@oisincoveney/pipeline 3.24.2 → 3.24.3

package/dist/argo-submit.js

@@ -1,121 +1,321 @@
+import { nonEmptyMutableArray, parseStrictWithSchema, parseWithSchema, requiredString, stringRecord, struct, withDefault } from "./schema-boundary.js";
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
-import { argoWorkflowActiveDeadlineSecondsSchema, argoWorkflowPodGcSchema, argoWorkflowTtlStrategySchema, dbAuthOptionSchema, mcpGatewayAuthOptionSchema } from "./remote/argo/model.js";
-import { brokerAuthOptionSchema } from "./credentials/broker.js";
 import { appendPullRequestDelivery } from "./schedule/passes/open-pull-request.js";
 import { compileScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
 import { buildRunnerTaskDescriptor } from "./runner-command/task-descriptor.js";
 import { buildDynamicRunnerArgoWorkflowManifest, buildRunnerArgoWorkflowManifest, runnerArgoWorkflowManifestSchema } from "./argo-workflow.js";
 import { normalizeRunnerRepositoryForSubmit } from "./git-remote-url.js";
+import { runnerPodSubmitOptionShape } from "./remote/submit/options.js";
 import { KubernetesArgoService, KubernetesArgoServiceLive } from "./runtime/services/kubernetes-argo-service.js";
 import { workflowSubmitResultSchema } from "./workflow-submit-contract.js";
+import * as DateTime from "effect/DateTime";
+import * as Effect from "effect/Effect";
+import * as ManagedRuntime from "effect/ManagedRuntime";
+import * as Option$1 from "effect/Option";
+import * as R from "effect/Record";
+import * as Schema from "effect/Schema";
 import { stringify } from "yaml";
-import { Effect } from "effect";
-import { z } from "zod";
-import { randomBytes } from "node:crypto";
 //#region src/argo-submit.ts
-const scheduleIdSchema = z.string().regex(/^[a-z][a-z0-9-]*$/);
-const configMapSchema = z.object({
-	apiVersion: z.literal("v1"),
-	data: z.record(z.string().min(1), z.string()),
-	kind: z.literal("ConfigMap"),
-	metadata: z.object({
-		labels: z.record(z.string().min(1), z.string().min(1)).optional(),
-		name: z.string().min(1),
-		namespace: z.string().min(1)
-	}).strict()
-}).strict();
-const workflowOwnerReferenceSchema = z.object({
-	apiVersion: z.literal("argoproj.io/v1alpha1"),
-	kind: z.literal("Workflow"),
-	name: z.string().min(1),
-	uid: z.string().min(1)
-}).strict();
-const configMapOwnerReferencesPatchSchema = z.object({ metadata: z.object({ ownerReferences: z.tuple([workflowOwnerReferenceSchema]) }).strict() }).strict();
-const createdWorkflowSchema = z.object({ metadata: z.object({
-	name: z.string().min(1).optional(),
-	uid: z.string().min(1).optional()
-}).passthrough() }).passthrough();
+const scheduleId = Schema.String.check(Schema.isPattern(/^[a-z][a-z0-9-]*$/u));
+const configMapSchema = struct({
+	apiVersion: Schema.Literal("v1"),
+	data: stringRecord,
+	kind: Schema.Literal("ConfigMap"),
+	metadata: struct({
+		labels: Schema.optional(stringRecord),
+		name: requiredString,
+		namespace: requiredString
+	})
+});
+const workflowOwnerReferenceSchema = struct({
+	apiVersion: Schema.Literal("argoproj.io/v1alpha1"),
+	kind: Schema.Literal("Workflow"),
+	name: requiredString,
+	uid: requiredString
+});
+const configMapOwnerReferencesPatchSchema = struct({ metadata: struct({ ownerReferences: Schema.mutable(Schema.Tuple([workflowOwnerReferenceSchema])) }) });
+const createdWorkflowSchema = struct({ metadata: struct({
+	name: Schema.optional(requiredString),
+	uid: Schema.optional(requiredString)
+}) });
+const runnerTaskDescriptorJson = Schema.fromJsonString(struct({ nodeId: requiredString }));
+const encodeRunnerTaskDescriptorJson = Schema.encodeSync(runnerTaskDescriptorJson);
+const runnerCommandPayloadJson = Schema.fromJsonString(runnerCommandPayloadSchema);
+const encodeRunnerCommandPayloadJson = Schema.encodeSync(runnerCommandPayloadJson);
+const errorMessageShape = struct({ message: Schema.String });
+const randomHex = (byteLength) => globalThis.crypto.randomUUID().replaceAll("-", "").slice(0, byteLength * 2);
+var ArgoSubmitError = class extends Schema.TaggedErrorClass()("ArgoSubmitError", { message: Schema.String }) {};
 const submitRunnerArgoWorkflowBaseOptionShape = {
-	activeDeadlineSeconds: argoWorkflowActiveDeadlineSecondsSchema.optional(),
