@cat-factory/integrations 0.31.0 → 0.32.0

package/dist/modules/kubernetes/kubernetes.logic.js

@@ -0,0 +1,169 @@
+import { isCloudMetadataHost } from '@cat-factory/kernel';
+import { KUBERNETES_RUNNER_TOKEN_SECRET_KEY } from '@cat-factory/contracts';
+// Pure helpers for the native Kubernetes runner backend. No I/O here — URL
+// building, the per-run pod-name derivation, the pod manifest, and the readiness
+// classification are all pure so they unit-test in isolation. The transport
+// (KubernetesRunnerTransport) does the actual kube-apiserver `fetch`es.
+/**
+ * The secret-bundle key the Kubernetes backend reads the ServiceAccount token from.
+ * Re-exported from the wire contract (the single source of truth shared with the SPA
+ * connect form) so the key is defined once.
+ */
+export const KUBERNETES_TOKEN_KEY = KUBERNETES_RUNNER_TOKEN_SECRET_KEY;
+/** Default port the executor-harness HTTP server listens on inside the pod. */
+export const DEFAULT_HARNESS_PORT = 8080;
+/** Deterministic per-RUN pod name (one pod per run; steps re-attach to it). */
+export function podName(runId) {
+    const sanitized = runId
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    // RFC1123 label: <=63 chars, starts/ends alphanumeric. Reserve room for the prefix.
+    const body = sanitized.slice(0, 63 - 'cf-run-'.length).replace(/-+$/g, '') || 'run';
+    return `cf-run-${body}`;
+}
+/** kube-apiserver root with any trailing slash stripped. */
+export function apiBase(config) {
+    return config.apiServerUrl.trim().replace(/\/+$/, '');
+}
+/** Collection URL for pods in the configured namespace. */
+export function podsUrl(config) {
+    return `${apiBase(config)}/api/v1/namespaces/${config.namespace}/pods`;
+}
+/** A single pod's URL. */
+export function podUrl(config, name) {
+    return `${podsUrl(config)}/${encodeURIComponent(name)}`;
+}
+/**
+ * The apiserver POD-PROXY subresource URL for the pod's harness HTTP server:
+ * `…/pods/<name>:<port>/proxy<path>`. Reaching this requires only HTTPS to the
+ * apiserver (RBAC `pods/proxy`), so no in-cluster networking / per-run Service is
+ * needed. `path` must begin with `/`.
+ */
+export function proxyUrl(config, name, path) {
+    const port = config.harnessPort ?? DEFAULT_HARNESS_PORT;
+    const p = path.startsWith('/') ? path : `/${path}`;
+    // The apiserver pod-proxy subresource addresses the target as a literal
+    // `pods/<name>:<port>/proxy` path segment — kubectl/client-go send the colon
+    // UNENCODED. Encode the name (RFC1123, so a no-op in practice) but keep the
+    // `:<port>` literal so the apiserver parses the name:port pair.
+    return `${podsUrl(config)}/${encodeURIComponent(name)}:${port}/proxy${p}`;
+}
+/** Resolve the image variant a dispatch needs (the heavier UI image when asked + configured). */
+export function resolveImage(config, options) {
+    if (options?.image === 'ui' && config.imageUi)
+        return config.imageUi;
+    return config.image;
+}
+/** Resolve the pod resource block for a dispatch (per-size override, else the default). */
+export function resolveResources(config, options) {
+    const sizeOverride = options?.instanceSize
+        ? config.resourcesBySize?.[options.instanceSize]
+        : undefined;
+    // A per-size override is the t-shirt size for this run: it sets BOTH the request and
+    // the limit (requests == limits ⇒ Guaranteed QoS). Applying it to the limit alone
+    // while keeping a larger default request produces requests > limits, which the
+    // apiserver rejects with a 422 — so a smaller size could never start.
+    const requests = sizeOverride ?? config.resources?.requests;
+    const limits = sizeOverride ?? config.resources?.limits;
+    const out = {};
+    if (requests)
+        out.requests = quantities(requests);
+    if (limits)
+        out.limits = quantities(limits);
+    return out.requests || out.limits ? out : undefined;
+}
+function quantities(q) {
+    const out = {};
+    if (q.cpu)
+        out.cpu = q.cpu;
+    if (q.memory)
+        out.memory = q.memory;
+    return out;
+}
+/**
+ * Build the bare-Pod manifest for a run. A bare Pod (not a Job) because the harness
+ * is a long-lived HTTP server we own the lifecycle of (create on first dispatch,
+ * delete on release) — Job completion semantics would fight that. The pod is
+ * reachable ONLY through the apiserver pod-proxy (no Service), so the harness needs
+ * no inbound shared secret here: access is gated by the SA's `pods/proxy` RBAC.
