@skaile/provider-k8s 0.0.0

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# @skaile/provider-k8s
+
+## 0.1.0
+
+- Initial release (ClusterIP + port-forward).

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Skaile
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,64 @@
+# @skaile/provider-k8s
+
+A [Kubernetes](https://kubernetes.io/) deploy target for
+[`@skaile/workspaces`](https://www.npmjs.com/package/@skaile/workspaces). v0.1.0
+stands a workspace up as a Pod behind a ClusterIP Service and reaches it over a
+local `kubectl port-forward` tunnel.
+
+## Install
+
+```bash
+skaile plugin install @skaile/provider-k8s
+```
+
+The `@kubernetes/client-node` SDK is an **optional peer dependency** — install it
+in your project so the provider can lazy-load it at runtime:
+
+```bash
+npm install @kubernetes/client-node
+```
+
+Add it to `skaile.yaml`:
+
+```yaml
+plugins:
+  - "@skaile/provider-k8s@^0.1.0"
+
+deploy:
+  target: k8s
+  config:
+    namespace: default
+    image: ghcr.io/me/workspace:1
+    port: 8080
+```
+
+## Config
+
+| Field | Type | Default | Notes |
+|---|---|---|---|
+| `namespace` | string | `default` | Target namespace |
+| `image` | string | — | Workspace image (required — bring-your-own) |
+| `port` | number | `8080` | Container + service port |
+| `serviceAccount` | string | — | Pod service account |
+| `env` | record | `{}` | Extra container env |
+| `serviceType` | `ClusterIP` | `ClusterIP` | Only ClusterIP in v0.1.0 |
+| `localForwardPort` | number | — | Local port for the forward tunnel |
+| `buildStrategy` | `local \| remote \| managed` | `local` | k8s is bring-your-own-image |
+
+## How it works
+
+- `@kubernetes/client-node` is lazy-loaded via a dynamic `import()` inside
+  `create()`/`restore()`, so this package builds and typechecks without the SDK
+  installed (offline-safe).
+- Creates a Pod + ClusterIP Service, waits for the Pod to reach `Running`, and
+  exposes `ws://127.0.0.1:<localForwardPort|port>` via a port-forward tunnel.
+- `tlsTermination: "edge"` (TLS terminates at the cluster ingress; the
+  port-forward tunnel is loopback-only on the operator's machine).
+
+## Limitations (v0.1.0)
+
+- ClusterIP + port-forward only. NodePort / LoadBalancer / Ingress are future
+  work (they add ingress class, annotations, and TLS cert source knobs).
+- Bring-your-own-image: in-cluster builds are not performed.
+- Requires `@kubernetes/client-node` and a working kubeconfig in the host
+  environment at runtime.

package/dist/index.d.ts

@@ -0,0 +1,135 @@
+import { DeployTarget, PluginRegistry } from '@skaile/workspaces/plugin-registry';
+import * as z from 'zod';
+
+/**
+ * Minimal local interface for `@kubernetes/client-node` — only the members this
+ * provider actually calls.
+ *
+ * The SDK is an *optional* peer dependency, lazy-loaded via a string-literal
+ * dynamic `import()`. Typing against this minimal surface (rather than the real
+ * package's types) keeps the package building + typechecking standalone
+ * offline; the host project supplies the real SDK at runtime.
+ */
+/** A `V1Pod`-ish object (subset we read). */
+interface K8sPod {
+    metadata?: {
+        name?: string;
+        namespace?: string;
+    };
+    status?: {
+        phase?: string;
+    };
+}
+/** A `V1Service`-ish object (subset we read). */
+interface K8sService {
+    metadata?: {
+        name?: string;
+        namespace?: string;
+    };
+}
+/** `CoreV1Api` subset. */
+interface CoreV1Api {
+    createNamespacedPod(arg: {
+        namespace: string;
+        body: unknown;
+    }): Promise<K8sPod>;
+    readNamespacedPod(arg: {
+        name: string;
+        namespace: string;
+    }): Promise<K8sPod>;
+    deleteNamespacedPod(arg: {
+        name: string;
+        namespace: string;
+    }): Promise<unknown>;
+    createNamespacedService(arg: {
+        namespace: string;
+        body: unknown;
+    }): Promise<K8sService>;
+    deleteNamespacedService(arg: {
+        name: string;
+        namespace: string;
+    }): Promise<unknown>;
+}
+/** `KubeConfig` subset. */
+interface KubeConfig {
+    loadFromDefault(): void;
+    makeApiClient(api: any): CoreV1Api;
+}
+/** The `@kubernetes/client-node` module surface we depend on. */
+interface K8sModule {
+    KubeConfig: new () => KubeConfig;
+    CoreV1Api: unknown;
+}
+/** Loader seam: returns the SDK module. Default does a real dynamic import. */
+type SdkLoader = () => Promise<K8sModule>;
+
+/**
+ * `k8sDeployTarget` — deploy a workspace as a Pod + ClusterIP Service in
+ * Kubernetes, reached via `kubectl port-forward`. `tlsTermination: "edge"`
+ * (TLS terminates at the cluster ingress; v0.1.0 reaches the service over a
+ * local port-forward tunnel).
