@cat-factory/integrations 0.34.0 → 0.35.0

package/dist/modules/kubernetes/KubernetesEnvironmentProvider.js

@@ -0,0 +1,250 @@
+import { KubernetesApiClient, safeText } from './KubernetesApiClient.js';
+import { apiBase, classifyDeploymentReadiness } from './kubernetes.logic.js';
+import { deriveUrl, extractLoadBalancerAddress, isManifestFile, namespaceUrl, parseKubernetesEnvConfig, parseManifests, resolveNamespace, resourceUrl, templateVars, } from './kubernetes-environment.logic.js';
+// Native Kubernetes ephemeral-environment provider. It applies an operator-authored
+// set of k3s/Kubernetes manifests (read from the PR repo or a separate repo) into a
+// per-PR namespace via the apiserver, using the SAME KubernetesApiClient (bearer
+// token + custom-CA TLS) as the runner backend. Per-PR isolation means provisioning
+// is idempotent (server-side apply) and teardown is a single namespace delete.
+//
+// The per-workspace config rides the stored manifest's `providerConfig` bag (parsed +
+// validated here); the apiserver token is the `apiToken` secret. The provider is a
+// stateless singleton — every call re-derives the client from the manifest, so one
+// instance serves every workspace.
+const APPLY_TIMEOUT_MS = 30_000;
+const READ_TIMEOUT_MS = 30_000;
+const FIELD_MANAGER = 'cat-factory';
+export class KubernetesEnvironmentProvider {
+    options;
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async provision(req) {
+        const config = parseKubernetesEnvConfig(req.manifest);
+        const client = new KubernetesApiClient(config, req.resolveSecret);
+        const inputs = req.inputs;
+        const namespace = resolveNamespace(config, inputs);
+        const image = config.imageTemplate ? renderImage(config.imageTemplate, inputs) : undefined;
+        const vars = templateVars(inputs, namespace, image);
+        await this.ensureNamespace(client, config, namespace);
+        const texts = await this.readManifests(req, config);
+        const resources = [];
+        for (const text of texts) {
+            resources.push(...parseManifests(text, vars, namespace, inputs.blockId, config.labels));
+        }
+        if (resources.length === 0) {
+            throw new Error('No Kubernetes manifests were found at the configured source path');
+        }
+        for (const resource of resources) {
+            await this.apply(client, config, namespace, resource);
+        }
+        // For an ingress-template URL the address is known immediately; status-backed
+        // sources resolve to null until `status()` reads the live LoadBalancer address.
+        const url = deriveUrl(config.url, vars, null);
+        return {
+            externalId: namespace,
+            url,
+            status: 'provisioning',
+            expiresAt: null,
+            access: null,
+            // Persist the FULL template var set (not just namespace/branch): `status()`
+            // re-derives an ingress-template URL from these, so dropping e.g. `{{pullNumber}}`
+            // / `{{image}}` here would silently corrupt a previously-correct URL on the next
+            // status poll. The vars are non-secret PR/repo context.
+            fields: { ...vars },
+        };
+    }
+    async status(req) {
+        const config = parseKubernetesEnvConfig(req.manifest);
+        const namespace = req.provisionFields.namespace ?? req.externalId;
+        if (!namespace) {
+            return {
+                externalId: null,
+                url: null,
+                status: 'failed',
+                expiresAt: null,
+                access: null,
+                fields: {},
+            };
+        }
+        const client = new KubernetesApiClient(config, req.resolveSecret);
+        const status = await this.deploymentStatus(client, config, namespace);
+        const url = await this.resolveLiveUrl(client, config, namespace, req.provisionFields);
+        return {
+            externalId: namespace,
+            url,
+            status,
+            expiresAt: null,
+            access: null,
+            fields: req.provisionFields,
+        };
+    }
+    async teardown(req) {
+        const config = parseKubernetesEnvConfig(req.manifest);
+        const namespace = req.provisionFields.namespace ?? req.externalId;
+        if (!namespace)
+            return { status: 'torn_down' };
+        const client = new KubernetesApiClient(config, req.resolveSecret);
+        const res = await client.fetch('DELETE', namespaceUrl(config, namespace), undefined, APPLY_TIMEOUT_MS);
+        // 404 ⇒ already gone (idempotent). 409 ⇒ a delete is already in flight.
+        if (!res.ok && res.status !== 404 && res.status !== 409) {
+            throw new Error(`Failed to delete namespace '${namespace}' (HTTP ${res.status}): ${await safeText(res)}`);
+        }
+        return { status: 'torn_down' };
+    }
+    async testConnection(req) {
+        if (!req.manifest)
+            return { ok: false, message: 'Expected a Kubernetes environment manifest.' };
+        let config;
+        try {
+            config = parseKubernetesEnvConfig(req.manifest);
+        }
+        catch (err) {
+            return { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+        const client = new KubernetesApiClient(config, req.resolveSecret);
+        try {
+            const res = await client.fetch('GET', `${namespaceUrl(config)}?limit=1`, undefined, READ_TIMEOUT_MS);
+            if (res.ok)
+                return { ok: true, message: `Reached ${apiBase(config)}.` };
+            return { ok: false, message: `apiserver responded ${res.status}: ${await safeText(res)}` };
+        }
+        catch (err) {
+            return { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    describeConfig() {
+        // The structured fields (apiserver URL, namespace template, manifest source, URL
+        // source) are collected by the bespoke Kubernetes connect form; the only secret is
+        // the ServiceAccount token, surfaced here so the unconfigured banner can clear.
