@oisincoveney/pipeline 3.24.2 → 4.0.0

package/dist/runtime/services/config-io-service.js

@@ -1,9 +1,14 @@
-import { PipelineConfigError, configIssuesFromZodError, validationError } from "../../config/schemas.js";
+import { parseResultWithSchema } from "../../schema-boundary.js";
+import { PipelineConfigError, configIssuesFromSchemaIssues, validationError } from "../../config/schemas.js";
+import { throwCauseFailure, unknownErrorMessage } from "../../effect-sync-errors.js";
+import * as Effect from "effect/Effect";
+import * as Option$1 from "effect/Option";
 import { parseDocument } from "yaml";
-import { Cause, Context, Effect, Layer, Option } from "effect";
 import { existsSync, readFileSync } from "node:fs";
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
 //#region src/runtime/services/config-io-service.ts
-function parseYamlSource(source, sourcePath) {
+const parseYamlSource = (source, sourcePath) => {
 	const document = parseDocument(source, {
 		prettyErrors: false,
 		uniqueKeys: true
@@ -13,30 +18,28 @@ function parseYamlSource(source, sourcePath) {
 		path: sourcePath
 	})));
 	return document.toJS();
-}
+};
 var ConfigIoService = class extends Context.Service()("ConfigIoService") {};
 const ConfigIoServiceLive = Layer.succeed(ConfigIoService, {
 	parseYaml: (source, sourcePath) => Effect.try({
-		try: () => parseYamlSource(source, sourcePath),
-		catch: (error) => error
+		catch: (error) => error instanceof PipelineConfigError ? error : new PipelineConfigError("PIPELINE_CONFIG_PARSE_ERROR", `Failed to parse ${sourcePath}`, [{
+			message: unknownErrorMessage(error),
+			path: sourcePath
+		}]),
+		try: () => parseYamlSource(source, sourcePath)
 	}),
-	readOptionalText: (path) => Effect.sync(() => existsSync(path) ? readFileSync(path, "utf8") : null),
-	readText: (path) => Effect.sync(() => readFileSync(path, "utf8"))
+	readOptionalText: (path) => Effect.sync(() => existsSync(path) ? Option$1.some(readFileSync(path, "utf-8")) : Option$1.none()),
+	readText: (path) => Effect.sync(() => readFileSync(path, "utf-8"))
 });
-function parseConfigYamlAs(source, sourcePath, schema) {
-	return Effect.gen(function* () {
-		const yaml = yield* (yield* ConfigIoService).parseYaml(source, sourcePath);
-		const parsed = schema.safeParse(yaml);
-		if (!parsed.success) return yield* Effect.fail(validationError(configIssuesFromZodError(parsed.error)));
-		return parsed.data;
-	});
-}
-function runConfigIoSync(program) {
+const parseConfigYamlAs = (source, sourcePath, schema) => Effect.gen(function* effectBody() {
+	const parsed = parseResultWithSchema(schema, yield* (yield* ConfigIoService).parseYaml(source, sourcePath), { onExcessProperty: "error" });
+	if (!parsed.ok) return yield* Effect.fail(validationError(configIssuesFromSchemaIssues(parsed.issues)));
+	return parsed.value;
+});
+const runConfigIoSync = (program) => {
 	const exit = Effect.runSyncExit(Effect.provide(program, ConfigIoServiceLive));
 	if (exit._tag === "Success") return exit.value;
-	const failure = Cause.findErrorOption(exit.cause);
-	if (Option.isSome(failure)) throw failure.value;
-	throw Cause.squash(exit.cause);
-}
+	return throwCauseFailure(exit.cause);
+};
 //#endregion
 export { ConfigIoService, parseConfigYamlAs, runConfigIoSync };

package/dist/runtime/services/drain-merge-git-service.js

@@ -4,7 +4,7 @@ import simpleGit from "simple-git";
 var DrainMergeGitService = class extends Context.Service()("DrainMergeGitService") {};
 const DrainMergeGitServiceLive = Layer.succeed(DrainMergeGitService, { create: (baseDir) => Effect.sync(() => {
 	const git = simpleGit({ baseDir });
-	return { raw: (args) => Effect.tryPromise(() => git.raw(args)) };
+	return { raw: (args) => Effect.tryPromise(async () => await git.raw(args)) };
 }) });
 //#endregion
 export { DrainMergeGitService, DrainMergeGitServiceLive };