+ *
+ * `buildStrategy` defaults to `local` — k8s is bring-your-own-image, so the
+ * operator supplies `config.image`. `@kubernetes/client-node` is an *optional*
+ * peer, lazy-loaded inside `create()`/`restore()` via an injectable loader so
+ * the package builds standalone and the test stays hermetic.
+ */
+
+declare const k8sConfigSchema: z.ZodObject<{
+    namespace: z.ZodDefault<z.ZodString>;
+    image: z.ZodString;
+    port: z.ZodDefault<z.ZodNumber>;
+    serviceAccount: z.ZodOptional<z.ZodString>;
+    env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    serviceType: z.ZodDefault<z.ZodLiteral<"ClusterIP">>;
+    localForwardPort: z.ZodOptional<z.ZodNumber>;
+    buildStrategy: z.ZodDefault<z.ZodEnum<{
+        local: "local";
+        remote: "remote";
+        managed: "managed";
+    }>>;
+}, z.core.$strict>;
+type K8sConfig = z.infer<typeof k8sConfigSchema>;
+declare const k8sPayloadSchema: z.ZodObject<{
+    namespace: z.ZodString;
+    podName: z.ZodString;
+    serviceName: z.ZodString;
+    localForwardPort: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+type K8sPayload = z.infer<typeof k8sPayloadSchema>;
+/** Injectable seams so tests never load the real `@kubernetes/client-node`. */
+interface K8sTargetOptions {
+    loadSdk?: SdkLoader;
+    pollIntervalMs?: number;
+}
+/** Build the Kubernetes deploy target with optional injected seams. */
+declare function makeK8sDeployTarget(opts?: K8sTargetOptions): DeployTarget<K8sConfig, K8sPayload>;
+/** Default Kubernetes deploy target registered by `register()`. */
+declare const k8sDeployTarget: DeployTarget<{
+    namespace: string;
+    image: string;
+    port: number;
+    env: Record<string, string>;
+    serviceType: "ClusterIP";
+    buildStrategy: "local" | "remote" | "managed";
+    serviceAccount?: string | undefined;
+    localForwardPort?: number | undefined;
+}, {
+    namespace: string;
+    podName: string;
+    serviceName: string;
+    localForwardPort?: number | undefined;
+}>;
+
+/**
+ * `@skaile/provider-k8s` — Kubernetes deploy target for `@skaile/workspaces`.
+ *
+ * v0.1.0 ships ClusterIP + port-forward only. Requires the optional peer
+ * `@kubernetes/client-node` to be installed in the host project (lazy-loaded at
+ * runtime). Install via `skaile plugin install @skaile/provider-k8s`.
+ */
+
+/** Register this plugin's deploy target with a registry. */
+declare function register(registry: PluginRegistry): void;
+
+export { type CoreV1Api, type K8sModule, type K8sTargetOptions, type KubeConfig, type SdkLoader, k8sDeployTarget, makeK8sDeployTarget, register };

package/dist/index.js

@@ -0,0 +1,190 @@
+// src/target.ts
+import * as z from "zod";
+
+// src/sdk-types.ts
+var defaultSdkLoader = async () => {
+  const mod = await import("@kubernetes/client-node");
+  if (!mod?.KubeConfig) {
+    throw new Error(
+      "@kubernetes/client-node is not installed. Run `skaile plugin install @skaile/provider-k8s` and add @kubernetes/client-node to your project."
+    );
+  }
+  return mod;
+};
+
+// src/target.ts
+var k8sConfigSchema = z.object({
+  namespace: z.string().default("default"),
+  image: z.string().min(1),
+  port: z.number().int().positive().default(8080),
+  serviceAccount: z.string().optional(),
+  env: z.record(z.string(), z.string()).default({}),
+  // v0.1.0 ships ClusterIP + port-forward only; NodePort/LoadBalancer/Ingress
+  // are documented as future work.