+ */
+export function buildPodManifest(config, runId, name, options) {
+    const port = config.harnessPort ?? DEFAULT_HARNESS_PORT;
+    const resources = resolveResources(config, options);
+    const container = {
+        name: 'executor',
+        image: resolveImage(config, options),
+        ports: [{ containerPort: port }],
+        env: [{ name: 'PORT', value: String(port) }],
+        ...(resources ? { resources } : {}),
+    };
+    const spec = {
+        restartPolicy: 'Never',
+        containers: [container],
+        ...(config.serviceAccountName ? { serviceAccountName: config.serviceAccountName } : {}),
+        ...(config.imagePullSecretName
+            ? { imagePullSecrets: [{ name: config.imagePullSecretName }] }
+            : {}),
+        ...(config.nodeSelector ? { nodeSelector: config.nodeSelector } : {}),
+        ...(config.tolerations ? { tolerations: config.tolerations } : {}),
+    };
+    return {
+        apiVersion: 'v1',
+        kind: 'Pod',
+        metadata: {
+            name,
+            namespace: config.namespace,
+            labels: { 'cat-factory.runId': labelValue(runId), ...config.labels },
+            ...(config.annotations ? { annotations: config.annotations } : {}),
+        },
+        spec,
+    };
+}
+/** Coerce an arbitrary id into a valid label value (<=63 chars, alnum/._-). */
+function labelValue(value) {
+    return value
+        .replace(/[^A-Za-z0-9._-]/g, '-')
+        .replace(/^[^A-Za-z0-9]+|[^A-Za-z0-9]+$/g, '')
+        .slice(0, 63);
+}
+/** Classify a pod's status JSON: ready to serve, still pending, or terminally gone. */
+export function classifyPodReadiness(pod) {
+    const status = pod?.status;
+    const phase = typeof status?.phase === 'string' ? status.phase : undefined;
+    if (phase === 'Succeeded' || phase === 'Failed')
+        return 'gone';
+    if (phase !== 'Running')
+        return 'pending';
+    const conditions = Array.isArray(status?.conditions)
+        ? status.conditions
+        : [];
+    const ready = conditions.find((c) => c.type === 'Ready');
+    return ready?.status === 'True' ? 'ready' : 'pending';
+}
+/**
+ * Validate the apiserver URL at the write boundary. Unlike the manifest pool's
+ * STRICT policy (no private hosts), a kube-apiserver is routinely a private IP or
+ * a cluster DNS name, so private hosts are ALLOWED here — the operator is
+ * explicitly pointing at their cluster. We still require https and reject the
+ * cloud-metadata endpoints (anti-SSRF), including their obfuscated IP encodings
+ * (bare integer, IPv4-mapped IPv6) and the full link-local range — see the shared
+ * {@link isCloudMetadataHost} classifier.
+ */
+export function assertApiServerUrlSafe(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`Invalid Kubernetes apiserver URL: ${rawUrl}`);
+    }
+    if (url.protocol !== 'https:') {
+        throw new Error('Kubernetes apiserver URL must use https.');
+    }
+    if (isCloudMetadataHost(url.hostname)) {
+        throw new Error('Kubernetes apiserver URL must not target the cloud metadata endpoint.');
+    }
+}
+//# sourceMappingURL=kubernetes.logic.js.map

package/dist/modules/kubernetes/kubernetes.logic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.logic.js","sourceRoot":"","sources":["../../../src/modules/kubernetes/kubernetes.logic.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAA;AAE3E,2EAA2E;AAC3E,iFAAiF;AACjF,4EAA4E;AAC5E,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kCAAkC,CAAA;AAEtE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAExC,+EAA+E;AAC/E,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,SAAS,GAAG,KAAK;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC1B,oFAAoF;IACpF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,CAAA;IACnF,OAAO,UAAU,IAAI,EAAE,CAAA;AACzB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,OAAO,CAAC,MAA8B;IACpD,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACvD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,OAAO,CAAC,MAA8B;IACpD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,SAAS,OAAO,CAAA;AACxE,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,MAAM,CAAC,MAA8B,EAAE,IAAY;IACjE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAA;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,MAA8B,EAAE,IAAY,EAAE,IAAY;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAA;IACvD,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;IAClD,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,gEAAgE;IAChE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAA;AAC3E,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAC1B,MAA8B,EAC9B,OAA+B;IAE/B,IAAI,OAAO,EAAE,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAA;IACpE,OAAO,MAAM,CAAC,KAAK,CAAA;AACrB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAC9B,MAA8B,EAC9B,OAA+B;IAE/B,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY;QACxC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;QAChD,CAAC,CAAC,SAAS,CAAA;IACb,qFAAqF;IACrF,kFAAkF;IAClF,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,YAAY,IAAI,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAA;IAC3D,MAAM,MAAM,GAAG,YAAY,IAAI,MAAM,CAAC,SAAS,EAAE,MAAM,CAAA;IACvD,MAAM,GAAG,GAA2E,EAAE,CAAA;IACtF,IAAI,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjD,IAAI,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAC3C,OAAO,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,CAAoC;IACtD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,IAAI,CAAC,CAAC,GAAG;QAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAA;IAC1B,IAAI,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAA;IACnC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA8B,EAC9B,KAAa,EACb,IAAY,EACZ,OAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAA;IACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,