@vibesdotdev/integrations-digitalocean 0.0.0-stage → 1.0.0-rc.2

package/dist/infra/doks/service-release.js

@@ -0,0 +1,3201 @@
+import { KubernetesFailureSchema, KubernetesIdentityTokenSchema, BoundedKubernetesConditionSchema, KubernetesManifestProjectionSchema } from "../../schemas/kubernetes-responses.js";
+import { KubernetesMetadataSchema, KubernetesSnapshotClassSchema, KubernetesQuotaSpecSchema, KubernetesSecretBodySchema, KubernetesAccountBodySchema, KubernetesCertificateStatusSchema, KubernetesCertificateRequestsSchema, KubernetesOrdersBodySchema, KubernetesChallengesBodySchema, KubernetesDataSchema, KubernetesIssuersSchema, KubernetesSolverNameSchema, KubernetesSnapshotBodySchema, KubernetesIssuerStatusSchema, KubernetesQuotaVersionSchema, KubernetesDeclaredQuotaSchema, KubernetesExistingPvcSchema, KubernetesDeclaredPvcSchema, KubernetesAccessSchema, KubernetesQuotasBodySchema, KubernetesStatefulPodsSchema, KubernetesMigrationJobSchema, KubernetesPodsSchema, KubernetesExpectedLabelsSchema, KubernetesOwnedJobSchema, KubernetesWorkloadStatusSchema, KubernetesBuildPodsSchema, KubernetesEventsSchema, KubernetesReplicaSpecSchema } from "../../schemas/kubernetes-responses.js";
+import { createSha256 } from '@vibesdotdev/shared/hashing';
+import { CapabilityError, settle } from '@vibesdotdev/kernel';
+import { encodeBase64Text } from "../../kubernetes/encoding.js";
+import { kubernetesRequest } from "../../kubernetes/transport.js";
+import { parseKubeconfig } from "../../kubernetes/authority.js";
+import * as z from 'zod/v4';
+import { cappedId } from '@vibesdotdev/infra-core';
+import { DigitalOceanKubernetesServiceReleaseTargetSchema, 
+// The DigitalOcean parse of the kind's descriptor: core cross-field checks plus the DigitalOcean-owned config.
+DigitalOceanServiceReleaseDescriptorSchema as ServiceReleaseDescriptorSchema } from "./service-release-schemas.js";
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import { DOKS_SECRET_DELIVERY_CLIENT_ID } from "../../secrets/doks-secret.descriptor.js";
+import { DigitalOceanDoksWorkerCredentialDeliveryOwnerSchema, DigitalOceanDoksWorkerDescriptorSchema, DigitalOceanDoksWorkerExecutionInputSchema, DigitalOceanDoksWorkerPlanSchema, DigitalOceanDoksWorkerOperationIdSchema, bindDigitalOceanDoksWorkerCredentialLease } from "../../schemas/doks-worker.js";
+import { planDigitalOceanDoksWorkerApply, planDigitalOceanDoksWorkerBuild } from "./worker.js";
+const FIELD_MANAGER = 'vibes-infra-service-release';
+const SECRET_FIELD_MANAGER = 'vibes-secret-management';
+const CERTIFICATE_FIELD_MANAGER = 'vibes-infra-certificate';
+const MIGRATION_FIELD_MANAGER = 'vibes-infra-repository-migration';
+const LABEL_PART_OF = 'app.kubernetes.io/part-of';
+function boundedConditionSummary(value) {
+    const parsed = z.array(z.unknown()).safeParse(value);
+    if (!parsed.success)
+        return [];
+    return parsed.data
+        .flatMap((entry) => {
+        const condition = BoundedKubernetesConditionSchema.safeParse(entry);
+        if (!condition.success)
+            return [];
+        const { type, status, reason } = condition.data;
+        return [`${type}:${status}${reason ? '/' + reason : ''}`];
+    })
+        .slice(0, 8);
+}
+function boundedStatusToken(value, fallback) {
+    const token = KubernetesIdentityTokenSchema.safeParse(value);
+    return token.success ? token.data : fallback;
+}
+function classifyKubernetesEventMessage(value) {
+    const parsed = z.string().safeParse(value);
+    if (!parsed.success)
+        return '';
+    const message = parsed.data.toLowerCase();
+    if (message.includes('failed calling webhook'))
+        return 'WebhookFailed';
+    if (message.includes('exceeded quota'))
+        return 'QuotaExceeded';
+    if (message.includes('forbidden'))
+        return 'Forbidden';
+    if (message.includes('not found'))
+        return 'NotFound';
+    if (message.includes('invalid'))
+        return 'Invalid';
+    if (message.includes('timed out') || message.includes('timeout'))
+        return 'TimedOut';
+    return '';
+}
+async function boundedKubernetesFailure(response) {
+    const evidence = await settle(async () => KubernetesFailureSchema.parse(await response.json()));
+    const body = evidence.ok ? evidence.value : {};
+    const reason = boundedStatusToken(body.reason, 'Unspecified');
+    const kind = boundedStatusToken(body.details?.kind, 'resource');
+    const name = boundedStatusToken(body.details?.name, 'unnamed');
+    const message = body.message ?? '';
+    let classification = '';
+    const namespaceTermination = message.match(/unable to create new content in namespace ["']?([A-Za-z0-9_.-]{1,63})["']? because it is being terminated/i);
+    const rbacDenial = message.match(/cannot (create|patch|update|delete|get|list|watch) resource ["']([A-Za-z0-9_.-]{1,64})["'][^\n]{0,160}?namespace ["']([A-Za-z0-9_.-]{1,63})["']/i);
+    const quotaDenial = message.match(/exceeded quota: ([A-Za-z0-9_.-]{1,63})/i);
+    const webhookDenial = message.match(/admission webhook ["']([A-Za-z0-9_.-]{1,128})["'] denied the request/i);
+    if (namespaceTermination)
+        classification = ` namespace=${namespaceTermination[1]} state=terminating`;
+    else if (rbacDenial)
+        classification = ` rbac=${rbacDenial[1]}:${rbacDenial[2]} namespace=${rbacDenial[3]}`;
+    else if (quotaDenial)
+        classification = ` quota=${quotaDenial[1]}`;
+    else if (webhookDenial)
+        classification = ` admission-webhook=${webhookDenial[1]}`;
+    const causes = (body.details?.causes ?? [])
+        .flatMap((cause) => {
+        const causeReason = boundedStatusToken(cause.reason, '');
+        const field = boundedStatusToken(cause.field, '');
+        return causeReason && field ? [`${causeReason}:${field}`] : causeReason ? [causeReason] : [];
+    })
+        .slice(0, 4);
+    return {
+        summary: ` reason=${reason} resource=${kind}/${name}${classification}${causes.length > 0 ? ` causes=${causes.join(',')}` : ''}${evidence.ok ? '' : ' diagnostics=Unavailable'}`,
+        cause: evidence.ok ? undefined : evidence.cause
+    };
+}
+function csiSnapshotAgentScripts() {
+    const client = `import { readFileSync } from 'node:fs';
+import https from 'node:https';
+const namespace = process.env.NAMESPACE;
+const token = readFileSync('/var/run/secrets/kubernetes.io/serviceaccount/token', 'utf8');
+const ca = readFileSync('/var/run/secrets/kubernetes.io/serviceaccount/ca.crt');
+const host = process.env.KUBERNETES_SERVICE_HOST;
+const port = Number(process.env.KUBERNETES_SERVICE_PORT_HTTPS || 443);
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const once = (method, path, body) => new Promise((resolve, reject) => {
+  const req = https.request({ host, port, path, method, ca, headers: {
+    authorization: 'Bearer ' + token,
+    accept: 'application/json',
+    ...(body ? { 'content-type': method === 'PATCH' ? 'application/merge-patch+json' : 'application/json' } : {})
+  } }, (res) => {
+    let raw = '';
+    res.setEncoding('utf8');
+    res.on('data', (chunk) => { raw += chunk; });
+    res.on('end', () => {
+      const status = res.statusCode || 500;
+      let parsed;
+      try { parsed = raw ? JSON.parse(raw) : undefined; } catch { parsed = undefined; }
+      if (status >= 400) reject(Object.assign(new Error(method + ' ' + path + ' returned HTTP ' + status), { status, retryAfter: Number(res.headers['retry-after']) || 0 }));
+      else resolve(parsed);
+    });
+  });
+  req.on('error', reject);
+  if (body) req.end(JSON.stringify(body)); else req.end();
+});
+// The API server sheds load with 429 (priority-and-fairness) and 503; both mean
+// "not processed, try later", so retrying is safe for every verb. Anything else
+// (4xx, 5xx that may have mutated) surfaces immediately.
+const request = async (method, path, body) => {
+  for (let attempt = 1; ; attempt += 1) {
+    try { return await once(method, path, body); }
+    catch (error) {
+      const status = error?.status;
+      if (attempt >= 8 || !(status === 429 || status === 503)) throw error;
+      await sleep(error.retryAfter > 0 ? error.retryAfter * 1000 : Math.min(30000, 1000 * 2 ** (attempt - 1)));
+    }
+  }
+};
+const namespaced = (resource, name = '') => '/apis/snapshot.storage.k8s.io/v1/namespaces/' + encodeURIComponent(namespace) + '/' + resource + (name ? '/' + encodeURIComponent(name) : '');
+const core = (resource, name = '') => '/api/v1/namespaces/' + encodeURIComponent(namespace) + '/' + resource + (name ? '/' + encodeURIComponent(name) : '');
+`;
+    const snapshot = `${client}
+const generation = Date.now().toString(36);
+const name = (process.env.SNAPSHOT_PREFIX + '-' + generation).slice(0, 63).replace(/-+$/, '');
+const created = await request('POST', namespaced('volumesnapshots'), {
+  apiVersion: 'snapshot.storage.k8s.io/v1', kind: 'VolumeSnapshot',
+  metadata: { name, namespace, labels: {
+    'app.kubernetes.io/managed-by': 'vibes-infra-service-release',
+    'vibes.dev/source-pvc': process.env.SOURCE_PVC,
+    'vibes.dev/source-revision': process.env.SOURCE_REVISION,
+    'vibes.dev/generation': generation,
+    'vibes.dev/verified': 'false'
+  }, annotations: { 'vibes.dev/storage-schema-version': process.env.STORAGE_SCHEMA_VERSION } },
+  spec: { volumeSnapshotClassName: process.env.SNAPSHOT_CLASS, source: { persistentVolumeClaimName: process.env.SOURCE_PVC } }
+});
+const deadline = Date.now() + Number(process.env.TIMEOUT_SECONDS) * 1000;
+while (Date.now() < deadline) {
+  const current = await request('GET', namespaced('volumesnapshots', created.metadata.name));
+  if (current.status?.error) throw new Error('VolumeSnapshot reported a provider error');
+  if (current.status?.readyToUse === true) process.exit(0);
+  await sleep(2000);
+}
+throw new Error('VolumeSnapshot did not become ready before the declared deadline');
+`;
+    const verify = `${client}
+const selector = encodeURIComponent('vibes.dev/source-pvc=' + process.env.SOURCE_PVC);
+const listed = await request('GET', namespaced('volumesnapshots') + '?labelSelector=' + selector);
+const ready = (listed.items || []).filter((item) => item.status?.readyToUse === true).sort((a, b) => String(b.metadata.creationTimestamp).localeCompare(String(a.metadata.creationTimestamp)));
+const candidate = ready.find((item) => item.metadata.labels?.['vibes.dev/verified'] !== 'true');
+if (!candidate) throw new Error('No ready unverified snapshot exists');
+const generation = candidate.metadata.labels?.['vibes.dev/generation'];
+if (!generation || candidate.metadata.labels?.['vibes.dev/source-revision'] !== process.env.SOURCE_REVISION) throw new Error('Snapshot generation or source revision label is missing');
+const suffix = generation.slice(-16);
+const pvcName = (process.env.VERIFY_PREFIX + '-pvc-' + suffix).slice(0, 63).replace(/-+$/, '');
+const podName = (process.env.VERIFY_PREFIX + '-fsck-' + suffix).slice(0, 63).replace(/-+$/, '');
+const deadline = Date.now() + Number(process.env.TIMEOUT_SECONDS) * 1000;
+let pvcCreated = false;
+let podCreated = false;
+try {
+  await request('POST', core('persistentvolumeclaims'), {
+    apiVersion: 'v1', kind: 'PersistentVolumeClaim',
+    metadata: { name: pvcName, namespace, labels: { 'app.kubernetes.io/managed-by': 'vibes-infra-service-release', 'vibes.dev/restore-source': candidate.metadata.name } },
+    spec: { accessModes: ['ReadWriteOnce'], storageClassName: process.env.STORAGE_CLASS, resources: { requests: { storage: process.env.SCRATCH_SIZE } }, dataSource: { apiGroup: 'snapshot.storage.k8s.io', kind: 'VolumeSnapshot', name: candidate.metadata.name } }
+  });
+  pvcCreated = true;
+	let pvcBound = false;
+  while (Date.now() < deadline) {
+    const pvc = await request('GET', core('persistentvolumeclaims', pvcName));
+	if (pvc.status?.phase === 'Bound') { pvcBound = true; break; }
+    await sleep(2000);
+  }
+	if (!pvcBound) throw new Error('Scratch restore PVC did not bind before the declared deadline');
+  await request('POST', core('pods'), {
+    apiVersion: 'v1', kind: 'Pod',
+    metadata: { name: podName, namespace, labels: { 'app.kubernetes.io/managed-by': 'vibes-infra-service-release', 'vibes.dev/restore-source': candidate.metadata.name } },
+    spec: { restartPolicy: 'Never', securityContext: { runAsNonRoot: true, runAsUser: 65532, runAsGroup: 65532, fsGroup: 65532, seccompProfile: { type: 'RuntimeDefault' } }, containers: [{
+      name: 'git-fsck', image: process.env.VERIFY_IMAGE, imagePullPolicy: 'IfNotPresent',
+      command: ['/bin/sh', '-c', 'set -eu; heads="$(find /verify -type f -name HEAD -print)"; test -n "$heads"; count=0; for head in $heads; do dir="$(dirname "$head")"; if [ -d "$dir/objects" ] && [ -d "$dir/refs" ]; then git --git-dir="$dir" fsck --full; count=$((count + 1)); fi; done; test "$count" -gt 0'],
+      volumeMounts: [{ name: 'restore', mountPath: '/verify', readOnly: true }],
+      securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: { drop: ['ALL'] } }
+    }], volumes: [{ name: 'restore', persistentVolumeClaim: { claimName: pvcName, readOnly: true } }] }
+  });
+  podCreated = true;
+  let succeeded = false;
+  while (Date.now() < deadline) {
+    const pod = await request('GET', core('pods', podName));
+    if (pod.status?.phase === 'Succeeded') { succeeded = true; break; }
+    if (pod.status?.phase === 'Failed') throw new Error('Scratch restore git fsck failed');
+    await sleep(2000);
+  }
+  if (!succeeded) throw new Error('Scratch restore git fsck exceeded the declared deadline');
+  await request('PATCH', namespaced('volumesnapshots', candidate.metadata.name), { metadata: { labels: { ...candidate.metadata.labels, 'vibes.dev/verified': 'true' }, annotations: { ...candidate.metadata.annotations, 'vibes.dev/verified-at': new Date().toISOString() } } });
+  const after = await request('GET', namespaced('volumesnapshots') + '?labelSelector=' + selector);
+  const verified = (after.items || []).filter((item) => item.status?.readyToUse === true && item.metadata.labels?.['vibes.dev/verified'] === 'true').sort((a, b) => String(b.metadata.creationTimestamp).localeCompare(String(a.metadata.creationTimestamp)));
+  const keep = Number(process.env.KEEP_VERIFIED_GENERATIONS);
+  if (verified.length > keep) {
+    if (process.env.DELETION_POLICY !== 'Delete') throw new Error('Refusing snapshot pruning without deletionPolicy=Delete');
+    const retained = new Set(verified.slice(0, keep).map((item) => item.metadata.name));
+    const cutoff = String(verified[keep - 1].metadata.creationTimestamp);
+    for (const item of (after.items || [])) {
+      if (!retained.has(item.metadata.name) && String(item.metadata.creationTimestamp) < cutoff) {
+        await request('DELETE', namespaced('volumesnapshots', item.metadata.name));
+      }
+    }
+  }
+} finally {
+  // best-effort cleanup: scratch restore pod/PVC must not leak if verification fails
+  if (podCreated) await request('DELETE', core('pods', podName)).catch(() => {});
+  if (pvcCreated) await request('DELETE', core('persistentvolumeclaims', pvcName)).catch(() => {});
+}
+`;
+    return { snapshot, verify };
+}
+function requiredSecrets(descriptor) {
+    const byName = new Map();
+    for (const binding of descriptor.secretBindings) {
+        const keys = byName.get(binding.target.name) ?? new Set();
+        keys.add(binding.target.key);
+        byName.set(binding.target.name, keys);
+    }
+    if (descriptor.config.certificate) {
+        const tls = descriptor.controlPlaneRouter.tlsSecretRef;
+        const keys = byName.get(tls.name) ?? new Set();
+        keys.add(tls.certificateKey);
+        keys.add(tls.privateKeyKey);
+        byName.set(tls.name, keys);
+    }
+    return [...byName.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([name, keys]) => ({
+        namespace: descriptor.namespace,
+        name,
+        keys: [...keys].sort()
+    }));
+}
+function normalizePublicKey(value) {
+    const [type, encoded] = value.trim().split(/\s+/, 3);
+    if (type !== 'ssh-ed25519' || !encoded)
+        throw new Error('SSH host public key must be OpenSSH Ed25519 format.');
+    const blob = Uint8Array.from(atob(encoded), char => char.charCodeAt(0));
+    if (blob.length < 4 ||
+        new DataView(blob.buffer, blob.byteOffset, blob.byteLength).getUint32(0) !== 11 ||
+        new TextDecoder().decode(blob.subarray(4, 15)) !== 'ssh-ed25519') {
+        throw new Error('SSH host public key did not contain an Ed25519 key blob.');
+    }
+    return `${type} ${encoded}`;
+}
+function publicKeyFingerprint(publicKey) {
+    const normalized = normalizePublicKey(publicKey);
+    const encoded = normalized.split(' ')[1];
+    const bytes = Uint8Array.from(atob(encoded), char => char.charCodeAt(0));
+    const hex = createSha256().update(bytes).digestHex();
+    const binary = (hex.match(/../g) ?? []).map(value => String.fromCharCode(parseInt(value, 16))).join('');
+    return `SHA256:${btoa(binary).replace(/=+$/, '')}`;
+}
+function labels(descriptor, component) {
+    const workload = component === 'gateway' ? descriptor.gateway : descriptor.stateful;
+    return {
+        'app.kubernetes.io/name': workload.name,
+        'app.kubernetes.io/component': component,
+        [LABEL_PART_OF]: descriptor.id,
+        'app.kubernetes.io/managed-by': FIELD_MANAGER,
+        'vibes.dev/revision': workload.revision
+    };
+}
+/** Where the migration Job mounts its authority Secret; declared to the Job as VIBES_SECRETS_MOUNT_DIR. */
+const MIGRATION_SECRETS_MOUNT_DIR = '/run/secrets/platform';
+/** The credential key the migration resolves; the projected file is named for it (mounted-files store). */
+const MIGRATION_AUTHORITY_CREDENTIAL = 'VIBES_INTERNAL_SERVICE_TOKEN';
+/** The tier the release declares for its stateful pod; the Job runs under the same one. */
+function declaredEnvironmentTier(descriptor) {
+    const declared = descriptor.stateful.env.find((entry) => entry.source === 'literal' && entry.name === 'VIBES_ENVIRONMENT_TIER');
+    if (!declared || declared.source !== 'literal') {
+        throw new Error(`Service release ${descriptor.id} declares no VIBES_ENVIRONMENT_TIER on its stateful service; the repository migration Job needs the declared tier.`);
+    }
+    return declared.value;
+}
+function envProjection(env) {
+    return env.map((entry) => entry.source === 'literal'
+        ? { name: entry.name, value: entry.value }
+        : {
+            name: entry.name,
+            valueFrom: { secretKeyRef: { name: entry.secretRef.name, key: entry.secretRef.key } }
+        });
+}
+function volumeProjection(mounts) {
+    const unique = [...new Map(mounts.map((mount) => [mount.secretName, mount])).values()];
+    return {
+        mounts: unique.map((mount) => ({
+            name: cappedId('secret', mount.secretName),
+            mountPath: mount.mountPath,