package/dist/runtime/services/file-system-service.js

@@ -1,19 +1,21 @@
-import { Cause, Context, Effect, Layer, Option } from "effect";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { Cause, Context, Effect, Layer, Option } from "effect";
 //#region src/runtime/services/file-system-service.ts
 var FileSystemService = class extends Context.Service()("FileSystemService") {};
 const FileSystemServiceLive = Layer.succeed(FileSystemService, {
 	exists: (path) => Effect.sync(() => existsSync(path)),
 	readText: (path) => Effect.try({
-		try: () => readFileSync(path, "utf8"),
-		catch: (error) => error
+		catch: (error) => error,
+		try: () => readFileSync(path, "utf-8")
 	}),
 	writeText: (path, contents) => Effect.try({
-		try: () => writeFileSync(path, contents),
-		catch: (error) => error
+		catch: (error) => error,
+		try: () => {
+			writeFileSync(path, contents);
+		}
 	})
 });
-function runFileSystemSync(program, layer) {
+const runFileSystemSync = (program, layer) => {
 	const exit = Effect.runSyncExit(Effect.provide(program, layer));
 	switch (exit._tag) {
 		case "Success": return exit.value;
@@ -24,6 +26,6 @@ function runFileSystemSync(program, layer) {
 		}
 		default: throw new Error("unreachable Effect exit state");
 	}
-}
+};
 //#endregion
 export { FileSystemService, FileSystemServiceLive, runFileSystemSync };

package/dist/runtime/services/git-porcelain-service.js

@@ -6,17 +6,18 @@ const execGit = promisify(execFile);
 var GitPorcelainService = class extends Context.Service()("GitPorcelainService") {};
 const GitPorcelainServiceLive = Layer.succeed(GitPorcelainService, {
 	run: (cwd, args, env) => Effect.tryPromise({
+		catch: (error) => error,
 		try: async () => {
 			const { stdout } = await execGit("git", args, {
 				cwd,
-				encoding: "utf8",
+				encoding: "utf-8",
 				env
 			});
 			return stdout;
-		},
-		catch: (error) => error
+		}
 	}),
 	statusPorcelain: (cwd) => Effect.try({
+		catch: (error) => error,
 		try: () => execFileSync("git", [
 			"status",
 			"--porcelain=v1",
@@ -24,14 +25,13 @@ const GitPorcelainServiceLive = Layer.succeed(GitPorcelainService, {
 			"-z"
 		], {
 			cwd,
-			encoding: "utf8",
+			encoding: "utf-8",
 			stdio: [
 				"ignore",
 				"pipe",
 				"ignore"
 			]
-		}),
-		catch: (error) => error
+		})
 	})
 });
 //#endregion

package/dist/runtime/services/kubernetes-argo-service.d.ts

@@ -1,14 +1,21 @@
 import { WorkflowReadApi } from "../../loop/argo-poll.js";
 import { Context, Effect, Layer } from "effect";
-import { CoreV1Api, CustomObjectsApi, KubeConfig } from "@kubernetes/client-node";
-
+import { CoreV1Api, KubeConfig } from "@kubernetes/client-node";
 //#region src/runtime/services/kubernetes-argo-service.d.ts
 interface CoreApi {
   readonly createNamespacedConfigMap: (param: Parameters<CoreV1Api["createNamespacedConfigMap"]>[0], options?: Parameters<CoreV1Api["createNamespacedConfigMap"]>[1]) => Promise<unknown>;
   readonly deleteNamespacedConfigMap: (param: Parameters<CoreV1Api["deleteNamespacedConfigMap"]>[0], options?: Parameters<CoreV1Api["deleteNamespacedConfigMap"]>[1]) => Promise<unknown>;
   readonly patchNamespacedConfigMap: (param: Parameters<CoreV1Api["patchNamespacedConfigMap"]>[0], options?: Parameters<CoreV1Api["patchNamespacedConfigMap"]>[1]) => Promise<unknown>;
 }
-type WorkflowApi = Pick<CustomObjectsApi, "createNamespacedCustomObject">;
+interface WorkflowApi {
+  readonly createNamespacedCustomObject: (param: {
+    readonly body: unknown;
+    readonly group: string;
+    readonly namespace: string;
+    readonly plural: string;
+    readonly version: string;
+  }) => Promise<unknown>;
+}
 interface KubernetesArgoIoDependencies {
   coreApi?: CoreApi;
   kubeConfig?: KubeConfig;