SAAS,GAA4B;QACzC,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC;QACpC,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAChC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAA;IACD,MAAM,IAAI,GAA4B;QACpC,aAAa,EAAE,OAAO;QACtB,UAAU,EAAE,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,MAAM,CAAC,mBAAmB;YAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAA;IACD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE;YACR,IAAI;YACJ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,EAAE,mBAAmB,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;YACpE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI;KACL,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,OAAO,CAAC,gCAAgC,EAAE,EAAE,CAAC;SAC7C,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACjB,CAAC;AAKD,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,MAAM,GAAI,GAAmD,EAAE,MAAM,CAAA;IAC3E,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAA;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC;QAClD,CAAC,CAAE,MAAM,CAAC,UAA6C;QACvD,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;IACxD,OAAO,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;AACH,CAAC"}

package/dist/modules/runners/RunnerPoolConnectionService.d.ts

@@ -1,57 +1,69 @@
 import type { Clock } from '@cat-factory/kernel';
 import type { RunnerPoolConnectionRecord, RunnerPoolConnectionRepository } from '@cat-factory/kernel';
 import type { SecretCipher } from '@cat-factory/kernel';
-import type { SecretResolver, UrlSafetyPolicy } from '@cat-factory/kernel';
-import type { ConnectionTestResult, ProviderDescriptor, RunnerPoolConnection, RunnerPoolManifest, RunnerPoolProvider, TestRunnerPoolConnectionInput } from '@cat-factory/kernel';
+import type { UrlSafetyPolicy } from '@cat-factory/kernel';
+import type { ConnectionTestResult, ProviderDescriptor, RunnerBackendConfig, RunnerPoolConnection, RunnerPoolProvider, RunnerTransport, TestRunnerPoolConnectionInput } from '@cat-factory/kernel';
 import type { WorkspaceRepository } from '@cat-factory/kernel';
 export interface RunnerPoolConnectionServiceDependencies {
     runnerPoolConnectionRepository: RunnerPoolConnectionRepository;
     workspaceRepository: WorkspaceRepository;
     secretCipher: SecretCipher;
     clock: Clock;
-    /** URL/host safety policy applied to a registered manifest. Defaults to strict. */
+    /** URL/host safety policy applied to a manifest backend. Defaults to strict. */
     urlPolicy?: UrlSafetyPolicy;
-    /** The injected pool provider, so the service can surface describe/test to the UI. */
+    /**
+     * Whether this deployment runtime can honor a backend's custom TLS trust material
+     * (a private CA / insecure-skip). The Cloudflare Worker cannot, so it sets `false`
+     * and a Kubernetes config with a CA is rejected at registration. Absent ⇒ supported.
+     */
+    customTlsSupported?: boolean;
+    /** Injected manifest HTTP provider (its OAuth cache shared / a native pool adapter). */
     runnerPoolProvider?: RunnerPoolProvider;
-    /** What the injected provider is (see EnvironmentConnectionService). Defaults `manifest`. */
-    providerKind?: 'native' | 'manifest';
-    providerId?: string;
-    providerLabel?: string;
 }
-export interface ResolvedRunnerPool {
-    manifest: RunnerPoolManifest;
-    resolveSecret: SecretResolver;
+/** A resolved runner backend: the live transport + its identity (for provisioning logs). */
+export interface ResolvedRunnerBackend {
+    transport: RunnerTransport;
+    kind: string;
+    providerId: string;
 }
 export declare class RunnerPoolConnectionService {
     private readonly deps;
     constructor(deps: RunnerPoolConnectionServiceDependencies);
-    /** Register (or replace) a workspace's runner pool. */
+    /** The per-call context a backend provider needs to build/test a transport. */
+    private context;
+    private provider;
+    /** The write-boundary safety options (URL policy + this runtime's TLS capability). */
+    private safetyOptions;
+    /** Register (or replace) a workspace's runner backend. */
     register(workspaceId: string, input: {
-        manifest: RunnerPoolManifest;
+        config: RunnerBackendConfig;
         secrets: Record<string, string>;
     }): Promise<RunnerPoolConnection>;
-    /** Rotate/replace the secret bundle without re-sending the manifest. */
+    /** Rotate/replace the secret bundle without re-sending the config. */
     updateSecrets(workspaceId: string, secrets: Record<string, string>): Promise<RunnerPoolConnection>;
-    /** Describe the pool provider's config fields + test availability for the UI. */
+    /** Describe the backend's config fields + test availability for the UI. */
     describeProvider(workspaceId: string): Promise<ProviderDescriptor>;
-    /** Probe a candidate pool connection before saving (nothing is persisted). */
+    /** Probe a candidate backend connection before saving (nothing is persisted). */
     testConnection(workspaceId: string, input: TestRunnerPoolConnectionInput): Promise<ConnectionTestResult>;
     /** The workspace's current connection (safe metadata), or null. */
     getConnection(workspaceId: string): Promise<RunnerPoolConnection | null>;
-    /** Resolve the live connection + parsed manifest, or throw if not registered. */
+    /** Resolve the live connection + parsed config, or throw if not registered. */
     requireConnection(workspaceId: string): Promise<{
         record: RunnerPoolConnectionRecord;
-        manifest: RunnerPoolManifest;
+        config: RunnerBackendConfig;
     }>;
     /**
-     * Resolve the workspace's pool (parsed manifest + a secret resolver over its
-     * decrypted bundle), or null when it has no live pool registered. Used by the
-     * container executor to pick the self-hosted runner backend per job.
