@fractal_cloud/sdk 1.5.2 → 2.0.0

package/dist/model/index.mjs

@@ -0,0 +1,1248 @@
+import superagent from "superagent";
+
+//#region src/model/core.ts
+/** Build an offer constructor (pure). Default instantiate merges neutral params + vendor config. */
+const defineOffer = (spec) => (config) => ({
+	satisfies: spec.satisfies,
+	offerType: spec.offerType,
+	provider: spec.provider,
+	deliveryModel: spec.deliveryModel,
+	config,
+	instantiate: (ctx) => spec.instantiate ? spec.instantiate(ctx, config) : [{
+		id: ctx.id,
+		type: spec.offerType,
+		provider: spec.provider,
+		deliveryModel: spec.deliveryModel,
+		parameters: {
+			...ctx.parameters,
+			...config
+		},
+		dependencies: ctx.dependencies,
+		links: ctx.links
+	}]
+});
+/** Authoring primitive: create a fresh node for a Component factory. */
+const newNode = (id, component) => ({
+	id,
+	component,
+	parameters: {},
+	locked: /* @__PURE__ */ new Set(),
+	dependencies: []
+});
+/** Authoring primitive: set a neutral param AND lock it (guardrail, design time). */
+const guardrail = (s, key, value) => ({
+	...s,
+	parameters: {
+		...s.parameters,
+		[key]: value
+	},
+	locked: new Set([...s.locked, key])
+});
+/** Authoring primitive: declare a structural dependency on another node. */
+const addDependency = (s, depId) => ({
+	...s,
+	dependencies: [...s.dependencies, depId]
+});
+/** Collect the links a component is the source of, in wire shape. */
+const linksFor = (st, sourceId) => st.links.filter((l) => l.sourceId === sourceId).map((l) => ({
+	componentId: l.targetId,
+	settings: l.settings
+}));
+const ensureUnlocked = (node, key) => {
+	if (node.locked.has(key)) throw new Error(`Parameter '${key}' on '${node.id}' is a locked guardrail and cannot be changed.`);
+};
+const setOpen = (st, id, key, value) => {
+	const node = st.nodes[id];
+	ensureUnlocked(node, key);
+	return {
+		...st,
+		nodes: {
+			...st.nodes,
+			[id]: {
+				...node,
+				parameters: {
+					...node.parameters,
+					[key]: value
+				}
+			}
+		}
+	};
+};
+const appendOpen = (st, id, key, value) => {
+	const node = st.nodes[id];
+	ensureUnlocked(node, key);
+	const prev = node.parameters[key] ?? [];
+	return {
+		...st,
+		nodes: {
+			...st.nodes,
+			[id]: {
+				...node,
+				parameters: {
+					...node.parameters,
+					[key]: [...prev, value]
+				}
+			}
+		}
+	};
+};
+const addChild = (st, parentId, child) => ({
+	...st,
+	children: {
+		...st.children,
+		[parentId]: [...st.children[parentId] ?? [], child]
+	}
+});
+const slotOps = (id) => ({
+	set: (k, v) => (st) => setOpen(st, id, k, v),
+	append: (k, v) => (st) => appendOpen(st, id, k, v),
+	addChild: (child) => (st) => addChild(st, id, child.state)
+});
+/** Collect a parent's child components in instantiation-context shape. */
+const childrenFor = (st, parentId) => (st.children[parentId] ?? []).map((c) => ({
+	id: c.id,
+	parameters: { ...c.parameters },
+	dependencies: [...c.dependencies, parentId],
+	links: linksFor(st, c.id)
+}));
+const serialize = (st) => ({
+	fractalId: st.fractalId,
+	components: st.order.map((id) => {
+		const n = st.nodes[id];
+		return {
+			id,
+			component: n.component,
+			parameters: { ...n.parameters },
+			locked: [...n.locked],
+			dependencies: [...n.dependencies],
+			links: linksFor(st, id)
+		};
+	})
+});
+const toLiveSystem = (st, args) => {
+	const validIds = new Set(st.order);