package/dist/runtime/services/kubernetes-argo-service.js

@@ -1,73 +1,110 @@
+import { stringField } from "../../unknown-fields.js";
 import { classifyArgoPhase, extractArgoRawPhase } from "../../loop/argo-poll.js";
-import { Context, Effect, Layer } from "effect";
+import { getOrElse, isSome, none, some } from "effect/Option";
 import { execa } from "execa";
+import { Context, Effect, Layer } from "effect";
 import { CoreV1Api, CustomObjectsApi, KubeConfig, PatchStrategy, setHeaderOptions } from "@kubernetes/client-node";
 //#region src/runtime/services/kubernetes-argo-service.ts
+const textOption = (value) => value === void 0 || value.length === 0 ? none() : some(value);
 var KubernetesArgoService = class extends Context.Service()("KubernetesArgoService") {};
+const resolveKubeConfig = (options, dependencies) => {
+	if (dependencies.kubeConfig !== void 0) return dependencies.kubeConfig;
+	const kubeConfig = new KubeConfig();
+	const kubeconfigPath = textOption(options.kubeconfigPath);
+	if (isSome(kubeconfigPath)) kubeConfig.loadFromFile(kubeconfigPath.value);
+	else kubeConfig.loadFromDefault();
+	const kubeContext = textOption(options.kubeContext);
+	if (isSome(kubeContext)) {
+		if (kubeConfig.getContextObject(kubeContext.value) === null) throw new Error(`Kube context '${kubeContext.value}' was not found in the resolved kubeconfig`);
+		kubeConfig.setCurrentContext(kubeContext.value);
+	}
+	return kubeConfig;
+};
+const buildApiClients = (kubeConfig, dependencies) => ({
+	coreApi: dependencies.coreApi ?? kubeConfig.makeApiClient(CoreV1Api),
+	workflowApi: dependencies.workflowApi ?? kubeConfig.makeApiClient(CustomObjectsApi)
+});
+const apiClients = (options, dependencies) => {
+	if (dependencies.coreApi !== void 0 && dependencies.workflowApi !== void 0) return {
+		coreApi: dependencies.coreApi,
+		workflowApi: dependencies.workflowApi
+	};
+	return buildApiClients(resolveKubeConfig(options, dependencies), dependencies);
+};
+const readApiClient = (options, dependencies) => {
+	if (dependencies.workflowReadApi !== void 0) return dependencies.workflowReadApi;
+	return resolveKubeConfig(options, dependencies).makeApiClient(CustomObjectsApi);
+};
+const kubectlArgs = (args, kubeContext) => {
+	const context = textOption(kubeContext);
+	return isSome(context) ? [
+		"--context",
+		context.value,
+		...args
+	] : [...args];
+};
+const kubectlErrorStderr = (error) => {
+	const stderr = stringField(error, "stderr");
+	if (isSome(stderr)) return stderr.value.trim();
+	return getOrElse(stringField(error, "shortMessage"), () => "kubectl failed").trim();
+};
+const kubectlErrorStdout = (error) => getOrElse(stringField(error, "stdout"), () => "").trim();
 const KubernetesArgoServiceLive = Layer.succeed(KubernetesArgoService, {
 	createConfigMap: ({ body, dependencies, namespace, options }) => Effect.try({
-		try: () => apiClients(options, dependencies),