+     * Resolve the workspace's runner backend into a live {@link RunnerTransport} (the
+     * provider builds it from the stored config + a secret resolver over its decrypted
+     * bundle), or null when it has no live backend registered / its kind is no longer
+     * registered. Used by the wiring to pick the dispatch backend per job.
      */
-    resolve(workspaceId: string): Promise<ResolvedRunnerPool | null>;
-    /** Unregister the pool (tombstones the binding). */
+    resolve(workspaceId: string): Promise<ResolvedRunnerBackend | null>;
+    /** Unregister the backend (tombstones the binding). */
     unregister(workspaceId: string): Promise<void>;
     private decryptSecrets;
     private toConnection;
+    /** Parse the stored discriminated config, tolerating a malformed/legacy blob. */
+    private parseConfig;
 }
 //# sourceMappingURL=RunnerPoolConnectionService.d.ts.map

package/dist/modules/runners/RunnerPoolConnectionService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RunnerPoolConnectionService.d.ts","sourceRoot":"","sources":["../../../src/modules/runners/RunnerPoolConnectionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EACV,0BAA0B,EAC1B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAU9D,MAAM,WAAW,uCAAuC;IACtD,8BAA8B,EAAE,8BAA8B,CAAA;IAC9D,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,mFAAmF;IACnF,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,6FAA6F;IAC7F,YAAY,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAA;IACpC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,aAAa,EAAE,cAAc,CAAA;CAC9B;AAED,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,uCAAuC,EAAI;IAE9E,uDAAuD;IACjD,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACvE,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;IAED,wEAAwE;IAClE,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAU/B;IAED,iFAAiF;IAC3E,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyBvE;IAED,8EAA8E;IACxE,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAe/B;IAED,mEAAmE;IAC7D,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAK7E;IAED,iFAAiF;IAC3E,iBAAiB,CACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,0BAA0B,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE,CAAC,CAO/E;IAED;;;;OAIG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAMrE;IAED,oDAAoD;IAC9C,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAInD;YAEa,cAAc;IAQ5B,OAAO,CAAC,YAAY;CAYrB"}
+{"version":3,"file":"RunnerPoolConnectionService.d.ts","sourceRoot":"","sources":["../../../src/modules/runners/RunnerPoolConnectionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EACV,0BAA0B,EAC1B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,6BAA6B,EAC9B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAiB9D,MAAM,WAAW,uCAAuC;IACtD,8BAA8B,EAAE,8BAA8B,CAAA;IAC9D,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,gFAAgF;IAChF,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,eAAe,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,uCAAuC,EAAI;IAE9E,+EAA+E;IAC/E,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,QAAQ;IAMhB,sFAAsF;IACtF,OAAO,CAAC,aAAa;IASrB,0DAA0D;IACpD,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAE,MAAM,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACtE,OAAO,CAAC,oBAAoB,CAAC,CA2B/B;IAED,sEAAsE;IAChE,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAW/B;IAED,2EAA2E;IACrE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6BvE;IAED,iFAAiF;IAC3E,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAU/B;IAED,mEAAmE;IAC7D,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAK7E;IAED,+EAA+E;IACzE,iBAAiB,CACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,0BAA0B,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAO9E;IAED;;;;;OAKG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAYxE;IAED,uDAAuD;IACjD,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAInD;YAEa,cAAc;IAQ5B,OAAO,CAAC,YAAY;IAmBpB,iFAAiF;IACjF,OAAO,CAAC,WAAW;CAOpB"}

package/dist/modules/runners/RunnerPoolConnectionService.js

@@ -1,29 +1,55 @@
-import { ConflictError, STRICT_URL_SAFETY_POLICY, ValidationError } from '@cat-factory/kernel';
+import { ConflictError, ValidationError } from '@cat-factory/kernel';
 import { requireWorkspace } from '@cat-factory/kernel';
 import { missingRequiredConfigKeys } from '../environments/environments.logic.js';
-import { assertManifestUrlsSafe, referencedSecretKeys } from './runners.logic.js';
+import { runnerBackend } from './runner-backends.js';
 export class RunnerPoolConnectionService {
     deps;
     constructor(deps) {
         this.deps = deps;
     }
-    /** Register (or replace) a workspace's runner pool. */
+    /** The per-call context a backend provider needs to build/test a transport. */
+    context(resolveSecret) {
+        return {
+            resolveSecret,
+            ...(this.deps.urlPolicy ? { urlPolicy: this.deps.urlPolicy } : {}),
+            ...(this.deps.runnerPoolProvider ? { runnerPoolProvider: this.deps.runnerPoolProvider } : {}),
+        };
+    }
+    provider(kind) {
+        const provider = runnerBackend(kind);
+        if (!provider)
+            throw new ValidationError(`Unknown runner backend kind: '${kind}'`);
+        return provider;
+    }
+    /** The write-boundary safety options (URL policy + this runtime's TLS capability). */
+    safetyOptions() {
+        return {