+            readOnly: true
+        })),
+        volumes: unique.map((mount) => ({
+            name: cappedId('secret', mount.secretName),
+            secret: {
+                secretName: mount.secretName,
+                items: mount.keys?.length ? mount.keys.map((key) => ({ key, path: key })) : undefined
+            }
+        }))
+    };
+}
+function backupCredentialEnv(name, ref) {
+    if (!ref.store)
+        throw new Error(`Backup credential ${name} has no Kubernetes Secret store.`);
+    return { name, valueFrom: { secretKeyRef: { name: ref.store, key: ref.key } } };
+}
+function resource(manifest, namespace) {
+    const metadata = KubernetesMetadataSchema.parse(manifest.metadata);
+    return {
+        apiVersion: String(manifest.apiVersion),
+        kind: String(manifest.kind),
+        namespace,
+        name: metadata.name,
+        manifest
+    };
+}
+function applyChange(descriptor, change) {
+    const next = structuredClone(descriptor);
+    if (change.operation === 'scale') {
+        if (!Number.isInteger(change.gatewayReplicas) || (change.gatewayReplicas ?? 0) < 2) {
+            throw new Error('Scale requires gatewayReplicas >= 2; the durable service remains singleton.');
+        }
+        next.gateway.replicas = change.gatewayReplicas;
+    }
+    if (change.operation === 'rollback') {
+        if (!change.rollback) {
+            throw new Error('Rollback requires explicit sealed gateway and stateful image digests plus revisions.');
+        }
+        next.gateway.image = change.rollback.gateway.image;
+        next.gateway.revision = change.rollback.gateway.revision;
+        next.stateful.image = change.rollback.stateful.image;
+        next.stateful.revision = change.rollback.stateful.revision;
+        const currentSchema = descriptor.stateful.storage.schemaVersion;
+        const target = change.rollback.stateful.storageCompatibility;
+        if (target.readFrom > currentSchema || target.readThrough < currentSchema) {
+            throw new Error(`Rollback release cannot read PVC schema version ${currentSchema}.`);
+        }
+        if (target.writeVersion !== currentSchema) {
+            throw new Error(`Rollback cannot change PVC schema version ${currentSchema}; restore/migration is a separate operation.`);
+        }
+        next.stateful.storage.releaseCompatibility = target;
+    }
+    return ServiceReleaseDescriptorSchema.parse(next);
+}
+export function planDigitalOceanKubernetesServiceRelease(rawDescriptor, change) {
+    const descriptor = applyChange(ServiceReleaseDescriptorSchema.parse(rawDescriptor), change);
+    const declaredPublicKey = normalizePublicKey(descriptor.gateway.hostKeyAuthority.publicKey);
+    const declaredFingerprint = publicKeyFingerprint(declaredPublicKey);
+    if (declaredFingerprint !== descriptor.gateway.hostKeyAuthority.fingerprint) {
+        throw new Error('Source-owned SSH host public key does not match its declared fingerprint.');
+    }
+    const namespace = descriptor.namespace;
+    const gatewayLabels = labels(descriptor, 'gateway');
+    const statefulLabels = labels(descriptor, 'stateful');
+    const gatewaySecrets = volumeProjection(descriptor.gateway.secretMounts);
+    const statefulSecrets = volumeProjection(descriptor.stateful.secretMounts);
+    const dnsOwnerRef = descriptor.config.dnsOwnerRef;
+    const gatewayServiceName = cappedId(descriptor.gateway.name, 'public');
+    const statefulPvcName = cappedId(descriptor.stateful.name, 'data');
+    const routerConfigName = cappedId(descriptor.id, 'router');
+    const routerTls = descriptor.controlPlaneRouter.tlsSecretRef;
+    const hostAuthority = descriptor.gateway.hostKeyAuthority;
+    const hostSecret = hostAuthority.secretRef;
+    const backup = descriptor.stateful.backup;
+    const repositoryMigration = descriptor.stateful.repositoryMigration;
+    const certificate = descriptor.config.certificate;
+    const imageRegistry = descriptor.config.imageRegistry;
+    const imagePullSecrets = imageRegistry ? [{ name: imageRegistry.name }] : [];
+    const privateGitdOrigin = `http://${descriptor.stateful.name}:${descriptor.stateful.port}`;
+    const gatewayRuntimeEnv = [
+        { name: 'GIT_SSH_GATEWAY_PORT', value: String(descriptor.gateway.listenPort) },
+        { name: 'GITD_SESSION_URL', value: privateGitdOrigin },
+        {
+            name: 'VIBES_SSH_HOST_KEY_FILE',
+            value: `${hostSecret.mountPath}/${hostSecret.privateKeyKey}`
+        },
+        ...envProjection(descriptor.gateway.env)
+    ];
+    const statefulRuntimeEnv = [
+        { name: 'GITD_HOST', value: '0.0.0.0' },
+        { name: 'GITD_PORT', value: String(descriptor.stateful.port) },
+        { name: 'GITD_ROOT', value: descriptor.stateful.storage.mountPath },
+        { name: 'HOME', value: '/tmp' },
+        { name: 'TMPDIR', value: '/tmp' },
+        ...envProjection(descriptor.stateful.env)
+    ];
+    const podSecurityContext = {
+        runAsNonRoot: true,
+        runAsUser: 65532,
+        runAsGroup: 65532,
+        fsGroup: 65532,
+        fsGroupChangePolicy: 'OnRootMismatch',
+        seccompProfile: { type: 'RuntimeDefault' }
+    };
+    const containerSecurityContext = {
+        allowPrivilegeEscalation: false,
+        readOnlyRootFilesystem: true,
+        capabilities: { drop: ['ALL'] }
+    };
+    const tcpHealthProbes = (port) => ({
+        startupProbe: {
+            tcpSocket: { port },
+            periodSeconds: 2,
+            timeoutSeconds: 1,
+            failureThreshold: 30
+        },
+        readinessProbe: {
+            tcpSocket: { port },
+            periodSeconds: 5,
+            timeoutSeconds: 2,
+            failureThreshold: 3
+        },
+        livenessProbe: {
+            tcpSocket: { port },
+            periodSeconds: 10,
+            timeoutSeconds: 2,
+            failureThreshold: 3
+        }
+    });
+    const routerHealthProbes = {
+        startupProbe: {
+            httpGet: { path: '/healthz', port: 'https', scheme: 'HTTPS' },
+            periodSeconds: 2,
+            timeoutSeconds: 1,
+            failureThreshold: 30
+        },
+        readinessProbe: {
+            httpGet: { path: '/healthz', port: 'https', scheme: 'HTTPS' },
+            periodSeconds: 5,
+            timeoutSeconds: 2,
+            failureThreshold: 3
+        },
+        livenessProbe: {
+            httpGet: { path: '/healthz', port: 'https', scheme: 'HTTPS' },
+            periodSeconds: 10,
+            timeoutSeconds: 2,
+            failureThreshold: 3
+        }
+    };
+    const backupLabels = {
+        'app.kubernetes.io/name': descriptor.stateful.name,
+        'app.kubernetes.io/component': 'backup',
+        [LABEL_PART_OF]: descriptor.id,
+        'app.kubernetes.io/managed-by': FIELD_MANAGER
+    };
+    const resticBackup = backup.mode === 'restic-s3' ? backup : undefined;
+    const csiBackup = backup.mode === 'csi-volume-snapshot' ? backup : undefined;
+    const backupEnv = resticBackup
+        ? [
+            { name: 'RESTIC_REPOSITORY', value: resticBackup.repository },
+            { name: 'HOME', value: '/work' },
+            { name: 'TMPDIR', value: '/work/tmp' },
+            backupCredentialEnv('AWS_ACCESS_KEY_ID', resticBackup.credentials.accessKeyId),
+            backupCredentialEnv('AWS_SECRET_ACCESS_KEY', resticBackup.credentials.secretAccessKey),
+            backupCredentialEnv('RESTIC_PASSWORD', resticBackup.credentials.encryptionKey)
+        ]
+        : [];
+    const backupCommand = resticBackup
+        ? `set -eu
+mkdir -p /work/tmp
+restic cat config >/dev/null 2>&1 || restic init
+restic backup /data --tag ${descriptor.id} --tag schema-v${descriptor.stateful.storage.schemaVersion}
+restic forget --prune --keep-daily ${resticBackup.retention.keepDaily} --keep-weekly ${resticBackup.retention.keepWeekly} --keep-monthly ${resticBackup.retention.keepMonthly}
+`
+        : '';
+    const verifyCommand = resticBackup
+        ? `set -eu
+mkdir -p /work/tmp
+restic restore latest --target /restore
+	find /restore -type f -name HEAD > /work/git-heads
+count=0
+while IFS= read -r head; do
+	dir="$(dirname "$head")"
+	if [ -d "$dir/objects" ] && [ -d "$dir/refs" ]; then
+		git --git-dir="$dir" fsck --full
+		count=$((count + 1))
+	fi
+done < /work/git-heads
+	test "$count" -gt 0
+	`
+        : '';
+    const caddyfile = `{
+	admin off
+	auto_https off
+}
+
+	:${descriptor.controlPlaneRouter.listenPort} {
+		tls /run/secrets/tls/${routerTls.certificateKey} /run/secrets/tls/${routerTls.privateKeyKey}
+		@git_info_refs {
+			method GET
+			path_regexp git_info_refs ^/~?[A-Za-z0-9]+([._-]?[A-Za-z0-9]+)*/[A-Za-z0-9]+([._-]?[A-Za-z0-9]+)*\\.git/info/refs$
+			query service=git-upload-pack service=git-receive-pack
+		}
+		@git_rpc {
+			method POST
+			path_regexp git_rpc ^/~?[A-Za-z0-9]+([._-]?[A-Za-z0-9]+)*/[A-Za-z0-9]+([._-]?[A-Za-z0-9]+)*\\.git/(git-upload-pack|git-receive-pack)$
+		}
+		@control_plane path ${descriptor.controlPlaneRouter.allowedPathPrefixes.map((prefix) => `${prefix}*`).join(' ')}${descriptor.controlPlaneRouter.proxyRepoBrowse
+        ? `
+		@repo_browse {
+			method GET
+			path_regexp repo_browse ^/~?[A-Za-z0-9]+([._-]?[A-Za-z0-9]+)*/[A-Za-z0-9]+([._-]?[A-Za-z0-9]+)*(\\.git)?/browse(/.*)?$
+		}`
+        : ''}${descriptor.controlPlaneRouter.proxyMergeControl
+        ? `
+		@merge_control {
+			method POST
+			path_regexp merge_control ^/~?[A-Za-z0-9]+([._-]?[A-Za-z0-9]+)*/[A-Za-z0-9]+([._-]?[A-Za-z0-9]+)*/(merge-preview|merge|stack-operation)$
+		}`
+        : ''}
+		route {
+			reverse_proxy @git_info_refs ${privateGitdOrigin} {
+				header_up Authorization {http.request.header.Authorization}
+				flush_interval -1
+			}
+			reverse_proxy @git_rpc ${privateGitdOrigin} {
+				header_up Authorization {http.request.header.Authorization}
+				flush_interval -1
+			}
+			reverse_proxy @control_plane ${privateGitdOrigin} {
+				header_up Authorization {http.request.header.Authorization}
+			}${descriptor.controlPlaneRouter.proxyRepoBrowse
+        ? `
+			reverse_proxy @repo_browse ${privateGitdOrigin} {
+				header_up Authorization {http.request.header.Authorization}
+			}`
+        : ''}${descriptor.controlPlaneRouter.proxyMergeControl
+        ? `
+			reverse_proxy @merge_control ${privateGitdOrigin} {
+				header_up Authorization {http.request.header.Authorization}
+			}`
+        : ''}
+			respond /healthz 200
+			${descriptor.controlPlaneRouter.fallbackRedirect ? `redir * ${descriptor.controlPlaneRouter.fallbackRedirect}{uri} 302` : 'respond 404'}
+		}
+	}
+	`;
+    const lbAnnotations = {
+        ...descriptor.config.loadBalancerAnnotations,
+        'service.beta.kubernetes.io/do-loadbalancer-name': cappedId(descriptor.id, 'ssh'),
+        'vibes.dev/dns-owner-ref': dnsOwnerRef
+    };
+    const backupResources = resticBackup
+        ? [
+            resource({
+                apiVersion: 'batch/v1',
+                kind: 'CronJob',
+                metadata: {
+                    name: cappedId(descriptor.stateful.name, 'backup'),
+                    namespace,
+                    labels: { ...backupLabels, 'vibes.dev/egress-profile': 'object-backup' }
+                },
+                spec: {
+                    schedule: resticBackup.schedule,
+                    concurrencyPolicy: 'Forbid',
+                    successfulJobsHistoryLimit: 3,
+                    failedJobsHistoryLimit: 3,
+                    jobTemplate: {
+                        spec: {
+                            activeDeadlineSeconds: resticBackup.restoreVerify.timeoutSeconds,
+                            backoffLimit: 1,
+                            template: {
+                                metadata: {
+                                    labels: { ...backupLabels, 'vibes.dev/egress-profile': 'object-backup' }
+                                },
+                                spec: {
+                                    restartPolicy: 'Never',
+                                    securityContext: podSecurityContext,
+                                    affinity: {
+                                        podAffinity: {
+                                            requiredDuringSchedulingIgnoredDuringExecution: [
+                                                {
+                                                    labelSelector: {
+                                                        matchLabels: {
+                                                            'app.kubernetes.io/name': descriptor.stateful.name,
+                                                            'app.kubernetes.io/component': 'stateful'
+                                                        }
+                                                    },
+                                                    topologyKey: 'kubernetes.io/hostname'
+                                                }
+                                            ]
+                                        }
+                                    },
+                                    containers: [
+                                        {
+                                            name: 'backup',
+                                            image: resticBackup.toolImage,
+                                            imagePullPolicy: 'IfNotPresent',
+                                            command: ['/bin/sh', '-c', backupCommand],
+                                            env: backupEnv,
+                                            volumeMounts: [
+                                                { name: 'source-data', mountPath: '/data', readOnly: true },
+                                                { name: 'work', mountPath: '/work' }
+                                            ],
+                                            securityContext: containerSecurityContext
+                                        }
+                                    ],
+                                    volumes: [
+                                        {
+                                            name: 'source-data',
+                                            persistentVolumeClaim: { claimName: statefulPvcName, readOnly: true }
+                                        },
+                                        { name: 'work', emptyDir: {} }
+                                    ]
+                                }
+                            }
+                        }
+                    }
+                }
+            }, namespace),
+            resource({
+                apiVersion: 'batch/v1',
+                kind: 'CronJob',
+                metadata: {
+                    name: cappedId(descriptor.stateful.name, 'restore-verify'),
+                    namespace,
+                    labels: {
+                        ...backupLabels,
+                        'app.kubernetes.io/component': 'restore-verify',
+                        'vibes.dev/egress-profile': 'object-backup'
+                    }
+                },
+                spec: {
+                    schedule: resticBackup.restoreVerify.schedule,
+                    concurrencyPolicy: 'Forbid',
+                    successfulJobsHistoryLimit: 3,
+                    failedJobsHistoryLimit: 3,
+                    jobTemplate: {
+                        spec: {
+                            activeDeadlineSeconds: resticBackup.restoreVerify.timeoutSeconds,
+                            backoffLimit: 0,
+                            template: {
+                                metadata: {
+                                    labels: {
+                                        ...backupLabels,
+                                        'app.kubernetes.io/component': 'restore-verify',
+                                        'vibes.dev/egress-profile': 'object-backup'
+                                    }
+                                },
+                                spec: {
+                                    restartPolicy: 'Never',
+                                    securityContext: podSecurityContext,
+                                    containers: [
+                                        {
+                                            name: 'restore-verify',
+                                            image: resticBackup.toolImage,
+                                            imagePullPolicy: 'IfNotPresent',
+                                            command: ['/bin/sh', '-c', verifyCommand],
+                                            env: backupEnv,
+                                            volumeMounts: [
+                                                { name: 'restore-scratch', mountPath: '/restore' },
+                                                { name: 'work', mountPath: '/work' }
+                                            ],
+                                            securityContext: containerSecurityContext
+                                        }
+                                    ],
+                                    volumes: [
+                                        {
+                                            name: 'restore-scratch',
+                                            emptyDir: { sizeLimit: resticBackup.restoreVerify.scratchSize }
+                                        },
+                                        { name: 'work', emptyDir: {} }
+                                    ]
+                                }
+                            }
+                        }
+                    }
+                }
+            }, namespace)
+        ]
+        : (() => {
+            if (!csiBackup)
+                throw new Error('Service release backup mode was not recognized.');
+            const snapshotBackup = csiBackup;
+            const scripts = csiSnapshotAgentScripts();
+            const configName = cappedId(descriptor.stateful.name, 'snapshot-agent');
+            const serviceAccountName = cappedId(descriptor.stateful.name, 'snapshot-agent');
+            const snapshotName = cappedId(descriptor.stateful.name, 'snapshot');
+            const verifyName = cappedId(descriptor.stateful.name, 'snapshot-verify');
+            const snapshotLabels = { ...backupLabels, 'vibes.dev/backup-mode': 'csi-volume-snapshot' };
+            // Requests are the co-scheduling budget, not the working set: the snapshot
+            // agent must fit BESIDE the stateful pod on its RWO node (podAffinity, so
+            // `sync -f /data` sees the live filesystem), and the namespace LimitRange
+            // default of 250m/256Mi could not fit next to gitd on a 2-vCPU node —
+            // every daily snapshot from 2026-08-20 to 2026-08-29 sat Pending until
+            // its deadline. Both agents only poll the API server from Node.