+        return [{ key: 'apiToken', label: 'ServiceAccount token', secret: true, required: true }];
+    }
+    // --- internals ----------------------------------------------------------
+    async ensureNamespace(client, config, namespace) {
+        const body = {
+            apiVersion: 'v1',
+            kind: 'Namespace',
+            metadata: {
+                name: namespace,
+                ...(config.labels ? { labels: config.labels } : {}),
+                ...(config.annotations ? { annotations: config.annotations } : {}),
+            },
+        };
+        const res = await client.fetch('POST', namespaceUrl(config), body, APPLY_TIMEOUT_MS);
+        if (res.ok || res.status === 409)
+            return; // 409 AlreadyExists ⇒ idempotent
+        throw new Error(`Failed to create namespace '${namespace}' (HTTP ${res.status}): ${await safeText(res)}`);
+    }
+    async apply(client, config, namespace, resource) {
+        const name = resource.metadata.name;
+        const url = `${resourceUrl(config, resource.apiVersion, resource.kind, namespace, name)}?fieldManager=${FIELD_MANAGER}&force=true`;
+        const res = await client.fetch('PATCH', url, JSON.stringify(resource), APPLY_TIMEOUT_MS, 'application/apply-patch+json');
+        if (!res.ok) {
+            throw new Error(`Failed to apply ${resource.kind}/${name} (HTTP ${res.status}): ${await safeText(res)}`);
+        }
+    }
+    /** Aggregate the namespace's Deployments into one lifecycle verdict. */
+    async deploymentStatus(client, config, namespace) {
+        const res = await client.fetch('GET', resourceUrl(config, 'apps/v1', 'Deployment', namespace), undefined, READ_TIMEOUT_MS);
+        if (res.status === 404)
+            return 'failed';
+        if (!res.ok)
+            return 'provisioning';
+        const body = (await res.json());
+        const items = Array.isArray(body.items) ? body.items : [];
+        if (items.length === 0)
+            return 'ready'; // nothing to roll out (e.g. a static Service)
+        let anyPending = false;
+        for (const item of items) {
+            const readiness = classifyDeploymentReadiness(item);
+            if (readiness === 'gone')
+                return 'failed';
+            if (readiness !== 'ready')
+                anyPending = true;
+        }
+        return anyPending ? 'provisioning' : 'ready';
+    }
+    /** Resolve the live URL, reading the LoadBalancer address for status-backed sources. */
+    async resolveLiveUrl(client, config, namespace, fields) {
+        const url = config.url;
+        const vars = { ...fields, namespace };
+        if (url.source === 'ingressTemplate')
+            return deriveUrl(url, vars, null);
+        const address = await this.readLoadBalancerAddress(client, config, namespace);
+        return address ? deriveUrl(url, vars, address) : null;
+    }
+    /**
+     * Read the LoadBalancer address backing a status source: the named Service/Ingress, or
+     * — when `ingressStatus` omits the name — the single Ingress applied in the namespace
+     * (the schema/UI documents "absent ⇒ the only Ingress applied"). Null until assigned.
+     */
+    async readLoadBalancerAddress(client, config, namespace) {
+        const url = config.url;
+        if (url.source === 'serviceStatus') {
+            const res = await client.fetch('GET', resourceUrl(config, 'v1', 'Service', namespace, url.serviceName), undefined, READ_TIMEOUT_MS);
+            return res.ok ? extractLoadBalancerAddress(await res.json()) : null;
+        }
+        // ingressTemplate is resolved by the caller; only ingressStatus reaches here.
+        if (url.source !== 'ingressStatus')
+            return null;
+        // ingressStatus: a named Ingress, else the only Ingress in the namespace.
