@fractal_cloud/sdk 1.1.0 → 1.2.0

package/dist/index.d.cts

@@ -1563,6 +1563,29 @@ type LiveSystemBuilder = {
 //#region src/live_system/index.d.ts
 declare namespace LiveSystem$1 {
   type Status = 'Unknown' | 'Mutating' | 'Active' | 'FailedMutation' | 'Processing' | 'Error' | 'Ready' | 'Deleting' | 'Stale';
+  /**
+   * Controls how deploy() behaves after submitting the live system to the API.
+   *
+   * - `'fire-and-forget'` (default): submit and return immediately. Errors are
+   *   logged to the console but not thrown. Suitable for applications and CLIs
+   *   where deployment is a background concern.
+   *
+   * - `'wait'`: submit then poll until the live system reaches `Active` status.
+   *   Throws if deployment fails or if the timeout is exceeded. Suitable for
+   *   CI/CD pipelines where the pipeline must not advance until infrastructure
+   *   is fully provisioned.
+   */
+  type DeployOptions = {
+    mode: 'fire-and-forget' | 'wait'; /** Polling interval in milliseconds. Default: 5000 (5 s). Only used with `mode: 'wait'`. */
+    pollIntervalMs?: number; /** Maximum time to wait in milliseconds. Default: 600000 (10 min). Only used with `mode: 'wait'`. */
+    timeoutMs?: number;
+    /**
+     * Suppress all SDK log output. Default: false.
+     * Set to `true` when a CLI or wrapper layer owns the presentation layer.
+     * Only applies to `mode: 'wait'` — `fire-and-forget` is always silent.
+     */
+    quiet?: boolean;
+  };
   type Id = LiveSystemId;
   namespace Id {
     type Builder = LiveSystemIdBuilder;
@@ -1590,21 +1613,59 @@ type LiveSystem$1 = {
   environment: Environment$1;
   createdAt: Date;
   updatedAt: Date;
-  deploy: (credentials: ServiceAccountCredentials$1) => Promise<void>;
+  deploy: (credentials: ServiceAccountCredentials$1, options?: LiveSystem$1.DeployOptions) => Promise<void>;
   destroy: (credentials: ServiceAccountCredentials$1) => Promise<void>;
 };
 //#endregion
+//#region src/fractal/component/network_and_compute/iaas/security_group.d.ts
+type IngressRule = {
+  protocol?: string;
+  fromPort: number;
+  toPort?: number;
+  sourceCidr?: string;
+  sourceGroupId?: string;
+};
+type SecurityGroupBuilder = {
+  withId: (id: string) => SecurityGroupBuilder;
+  withVersion: (major: number, minor: number, patch: number) => SecurityGroupBuilder;
+  withDisplayName: (displayName: string) => SecurityGroupBuilder;
+  withDescription: (description: string) => SecurityGroupBuilder;
+  withIngressRules: (rules: IngressRule[]) => SecurityGroupBuilder;
+  withLinks: (links: ComponentLink[]) => SecurityGroupBuilder;
+  build: () => SecurityGroupComponent;
+};
+type SecurityGroupConfig = {
+  id: string;
+  version: {
+    major: number;
+    minor: number;
+    patch: number;
+  };
+  displayName: string;
+  description: string;
+  ingressRules?: IngressRule[];
+};
+/** A BlueprintComponent that is guaranteed to be a SecurityGroup. */
+type SecurityGroupComponent = BlueprintComponent & {
+  readonly _brand: 'SecurityGroup';
+};
+declare namespace SecurityGroup {
+  const getBuilder: () => SecurityGroupBuilder;
+  const create: (config: SecurityGroupConfig) => SecurityGroupComponent;
+}
+//#endregion
 //#region src/fractal/component/network_and_compute/iaas/vm.d.ts
 type VmPortLink = {
-  target: VirtualMachineNode;
+  target: VirtualMachineComponent;
   fromPort: number;
   toPort?: number;
   protocol?: string;
 };
-type VirtualMachineNode = {
+type VirtualMachineComponent = {
   readonly component: BlueprintComponent;
-  readonly components: ReadonlyArray<BlueprintComponent>;
-  withLinks: (links: VmPortLink[]) => VirtualMachineNode;
+  readonly components: ReadonlyArray<BlueprintComponent>; /** Declares a traffic rule from this VM to another. The agent derives managed SG egress/ingress rules. */
+  linkToVirtualMachine: (links: VmPortLink[]) => VirtualMachineComponent; /** Declares SG membership. The agent assigns the VM to the given security group at launch. No settings required. */
+  linkToSecurityGroup: (sgs: SecurityGroupComponent[]) => VirtualMachineComponent;
 };
 type VirtualMachineBuilder = {
   withId: (id: string) => VirtualMachineBuilder;
@@ -1626,7 +1687,7 @@ type VirtualMachineConfig = {
 };
 declare namespace VirtualMachine {
   const getBuilder: () => VirtualMachineBuilder;
-  const create: (config: VirtualMachineConfig) => VirtualMachineNode;
+  const create: (config: VirtualMachineConfig) => VirtualMachineComponent;
 }
 //#endregion
 //#region src/fractal/component/custom_workloads/caas/workload.d.ts
@@ -1635,16 +1696,16 @@ declare namespace VirtualMachine {
  * The agent derives managed SG egress/ingress rules from these.