-	brokerAuth: brokerAuthOptionSchema,
-	dbAuth: dbAuthOptionSchema.optional(),
-	eventAuthSecretKey: z.string().min(1).optional(),
-	eventAuthSecretName: z.string().min(1).optional(),
-	generateName: z.string().min(1).optional(),
-	gitCredentialsSecretName: z.string().min(1).optional(),
-	githubAuthSecretName: z.string().min(1).optional(),
-	image: z.string().min(1).optional(),
-	imagePullPolicy: z.enum([
+	...runnerPodSubmitOptionShape,
+	imagePullPolicy: Schema.optional(Schema.Literals([
 		"Always",
 		"IfNotPresent",
 		"Never"
-	]).optional(),
-	imagePullSecretName: z.string().min(1).optional(),
-	kubeContext: z.string().min(1).optional(),
-	kubeconfigPath: z.string().min(1).optional(),
-	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
-	name: z.string().min(1).optional(),
-	namespace: z.string().min(1),
-	npmRegistryAuthSecretName: z.string().min(1).optional(),
-	payloadJson: z.string().min(1),
-	podGC: argoWorkflowPodGcSchema.optional(),
-	serviceAccountName: z.string().min(1).optional(),
-	ttlStrategy: argoWorkflowTtlStrategySchema.optional()
+	])),
+	namespace: requiredString,
+	payloadJson: requiredString
 };
-const submitRunnerArgoWorkflowOptionsSchema = z.object({
+const commandScheduleOptionsSchema = struct({
+	command: nonEmptyMutableArray(requiredString),
+	deliverPullRequest: withDefault(Schema.Boolean, false),
+	generatedAt: Schema.optional(Schema.DateTimeUtcFromDate),
+	scheduleId: Schema.optional(scheduleId),
+	task: requiredString
+});
+const hasWorkflowName = (options) => options.name !== void 0 || options.generateName !== void 0;
+const submitRunnerArgoWorkflowOptionsSchema = struct({
 	...submitRunnerArgoWorkflowBaseOptionShape,
-	scheduleYaml: z.string().min(1)
-}).strict().refine(hasWorkflowName, { message: "Argo submit options must declare name or generateName" });
-const submitDynamicRunnerArgoWorkflowOptionsSchema = z.object({
+	scheduleYaml: requiredString
+}).check(Schema.makeFilter((options) => hasWorkflowName(options) || "Argo submit options must declare name or generateName", {
+	description: "Static Argo submit options must include name or generateName.",
+	identifier: "SubmitRunnerArgoWorkflowName",
+	title: "Submit runner Argo workflow name"
+}));
+const submitDynamicRunnerArgoWorkflowOptionsSchema = struct({
 	...submitRunnerArgoWorkflowBaseOptionShape,
-	workflowId: z.string().min(1)
-}).strict().refine(hasWorkflowName, { message: "Argo submit options must declare name or generateName" });
-const commandScheduleOptionsSchema = z.object({
-	command: z.array(z.string().min(1)).min(1),
-	deliverPullRequest: z.boolean().default(false),
-	generatedAt: z.date().default(() => /* @__PURE__ */ new Date()),
-	scheduleId: scheduleIdSchema.optional(),
-	task: z.string().min(1)
-}).strict();
-function hasWorkflowName(options) {
-	return options.name !== void 0 || options.generateName !== void 0;
-}
-function submitRunnerArgoWorkflow(rawOptions, dependencies = {}) {
-	return Effect.runPromise(Effect.provide(Effect.suspend(() => submitRunnerArgoWorkflowEffect(rawOptions, dependencies)), KubernetesArgoServiceLive));
-}
-function submitDynamicRunnerArgoWorkflow(rawOptions, dependencies = {}) {
-	return Effect.runPromise(Effect.provide(Effect.suspend(() => submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies)), KubernetesArgoServiceLive));
-}
-function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
-	const { config, ...schemaOptions } = rawOptions;
-	const options = submitRunnerArgoWorkflowOptionsSchema.parse(schemaOptions);
+	workflowId: requiredString
+}).check(Schema.makeFilter((options) => hasWorkflowName(options) || "Argo submit options must declare name or generateName", {
+	description: "Dynamic Argo submit options must include name or generateName.",
+	identifier: "SubmitDynamicRunnerArgoWorkflowName",
+	title: "Submit dynamic runner Argo workflow name"
+}));
+const kubernetesArgoRuntime = ManagedRuntime.make(KubernetesArgoServiceLive);
+const runKubernetesArgoEffect = async (effect) => await kubernetesArgoRuntime.runPromise(effect);
+const runConfigMap = (input) => {
+	return {
+		body: parseStrictWithSchema(configMapSchema, {
+			apiVersion: "v1",
+			data: input.data,
+			kind: "ConfigMap",
+			metadata: {
+				labels: input.labels,