+        if (url.ingressName) {
+            const res = await client.fetch('GET', resourceUrl(config, 'networking.k8s.io/v1', 'Ingress', namespace, url.ingressName), undefined, READ_TIMEOUT_MS);
+            return res.ok ? extractLoadBalancerAddress(await res.json()) : null;
+        }
+        const res = await client.fetch('GET', resourceUrl(config, 'networking.k8s.io/v1', 'Ingress', namespace), undefined, READ_TIMEOUT_MS);
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const items = Array.isArray(body.items) ? body.items : [];
+        if (items.length === 0)
+            return null;
+        return extractLoadBalancerAddress(items[0]);
+    }
+    /** Read the manifest file(s) from the configured source (co-located or separate repo). */
+    async readManifests(req, config) {
+        const source = config.manifestSource;
+        let ctx;
+        let ref;
+        if (source.type === 'colocated') {
+            ctx = req.runRepo ?? null;
+            if (!ctx) {
+                throw new Error('Co-located manifests require the run repo (is GitHub connected?)');
+            }
+            ref = req.inputs.branch || ctx.baseBranch;
+        }
+        else {
+            const [owner, repo] = source.repo.split('/');
+            ctx = (await req.resolveRepoFiles?.({ owner: owner, repo: repo, ref: source.ref })) ?? null;
+            if (!ctx) {
+                throw new Error(`Could not resolve the separate manifests repo '${source.repo}'`);
+            }
+            ref = source.ref || ctx.baseBranch;
+        }
+        return this.readPath(ctx.repo, source.path, ref);
+    }
+    /** Read a single manifest file, or every manifest file in a directory. */
+    async readPath(repo, path, ref) {
+        const entries = await repo.listDirectory(path, ref);
+        const files = entries.filter((e) => e.type === 'file' && isManifestFile(e.path));
+        if (files.length > 0) {
+            const texts = [];
+            for (const entry of files) {
+                const file = await repo.getFile(entry.path, ref);
+                if (file)
+                    texts.push(file.content);
+            }
+            return texts;
+        }
+        const single = await repo.getFile(path, ref);
+        if (!single)
+            throw new Error(`No manifests found at '${path}'`);
+        return [single.content];
+    }
+}
+/** Render the optional image template over the provision inputs. */
+function renderImage(template, inputs) {
+    return template.replace(/\{\{\s*([a-zA-Z0-9_.]+)\s*\}\}/g, (_m, key) => inputs[key] ?? '');
+}
+//# sourceMappingURL=KubernetesEnvironmentProvider.js.map

package/dist/modules/kubernetes/KubernetesEnvironmentProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KubernetesEnvironmentProvider.js","sourceRoot":"","sources":["../../../src/modules/kubernetes/KubernetesEnvironmentProvider.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EACL,SAAS,EACT,0BAA0B,EAC1B,cAAc,EAEd,YAAY,EACZ,wBAAwB,EACxB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,YAAY,GACb,MAAM,mCAAmC,CAAA;AAE1C,oFAAoF;AACpF,oFAAoF;AACpF,iFAAiF;AACjF,oFAAoF;AACpF,+EAA+E;AAC/E,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,mFAAmF;AACnF,mCAAmC;AAEnC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAC/B,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,MAAM,aAAa,GAAG,aAAa,CAAA;AAOnC,MAAM,OAAO,6BAA6B;IAEX,OAAO;IADpC,6DAA6D;IAC7D,YAA6B,OAAO,GAAyC,EAAE;uBAAlD,OAAO;IAA8C,CAAC;IAEnF,KAAK,CAAC,SAAS,CAAC,GAAgC;QAC9C,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;QACzB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1F,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QAEnD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QAErD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnD,MAAM,SAAS,GAAyB,EAAE,CAAA;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,SAAS,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACzF,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;QACrF,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;QACvD,CAAC;QAED,8EAA8E;QAC9E,gFAAgF;QAChF,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAC7C,OAAO;YACL,UAAU,EAAE,SAAS;YACrB,GAAG;YACH,MAAM,EAAE,cAAc;YACtB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,IAAI;YACZ,4EAA4E;YAC5E,mFAAmF;YACnF,iFAAiF;YACjF,wDAAwD;YACxD,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE;SACpB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAA6B;QACxC,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,CAAA;QACjE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,GAAG,EAAE,IAAI;gBACT,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,EAAE;aACX,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QACrE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,eAAe,CAAC,CAAA;QACrF,OAAO;YACL,UAAU,EAAE,SAAS;YACrB,GAAG;YACH,MAAM;YACN,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,GAAG,CAAC,eAAe;SAC5B,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAA+B;QAC5C,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,CAAA;QACjE,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QAC9C,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;QACjE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,QAAQ,EACR,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,EAC/B,SAAS,EACT,gBAAgB,CACjB,CAAA;QACD,wEAAwE;QACxE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,WAAW,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CACzF,CAAA;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAChC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAqC;QACxD,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAA;QAC/F,IAAI,MAAmC,CAAA;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACjF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;QACjE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,KAAK,EACL,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,EACjC,SAAS,EACT,eAAe,CAChB,CAAA;YACD,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAA;YACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,GAAG,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACjF,CAAC;IACH,CAAC;IAED,cAAc;QACZ,iFAAiF;QACjF,mFAAmF;QACnF,gFAAgF;QAChF,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,eAAe,CAC3B,MAA2B,EAC3B,MAAmC,EACnC,SAAiB;QAEjB,MAAM,IAAI,GAAG;YACX,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE;gBACR,IAAI,EAAE,SAAS;gBACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;SACF,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAA;QACpF,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAM,CAAC,iCAAiC;QAC1E,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,WAAW,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CACzF,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,MAA2B,EAC3B,MAAmC,EACnC,SAAiB,EACjB,QAA4B;QAE5B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAK,CAAA;QACpC,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,iBAAiB,aAAa,aAAa,CAAA;QAClI,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,OAAO,EACP,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EACxB,gBAAgB,EAChB,8BAA8B,CAC/B,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,IAAI,IAAI,IAAI,UAAU,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CACxF,CAAA;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IAChE,KAAK,CAAC,gBAAgB,CAC5B,MAA2B,EAC3B,MAAmC,EACnC,SAAiB;QAEjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,KAAK,EACL,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,EACvD,SAAS,EACT,eAAe,CAChB,CAAA;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAA;QACvC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,cAAc,CAAA;QAClC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAA;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAA,CAAC,8CAA8C;QACrF,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAA;YACnD,IAAI,SAAS,KAAK,MAAM;gBAAE,OAAO,QAAQ,CAAA;YACzC,IAAI,SAAS,KAAK,OAAO;gBAAE,UAAU,GAAG,IAAI,CAAA;QAC9C,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAA;IAC9C,CAAC;IAED,wFAAwF;IAChF,KAAK,CAAC,cAAc,CAC1B,MAA2B,EAC3B,MAAmC,EACnC,SAAiB,EACjB,MAA8B;QAE9B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAA;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,iBAAiB;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QAC7E,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CACnC,MAA2B,EAC3B,MAAmC,EACnC,SAAiB;QAEjB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,KAAK,EACL,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,EAChE,SAAS,EACT,eAAe,CAChB,CAAA;YACD,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,CAAC;QACD,8EAA8E;QAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO,IAAI,CAAA;QAC/C,0EAA0E;QAC1E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,KAAK,EACL,WAAW,CAAC,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,EAClF,SAAS,EACT,eAAe,CAChB,CAAA;YACD,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,KAAK,EACL,WAAW,CAAC,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,SAAS,CAAC,EACjE,SAAS,EACT,eAAe,CAChB,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAA;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACnC,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,aAAa,CACzB,GAAgC,EAChC,MAAmC;QAEnC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAA;QACpC,IAAI,GAA0B,CAAA;QAC9B,IAAI,GAAW,CAAA;QACf,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,IAAI,CAAA;YACzB,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;YACrF,CAAC;YACD,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,CAAA;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC5C,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,KAAM,EAAE,IAAI,EAAE,IAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAA;YAC7F,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;YACnF,CAAC;YACD,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAA;QACpC,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAClD,CAAC;IAED,0EAA0E;IAClE,KAAK,CAAC,QAAQ,CAAC,IAAe,EAAE,IAAY,EAAE,GAAW;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAChF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAa,EAAE,CAAA;YAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBAChD,IAAI,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACpC,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACzB,CAAC;CACF;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,QAAgB,EAAE,MAA8B;IACnE,OAAO,QAAQ,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;AACpG,CAAC"}

package/dist/modules/kubernetes/KubernetesRunnerTransport.d.ts

@@ -1,7 +1,7 @@
 import type { ConnectionTestResult, KubernetesRunnerConfig, RunnerDispatchKind, RunnerDispatchOptions, RunnerJobRef, RunnerJobView, RunnerTransport, SecretResolver } from '@cat-factory/kernel';
 export declare class KubernetesRunnerTransport implements RunnerTransport {
     private readonly config;
-    private readonly resolveSecret;
+    private readonly client;
     constructor(config: KubernetesRunnerConfig, resolveSecret: SecretResolver);
     dispatch(ref: RunnerJobRef, spec: Record<string, unknown>, kind?: RunnerDispatchKind, options?: RunnerDispatchOptions): Promise<void>;
     poll(ref: RunnerJobRef): Promise<RunnerJobView>;
@@ -13,17 +13,5 @@ export declare class KubernetesRunnerTransport implements RunnerTransport {
     private waitForPodReady;
     private proxyFetch;
     private apiFetch;
-    /**
-     * Build the undici dispatcher carrying the cluster CA / insecure-skip flag, when
-     * configured. A kube-apiserver usually presents a private CA, which `fetch` can't
-     * verify without this. Loaded lazily (Node only) so the Worker bundle never pulls
-     * in `undici`; on a runtime without it, a custom-CA/insecure config fails clearly.
-     *
-     * The Agent is cached at MODULE scope keyed by the CA/insecure pair, not per
-     * instance: the wiring builds a fresh transport on every dispatch/poll resolve, so
-     * a per-instance cache would create (and abandon) one Agent — a TLS connection pool
-     * — per poll tick, defeating keep-alive and leaking sockets.