  */
 type WorkloadPortLink = {
-  target: WorkloadNode;
+  target: WorkloadComponent;
   fromPort: number;
   toPort?: number;
   protocol?: string;
 };
-type WorkloadNode = {
+type WorkloadComponent = {
   readonly component: BlueprintComponent;
-  readonly components: ReadonlyArray<BlueprintComponent>;
-  withLinks: (links: WorkloadPortLink[]) => WorkloadNode;
-  withSecurityGroups: (sgs: BlueprintComponent[]) => WorkloadNode;
+  readonly components: ReadonlyArray<BlueprintComponent>; /** Declares a traffic rule from this workload to another. The agent derives managed SG egress/ingress rules. */
+  linkToWorkload: (links: WorkloadPortLink[]) => WorkloadComponent; /** Declares SG membership. The agent assigns the workload to the given security group at launch. No settings required. */
+  linkToSecurityGroup: (sgs: SecurityGroupComponent[]) => WorkloadComponent;
 };
 type WorkloadBuilder = {
   withId: (id: string) => WorkloadBuilder;
@@ -1677,17 +1738,17 @@ type WorkloadConfig = {
 };
 declare namespace Workload {
   const getBuilder: () => WorkloadBuilder;
-  const create: (config: WorkloadConfig) => WorkloadNode;
+  const create: (config: WorkloadConfig) => WorkloadComponent;
 }
 //#endregion
 //#region src/fractal/component/network_and_compute/iaas/subnet.d.ts
-type SubnetNode = {
+type SubnetComponent = {
   readonly subnet: BlueprintComponent;
   readonly virtualMachines: ReadonlyArray<BlueprintComponent>;
   readonly workloads: ReadonlyArray<BlueprintComponent>;
   readonly components: ReadonlyArray<BlueprintComponent>;
-  withVirtualMachines: (vms: VirtualMachineNode[]) => SubnetNode;
-  withWorkloads: (workloads: ReadonlyArray<WorkloadNode>) => SubnetNode;
+  withVirtualMachines: (vms: VirtualMachineComponent[]) => SubnetComponent;
+  withWorkloads: (workloads: ReadonlyArray<WorkloadComponent>) => SubnetComponent;
 };
 type SubnetResult = {
   readonly subnet: BlueprintComponent;
@@ -1717,52 +1778,19 @@ type SubnetConfig = {
 };
 declare namespace Subnet {
   const getBuilder: () => SubnetBuilder;
-  const create: (config: SubnetConfig) => SubnetNode;
-}
-//#endregion
-//#region src/fractal/component/network_and_compute/iaas/security_group.d.ts
-type IngressRule = {
-  protocol?: string;
-  fromPort: number;
-  toPort?: number;
-  sourceCidr?: string;
-  sourceGroupId?: string;
-};
-type SecurityGroupBuilder = {
-  withId: (id: string) => SecurityGroupBuilder;
-  withVersion: (major: number, minor: number, patch: number) => SecurityGroupBuilder;
-  withDisplayName: (displayName: string) => SecurityGroupBuilder;
-  withDescription: (description: string) => SecurityGroupBuilder;
-  withIngressRules: (rules: IngressRule[]) => SecurityGroupBuilder;
-  withLinks: (links: ComponentLink[]) => SecurityGroupBuilder;
-  build: () => BlueprintComponent;
-};
-type SecurityGroupConfig = {
-  id: string;
-  version: {
-    major: number;
-    minor: number;
-    patch: number;
-  };
-  displayName: string;
-  description: string;
-  ingressRules?: IngressRule[];
-};
-declare namespace SecurityGroup {
-  const getBuilder: () => SecurityGroupBuilder;
-  const create: (config: SecurityGroupConfig) => BlueprintComponent;
+  const create: (config: SubnetConfig) => SubnetComponent;
 }
 //#endregion
 //#region src/fractal/component/network_and_compute/iaas/virtual_network.d.ts
-type VirtualNetworkNode = {
+type VirtualNetworkComponent = {
   readonly vpc: BlueprintComponent;
   readonly subnets: ReadonlyArray<BlueprintComponent>;
   readonly securityGroups: ReadonlyArray<BlueprintComponent>;
   readonly virtualMachines: ReadonlyArray<BlueprintComponent>;
   readonly workloads: ReadonlyArray<BlueprintComponent>;
   readonly components: ReadonlyArray<BlueprintComponent>;
-  withSubnets: (subnets: SubnetNode[]) => VirtualNetworkNode;
-  withSecurityGroups: (sgs: BlueprintComponent[]) => VirtualNetworkNode;
+  withSubnets: (subnets: SubnetComponent[]) => VirtualNetworkComponent;
+  withSecurityGroups: (sgs: BlueprintComponent[]) => VirtualNetworkComponent;
 };
 type VirtualNetworkResult = {
   readonly vpc: BlueprintComponent;
@@ -1796,7 +1824,7 @@ type VirtualNetworkConfig = {
 };
 declare namespace VirtualNetwork {
   const getBuilder: () => VirtualNetworkBuilder;
-  const create: (config: VirtualNetworkConfig) => VirtualNetworkNode;
+  const create: (config: VirtualNetworkConfig) => VirtualNetworkComponent;
 }
 //#endregion
 //#region src/live_system/component/network_and_compute/iaas/vpc.d.ts
@@ -2626,14 +2654,14 @@ declare namespace HetznerServer {
 }
 //#endregion
 //#region src/fractal/component/network_and_compute/paas/container_platform.d.ts
-type ContainerPlatformNode = {
+type ContainerPlatformComponent = {
   readonly platform: BlueprintComponent;
   /**
    * Workload nodes with the platform dependency auto-wired into each component.