+				name: input.name,
+				namespace: input.namespace
+			}
+		}),
+		name: input.name
+	};
+};
+const staticRunConfigMaps = (input) => [
+	runConfigMap({
+		data: { "payload.json": input.payloadJson },
+		labels: input.labels,
+		name: input.payloadConfigMapName,
+		namespace: input.namespace
+	}),
+	runConfigMap({
+		data: R.fromEntries(input.tasks.map((task) => [`${task.taskName}.json`, `${encodeRunnerTaskDescriptorJson(buildRunnerTaskDescriptor(task.nodeId))}\n`])),
+		labels: input.labels,
+		name: input.taskDescriptorConfigMapName,
+		namespace: input.namespace
+	}),
+	runConfigMap({
+		data: { "schedule.yaml": input.scheduleYaml },
+		labels: input.labels,
+		name: input.scheduleConfigMapName,
+		namespace: input.namespace
+	})
+];
+const dynamicRunConfigMaps = (input) => [runConfigMap({
+	data: { "payload.json": input.payloadJson },
+	labels: input.labels,
+	name: input.payloadConfigMapName,
+	namespace: input.namespace
+})];
+const runConfigMapEffects = (configMapNames, effectForName) => Effect.all(configMapNames.map(effectForName), { concurrency: "unbounded" });
+const patchRunConfigMapOwnerReferences = (input) => Effect.gen(function* effectBody() {
+	const service = yield* KubernetesArgoService;
+	yield* runConfigMapEffects(input.configMapNames, (name) => service.patchConfigMapOwnerReferences({
+		body: input.body,
+		dependencies: input.dependencies,
+		name,
+		namespace: input.namespace,
+		options: input.options
+	}));
+});
+const deleteRunConfigMaps = (input) => Effect.gen(function* effectBody() {
+	const service = yield* KubernetesArgoService;
+	yield* runConfigMapEffects(input.configMapNames, (name) => service.deleteConfigMap({
+		dependencies: input.dependencies,
+		name,
+		namespace: input.namespace,
+		options: input.options
+	}));
+});
+const workflowOwnerReference = (result) => {
+	if (result.workflowUid === void 0) return Option$1.none();
+	return Option$1.some(parseStrictWithSchema(workflowOwnerReferenceSchema, {
+		apiVersion: "argoproj.io/v1alpha1",
+		kind: "Workflow",
+		name: result.workflowName,
+		uid: result.workflowUid
+	}));
+};
+const missingWorkflowUidMessage = (result) => `Created Argo Workflow '${result.workflowName}' did not include metadata.uid; cannot own ConfigMaps`;
+const configMapOwnerReferencesPatch = (ownerReference) => parseStrictWithSchema(configMapOwnerReferencesPatchSchema, { metadata: { ownerReferences: [ownerReference] } });
+const errorMessage = (error) => Option$1.match(Schema.decodeUnknownOption(errorMessageShape)(error), {
+	onNone: () => String(error),
+	onSome: (value) => value.message
+});
+const warnRunConfigMapOwnershipSkipped = (input) => Effect.sync(() => {
+	const reason = errorMessage(input.error);
+	const message = `moka submit: failed to set Workflow ownerReference for ConfigMaps after Argo Workflow '${input.result.workflowName}' was created; leaving ConfigMaps for TTL/sweeper cleanup: ${reason}\n`;
+	process.stderr.write(message);
+});
+const ownRunConfigMaps = (input) => {
+	const ownerReference = workflowOwnerReference(input.result);
+	if (Option$1.isNone(ownerReference)) return warnRunConfigMapOwnershipSkipped({
+		error: new ArgoSubmitError({ message: missingWorkflowUidMessage(input.result) }),
+		result: input.result
+	}).pipe(Effect.as(input.result));
+	return patchRunConfigMapOwnerReferences({
+		body: configMapOwnerReferencesPatch(ownerReference.value),
+		configMapNames: input.configMapNames,
+		dependencies: input.dependencies,
+		namespace: input.namespace,
+		options: input.options
+	}).pipe(Effect.as(input.result));
+};
+const ownRunConfigMapsBestEffort = (input) => ownRunConfigMaps(input).pipe(Effect.catch((error) => warnRunConfigMapOwnershipSkipped({
+	error,
+	result: input.result
+}).pipe(Effect.as(input.result))));
+const cleanupRunConfigMapsOnFailure = (input) => deleteRunConfigMaps({
+	configMapNames: input.configMapNames,
+	dependencies: input.dependencies,
+	namespace: input.namespace,
+	options: input.options
+}).pipe(Effect.catch((cleanupError) => Effect.fail(new ArgoSubmitError({ message: `Failed to clean up ConfigMaps after submit failure: ${errorMessage(input.error)}; cleanup failed: ${errorMessage(cleanupError)}` }))), Effect.flatMap(() => Effect.fail(input.error)));