+            const agentResources = {
+                requests: { cpu: '20m', memory: '64Mi' },
+                limits: { cpu: '500m', memory: '256Mi' }
+            };
+            const commonEnv = [
+                { name: 'NAMESPACE', valueFrom: { fieldRef: { fieldPath: 'metadata.namespace' } } },
+                { name: 'SOURCE_PVC', value: statefulPvcName },
+                { name: 'SOURCE_REVISION', value: descriptor.stateful.revision },
+                {
+                    name: 'STORAGE_SCHEMA_VERSION',
+                    value: String(descriptor.stateful.storage.schemaVersion)
+                },
+                { name: 'SNAPSHOT_CLASS', value: snapshotBackup.snapshotClassName },
+                { name: 'DELETION_POLICY', value: snapshotBackup.deletionPolicy },
+                { name: 'TIMEOUT_SECONDS', value: String(snapshotBackup.restoreVerify.timeoutSeconds) }
+            ];
+            return [
+                resource({
+                    apiVersion: 'v1',
+                    kind: 'ConfigMap',
+                    metadata: { name: configName, namespace, labels: snapshotLabels },
+                    data: { 'snapshot.mjs': scripts.snapshot, 'verify.mjs': scripts.verify }
+                }, namespace),
+                resource({
+                    apiVersion: 'v1',
+                    kind: 'ServiceAccount',
+                    metadata: { name: serviceAccountName, namespace, labels: snapshotLabels },
+                    automountServiceAccountToken: true,
+                    imagePullSecrets
+                }, namespace),
+                resource({
+                    apiVersion: 'rbac.authorization.k8s.io/v1',
+                    kind: 'Role',
+                    metadata: { name: serviceAccountName, namespace, labels: snapshotLabels },
+                    rules: [
+                        {
+                            apiGroups: ['snapshot.storage.k8s.io'],
+                            resources: ['volumesnapshots'],
+                            verbs: ['get', 'list', 'create', 'patch', 'delete']
+                        },
+                        {
+                            apiGroups: [''],
+                            resources: ['persistentvolumeclaims', 'pods'],
+                            verbs: ['get', 'list', 'create', 'delete']
+                        }
+                    ]
+                }, namespace),
+                resource({
+                    apiVersion: 'rbac.authorization.k8s.io/v1',
+                    kind: 'RoleBinding',
+                    metadata: { name: serviceAccountName, namespace, labels: snapshotLabels },
+                    roleRef: {
+                        apiGroup: 'rbac.authorization.k8s.io',
+                        kind: 'Role',
+                        name: serviceAccountName
+                    },
+                    subjects: [{ kind: 'ServiceAccount', name: serviceAccountName, namespace }]
+                }, namespace),
+                resource({
+                    apiVersion: 'batch/v1',
+                    kind: 'CronJob',
+                    metadata: { name: snapshotName, namespace, labels: snapshotLabels },
+                    spec: {
+                        schedule: snapshotBackup.schedule,
+                        concurrencyPolicy: 'Forbid',
+                        successfulJobsHistoryLimit: 3,
+                        failedJobsHistoryLimit: 3,
+                        jobTemplate: {
+                            spec: {
+                                activeDeadlineSeconds: snapshotBackup.restoreVerify.timeoutSeconds,
+                                backoffLimit: 0,
+                                template: {
+                                    metadata: { labels: snapshotLabels },
+                                    spec: {
+                                        serviceAccountName,
+                                        restartPolicy: 'Never',
+                                        securityContext: podSecurityContext,
+                                        affinity: {
+                                            podAffinity: {
+                                                requiredDuringSchedulingIgnoredDuringExecution: [
+                                                    {
+                                                        labelSelector: {
+                                                            matchLabels: {
+                                                                'app.kubernetes.io/name': descriptor.stateful.name,
+                                                                'app.kubernetes.io/component': 'stateful'
+                                                            }
+                                                        },
+                                                        topologyKey: 'kubernetes.io/hostname'
+                                                    }
+                                                ]
+                                            }
+                                        },
+                                        containers: [
+                                            {
+                                                name: 'snapshot',
+                                                image: snapshotBackup.toolImage,
+                                                imagePullPolicy: 'IfNotPresent',
+                                                command: [
+                                                    '/bin/sh',
+                                                    '-c',
+                                                    'set -eu; sync -f /data; node /opt/vibes-backup/snapshot.mjs'
+                                                ],
+                                                env: [...commonEnv, { name: 'SNAPSHOT_PREFIX', value: snapshotName }],
+                                                resources: agentResources,
+                                                volumeMounts: [
+                                                    { name: 'source-data', mountPath: '/data', readOnly: true },
+                                                    { name: 'scripts', mountPath: '/opt/vibes-backup', readOnly: true },
+                                                    { name: 'tmp', mountPath: '/tmp' }
+                                                ],
+                                                securityContext: containerSecurityContext
+                                            }
+                                        ],
+                                        volumes: [
+                                            {
+                                                name: 'source-data',
+                                                persistentVolumeClaim: { claimName: statefulPvcName, readOnly: true }
+                                            },
+                                            { name: 'scripts', configMap: { name: configName, defaultMode: 0o444 } },
+                                            { name: 'tmp', emptyDir: {} }
+                                        ]
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }, namespace),
+                resource({
+                    apiVersion: 'batch/v1',
+                    kind: 'CronJob',
+                    metadata: {
+                        name: verifyName,
+                        namespace,
+                        labels: { ...snapshotLabels, 'app.kubernetes.io/component': 'restore-verify' }
+                    },
+                    spec: {
+                        schedule: snapshotBackup.restoreVerify.schedule,
+                        concurrencyPolicy: 'Forbid',
+                        successfulJobsHistoryLimit: 3,
+                        failedJobsHistoryLimit: 3,
+                        jobTemplate: {
+                            spec: {
+                                activeDeadlineSeconds: snapshotBackup.restoreVerify.timeoutSeconds,
+                                backoffLimit: 0,
+                                template: {
+                                    metadata: {
+                                        labels: {
+                                            ...snapshotLabels,
+                                            'app.kubernetes.io/component': 'restore-verify'
+                                        }
+                                    },
+                                    spec: {
+                                        serviceAccountName,
+                                        restartPolicy: 'Never',
+                                        securityContext: podSecurityContext,
+                                        containers: [
+                                            {
+                                                name: 'restore-verify',
+                                                image: snapshotBackup.toolImage,
+                                                imagePullPolicy: 'IfNotPresent',
+                                                command: ['node', '/opt/vibes-backup/verify.mjs'],
+                                                env: [
+                                                    ...commonEnv,
+                                                    { name: 'VERIFY_PREFIX', value: verifyName },
+                                                    { name: 'VERIFY_IMAGE', value: descriptor.stateful.image },
+                                                    {
+                                                        name: 'STORAGE_CLASS',
+                                                        value: descriptor.stateful.storage.storageClassName
+                                                    },
+                                                    {
+                                                        name: 'SCRATCH_SIZE',
+                                                        value: snapshotBackup.restoreVerify.scratchSize
+                                                    },
+                                                    {
+                                                        name: 'KEEP_VERIFIED_GENERATIONS',
+                                                        value: String(snapshotBackup.retention.verifiedGenerations)
+                                                    }
+                                                ],
+                                                resources: agentResources,
+                                                volumeMounts: [
+                                                    { name: 'scripts', mountPath: '/opt/vibes-backup', readOnly: true },
+                                                    { name: 'tmp', mountPath: '/tmp' }
+                                                ],
+                                                securityContext: containerSecurityContext
+                                            }
+                                        ],
+                                        volumes: [
+                                            { name: 'scripts', configMap: { name: configName, defaultMode: 0o444 } },
+                                            { name: 'tmp', emptyDir: {} }
+                                        ]
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }, namespace),
+                resource({
+                    apiVersion: 'cilium.io/v2',
+                    kind: 'CiliumNetworkPolicy',
+                    metadata: {
+                        name: cappedId(descriptor.stateful.name, 'snapshot-api-egress'),
+                        namespace
+                    },
+                    spec: {
+                        endpointSelector: {
+                            matchLabels: { 'vibes.dev/backup-mode': 'csi-volume-snapshot' }
+                        },
+                        egress: [
+                            {
+                                toEntities: ['kube-apiserver'],
+                                toPorts: [{ ports: [{ port: '443', protocol: 'TCP' }] }]
+                            }
+                        ]
+                    }
+                }, namespace)
+            ];
+        })();
+    const manifests = [
+        resource({
+            apiVersion: 'v1',
+            kind: 'Namespace',
+            metadata: { name: namespace, labels: { [LABEL_PART_OF]: descriptor.id } }
+        }),
+        resource({
+            apiVersion: 'v1',
+            kind: 'ConfigMap',
+            metadata: {
+                name: routerConfigName,
+                namespace,
+                labels: { [LABEL_PART_OF]: descriptor.id },
+                annotations: {
+                    'vibes.dev/https-smart-git-authority': 'gitd',
+                    'vibes.dev/https-smart-git-path-contract': descriptor.controlPlaneRouter.smartGit.pathContract
+                }
+            },
+            data: { Caddyfile: caddyfile }
+        }, namespace),
+        resource({
+            apiVersion: 'apps/v1',
+            kind: 'Deployment',
+            metadata: {
+                name: descriptor.gateway.name,
+                namespace,
+                labels: gatewayLabels,
+                annotations: {
+                    'vibes.dev/router-revision': descriptor.controlPlaneRouter.revision,
+                    'vibes.dev/ssh-host-key-fingerprint': hostAuthority.fingerprint,
+                    'vibes.dev/ssh-host-key-generation': String(hostAuthority.rotation.generation)
+                }
+            },
+            spec: {
+                replicas: descriptor.gateway.replicas,
+                strategy: {
+                    type: 'RollingUpdate',
+                    rollingUpdate: {
+                        maxUnavailable: descriptor.gateway.maxUnavailable,
+                        maxSurge: descriptor.gateway.maxSurge
+                    }
+                },
+                selector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': descriptor.gateway.name,
+                        'app.kubernetes.io/component': 'gateway'
+                    }
+                },
+                template: {
+                    metadata: {
+                        labels: gatewayLabels,
+                        annotations: {
+                            'vibes.dev/router-revision': descriptor.controlPlaneRouter.revision,
+                            'vibes.dev/ssh-host-key-fingerprint': hostAuthority.fingerprint,
+                            'vibes.dev/ssh-host-key-generation': String(hostAuthority.rotation.generation)
+                        }
+                    },
+                    spec: {
+                        securityContext: podSecurityContext,
+                        topologySpreadConstraints: [
+                            {
+                                maxSkew: 1,
+                                topologyKey: 'kubernetes.io/hostname',
+                                whenUnsatisfiable: 'DoNotSchedule',
+                                labelSelector: {
+                                    matchLabels: {
+                                        'app.kubernetes.io/name': descriptor.gateway.name,
+                                        'app.kubernetes.io/component': 'gateway'
+                                    }
+                                }
+                            }
+                        ],
+                        containers: [
+                            {
+                                name: 'gateway',
+                                image: descriptor.gateway.image,
+                                imagePullPolicy: 'IfNotPresent',
+                                ports: [
+                                    { name: 'ssh', containerPort: descriptor.gateway.listenPort, protocol: 'TCP' }
+                                ],
+                                env: gatewayRuntimeEnv,
+                                volumeMounts: [
+                                    ...gatewaySecrets.mounts,
+                                    { name: 'ssh-host-key', mountPath: hostSecret.mountPath, readOnly: true },
+                                    { name: 'tmp', mountPath: '/tmp' }
+                                ],
+                                resources: descriptor.gateway.resources,
+                                securityContext: containerSecurityContext,
+                                ...tcpHealthProbes('ssh')
+                            },
+                            {
+                                name: 'https-router',
+                                image: descriptor.controlPlaneRouter.image,
+                                imagePullPolicy: 'IfNotPresent',
+                                ports: [
+                                    {
+                                        name: 'https',
+                                        containerPort: descriptor.controlPlaneRouter.listenPort,
+                                        protocol: 'TCP'
+                                    }
+                                ],
+                                volumeMounts: [
+                                    { name: 'router-config', mountPath: '/etc/caddy', readOnly: true },
+                                    { name: 'router-tls', mountPath: '/run/secrets/tls', readOnly: true },
+                                    { name: 'router-data', mountPath: '/data' },
+                                    { name: 'router-runtime', mountPath: '/config' },
+                                    { name: 'tmp', mountPath: '/tmp' }
+                                ],
+                                resources: descriptor.controlPlaneRouter.resources,
+                                securityContext: containerSecurityContext,
+                                ...routerHealthProbes
+                            }
+                        ],
+                        volumes: [
+                            ...gatewaySecrets.volumes,
+                            {
+                                name: 'ssh-host-key',
+                                secret: {
+                                    secretName: hostSecret.name,
+                                    items: [
+                                        {
+                                            key: hostSecret.privateKeyKey,
+                                            path: hostSecret.privateKeyKey,
+                                            mode: 0o440
+                                        },
+                                        { key: hostSecret.publicKeyKey, path: hostSecret.publicKeyKey, mode: 0o444 }
+                                    ]
+                                }
+                            },
+                            {
+                                name: 'router-config',
+                                configMap: {
+                                    name: routerConfigName,
+                                    items: [{ key: 'Caddyfile', path: 'Caddyfile' }]
+                                }
+                            },
+                            {
+                                name: 'router-tls',
+                                secret: {
+                                    secretName: routerTls.name,
+                                    items: [
+                                        {
+                                            key: routerTls.certificateKey,
+                                            path: routerTls.certificateKey,
+                                            mode: 0o444
+                                        },
+                                        { key: routerTls.privateKeyKey, path: routerTls.privateKeyKey, mode: 0o440 }
+                                    ]
+                                }
+                            },
+                            { name: 'router-data', emptyDir: {} },
+                            { name: 'router-runtime', emptyDir: {} },
+                            { name: 'tmp', emptyDir: {} }
+                        ]
+                    }
+                }
+            }
+        }, namespace),
+        resource({
+            apiVersion: 'policy/v1',
+            kind: 'PodDisruptionBudget',
+            metadata: {
+                name: cappedId(descriptor.gateway.name, 'availability'),
+                namespace,
+                labels: gatewayLabels
+            },
+            spec: {
+                minAvailable: 2,
+                selector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': descriptor.gateway.name,
+                        'app.kubernetes.io/component': 'gateway'
+                    }
+                }
+            }
+        }, namespace),
+        resource({
+            apiVersion: 'v1',
+            kind: 'Service',
+            metadata: {
+                name: gatewayServiceName,
+                namespace,
+                labels: gatewayLabels,
+                annotations: lbAnnotations
+            },
+            spec: {
+                type: 'LoadBalancer',
+                externalTrafficPolicy: 'Local',
+                selector: {
+                    'app.kubernetes.io/name': descriptor.gateway.name,
+                    'app.kubernetes.io/component': 'gateway'
+                },
+                ports: [
+                    { name: 'ssh', protocol: 'TCP', port: descriptor.gateway.port, targetPort: 'ssh' },
+                    {
+                        name: 'https',
+                        protocol: 'TCP',
+                        port: descriptor.controlPlaneRouter.publicPort,
+                        targetPort: 'https'
+                    }
+                ]
+            }
+        }, namespace),
+        resource({
+            apiVersion: 'v1',
+            kind: 'PersistentVolumeClaim',
+            metadata: {
+                name: statefulPvcName,
+                namespace,
+                labels: statefulLabels,
+                annotations: {
+                    'vibes.dev/storage-schema-version': String(descriptor.stateful.storage.schemaVersion)
+                }
+            },
+            spec: {
+                accessModes: ['ReadWriteOnce'],
+                storageClassName: descriptor.stateful.storage.storageClassName
+                    ? descriptor.stateful.storage.storageClassName
+                    : undefined,
+                resources: { requests: { storage: descriptor.stateful.storage.size } }
+            }
+        }, namespace),
+        resource({
+            apiVersion: 'v1',
+            kind: 'Service',
+            metadata: { name: descriptor.stateful.name, namespace, labels: statefulLabels },
+            spec: {
+                type: 'ClusterIP',
+                clusterIP: 'None',
+                publishNotReadyAddresses: false,
+                selector: {
+                    'app.kubernetes.io/name': descriptor.stateful.name,
+                    'app.kubernetes.io/component': 'stateful'
+                },
+                ports: [
+                    {
+                        name: 'session',
+                        protocol: 'TCP',
+                        port: descriptor.stateful.port,
+                        targetPort: 'session'
+                    }
+                ]
+            }
+        }, namespace),
+        resource({
+            apiVersion: 'apps/v1',
+            kind: 'StatefulSet',
+            metadata: {
+                name: descriptor.stateful.name,
+                namespace,
+                labels: statefulLabels,
+                annotations: {
+                    'vibes.dev/storage-schema-version': String(descriptor.stateful.storage.schemaVersion)
+                }
+            },
+            spec: {
+                replicas: 1,
+                serviceName: descriptor.stateful.name,
+                updateStrategy: { type: 'RollingUpdate' },
+                podManagementPolicy: 'OrderedReady',
+                selector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': descriptor.stateful.name,
+                        'app.kubernetes.io/component': 'stateful'
+                    }
+                },
+                template: {
+                    metadata: { labels: statefulLabels },
+                    spec: {
+                        securityContext: podSecurityContext,
+                        containers: [
+                            {
+                                name: 'stateful',
+                                image: descriptor.stateful.image,
+                                imagePullPolicy: 'IfNotPresent',
+                                ports: [
+                                    { name: 'session', containerPort: descriptor.stateful.port, protocol: 'TCP' }
+                                ],
+                                env: statefulRuntimeEnv,
+                                volumeMounts: [
+                                    ...statefulSecrets.mounts,
+                                    { name: 'data', mountPath: descriptor.stateful.storage.mountPath },
+                                    { name: 'tmp', mountPath: '/tmp' }
+                                ],
+                                resources: descriptor.stateful.resources,
+                                securityContext: containerSecurityContext,
+                                ...tcpHealthProbes('session')
+                            }
+                        ],
+                        volumes: [
+                            ...statefulSecrets.volumes,
+                            {
+                                name: 'data',
+                                persistentVolumeClaim: { claimName: statefulPvcName, readOnly: false }
+                            },
+                            { name: 'tmp', emptyDir: {} }
+                        ]
+                    }
+                }
+            }
+        }, namespace),
+        ...backupResources,
+        // The repository-migration Job is labeled with this egress profile, but
+        // under default-deny nothing ever granted the profile its network: the
+        // mirror-ssh run needs TCP 22 to the legacy source host and TCP 443 for
+        // the platform inventory/lease APIs. Its absence surfaced as
+        // "ssh: connect to host git.vibes.dev port 22: Connection timed out"
+        // (2026-08-18, generation-1 attempt 3) — the two earlier attempts died
+        // before reaching the network, keeping this gap latent. Port-scoped and
+        // profile-scoped; the source hostname resolves via public DNS so the
+        // destination stays an ipBlock, not a pinned address.