+            ...(this.deps.urlPolicy ? { urlPolicy: this.deps.urlPolicy } : {}),
+            ...(this.deps.customTlsSupported !== undefined
+                ? { customTlsSupported: this.deps.customTlsSupported }
+                : {}),
+        };
+    }
+    /** Register (or replace) a workspace's runner backend. */
     async register(workspaceId, input) {
         await requireWorkspace(this.deps.workspaceRepository, workspaceId);
-        const manifest = input.manifest;
-        assertManifestUrlsSafe(manifest, this.deps.urlPolicy ?? STRICT_URL_SAFETY_POLICY);
-        const missing = referencedSecretKeys(manifest).filter((key) => !(key in input.secrets));
+        const config = input.config;
+        const provider = this.provider(config.kind);
+        provider.assertConfigSafe(config, this.safetyOptions());
+        const missing = provider.referencedSecretKeys(config).filter((key) => !(key in input.secrets));
         if (missing.length) {
             throw new ValidationError(`Missing secret values for: ${missing.join(', ')}`);
         }
         const existing = await this.deps.runnerPoolConnectionRepository.getByWorkspace(workspaceId);
+        const meta = provider.connectionMeta(config);
         const secretsCipher = await this.deps.secretCipher.encrypt(JSON.stringify(input.secrets));
         const record = {
             workspaceId,
-            providerId: manifest.providerId,
-            label: manifest.label,
-            baseUrl: manifest.baseUrl,
-            manifestJson: JSON.stringify(manifest),
+            kind: config.kind,
+            providerId: meta.providerId,
+            label: meta.label,
+            baseUrl: meta.baseUrl,
+            configJson: JSON.stringify(config),
             secretsCipher,
             createdAt: existing?.createdAt ?? this.deps.clock.now(),
             deletedAt: null,
@@ -31,10 +57,11 @@ export class RunnerPoolConnectionService {
         await this.deps.runnerPoolConnectionRepository.upsert(record);
         return this.toConnection(record, Object.keys(input.secrets));
     }
-    /** Rotate/replace the secret bundle without re-sending the manifest. */
+    /** Rotate/replace the secret bundle without re-sending the config. */
     async updateSecrets(workspaceId, secrets) {
-        const { record, manifest } = await this.requireConnection(workspaceId);
-        const missing = referencedSecretKeys(manifest).filter((key) => !(key in secrets));
+        const { record, config } = await this.requireConnection(workspaceId);
+        const provider = this.provider(record.kind);
+        const missing = provider.referencedSecretKeys(config).filter((key) => !(key in secrets));
         if (missing.length) {
             throw new ValidationError(`Missing secret values for: ${missing.join(', ')}`);
         }
@@ -43,50 +70,47 @@ export class RunnerPoolConnectionService {
         await this.deps.runnerPoolConnectionRepository.upsert(updated);
         return this.toConnection(updated, Object.keys(secrets));
     }
-    /** Describe the pool provider's config fields + test availability for the UI. */
+    /** Describe the backend's config fields + test availability for the UI. */
     async describeProvider(workspaceId) {
         const record = await this.deps.runnerPoolConnectionRepository.getByWorkspace(workspaceId);
-        const manifest = record ? JSON.parse(record.manifestJson) : undefined;
-        const configFields = this.deps.runnerPoolProvider?.describeConfig?.(manifest) ?? [];
-        // A runner-pool manifest has no `providerConfig` bag, so the stored values are the secret
-        // bundle keys plus `baseUrl` when the manifest carries one. The latter mirrors the connect
-        // form's write path (a `baseUrl` field lands on the manifest's `baseUrl`, not the secret
-        // bundle) — without it a `required` baseUrl field would never clear `missingRequired`.
+        const config = record ? JSON.parse(record.configJson) : undefined;
+        // The manifest backend renders a flat field form (its secret-ref keys + baseUrl);
+        // the native (kubernetes) backend uses an explicit UI form, so it has no flat fields.
+        const manifest = config?.kind === 'manifest' ? config.manifest : undefined;
+        const configFields = manifest
+            ? (this.deps.runnerPoolProvider?.describeConfig?.(manifest) ?? [])
+            : [];
         const storedKeys = record ? Object.keys(await this.decryptSecrets(record)) : [];
         if (manifest?.baseUrl)
             storedKeys.push('baseUrl');
         const provider = this.deps.runnerPoolProvider;
         return {
-            providerId: this.deps.providerId ?? manifest?.providerId ?? 'http',
-            label: this.deps.providerLabel ?? manifest?.label ?? 'Custom HTTP pool',
-            kind: this.deps.providerKind ?? 'manifest',
+            providerId: record?.providerId ?? 'http',
+            label: record?.label ?? 'Agent runner backend',
+            // `kind` here is the UI FORM-STYLE discriminator (manifest editor vs native flat
+            // form), not the runner-backend kind: only the manifest backend uses this
+            // descriptor-driven form, so it stays 'manifest'. The actual backend kind is
+            // surfaced on the connection (`connection.kind` + the non-secret `config`), which
+            // is what the tab's backend selector + the Kubernetes form read.