-		catch: (error) => error
+		catch: (error) => error,
+		try: () => apiClients(options, dependencies)
 	}).pipe(Effect.flatMap(({ coreApi }) => Effect.tryPromise({
-		try: () => coreApi.createNamespacedConfigMap({
+		catch: (error) => error,
+		try: async () => await coreApi.createNamespacedConfigMap({
 			body,
 			namespace
-		}),
-		catch: (error) => error
-	}))),
-	deleteConfigMap: ({ dependencies, name, namespace, options }) => Effect.try({
-		try: () => apiClients(options, dependencies),
-		catch: (error) => error
-	}).pipe(Effect.flatMap(({ coreApi }) => Effect.tryPromise({
-		try: () => coreApi.deleteNamespacedConfigMap({
-			name,
-			namespace
-		}),
-		catch: (error) => error
+		})
 	}))),
 	createWorkflow: ({ body, dependencies, namespace, options }) => Effect.try({
-		try: () => apiClients(options, dependencies),
-		catch: (error) => error
+		catch: (error) => error,
+		try: () => apiClients(options, dependencies)
 	}).pipe(Effect.flatMap(({ workflowApi }) => Effect.tryPromise({
-		try: () => workflowApi.createNamespacedCustomObject({
+		catch: (error) => error,
+		try: async () => await workflowApi.createNamespacedCustomObject({
 			body,
 			group: "argoproj.io",
 			namespace,
 			plural: "workflows",
 			version: "v1alpha1"
-		}),
-		catch: (error) => error
+		})
+	}))),
+	deleteConfigMap: ({ dependencies, name, namespace, options }) => Effect.try({
+		catch: (error) => error,
+		try: () => apiClients(options, dependencies)
+	}).pipe(Effect.flatMap(({ coreApi }) => Effect.tryPromise({
+		catch: (error) => error,
+		try: async () => await coreApi.deleteNamespacedConfigMap({
+			name,
+			namespace
+		})
 	}))),
 	getWorkflowPhase: ({ dependencies, name, namespace, options }) => Effect.try({
-		try: () => readApiClient(options, dependencies),
-		catch: (error) => error
+		catch: (error) => error,
+		try: () => readApiClient(options, dependencies)
 	}).pipe(Effect.flatMap((workflowReadApi) => Effect.tryPromise({
-		try: () => workflowReadApi.getNamespacedCustomObject({
+		catch: (error) => error,
+		try: async () => await workflowReadApi.getNamespacedCustomObject({
 			group: "argoproj.io",
 			name,
 			namespace,
 			plural: "workflows",
 			version: "v1alpha1"
-		}),
-		catch: (error) => error
+		})
 	})), Effect.map((resource) => classifyArgoPhase(extractArgoRawPhase(resource)))),
-	patchConfigMapOwnerReferences: ({ body, dependencies, name, namespace, options }) => Effect.try({
-		try: () => apiClients(options, dependencies),
-		catch: (error) => error
-	}).pipe(Effect.flatMap(({ coreApi }) => Effect.tryPromise({
-		try: () => coreApi.patchNamespacedConfigMap({
-			body,
-			name,
-			namespace
-		}, setHeaderOptions("Content-Type", PatchStrategy.MergePatch)),
-		catch: (error) => error
-	}))),
 	kubectl: (args, options) => Effect.tryPromise({
-		try: () => execa("kubectl", kubectlArgs(args, options.kubeContext), {