+const createRunConfigMaps = (input) => {
+	const createdConfigMapNames = [];
+	return Effect.gen(function* effectBody() {
+		const service = yield* KubernetesArgoService;
+		yield* Effect.all(input.configMaps.map((configMap) => service.createConfigMap({
+			body: configMap.body,
+			dependencies: input.dependencies,
+			namespace: input.namespace,
+			options: input.options
+		}).pipe(Effect.tap(() => Effect.sync(() => {
+			createdConfigMapNames.push(configMap.name);
+		})))), { concurrency: "unbounded" });
+		return createdConfigMapNames;
+	}).pipe(Effect.catch((error) => cleanupRunConfigMapsOnFailure({
+		configMapNames: createdConfigMapNames,
+		dependencies: input.dependencies,
+		error,
+		namespace: input.namespace,
+		options: input.options
+	})));
+};
+const applyWorkflowFieldOverrides = (workflow, overrides = {}) => {
+	if (overrides.podGC === void 0) return workflow;
+	return parseStrictWithSchema(runnerArgoWorkflowManifestSchema, {
+		...workflow,
+		spec: {
+			...workflow.spec,
+			podGC: overrides.podGC
+		}
+	});
+};
+const workflowSubmitResult = (response, workflow, base) => {
+	const created = parseWithSchema(createdWorkflowSchema, response, { onExcessProperty: "preserve" });
+	return parseStrictWithSchema(workflowSubmitResultSchema, {
+		...base,
+		workflowName: created.metadata.name ?? workflow.metadata.name,
+		workflowUid: created.metadata.uid
+	});
+};
+const submitWorkflowManifest = (input) => Effect.gen(function* effectBody() {
+	const service = yield* KubernetesArgoService;
+	const workflow = applyWorkflowFieldOverrides(input.workflow, input.workflowFieldOverrides);
+	return workflowSubmitResult(yield* service.createWorkflow({
+		body: parseStrictWithSchema(runnerArgoWorkflowManifestSchema, workflow),
+		dependencies: input.dependencies,
+		namespace: input.namespace,
+		options: input.options
+	}), workflow, {
+		namespace: input.namespace,
+		...input.resultExtras
+	});
+});
+const submitWorkflowWithRunConfigMaps = (input) => submitWorkflowManifest({
+	dependencies: input.dependencies,
+	namespace: input.namespace,
+	options: input.options,
+	resultExtras: input.resultExtras,
+	workflow: input.workflow,
+	workflowFieldOverrides: input.workflowFieldOverrides
+}).pipe(Effect.catch((error) => cleanupRunConfigMapsOnFailure({
+	configMapNames: input.configMapNames,
+	dependencies: input.dependencies,
+	error,
+	namespace: input.namespace,
+	options: input.options
+})), Effect.flatMap((result) => ownRunConfigMapsBestEffort({
+	configMapNames: input.configMapNames,
+	dependencies: input.dependencies,
+	namespace: input.namespace,
+	options: input.options,
+	result
+})));
+const buildCommandScheduleYaml = (rawOptions) => {
+	const options = parseStrictWithSchema(commandScheduleOptionsSchema, rawOptions);
+	const scheduleId = options.scheduleId ?? `custom-${randomHex(8)}`;
+	const generatedAt = options.generatedAt ?? DateTime.nowUnsafe();
+	const artifact = {
+		generated_at: DateTime.formatIso(generatedAt),
+		kind: "pipeline-schedule",
+		root_workflow: "root",
+		schedule_id: scheduleId,
+		source_entrypoint: "custom",
+		task: options.task,
+		version: 1,
+		workflows: { root: { nodes: [{
+			command: options.command,
+			id: "command",
+			kind: "command"
+		}] } }
+	};
+	return stringify(appendPullRequestDelivery(options.deliverPullRequest, artifact));
+};
+const normalizeRunnerPayloadForSubmit = (input) => {
+	const repository = normalizeRunnerRepositoryForSubmit(input.payload.repository);
+	if (repository === input.payload.repository) return input;
+	const payload = parseStrictWithSchema(runnerCommandPayloadSchema, {
+		...input.payload,
+		repository
+	});
+	return {
+		payload,
+		payloadJson: encodeRunnerCommandPayloadJson(payload)
+	};
+};
+const submitDynamicRunnerArgoWorkflowEffect = (rawOptions, dependencies) => {
+	const { config: _config, ...schemaOptions } = rawOptions;
+	const options = parseStrictWithSchema(submitDynamicRunnerArgoWorkflowOptionsSchema, schemaOptions);
 	const { payload, payloadJson } = normalizeRunnerPayloadForSubmit({
-		payload: runnerCommandPayloadSchema.parse(parseRunnerCommandPayload(options.payloadJson)),
+		payload: parseStrictWithSchema(runnerCommandPayloadSchema, parseRunnerCommandPayload(options.payloadJson)),