-     */
-    private tlsDispatcher;
 }
 //# sourceMappingURL=KubernetesRunnerTransport.d.ts.map

package/dist/modules/kubernetes/KubernetesRunnerTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"KubernetesRunnerTransport.d.ts","sourceRoot":"","sources":["../../../src/modules/kubernetes/KubernetesRunnerTransport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,cAAc,EACf,MAAM,qBAAqB,CAAA;AA2C5B,qBAAa,yBAA0B,YAAW,eAAe;IAE7D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAFhC,YACmB,MAAM,EAAE,sBAAsB,EAC9B,aAAa,EAAE,cAAc,EAC5C;IAEE,QAAQ,CACZ,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,GAAE,kBAA4B,EAClC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAQf;IAEK,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAmBpD;IAED,qEAAqE;IAC/D,OAAO,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9C;IAED,mFAAmF;IAC7E,cAAc,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAqBpD;YAIa,SAAS;YAaT,eAAe;IA+C7B,OAAO,CAAC,UAAU;YAUJ,QAAQ;IA6BtB;;;;;;;;;;OAUG;YACW,aAAa;CAwB5B"}
+{"version":3,"file":"KubernetesRunnerTransport.d.ts","sourceRoot":"","sources":["../../../src/modules/kubernetes/KubernetesRunnerTransport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,cAAc,EACf,MAAM,qBAAqB,CAAA;AA2C5B,qBAAa,yBAA0B,YAAW,eAAe;IAI7D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAE5C,YACmB,MAAM,EAAE,sBAAsB,EAC/C,aAAa,EAAE,cAAc,EAG9B;IAEK,QAAQ,CACZ,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,GAAE,kBAA4B,EAClC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAQf;IAEK,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAmBpD;IAED,qEAAqE;IAC/D,OAAO,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9C;IAED,mFAAmF;IAC7E,cAAc,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAqBpD;YAIa,SAAS;YAaT,eAAe;IA+C7B,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,QAAQ;CAQjB"}

package/dist/modules/kubernetes/KubernetesRunnerTransport.js

@@ -1,4 +1,5 @@
-import { analyzePodStatus, apiBase, buildPodManifest, classifyPodReadiness, KUBERNETES_TOKEN_KEY, podName, podUrl, podsUrl, proxyUrl, } from './kubernetes.logic.js';
+import { KubernetesApiClient, safeText } from './KubernetesApiClient.js';
+import { analyzePodStatus, apiBase, buildPodManifest, classifyPodReadiness, podName, podUrl, podsUrl, proxyUrl, } from './kubernetes.logic.js';
 // Native Kubernetes runner transport (target k8s 1.35+). One bare Pod per RUN,
 // named deterministically from `ref.runId`; every step of the run re-attaches to
 // that pod by `ref.jobId` — mirroring CloudflareContainerTransport's per-run model
@@ -28,10 +29,10 @@ const READY_WAIT_MS = 120_000;
 const READY_POLL_INTERVAL_MS = 1_500;
 export class KubernetesRunnerTransport {
     config;
-    resolveSecret;
+    client;
     constructor(config, resolveSecret) {
         this.config = config;
-        this.resolveSecret = resolveSecret;
+        this.client = new KubernetesApiClient(config, resolveSecret);
     }
     async dispatch(ref, spec, kind = 'agent', options) {
         const name = podName(ref.runId);
@@ -146,72 +147,8 @@ export class KubernetesRunnerTransport {
     proxyFetch(method, name, path, body, timeoutMs) {
         return this.apiFetch(method, proxyUrl(this.config, name, path), body, timeoutMs);
     }
-    async apiFetch(method, url, body, timeoutMs) {
-        const token = this.resolveSecret(KUBERNETES_TOKEN_KEY);
-        if (!token)
-            throw new Error(`Missing Kubernetes ServiceAccount token ('${KUBERNETES_TOKEN_KEY}')`);
-        const headers = {
-            authorization: `Bearer ${token}`,
-            accept: 'application/json',
-        };
-        let payload;
-        if (body !== undefined && method !== 'GET' && method !== 'DELETE') {
-            payload = JSON.stringify(body);
-            headers['content-type'] = 'application/json';
-        }
-        const init = {
-            method,
-            headers,
-            body: payload,
-            signal: AbortSignal.timeout(timeoutMs),
-        };
-        const dispatcher = await this.tlsDispatcher();
-        if (dispatcher)
-            init.dispatcher = dispatcher;
-        return fetch(url, init);
-    }
-    /**
-     * Build the undici dispatcher carrying the cluster CA / insecure-skip flag, when
-     * configured. A kube-apiserver usually presents a private CA, which `fetch` can't
-     * verify without this. Loaded lazily (Node only) so the Worker bundle never pulls
-     * in `undici`; on a runtime without it, a custom-CA/insecure config fails clearly.
-     *
-     * The Agent is cached at MODULE scope keyed by the CA/insecure pair, not per
-     * instance: the wiring builds a fresh transport on every dispatch/poll resolve, so
-     * a per-instance cache would create (and abandon) one Agent — a TLS connection pool
-     * — per poll tick, defeating keep-alive and leaking sockets.
-     */
-    async tlsDispatcher() {
-        if (!this.config.caCertPem && !this.config.insecureSkipTlsVerify)
-            return undefined;
-        const key = `${this.config.insecureSkipTlsVerify ? 'insecure' : 'verify'}:${this.config.caCertPem ?? ''}`;
-        const existing = tlsDispatcherCache.get(key);
-        if (existing)
-            return existing;
-        // Variable specifier so bundlers don't statically resolve `undici`.