-			env: options.kubeconfigPath ? { KUBECONFIG: options.kubeconfigPath } : void 0,
-			stdin: "ignore"
-		}),
-		catch: (error) => error
+		catch: (error) => error,
+		try: async () => {
+			const kubeconfigPath = textOption(options.kubeconfigPath);
+			return await execa("kubectl", kubectlArgs(args, options.kubeContext), {
+				env: isSome(kubeconfigPath) ? { KUBECONFIG: kubeconfigPath.value } : void 0,
+				stdin: "ignore"
+			});
+		}
 	}).pipe(Effect.map((result) => ({
 		ok: true,
 		stderr: result.stderr,
@@ -76,49 +113,18 @@ const KubernetesArgoServiceLive = Layer.succeed(KubernetesArgoService, {
 		ok: false,
 		stderr: kubectlErrorStderr(error),
 		stdout: kubectlErrorStdout(error)
+	}))),
+	patchConfigMapOwnerReferences: ({ body, dependencies, name, namespace, options }) => Effect.try({
+		catch: (error) => error,
+		try: () => apiClients(options, dependencies)
+	}).pipe(Effect.flatMap(({ coreApi }) => Effect.tryPromise({
+		catch: (error) => error,
+		try: async () => await coreApi.patchNamespacedConfigMap({
+			body,
+			name,
+			namespace
+		}, setHeaderOptions("Content-Type", PatchStrategy.MergePatch))
 	})))
 });
-function resolveKubeConfig(options, dependencies) {
-	if (dependencies.kubeConfig) return dependencies.kubeConfig;
-	const kubeConfig = new KubeConfig();
-	if (options.kubeconfigPath) kubeConfig.loadFromFile(options.kubeconfigPath);
-	else kubeConfig.loadFromDefault();
-	if (options.kubeContext) {
-		if (!kubeConfig.getContextObject(options.kubeContext)) throw new Error(`Kube context '${options.kubeContext}' was not found in the resolved kubeconfig`);
-		kubeConfig.setCurrentContext(options.kubeContext);
-	}
-	return kubeConfig;
-}
-function apiClients(options, dependencies) {
-	if (dependencies.coreApi && dependencies.workflowApi) return {
-		coreApi: dependencies.coreApi,
-		workflowApi: dependencies.workflowApi
-	};
-	return buildApiClients(resolveKubeConfig(options, dependencies), dependencies);
-}
-function buildApiClients(kubeConfig, dependencies) {
-	return {
-		coreApi: dependencies.coreApi ?? kubeConfig.makeApiClient(CoreV1Api),
-		workflowApi: dependencies.workflowApi ?? kubeConfig.makeApiClient(CustomObjectsApi)
-	};
-}
-function readApiClient(options, dependencies) {
-	if (dependencies.workflowReadApi) return dependencies.workflowReadApi;
-	return resolveKubeConfig(options, dependencies).makeApiClient(CustomObjectsApi);
-}
-function kubectlArgs(args, kubeContext) {
-	return kubeContext ? [
-		"--context",
-		kubeContext,
-		...args
-	] : [...args];
-}
-function kubectlErrorStderr(error) {
-	const parsed = error;
-	return (parsed.stderr || parsed.shortMessage || "kubectl failed").trim();
-}
-function kubectlErrorStdout(error) {
-	return (error.stdout || "").trim();
-}
 //#endregion
 export { KubernetesArgoService, KubernetesArgoServiceLive, resolveKubeConfig };