 		payloadJson: options.payloadJson
 	});
-	const compiled = compileScheduleArtifact(config, parseScheduleArtifact(options.scheduleYaml, "schedule.yaml"));
-	const payloadConfigMapName = `pipeline-payload-${randomBytes(6).toString("hex")}`;
-	const scheduleArtifactConfigMapName = `pipeline-schedule-${randomBytes(6).toString("hex")}`;
-	const taskDescriptorConfigMapName = `pipeline-task-descriptors-${randomBytes(6).toString("hex")}`;
-	if (payload.workflow.id !== compiled.workflowId) throw new Error(`Runner payload workflow '${payload.workflow.id}' does not match schedule workflow '${compiled.workflowId}'`);
-	const graphEffect = compileSubmitArgoGraph(compiled).pipe(Effect.mapError((error) => /* @__PURE__ */ new Error(`Schedule '${compiled.workflowId}' cannot be submitted: ${error.message}`)));
+	if (payload.workflow.id !== options.workflowId) return Effect.fail(new ArgoSubmitError({ message: `Runner payload workflow '${payload.workflow.id}' does not match dynamic workflow '${options.workflowId}'` }));
+	const payloadConfigMapName = `pipeline-payload-${randomHex(6)}`;
 	const labels = {
 		"pipeline.oisin.dev/project": payload.run.project,
 		"pipeline.oisin.dev/run-id": payload.run.id,
 		"pipeline.oisin.dev/source": "argo-workflow",
-		"pipeline.oisin.dev/workflow": compiled.workflowId
+		"pipeline.oisin.dev/workflow": options.workflowId
 	};
-	const workflow = buildRunnerArgoWorkflowManifest({
-		annotations: payload.task.kind === "ticket" ? {
-			"pipeline.oisin.dev/ticket-id": payload.task.id,
-			"pipeline.oisin.dev/ticket-project": payload.run.project,
-			"pipeline.oisin.dev/ticket-title": payload.task.title
-		} : {},
+	const annotations = payload.task.kind === "ticket" ? {
+		"pipeline.oisin.dev/ticket-id": payload.task.id,
+		"pipeline.oisin.dev/ticket-project": payload.run.project,
+		"pipeline.oisin.dev/ticket-title": payload.task.title
+	} : {};
+	const workflow = buildDynamicRunnerArgoWorkflowManifest({
 		activeDeadlineSeconds: options.activeDeadlineSeconds,
+		annotations,
 		brokerAuth: options.brokerAuth,
 		dbAuth: options.dbAuth,
-		mcpGatewayAuth: options.mcpGatewayAuth,
 		eventAuthSecretKey: options.eventAuthSecretKey,
 		eventAuthSecretName: options.eventAuthSecretName,
 		generateName: options.generateName,
@@ -125,29 +325,23 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		imagePullPolicy: options.imagePullPolicy,
 		imagePullSecretName: options.imagePullSecretName,
 		labels,
+		mcpGatewayAuth: options.mcpGatewayAuth,
 		name: options.name,
 		namespace: options.namespace,
 		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		payloadConfigMapName,
-		plan: compiled.plan,
-		scheduleConfigMapName: scheduleArtifactConfigMapName,
 		serviceAccountName: options.serviceAccountName,
-		taskDescriptorConfigMapName,
-		ttlStrategy: options.ttlStrategy
+		ttlStrategy: options.ttlStrategy,
+		workflowId: options.workflowId
 	});
-	return Effect.gen(function* () {
-		const graph = yield* graphEffect;
+	return Effect.gen(function* effectBody() {
 		return yield* submitWorkflowWithRunConfigMaps({
 			configMapNames: yield* createRunConfigMaps({
-				configMaps: staticRunConfigMaps({
+				configMaps: dynamicRunConfigMaps({
 					labels,
 					namespace: options.namespace,
 					payloadConfigMapName,
-					payloadJson,
-					scheduleConfigMapName: scheduleArtifactConfigMapName,
-					scheduleYaml: options.scheduleYaml,
-					taskDescriptorConfigMapName,
-					tasks: graph.tasks
+					payloadJson
 				}),
 				dependencies,
 				namespace: options.namespace,
@@ -156,37 +350,45 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			dependencies,
 			namespace: options.namespace,
 			options,
-			resultExtras: {
-				payloadConfigMapName,
-				scheduleConfigMapName: scheduleArtifactConfigMapName,
-				taskDescriptorConfigMapName
-			},
+			resultExtras: { payloadConfigMapName },
 			workflow,
 			workflowFieldOverrides: { podGC: options.podGC }
 		});
 	});
-}
-function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
-	const { config: _config, ...schemaOptions } = rawOptions;
-	const options = submitDynamicRunnerArgoWorkflowOptionsSchema.parse(schemaOptions);
+};