    * Pass these to Subnet.withWorkloads() so the subnet dep is stacked on top.
    */
-  readonly workloads: ReadonlyArray<WorkloadNode>;
-  withWorkloads: (workloads: WorkloadNode[]) => ContainerPlatformNode;
+  readonly workloads: ReadonlyArray<WorkloadComponent>;
+  withWorkloads: (workloads: WorkloadComponent[]) => ContainerPlatformComponent;
 };
 type ContainerPlatformBuilder = {
   withId: (id: string) => ContainerPlatformBuilder;
@@ -2654,7 +2682,7 @@ type ContainerPlatformConfig = {
 };
 declare namespace ContainerPlatform {
   const getBuilder: () => ContainerPlatformBuilder;
-  const create: (config: ContainerPlatformConfig) => ContainerPlatformNode;
+  const create: (config: ContainerPlatformConfig) => ContainerPlatformComponent;
 }
 //#endregion
 //#region src/live_system/component/network_and_compute/paas/ecs_cluster.d.ts
@@ -2755,11 +2783,17 @@ declare namespace AwsEcsTaskDefinition {
 /**
  * Returned by satisfy() — all structural properties (dependencies, links,
  * desiredCount) are locked from the blueprint. Only AWS-specific launch
- * parameters are set here.
+ * parameters and live-system sub-component dependencies are set here.
  */
 type SatisfiedAwsEcsServiceBuilder = {
   withLaunchType: (type: string) => SatisfiedAwsEcsServiceBuilder;
   withAssignPublicIp: (assign: boolean) => SatisfiedAwsEcsServiceBuilder;
+  /**
+   * Declares a live-system-only dependency on the ECS Task Definition that
+   * this service will run. This has no blueprint equivalent — it is an
+   * AWS-specific sub-component relationship.
+   */
+  withTaskDefinition: (taskDef: LiveSystemComponent) => SatisfiedAwsEcsServiceBuilder;
   build: () => LiveSystemComponent;
 };
 type AwsEcsServiceBuilder = {
@@ -2787,6 +2821,12 @@ type AwsEcsServiceConfig = {
 };
 declare namespace AwsEcsService {
   const getBuilder: () => AwsEcsServiceBuilder;
+  /**
+   * Satisfies a blueprint Workload component as an AWS ECS Service.
+   * All structural properties — dependencies (subnet, cluster), links
+   * (traffic rules, SG membership), and desiredCount — are carried from
+   * the blueprint unchanged. Only AWS-specific launch parameters are added here.
+   */
   /**
    * Satisfies a blueprint Workload component as an AWS ECS Service.
    * All structural properties — dependencies (subnet, cluster), links
@@ -2825,4 +2865,4 @@ type Environment = Environment$1;
 declare const LiveSystem: typeof LiveSystem$1;
 type LiveSystem = LiveSystem$1;
 //#endregion
-export { AwsEcsCluster, type AwsEcsClusterBuilder, type AwsEcsClusterConfig, AwsEcsService, type AwsEcsServiceBuilder, type AwsEcsServiceConfig, AwsEcsTaskDefinition, type AwsEcsTaskDefinitionBuilder, type AwsEcsTaskDefinitionConfig, AwsSecurityGroup, type AwsSecurityGroupBuilder, type AwsSecurityGroupConfig, AwsSubnet, type AwsSubnetBuilder, type AwsSubnetConfig, AwsVpc, type AwsVpcBuilder, type AwsVpcConfig, AzureNsg, type AzureNsgBuilder, type AzureNsgConfig, AzureSubnet, type AzureSubnetBuilder, type AzureSubnetConfig, AzureVm, type AzureVmBuilder, type AzureVmConfig, AzureVnet, type AzureVnetBuilder, type AzureVnetConfig, BoundedContext, ContainerPlatform, type ContainerPlatformBuilder, type ContainerPlatformConfig, type ContainerPlatformNode, Ec2Instance, type Ec2InstanceBuilder, type Ec2InstanceConfig, Environment, Fractal, GcpFirewall, type GcpFirewallBuilder, type GcpFirewallConfig, GcpSubnet, type GcpSubnetBuilder, type GcpSubnetConfig, GcpVm, type GcpVmBuilder, type GcpVmConfig, GcpVpc, type GcpVpcBuilder, type GcpVpcConfig, HetznerFirewall, type HetznerFirewallBuilder, type HetznerFirewallConfig, HetznerNetwork, type HetznerNetworkBuilder, type HetznerNetworkConfig, HetznerServer, type HetznerServerBuilder, type HetznerServerConfig, HetznerSubnet, type HetznerSubnetBuilder, type HetznerSubnetConfig, InfrastructureDomain, type IngressRule, KebabCaseString, LiveSystem, OciInstance, type OciInstanceBuilder, type OciInstanceConfig, OciSecurityList, type OciSecurityListBuilder, type OciSecurityListConfig, OciSubnet, type OciSubnetBuilder, type OciSubnetConfig, OciVcn, type OciVcnBuilder, type OciVcnConfig, OwnerId, OwnerType, PascalCaseString, type SatisfiedAwsEcsClusterBuilder, type SatisfiedAwsEcsServiceBuilder, type SatisfiedAwsEcsTaskDefinitionBuilder, type SatisfiedAwsSecurityGroupBuilder, type SatisfiedAwsSubnetBuilder, type SatisfiedAwsVpcBuilder, type SatisfiedAzureNsgBuilder, type SatisfiedAzureSubnetBuilder, type SatisfiedAzureVmBuilder, type