+  serviceType: z.literal("ClusterIP").default("ClusterIP"),
+  localForwardPort: z.number().int().positive().optional(),
+  buildStrategy: z.enum(["local", "remote", "managed"]).default("local")
+}).strict();
+var k8sPayloadSchema = z.object({
+  namespace: z.string(),
+  podName: z.string(),
+  serviceName: z.string(),
+  localForwardPort: z.number().optional()
+});
+var DEFAULT_READY_TIMEOUT_MS = 12e4;
+var DEFAULT_POLL_INTERVAL_MS = 1e3;
+async function sleep(ms, signal) {
+  return await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new Error("aborted while polling pod phase"));
+    };
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort);
+  });
+}
+async function makeApi(loadSdk) {
+  const k8s = await loadSdk();
+  const kc = new k8s.KubeConfig();
+  kc.loadFromDefault();
+  return kc.makeApiClient(k8s.CoreV1Api);
+}
+function buildHandle(api, payload, config, ctx, ready, initialState) {
+  let state = initialState;
+  const forwardPort = payload.localForwardPort ?? config.port;
+  return {
+    // Reached over a local port-forward tunnel to the ClusterIP service.
+    wsUrl: `ws://127.0.0.1:${forwardPort}`,
+    wsAuth: ctx.wsAuth ? "<redacted>" : void 0,
+    get state() {
+      return state;
+    },
+    payload,
+    async waitReady(timeoutMs) {
+      try {
+        await ready();
+        state = "ready";
+      } catch (err) {
+        state = "errored";
+        throw err;
+      }
+      void timeoutMs;
+    },
+    async health() {
+      try {
+        const pod = await api.readNamespacedPod({
+          name: payload.podName,
+          namespace: payload.namespace
+        });
+        const healthy = pod.status?.phase === "Running";
+        return healthy ? { healthy } : { healthy, detail: `pod ${payload.podName} phase=${pod.status?.phase ?? "unknown"}` };
+      } catch (err) {
+        return { healthy: false, detail: err.message };
+      }
+    },
+    async stop() {
+      state = "stopping";
+      await api.deleteNamespacedService({ name: payload.serviceName, namespace: payload.namespace }).catch(() => {
+      });
+      await api.deleteNamespacedPod({ name: payload.podName, namespace: payload.namespace }).catch(() => {
+      });
+      state = "stopped";
+    }
+  };
+}
+function makeK8sDeployTarget(opts = {}) {
+  const loadSdk = opts.loadSdk ?? defaultSdkLoader;
+  const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  return {
+    id: "k8s",
+    displayName: "Kubernetes (ClusterIP + port-forward)",
+    apiVersion: 1,
+    tlsTermination: "edge",
+    configSchema: k8sConfigSchema,
+    payloadSchema: k8sPayloadSchema,
+    async create(config, ctx) {
+      const api = await makeApi(loadSdk);
+      const podName = `skaile-ws-${ctx.workspaceId}`;
+      const serviceName = `skaile-ws-${ctx.workspaceId}-svc`;
+      const image = config.image ?? ctx.imageRef;
+      if (!image) throw new Error("k8s deploy requires an image (buildStrategy is local)");
+      const podBody = {
+        metadata: { name: podName, namespace: config.namespace, labels: { app: podName } },
+        spec: {
+          serviceAccountName: config.serviceAccount,
+          containers: [
+            {
+              name: "workspace",
+              image,
+              ports: [{ containerPort: config.port }],
+              env: Object.entries({ ...config.env, ...ctx.env }).map(([name, value]) => ({
+                name,
+                value
+              }))
+            }
+          ]
+        }
+      };
+      await api.createNamespacedPod({ namespace: config.namespace, body: podBody });
+      const serviceBody = {
+        metadata: { name: serviceName, namespace: config.namespace },