-        const moduleName = 'undici';
-        const undici = (await import(moduleName).catch(() => null));
-        if (!undici) {
-            throw new Error('Kubernetes custom CA / insecure TLS requires the Node runtime (undici is unavailable).');
-        }
-        const agent = new undici.Agent({
-            connect: {
-                ca: this.config.caCertPem,
-                rejectUnauthorized: !this.config.insecureSkipTlsVerify,
-            },
-        });
-        tlsDispatcherCache.set(key, agent);
-        return agent;
-    }
-}
-/** Module-scoped undici Agent cache, keyed by the CA/insecure pair (see tlsDispatcher). */
-const tlsDispatcherCache = new Map();
-async function safeText(res) {
-    try {
-        return (await res.text()).slice(0, 300);
-    }
-    catch {
-        return '(no body)';
+    apiFetch(method, url, body, timeoutMs) {
+        return this.client.fetch(method, url, body, timeoutMs);
     }
 }
 function sleep(ms) {

package/dist/modules/kubernetes/KubernetesRunnerTransport.js.map

@@ -1 +1 @@
-{"version":3,"file":"KubernetesRunnerTransport.js","sourceRoot":"","sources":["../../../src/modules/kubernetes/KubernetesRunnerTransport.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,OAAO,EACP,MAAM,EACN,OAAO,EACP,QAAQ,GACT,MAAM,uBAAuB,CAAA;AAE9B,+EAA+E;AAC/E,iFAAiF;AACjF,mFAAmF;AACnF,+EAA+E;AAC/E,4EAA4E;AAC5E,kFAAkF;AAClF,+EAA+E;AAC/E,uCAAuC;AACvC,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,iFAAiF;AACjF,2EAA2E;AAE3E,oFAAoF;AACpF,yEAAyE;AACzE,MAAM,cAAc,GAAG,8CAA8C,CAAA;AAErE,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,mFAAmF;AACnF,sFAAsF;AACtF,mFAAmF;AACnF,sFAAsF;AACtF,gFAAgF;AAChF,qFAAqF;AACrF,8EAA8E;AAC9E,MAAM,aAAa,GAAG,OAAO,CAAA;AAC7B,MAAM,sBAAsB,GAAG,KAAK,CAAA;AAEpC,MAAM,OAAO,yBAAyB;IAEjB,MAAM;IACN,aAAa;IAFhC,YACmB,MAA8B,EAC9B,aAA6B;sBAD7B,MAAM;6BACN,aAAa;IAC7B,CAAC;IAEJ,KAAK,CAAC,QAAQ,CACZ,GAAiB,EACjB,IAA6B,EAC7B,IAAI,GAAuB,OAAO,EAClC,OAA+B;QAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC9C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAA;QAChG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAiB;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAC/B,KAAK,EACL,IAAI,EACJ,SAAS,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EACxC,SAAS,EACT,eAAe,CAChB,CAAA;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,0EAA0E;YAC1E,4EAA4E;YAC5E,qEAAqE;YACrE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;QACnD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;IAC5C,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EACzB,SAAS,EACT,mBAAmB,CACpB,CAAA;QACD,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,gFAAgF;QAChF,+EAA+E;QAC/E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,WAAW,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CACtF,CAAA;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,KAAK,EACL,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EACjC,SAAS,EACT,mBAAmB,CACpB,CAAA;YACD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,WAAW,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI;iBACjF,CAAA;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,uBAAuB,GAAG,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE;aACrE,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACjF,CAAC;IACH,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,SAAS,CACrB,IAAY,EACZ,KAAa,EACb,OAA+B;QAE/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QAC5F,8EAA8E;QAC9E,mEAAmE;QACnE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAM;QACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7F,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,IAAY;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAA;QAC3C,mFAAmF;QACnF,mFAAmF;QACnF,gFAAgF;QAChF,yEAAyE;QACzE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,iCAAiC,CAAC,CAAA;QAC7F,oFAAoF;QACpF,0FAA0F;QAC1F,mFAAmF;QACnF,IAAI,UAAU,GAAG,EAAE,CAAA;QACnB,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;YAC7F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,eAAe,IAAI,mCAAmC,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;gBAC5B,+EAA+E;gBAC/E,+DAA+D;gBAC/D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;gBACzD,kFAAkF;gBAClF,oFAAoF;gBACpF,kFAAkF;gBAClF,oFAAoF;gBACpF,oFAAoF;gBACpF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,sBAAsB,KAAK,EAAE,CAAC,CAAA;gBACnE,CAAC;gBACD,IAAI,MAAM;oBAAE,UAAU,GAAG,MAAM,CAAA;gBAC/B,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;gBAC3C,IAAI,SAAS,KAAK,OAAO;oBAAE,OAAM;gBACjC,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACzB,MAAM,WAAW,CACf,eAAe,IAAI,8BAA8B,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxF,CAAA;gBACH,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,WAAW,CACf,eAAe,IAAI,sBAAsB,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/G,CAAA;YACH,CAAC;YACD,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAEO,UAAU,CAChB,MAAc,EACd,IAAY,EACZ,IAAY,EACZ,IAAa,EACb,SAAiB;QAEjB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAClF,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,MAAc,EACd,GAAW,EACX,IAAa,EACb,SAAiB;QAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAA;QACtD,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CAAC,6CAA6C,oBAAoB,IAAI,CAAC,CAAA;QACxF,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,kBAAkB;SAC3B,CAAA;QACD,IAAI,OAA2B,CAAA;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC9B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;QAC9C,CAAC;QACD,MAAM,IAAI,GAA2C;YACnD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAA;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;QAC7C,IAAI,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5C,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB;YAAE,OAAO,SAAS,CAAA;QAClF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAA;QACzG,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC7B,oEAAoE;QACpE,MAAM,UAAU,GAAG,QAAQ,CAAA;QAC3B,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAElD,CAAA;QACR,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;YAC7B,OAAO,EAAE;gBACP,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBACzB,kBAAkB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB;aACvD;SACF,CAAC,CAAA;QACF,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAmB,CAAA;AAErD,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAA;IACpB,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC"}