+            kind: 'manifest',
             configFields,
-            supportsTest: typeof provider?.testConnection === 'function',
+            supportsTest: true,
             missingRequired: missingRequiredConfigKeys(configFields, storedKeys),
-            // The current saved manifest (non-secret), so the native connect form overlays edits
-            // onto the real stored manifest instead of the bare scaffold (mirrors the env service).
             ...(manifest ? { savedManifest: manifest } : {}),
-            ...(provider?.describeManifestTemplate
+            ...(manifest && provider?.describeManifestTemplate
                 ? { manifestTemplate: provider.describeManifestTemplate() }
                 : {}),
         };
     }
-    /** Probe a candidate pool connection before saving (nothing is persisted). */
+    /** Probe a candidate backend connection before saving (nothing is persisted). */
     async testConnection(workspaceId, input) {
         await requireWorkspace(this.deps.workspaceRepository, workspaceId);
-        const provider = this.deps.runnerPoolProvider;
-        if (!provider?.testConnection) {
-            return { ok: true, message: 'This pool provider has no connection test.' };
-        }
-        if (input.manifest) {
-            assertManifestUrlsSafe(input.manifest, this.deps.urlPolicy ?? STRICT_URL_SAFETY_POLICY);
-        }
+        if (!input.config)
+            return { ok: true, message: 'Nothing to test.' };
+        const provider = this.provider(input.config.kind);
+        provider.assertConfigSafe(input.config, this.safetyOptions());
         const secrets = input.secrets ?? {};
-        return provider.testConnection({
-            manifest: input.manifest,
-            config: input.config ?? {},
-            resolveSecret: (key) => secrets[key],
-        });
+        return provider.testConnection(input.config, this.context((key) => secrets[key]));
     }
     /** The workspace's current connection (safe metadata), or null. */
     async getConnection(workspaceId) {
@@ -96,29 +120,34 @@ export class RunnerPoolConnectionService {
         const keys = Object.keys(await this.decryptSecrets(record));
         return this.toConnection(record, keys);
     }
-    /** Resolve the live connection + parsed manifest, or throw if not registered. */
+    /** Resolve the live connection + parsed config, or throw if not registered. */
     async requireConnection(workspaceId) {
         const record = await this.deps.runnerPoolConnectionRepository.getByWorkspace(workspaceId);
         if (!record) {
-            throw new ConflictError(`Workspace '${workspaceId}' has no runner pool registered`);
+            throw new ConflictError(`Workspace '${workspaceId}' has no runner backend registered`);
         }
-        const manifest = JSON.parse(record.manifestJson);
-        return { record, manifest };
+        const config = JSON.parse(record.configJson);
+        return { record, config };
     }
     /**
-     * Resolve the workspace's pool (parsed manifest + a secret resolver over its
-     * decrypted bundle), or null when it has no live pool registered. Used by the
-     * container executor to pick the self-hosted runner backend per job.
+     * Resolve the workspace's runner backend into a live {@link RunnerTransport} (the
+     * provider builds it from the stored config + a secret resolver over its decrypted
+     * bundle), or null when it has no live backend registered / its kind is no longer
+     * registered. Used by the wiring to pick the dispatch backend per job.
      */
     async resolve(workspaceId) {
         const record = await this.deps.runnerPoolConnectionRepository.getByWorkspace(workspaceId);
         if (!record)
             return null;
-        const manifest = JSON.parse(record.manifestJson);
+        const provider = runnerBackend(record.kind);
+        if (!provider)
+            return null;
+        const config = JSON.parse(record.configJson);
         const bundle = await this.decryptSecrets(record);
-        return { manifest, resolveSecret: (key) => bundle[key] };
+        const transport = provider.buildTransport(config, this.context((key) => bundle[key]));
+        return { transport, kind: record.kind, providerId: record.providerId };
     }
-    /** Unregister the pool (tombstones the binding). */
+    /** Unregister the backend (tombstones the binding). */
     async unregister(workspaceId) {
         const record = await this.deps.runnerPoolConnectionRepository.getByWorkspace(workspaceId);
         if (!record)
@@ -132,13 +161,28 @@ export class RunnerPoolConnectionService {
         return parsed && typeof parsed === 'object' ? parsed : {};
     }
     toConnection(record, secretKeys) {
+        // The stored config holds NO secrets (those live in the separate encrypted bundle),
+        // so it is safe to expose so the connect form can prefill the non-secret fields on
+        // edit (namespace/image/… for kubernetes) instead of forcing a full re-entry.