+        ...(descriptor.stateful.repositoryMigration
+            ? [
+                resource({
+                    apiVersion: 'networking.k8s.io/v1',
+                    kind: 'NetworkPolicy',
+                    metadata: { name: cappedId(descriptor.id, 'migration-egress'), namespace },
+                    spec: {
+                        podSelector: {
+                            matchLabels: { 'vibes.dev/egress-profile': 'repository-migration' }
+                        },
+                        policyTypes: ['Egress'],
+                        egress: [
+                            {
+                                to: [{ ipBlock: { cidr: '0.0.0.0/0' } }],
+                                ports: [
+                                    { protocol: 'TCP', port: 22 },
+                                    { protocol: 'TCP', port: 443 }
+                                ]
+                            }
+                        ]
+                    }
+                }, namespace)
+            ]
+            : []),
+        resource({
+            apiVersion: 'networking.k8s.io/v1',
+            kind: 'NetworkPolicy',
+            metadata: { name: cappedId(descriptor.id, 'default-deny-ingress'), namespace },
+            spec: { podSelector: {}, policyTypes: ['Ingress'], ingress: [] }
+        }, namespace),
+        resource({
+            apiVersion: 'networking.k8s.io/v1',
+            kind: 'NetworkPolicy',
+            metadata: { name: cappedId(descriptor.id, 'default-deny-egress'), namespace },
+            spec: { podSelector: {}, policyTypes: ['Egress'], egress: [] }
+        }, namespace),
+        resource({
+            apiVersion: 'networking.k8s.io/v1',
+            kind: 'NetworkPolicy',
+            metadata: { name: cappedId(descriptor.gateway.name, 'public-ssh'), namespace },
+            spec: {
+                podSelector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': descriptor.gateway.name,
+                        'app.kubernetes.io/component': 'gateway'
+                    }
+                },
+                policyTypes: ['Ingress'],
+                ingress: [
+                    {
+                        from: [
+                            { ipBlock: { cidr: '0.0.0.0/0' } },
+                            { ipBlock: { cidr: '::/0' } },
+                            { namespaceSelector: {} }
+                        ],
+                        ports: [
+                            { protocol: 'TCP', port: descriptor.gateway.listenPort },
+                            { protocol: 'TCP', port: descriptor.controlPlaneRouter.listenPort }
+                        ]
+                    }
+                ]
+            }
+        }, namespace),
+        resource({
+            apiVersion: 'networking.k8s.io/v1',
+            kind: 'NetworkPolicy',
+            metadata: { name: cappedId(descriptor.gateway.name, 'egress'), namespace },
+            spec: {
+                podSelector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': descriptor.gateway.name,
+                        'app.kubernetes.io/component': 'gateway'
+                    }
+                },
+                policyTypes: ['Egress'],
+                egress: [
+                    {
+                        to: [
+                            {
+                                namespaceSelector: {
+                                    matchLabels: { 'kubernetes.io/metadata.name': 'kube-system' }
+                                },
+                                podSelector: { matchLabels: { 'k8s-app': 'kube-dns' } }
+                            }
+                        ],
+                        ports: [
+                            { protocol: 'UDP', port: 53 },
+                            { protocol: 'TCP', port: 53 }
+                        ]
+                    },
+                    {
+                        to: [
+                            {
+                                podSelector: {
+                                    matchLabels: {
+                                        'app.kubernetes.io/name': descriptor.stateful.name,
+                                        'app.kubernetes.io/component': 'stateful'
+                                    }
+                                }
+                            }
+                        ],
+                        ports: [{ protocol: 'TCP', port: descriptor.stateful.port }]
+                    },
+                    {
+                        to: descriptor.networkPolicy.egress.platformAuthCidrs.map((cidr) => ({
+                            ipBlock: { cidr }
+                        })),
+                        ports: [{ protocol: 'TCP', port: 443 }]
+                    }
+                ]
+            }
+        }, namespace),
+        resource({
+            apiVersion: 'networking.k8s.io/v1',
+            kind: 'NetworkPolicy',
+            metadata: { name: cappedId(descriptor.stateful.name, 'private'), namespace },
+            spec: {
+                podSelector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': descriptor.stateful.name,
+                        'app.kubernetes.io/component': 'stateful'
+                    }
+                },
+                policyTypes: ['Ingress'],
+                ingress: [
+                    {
+                        from: [
+                            {
+                                podSelector: {
+                                    matchLabels: {
+                                        'app.kubernetes.io/name': descriptor.gateway.name,
+                                        'app.kubernetes.io/component': 'gateway'
+                                    }
+                                }
+                            }
+                        ],
+                        ports: [{ protocol: 'TCP', port: descriptor.stateful.port }]
+                    }
+                ]
+            }
+        }, namespace),
+        ...(resticBackup
+            ? [
+                resource({
+                    apiVersion: 'networking.k8s.io/v1',
+                    kind: 'NetworkPolicy',
+                    metadata: { name: cappedId(descriptor.stateful.name, 'backup-egress'), namespace },
+                    spec: {
+                        podSelector: { matchLabels: { 'vibes.dev/egress-profile': 'object-backup' } },
+                        policyTypes: ['Egress'],
+                        egress: [
+                            {
+                                to: [
+                                    {
+                                        namespaceSelector: {
+                                            matchLabels: { 'kubernetes.io/metadata.name': 'kube-system' }
+                                        },
+                                        podSelector: { matchLabels: { 'k8s-app': 'kube-dns' } }
+                                    }
+                                ],
+                                ports: [
+                                    { protocol: 'UDP', port: 53 },
+                                    { protocol: 'TCP', port: 53 }
+                                ]
+                            },
+                            ...(descriptor.networkPolicy.egress.objectBackupCidrs
+                                ? [
+                                    {
+                                        to: descriptor.networkPolicy.egress.objectBackupCidrs.map((cidr) => ({
+                                            ipBlock: { cidr }
+                                        })),
+                                        ports: [{ protocol: 'TCP', port: 443 }]
+                                    }
+                                ]
+                                : [])
+                        ]
+                    }
+                }, namespace),
+                ...(descriptor.networkPolicy.egress.objectBackupHostnames
+                    ? [
+                        resource({
+                            apiVersion: 'cilium.io/v2',
+                            kind: 'CiliumNetworkPolicy',
+                            metadata: {
+                                name: cappedId(descriptor.stateful.name, 'backup-fqdn-egress'),
+                                namespace
+                            },
+                            spec: {
+                                endpointSelector: {
+                                    matchLabels: { 'vibes.dev/egress-profile': 'object-backup' }
+                                },
+                                egress: [
+                                    {
+                                        toFQDNs: descriptor.networkPolicy.egress.objectBackupHostnames.map((matchName) => ({ matchName })),
+                                        toPorts: [{ ports: [{ port: '443', protocol: 'TCP' }] }]
+                                    }
+                                ]
+                            }
+                        }, namespace)
+                    ]
+                    : [])
+            ]
+            : [])
+    ];
+    return {
+        provider: 'digitalocean-kubernetes',
+        cluster: descriptor.config.cluster,
+        operation: change.operation,
+        fieldManager: FIELD_MANAGER,
+        conflictPolicy: 'fail',
+        dns: { hostname: descriptor.gateway.hostname, ownerRef: dnsOwnerRef, managedByThisPlan: false },
+        hostKeyAuthority: {
+            publicKey: declaredPublicKey,
+            fingerprint: hostAuthority.fingerprint,
+            generation: hostAuthority.rotation.generation,
+            source: hostAuthority.source,
+            secret: {
+                namespace,
+                name: hostSecret.name,
+                provisioningOwner: 'secret-management',
+                rotationStrategy: 'preprovisioned-atomic'
+            }
+        },
+        namespaceQuota: descriptor.config.namespaceQuota
+            ? {
+                namespace,
+                name: descriptor.config.namespaceQuota.name,
+                hard: { ...descriptor.config.namespaceQuota.hard }
+            }
+            : undefined,
+        imageRegistry: imageRegistry
+            ? {
+                provider: imageRegistry.provider,
+                name: imageRegistry.name,
+                pullSecretName: imageRegistry.name
+            }
+            : undefined,
+        backup: backup.mode === 'restic-s3'
+            ? {
+                mode: 'restic-s3',
+                repository: backup.repository,
+                encryption: 'restic-repository-key',
+                schedule: backup.schedule,
+                verifySchedule: backup.restoreVerify.schedule,
+                retention: backup.retention
+            }
+            : {
+                mode: 'csi-volume-snapshot',
+                snapshotClassName: backup.snapshotClassName,
+                deletionPolicy: backup.deletionPolicy,
+                schedule: backup.schedule,
+                verifySchedule: backup.restoreVerify.schedule,
+                retention: backup.retention
+            },
+        repositoryMigration: repositoryMigration
+            ? {
+                migrationId: repositoryMigration.migrationId,
+                mode: repositoryMigration.mode,
+                sourceOrigin: repositoryMigration.source.origin,
+                inventoryUrl: repositoryMigration.source.inventoryUrl,
+                sshLeaseUrl: repositoryMigration.source.sshLeaseUrl,
+                releaseRevision: descriptor.stateful.revision,
+                expectedRepositoryCount: repositoryMigration.expected.repositoryCount,
+                expectedOwners: repositoryMigration.expected.owners.map((owner) => ({ ...owner })),
+                inventoryAuthoritySecret: {
+                    namespace,
+                    name: repositoryMigration.source.inventoryAuthoritySecretRef.name,
+                    key: repositoryMigration.source.inventoryAuthoritySecretRef.key
+                },
+                environmentTier: declaredEnvironmentTier(descriptor),
+                destination: {
+                    pvcName: statefulPvcName,
+                    mountPath: descriptor.stateful.storage.mountPath
+                },
+                statefulName: descriptor.stateful.name,
+                image: descriptor.stateful.image,
+                receipt: { namespace, name: repositoryMigration.receipt.configMapName },
+                stablePasses: repositoryMigration.convergence.stablePasses,
+                rollback: repositoryMigration.rollback.mode
+            }
+            : undefined,
+        certificates: certificate
+            ? [
+                {
+                    namespace,
+                    name: routerTls.name,
+                    secretName: routerTls.name,
+                    dnsNames: [descriptor.gateway.hostname],
+                    issuerRef: certificate.issuerRef,
+                    duration: certificate.duration,
+                    renewBefore: certificate.renewBefore,
+                    privateKey: certificate.privateKey
+                }
+            ]
+            : [],
+        requiresCiliumNetworkPolicy: backup.mode === 'csi-volume-snapshot' ||
+            Boolean(descriptor.networkPolicy.egress.objectBackupHostnames),
+        requiredSecrets: requiredSecrets(descriptor),
+        resources: manifests,
+        warnings: [
+            `DNS is not mutated by this plan; ${dnsOwnerRef} must track the LoadBalancer ingress.`,
+            'The stateful service has one RWO primary; its rollout is ordered but not zero-downtime.'
+        ]
+    };
+}
+function resourcePath(resource) {
+    const name = encodeURIComponent(resource.name);
+    const ns = resource.namespace ? `/namespaces/${encodeURIComponent(resource.namespace)}` : '';
+    const key = `${resource.apiVersion}:${resource.kind}`;
+    const paths = {
+        'v1:Namespace': `/api/v1/namespaces/${name}`,
+        'v1:Service': `/api/v1${ns}/services/${name}`,
+        'v1:ServiceAccount': `/api/v1${ns}/serviceaccounts/${name}`,
+        'v1:ConfigMap': `/api/v1${ns}/configmaps/${name}`,
+        'v1:PersistentVolumeClaim': `/api/v1${ns}/persistentvolumeclaims/${name}`,
+        'v1:ResourceQuota': `/api/v1${ns}/resourcequotas/${name}`,
+        'apps/v1:Deployment': `/apis/apps/v1${ns}/deployments/${name}`,
+        'apps/v1:StatefulSet': `/apis/apps/v1${ns}/statefulsets/${name}`,
+        'batch/v1:Job': `/apis/batch/v1${ns}/jobs/${name}`,
+        'batch/v1:CronJob': `/apis/batch/v1${ns}/cronjobs/${name}`,
+        'rbac.authorization.k8s.io/v1:Role': `/apis/rbac.authorization.k8s.io/v1${ns}/roles/${name}`,
+        'rbac.authorization.k8s.io/v1:RoleBinding': `/apis/rbac.authorization.k8s.io/v1${ns}/rolebindings/${name}`,
+        'policy/v1:PodDisruptionBudget': `/apis/policy/v1${ns}/poddisruptionbudgets/${name}`,
+        'autoscaling/v2:HorizontalPodAutoscaler': `/apis/autoscaling/v2${ns}/horizontalpodautoscalers/${name}`,
+        'networking.k8s.io/v1:NetworkPolicy': `/apis/networking.k8s.io/v1${ns}/networkpolicies/${name}`,
+        'cilium.io/v2:CiliumNetworkPolicy': `/apis/cilium.io/v2${ns}/ciliumnetworkpolicies/${name}`
+    };
+    const path = Object.entries(paths).find(([candidate]) => candidate === key)?.[1];
+    if (!path)
+        throw new Error(`Refusing resource outside service-release allowlist: ${key}.`);
+    return path;
+}
+function invalidWorkerPlan(message, reason) {
+    return new CapabilityError(message, 'INVALID_INPUT', { reason });
+}
+export class DigitalOceanKubernetesServiceReleaseClient {
+    runtime;
+    kubernetes;
+    fetchImpl;
+    spacesKeys;
+    constructor(runtime, kubernetes, fetchImpl, spacesKeys) {
+        this.runtime = runtime;
+        this.kubernetes = kubernetes;
+        this.fetchImpl = fetchImpl;
+        this.spacesKeys = spacesKeys;
+    }
+    /**
+     * Resolve the DOKS Secret delivery capability through its semantic runtime
+     * client. The secrets/store projection remains limited to store operations.
+     */
+    async workerCredentialDeliveryOwner() {
+        let client;
+        try {
+            client = await getVibesClient(DOKS_SECRET_DELIVERY_CLIENT_ID, this.runtime);
+        }
+        catch (cause) {
+            throw new CapabilityError('The DOKS Secret credential delivery owner is not composed.', 'UNAVAILABLE', { reason: 'doks-worker-credential-owner-unavailable', cause });
+        }
+        // The contract is validated on the resolved client, and the validated
+        // client itself is returned. A schema projection of the delivery members
+        // would lose the runtime client's receiver, and with it the store and
+        // connection state its delivery operations read through `this`.
+        const owner = DigitalOceanDoksWorkerCredentialDeliveryOwnerSchema.safeParse(client);
+        if (!owner.success) {
+            throw new CapabilityError('The DOKS Secret credential delivery owner has an invalid runtime contract.', 'UNAVAILABLE', { reason: 'doks-worker-credential-owner-unavailable', cause: owner.error });
+        }
+        return client;
+    }
+    /**
+     * Admission for every externally reachable worker execution. The caller
+     * supplies only the execution input (operation, worker id, source
+     * revision); the authorized projection is regenerated from the descriptor
+     * the runtime selects by id, so a descriptor embedded in an untrusted plan
+     * is never independent authority.
+     */
+    async authorizeWorkerExecution(execution, allowCredentialLease) {
+        return this.authorizeWorkerPlan(execution, allowCredentialLease);
+    }
+    /**
+     * Regenerate the authorized projection from the descriptor the runtime
+     * selects by id. A credential lease the Secrets owner issued mid-execution
+     * is the only caller state that may re-enter, and only when the caller is
+     * allowed to reuse it.
+     */
+    async authorizeWorkerPlan(execution, allowCredentialLease, issuedLease) {
+        const selected = this.runtime
+            .query('infra/worker')
+            .withId(execution.worker)
+            .enabled()
+            .firstDescriptor();
+        if (!selected) {
+            throw new CapabilityError('DOKS worker descriptor is not registered.', 'NOT_FOUND', {
+                reason: 'doks-worker-descriptor-not-found'
+            });
+        }
+        const descriptor = DigitalOceanDoksWorkerDescriptorSchema.safeParse(selected);
+        if (!descriptor.success || descriptor.data.id !== execution.worker) {
+            throw invalidWorkerPlan('Selected DOKS worker descriptor is invalid.', 'doks-worker-descriptor-invalid');
+        }
+        if (execution.environment !== undefined &&
+            descriptor.data.runtime.scope.qualifiers.environmentTier !== execution.environment) {
+            throw invalidWorkerPlan('DOKS worker descriptor does not match the requested environment.', 'doks-worker-environment-mismatch');
+        }
+        let authorizedPlan;
+        try {
+            authorizedPlan =
+                execution.operation === 'apply'
+                    ? planDigitalOceanDoksWorkerApply(descriptor.data)
+                    : planDigitalOceanDoksWorkerBuild(descriptor.data, execution.sourceRevision);
+            if (issuedLease) {
+                if (!allowCredentialLease) {
+                    throw invalidWorkerPlan('A DOKS worker execution cannot reuse a source credential lease.', 'doks-worker-plan-replay-refused');
+                }
+                authorizedPlan = bindDigitalOceanDoksWorkerCredentialLease(authorizedPlan, issuedLease.operationId);
+            }
+        }
+        catch (cause) {
+            if (cause instanceof CapabilityError)
+                throw cause;
+            throw invalidWorkerPlan('Selected DOKS worker descriptor cannot authorize this plan.', 'doks-worker-descriptor-invalid');
+        }
+        return authorizedPlan;
+    }
+    /**
+     * Recover the issued source lease only from the live, owned Job. The
+     * operation annotation and the Job's source Secret reference must agree;
+     * a plan regenerated from the descriptor alone is not cleanup authority.