+{"version":3,"file":"KubernetesRunnerTransport.js","sourceRoot":"","sources":["../../../src/modules/kubernetes/KubernetesRunnerTransport.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AACxE,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,OAAO,EACP,MAAM,EACN,OAAO,EACP,QAAQ,GACT,MAAM,uBAAuB,CAAA;AAE9B,+EAA+E;AAC/E,iFAAiF;AACjF,mFAAmF;AACnF,+EAA+E;AAC/E,4EAA4E;AAC5E,kFAAkF;AAClF,+EAA+E;AAC/E,uCAAuC;AACvC,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,iFAAiF;AACjF,2EAA2E;AAE3E,oFAAoF;AACpF,yEAAyE;AACzE,MAAM,cAAc,GAAG,8CAA8C,CAAA;AAErE,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,mFAAmF;AACnF,sFAAsF;AACtF,mFAAmF;AACnF,sFAAsF;AACtF,gFAAgF;AAChF,qFAAqF;AACrF,8EAA8E;AAC9E,MAAM,aAAa,GAAG,OAAO,CAAA;AAC7B,MAAM,sBAAsB,GAAG,KAAK,CAAA;AAEpC,MAAM,OAAO,yBAAyB;IAIjB,MAAM;IAHR,MAAM,CAAqB;IAE5C,YACmB,MAA8B,EAC/C,aAA6B;sBADZ,MAAM;QAGvB,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,GAAiB,EACjB,IAA6B,EAC7B,IAAI,GAAuB,OAAO,EAClC,OAA+B;QAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC9C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAA;QAChG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAiB;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAC/B,KAAK,EACL,IAAI,EACJ,SAAS,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EACxC,SAAS,EACT,eAAe,CAChB,CAAA;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,0EAA0E;YAC1E,4EAA4E;YAC5E,qEAAqE;YACrE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;QACnD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;IAC5C,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EACzB,SAAS,EACT,mBAAmB,CACpB,CAAA;QACD,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,gFAAgF;QAChF,+EAA+E;QAC/E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,WAAW,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CACtF,CAAA;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,KAAK,EACL,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EACjC,SAAS,EACT,mBAAmB,CACpB,CAAA;YACD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,WAAW,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI;iBACjF,CAAA;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,uBAAuB,GAAG,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE;aACrE,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACjF,CAAC;IACH,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,SAAS,CACrB,IAAY,EACZ,KAAa,EACb,OAA+B;QAE/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QAC5F,8EAA8E;QAC9E,mEAAmE;QACnE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAM;QACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7F,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,IAAY;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAA;QAC3C,mFAAmF;QACnF,mFAAmF;QACnF,gFAAgF;QAChF,yEAAyE;QACzE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,iCAAiC,CAAC,CAAA;QAC7F,oFAAoF;QACpF,0FAA0F;QAC1F,mFAAmF;QACnF,IAAI,UAAU,GAAG,EAAE,CAAA;QACnB,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;YAC7F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,eAAe,IAAI,mCAAmC,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;gBAC5B,+EAA+E;gBAC/E,+DAA+D;gBAC/D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;gBACzD,kFAAkF;gBAClF,oFAAoF;gBACpF,kFAAkF;gBAClF,oFAAoF;gBACpF,oFAAoF;gBACpF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,sBAAsB,KAAK,EAAE,CAAC,CAAA;gBACnE,CAAC;gBACD,IAAI,MAAM;oBAAE,UAAU,GAAG,MAAM,CAAA;gBAC/B,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;gBAC3C,IAAI,SAAS,KAAK,OAAO;oBAAE,OAAM;gBACjC,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACzB,MAAM,WAAW,CACf,eAAe,IAAI,8BAA8B,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxF,CAAA;gBACH,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,WAAW,CACf,eAAe,IAAI,sBAAsB,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/G,CAAA;YACH,CAAC;YACD,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAEO,UAAU,CAChB,MAAc,EACd,IAAY,EACZ,IAAY,EACZ,IAAa,EACb,SAAiB;QAEjB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAClF,CAAC;IAEO,QAAQ,CACd,MAAc,EACd,GAAW,EACX,IAAa,EACb,SAAiB;QAEjB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IACxD,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC"}

package/dist/modules/kubernetes/kubernetes-environment.logic.d.ts

@@ -0,0 +1,68 @@
+import type { EnvironmentManifest, KubernetesEnvironmentConfig, KubernetesUrlSource } from '@cat-factory/kernel';
+/** The label key stamped on the namespace + applied resources, carrying the run/block id. */
+export declare const ENV_BLOCK_LABEL = "cat-factory.blockId";
+/** The owning-prefix for the per-PR namespace. */
+export declare const ENV_NAMESPACE_PREFIX = "cf-env-";
+/** A parsed Kubernetes resource (apiVersion + kind + metadata + the rest). */
+export interface KubernetesResource {
+    apiVersion: string;
+    kind: string;
+    metadata: {
+        name?: string;
+        namespace?: string;
+        labels?: Record<string, string>;
+    } & Record<string, unknown>;
+    [key: string]: unknown;
+}
+/** Whether a manifest kind is supported by the apply loop. `Namespace` is owned by us. */
+export declare function isSupportedKind(kind: string): boolean;
+/**
+ * Read the per-workspace Kubernetes config off the stored manifest's `providerConfig`.