+        const config = this.parseConfig(record);
         return {
+            kind: record.kind,
             providerId: record.providerId,
             label: record.label,
             baseUrl: record.baseUrl,
             connectedAt: record.createdAt,
             secretKeys,
+            ...(config ? { config } : {}),
         };
     }
+    /** Parse the stored discriminated config, tolerating a malformed/legacy blob. */
+    parseConfig(record) {
+        try {
+            return JSON.parse(record.configJson);
+        }
+        catch {
+            return undefined;
+        }
+    }
 }
 //# sourceMappingURL=RunnerPoolConnectionService.js.map

package/dist/modules/runners/RunnerPoolConnectionService.js.map

@@ -1 +1 @@
-{"version":3,"file":"RunnerPoolConnectionService.js","sourceRoot":"","sources":["../../../src/modules/runners/RunnerPoolConnectionService.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAA;AACjF,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AA4BjF,MAAM,OAAO,2BAA2B;IACT,IAAI;IAAjC,YAA6B,IAA6C;oBAA7C,IAAI;IAA4C,CAAC;IAE9E,uDAAuD;IACvD,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,KAAwE;QAExE,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAC/B,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC,CAAA;QAEjF,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACvF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAC3F,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACzF,MAAM,MAAM,GAA+B;YACzC,WAAW;YACX,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACtC,aAAa;YACb,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACvD,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,OAA+B;QAE/B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACtE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAA;QACjF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QACnF,MAAM,OAAO,GAA+B,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,CAAA;QACxE,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9D,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAwB,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7F,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QACnF,0FAA0F;QAC1F,2FAA2F;QAC3F,yFAAyF;QACzF,uFAAuF;QACvF,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/E,IAAI,QAAQ,EAAE,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAA;QAC7C,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,EAAE,UAAU,IAAI,MAAM;YAClE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,EAAE,KAAK,IAAI,kBAAkB;YACvE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU;YAC1C,YAAY;YACZ,YAAY,EAAE,OAAO,QAAQ,EAAE,cAAc,KAAK,UAAU;YAC5D,eAAe,EAAE,yBAAyB,CAAC,YAAY,EAAE,UAAU,CAAC;YACpE,qFAAqF;YACrF,wFAAwF;YACxF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAA8C,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,QAAQ,EAAE,wBAAwB;gBACpC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,wBAAwB,EAA6B,EAAE;gBACtF,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,KAAoC;QAEpC,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAA;QAC7C,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAA;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC,CAAA;QACzF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAA;QACnC,OAAO,QAAQ,CAAC,cAAc,CAAC;YAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;SACrC,CAAC,CAAA;IACJ,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,iBAAiB,CACrB,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CAAC,cAAc,WAAW,iCAAiC,CAAC,CAAA;QACrF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAuB,CAAA;QACtE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAuB,CAAA;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAChD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IAClE,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/F,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAAkC;QAElC,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,OAAO,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;QACrF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvF,CAAC;IAEO,YAAY,CAClB,MAAkC,EAClC,UAAoB;QAEpB,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,SAAS;YAC7B,UAAU;SACX,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"RunnerPoolConnectionService.js","sourceRoot":"","sources":["../../../src/modules/runners/RunnerPoolConnectionService.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAA;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAuCpD,MAAM,OAAO,2BAA2B;IACT,IAAI;IAAjC,YAA6B,IAA6C;oBAA7C,IAAI;IAA4C,CAAC;IAE9E,+EAA+E;IACvE,OAAO,CAAC,aAAkD;QAChE,OAAO;YACL,aAAa;YACb,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAA;IACH,CAAC;IAEO,QAAQ,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,iCAAiC,IAAI,GAAG,CAAC,CAAA;QAClF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,sFAAsF;IAC9E,aAAa;QACnB,OAAO;YACL,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,KAAuE;QAEvE,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3C,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;QAEvD,MAAM,OAAO,GAAG,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9F,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAC3F,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACzF,MAAM,MAAM,GAA+B;YACzC,WAAW;YACX,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAClC,aAAa;YACb,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACvD,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,OAA+B;QAE/B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAA;QACxF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QACnF,MAAM,OAAO,GAA+B,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,CAAA;QACxE,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9D,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAyB,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1F,kFAAkF;QAClF,sFAAsF;QACtF,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1E,MAAM,YAAY,GAAG,QAAQ;YAC3B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/E,IAAI,QAAQ,EAAE,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAA;QAC7C,OAAO;YACL,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,MAAM;YACxC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,sBAAsB;YAC9C,iFAAiF;YACjF,0EAA0E;YAC1E,6EAA6E;YAC7E,kFAAkF;YAClF,iEAAiE;YACjE,IAAI,EAAE,UAAU;YAChB,YAAY;YACZ,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,yBAAyB,CAAC,YAAY,EAAE,UAAU,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAA8C,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,QAAQ,IAAI,QAAQ,EAAE,wBAAwB;gBAChD,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,wBAAwB,EAA6B,EAAE;gBACtF,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,KAAoC;QAEpC,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAA;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjD,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;QAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAA;QACnC,OAAO,QAAQ,CAAC,cAAc,CAC5B,KAAK,CAAC,MAAM,EACZ,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CACpC,CAAA;IACH,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,iBAAiB,CACrB,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CAAC,cAAc,WAAW,oCAAoC,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAwB,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAwB,CAAA;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CACvC,MAAM,EACN,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACnC,CAAA;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAA;IACxE,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/F,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAAkC;QAElC,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,OAAO,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;QACrF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvF,CAAC;IAEO,YAAY,CAClB,MAAkC,EAClC,UAAoB;QAEpB,oFAAoF;QACpF,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACvC,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,SAAS;YAC7B,UAAU;YACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAA;IACH,CAAC;IAED,iFAAiF;IACzE,WAAW,CAAC,MAAkC;QACpD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAwB,CAAA;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;CACF"}

package/dist/modules/runners/runner-backends.d.ts

@@ -0,0 +1,51 @@
+import type { ConnectionTestResult, RunnerBackendConfig, RunnerPoolProvider, RunnerTransport, SecretResolver, UrlSafetyPolicy } from '@cat-factory/kernel';
+/** Per-call dependencies a provider may need to build/test its transport. */
+export interface RunnerBackendContext {
+    resolveSecret: SecretResolver;
+    /** Manifest SSRF policy (the Kubernetes backend does its own apiserver-URL check). */
+    urlPolicy?: UrlSafetyPolicy;
+    /**
+     * A shared manifest HTTP provider (its OAuth cache reused), injectable for tests
+     * and for native pool adapters. Used by the `manifest` backend only.