+        spec: {
+          type: config.serviceType,
+          selector: { app: podName },
+          ports: [{ port: config.port, targetPort: config.port }]
+        }
+      };
+      await api.createNamespacedService({ namespace: config.namespace, body: serviceBody });
+      ctx.log.info("k8s pod + service created", { podName, serviceName });
+      const payload = {
+        namespace: config.namespace,
+        podName,
+        serviceName,
+        localForwardPort: config.localForwardPort
+      };
+      const ready = async () => {
+        const deadline = Date.now() + DEFAULT_READY_TIMEOUT_MS;
+        for (; ; ) {
+          const pod = await api.readNamespacedPod({ name: podName, namespace: config.namespace });
+          if (pod.status?.phase === "Running") return;
+          if (Date.now() > deadline) {
+            throw new Error(`timed out waiting for pod ${podName} to reach Running`);
+          }
+          await sleep(pollIntervalMs, ctx.signal);
+        }
+      };
+      return buildHandle(api, payload, config, ctx, ready, "starting");
+    },
+    async restore(payload, ctx) {
+      const api = await makeApi(loadSdk);
+      const pod = await api.readNamespacedPod({
+        name: payload.podName,
+        namespace: payload.namespace
+      });
+      if (pod.status?.phase !== "Running") {
+        throw new Error(
+          `k8s pod ${payload.podName} is not running (phase=${pod.status?.phase ?? "unknown"})`
+        );
+      }
+      ctx.log.info("re-attached to k8s pod", { podName: payload.podName });
+      return buildHandle(api, payload, { port: 8080 }, ctx, async () => {
+      }, "ready");
+    }
+  };
+}
+var k8sDeployTarget = makeK8sDeployTarget();
+
+// src/index.ts
+function register(registry) {
+  registry.register("deployTarget", k8sDeployTarget);
+}
+export {
+  k8sDeployTarget,
+  makeK8sDeployTarget,
+  register
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/target.ts","../src/sdk-types.ts","../src/index.ts"],"sourcesContent":["/**\n * `k8sDeployTarget` — deploy a workspace as a Pod + ClusterIP Service in\n * Kubernetes, reached via `kubectl port-forward`. `tlsTermination: \"edge\"`\n * (TLS terminates at the cluster ingress; v0.1.0 reaches the service over a\n * local port-forward tunnel).\n *\n * `buildStrategy` defaults to `local` — k8s is bring-your-own-image, so the\n * operator supplies `config.image`. `@kubernetes/client-node` is an *optional*\n * peer, lazy-loaded inside `create()`/`restore()` via an injectable loader so\n * the package builds standalone and the test stays hermetic.\n */\n\nimport type { DeployContext, DeployHandle, DeployTarget } from \"@skaile/workspaces/plugin-registry\";\nimport * as z from \"zod\";\nimport { type CoreV1Api, defaultSdkLoader, type SdkLoader } from \"./sdk-types.js\";\n\nconst k8sConfigSchema = z\n  .object({\n    namespace: z.string().default(\"default\"),\n    image: z.string().min(1),\n    port: z.number().int().positive().default(8080),\n    serviceAccount: z.string().optional(),\n    env: z.record(z.string(), z.string()).default({}),\n    // v0.1.0 ships ClusterIP + port-forward only; NodePort/LoadBalancer/Ingress\n    // are documented as future work.