+	for (const key of Object.keys(args.select)) if (!validIds.has(key)) throw new Error(`Selection key '${key}' does not match any component in the fractal. Valid components: ${st.order.join(", ")}.`);
+	const components = [];
+	for (const id of st.order) {
+		const node = st.nodes[id];
+		const offer = args.select[id];
+		if (!offer) throw new Error(`Missing offer selection for component '${id}'.`);
+		if (offer.satisfies !== node.component) throw new Error(`Offer '${offer.offerType}' does not satisfy component '${node.component}' (selected for '${id}').`);
+		const children = childrenFor(st, id);
+		const emitted = offer.instantiate({
+			id,
+			parameters: { ...node.parameters },
+			dependencies: node.dependencies,
+			links: linksFor(st, id),
+			children
+		});
+		if (children.length > 0) {
+			const emittedIds = new Set(emitted.map((c) => c.id));
+			const dropped = children.filter((c) => !emittedIds.has(c.id));
+			if (dropped.length > 0) throw new Error(`Offer '${offer.offerType}' selected for '${id}' does not emit its child component(s) [${dropped.map((c) => c.id).join(", ")}]. The selected offer must support child components (e.g. databases added via an operation).`);
+		}
+		components.push(...emitted);
+	}
+	return {
+		name: args.name,
+		fractalId: st.fractalId,
+		fractalName: st.fractalName,
+		version: st.version,
+		boundedContext: st.boundedContext,
+		environment: args.environment,
+		components
+	};
+};
+const fluent = (ops, st) => {
+	const api = {
+		value: st,
+		blueprint: serialize(st),
+		toLiveSystem: (args) => toLiveSystem(st, args)
+	};
+	for (const k of Object.keys(ops)) api[k] = (...args) => fluent(ops, ops[k](...args)(st));
+	return api;
+};
+function createFractal(def) {
+	const order = [];
+	const linkRecords = [];
+	const slots = def.blueprint({
+		add: (n) => {
+			order.push(n.state.id);
+			return n;
+		},
+		link: (source, target, settings = {}) => {
+			linkRecords.push({
+				sourceId: source.state.id,
+				targetId: target.state.id,
+				settings
+			});
+		}
+	});
+	const nodes = {};
+	const slotToId = {};
+	for (const key of Object.keys(slots)) {
+		const node = slots[key];
+		nodes[node.state.id] = node.state;
+		slotToId[key] = node.state.id;
+	}
+	const fractalId = `${def.id}:${def.version.major}.${def.version.minor}.${def.version.patch}`;
+	const state = {
+		fractalId,
+		fractalName: def.id,
+		version: def.version,
+		boundedContext: def.boundedContextId,
+		nodes,
+		order,
+		links: linkRecords,
+		children: {}
+	};
+	const slotOpsMap = {};
+	for (const key of Object.keys(slotToId)) slotOpsMap[key] = slotOps(slotToId[key]);
+	const ops = def.operations ? def.operations(slotOpsMap) : {};
+	return {
+		fractalId,
+		blueprint: serialize(state),
+		ops,
+		specialize: () => fluent(ops, state),
+		toLiveSystem: (args) => toLiveSystem(state, args)
+	};
+}
+
+//#endregion
+//#region src/model/service.ts
+/**
+* service.ts — deploy a model LiveSystem to the Fractal Cloud API.
+*
+* Self-contained (the interim SDK service is unproven and not reused). Builds the
+* API payload from the model LiveSystem, submits (create or update), and — in
+* `wait` mode — polls to Active, emitting the canonical SDK wait-mode log lines
+* (see ~/Projects/CLAUDE.md "SDK — Wait Mode Log Format").
+*
+* NOTE: not runtime-verified here (no Fractal Cloud credentials) — covered by
+* mocked-HTTP unit tests in service.test.ts; smoke against the live API with real
+* credentials before release.