SatisfiedAzureVnetBuilder, type SatisfiedEc2Builder, type SatisfiedGcpFirewallBuilder, type SatisfiedGcpSubnetBuilder, type SatisfiedGcpVmBuilder, type SatisfiedGcpVpcBuilder, type SatisfiedHetznerFirewallBuilder, type SatisfiedHetznerNetworkBuilder, type SatisfiedHetznerServerBuilder, type SatisfiedHetznerSubnetBuilder, type SatisfiedOciInstanceBuilder, type SatisfiedOciSecurityListBuilder, type SatisfiedOciSubnetBuilder, type SatisfiedOciVcnBuilder, SecurityGroup, type SecurityGroupBuilder, type SecurityGroupConfig, ServiceAccountCredentials, ServiceAccountId, ServiceDeliveryModel, Subnet, type SubnetBuilder, type SubnetConfig, type SubnetNode, type SubnetResult, Version, VirtualMachine, type VirtualMachineBuilder, type VirtualMachineConfig, type VirtualMachineNode, VirtualNetwork, type VirtualNetworkBuilder, type VirtualNetworkConfig, type VirtualNetworkNode, type VirtualNetworkResult, type VmPortLink, Workload, type WorkloadBuilder, type WorkloadConfig, type WorkloadNode, type WorkloadPortLink };
+export { AwsEcsCluster, type AwsEcsClusterBuilder, type AwsEcsClusterConfig, AwsEcsService, type AwsEcsServiceBuilder, type AwsEcsServiceConfig, AwsEcsTaskDefinition, type AwsEcsTaskDefinitionBuilder, type AwsEcsTaskDefinitionConfig, AwsSecurityGroup, type AwsSecurityGroupBuilder, type AwsSecurityGroupConfig, AwsSubnet, type AwsSubnetBuilder, type AwsSubnetConfig, AwsVpc, type AwsVpcBuilder, type AwsVpcConfig, AzureNsg, type AzureNsgBuilder, type AzureNsgConfig, AzureSubnet, type AzureSubnetBuilder, type AzureSubnetConfig, AzureVm, type AzureVmBuilder, type AzureVmConfig, AzureVnet, type AzureVnetBuilder, type AzureVnetConfig, BoundedContext, ContainerPlatform, type ContainerPlatformBuilder, type ContainerPlatformComponent, type ContainerPlatformConfig, Ec2Instance, type Ec2InstanceBuilder, type Ec2InstanceConfig, Environment, Fractal, GcpFirewall, type GcpFirewallBuilder, type GcpFirewallConfig, GcpSubnet, type GcpSubnetBuilder, type GcpSubnetConfig, GcpVm, type GcpVmBuilder, type GcpVmConfig, GcpVpc, type GcpVpcBuilder, type GcpVpcConfig, HetznerFirewall, type HetznerFirewallBuilder, type HetznerFirewallConfig, HetznerNetwork, type HetznerNetworkBuilder, type HetznerNetworkConfig, HetznerServer, type HetznerServerBuilder, type HetznerServerConfig, HetznerSubnet, type HetznerSubnetBuilder, type HetznerSubnetConfig, InfrastructureDomain, type IngressRule, KebabCaseString, LiveSystem, OciInstance, type OciInstanceBuilder, type OciInstanceConfig, OciSecurityList, type OciSecurityListBuilder, type OciSecurityListConfig, OciSubnet, type OciSubnetBuilder, type OciSubnetConfig, OciVcn, type OciVcnBuilder, type OciVcnConfig, OwnerId, OwnerType, PascalCaseString, type SatisfiedAwsEcsClusterBuilder, type SatisfiedAwsEcsServiceBuilder, type SatisfiedAwsEcsTaskDefinitionBuilder, type SatisfiedAwsSecurityGroupBuilder, type SatisfiedAwsSubnetBuilder, type SatisfiedAwsVpcBuilder, type SatisfiedAzureNsgBuilder, type SatisfiedAzureSubnetBuilder, type SatisfiedAzureVmBuilder, type SatisfiedAzureVnetBuilder, type SatisfiedEc2Builder, type SatisfiedGcpFirewallBuilder, type SatisfiedGcpSubnetBuilder, type SatisfiedGcpVmBuilder, type SatisfiedGcpVpcBuilder, type SatisfiedHetznerFirewallBuilder, type SatisfiedHetznerNetworkBuilder, type SatisfiedHetznerServerBuilder, type SatisfiedHetznerSubnetBuilder, type SatisfiedOciInstanceBuilder, type SatisfiedOciSecurityListBuilder, type SatisfiedOciSubnetBuilder, type SatisfiedOciVcnBuilder, SecurityGroup, type SecurityGroupBuilder, type SecurityGroupComponent, type SecurityGroupConfig, ServiceAccountCredentials, ServiceAccountId, ServiceDeliveryModel, Subnet, type SubnetBuilder, type SubnetComponent, type SubnetConfig, type SubnetResult, Version, VirtualMachine, type VirtualMachineBuilder, type VirtualMachineComponent, type VirtualMachineConfig, VirtualNetwork, type VirtualNetworkBuilder, type VirtualNetworkComponent, type VirtualNetworkConfig, type VirtualNetworkResult, type VmPortLink, Workload, type WorkloadBuilder, type WorkloadComponent, type WorkloadConfig, type WorkloadPortLink };

package/dist/index.d.mts

@@ -1563,6 +1563,29 @@ type LiveSystemBuilder = {
 //#region src/live_system/index.d.ts
 declare namespace LiveSystem$1 {
   type Status = 'Unknown' | 'Mutating' | 'Active' | 'FailedMutation' | 'Processing' | 'Error' | 'Ready' | 'Deleting' | 'Stale';
+  /**
+   * Controls how deploy() behaves after submitting the live system to the API.