+const submitDynamicRunnerArgoWorkflow = async (rawOptions, dependencies = {}) => await runKubernetesArgoEffect(Effect.suspend(() => submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies)));
+const compileSubmitArgoGraph = (compiled) => Effect.try({
+	catch: (error) => {
+		if (error instanceof ArgoGraphCompilerError) return error;
+		throw error;
+	},
+	try: () => compileArgoExecutionGraph(compiled.plan)
+});
+const submitRunnerArgoWorkflowEffect = (rawOptions, dependencies) => {
+	const { config, ...schemaOptions } = rawOptions;
+	const options = parseStrictWithSchema(submitRunnerArgoWorkflowOptionsSchema, schemaOptions);
 	const { payload, payloadJson } = normalizeRunnerPayloadForSubmit({
-		payload: runnerCommandPayloadSchema.parse(parseRunnerCommandPayload(options.payloadJson)),
+		payload: parseStrictWithSchema(runnerCommandPayloadSchema, parseRunnerCommandPayload(options.payloadJson)),
 		payloadJson: options.payloadJson
 	});
-	if (payload.workflow.id !== options.workflowId) throw new Error(`Runner payload workflow '${payload.workflow.id}' does not match dynamic workflow '${options.workflowId}'`);
-	const payloadConfigMapName = `pipeline-payload-${randomBytes(6).toString("hex")}`;
+	const compiled = compileScheduleArtifact(config, parseScheduleArtifact(options.scheduleYaml, "schedule.yaml"));
+	const payloadConfigMapName = `pipeline-payload-${randomHex(6)}`;
+	const scheduleArtifactConfigMapName = `pipeline-schedule-${randomHex(6)}`;
+	const taskDescriptorConfigMapName = `pipeline-task-descriptors-${randomHex(6)}`;
+	if (payload.workflow.id !== compiled.workflowId) return Effect.fail(new ArgoSubmitError({ message: `Runner payload workflow '${payload.workflow.id}' does not match schedule workflow '${compiled.workflowId}'` }));
+	const graphEffect = compileSubmitArgoGraph(compiled).pipe(Effect.mapError((error) => new ArgoSubmitError({ message: `Schedule '${compiled.workflowId}' cannot be submitted: ${error.message}` })));
 	const labels = {
 		"pipeline.oisin.dev/project": payload.run.project,
 		"pipeline.oisin.dev/run-id": payload.run.id,
 		"pipeline.oisin.dev/source": "argo-workflow",
-		"pipeline.oisin.dev/workflow": options.workflowId
+		"pipeline.oisin.dev/workflow": compiled.workflowId
 	};
 	const annotations = payload.task.kind === "ticket" ? {
 		"pipeline.oisin.dev/ticket-id": payload.task.id,
 		"pipeline.oisin.dev/ticket-project": payload.run.project,
 		"pipeline.oisin.dev/ticket-title": payload.task.title
 	} : {};
-	const workflow = buildDynamicRunnerArgoWorkflowManifest({
+	const workflow = buildRunnerArgoWorkflowManifest({
 		activeDeadlineSeconds: options.activeDeadlineSeconds,
 		annotations,
 		brokerAuth: options.brokerAuth,
@@ -199,24 +401,31 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		image: options.image,
 		imagePullPolicy: options.imagePullPolicy,
 		imagePullSecretName: options.imagePullSecretName,
-		mcpGatewayAuth: options.mcpGatewayAuth,
 		labels,
+		mcpGatewayAuth: options.mcpGatewayAuth,
 		name: options.name,
 		namespace: options.namespace,
 		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		payloadConfigMapName,
+		plan: compiled.plan,
+		scheduleConfigMapName: scheduleArtifactConfigMapName,
 		serviceAccountName: options.serviceAccountName,
-		ttlStrategy: options.ttlStrategy,
-		workflowId: options.workflowId
+		taskDescriptorConfigMapName,
+		ttlStrategy: options.ttlStrategy
 	});
-	return Effect.gen(function* () {
+	return Effect.gen(function* effectBody() {
+		const graph = yield* graphEffect;
 		return yield* submitWorkflowWithRunConfigMaps({
 			configMapNames: yield* createRunConfigMaps({
-				configMaps: dynamicRunConfigMaps({
+				configMaps: staticRunConfigMaps({
 					labels,
 					namespace: options.namespace,
 					payloadConfigMapName,
-					payloadJson
+					payloadJson,
+					scheduleConfigMapName: scheduleArtifactConfigMapName,
+					scheduleYaml: options.scheduleYaml,
+					taskDescriptorConfigMapName,
+					tasks: graph.tasks
 				}),
 				dependencies,
 				namespace: options.namespace,
@@ -225,248 +434,16 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			dependencies,
 			namespace: options.namespace,
 			options,
-			resultExtras: { payloadConfigMapName },
+			resultExtras: {
+				payloadConfigMapName,