+*/
+const FRACTAL_API_URL = "https://api.fractal.cloud";
+const CLIENT_ID_HEADER = "X-ClientID";
+const CLIENT_SECRET_HEADER = "X-ClientSecret";
+const DEFAULT_POLL_INTERVAL_MS = 5e3;
+const DEFAULT_TIMEOUT_MS = 6e5;
+const TERMINAL_FAILURE_STATUSES = ["FailedMutation", "Error"];
+const bcString = (bc) => `${bc.ownerType ?? "Personal"}/${bc.ownerId ?? ""}/${bc.name ?? ""}`;
+const liveSystemId = (ls) => `${bcString(ls.boundedContext)}/${ls.name}`;
+const fractalApiId = (ls) => `${bcString(ls.boundedContext)}/${ls.fractalName}:${ls.version.major}.${ls.version.minor}.${ls.version.patch}`;
+const buildBody = (ls) => ({
+	liveSystemId: liveSystemId(ls),
+	fractalId: fractalApiId(ls),
+	blueprintMap: ls.components.reduce((acc, c) => {
+		acc[c.id] = {
+			type: c.type,
+			id: c.id,
+			provider: c.provider,
+			deliveryModel: c.deliveryModel,
+			parameters: c.parameters,
+			dependencies: [...c.dependencies],
+			links: c.links.map((l) => ({
+				componentId: l.componentId,
+				settings: l.settings
+			}))
+		};
+		return acc;
+	}, {}),
+	environment: {
+		id: {
+			type: ls.environment.ownerType ?? "Personal",
+			ownerId: ls.environment.ownerId ?? "",
+			shortName: ls.environment.name ?? ""
+		},
+		parameters: {}
+	}
+});
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const authHeaders = (c) => ({
+	[CLIENT_ID_HEADER]: c.clientId,
+	[CLIENT_SECRET_HEADER]: c.clientSecret
+});
+const log = (quiet, level, message, fields = {}) => {
+	if (quiet) return;
+	const ts = (/* @__PURE__ */ new Date()).toISOString();
+	const fieldStr = Object.entries(fields).map(([k, v]) => `${k}=${v}`).join(" ");
+	console.log(`[${ts}] ${level.padEnd(5)} ${message}${fieldStr ? "  " + fieldStr : ""}`);
+};
+const elapsedSec = (startMs) => `${Math.round((Date.now() - startMs) / 1e3)}s`;
+const submit = async (ls, creds) => {
+	const url = `${FRACTAL_API_URL}/livesystems/${liveSystemId(ls)}`;
+	const existing = await superagent.get(url).ok((res) => res.status === 200 || res.status === 404).set(authHeaders(creds));
+	const body = buildBody(ls);
+	if (existing.status === 200) await superagent.put(url).set(authHeaders(creds)).send(body);
+	else await superagent.post(`${FRACTAL_API_URL}/livesystems`).set(authHeaders(creds)).send(body);
+};
+const getStatus = async (id, creds) => {
+	return (await superagent.get(`${FRACTAL_API_URL}/livesystems/${id}`).set(authHeaders(creds))).body.status;
+};
+const pollUntilActive = async (ls, creds, opts, startMs) => {
+	const quiet = opts.quiet ?? false;
+	const interval = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+	const deadline = Date.now() + (opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+	const id = liveSystemId(ls);
+	let round = 0;
+	while (Date.now() < deadline) {
+		await sleep(interval);
+		round++;
+		let status;
+		try {
+			status = await getStatus(id, creds);
+		} catch (err) {
+			const code = err.status;
+			if (code !== void 0 && code >= 400 && code < 500) {
+				log(quiet, "ERROR", "Fatal error polling Live System status", {
+					system: id,
+					round,
+					elapsed: elapsedSec(startMs)
+				});
+				throw err;
+			}
+			log(quiet, "WARN", "Transient error polling status, retrying", {
+				system: id,
+				round,
+				elapsed: elapsedSec(startMs)
+			});
+			continue;
+		}
+		if (status === "Active") return;
+		if (TERMINAL_FAILURE_STATUSES.includes(status)) {
+			log(quiet, "ERROR", "Live System deployment failed", {
+				system: id,
+				status,
+				elapsed: elapsedSec(startMs)
+			});
+			throw new Error(`Live system deployment failed with status: ${status}`);
+		}
+		log(quiet, "CHECK", "Polling Live System status", {
+			system: id,
+			round,
+			status,
+			elapsed: elapsedSec(startMs)
+		});
+	}
+	log(quiet, "ERROR", "Live System deployment timed out", {
+		system: id,
+		elapsed: elapsedSec(startMs),