+ * The config was Valibot-validated at the connect controller boundary, so this trusts
+ * the stored shape (a cast) rather than re-parsing (which would pull valibot in here).
+ */
+export declare function parseKubernetesEnvConfig(manifest: EnvironmentManifest): KubernetesEnvironmentConfig;
+/** Build the stored manifest that carries a Kubernetes env config in its providerConfig. */
+export declare function kubernetesConfigToManifest(config: KubernetesEnvironmentConfig): EnvironmentManifest;
+/** The `{{var}}` substitution map available to the namespace + manifest templates. */
+export declare function templateVars(inputs: Record<string, string>, namespace: string, image: string | undefined): Record<string, string>;
+/** Replace `{{ key }}` placeholders from `vars`; an unknown key resolves to ''. */
+export declare function renderTemplate(template: string, vars: Record<string, string>): string;
+/**
+ * Resolve the per-PR namespace name: render the configured template (or a default
+ * derived from the repo + PR number / block id) then sanitize to an RFC1123 label.
+ *
+ * The default qualifies the PR number with the repo, because a workspace can have many
+ * repos and two of them can open a PR with the SAME number. A bare `cf-env-<pr>` would
+ * then collide on one namespace — and since `ensureNamespace` treats the resulting 409
+ * as idempotent, the second PR's manifests would be applied INTO the first's live
+ * environment (and its teardown would delete the wrong namespace). So prefer
+ * `<repoName>-<pullNumber>`, falling back to the globally-unique block id, and only to a
+ * bare PR number when neither repo nor block context is present (a manual provision).
+ */
+export declare function resolveNamespace(config: KubernetesEnvironmentConfig, inputs: Record<string, string>): string;
+/** The cluster-scoped Namespace collection/object URL. */
+export declare function namespaceUrl(config: KubernetesEnvironmentConfig, name?: string): string;
+/**
+ * The apiserver resource URL for server-side apply (`name` required) or a collection
+ * GET (`name` omitted). Throws for an unsupported kind. `apiVersion` carries the
+ * group/version; the kind's plural comes from the built-in allow-list.
+ */
+export declare function resourceUrl(config: KubernetesEnvironmentConfig, apiVersion: string, kind: string, namespace: string, name?: string): string;
+/** Whether a repo entry path is a manifest file we should read (yaml/yml/json). */
+export declare function isManifestFile(path: string): boolean;
+/**
+ * Parse one or more YAML/JSON documents into resources, templating `{{var}}` first,
+ * then forcing each resource's namespace + stamping the env label. Empty docs are
+ * dropped. Throws on a document missing apiVersion/kind/metadata.name.
+ */
+export declare function parseManifests(text: string, vars: Record<string, string>, namespace: string, blockId: string | undefined, extraLabels: Record<string, string> | undefined): KubernetesResource[];
+/** Read the first LoadBalancer address (ip or hostname) off a Service/Ingress status. */
+export declare function extractLoadBalancerAddress(obj: unknown): string | null;
+/**
+ * Derive the environment URL from the configured source. For `ingressTemplate` the URL
+ * is known immediately (rendered host); the status-backed sources return null until the
+ * caller has fetched the live address and passes it in.
+ */
+export declare function deriveUrl(url: KubernetesUrlSource, vars: Record<string, string>, liveAddress: string | null): string | null;
+//# sourceMappingURL=kubernetes-environment.logic.d.ts.map

package/dist/modules/kubernetes/kubernetes-environment.logic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes-environment.logic.d.ts","sourceRoot":"","sources":["../../../src/modules/kubernetes/kubernetes-environment.logic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAS5B,6FAA6F;AAC7F,eAAO,MAAM,eAAe,wBAAwB,CAAA;AACpD,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,YAAY,CAAA;AAE7C,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,MAAM,CACvF,MAAM,EACN,OAAO,CACR,CAAA;IACD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AA8BD,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,mBAAmB,GAC5B,2BAA2B,CAI7B;AAED,4FAA4F;AAC5F,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,2BAA2B,GAClC,mBAAmB,CAerB;AAED,sFAAsF;AACtF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAErF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,2BAA2B,EACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,MAAM,CASR;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,MAAM,EAAE,2BAA2B,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAGvF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,2BAA2B,EACnC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAgBR;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC9C,kBAAkB,EAAE,CAyBtB;AAED,yFAAyF;AACzF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMtE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,MAAM,GAAG,IAAI,CAWf"}