package/dist/runtime/services/kubernetes-jobs-read-service.js

@@ -0,0 +1,115 @@
+import { isRecord } from "../../safe-json.js";
+import { numberField, stringField } from "../../unknown-fields.js";
+import { resolveKubeConfig } from "./kubernetes-argo-service.js";
+import { JOB_LABEL_NODE, JOB_LABEL_RUN_ID } from "../../remote/jobs/policy.js";
+import * as Effect from "effect/Effect";
+import * as Option$1 from "effect/Option";
+import * as R from "effect/Record";
+import * as Arr from "effect/Array";
+import { BatchV1Api, CoreV1Api } from "@kubernetes/client-node";
+//#region src/runtime/services/kubernetes-jobs-read-service.ts
+const field = (value, key) => isRecord(value) ? value[key] : void 0;
+const nodeIdOf = (item) => stringField(field(field(item, "metadata"), "labels"), JOB_LABEL_NODE);
+const numberOr = (value, key) => Option$1.getOrElse(numberField(value, key), () => 0);
+const stringOr = (value, key) => Option$1.getOrElse(stringField(value, key), () => "");
+const toCondition = (raw) => ({
+	...Option$1.match(stringField(raw, "reason"), {
+		onNone: () => ({}),
+		onSome: (reason) => ({ reason })
+	}),
+	status: stringOr(raw, "status"),
+	type: stringOr(raw, "type")
+});
+const toObservedJob = (item) => {
+	const status = field(item, "status");
+	const conditions = field(status, "conditions");
+	return {
+		active: numberOr(status, "active"),
+		conditions: Arr.isArray(conditions) ? conditions.map(toCondition) : [],
+		failed: numberOr(status, "failed"),
+		succeeded: numberOr(status, "succeeded")
+	};
+};
+const toObservedPod = (item) => {
+	const status = field(item, "status");
+	return {
+		phase: stringOr(status, "phase"),
+		...Option$1.match(stringField(status, "reason"), {
+			onNone: () => ({}),
+			onSome: (reason) => ({ reason })
+		})
+	};
+};
+const pair = (key, value) => [key, value];
+const itemsOf = (list) => {
+	const items = field(list, "items");
+	return Arr.isArray(items) ? items : [];
+};
+const nodeEntries = (items, project) => items.flatMap((item) => Arr.fromOption(Option$1.map(nodeIdOf(item), (nodeId) => pair(nodeId, project(item)))));
+/**
+* Fold a run's raw `V1JobList` + `V1PodList` into the per-node observation the
+* reconcile classifier consumes. Each Job/pod is keyed by its `node` label; a
+* node that has pods but no Job (Job GC'd while a pod lingers) surfaces with an
+* absent `job`, which the classifier treats as the dead-Job signal.
+*/
+const parseRunObservation = (jobList, podList) => {
+	const jobsByNode = R.fromEntries(nodeEntries(itemsOf(jobList), toObservedJob));
+	const podPairs = nodeEntries(itemsOf(podList), toObservedPod);
+	const podsByNode = Arr.groupBy(podPairs, ([nodeId]) => nodeId);
+	const nodeIds = Arr.dedupe([...R.keys(jobsByNode), ...R.keys(podsByNode)]);
+	return { nodes: R.fromEntries(nodeIds.map((nodeId) => {
+		const pods = Option$1.match(R.get(podsByNode, nodeId), {
+			onNone: () => [],
+			onSome: (grouped) => grouped.map(([, pod]) => pod)
+		});
+		const observation = Option$1.match(R.get(jobsByNode, nodeId), {
+			onNone: () => ({ pods }),
+			onSome: (job) => ({
+				job,
+				pods
+			})
+		});
+		return pair(nodeId, observation);
+	})) };
+};
+const listApiClient = (options, dependencies) => {
+	if (dependencies.listApi !== void 0) return dependencies.listApi;
+	const kubeConfig = resolveKubeConfig(options, { kubeConfig: dependencies.kubeConfig });
+	const batchApi = kubeConfig.makeApiClient(BatchV1Api);
+	const coreApi = kubeConfig.makeApiClient(CoreV1Api);
+	return {
+		listJobs: async ({ labelSelector, namespace }) => await batchApi.listNamespacedJob({
+			labelSelector,
+			namespace
+		}),
+		listPods: async ({ labelSelector, namespace }) => await coreApi.listNamespacedPod({
+			labelSelector,
+			namespace
+		})
+	};
+};
+/**
+* Build the {@link JobFleetReadApi} the reconcile loop reads cluster truth
+* through. Lists a run's Jobs+pods by its run-id label and folds them via
+* {@link parseRunObservation}. Client resolution is deferred into the Effect so
+* a kubeconfig failure surfaces as a typed error, not a constructor throw.
+*/
+const kubernetesJobFleetReadApi = (options, dependencies = {}) => ({ observeRun: ({ namespace, runId }) => Effect.try({
+	catch: (error) => error,
+	try: () => listApiClient(options, dependencies)
+}).pipe(Effect.flatMap((listApi) => Effect.tryPromise({
+	catch: (error) => error,
+	try: async () => {
+		const labelSelector = `${JOB_LABEL_RUN_ID}=${runId}`;
+		const [jobList, podList] = await Promise.all([listApi.listJobs({
+			labelSelector,
+			namespace
+		}), listApi.listPods({
+			labelSelector,
+			namespace
+		})]);
+		return parseRunObservation(jobList, podList);
+	}
+}))) });
+//#endregion
+export { kubernetesJobFleetReadApi, parseRunObservation };