+   *
+   * - `'fire-and-forget'` (default): submit and return immediately. Errors are
+   *   logged to the console but not thrown. Suitable for applications and CLIs
+   *   where deployment is a background concern.
+   *
+   * - `'wait'`: submit then poll until the live system reaches `Active` status.
+   *   Throws if deployment fails or if the timeout is exceeded. Suitable for
+   *   CI/CD pipelines where the pipeline must not advance until infrastructure
+   *   is fully provisioned.
+   */
+  type DeployOptions = {
+    mode: 'fire-and-forget' | 'wait'; /** Polling interval in milliseconds. Default: 5000 (5 s). Only used with `mode: 'wait'`. */
+    pollIntervalMs?: number; /** Maximum time to wait in milliseconds. Default: 600000 (10 min). Only used with `mode: 'wait'`. */
+    timeoutMs?: number;
+    /**
+     * Suppress all SDK log output. Default: false.
+     * Set to `true` when a CLI or wrapper layer owns the presentation layer.
+     * Only applies to `mode: 'wait'` — `fire-and-forget` is always silent.
+     */
+    quiet?: boolean;
+  };
   type Id = LiveSystemId;
   namespace Id {
     type Builder = LiveSystemIdBuilder;
@@ -1590,21 +1613,59 @@ type LiveSystem$1 = {
   environment: Environment$1;
   createdAt: Date;
   updatedAt: Date;
-  deploy: (credentials: ServiceAccountCredentials$1) => Promise<void>;
+  deploy: (credentials: ServiceAccountCredentials$1, options?: LiveSystem$1.DeployOptions) => Promise<void>;
   destroy: (credentials: ServiceAccountCredentials$1) => Promise<void>;
 };
 //#endregion
+//#region src/fractal/component/network_and_compute/iaas/security_group.d.ts
+type IngressRule = {
+  protocol?: string;
+  fromPort: number;
+  toPort?: number;
+  sourceCidr?: string;
+  sourceGroupId?: string;
+};
+type SecurityGroupBuilder = {
+  withId: (id: string) => SecurityGroupBuilder;
+  withVersion: (major: number, minor: number, patch: number) => SecurityGroupBuilder;
+  withDisplayName: (displayName: string) => SecurityGroupBuilder;
+  withDescription: (description: string) => SecurityGroupBuilder;
+  withIngressRules: (rules: IngressRule[]) => SecurityGroupBuilder;
+  withLinks: (links: ComponentLink[]) => SecurityGroupBuilder;
+  build: () => SecurityGroupComponent;
+};
+type SecurityGroupConfig = {
+  id: string;
+  version: {
+    major: number;
+    minor: number;
+    patch: number;
+  };
+  displayName: string;
+  description: string;
+  ingressRules?: IngressRule[];
+};
+/** A BlueprintComponent that is guaranteed to be a SecurityGroup. */
+type SecurityGroupComponent = BlueprintComponent & {
+  readonly _brand: 'SecurityGroup';
+};
+declare namespace SecurityGroup {
+  const getBuilder: () => SecurityGroupBuilder;
+  const create: (config: SecurityGroupConfig) => SecurityGroupComponent;
+}
+//#endregion
 //#region src/fractal/component/network_and_compute/iaas/vm.d.ts
 type VmPortLink = {
-  target: VirtualMachineNode;
+  target: VirtualMachineComponent;
   fromPort: number;
   toPort?: number;
   protocol?: string;
 };
-type VirtualMachineNode = {
+type VirtualMachineComponent = {
   readonly component: BlueprintComponent;
-  readonly components: ReadonlyArray<BlueprintComponent>;
-  withLinks: (links: VmPortLink[]) => VirtualMachineNode;
+  readonly components: ReadonlyArray<BlueprintComponent>; /** Declares a traffic rule from this VM to another. The agent derives managed SG egress/ingress rules. */
+  linkToVirtualMachine: (links: VmPortLink[]) => VirtualMachineComponent; /** Declares SG membership. The agent assigns the VM to the given security group at launch. No settings required. */
+  linkToSecurityGroup: (sgs: SecurityGroupComponent[]) => VirtualMachineComponent;
 };
 type VirtualMachineBuilder = {
   withId: (id: string) => VirtualMachineBuilder;
@@ -1626,7 +1687,7 @@ type VirtualMachineConfig = {
 };
 declare namespace VirtualMachine {
   const getBuilder: () => VirtualMachineBuilder;
-  const create: (config: VirtualMachineConfig) => VirtualMachineNode;
+  const create: (config: VirtualMachineConfig) => VirtualMachineComponent;
 }
 //#endregion
 //#region src/fractal/component/custom_workloads/caas/workload.d.ts
@@ -1635,16 +1696,16 @@ declare namespace VirtualMachine {
  * The agent derives managed SG egress/ingress rules from these.