+		timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS
+	});
+	throw new Error("Live system deployment timed out");
+};
+/** Deploy (create or update) a LiveSystem. `fire-and-forget` submits and returns;
+*  `wait` polls until Active (or failure/timeout) emitting wait-mode log lines. */
+async function deploy(ls, creds, opts = { mode: "fire-and-forget" }) {
+	if (opts.mode === "fire-and-forget") {
+		await submit(ls, creds);
+		return;
+	}
+	const quiet = opts.quiet ?? false;
+	const startMs = Date.now();
+	log(quiet, "INFO", "Deploying Live System", {
+		system: liveSystemId(ls),
+		fractal: fractalApiId(ls)
+	});
+	await submit(ls, creds);
+	await pollUntilActive(ls, creds, opts, startMs);
+	log(quiet, "INFO", "Live System Active", {
+		system: liveSystemId(ls),
+		elapsed: elapsedSec(startMs)
+	});
+}
+/** Destroy a deployed LiveSystem. */
+async function destroy(ls, creds) {
+	await superagent.delete(`${FRACTAL_API_URL}/livesystems/${liveSystemId(ls)}`).set(authHeaders(creds));
+}
+
+//#endregion
+//#region src/model/components/network_and_compute.ts
+/**
+* components/network_and_compute.ts — NetworkAndCompute Component factories.
+*
+* Each agnostic blueprint parameter is a typed `.withXxx()` guardrail setter
+* (locked at design time). Components that can sit under another expose
+* `dependsOn(other)` to declare a structural dependency. Vendor knobs do NOT
+* live here — they belong on Offers (see offers/network_and_compute.ts).
+*/
+const virtualNetworkNode = (s) => ({
+	state: s,
+	withCidrBlock: (v) => virtualNetworkNode(guardrail(s, "cidrBlock", v)),
+	withRegion: (v) => virtualNetworkNode(guardrail(s, "region", v)),
+	withTags: (v) => virtualNetworkNode(guardrail(s, "tags", v))
+});
+const VirtualNetwork = (cfg) => virtualNetworkNode(newNode(cfg.id, "NetworkAndCompute.VirtualNetwork"));
+const subnetNode = (s) => ({
+	state: s,
+	withCidrBlock: (v) => subnetNode(guardrail(s, "cidrBlock", v)),
+	dependsOn: (other) => subnetNode(addDependency(s, other.state.id))
+});
+const Subnet = (cfg) => subnetNode(newNode(cfg.id, "NetworkAndCompute.Subnet"));
+const securityGroupNode = (s) => ({
+	state: s,
+	withIngressRules: (v) => securityGroupNode(guardrail(s, "ingressRules", v)),
+	withEgressRules: (v) => securityGroupNode(guardrail(s, "egressRules", v)),
+	dependsOn: (other) => securityGroupNode(addDependency(s, other.state.id))
+});
+const SecurityGroup = (cfg) => securityGroupNode(newNode(cfg.id, "NetworkAndCompute.SecurityGroup"));
+const virtualMachineNode = (s) => ({
+	state: s,
+	withOsType: (v) => virtualMachineNode(guardrail(s, "osType", v)),
+	withSize: (v) => virtualMachineNode(guardrail(s, "size", v)),
+	withTags: (v) => virtualMachineNode(guardrail(s, "tags", v)),
+	dependsOn: (other) => virtualMachineNode(addDependency(s, other.state.id))
+});
+const VirtualMachine = (cfg) => virtualMachineNode(newNode(cfg.id, "NetworkAndCompute.VirtualMachine"));
+const containerPlatformNode = (s) => ({
+	state: s,
+	withNodePools: (v) => containerPlatformNode(guardrail(s, "nodePools", v)),
+	withKubernetesVersion: (v) => containerPlatformNode(guardrail(s, "kubernetesVersion", v)),
+	withNetworkPolicyProvider: (v) => containerPlatformNode(guardrail(s, "networkPolicyProvider", v)),
+	dependsOn: (other) => containerPlatformNode(addDependency(s, other.state.id))
+});
+const ContainerPlatform = (cfg) => containerPlatformNode(newNode(cfg.id, "NetworkAndCompute.ContainerPlatform"));
+const loadBalancerNode = (s) => ({
+	state: s,
+	withScheme: (v) => loadBalancerNode(guardrail(s, "scheme", v)),
+	dependsOn: (other) => loadBalancerNode(addDependency(s, other.state.id))
+});
+const LoadBalancer = (cfg) => loadBalancerNode(newNode(cfg.id, "NetworkAndCompute.LoadBalancer"));
+
+//#endregion
+//#region src/model/components/storage.ts
+/**
+* components/storage.ts — Storage domain Component factories (Level 1).