package/dist/runtime/services/kubernetes-jobs-service.d.ts

@@ -0,0 +1,37 @@
+import "./kubernetes-argo-service.js";
+import { RunnerJobManifest } from "../../remote/jobs/model.js";
+import { Context, Effect, Layer } from "effect";
+import { KubeConfig } from "@kubernetes/client-node";
+//#region src/runtime/services/kubernetes-jobs-service.d.ts
+/**
+ * Client seam for the Jobs transport (doc-1 decision 3). Deliberately narrow:
+ * the only cluster mutation the coordinator performs to launch a node is
+ * `createNamespacedJob`. There is NO ConfigMap method here — that is the
+ * structural guarantee behind ENG-18 AC#2 ("zero per-run ConfigMaps"): the
+ * Jobs path cannot create a ConfigMap because it holds no ConfigMap client.
+ *
+ * Client injection mirrors {@link KubernetesArgoService}: tests pass a fake
+ * `batchApi`; production resolves a real {@link BatchV1Api} from the kubeconfig.
+ */
+interface BatchApi {
+  readonly createNamespacedJob: (param: {
+    readonly body: RunnerJobManifest;
+    readonly namespace: string;
+  }) => Promise<unknown>;
+  /**
+   * ENG-57.6: read one Job by name — the OBSERVE half of create-or-observe. When
+   * a deterministic `(run, node, generation)` create races (or replays) into an
+   * AlreadyExists, the coordinator reads the existing Job rather than creating a
+   * duplicate. Optional so pre-57.6 fakes/callers that never observe stay valid.
+   */
+  readonly readNamespacedJob?: (param: {
+    readonly name: string;
+    readonly namespace: string;
+  }) => Promise<unknown>;
+}
+interface KubernetesJobsIoDependencies {
+  batchApi?: BatchApi;
+  kubeConfig?: KubeConfig;
+}
+//#endregion
+export { BatchApi, KubernetesJobsIoDependencies };

package/dist/runtime/services/kubernetes-jobs-service.js

@@ -0,0 +1,45 @@
+import { resolveKubeConfig } from "./kubernetes-argo-service.js";
+import { Context, Effect, Layer } from "effect";
+import { BatchV1Api } from "@kubernetes/client-node";
+//#region src/runtime/services/kubernetes-jobs-service.ts
+const batchApiClient = (options, dependencies) => {
+	if (dependencies.batchApi !== void 0) return dependencies.batchApi;
+	return resolveKubeConfig(options, { kubeConfig: dependencies.kubeConfig }).makeApiClient(BatchV1Api);
+};
+/** Raised when a create-or-observe read is required but the injected client has
+* no read capability — a wiring error, surfaced rather than silently skipped. */
+var JobReadUnsupportedError = class extends Error {
+	constructor() {
+		super("KubernetesJobsService read: injected BatchApi does not support readNamespacedJob");
+		this.name = "JobReadUnsupportedError";
+	}
+};
+var KubernetesJobsService = class extends Context.Service()("KubernetesJobsService") {};
+const KubernetesJobsServiceLive = Layer.succeed(KubernetesJobsService, {
+	createJob: ({ body, dependencies, namespace, options }) => Effect.try({
+		catch: (error) => error,
+		try: () => batchApiClient(options, dependencies)
+	}).pipe(Effect.flatMap((batchApi) => Effect.tryPromise({
+		catch: (error) => error,
+		try: async () => await batchApi.createNamespacedJob({
+			body,
+			namespace
+		})
+	}))),
+	readJob: ({ dependencies, name, namespace, options }) => Effect.try({
+		catch: (error) => error,
+		try: () => batchApiClient(options, dependencies)
+	}).pipe(Effect.flatMap((batchApi) => {
+		const read = batchApi.readNamespacedJob;
+		if (read === void 0) return Effect.fail(new JobReadUnsupportedError());
+		return Effect.tryPromise({
+			catch: (error) => error,
+			try: async () => await read({
+				name,
+				namespace
+			})
+		});
+	}))
+});
+//#endregion
+export { JobReadUnsupportedError, KubernetesJobsService, KubernetesJobsServiceLive };