  */
 type WorkloadPortLink = {
-  target: WorkloadNode;
+  target: WorkloadComponent;
   fromPort: number;
   toPort?: number;
   protocol?: string;
 };
-type WorkloadNode = {
+type WorkloadComponent = {
   readonly component: BlueprintComponent;
-  readonly components: ReadonlyArray<BlueprintComponent>;
-  withLinks: (links: WorkloadPortLink[]) => WorkloadNode;
-  withSecurityGroups: (sgs: BlueprintComponent[]) => WorkloadNode;
+  readonly components: ReadonlyArray<BlueprintComponent>; /** Declares a traffic rule from this workload to another. The agent derives managed SG egress/ingress rules. */
+  linkToWorkload: (links: WorkloadPortLink[]) => WorkloadComponent; /** Declares SG membership. The agent assigns the workload to the given security group at launch. No settings required. */
+  linkToSecurityGroup: (sgs: SecurityGroupComponent[]) => WorkloadComponent;
 };
 type WorkloadBuilder = {
   withId: (id: string) => WorkloadBuilder;
@@ -1677,17 +1738,17 @@ type WorkloadConfig = {
 };
 declare namespace Workload {
   const getBuilder: () => WorkloadBuilder;
-  const create: (config: WorkloadConfig) => WorkloadNode;
+  const create: (config: WorkloadConfig) => WorkloadComponent;
 }
 //#endregion
 //#region src/fractal/component/network_and_compute/iaas/subnet.d.ts
-type SubnetNode = {
+type SubnetComponent = {
   readonly subnet: BlueprintComponent;
   readonly virtualMachines: ReadonlyArray<BlueprintComponent>;
   readonly workloads: ReadonlyArray<BlueprintComponent>;
   readonly components: ReadonlyArray<BlueprintComponent>;
-  withVirtualMachines: (vms: VirtualMachineNode[]) => SubnetNode;
-  withWorkloads: (workloads: ReadonlyArray<WorkloadNode>) => SubnetNode;
+  withVirtualMachines: (vms: VirtualMachineComponent[]) => SubnetComponent;
+  withWorkloads: (workloads: ReadonlyArray<WorkloadComponent>) => SubnetComponent;
 };
 type SubnetResult = {
   readonly subnet: BlueprintComponent;
@@ -1717,52 +1778,19 @@ type SubnetConfig = {
 };
 declare namespace Subnet {
   const getBuilder: () => SubnetBuilder;
-  const create: (config: SubnetConfig) => SubnetNode;
-}
-//#endregion
-//#region src/fractal/component/network_and_compute/iaas/security_group.d.ts
-type IngressRule = {
-  protocol?: string;
-  fromPort: number;
-  toPort?: number;
-  sourceCidr?: string;
-  sourceGroupId?: string;
-};
-type SecurityGroupBuilder = {
-  withId: (id: string) => SecurityGroupBuilder;
-  withVersion: (major: number, minor: number, patch: number) => SecurityGroupBuilder;
-  withDisplayName: (displayName: string) => SecurityGroupBuilder;
-  withDescription: (description: string) => SecurityGroupBuilder;
-  withIngressRules: (rules: IngressRule[]) => SecurityGroupBuilder;
-  withLinks: (links: ComponentLink[]) => SecurityGroupBuilder;
-  build: () => BlueprintComponent;
-};
-type SecurityGroupConfig = {
-  id: string;
-  version: {
-    major: number;
-    minor: number;
-    patch: number;
-  };
-  displayName: string;
-  description: string;
-  ingressRules?: IngressRule[];
-};
-declare namespace SecurityGroup {
-  const getBuilder: () => SecurityGroupBuilder;
-  const create: (config: SecurityGroupConfig) => BlueprintComponent;
+  const create: (config: SubnetConfig) => SubnetComponent;
 }
 //#endregion
 //#region src/fractal/component/network_and_compute/iaas/virtual_network.d.ts
-type VirtualNetworkNode = {
+type VirtualNetworkComponent = {
   readonly vpc: BlueprintComponent;
   readonly subnets: ReadonlyArray<BlueprintComponent>;
   readonly securityGroups: ReadonlyArray<BlueprintComponent>;
   readonly virtualMachines: ReadonlyArray<BlueprintComponent>;
   readonly workloads: ReadonlyArray<BlueprintComponent>;
   readonly components: ReadonlyArray<BlueprintComponent>;
-  withSubnets: (subnets: SubnetNode[]) => VirtualNetworkNode;
-  withSecurityGroups: (sgs: BlueprintComponent[]) => VirtualNetworkNode;
+  withSubnets: (subnets: SubnetComponent[]) => VirtualNetworkComponent;
+  withSecurityGroups: (sgs: BlueprintComponent[]) => VirtualNetworkComponent;
 };
 type VirtualNetworkResult = {
   readonly vpc: BlueprintComponent;
@@ -1796,7 +1824,7 @@ type VirtualNetworkConfig = {
 };
 declare namespace VirtualNetwork {
   const getBuilder: () => VirtualNetworkBuilder;
-  const create: (config: VirtualNetworkConfig) => VirtualNetworkNode;
+  const create: (config: VirtualNetworkConfig) => VirtualNetworkComponent;
 }
 //#endregion
 //#region src/live_system/component/network_and_compute/iaas/vpc.d.ts
@@ -2626,14 +2654,14 @@ declare namespace HetznerServer {
 }
 //#endregion
 //#region src/fractal/component/network_and_compute/paas/container_platform.d.ts
-type ContainerPlatformNode = {
+type ContainerPlatformComponent = {
   readonly platform: BlueprintComponent;
   /**
    * Workload nodes with the platform dependency auto-wired into each component.