\n    serviceType: z.literal(\"ClusterIP\").default(\"ClusterIP\"),\n    localForwardPort: z.number().int().positive().optional(),\n    buildStrategy: z.enum([\"local\", \"remote\", \"managed\"]).default(\"local\"),\n  })\n  .strict();\n\ntype K8sConfig = z.infer<typeof k8sConfigSchema>;\n\nconst k8sPayloadSchema = z.object({\n  namespace: z.string(),\n  podName: z.string(),\n  serviceName: z.string(),\n  localForwardPort: z.number().optional(),\n});\n\ntype K8sPayload = z.infer<typeof k8sPayloadSchema>;\n\nconst DEFAULT_READY_TIMEOUT_MS = 120_000;\nconst DEFAULT_POLL_INTERVAL_MS = 1_000;\n\n/** Injectable seams so tests never load the real `@kubernetes/client-node`. */\nexport interface K8sTargetOptions {\n  loadSdk?: SdkLoader;\n  pollIntervalMs?: number;\n}\n\nasync function sleep(ms: number, signal: AbortSignal): Promise<void> {\n  return await new Promise<void>((resolve, reject) => {\n    const timer = setTimeout(() => {\n      signal.removeEventListener(\"abort\", onAbort);\n      resolve();\n    }, ms);\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(new Error(\"aborted while polling pod phase\"));\n    };\n    if (signal.aborted) onAbort();\n    else signal.addEventListener(\"abort\", onAbort);\n  });\n}\n\nasync function makeApi(loadSdk: SdkLoader): Promise<CoreV1Api> {\n  const k8s = await loadSdk();\n  const kc = new k8s.KubeConfig();\n  kc.loadFromDefault();\n  return kc.makeApiClient(k8s.CoreV1Api);\n}\n\nfunction buildHandle(\n  api: CoreV1Api,\n  payload: K8sPayload,\n  config: Pick<K8sConfig, \"port\">,\n  ctx: DeployContext,\n  ready: () => Promise<void>,\n  initialState: DeployHandle[\"state\"],\n): DeployHandle<K8sPayload> {\n  let state: DeployHandle[\"state\"] = initialState;\n  const forwardPort = payload.localForwardPort ?? config.port;\n  return {\n    // Reached over a local port-forward tunnel to the ClusterIP service.\n    wsUrl: `ws://127.0.0.1:${forwardPort}`,\n    wsAuth: ctx.wsAuth ? \"<redacted>\" : undefined,\n    get state() {\n      return state;\n    },\n    payload,\n    async waitReady(timeoutMs?: number) {\n      try {\n        await ready();\n        state = \"ready\";\n      } catch (err) {\n        state = \"errored\";\n        throw err;\n      }\n      void timeoutMs;\n    },\n    async health() {\n      try {\n        const pod = await api.readNamespacedPod({\n          name: payload.podName,\n          namespace: payload.namespace,\n        });\n        const healthy = pod.status?.phase === \"Running\";\n        return healthy\n          ? { healthy }\n          : { healthy, detail: `pod ${payload.podName} phase=${pod.status?.phase ?? \"unknown\"}` };\n      } catch (err) {\n        return { healthy: false, detail: (err as Error).message };\n      }\n    },\n    async stop() {\n      state = \"stopping\";\n      // Idempotent teardown: ignore 404s when the objects are already gone.\n      await api\n        .deleteNamespacedService({ name: payload.serviceName, namespace: payload.namespace })\n        .catch(() => {});\n      await api\n        .deleteNamespacedPod({ name: payload.podName, namespace: payload.namespace })\n        .catch(() => {});\n      state = \"stopped\";\n    },\n  };\n}\n\n/** Build the Kubernetes deploy target with optional injected seams. */\nexport function makeK8sDeployTarget(\n  opts: K8sTargetOptions = {},\n): DeployTarget<K8sConfig, K8sPayload> {\n  const loadSdk = opts.loadSdk ?? defaultSdkLoader;\n  const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;\n\n  return {\n    id: \"k8s\",\n    displayName: \"Kubernetes (ClusterIP + port-forward)\",\n    apiVersion: 1,\n    tlsTermination: \"edge\",\n    configSchema: k8sConfigSchema as unknown as z.ZodType<K8sConfig>,\n    payloadSchema: k8sPayloadSchema,\n\n    async create(config, ctx) {\n      const api = await makeApi(loadSdk);\n      const podName = `skaile-ws-${ctx.workspaceId}`;\n      const serviceName = `skaile-ws-${ctx.workspaceId}-svc`;\n      const image = config.image ?? ctx.imageRef;\n      if (!image) throw new Error(\"k8s deploy requires an image (buildStrategy is local)\");\n\n      const podBody = {\n        metadata: { name: podName, namespace: config.namespace, labels: { app: podName } },\n        spec: {\n          serviceAccountName: config.serviceAccount,\n          containers: [\n            {\n              name: \"workspace\",\n              image,\n              ports: [{ containerPort: config.port }],\n              env: Object.entries({ ...config.env, ...ctx.env }).map(([name, value]) => ({\n                name,\n                value,\n              })),\n            },\n          ],\n        },\n      };\n      await api.createNamespacedPod({ namespace: config.namespace, body: podBody });\n\n      const serviceBody = {\n        metadata: { name: serviceName, namespace: config.namespace },\n        spec: {\n          type: config.serviceType,\n          selector: { app: podName },\n          ports: [{ port: config.port, targetPort: config.port }],\n        },\n      };\n      await api.createNamespacedService({ namespace: config.namespace, body: serviceBody });\n      ctx.log.info(\"k8s pod + service created\", { podName, serviceName });\n\n      const payload: K8sPayload = {\n        namespace: config.namespace,\n        podName,\n        serviceName,\n        localForwardPort: config.localForwardPort,\n      };\n      const ready = async () => {\n        const deadline = Date.now() + DEFAULT_READY_TIMEOUT_MS;\n        for (;;) {\n          const pod = await api.readNamespacedPod({ name: podName, namespace: config.namespace });\n          if (pod.status?.phase === \"Running\") return;\n          if (Date.now() > deadline) {\n            throw new Error(`timed out waiting for pod ${podName} to reach Running`);\n          }\n          await sleep(pollIntervalMs, ctx.signal);\n        }\n      };\n      return buildHandle(api, payload, config, ctx, ready, \"starting\");\n    },\n\n    async restore(payload, ctx) {\n      const api = await makeApi(loadSdk);\n      const pod = await api.readNamespacedPod({\n        name: payload.podName,\n        namespace: payload.namespace,\n      });\n      if (pod.status?.phase !== \"Running\") {\n        throw new Error(\n          `k8s pod ${payload.podName} is not running (phase=${pod.status?.phase ?? \"unknown\"})`,\n        );\n      }\n      ctx.log.info(\"re-attached to k8s pod\", { podName: payload.podName });\n      return buildHandle(api, payload, { port: 8080 }, ctx, async () => {}, \"ready\");\n    },\n  };\n}\n\n/** Default Kubernetes deploy target registered by `register()`. */\nexport const k8sDeployTarget = makeK8sDeployTarget();\n","/**\n * Minimal local interface for `@kubernetes/client-node` — only the members this\n * provider actually calls.\n *\n * The SDK is an *optional* peer dependency, lazy-loaded via a string-literal\n * dynamic `import()`. Typing against this minimal surface (rather than the real\n * package's types) keeps the package building + typechecking standalone\n * offline; the host project supplies the real SDK at runtime.\n */\n\n/** A `V1Pod`-ish object (subset we read). */\nexport interface K8sPod {\n  metadata?: { name?: string; namespace?: string };\n  status?: { phase?: string };\n}\n\n/** A `V1Service`-ish object (subset we read). */\nexport interface K8sService {\n  metadata?: { name?: string; namespace?: string };\n}\n\n/** `CoreV1Api` subset. */\nexport interface CoreV1Api {\n  createNamespacedPod(arg: { namespace: string; body: unknown }): Promise<K8sPod>;\n  readNamespacedPod(arg: { name: string; namespace: string }): Promise<K8sPod>;\n  deleteNamespacedPod(arg: { name: string; namespace: string }): Promise<unknown>;\n  createNamespacedService(arg: { namespace: string; body: unknown }): Promise<K8sService>;\n  deleteNamespacedService(arg: { name: string; namespace: string }): Promise<unknown>;\n}\n\n/** `KubeConfig` subset. */\nexport interface KubeConfig {\n  loadFromDefault(): void;\n  // biome-ignore lint/suspicious/noExplicitAny: api ctor passed through opaquely\n  makeApiClient(api: any): CoreV1Api;\n}\n\n/** The `@kubernetes/client-node` module surface we depend on. */\nexport interface K8sModule {\n  KubeConfig: new () => KubeConfig;\n  CoreV1Api: unknown;\n}\n\n/** Loader seam: returns the SDK module. Default does a real dynamic import. */\nexport type SdkLoader = () => Promise<K8sModule>;\n\n/**\n * Default loader: lazy `import(\"@kubernetes/client-node\")`. The string literal\n * keeps bundlers from eagerly resolving the optional peer; only evaluated when\n * `create()`/`restore()` run.\n */\nexport const defaultSdkLoader: SdkLoader = async () => {\n  const mod = (await import(\"@kubernetes/client-node\" as string)) as unknown as K8sModule;\n  if (!mod?.KubeConfig) {\n    throw new Error(\n      \"@kubernetes/client-node is not installed. Run `skaile plugin install @skaile/provider-k8s` and add @kubernetes/client-node to your project.\",\n    );\n  }\n  return mod;\n};\n","/**\n * `@skaile/provider-k8s` — Kubernetes deploy target for `@skaile/workspaces`.\n *\n * v0.1.0 ships ClusterIP + port-forward only. Requires the optional peer\n * `@kubernetes/client-node` to be installed in the host project (lazy-loaded at\n * runtime). Install via `skaile plugin install @skaile/provider-k8s`.\n */\n\nimport type { PluginRegistry } from \"@skaile/workspaces/plugin-registry\";\nimport { k8sDeployTarget } from \"./target.js\";\n\nexport { k8sDeployTarget, makeK8sDeployTarget } from \"./target.js\";\nexport type { K8sTargetOptions } from \"./target.js\";\nexport type { CoreV1Api, K8sModule, KubeConfig, SdkLoader } from \"./sdk-types.js\";\n\n/** Register this plugin's deploy target with a registry. */\nexport function register(registry: PluginRegistry): void {\n  registry.register(\"deployTarget\", k8sDeployTarget);\n}\n"],"mappings":";AAaA,YAAY,OAAO;;;ACsCZ,IAAM,mBAA8B,YAAY;AACrD,QAAM,MAAO,MAAM,OAAO,yBAAmC;AAC7D,MAAI,CAAC,KAAK,YAAY;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;;;AD3CA,IAAM,kBACH,SAAO;AAAA,EACN,WAAa,SAAO,EAAE,QAAQ,SAAS;AAAA,EACvC,OAAS,SAAO,EAAE,IAAI,CAAC;AAAA,EACvB,MAAQ,SAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC9C,gBAAkB,SAAO,EAAE,SAAS;AAAA,EACpC,KAAO,SAAS,SAAO,GAAK,SAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA,EAGhD,aAAe,UAAQ,WAAW,EAAE,QAAQ,WAAW;AAAA,EACvD,kBAAoB,SAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,eAAiB,OAAK,CAAC,SAAS,UAAU,SAAS,CAAC,EAAE,QAAQ,OAAO;AACvE,CAAC,EACA,OAAO;AAIV,IAAM,mBAAqB,SAAO;AAAA,EAChC,WAAa,SAAO;AAAA,EACpB,SAAW,SAAO;AAAA,EAClB,aAAe,SAAO;AAAA,EACtB,kBAAoB,SAAO,EAAE,SAAS;AACxC,CAAC;AAID,IAAM,2BAA2B;AACjC,IAAM,2BAA2B;AAQjC,eAAe,MAAM,IAAY,QAAoC;AACnE,SAAO,MAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAClD,UAAM,QAAQ,WAAW,MAAM;AAC7B,aAAO,oBAAoB,SAAS,OAAO;AAC3C,cAAQ;AAAA,IACV,GAAG,EAAE;AACL,UAAM,UAAU,MAAM;AACpB,mBAAa,KAAK;AAClB,aAAO,IAAI,MAAM,iCAAiC,CAAC;AAAA,IACrD;AACA,QAAI,OAAO,QAAS,SAAQ;AAAA,QACvB,QAAO,iBAAiB,SAAS,OAAO;AAAA,EAC/C,CAAC;AACH;AAEA,eAAe,QAAQ,SAAwC;AAC7D,QAAM,MAAM,MAAM,QAAQ;AAC1B,QAAM,KAAK,IAAI,IAAI,WAAW;AAC9B,KAAG,gBAAgB;AACnB,SAAO,GAAG,cAAc,IAAI,SAAS;AACvC;AAEA,SAAS,YACP,KACA,SACA,QACA,KACA,OACA,cAC0B;AAC1B,MAAI,QAA+B;AACnC,QAAM,cAAc,QAAQ,oBAAoB,OAAO;AACvD,SAAO;AAAA;AAAA,IAEL,OAAO,kBAAkB,WAAW;AAAA,IACpC,QAAQ,IAAI,SAAS,eAAe;AAAA,IACpC,IAAI,QAAQ;AACV,aAAO;AAAA,IACT;AAAA,IACA;AAAA,IACA,MAAM,UAAU,WAAoB;AAClC,UAAI;AACF,cAAM,MAAM;AACZ,gBAAQ;AAAA,MACV,SAAS,KAAK;AACZ,gBAAQ;AACR,cAAM;AAAA,MACR;AACA,WAAK;AAAA,IACP;AAAA,IACA,MAAM,SAAS;AACb,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,kBAAkB;AAAA,UACtC,MAAM,QAAQ;AAAA,UACd,WAAW,QAAQ;AAAA,QACrB,CAAC;AACD,cAAM,UAAU,IAAI,QAAQ,UAAU;AACtC,eAAO,UACH,EAAE,QAAQ,IACV,EAAE,SAAS,QAAQ,OAAO,QAAQ,OAAO,UAAU,IAAI,QAAQ,SAAS,SAAS,GAAG;AAAA,MAC1F,SAAS,KAAK;AACZ,eAAO,EAAE,SAAS,OAAO,QAAS,IAAc,QAAQ;AAAA,MAC1D;AAAA,IACF;AAAA,IACA,MAAM,OAAO;AACX,cAAQ;AAER,YAAM,IACH,wBAAwB,EAAE,MAAM,QAAQ,aAAa,WAAW,QAAQ,UAAU,CAAC,EACnF,MAAM,MAAM;AAAA,MAAC,CAAC;AACjB,YAAM,IACH,oBAAoB,EAAE,MAAM,QAAQ,SAAS,WAAW,QAAQ,UAAU,CAAC,EAC3E,MAAM,MAAM;AAAA,MAAC,CAAC;AACjB,cAAQ;AAAA,IACV;AAAA,EACF;AACF;AAGO,SAAS,oBACd,OAAyB,CAAC,GACW;AACrC,QAAM,UAAU,KAAK,WAAW;AAChC,QAAM,iBAAiB,KAAK,kBAAkB;AAE9C,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,cAAc;AAAA,IACd,eAAe;AAAA,IAEf,MAAM,OAAO,QAAQ,KAAK;AACxB,YAAM,MAAM,MAAM,QAAQ,OAAO;AACjC,YAAM,UAAU,aAAa,IAAI,WAAW;AAC5C,YAAM,cAAc,aAAa,IAAI,WAAW;AAChD,YAAM,QAAQ,OAAO,SAAS,IAAI;AAClC,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,uDAAuD;AAEnF,YAAM,UAAU;AAAA,QACd,UAAU,EAAE,MAAM,SAAS,WAAW,OAAO,WAAW,QAAQ,EAAE,KAAK,QAAQ,EAAE;AAAA,QACjF,MAAM;AAAA,UACJ,oBAAoB,OAAO;AAAA,UAC3B,YAAY;AAAA,YACV;AAAA,cACE,MAAM;AAAA,cACN;AAAA,cACA,OAAO,CAAC,EAAE,eAAe,OAAO,KAAK,CAAC;AAAA,cACtC,KAAK,OAAO,QAAQ,EAAE,GAAG,OAAO,KAAK,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;AAAA,gBACzE;AAAA,gBACA;AAAA,cACF,EAAE;AAAA,YACJ;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI,oBAAoB,EAAE,WAAW,OAAO,WAAW,MAAM,QAAQ,CAAC;AAE5E,YAAM,cAAc;AAAA,QAClB,UAAU,EAAE,MAAM,aAAa,WAAW,OAAO,UAAU;AAAA,QAC3D,MAAM;AAAA,UACJ,MAAM,OAAO;AAAA,UACb,UAAU,EAAE,KAAK,QAAQ;AAAA,UACzB,OAAO,CAAC,EAAE,MAAM,OAAO,MAAM,YAAY,OAAO,KAAK,CAAC;AAAA,QACxD;AAAA,MACF;AACA,YAAM,IAAI,wBAAwB,EAAE,WAAW,OAAO,WAAW,MAAM,YAAY,CAAC;AACpF,UAAI,IAAI,KAAK,6BAA6B,EAAE,SAAS,YAAY,CAAC;AAElE,YAAM,UAAsB;AAAA,QAC1B,WAAW,OAAO;AAAA,QAClB;AAAA,QACA;AAAA,QACA,kBAAkB,OAAO;AAAA,MAC3B;AACA,YAAM,QAAQ,YAAY;AACxB,cAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,mBAAS;AACP,gBAAM,MAAM,MAAM,IAAI,kBAAkB,EAAE,MAAM,SAAS,WAAW,OAAO,UAAU,CAAC;AACtF,cAAI,IAAI,QAAQ,UAAU,UAAW;AACrC,cAAI,KAAK,IAAI,IAAI,UAAU;AACzB,kBAAM,IAAI,MAAM,6BAA6B,OAAO,mBAAmB;AAAA,UACzE;AACA,gBAAM,MAAM,gBAAgB,IAAI,MAAM;AAAA,QACxC;AAAA,MACF;AACA,aAAO,YAAY,KAAK,SAAS,QAAQ,KAAK,OAAO,UAAU;AAAA,IACjE;AAAA,IAEA,MAAM,QAAQ,SAAS,KAAK;AAC1B,YAAM,MAAM,MAAM,QAAQ,OAAO;AACjC,YAAM,MAAM,MAAM,IAAI,kBAAkB;AAAA,QACtC,MAAM,QAAQ;AAAA,QACd,WAAW,QAAQ;AAAA,MACrB,CAAC;AACD,UAAI,IAAI,QAAQ,UAAU,WAAW;AACnC,cAAM,IAAI;AAAA,UACR,WAAW,QAAQ,OAAO,0BAA0B,IAAI,QAAQ,SAAS,SAAS;AAAA,QACpF;AAAA,MACF;AACA,UAAI,IAAI,KAAK,0BAA0B,EAAE,SAAS,QAAQ,QAAQ,CAAC;AACnE,aAAO,YAAY,KAAK,SAAS,EAAE,MAAM,KAAK,GAAG,KAAK,YAAY;AAAA,MAAC,GAAG,OAAO;AAAA,IAC/E;AAAA,EACF;AACF;AAGO,IAAM,kBAAkB,oBAAoB;;;AE3M5C,SAAS,SAAS,UAAgC;AACvD,WAAS,SAAS,gBAAgB,eAAe;AACnD;","names":[]}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@skaile/provider-k8s",
+  "version": "0.0.0",
+  "description": "Kubernetes (ClusterIP + port-forward) deploy target for @skaile/workspaces",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
+  "peerDependencies": {
+    "@skaile/workspaces": ">=0.22.0-0",
+    "@kubernetes/client-node": ">=0.20.0"
+  },
+  "peerDependenciesMeta": {
+    "@kubernetes/client-node": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@skaile/workspaces": "0.21.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "format": "biome format --write .",
+    "lint": "biome lint .",
+    "check": "biome check ."
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/skaile-ai/workspaces.git",
+    "directory": "packages/provider-k8s"
+  },
+  "homepage": "https://github.com/skaile-ai/workspaces/tree/main/packages/provider-k8s#readme",
+  "bugs": "https://github.com/skaile-ai/workspaces/issues",
+  "license": "Apache-2.0",
+  "dependencies": {
+    "zod": "^4.4.0"
+  }
+}