+     */
+    recoverWorkerSourceLease(plan, input) {
+        const jobResult = KubernetesOwnedJobSchema.safeParse(input);
+        if (!jobResult.success) {
+            throw new CapabilityError('DOKS worker Job does not provide usable credential recovery evidence.', 'UNAVAILABLE', { reason: 'doks-worker-operation-evidence-unavailable', cause: jobResult.error });
+        }
+        if (plan.operation !== 'build')
+            return plan;
+        const sourceBinding = plan.credentialBindings?.find((binding) => binding.kind === 'source-lease');
+        const operationValue = jobResult.data.metadata?.annotations?.['vibes.dev/source-operation-id'];
+        const operationId = DigitalOceanDoksWorkerOperationIdSchema.safeParse(operationValue);
+        if (!sourceBinding || !operationId.success) {
+            throw new CapabilityError('DOKS worker Job does not identify its issued source lease.', 'UNAVAILABLE', { reason: 'doks-worker-operation-evidence-unavailable' });
+        }
+        const labels = jobResult.data.metadata?.labels ?? {};
+        const owned = labels['app.kubernetes.io/managed-by'] === plan.fieldManager &&
+            labels['app.kubernetes.io/name'] === plan.worker &&
+            labels['vibes.dev/source-sha'] === plan.sourceRevision;
+        if (!owned) {
+            throw new CapabilityError('DOKS worker Job does not match the selected worker descriptor.', 'UNAVAILABLE', { reason: 'doks-worker-job-ownership-unavailable' });
+        }
+        const recovered = bindDigitalOceanDoksWorkerCredentialLease(plan, operationId.data);
+        const lease = recovered.credentialLease;
+        const sourceReferences = jobResult.data.spec?.template?.spec?.containers?.flatMap((container) => (container.env ?? []).flatMap((environment) => {
+            const reference = environment.valueFrom?.secretKeyRef;
+            return reference?.key === sourceBinding.key && reference.name
+                ? [reference.name]
+                : [];
+        })) ?? [];
+        if (!lease || sourceReferences.length !== 1 || sourceReferences[0] !== lease.name) {
+            throw new CapabilityError('DOKS worker Job source reference does not match its issued lease.', 'UNAVAILABLE', { reason: 'doks-worker-operation-evidence-unavailable' });
+        }
+        return recovered;
+    }
+    async revokeWorkerSourceLease(plan) {
+        if (!plan.credentialLease)
+            return;
+        const owner = await this.workerCredentialDeliveryOwner();
+        await owner.revokeWorkerCredentials(plan.credentialLease);
+    }
+    async backupAuthorities(input) {
+        const keys = await this.backupAuthorityHandles(input);
+        return {
+            provider: 'digitalocean-spaces',
+            authorities: keys.map((key) => ({
+                name: key.name,
+                grants: key.grants,
+                createdAt: key.createdAt
+            }))
+        };
+    }
+    async backupAuthorityHandles(input) {
+        if (!this.spacesKeys)
+            throw new Error('DigitalOcean Spaces-key authority is not composed.');
+        const result = await settle(() => this.spacesKeys.list({ bucket: input.bucket }));
+        if (!result.ok)
+            throw this.backupAuthorityError(result.cause, input.requiredControlPlaneScopes);
+        const keys = result.value;
+        return keys
+            .filter((key) => key.name === input.namePrefix || key.name.startsWith(`${input.namePrefix}-`))
+            .map((key) => ({
+            name: key.name,
+            accessKeyId: key.access_key,
+            grants: key.grants,
+            createdAt: key.created_at
+        }));
+    }
+    async createBackupAuthorityKey(input) {
+        if (!this.spacesKeys)
+            throw new Error('DigitalOcean Spaces-key authority is not composed.');
+        const result = await settle(() => this.spacesKeys.create({ name: input.name, grants: input.grants }));
+        if (!result.ok)
+            throw this.backupAuthorityError(result.cause, input.requiredControlPlaneScopes);
+        const created = result.value;
+        return {
+            name: created.name,
+            accessKeyId: created.access_key,
+            secretAccessKey: created.secret_key,
+            grants: created.grants
+        };
+    }
+    async deleteBackupAuthorityKey(accessKeyId) {
+        if (!this.spacesKeys)
+            throw new Error('DigitalOcean Spaces-key authority is not composed.');
+        await this.spacesKeys.delete(accessKeyId);
+    }
+    backupAuthorityError(error, requiredScopes) {
+        if (error instanceof CapabilityError &&
+            error.reason === 'digitalocean-http-failed' &&
+            (error.details?.status === 401 ||
+                error.details?.status === 403 ||
+                error.details?.status === 404)) {
+            return new CapabilityError(`DigitalOcean Spaces-key authority is unavailable (HTTP ${error.details?.status}); ` +
+                `the endpoint may not be enabled or the operator credential may lack required scopes: ${requiredScopes.join(', ')}.`, 'UNAVAILABLE', { reason: 'digitalocean-backup-authority-unavailable', cause: error });
+        }
+        return error instanceof CapabilityError
+            ? error
+            : new CapabilityError('DigitalOcean backup authority failed', 'UNAVAILABLE', {
+                reason: 'digitalocean-backup-authority-failed',
+                cause: error
+            });
+    }
+    plan(descriptor, change) {
+        return planDigitalOceanKubernetesServiceRelease(descriptor, change);
+    }
+    async connect(plan) {
+        const cluster = plan.cluster.id
+            ? await this.kubernetes.getCluster(plan.cluster.id)
+            : await this.kubernetes.findClusterByName(plan.cluster.name);
+        if (!cluster)
+            throw new Error('Target DOKS cluster was not found.');
+        if (cluster.status.state !== 'running')
+            throw new Error(`Target DOKS cluster is not running (${cluster.status.state}).`);
+        const authority = parseKubeconfig(await this.kubernetes.fetchKubeconfig(cluster.id, { expirySeconds: 300 }));
+        const request = async (path, init, allowNotFound = false, allowConflict = false) => {
+            const headers = new Headers(init.headers);
+            if (authority.token)
+                headers.set('authorization', `Bearer ${authority.token}`);
+            const response = await kubernetesRequest(this.runtime, authority, `${authority.server}${path}`, {
+                ...init,
+                headers
+            }, this.fetchImpl);
+            if (allowNotFound && response.status === 404)
+                return null;
+            if (allowConflict && response.status === 409)
+                return response;
+            if (!response.ok) {
+                const method = init.method !== undefined && /^[A-Z]+$/.test(init.method) ? init.method : 'REQUEST';
+                const pathname = new URL(path, 'https://kubernetes.invalid').pathname;
+                const failure = await boundedKubernetesFailure(response);
+                throw new Error(`Kubernetes API request failed (${response.status}) for ${method} ${pathname};${failure.summary}; ` +
+                    'the response body was intentionally redacted.', { cause: failure.cause });
+            }
+            return response;
+        };
+        return { cluster: { id: cluster.id, name: cluster.name }, request };
+    }
+    async assertReadiness(plan, connection) {
+        const { request } = connection ?? (await this.connect(plan));
+        const missing = [];
+        if (plan.requiresCiliumNetworkPolicy) {
+            const capability = await request('/apis/apiextensions.k8s.io/v1/customresourcedefinitions/ciliumnetworkpolicies.cilium.io', { method: 'GET', headers: { accept: 'application/json' } }, true);
+            if (!capability)
+                missing.push('CiliumNetworkPolicy capability');
+        }
+        let snapshotClass;
+        if (plan.backup.mode === 'csi-volume-snapshot') {
+            const response = await request(`/apis/snapshot.storage.k8s.io/v1/volumesnapshotclasses/${encodeURIComponent(plan.backup.snapshotClassName)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+            if (!response) {
+                missing.push(`VolumeSnapshotClass ${plan.backup.snapshotClassName}`);
+            }
+            else {
+                const candidate = KubernetesSnapshotClassSchema.parse(await response.json());
+                if (candidate.driver !== 'dobs.csi.digitalocean.com') {
+                    missing.push(`VolumeSnapshotClass ${plan.backup.snapshotClassName} DigitalOcean CSI driver`);
+                }
+                else if (candidate.deletionPolicy !== plan.backup.deletionPolicy) {
+                    missing.push(`VolumeSnapshotClass ${plan.backup.snapshotClassName} deletionPolicy=${plan.backup.deletionPolicy}`);
+                }
+                else {
+                    snapshotClass = {
+                        name: plan.backup.snapshotClassName,
+                        driver: 'dobs.csi.digitalocean.com',
+                        deletionPolicy: 'Delete'
+                    };
+                }
+            }
+        }
+        let namespaceQuota;
+        if (plan.namespaceQuota) {
+            const declared = plan.namespaceQuota;
+            const response = await request(`/api/v1/namespaces/${encodeURIComponent(declared.namespace)}/resourcequotas/${encodeURIComponent(declared.name)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+            if (!response) {
+                missing.push(`ResourceQuota ${declared.namespace}/${declared.name}`);
+            }
+            else {
+                const current = KubernetesQuotaSpecSchema.parse(await response.json());
+                const hard = current.spec?.hard ?? {};
+                const exact = Object.keys(hard).length === Object.keys(declared.hard).length &&
+                    Object.entries(declared.hard).every(([key, value]) => hard[key] === value);
+                if (!exact) {
+                    missing.push(`ResourceQuota ${declared.namespace}/${declared.name} exact hard limits`);
+                }
+                else {
+                    namespaceQuota = { ...declared, hard: { ...declared.hard } };
+                }
+            }
+        }
+        let imageRegistry;
+        if (plan.imageRegistry) {
+            const declared = plan.imageRegistry;
+            const secret = await request(`/api/v1/namespaces/${encodeURIComponent(plan.hostKeyAuthority.secret.namespace)}/secrets/${encodeURIComponent(declared.pullSecretName)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+            const defaultServiceAccount = await request(`/api/v1/namespaces/${encodeURIComponent(plan.hostKeyAuthority.secret.namespace)}/serviceaccounts/default`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+            const secretBody = secret ? KubernetesSecretBodySchema.parse(await secret.json()) : undefined;
+            const accountBody = defaultServiceAccount
+                ? KubernetesAccountBodySchema.parse(await defaultServiceAccount.json())
+                : undefined;
+            const exact = secretBody?.type === 'kubernetes.io/dockerconfigjson' &&
+                '.dockerconfigjson' in (secretBody.data ?? {}) &&
+                (accountBody?.imagePullSecrets ?? []).some((entry) => entry.name === declared.pullSecretName);
+            if (!exact) {
+                missing.push(`DigitalOcean registry ${declared.name} pull authority in namespace ${plan.hostKeyAuthority.secret.namespace}`);
+            }
+            else {
+                imageRegistry = { ...declared };
+            }
+        }
+        for (const secret of plan.requiredSecrets) {
+            const response = await request(`/api/v1/namespaces/${encodeURIComponent(secret.namespace)}/secrets/${encodeURIComponent(secret.name)}`, {
+                method: 'GET',
+                headers: { accept: 'application/json' }
+            }, true);
+            if (!response) {
+                const certificate = plan.certificates.find((candidate) => candidate.namespace === secret.namespace && candidate.secretName === secret.name);
+                if (certificate) {
+                    const certificateResponse = await request(`/apis/cert-manager.io/v1/namespaces/${encodeURIComponent(certificate.namespace)}/certificates/${encodeURIComponent(certificate.name)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+                    if (certificateResponse) {
+                        const raw = KubernetesCertificateStatusSchema.parse(await certificateResponse.json());
+                        const conditions = boundedConditionSummary(raw.status?.conditions);
+                        const ready = raw.status?.conditions?.find((condition) => condition.type === 'Ready');
+                        const summary = conditions.length > 0 ? ` [${conditions.join(',')}]` : '';
+                        let state = ready?.status === 'True'
+                            ? 'claims Ready but its Secret is absent'
+                            : `is not Ready${summary}`;
+                        if (ready?.status !== 'True') {
+                            const requestsResponse = await request(`/apis/cert-manager.io/v1/namespaces/${encodeURIComponent(certificate.namespace)}/certificaterequests`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+                            if (requestsResponse) {
+                                const body = KubernetesCertificateRequestsSchema.parse(await requestsResponse.json());
+                                const owned = (body.items ?? [])
+                                    .filter((item) => item.metadata?.ownerReferences?.some((owner) => owner.kind === 'Certificate' && owner.name === certificate.name))
+                                    .sort((left, right) => String(right.metadata?.creationTimestamp).localeCompare(String(left.metadata?.creationTimestamp)));
+                                const latest = owned[0];
+                                if (!latest) {
+                                    state += '; no owned CertificateRequest exists';
+                                }
+                                else {
+                                    const requestName = latest.metadata?.name !== undefined &&
+                                        /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/.test(latest.metadata.name)
+                                        ? latest.metadata.name
+                                        : 'owned';
+                                    const requestConditions = boundedConditionSummary(latest.status?.conditions);
+                                    const requestSummary = requestConditions.length > 0 ? ` [${requestConditions.join(',')}]` : '';
+                                    state += `; CertificateRequest ${requestName}${requestSummary}`;
+                                    if (latest.metadata?.name !== undefined) {
+                                        const ordersResponse = await request(`/apis/acme.cert-manager.io/v1/namespaces/${encodeURIComponent(certificate.namespace)}/orders`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+                                        if (ordersResponse) {
+                                            const ordersBody = KubernetesOrdersBodySchema.parse(await ordersResponse.json());
+                                            const orders = (ordersBody.items ?? [])
+                                                .filter((item) => item.metadata?.ownerReferences?.some((owner) => owner.kind === 'CertificateRequest' &&
+                                                owner.name === latest.metadata?.name))
+                                                .sort((left, right) => String(right.metadata?.creationTimestamp).localeCompare(String(left.metadata?.creationTimestamp)));
+                                            const order = orders[0];
+                                            if (!order) {
+                                                state += '; no owned ACME Order exists';
+                                            }
+                                            else {
+                                                const orderName = boundedStatusToken(order.metadata?.name, 'owned');
+                                                const orderState = boundedStatusToken(order.status?.state, 'unknown');
+                                                const orderReason = boundedStatusToken(order.status?.reason, '');
+                                                state += `; Order ${orderName} state=${orderState}${orderReason ? ` reason=${orderReason}` : ''}`;
+                                                if (order.metadata?.name !== undefined) {
+                                                    const challengesResponse = await request(`/apis/acme.cert-manager.io/v1/namespaces/${encodeURIComponent(certificate.namespace)}/challenges`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+                                                    if (challengesResponse) {
+                                                        const challengesBody = KubernetesChallengesBodySchema.parse(await challengesResponse.json());
+                                                        const challenges = (challengesBody.items ?? []).filter((item) => item.metadata?.ownerReferences?.some((owner) => owner.kind === 'Order' && owner.name === order.metadata?.name));
+                                                        if (challenges.length === 0) {
+                                                            state += '; no owned ACME Challenge exists';
+                                                        }
+                                                        else {
+                                                            const summaries = challenges.slice(0, 8).map((challenge) => {
+                                                                const name = boundedStatusToken(challenge.metadata?.name, 'owned');
+                                                                const challengeState = boundedStatusToken(challenge.status?.state, 'unknown');
+                                                                const reason = boundedStatusToken(challenge.status?.reason, '');
+                                                                return `${name}:${challengeState}${reason ? `/${reason}` : ''}:presented=${challenge.status?.presented === true}:processing=${challenge.status?.processing === true}`;
+                                                            });
+                                                            state += `; Challenges [${summaries.join(',')}]`;
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        missing.push(`Secret ${secret.namespace}/${secret.name} (Certificate ${certificate.name} ${state})`);
+                        continue;
+                    }
+                }
+                missing.push(`Secret ${secret.namespace}/${secret.name}`);
+                continue;
+            }
+            const raw = KubernetesDataSchema.parse(await response.json());
+            const present = new Set(Object.keys(raw.data ?? {}));
+            const missingKeys = secret.keys.filter((key) => !present.has(key));
+            if (missingKeys.length > 0) {
+                missing.push(`Secret ${secret.namespace}/${secret.name} keys [${missingKeys.join(', ')}]`);
+            }
+        }
+        let repositoryMigration;
+        if (plan.repositoryMigration) {
+            const migration = plan.repositoryMigration;
+            const response = await request(`/api/v1/namespaces/${encodeURIComponent(migration.receipt.namespace)}/configmaps/${encodeURIComponent(migration.receipt.name)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+            if (!response) {
+                missing.push(`repository migration receipt ConfigMap ${migration.receipt.namespace}/${migration.receipt.name}`);
+            }
+            else {
+                const raw = KubernetesDataSchema.parse(await response.json());
+                const data = raw.data ?? {};
+                // The receipt proves the one-time migration ran to parity. The
+                // schema IS the parity contract — literals pin every identity
+                // field to the descriptor, so a divergence fails validation and
+                // the plan error NAMES the diverging field (the old boolean chain
+                // reported only "exact parity", which hid three different
+                // mismatches behind one opaque message on 2026-08-18).
+                // `release-revision` records the revision that RAN the migration —
+                // history, deliberately NOT pinned to the descriptor's current
+                // revision: pinning it froze the release at the migration revision
+                // and failed every subsequent image update.