    * Pass these to Subnet.withWorkloads() so the subnet dep is stacked on top.
    */
-  readonly workloads: ReadonlyArray<WorkloadNode>;
-  withWorkloads: (workloads: WorkloadNode[]) => ContainerPlatformNode;
+  readonly workloads: ReadonlyArray<WorkloadComponent>;
+  withWorkloads: (workloads: WorkloadComponent[]) => ContainerPlatformComponent;
 };
 type ContainerPlatformBuilder = {
   withId: (id: string) => ContainerPlatformBuilder;
@@ -2654,7 +2682,7 @@ type ContainerPlatformConfig = {
 };
 declare namespace ContainerPlatform {
   const getBuilder: () => ContainerPlatformBuilder;
-  const create: (config: ContainerPlatformConfig) => ContainerPlatformNode;
+  const create: (config: ContainerPlatformConfig) => ContainerPlatformComponent;
 }
 //#endregion
 //#region src/live_system/component/network_and_compute/paas/ecs_cluster.d.ts
@@ -2755,11 +2783,17 @@ declare namespace AwsEcsTaskDefinition {
 /**
  * Returned by satisfy() — all structural properties (dependencies, links,
  * desiredCount) are locked from the blueprint. Only AWS-specific launch
- * parameters are set here.
+ * parameters and live-system sub-component dependencies are set here.
  */
 type SatisfiedAwsEcsServiceBuilder = {
   withLaunchType: (type: string) => SatisfiedAwsEcsServiceBuilder;
   withAssignPublicIp: (assign: boolean) => SatisfiedAwsEcsServiceBuilder;
+  /**
+   * Declares a live-system-only dependency on the ECS Task Definition that
+   * this service will run. This has no blueprint equivalent — it is an
+   * AWS-specific sub-component relationship.
+   */
+  withTaskDefinition: (taskDef: LiveSystemComponent) => SatisfiedAwsEcsServiceBuilder;
   build: () => LiveSystemComponent;
 };
 type AwsEcsServiceBuilder = {
@@ -2787,6 +2821,12 @@ type AwsEcsServiceConfig = {
 };
 declare namespace AwsEcsService {
   const getBuilder: () => AwsEcsServiceBuilder;
+  /**
+   * Satisfies a blueprint Workload component as an AWS ECS Service.
+   * All structural properties — dependencies (subnet, cluster), links
+   * (traffic rules, SG membership), and desiredCount — are carried from
+   * the blueprint unchanged. Only AWS-specific launch parameters are added here.
+   */
   /**
    * Satisfies a blueprint Workload component as an AWS ECS Service.
    * All structural properties — dependencies (subnet, cluster), links
@@ -2825,4 +2865,4 @@ type Environment = Environment$1;
 declare const LiveSystem: typeof LiveSystem$1;
 type LiveSystem = LiveSystem$1;
 //#endregion
-export { AwsEcsCluster, type AwsEcsClusterBuilder, type AwsEcsClusterConfig, AwsEcsService, type AwsEcsServiceBuilder, type AwsEcsServiceConfig, AwsEcsTaskDefinition, type AwsEcsTaskDefinitionBuilder, type AwsEcsTaskDefinitionConfig, AwsSecurityGroup, type AwsSecurityGroupBuilder, type AwsSecurityGroupConfig, AwsSubnet, type AwsSubnetBuilder, type AwsSubnetConfig, AwsVpc, type AwsVpcBuilder, type AwsVpcConfig, AzureNsg, type AzureNsgBuilder, type AzureNsgConfig, AzureSubnet, type AzureSubnetBuilder, type AzureSubnetConfig, AzureVm, type AzureVmBuilder, type AzureVmConfig, AzureVnet, type AzureVnetBuilder, type AzureVnetConfig, BoundedContext, ContainerPlatform, type ContainerPlatformBuilder, type ContainerPlatformConfig, type ContainerPlatformNode, Ec2Instance, type Ec2InstanceBuilder, type Ec2InstanceConfig, Environment, Fractal, GcpFirewall, type GcpFirewallBuilder, type GcpFirewallConfig, GcpSubnet, type GcpSubnetBuilder, type GcpSubnetConfig, GcpVm, type GcpVmBuilder, type GcpVmConfig, GcpVpc, type GcpVpcBuilder, type GcpVpcConfig, HetznerFirewall, type HetznerFirewallBuilder, type HetznerFirewallConfig, HetznerNetwork, type HetznerNetworkBuilder, type HetznerNetworkConfig, HetznerServer, type HetznerServerBuilder, type HetznerServerConfig, HetznerSubnet, type HetznerSubnetBuilder, type HetznerSubnetConfig, InfrastructureDomain, type IngressRule, KebabCaseString, LiveSystem, OciInstance, type OciInstanceBuilder, type OciInstanceConfig, OciSecurityList, type OciSecurityListBuilder, type OciSecurityListConfig, OciSubnet, type OciSubnetBuilder, type OciSubnetConfig, OciVcn, type OciVcnBuilder, type OciVcnConfig, OwnerId, OwnerType, PascalCaseString, type SatisfiedAwsEcsClusterBuilder, type SatisfiedAwsEcsServiceBuilder, type SatisfiedAwsEcsTaskDefinitionBuilder, type