+				scheduleConfigMapName: scheduleArtifactConfigMapName,
+				taskDescriptorConfigMapName
+			},
 			workflow,
 			workflowFieldOverrides: { podGC: options.podGC }
 		});
 	});
-}
-function staticRunConfigMaps(input) {
-	return [
-		runConfigMap({
-			data: { "payload.json": input.payloadJson },
-			labels: input.labels,
-			name: input.payloadConfigMapName,
-			namespace: input.namespace
-		}),
-		runConfigMap({
-			data: Object.fromEntries(input.tasks.map((task) => [`${task.taskName}.json`, `${JSON.stringify(buildRunnerTaskDescriptor(task.nodeId))}\n`])),
-			labels: input.labels,
-			name: input.taskDescriptorConfigMapName,
-			namespace: input.namespace
-		}),
-		runConfigMap({
-			data: { "schedule.yaml": input.scheduleYaml },
-			labels: input.labels,
-			name: input.scheduleConfigMapName,
-			namespace: input.namespace
-		})
-	];
-}
-function dynamicRunConfigMaps(input) {
-	return [runConfigMap({
-		data: { "payload.json": input.payloadJson },
-		labels: input.labels,
-		name: input.payloadConfigMapName,
-		namespace: input.namespace
-	})];
-}
-function runConfigMap(input) {
-	return {
-		body: configMapSchema.parse({
-			apiVersion: "v1",
-			data: input.data,
-			kind: "ConfigMap",
-			metadata: {
-				labels: input.labels,
-				name: input.name,
-				namespace: input.namespace
-			}
-		}),
-		name: input.name
-	};
-}
-function createRunConfigMaps(input) {
-	const createdConfigMapNames = [];
-	return Effect.gen(function* () {
-		const service = yield* KubernetesArgoService;
-		yield* Effect.forEach(input.configMaps, (configMap) => service.createConfigMap({
-			body: configMap.body,
-			dependencies: input.dependencies,
-			namespace: input.namespace,
-			options: input.options
-		}).pipe(Effect.tap(() => Effect.sync(() => {
-			createdConfigMapNames.push(configMap.name);
-		}))));
-		return createdConfigMapNames;
-	}).pipe(Effect.catch((error) => cleanupRunConfigMapsOnFailure({
-		configMapNames: createdConfigMapNames,
-		dependencies: input.dependencies,
-		error,
-		namespace: input.namespace,
-		options: input.options
-	})));
-}
-function ownRunConfigMaps(input) {
-	const ownerReference = workflowOwnerReference(input.result);
-	if (ownerReference === void 0) return warnRunConfigMapOwnershipSkipped({
-		error: new Error(missingWorkflowUidMessage(input.result)),
-		result: input.result
-	}).pipe(Effect.as(input.result));
-	return patchRunConfigMapOwnerReferences({
-		body: configMapOwnerReferencesPatch(ownerReference),
-		configMapNames: input.configMapNames,
-		dependencies: input.dependencies,
-		namespace: input.namespace,
-		options: input.options
-	}).pipe(Effect.as(input.result));
-}
-function ownRunConfigMapsBestEffort(input) {
-	return ownRunConfigMaps(input).pipe(Effect.catch((error) => warnRunConfigMapOwnershipSkipped({
-		error,
-		result: input.result
-	}).pipe(Effect.as(input.result))));
-}
-function warnRunConfigMapOwnershipSkipped(input) {
-	return Effect.sync(() => {
-		const reason = errorMessage(input.error);
-		const message = `moka submit: failed to set Workflow ownerReference for ConfigMaps after Argo Workflow '${input.result.workflowName}' was created; leaving ConfigMaps for TTL/sweeper cleanup: ${reason}\n`;
-		process.stderr.write(message);
-	});
-}
-function cleanupRunConfigMapsOnFailure(input) {
-	return deleteRunConfigMaps({
-		configMapNames: input.configMapNames,
-		dependencies: input.dependencies,
-		namespace: input.namespace,
-		options: input.options
-	}).pipe(Effect.catch((cleanupError) => Effect.fail(/* @__PURE__ */ new Error(`Failed to clean up ConfigMaps after submit failure: ${errorMessage(input.error)}; cleanup failed: ${errorMessage(cleanupError)}`))), Effect.flatMap(() => Effect.fail(input.error)));
-}
-function patchRunConfigMapOwnerReferences(input) {
-	return Effect.gen(function* () {
-		const service = yield* KubernetesArgoService;
-		return yield* Effect.all(input.configMapNames.map((name) => service.patchConfigMapOwnerReferences({
-			body: input.body,
-			dependencies: input.dependencies,
-			name,
-			namespace: input.namespace,
-			options: input.options
-		})), { concurrency: "unbounded" });
-	});
-}
-function deleteRunConfigMaps(input) {
-	return Effect.gen(function* () {
-		const service = yield* KubernetesArgoService;