+                const receiptSchema = z.object({
+                    'migration-id': z.literal(migration.migrationId),
+                    'source-origin': z.literal(migration.sourceOrigin),
+                    'release-revision': z.string().min(1),
+                    'repository-count': z.literal(String(migration.expectedRepositoryCount)),
+                    'stable-passes': z.literal(String(migration.stablePasses)),
+                    'rollback-fence': z.literal(migration.rollback),
+                    'inventory-digest': z.string().regex(/^[a-f0-9]{64}$/),
+                    'parity-digest': z.string().regex(/^[a-f0-9]{64}$/)
+                });
+                const receipt = receiptSchema.safeParse(data);
+                if (!receipt.success) {
+                    const divergence = receipt.error.issues
+                        .map((issue) => `${issue.path.join('.')} ${issue.message}`)
+                        .join('; ');
+                    missing.push(`repository migration receipt ${migration.receipt.namespace}/${migration.receipt.name} parity: ${divergence}`);
+                }
+                else {
+                    repositoryMigration = {
+                        migrationId: migration.migrationId,
+                        repositoryCount: migration.expectedRepositoryCount,
+                        inventoryDigest: receipt.data['inventory-digest'],
+                        parityDigest: receipt.data['parity-digest'],
+                        stablePasses: 2,
+                        rollback: migration.rollback
+                    };
+                }
+            }
+        }
+        if (missing.length > 0) {
+            throw new Error(`Service release prerequisites are not ready: ${missing.join('; ')}.`);
+        }
+        return {
+            cluster: 'running',
+            secrets: plan.requiredSecrets,
+            imageRegistry: imageRegistry ? imageRegistry : undefined,
+            namespaceQuota: namespaceQuota ? namespaceQuota : undefined,
+            snapshotClass: snapshotClass ? snapshotClass : undefined,
+            repositoryMigration: repositoryMigration ? repositoryMigration : undefined
+        };
+    }
+    async readiness(descriptor, change) {
+        const plan = this.plan(descriptor, change);
+        plan.readiness = await this.assertReadiness(plan);
+        return plan;
+    }
+    async certificateAuthorities(target) {
+        const parsed = DigitalOceanKubernetesServiceReleaseTargetSchema.parse(target);
+        const { cluster, request } = await this.connect({ cluster: parsed.cluster });
+        const response = await request('/apis/cert-manager.io/v1/clusterissuers', {
+            method: 'GET',
+            headers: { accept: 'application/json' }
+        }, true);
+        if (!response)
+            return { provider: 'digitalocean-kubernetes', cluster, authorities: [] };
+        const body = KubernetesIssuersSchema.parse(await response.json());
+        const authorities = (body.items ?? []).flatMap((item) => {
+            if (item.metadata?.name === undefined)
+                return [];
+            const solverTypes = [
+                ...new Set((item.spec?.acme?.solvers ?? []).flatMap((solver) => {
+                    const types = [];
+                    if (solver.http01)
+                        types.push('http01');
+                    if (solver.dns01) {
+                        for (const [provider, config] of Object.entries(solver.dns01)) {
+                            if (!/^[A-Za-z][A-Za-z0-9_.-]{0,31}$/.test(provider))
+                                continue;
+                            if (provider === 'webhook' &&
+                                KubernetesSolverNameSchema.safeParse(config).success) {
+                                const solverName = boundedStatusToken(KubernetesSolverNameSchema.parse(config).solverName, 'unknown');
+                                types.push(`dns01/webhook/${solverName}`);
+                            }
+                            else {
+                                types.push(`dns01/${provider}`);
+                            }
+                        }
+                    }
+                    return types;
+                }))
+            ].sort();
+            const acmeServerValue = item.spec?.acme?.server;
+            const acmeServer = acmeServerValue &&
+                URL.canParse(acmeServerValue) &&
+                new URL(acmeServerValue).protocol === 'https:' &&
+                !new URL(acmeServerValue).username &&
+                !new URL(acmeServerValue).password
+                ? new URL(acmeServerValue).toString()
+                : undefined;
+            const contactEmail = item.spec?.acme?.email !== undefined &&
+                /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(item.spec.acme.email)
+                ? item.spec.acme.email
+                : undefined;
+            return [
+                {
+                    name: item.metadata.name,
+                    kind: 'ClusterIssuer',
+                    ready: item.status?.conditions?.some((condition) => condition.type === 'Ready' && condition.status === 'True') ?? false,
+                    solverTypes,
+                    acmeServer: acmeServer ? acmeServer : undefined,
+                    contactEmail: contactEmail ? contactEmail : undefined
+                }
+            ];
+        });
+        return { provider: 'digitalocean-kubernetes', cluster, authorities };
+    }
+    async clusterCapabilities(target) {
+        const parsed = DigitalOceanKubernetesServiceReleaseTargetSchema.parse(target);
+        const { cluster, request } = await this.connect({ cluster: parsed.cluster });
+        const ciliumNetworkPolicy = await request('/apis/apiextensions.k8s.io/v1/customresourcedefinitions/ciliumnetworkpolicies.cilium.io', { method: 'GET', headers: { accept: 'application/json' } }, true);
+        const snapshotClassesResponse = await request('/apis/snapshot.storage.k8s.io/v1/volumesnapshotclasses', { method: 'GET', headers: { accept: 'application/json' } }, true);
+        const snapshotBody = snapshotClassesResponse
+            ? KubernetesSnapshotBodySchema.parse(await snapshotClassesResponse.json())
+            : undefined;
+        const classes = (snapshotBody?.items ?? []).flatMap((item) => {
+            if (item.metadata?.name === undefined ||
+                item.driver === undefined ||
+                item.deletionPolicy === undefined)
+                return [];
+            const annotations = item.metadata.annotations ?? {};
+            return [
+                {
+                    name: item.metadata.name,
+                    driver: item.driver,
+                    deletionPolicy: item.deletionPolicy,
+                    isDefault: annotations['snapshot.storage.kubernetes.io/is-default-class'] === 'true' ||
+                        annotations['snapshot.storage.k8s.io/is-default-class'] === 'true'
+                }
+            ];
+        });
+        return {
+            provider: 'digitalocean-kubernetes',
+            cluster,
+            ciliumNetworkPolicy: Boolean(ciliumNetworkPolicy),
+            volumeSnapshots: { apiAvailable: Boolean(snapshotClassesResponse), classes }
+        };
+    }
+    async provisionSecrets(descriptor, change, material) {
+        const parsed = ServiceReleaseDescriptorSchema.parse(descriptor);
+        const plan = this.plan(parsed, change);
+        const expected = new Set(parsed.secretBindings.map((binding) => `${binding.target.name}/${binding.target.key}`));
+        const supplied = new Map();
+        for (const entry of material) {
+            const key = `${entry.target.name}/${entry.target.key}`;
+            if (!expected.has(key))
+                throw new Error(`Refusing undeclared service-release secret material for ${key}.`);
+            if (supplied.has(key))
+                throw new Error(`Duplicate service-release secret material for ${key}.`);
+            if (!entry.value)
+                throw new Error(`Service-release secret material for ${key} is empty.`);
+            supplied.set(key, entry.value);
+        }
+        const missing = [...expected].filter((key) => !supplied.has(key));
+        if (missing.length > 0)
+            throw new Error(`Missing service-release secret material for ${missing.join(', ')}.`);
+        const { cluster, request } = await this.connect(plan);
+        const provisionable = requiredSecrets({
+            ...parsed,
+            config: { ...parsed.config, certificate: undefined }
+        });
+        for (const secret of provisionable) {
+            const data = Object.fromEntries(secret.keys.map((key) => [
+                key,
+                encodeBase64Text(supplied.get(`${secret.name}/${key}`))
+            ]));
+            const query = new URLSearchParams({ fieldManager: SECRET_FIELD_MANAGER, force: 'false' });
+            await request(`/api/v1/namespaces/${encodeURIComponent(secret.namespace)}/secrets/${encodeURIComponent(secret.name)}?${query}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+                body: JSON.stringify({
+                    apiVersion: 'v1',
+                    kind: 'Secret',
+                    metadata: { name: secret.name, namespace: secret.namespace },
+                    type: secret.name === parsed.controlPlaneRouter.tlsSecretRef.name
+                        ? 'kubernetes.io/tls'
+                        : 'Opaque',
+                    data
+                })
+            });
+        }
+        return { provider: 'digitalocean-kubernetes', cluster, secrets: provisionable };
+    }
+    async provisionImageRegistry(descriptor, change) {
+        const plan = this.plan(descriptor, change);
+        const registry = plan.imageRegistry;
+        if (!registry)
+            throw new Error('Service release does not declare a DigitalOcean image registry.');
+        const target = plan.cluster.id
+            ? await this.kubernetes.getCluster(plan.cluster.id)
+            : await this.kubernetes.findClusterByName(plan.cluster.name);
+        if (!target)
+            throw new Error('Target DOKS cluster was not found.');
+        if (target.status.state !== 'running') {
+            throw new Error(`Target DOKS cluster is not running (${target.status.state}).`);
+        }
+        await this.kubernetes.addRegistries([target.id], [registry.name]);
+        const { cluster, request } = await this.connect(plan);
+        const namespace = plan.hostKeyAuthority.secret.namespace;
+        for (let attempt = 0; attempt < 30; attempt += 1) {
+            const secret = await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/secrets/${encodeURIComponent(registry.pullSecretName)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+            const account = await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/serviceaccounts/default`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+            const secretBody = secret ? KubernetesSecretBodySchema.parse(await secret.json()) : undefined;
+            const accountBody = account
+                ? KubernetesAccountBodySchema.parse(await account.json())
+                : undefined;
+            if (secretBody?.type === 'kubernetes.io/dockerconfigjson' &&
+                '.dockerconfigjson' in (secretBody.data ?? {}) &&
+                (accountBody?.imagePullSecrets ?? []).some((entry) => entry.name === registry.pullSecretName)) {
+                return {
+                    provider: 'digitalocean-kubernetes',
+                    cluster,
+                    registry: {
+                        provider: registry.provider,
+                        name: registry.name,
+                        pullSecret: {
+                            namespace,
+                            name: registry.pullSecretName,
+                            type: 'kubernetes.io/dockerconfigjson'
+                        }
+                    }
+                };
+            }
+            await this.runtime.lifecycle.delay(1_000);
+        }
+        throw new Error(`DigitalOcean registry ${registry.name} did not propagate its cluster-managed pull authority into namespace ${namespace}.`);
+    }
+    async provisionCertificateAuthority(descriptor, change, material) {
+        const parsed = ServiceReleaseDescriptorSchema.parse(descriptor);
+        const certificate = parsed.config.certificate;
+        const provisioning = certificate?.provisioning;
+        if (!certificate || certificate.issuerRef.kind !== 'Issuer' || !provisioning) {
+            throw new Error('Service release does not declare a provisionable namespace certificate authority.');
+        }
+        if (!provisioning.solver.apiToken.sourceKeys.includes(material.sourceKey)) {
+            throw new Error(`Refusing undeclared certificate-authority source key ${material.sourceKey}.`);
+        }
+        if (!material.value)
+            throw new Error('Certificate-authority token material is empty.');
+        const plan = this.plan(parsed, change);
+        const { cluster, request } = await this.connect(plan);
+        const namespace = parsed.namespace;
+        const existingNamespace = await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+        if (!existingNamespace) {
+            const namespaceQuery = new URLSearchParams({
+                fieldManager: CERTIFICATE_FIELD_MANAGER,
+                force: 'false'
+            });
+            await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}?${namespaceQuery}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+                body: JSON.stringify({ apiVersion: 'v1', kind: 'Namespace', metadata: { name: namespace } })
+            });
+        }
+        const tokenTarget = provisioning.solver.apiToken.target;
+        const secretQuery = new URLSearchParams({ fieldManager: SECRET_FIELD_MANAGER, force: 'false' });
+        await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/secrets/${encodeURIComponent(tokenTarget.name)}?${secretQuery}`, {
+            method: 'PATCH',
+            headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+            body: JSON.stringify({
+                apiVersion: 'v1',
+                kind: 'Secret',
+                metadata: { name: tokenTarget.name, namespace },
+                type: 'Opaque',
+                data: { [tokenTarget.key]: encodeBase64Text(material.value) }
+            })
+        });
+        const issuerQuery = new URLSearchParams({
+            fieldManager: CERTIFICATE_FIELD_MANAGER,
+            force: 'false'
+        });
+        await request(`/apis/cert-manager.io/v1/namespaces/${encodeURIComponent(namespace)}/issuers/${encodeURIComponent(certificate.issuerRef.name)}?${issuerQuery}`, {
+            method: 'PATCH',
+            headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+            body: JSON.stringify({
+                apiVersion: 'cert-manager.io/v1',
+                kind: 'Issuer',
+                metadata: { name: certificate.issuerRef.name, namespace },
+                spec: {
+                    acme: {
+                        server: provisioning.server,
+                        email: provisioning.email,
+                        privateKeySecretRef: provisioning.privateKeySecretRef,
+                        solvers: [
+                            {
+                                selector: { dnsZones: provisioning.solver.dnsZones },
+                                dns01: {
+                                    cloudflare: {
+                                        apiTokenSecretRef: { name: tokenTarget.name, key: tokenTarget.key }
+                                    }
+                                }
+                            }
+                        ]
+                    }
+                }
+            })
+        });
+        return {
+            provider: 'digitalocean-kubernetes',
+            cluster,
+            authority: {
+                namespace,
+                name: certificate.issuerRef.name,
+                kind: 'Issuer',
+                solver: 'dns01/cloudflare',
+                dnsZones: [...provisioning.solver.dnsZones],
+                secret: { name: tokenTarget.name, keys: [tokenTarget.key] },
+                sourceKey: material.sourceKey
+            }
+        };
+    }
+    async provisionCertificates(descriptor, change) {
+        const plan = this.plan(descriptor, change);
+        if (plan.certificates.length === 0) {
+            throw new Error('Service release does not declare a managed certificate.');
+        }
+        const { cluster, request } = await this.connect(plan);
+        for (const certificate of plan.certificates) {
+            const issuerPath = certificate.issuerRef.kind === 'ClusterIssuer'
+                ? `/apis/cert-manager.io/v1/clusterissuers/${encodeURIComponent(certificate.issuerRef.name)}`
+                : `/apis/cert-manager.io/v1/namespaces/${encodeURIComponent(certificate.namespace)}/issuers/${encodeURIComponent(certificate.issuerRef.name)}`;
+            const issuer = await request(issuerPath, { method: 'GET', headers: { accept: 'application/json' } }, true);
+            if (!issuer)
+                throw new Error(`Declared ${certificate.issuerRef.kind} ${certificate.issuerRef.name} was not found.`);
+            const status = KubernetesIssuerStatusSchema.parse(await issuer.json());
+            const ready = status.status?.conditions?.some((condition) => condition.type === 'Ready' && condition.status === 'True') ?? false;
+            if (!ready)
+                throw new Error(`Declared ${certificate.issuerRef.kind} ${certificate.issuerRef.name} is not Ready.`);
+        }
+        const namespace = plan.certificates[0].namespace;
+        const existingNamespace = await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+        if (!existingNamespace) {
+            const namespaceQuery = new URLSearchParams({
+                fieldManager: CERTIFICATE_FIELD_MANAGER,
+                force: 'false'
+            });
+            await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}?${namespaceQuery}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+                body: JSON.stringify({
+                    apiVersion: 'v1',
+                    kind: 'Namespace',
+                    metadata: { name: namespace }
+                })
+            });
+        }
+        for (const certificate of plan.certificates) {
+            const query = new URLSearchParams({
+                fieldManager: CERTIFICATE_FIELD_MANAGER,
+                force: 'false'
+            });
+            await request(`/apis/cert-manager.io/v1/namespaces/${encodeURIComponent(certificate.namespace)}/certificates/${encodeURIComponent(certificate.name)}?${query}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+                body: JSON.stringify({
+                    apiVersion: 'cert-manager.io/v1',
+                    kind: 'Certificate',
+                    metadata: { name: certificate.name, namespace: certificate.namespace },
+                    spec: {
+                        secretName: certificate.secretName,
+                        dnsNames: certificate.dnsNames,
+                        duration: certificate.duration,
+                        renewBefore: certificate.renewBefore,
+                        privateKey: certificate.privateKey,
+                        issuerRef: certificate.issuerRef
+                    }
+                })
+            });
+        }
+        return {
+            provider: 'digitalocean-kubernetes',
+            cluster,
+            certificates: plan.certificates.map(({ namespace: certNamespace, name, secretName, dnsNames }) => ({
+                namespace: certNamespace,
+                name,
+                secretName,
+                dnsNames
+            }))
+        };
+    }
+    async provisionRepositoryMigration(descriptor, change) {
+        const plan = this.plan(descriptor, change);
+        const migration = plan.repositoryMigration;
+        if (!migration) {
+            throw new Error('Service release does not declare a repository migration.');
+        }
+        const { cluster, request } = await this.connect(plan);
+        const secret = await request(`/api/v1/namespaces/${encodeURIComponent(migration.inventoryAuthoritySecret.namespace)}/secrets/${encodeURIComponent(migration.inventoryAuthoritySecret.name)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+        if (!secret) {
+            throw new Error(`Repository migration authority Secret ${migration.inventoryAuthoritySecret.namespace}/${migration.inventoryAuthoritySecret.name} is not ready.`);
+        }
+        const secretBody = KubernetesDataSchema.parse(await secret.json());
+        if (!(migration.inventoryAuthoritySecret.key in (secretBody.data ?? {}))) {
+            throw new Error(`Repository migration authority Secret ${migration.inventoryAuthoritySecret.namespace}/${migration.inventoryAuthoritySecret.name} is missing key ${migration.inventoryAuthoritySecret.key}.`);
+        }
+        const cilium = await request('/apis/apiextensions.k8s.io/v1/customresourcedefinitions/ciliumnetworkpolicies.cilium.io', { method: 'GET', headers: { accept: 'application/json' } }, true);
+        if (!cilium)
+            throw new Error('Repository migration requires CiliumNetworkPolicy capability.');
+        const namespace = migration.receipt.namespace;
+        const jobName = cappedId('gitd-migration', migration.migrationId);
+        const serviceAccountName = cappedId('gitd-migration', 'runner');
+        const labels = {
+            'app.kubernetes.io/name': jobName,
+            'app.kubernetes.io/component': 'repository-migration',
+            'app.kubernetes.io/managed-by': MIGRATION_FIELD_MANAGER,
+            'vibes.dev/migration-id': migration.migrationId,
+            'vibes.dev/egress-profile': 'repository-migration',
+            'vibes.dev/release-revision': migration.releaseRevision
+        };
+        const namespaceResource = plan.resources.find((item) => item.kind === 'Namespace' && item.name === namespace);
+        const pvcResource = plan.resources.find((item) => item.kind === 'PersistentVolumeClaim' &&
+            item.namespace === namespace &&
+            item.name === migration.destination.pvcName);
+        if (!namespaceResource || !pvcResource) {
+            throw new Error('Repository migration destination Namespace/PVC projection is unavailable.');
+        }
+        const platformHostname = new URL(migration.inventoryUrl).hostname;
+        const sourceHostname = new URL(migration.sourceOrigin).hostname;
+        const quotaResource = plan.namespaceQuota
+            ? resource({
+                apiVersion: 'v1',
+                kind: 'ResourceQuota',
+                metadata: {
+                    name: plan.namespaceQuota.name,
+                    namespace,
+                    labels: { 'app.kubernetes.io/managed-by': MIGRATION_FIELD_MANAGER }
+                },
+                spec: { hard: { ...plan.namespaceQuota.hard } }
+            }, namespace)
+            : undefined;
+        const prerequisites = [
+            namespaceResource,
+            ...(quotaResource ? [quotaResource] : []),
+            pvcResource,
+            resource({
+                apiVersion: 'v1',
+                kind: 'ConfigMap',
+                metadata: { name: migration.receipt.name, namespace, labels }
+            }, namespace),
+            resource({
+                apiVersion: 'v1',
+                kind: 'ServiceAccount',
+                metadata: { name: serviceAccountName, namespace, labels },
+                automountServiceAccountToken: true,
+                imagePullSecrets: plan.imageRegistry ? [{ name: plan.imageRegistry.pullSecretName }] : []
+            }, namespace),
+            resource({
+                apiVersion: 'rbac.authorization.k8s.io/v1',
+                kind: 'Role',
+                metadata: { name: serviceAccountName, namespace, labels },
+                rules: [
+                    {
+                        apiGroups: [''],
+                        resources: ['configmaps'],
+                        resourceNames: [migration.receipt.name],
+                        verbs: ['get', 'patch', 'update']
+                    }
+                ]
+            }, namespace),
+            resource({
+                apiVersion: 'rbac.authorization.k8s.io/v1',
+                kind: 'RoleBinding',
+                metadata: { name: serviceAccountName, namespace, labels },
+                roleRef: {
+                    apiGroup: 'rbac.authorization.k8s.io',
+                    kind: 'Role',
+                    name: serviceAccountName
+                },
+                subjects: [{ kind: 'ServiceAccount', name: serviceAccountName, namespace }]
+            }, namespace),
+            resource({
+                apiVersion: 'cilium.io/v2',
+                kind: 'CiliumNetworkPolicy',
+                metadata: { name: cappedId('gitd-migration', 'egress'), namespace, labels },
+                spec: {
+                    endpointSelector: {
+                        matchLabels: { 'vibes.dev/egress-profile': 'repository-migration' }
+                    },
+                    egress: [
+                        {
+                            toEndpoints: [