package/dist/runtime/services/kubernetes-jobs-watch-service.js

@@ -0,0 +1,61 @@
+import { resolveKubeConfig } from "./kubernetes-argo-service.js";
+import { JOBS_TRANSPORT_SOURCE, JOB_LABEL_SOURCE } from "../../remote/jobs/policy.js";
+import * as Effect from "effect/Effect";
+import * as Option$1 from "effect/Option";
+import { Watch } from "@kubernetes/client-node";
+import * as Queue from "effect/Queue";
+//#region src/runtime/services/kubernetes-jobs-watch-service.ts
+const watchStarterOf = (options, dependencies) => {
+	if (dependencies.watchStarter !== void 0) return dependencies.watchStarter;
+	const watch = new Watch(resolveKubeConfig(options, { kubeConfig: dependencies.kubeConfig }));
+	return async (path, queryParams, callback, done) => watch.watch(path, queryParams, callback, done);
+};
+const jobsPath = (namespace) => `/apis/batch/v1/namespaces/${namespace}/jobs`;
+const podsPath = (namespace) => `/api/v1/namespaces/${namespace}/pods`;
+/** Open one watch stream, bridging its `callback`/`done` onto `queue`, and
+* register its `AbortController` for release on any scope exit. */
+const openWatch = (starter, path, labelSelector, queue) => Effect.acquireRelease(Effect.tryPromise({
+	catch: (error) => error,
+	try: async () => starter(path, { labelSelector }, () => Effect.runSync(Queue.offer(queue, { kind: "event" })), (error) => Effect.runSync(Queue.offer(queue, {
+		error,
+		kind: "done"
+	})))
+}), (controller) => Effect.sync(() => controller.abort()));
+/** Register the caller-abort listener for release (removal) on any scope exit. */
+const registerAbortListener = (signal, queue) => Option$1.match(signal, {
+	onNone: () => Effect.void,
+	onSome: (activeSignal) => {
+		const onAbort = () => {
+			Effect.runSync(Queue.offer(queue, { kind: "aborted" }));
+		};
+		return Effect.acquireRelease(Effect.sync(() => activeSignal.addEventListener("abort", onAbort, { once: true })), () => Effect.sync(() => activeSignal.removeEventListener("abort", onAbort)));
+	}
+});
+/** Drain the shared queue: run `onEvent` per event, sequenced and awaited (so a
+* failing reconcile surfaces through the Effect failure channel, same as a
+* transport error); stop at the first terminal message from either stream or
+* the caller-abort listener. */
+const drainSession = (queue, onEvent) => Effect.gen(function* drain() {
+	const message = yield* Queue.take(queue);
+	if (message.kind === "aborted") return "aborted";
+	if (message.kind === "done") {
+		if (message.error !== null && message.error !== void 0) return yield* Effect.fail(message.error);
+		return "closed";
+	}
+	yield* onEvent;
+	return yield* drainSession(queue, onEvent);
+});
+const kubernetesJobFleetWatchApi = (options, dependencies = {}) => ({ watchSession: ({ namespace, onEvent }) => {
+	if (dependencies.signal?.aborted === true) return Effect.succeed("aborted");
+	return Effect.scoped(Effect.gen(function* session() {
+		const starter = watchStarterOf(options, dependencies);
+		const labelSelector = `${JOB_LABEL_SOURCE}=${JOBS_TRANSPORT_SOURCE}`;
+		const queue = yield* Queue.unbounded();
+		yield* openWatch(starter, jobsPath(namespace), labelSelector, queue);
+		yield* openWatch(starter, podsPath(namespace), labelSelector, queue);
+		yield* registerAbortListener(Option$1.fromNullishOr(dependencies.signal), queue);
+		return yield* drainSession(queue, onEvent);
+	}));
+} });
+//#endregion
+export { kubernetesJobFleetWatchApi };