SatisfiedAwsSecurityGroupBuilder, type SatisfiedAwsSubnetBuilder, type SatisfiedAwsVpcBuilder, type SatisfiedAzureNsgBuilder, type SatisfiedAzureSubnetBuilder, type SatisfiedAzureVmBuilder, type SatisfiedAzureVnetBuilder, type SatisfiedEc2Builder, type SatisfiedGcpFirewallBuilder, type SatisfiedGcpSubnetBuilder, type SatisfiedGcpVmBuilder, type SatisfiedGcpVpcBuilder, type SatisfiedHetznerFirewallBuilder, type SatisfiedHetznerNetworkBuilder, type SatisfiedHetznerServerBuilder, type SatisfiedHetznerSubnetBuilder, type SatisfiedOciInstanceBuilder, type SatisfiedOciSecurityListBuilder, type SatisfiedOciSubnetBuilder, type SatisfiedOciVcnBuilder, SecurityGroup, type SecurityGroupBuilder, type SecurityGroupConfig, ServiceAccountCredentials, ServiceAccountId, ServiceDeliveryModel, Subnet, type SubnetBuilder, type SubnetConfig, type SubnetNode, type SubnetResult, Version, VirtualMachine, type VirtualMachineBuilder, type VirtualMachineConfig, type VirtualMachineNode, VirtualNetwork, type VirtualNetworkBuilder, type VirtualNetworkConfig, type VirtualNetworkNode, type VirtualNetworkResult, type VmPortLink, Workload, type WorkloadBuilder, type WorkloadConfig, type WorkloadNode, type WorkloadPortLink };
+export { AwsEcsCluster, type AwsEcsClusterBuilder, type AwsEcsClusterConfig, AwsEcsService, type AwsEcsServiceBuilder, type AwsEcsServiceConfig, AwsEcsTaskDefinition, type AwsEcsTaskDefinitionBuilder, type AwsEcsTaskDefinitionConfig, AwsSecurityGroup, type AwsSecurityGroupBuilder, type AwsSecurityGroupConfig, AwsSubnet, type AwsSubnetBuilder, type AwsSubnetConfig, AwsVpc, type AwsVpcBuilder, type AwsVpcConfig, AzureNsg, type AzureNsgBuilder, type AzureNsgConfig, AzureSubnet, type AzureSubnetBuilder, type AzureSubnetConfig, AzureVm, type AzureVmBuilder, type AzureVmConfig, AzureVnet, type AzureVnetBuilder, type AzureVnetConfig, BoundedContext, ContainerPlatform, type ContainerPlatformBuilder, type ContainerPlatformComponent, type ContainerPlatformConfig, Ec2Instance, type Ec2InstanceBuilder, type Ec2InstanceConfig, Environment, Fractal, GcpFirewall, type GcpFirewallBuilder, type GcpFirewallConfig, GcpSubnet, type GcpSubnetBuilder, type GcpSubnetConfig, GcpVm, type GcpVmBuilder, type GcpVmConfig, GcpVpc, type GcpVpcBuilder, type GcpVpcConfig, HetznerFirewall, type HetznerFirewallBuilder, type HetznerFirewallConfig, HetznerNetwork, type HetznerNetworkBuilder, type HetznerNetworkConfig, HetznerServer, type HetznerServerBuilder, type HetznerServerConfig, HetznerSubnet, type HetznerSubnetBuilder, type HetznerSubnetConfig, InfrastructureDomain, type IngressRule, KebabCaseString, LiveSystem, OciInstance, type OciInstanceBuilder, type OciInstanceConfig, OciSecurityList, type OciSecurityListBuilder, type OciSecurityListConfig, OciSubnet, type OciSubnetBuilder, type OciSubnetConfig, OciVcn, type OciVcnBuilder, type OciVcnConfig, OwnerId, OwnerType, PascalCaseString, type SatisfiedAwsEcsClusterBuilder, type SatisfiedAwsEcsServiceBuilder, type SatisfiedAwsEcsTaskDefinitionBuilder, type SatisfiedAwsSecurityGroupBuilder, type SatisfiedAwsSubnetBuilder, type SatisfiedAwsVpcBuilder, type SatisfiedAzureNsgBuilder, type SatisfiedAzureSubnetBuilder, type SatisfiedAzureVmBuilder, type SatisfiedAzureVnetBuilder, type SatisfiedEc2Builder, type SatisfiedGcpFirewallBuilder, type SatisfiedGcpSubnetBuilder, type SatisfiedGcpVmBuilder, type SatisfiedGcpVpcBuilder, type SatisfiedHetznerFirewallBuilder, type SatisfiedHetznerNetworkBuilder, type SatisfiedHetznerServerBuilder, type SatisfiedHetznerSubnetBuilder, type SatisfiedOciInstanceBuilder, type SatisfiedOciSecurityListBuilder, type SatisfiedOciSubnetBuilder, type SatisfiedOciVcnBuilder, SecurityGroup, type SecurityGroupBuilder, type SecurityGroupComponent, type SecurityGroupConfig, ServiceAccountCredentials, ServiceAccountId, ServiceDeliveryModel, Subnet, type SubnetBuilder, type SubnetComponent, type SubnetConfig, type SubnetResult, Version, VirtualMachine, type VirtualMachineBuilder, type VirtualMachineComponent, type VirtualMachineConfig, VirtualNetwork, type VirtualNetworkBuilder, type VirtualNetworkComponent, type VirtualNetworkConfig, type VirtualNetworkResult, type VmPortLink, Workload, type WorkloadBuilder, type WorkloadComponent, type WorkloadConfig, type WorkloadPortLink };