+                                {
+                                    matchLabels: {
+                                        'k8s:io.kubernetes.pod.namespace': 'kube-system',
+                                        'k8s:k8s-app': 'kube-dns'
+                                    }
+                                }
+                            ],
+                            toPorts: [
+                                {
+                                    ports: [
+                                        { port: '53', protocol: 'UDP' },
+                                        { port: '53', protocol: 'TCP' }
+                                    ]
+                                }
+                            ]
+                        },
+                        {
+                            toFQDNs: [{ matchName: sourceHostname }],
+                            toPorts: [{ ports: [{ port: '22', protocol: 'TCP' }] }]
+                        },
+                        {
+                            toFQDNs: [{ matchName: platformHostname }],
+                            toPorts: [{ ports: [{ port: '443', protocol: 'TCP' }] }]
+                        },
+                        {
+                            toEntities: ['kube-apiserver'],
+                            toPorts: [{ ports: [{ port: '443', protocol: 'TCP' }] }]
+                        }
+                    ]
+                }
+            }, namespace)
+        ];
+        for (const item of prerequisites) {
+            const query = new URLSearchParams({ fieldManager: MIGRATION_FIELD_MANAGER, force: 'false' });
+            if (item.kind === 'ResourceQuota') {
+                const path = resourcePath(item);
+                const existing = await request(path, { method: 'GET', headers: { accept: 'application/json' } }, true);
+                if (!existing) {
+                    const collectionPath = path.slice(0, path.lastIndexOf('/'));
+                    await request(`${collectionPath}?${new URLSearchParams({ fieldManager: MIGRATION_FIELD_MANAGER })}`, {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json', accept: 'application/json' },
+                        body: JSON.stringify(item.manifest)
+                    });
+                    continue;
+                }
+                const current = KubernetesQuotaVersionSchema.parse(await existing.json());
+                const desired = KubernetesDeclaredQuotaSchema.parse(item.manifest);
+                const hard = current.spec?.hard ?? {};
+                const desiredKeys = Object.keys(desired.spec.hard);
+                const nonStorageExact = Object.keys(hard).length === desiredKeys.length &&
+                    desiredKeys
+                        .filter((key) => key !== 'requests.storage')
+                        .every((key) => hard[key] === desired.spec.hard[key]);
+                if (!nonStorageExact) {
+                    throw new Error(`Existing ResourceQuota ${item.namespace}/${item.name} has non-storage hard limits that differ from the source-owned declaration.`);
+                }
+                if (hard['requests.storage'] === desired.spec.hard['requests.storage'])
+                    continue;
+                if (current.metadata?.resourceVersion === undefined || !current.metadata.resourceVersion) {
+                    throw new Error(`Existing ResourceQuota ${item.namespace}/${item.name} has no resourceVersion for compare-and-set.`);
+                }
+                await request(`${path}?${new URLSearchParams({ fieldManager: MIGRATION_FIELD_MANAGER })}`, {
+                    method: 'PUT',
+                    headers: { 'content-type': 'application/json', accept: 'application/json' },
+                    body: JSON.stringify({
+                        ...desired,
+                        metadata: { ...desired.metadata, resourceVersion: current.metadata.resourceVersion }
+                    })
+                });
+                continue;
+            }
+            if (item.kind === 'PersistentVolumeClaim') {
+                const path = resourcePath(item);
+                const existing = await request(path, { method: 'GET', headers: { accept: 'application/json' } }, true);
+                if (existing) {
+                    const current = KubernetesExistingPvcSchema.parse(await existing.json());
+                    const desired = KubernetesDeclaredPvcSchema.parse(item.manifest);
+                    const accessModes = current.spec?.accessModes ?? [];
+                    const exact = accessModes.length === desired.spec.accessModes.length &&
+                        desired.spec.accessModes.every((mode) => accessModes.includes(mode)) &&
+                        current.spec?.storageClassName === desired.spec.storageClassName &&
+                        current.spec?.resources?.requests?.storage ===
+                            desired.spec.resources.requests.storage &&
+                        current.metadata?.annotations?.['vibes.dev/storage-schema-version'] ===
+                            desired.metadata.annotations?.['vibes.dev/storage-schema-version'];
+                    if (!exact) {
+                        throw new Error(`Existing repository migration destination PVC ${item.namespace}/${item.name} does not match the declared storage contract.`);
+                    }
+                    continue;
+                }
+                const accessReview = await request('/apis/authorization.k8s.io/v1/selfsubjectaccessreviews', {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json', accept: 'application/json' },
+                    body: JSON.stringify({
+                        apiVersion: 'authorization.k8s.io/v1',
+                        kind: 'SelfSubjectAccessReview',
+                        spec: {
+                            resourceAttributes: {
+                                namespace: item.namespace,
+                                verb: 'create',
+                                group: '',
+                                resource: 'persistentvolumeclaims'
+                            }
+                        }
+                    })
+                });
+                const access = KubernetesAccessSchema.parse(await accessReview.json());
+                if (access.status?.allowed !== true || access.status?.denied === true) {
+                    throw new Error(`DOKS Kubernetes authority is not allowed to create PersistentVolumeClaims in namespace ${item.namespace}.`);
+                }
+                const quotasResponse = await request(`/api/v1/namespaces/${encodeURIComponent(item.namespace)}/resourcequotas`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+                const quotasBody = quotasResponse
+                    ? KubernetesQuotasBodySchema.parse(await quotasResponse.json())
+                    : undefined;
+                const quotaSummary = (quotasBody?.items ?? [])
+                    .flatMap((quota) => {
+                    const quotaName = boundedStatusToken(quota.metadata?.name, '');
+                    if (!quotaName)
+                        return [];
+                    const values = (section) => Object.entries(section ?? {})
+                        .flatMap(([key, value]) => /^[A-Za-z0-9./_-]{1,64}$/.test(key) &&
+                        z.string().safeParse(value).success &&
+                        /^[0-9]+(?:\.[0-9]+)?(?:[EPTGMK]i?|m)?$/.test(String(value))
+                        ? [`${key}=${value}`]
+                        : [])
+                        .sort()
+                        .slice(0, 24)
+                        .join(',');
+                    return [
+                        `${quotaName} hard[${values(quota.status?.hard)}] used[${values(quota.status?.used)}]`
+                    ];
+                })
+                    .slice(0, 8);
+                const collectionPath = path.slice(0, path.lastIndexOf('/'));
+                try {
+                    await request(`${collectionPath}?${query}`, {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json', accept: 'application/json' },
+                        body: JSON.stringify(item.manifest)
+                    });
+                }
+                catch (error) {
+                    throw new Error(`${error instanceof Error ? error.message : String(error)}` +
+                        `${quotaSummary.length > 0 ? ` Namespace quota inventory: ${quotaSummary.join('; ')}.` : ''}`, { cause: error });
+                }
+                continue;
+            }
+            await request(`${resourcePath(item)}?${query}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+                body: JSON.stringify(item.manifest)
+            });
+        }
+        // The destination PVC is ReadWriteOnce: node-scoped attachment. When the
+        // stateful pod is running it holds the volume on its node, and a job pod
+        // scheduled anywhere else dies in Multi-Attach (observed generation-2,
+        // 2026-08-18). Co-schedule beside a running stateful pod; when none is
+        // running (generation-1 ran before the stateful service existed) the
+        // volume is unattached and required affinity would deadlock scheduling,
+        // so omit it.
+        const statefulPodsResponse = await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/pods?labelSelector=${encodeURIComponent(`app.kubernetes.io/name=${migration.statefulName},app.kubernetes.io/component=stateful`)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+        const statefulPods = statefulPodsResponse
+            ? (KubernetesStatefulPodsSchema.parse(await statefulPodsResponse.json()).items ?? [])
+            : [];
+        const statefulRunning = statefulPods.some((pod) => pod.status?.phase === 'Running' || pod.status?.phase === 'Pending');
+        const migrationAffinity = statefulRunning
+            ? {
+                affinity: {
+                    podAffinity: {
+                        requiredDuringSchedulingIgnoredDuringExecution: [
+                            {
+                                labelSelector: {
+                                    matchLabels: {
+                                        'app.kubernetes.io/name': migration.statefulName,
+                                        'app.kubernetes.io/component': 'stateful'
+                                    }
+                                },
+                                topologyKey: 'kubernetes.io/hostname'
+                            }
+                        ]
+                    }
+                }
+            }
+            : {};
+        const jobPath = `/apis/batch/v1/namespaces/${encodeURIComponent(namespace)}/jobs/${encodeURIComponent(jobName)}`;
+        let jobResponse = await request(jobPath, { method: 'GET', headers: { accept: 'application/json' } }, true);
+        if (!jobResponse) {
+            const job = resource({
+                apiVersion: 'batch/v1',
+                kind: 'Job',
+                metadata: { name: jobName, namespace, labels },
+                spec: {
+                    activeDeadlineSeconds: 21_600,
+                    backoffLimit: 0,
+                    template: {
+                        metadata: { labels },
+                        spec: {
+                            serviceAccountName,
+                            restartPolicy: 'Never',
+                            ...migrationAffinity,
+                            securityContext: {
+                                runAsNonRoot: true,
+                                runAsUser: 65532,
+                                runAsGroup: 65532,
+                                fsGroup: 65532,
+                                fsGroupChangePolicy: 'OnRootMismatch',
+                                seccompProfile: { type: 'RuntimeDefault' }
+                            },
+                            containers: [
+                                {
+                                    name: 'repository-migration',
+                                    image: migration.image,
+                                    imagePullPolicy: 'IfNotPresent',
+                                    command: ['bun', '/app/migrate.js'],
+                                    env: [
+                                        { name: 'MIGRATION_ID', value: migration.migrationId },
+                                        { name: 'SOURCE_ORIGIN', value: migration.sourceOrigin },
+                                        { name: 'PLATFORM_INVENTORY_URL', value: migration.inventoryUrl },
+                                        { name: 'PLATFORM_SSH_LEASE_URL', value: migration.sshLeaseUrl },
+                                        { name: 'RELEASE_REVISION', value: migration.releaseRevision },
+                                        { name: 'DESTINATION_ROOT', value: migration.destination.mountPath },
+                                        {
+                                            name: 'NAMESPACE',
+                                            valueFrom: { fieldRef: { fieldPath: 'metadata.namespace' } }
+                                        },
+                                        { name: 'RECEIPT_CONFIG_MAP', value: migration.receipt.name },
+                                        {
+                                            name: 'EXPECTED_INVENTORY',
+                                            value: JSON.stringify({
+                                                repositoryCount: migration.expectedRepositoryCount,
+                                                owners: migration.expectedOwners
+                                            })
+                                        },
+                                        { name: 'VIBES_ENVIRONMENT_TIER', value: migration.environmentTier },
+                                        { name: 'VIBES_SECRETS_MOUNT_DIR', value: MIGRATION_SECRETS_MOUNT_DIR },
+                                        {
+                                            name: 'NODE_EXTRA_CA_CERTS',
+                                            value: '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
+                                        },
+                                        { name: 'HOME', value: '/tmp' },
+                                        { name: 'TMPDIR', value: '/tmp' }
+                                    ],
+                                    volumeMounts: [
+                                        { name: 'data', mountPath: migration.destination.mountPath },
+                                        {
+                                            name: 'platform-authority',
+                                            mountPath: MIGRATION_SECRETS_MOUNT_DIR,
+                                            readOnly: true
+                                        },
+                                        { name: 'tmp', mountPath: '/tmp' }
+                                    ],
+                                    resources: {
+                                        // Requests are the co-scheduling budget, not the working set:
+                                        // the job must fit BESIDE the stateful pod on one RWO node
+                                        // (see migrationAffinity), and 500m/512Mi could not fit next
+                                        // to gitd on any node in the pool (generation-2, 2026-08-18).
+                                        // The mirror is network/disk-bound; limits keep its bursts.
+                                        requests: { cpu: '100m', memory: '256Mi' },
+                                        limits: { cpu: '4', memory: '8Gi' }
+                                    },
+                                    securityContext: {
+                                        allowPrivilegeEscalation: false,
+                                        readOnlyRootFilesystem: true,
+                                        capabilities: { drop: ['ALL'] }
+                                    }
+                                }
+                            ],
+                            volumes: [
+                                {
+                                    name: 'data',
+                                    persistentVolumeClaim: {
+                                        claimName: migration.destination.pvcName,
+                                        readOnly: false
+                                    }
+                                },
+                                {
+                                    name: 'platform-authority',
+                                    secret: {
+                                        secretName: migration.inventoryAuthoritySecret.name,
+                                        items: [
+                                            {
+                                                key: migration.inventoryAuthoritySecret.key,
+                                                path: MIGRATION_AUTHORITY_CREDENTIAL,
+                                                mode: 0o400
+                                            }
+                                        ]
+                                    }
+                                },
+                                { name: 'tmp', emptyDir: { medium: 'Memory', sizeLimit: '8Mi' } }
+                            ]
+                        }
+                    }
+                }
+            }, namespace);
+            const query = new URLSearchParams({ fieldManager: MIGRATION_FIELD_MANAGER, force: 'false' });
+            jobResponse = await request(`${resourcePath(job)}?${query}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+                body: JSON.stringify(job.manifest)
+            });
+        }
+        const status = KubernetesMigrationJobSchema.parse(await jobResponse.json());
+        const state = status.status?.succeeded !== undefined && status.status.succeeded > 0
+            ? 'succeeded'
+            : status.status?.failed !== undefined && status.status.failed > 0
+                ? 'failed'
+                : status.status?.active !== undefined && status.status.active > 0
+                    ? 'running'
+                    : 'started';
+        const failedCondition = status.status?.conditions?.find((condition) => condition.type === 'Failed' && condition.status === 'True');
+        const reason = state === 'failed' ? boundedStatusToken(failedCondition?.reason, 'JobFailed') : undefined;
+        let completedRepositories = 0;
+        let lastCompletedRepository;
+        let failedRepository;
+        let progressReason;
+        const podSelector = new URLSearchParams({ labelSelector: `job-name=${jobName}` });
+        const podsResponse = await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/pods?${podSelector}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+        if (podsResponse) {
+            const pods = KubernetesPodsSchema.parse(await podsResponse.json());
+            const pod = (pods.items ?? [])
+                .filter((pod) => pod.metadata?.name !== undefined &&
+                /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/.test(pod.metadata.name))
+                .sort((left, right) => String(right.metadata?.creationTimestamp ?? '').localeCompare(String(left.metadata?.creationTimestamp ?? '')))
+                .at(0);
+            const podName = pod?.metadata?.name;
+            const container = pod?.status?.containerStatuses?.find((candidate) => candidate.name === 'repository-migration');
+            const waitingReason = boundedStatusToken(container?.state?.waiting?.reason, '');
+            if (waitingReason)
+                progressReason = waitingReason;
+            else if (pod?.status?.phase !== undefined) {
+                progressReason = boundedStatusToken(pod.status.phase, '');
+            }
+            const logsAvailable = Boolean(container?.state?.running || container?.state?.terminated);
+            if (podName && logsAvailable) {
+                const logQuery = new URLSearchParams({
+                    container: 'repository-migration',
+                    tailLines: '512',
+                    limitBytes: String(256 * 1024)
+                });
+                const logsResponse = await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/pods/${encodeURIComponent(podName)}/log?${logQuery}`, { method: 'GET', headers: { accept: '*/*' } }, true);
+                if (logsResponse) {
+                    const lines = (await logsResponse.text()).split('\n').slice(-512);
+                    const migrated = lines.flatMap((line) => {
+                        const match = line.match(/^MIGRATED ([~A-Za-z0-9][~A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*) refs=\d+$/);
+                        return match ? [match[1]] : [];
+                    });
+                    completedRepositories = migrated.length;
+                    lastCompletedRepository = migrated.at(-1);
+                    if (state === 'failed') {
+                        failedRepository = lines
+                            .flatMap((line) => {
+                            const byId = line.match(/\bRepository ([0-9a-f]{8}-[0-9a-f-]{27,36})\b/i);
+                            if (byId)
+                                return [byId[1].toLowerCase()];
+                            const byPath = line.match(/\b([~A-Za-z0-9][~A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*)\.git\b/);
+                            return byPath ? [byPath[1]] : [];
+                        })
+                            .at(-1);
+                    }
+                }
+            }
+        }
+        const hasDeclaredPullAuthority = plan.imageRegistry
+            ? (status.spec?.template?.spec?.imagePullSecrets ?? []).some((entry) => entry.name === plan.imageRegistry.pullSecretName)
+            : true;
+        if (plan.imageRegistry &&
+            !hasDeclaredPullAuthority &&
+            completedRepositories === 0 &&
+            progressReason === 'ImagePullBackOff') {
+            const receiptResponse = await request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/configmaps/${encodeURIComponent(migration.receipt.name)}`, { method: 'GET', headers: { accept: 'application/json' } }, true);
+            const receipt = receiptResponse
+                ? KubernetesDataSchema.parse(await receiptResponse.json())
+                : undefined;
+            if (Object.keys(receipt?.data ?? {}).length > 0) {
+                throw new Error('Refusing to replace an image-pull-blocked migration Job after receipt data exists.');
+            }
+            await request(`${jobPath}?${new URLSearchParams({ propagationPolicy: 'Foreground' })}`, {
+                method: 'DELETE',
+                headers: { accept: 'application/json' }
+            });
+            for (let attempt = 0; attempt < 30; attempt += 1) {
+                const remaining = await request(jobPath, { method: 'GET', headers: { accept: 'application/json' } }, true);
+                if (!remaining)
+                    break;
+                await this.runtime.lifecycle.delay(1_000);
+            }
+            return {
+                provider: 'digitalocean-kubernetes',
+                cluster,
+                migration: {
+                    migrationId: migration.migrationId,
+                    namespace,
+                    jobName,
+                    receiptConfigMapName: migration.receipt.name,
+                    repositoryCount: migration.expectedRepositoryCount,
+                    state: 'started',
+                    completedRepositories: 0,
+                    progressReason: 'StuckImagePullJobReplaced'
+                }
+            };
+        }
+        return {
+            provider: 'digitalocean-kubernetes',
+            cluster,
+            migration: {
+                migrationId: migration.migrationId,
+                namespace,
+                jobName,
+                receiptConfigMapName: migration.receipt.name,
+                repositoryCount: migration.expectedRepositoryCount,
+                state,
+                completedRepositories,
+                lastCompletedRepository: lastCompletedRepository ? lastCompletedRepository : undefined,
+                failedRepository: failedRepository ? failedRepository : undefined,
+                progressReason: progressReason ? progressReason : undefined,
+                reason: reason ? reason : undefined
+            }
+        };
+    }
+    async apply(descriptor, change) {
+        const plan = this.plan(descriptor, change);
+        const connection = await this.connect(plan);
+        await this.assertReadiness(plan, connection);
+        const { request } = connection;
+        for (const item of plan.resources) {
+            const query = new URLSearchParams({ fieldManager: FIELD_MANAGER, force: 'false' });
+            await request(`${resourcePath(item)}?${query}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+                body: JSON.stringify(item.manifest)
+            });
+        }
+        return plan;
+    }
+    /**
+     * Apply a worker execution through the same short-lived DOKS authority and
+     * bounded error surface as service releases. The caller names the worker
+     * and operation; the plan that mutates the cluster is the projection this
+     * method re-derives from the runtime-selected descriptor.