+     */
+    runnerPoolProvider?: RunnerPoolProvider;
+}
+/** Capabilities/policies a backend validates its config against at the write boundary. */
+export interface RunnerBackendSafetyOptions {
+    /** Manifest SSRF policy. Absent ⇒ strict. */
+    urlPolicy?: UrlSafetyPolicy;
+    /**
+     * Whether THIS deployment runtime can honor a backend's custom TLS trust material
+     * (a private CA / insecure-skip). The Cloudflare Worker cannot (no undici / no
+     * custom-CA fetch), so it sets this `false` and the kubernetes backend rejects such
+     * a config up front instead of letting it save and then die at first dispatch.
+     * Absent/`true` ⇒ supported (Node/local).
+     */
+    customTlsSupported?: boolean;
+}
+export interface RunnerBackendProvider {
+    readonly kind: RunnerBackendConfig['kind'];
+    /** Every secret-bundle key the config references (validated present at registration). */
+    referencedSecretKeys(config: RunnerBackendConfig): string[];
+    /** Non-secret metadata persisted on the connection row + shown in the UI. */
+    connectionMeta(config: RunnerBackendConfig): {
+        providerId: string;
+        label: string;
+        baseUrl: string;
+    };
+    /** Validate the config at the write boundary (SSRF / URL + runtime safety). Throws if unsafe. */
+    assertConfigSafe(config: RunnerBackendConfig, opts?: RunnerBackendSafetyOptions): void;
+    /** Build the live transport the execution engine dispatches/polls/releases through. */
+    buildTransport(config: RunnerBackendConfig, ctx: RunnerBackendContext): RunnerTransport;
+    /** Probe the backend without persisting anything. */
+    testConnection(config: RunnerBackendConfig, ctx: RunnerBackendContext): Promise<ConnectionTestResult>;
+}
+/** Register a runner-backend provider (built-ins on import; third-party for side effect). */
+export declare function registerRunnerBackend(provider: RunnerBackendProvider): void;
+/** The provider for a backend kind, or undefined when unregistered. */
+export declare function runnerBackend(kind: string): RunnerBackendProvider | undefined;
+/** All registered backend kinds (for diagnostics / a UI capabilities list). */
+export declare function registeredRunnerBackendKinds(): string[];
+export declare const manifestRunnerBackend: RunnerBackendProvider;
+export declare const kubernetesRunnerBackend: RunnerBackendProvider;
+//# sourceMappingURL=runner-backends.d.ts.map

package/dist/modules/runners/runner-backends.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-backends.d.ts","sourceRoot":"","sources":["../../../src/modules/runners/runner-backends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAqB5B,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,cAAc,CAAA;IAC7B,sFAAsF;IACtF,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,0FAA0F;AAC1F,MAAM,WAAW,0BAA0B;IACzC,6CAA6C;IAC7C,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC1C,yFAAyF;IACzF,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAAA;IAC3D,6EAA6E;IAC7E,cAAc,CAAC,MAAM,EAAE,mBAAmB,GAAG;QAC3C,UAAU,EAAE,MAAM,CAAA;QAClB,KAAK,EAAE,MAAM,CAAA;QACb,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,iGAAiG;IACjG,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IACtF,uFAAuF;IACvF,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,oBAAoB,GAAG,eAAe,CAAA;IACvF,qDAAqD;IACrD,cAAc,CACZ,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACjC;AAID,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAE3E;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAE7E;AAED,+EAA+E;AAC/E,wBAAgB,4BAA4B,IAAI,MAAM,EAAE,CAEvD;AASD,eAAO,MAAM,qBAAqB,EAAE,qBAmCnC,CAAA;AAID,eAAO,MAAM,uBAAuB,EAAE,qBAqCrC,CAAA"}