-		return yield* Effect.all(input.configMapNames.map((name) => service.deleteConfigMap({
-			dependencies: input.dependencies,
-			name,
-			namespace: input.namespace,
-			options: input.options
-		})), { concurrency: "unbounded" });
-	});
-}
-function workflowOwnerReference(result) {
-	if (result.workflowUid === void 0) return;
-	return workflowOwnerReferenceSchema.parse({
-		apiVersion: "argoproj.io/v1alpha1",
-		kind: "Workflow",
-		name: result.workflowName,
-		uid: result.workflowUid
-	});
-}
-function missingWorkflowUidMessage(result) {
-	return `Created Argo Workflow '${result.workflowName}' did not include metadata.uid; cannot own ConfigMaps`;
-}
-function configMapOwnerReferencesPatch(ownerReference) {
-	return configMapOwnerReferencesPatchSchema.parse({ metadata: { ownerReferences: [ownerReference] } });
-}
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-function submitWorkflowManifest(input) {
-	return Effect.gen(function* () {
-		const service = yield* KubernetesArgoService;
-		const workflow = applyWorkflowFieldOverrides(input.workflow, input.workflowFieldOverrides);
-		return workflowSubmitResult(yield* service.createWorkflow({
-			body: runnerArgoWorkflowManifestSchema.parse(workflow),
-			dependencies: input.dependencies,
-			namespace: input.namespace,
-			options: input.options
-		}), workflow, {
-			namespace: input.namespace,
-			...input.resultExtras
-		});
-	});
-}
-function submitWorkflowWithRunConfigMaps(input) {
-	return submitWorkflowManifest({
-		dependencies: input.dependencies,
-		namespace: input.namespace,
-		options: input.options,
-		resultExtras: input.resultExtras,
-		workflow: input.workflow,
-		workflowFieldOverrides: input.workflowFieldOverrides
-	}).pipe(Effect.catch((error) => cleanupRunConfigMapsOnFailure({
-		configMapNames: input.configMapNames,
-		dependencies: input.dependencies,
-		error,
-		namespace: input.namespace,
-		options: input.options
-	})), Effect.flatMap((result) => ownRunConfigMapsBestEffort({
-		configMapNames: input.configMapNames,
-		dependencies: input.dependencies,
-		namespace: input.namespace,
-		options: input.options,
-		result
-	})));
-}
-function applyWorkflowFieldOverrides(workflow, overrides) {
-	if (overrides?.podGC === void 0) return workflow;
-	return runnerArgoWorkflowManifestSchema.parse({
-		...workflow,
-		spec: {
-			...workflow.spec,
-			podGC: overrides.podGC
-		}
-	});
-}
-function workflowSubmitResult(response, workflow, base) {
-	const created = createdWorkflowSchema.parse(response);
-	return workflowSubmitResultSchema.parse({
-		...base,
-		workflowName: created.metadata.name ?? workflow.metadata.name,
-		workflowUid: created.metadata.uid
-	});
-}
-function buildCommandScheduleYaml(rawOptions) {
-	const options = commandScheduleOptionsSchema.parse(rawOptions);
-	const scheduleId = options.scheduleId ?? `custom-${randomBytes(8).toString("hex")}`;
-	const artifact = {
-		generated_at: options.generatedAt.toISOString(),
-		kind: "pipeline-schedule",
-		root_workflow: "root",
-		schedule_id: scheduleId,
-		source_entrypoint: "custom",
-		task: options.task,
-		version: 1,
-		workflows: { root: { nodes: [{
-			command: options.command,
-			id: "command",
-			kind: "command"
-		}] } }
-	};
-	return stringify(appendPullRequestDelivery(options.deliverPullRequest, artifact));
-}
-function normalizeRunnerPayloadForSubmit(input) {
-	const repository = normalizeRunnerRepositoryForSubmit(input.payload.repository);
-	if (repository === input.payload.repository) return input;
-	const payload = runnerCommandPayloadSchema.parse({
-		...input.payload,
-		repository
-	});
-	return {
-		payload,
-		payloadJson: JSON.stringify(payload)
-	};
-}
-function compileSubmitArgoGraph(compiled) {
-	return Effect.try({
-		try: () => compileArgoExecutionGraph(compiled.plan),
-		catch: (error) => {
-			if (error instanceof ArgoGraphCompilerError) return error;
-			throw error;
-		}
-	});
-}
+};
+const submitRunnerArgoWorkflow = async (rawOptions, dependencies = {}) => await runKubernetesArgoEffect(Effect.suspend(() => submitRunnerArgoWorkflowEffect(rawOptions, dependencies)));
 //#endregion
 export { buildCommandScheduleYaml, submitDynamicRunnerArgoWorkflow, submitRunnerArgoWorkflow };