+     */
+    async applyWorkerPlan(input) {
+        const parsedExecution = DigitalOceanDoksWorkerExecutionInputSchema.safeParse(input);
+        if (!parsedExecution.success) {
+            throw invalidWorkerPlan('DOKS worker execution input is invalid.', 'doks-worker-execution-invalid');
+        }
+        const execution = parsedExecution.data;
+        const plan = await this.authorizeWorkerExecution(execution, false);
+        let opened;
+        const connection = {
+            cluster: { id: plan.cluster.id ?? '', name: plan.cluster.name ?? '' },
+            request: (path, init, allowNotFound, allowConflict) => {
+                opened ??= this.connect(plan);
+                return opened.then((live) => live.request(path, init, allowNotFound, allowConflict));
+            }
+        };
+        const query = new URLSearchParams({ fieldManager: plan.fieldManager, force: 'false' });
+        const bindings = plan.credentialBindings ?? [];
+        const job = plan.operation === 'build'
+            ? plan.resources.find((resource) => resource.kind === 'Job')
+            : undefined;
+        let owner;
+        let delivered;
+        let appliedPlan = plan;
+        const createJob = Boolean(job);
+        const isOwnedJob = (body) => {
+            if (!job)
+                return false;
+            const expectedLabels = KubernetesExpectedLabelsSchema.parse(job.manifest).metadata?.labels ?? {};
+            return (body.metadata?.labels?.['app.kubernetes.io/managed-by'] === plan.fieldManager &&
+                body.metadata?.labels?.['vibes.dev/source-sha'] === expectedLabels['vibes.dev/source-sha'] &&
+                body.metadata?.labels?.['app.kubernetes.io/name'] === expectedLabels['app.kubernetes.io/name']);
+        };
+        try {
+            if (bindings.length > 0) {
+                owner = await this.workerCredentialDeliveryOwner();
+                await owner.admitWorkerCredentials(plan);
+            }
+            // Target admission is credential-free. Once it passes, create the
+            // Namespace before the delivery owner writes any namespaced Secret.
+            const namespace = plan.resources.find((resource) => resource.kind === 'Namespace');
+            if (namespace) {
+                await connection.request(`${resourcePath(namespace)}?${query}`, {
+                    method: 'PATCH',
+                    headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+                    body: JSON.stringify(namespace.manifest)
+                });
+            }
+            // Reuse a live Job and its issued operation lease. A failed Job must
+            // relinquish that exact lease and Secret before UID-safe replacement.
+            if (job) {
+                const existing = await connection.request(resourcePath(job), { method: 'GET', headers: { accept: 'application/json' } }, true);
+                if (existing) {
+                    const body = KubernetesOwnedJobSchema.parse(await existing.json());
+                    if (!isOwnedJob(body)) {
+                        throw new Error(`Refusing to mutate foreign DOKS worker build Job ${job.namespace}/${job.name}.`);
+                    }
+                    const failed = (body.status?.failed ?? 0) > 0 ||
+                        body.status?.conditions?.some((condition) => condition.type === 'Failed' && condition.status === 'True');
+                    if (failed) {
+                        const oldOperation = this.recoverWorkerSourceLease(plan, body);
+                        await this.revokeWorkerSourceLease(oldOperation);
+                        const uid = boundedStatusToken(body.metadata?.uid, '');
+                        if (!uid) {
+                            throw new Error(`Refusing to replace DOKS worker build Job ${job.namespace}/${job.name} without its UID.`);
+                        }
+                        await connection.request(resourcePath(job), {
+                            method: 'DELETE',
+                            headers: { 'content-type': 'application/json', accept: 'application/json' },
+                            body: JSON.stringify({ propagationPolicy: 'Background', preconditions: { uid } })
+                        });
+                        for (let attempt = 0; attempt < 120; attempt += 1) {
+                            const remaining = await connection.request(resourcePath(job), { method: 'GET', headers: { accept: 'application/json' } }, true);
+                            if (!remaining)
+                                break;
+                            if (attempt === 119) {
+                                throw new Error(`Timed out waiting to replace failed DOKS worker build Job ${job.namespace}/${job.name}.`);
+                            }
+                            await this.runtime.lifecycle.delay(250);
+                        }
+                    }
+                    else {
+                        return this.recoverWorkerSourceLease(plan, body);
+                    }
+                }
+            }
+            if (bindings.length > 0) {
+                if (!owner) {
+                    throw new CapabilityError('The DOKS Secret credential delivery owner is not composed.', 'UNAVAILABLE', { reason: 'doks-worker-credential-owner-unavailable' });
+                }
+                delivered = DigitalOceanDoksWorkerPlanSchema.parse(await owner.prepareWorkerCredentials(plan));
+                if (plan.operation === 'build') {
+                    if (!delivered.credentialLease) {
+                        throw invalidWorkerPlan('DOKS build credential delivery returned no source lease.', 'doks-worker-source-lease-missing');
+                    }
+                    appliedPlan = await this.authorizeWorkerPlan(execution, true, delivered.credentialLease);
+                }
+            }
+            for (const resource of appliedPlan.resources) {
+                if (resource.kind === 'Job' || resource.kind === 'Namespace')
+                    continue;
+                await connection.request(`${resourcePath(resource)}?${query}`, {
+                    method: 'PATCH',
+                    headers: { 'content-type': 'application/apply-patch+yaml', accept: 'application/json' },
+                    body: JSON.stringify(resource.manifest)
+                });
+            }
+            if (job && createJob) {
+                const appliedJob = appliedPlan.resources.find((resource) => resource.kind === 'Job');
+                if (!appliedJob) {
+                    throw invalidWorkerPlan('DOKS build execution has no authorized Job.', 'doks-worker-job-missing');
+                }
+                const createPath = `/apis/batch/v1/namespaces/${encodeURIComponent(appliedJob.namespace ?? 'default')}/jobs`;
+                const created = await connection.request(createPath, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json', accept: 'application/json' },
+                    body: JSON.stringify(appliedJob.manifest)
+                }, false, true);
+                if (created?.status === 409) {
+                    const occupant = await connection.request(resourcePath(appliedJob), { method: 'GET', headers: { accept: 'application/json' } });
+                    if (!occupant) {
+                        throw new CapabilityError('DOKS worker Job create conflicted but no current Job can be recovered.', 'UNAVAILABLE', { reason: 'doks-worker-job-race-evidence-unavailable' });
+                    }
+                    const body = KubernetesOwnedJobSchema.parse(await occupant.json());
+                    if (!isOwnedJob(body)) {
+                        throw new Error(`Refusing to accept foreign DOKS worker build Job ${appliedJob.namespace}/${appliedJob.name} after create conflict.`);
+                    }
+                    const winner = this.recoverWorkerSourceLease(plan, body);
+                    const losingOperation = delivered;
+                    delivered = undefined;
+                    if (losingOperation?.credentialLease) {
+                        await this.revokeWorkerSourceLease(losingOperation);
+                    }
+                    return winner;
+                }
+            }
+            return appliedPlan;
+        }
+        catch (cause) {
+            const issued = delivered;
+            delivered = undefined;
+            if (issued?.credentialLease) {
+                const revoked = await settle(() => this.revokeWorkerSourceLease(issued));
+                if (!revoked.ok) {
+                    throw new CapabilityError('DOKS worker apply and credential cleanup failed.', 'UNAVAILABLE', {
+                        reason: 'doks-worker-apply-cleanup-failed',
+                        cause: new AggregateError([cause, revoked.cause])
+                    });
+                }
+            }
+            throw cause;
+        }
+    }
+    async getWorkerPlanStatus(input) {
+        const parsedExecution = DigitalOceanDoksWorkerExecutionInputSchema.safeParse(input);
+        if (!parsedExecution.success) {
+            throw invalidWorkerPlan('DOKS worker execution input is invalid.', 'doks-worker-execution-invalid');
+        }
+        const plan = await this.authorizeWorkerExecution(parsedExecution.data, true);
+        const target = plan.resources.find((item) => plan.operation === 'build' ? item.kind === 'Job' : item.kind === 'Deployment');
+        if (!target)
+            throw new Error(`DOKS worker ${plan.operation} plan has no status-bearing resource.`);
+        const connection = await this.connect(plan);
+        const response = await connection.request(resourcePath(target), {
+            method: 'GET',
+            headers: { accept: 'application/json' }
+        });
+        const body = KubernetesWorkloadStatusSchema.parse(await response.json());
+        const conditions = body.status?.conditions ?? [];
+        const errors = [];
+        const recordFailure = (reason, cause) => {
+            errors.push(new CapabilityError('DOKS worker evidence is incomplete.', 'UNAVAILABLE', { reason, cause }));
+        };
+        if (plan.operation === 'build') {
+            const cleanupCredential = async () => {
+                const revokeErrorResult = await settle(async () => {
+                    const operationPlan = this.recoverWorkerSourceLease(plan, body);
+                    await this.revokeWorkerSourceLease(operationPlan);
+                    return true;
+                });
+                if (revokeErrorResult.ok)
+                    return revokeErrorResult.value;
+                {
+                    const revokeError = revokeErrorResult.cause;
+                    recordFailure('doks-worker-credential-cleanup-failed', revokeError);
+                    return false;
+                }
+            };
+            const podDiagnostic = async () => {
+                const diagnosticErrorResult = await settle(async () => {
+                    const namespace = target.namespace ?? 'default';
+                    const selector = new URLSearchParams({ labelSelector: `job-name=${target.name}` });
+                    const podResponse = await connection.request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/pods?${selector}`, { method: 'GET', headers: { accept: 'application/json' } });
+                    const pods = KubernetesBuildPodsSchema.parse(await podResponse.json());
+                    const pod = pods.items?.[0];
+                    if (!pod) {
+                        const jobUid = boundedStatusToken(body.metadata?.uid, '');
+                        if (!jobUid)
+                            return 'NoPods';
+                        const eventSelector = new URLSearchParams({
+                            fieldSelector: `involvedObject.kind=Job,involvedObject.name=${target.name},involvedObject.uid=${jobUid}`
+                        });
+                        const eventResponse = await connection.request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/events?${eventSelector}`, { method: 'GET', headers: { accept: 'application/json' } });
+                        const events = KubernetesEventsSchema.parse(await eventResponse.json());
+                        const event = (events.items ?? []).sort((left, right) => String(right.eventTime ?? right.lastTimestamp ?? '').localeCompare(String(left.eventTime ?? left.lastTimestamp ?? '')))[0];
+                        const reason = boundedStatusToken(event?.reason, '');
+                        const classification = classifyKubernetesEventMessage(event?.message);
+                        return ['NoPods', reason, classification].filter(Boolean).join('/');
+                    }
+                    const containerReason = pod.status?.containerStatuses
+                        ?.map((item) => boundedStatusToken(item.state?.waiting?.reason ?? item.state?.terminated?.reason, ''))
+                        .find(Boolean);
+                    const conditionReason = boundedStatusToken(pod.status?.conditions?.find((item) => item.status === 'False' && item.reason)?.reason, '');
+                    let logClassification = '';
+                    const diagnosticPodName = pod.metadata?.name;
+                    if (diagnosticPodName && (pod.status?.phase === 'Failed' || containerReason)) {
+                        const logErrorResult = await settle(async () => {
+                            const logResponse = await connection.request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/pods/${encodeURIComponent(diagnosticPodName)}/log?container=builder&tailLines=20`, { method: 'GET', headers: {} });
+                            if (logResponse?.ok) {
+                                logClassification = classifyKubernetesEventMessage(await logResponse.text());
+                            }
+                        });
+                        if (!logErrorResult.ok) {
+                            const logError = logErrorResult.cause;
+                            recordFailure('doks-worker-log-evidence-unavailable', logError);
+                        }
+                    }
+                    return [
+                        boundedStatusToken(pod.status?.phase, 'Unknown'),
+                        containerReason || conditionReason,
+                        logClassification
+                    ]
+                        .filter(Boolean)
+                        .join('/');
+                });
+                if (diagnosticErrorResult.ok)
+                    return diagnosticErrorResult.value;
+                {
+                    const diagnosticError = diagnosticErrorResult.cause;
+                    recordFailure('doks-worker-diagnostics-unavailable', diagnosticError);
+                    return 'DiagnosticsUnavailable';
+                }
+            };
+            const failure = conditions.find((item) => item.type === 'Failed' && item.status === 'True');
+            if ((body.status?.failed ?? 0) > 0 || failure) {
+                const cleaned = await cleanupCredential();
+                return {
+                    state: 'failed',
+                    reason: `${boundedStatusToken(failure?.reason, 'JobFailed')} (${await podDiagnostic()})${cleaned ? '' : '/CredentialCleanupFailed'}`,
+                    worker: plan.worker,
+                    operation: plan.operation,
+                    errors: errors.length > 0 ? errors : undefined
+                };
+            }
+            if ((body.status?.succeeded ?? 0) > 0) {
+                const cleaned = await cleanupCredential();
+                return {
+                    state: cleaned ? 'succeeded' : 'failed',
+                    reason: cleaned ? 'JobComplete' : 'JobComplete/CredentialCleanupFailed',
+                    worker: plan.worker,
+                    operation: plan.operation,
+                    errors: errors.length > 0 ? errors : undefined
+                };
+            }
+            return {
+                state: 'pending',
+                reason: `JobRunning (${await podDiagnostic()})`,
+                worker: plan.worker,
+                operation: plan.operation,
+                errors: errors.length > 0 ? errors : undefined
+            };
+        }
+        const failed = conditions.find((item) => item.type === 'Progressing' &&
+            item.status === 'False' &&
+            item.reason === 'ProgressDeadlineExceeded');
+        if (failed)
+            return {
+                state: 'failed',
+                reason: 'ProgressDeadlineExceeded',
+                worker: plan.worker,
+                operation: plan.operation,
+                errors: errors.length > 0 ? errors : undefined
+            };
+        const desired = Number(KubernetesReplicaSpecSchema.parse(target.manifest).spec?.replicas ?? 1);
+        const generation = body.metadata?.generation ?? 0;
+        const ready = (body.status?.observedGeneration ?? -1) >= generation &&
+            (body.status?.replicas ?? 0) === desired &&
+            (body.status?.availableReplicas ?? 0) >= desired &&
+            (body.status?.updatedReplicas ?? 0) >= desired;
+        return ready
+            ? {
+                state: 'succeeded',
+                reason: 'DeploymentAvailable',
+                worker: plan.worker,
+                operation: plan.operation,
+                errors: errors.length > 0 ? errors : undefined
+            }
+            : {
+                state: 'pending',
+                reason: 'DeploymentProgressing',
+                worker: plan.worker,
+                operation: plan.operation,
+                errors: errors.length > 0 ? errors : undefined
+            };
+    }
+}
+//# sourceMappingURL=service-release.js.map