+*
+* Abstract, vendor-agnostic capability contracts:
+*   - Storage.ObjectStorage
+*   - Storage.RelationalDbms
+*   - Storage.RelationalDatabase
+*
+* Each agnostic parameter is a typed `.withXxx()` guardrail setter (locks the
+* key at design time). Built exclusively on the LOCKED engine in ../core.
+*/
+const objectStorageNode = (s) => ({
+	state: s,
+	withVersioningEnabled: (v) => objectStorageNode(guardrail(s, "versioningEnabled", v)),
+	withStorageClass: (v) => objectStorageNode(guardrail(s, "storageClass", v)),
+	withPublicAccess: (v) => objectStorageNode(guardrail(s, "publicAccess", v)),
+	withEncryption: (v) => objectStorageNode(guardrail(s, "encryption", v)),
+	withRetentionDays: (v) => objectStorageNode(guardrail(s, "retentionDays", v)),
+	withTags: (v) => objectStorageNode(guardrail(s, "tags", v))
+});
+const ObjectStorage = (cfg) => objectStorageNode(newNode(cfg.id, "Storage.ObjectStorage"));
+const relationalDbmsNode = (s) => ({
+	state: s,
+	withEngineVersion: (v) => relationalDbmsNode(guardrail(s, "engineVersion", v)),
+	withSizeTier: (v) => relationalDbmsNode(guardrail(s, "sizeTier", v)),
+	withStorageGb: (v) => relationalDbmsNode(guardrail(s, "storageGb", v)),
+	withBackupRetentionDays: (v) => relationalDbmsNode(guardrail(s, "backupRetentionDays", v)),
+	withHighAvailability: (v) => relationalDbmsNode(guardrail(s, "highAvailability", v))
+});
+const RelationalDbms = (cfg) => relationalDbmsNode(newNode(cfg.id, "Storage.RelationalDbms"));
+const relationalDatabaseNode = (s) => ({
+	state: s,
+	withCharset: (v) => relationalDatabaseNode(guardrail(s, "charset", v)),
+	withCollation: (v) => relationalDatabaseNode(guardrail(s, "collation", v)),
+	dependsOn: (other) => relationalDatabaseNode(addDependency(s, other.state.id))
+});
+const RelationalDatabase = (cfg) => relationalDatabaseNode(newNode(cfg.id, "Storage.RelationalDatabase"));
+
+//#endregion
+//#region src/model/components/big_data.ts
+/**
+* components/big_data.ts — BigData domain Component factories (Level 1, abstract).
+*
+* Each agnostic param is a typed `.withXxx()` guardrail setter (locked at design
+* time via `guardrail`). Structural relationships are declared with `dependsOn`
+* (via `addDependency`). Vendor knobs never appear here — they live on Offers.
+*/
+const computeClusterNode = (s) => ({
+	state: s,
+	withClusterName: (v) => computeClusterNode(guardrail(s, "clusterName", v)),
+	withSparkVersion: (v) => computeClusterNode(guardrail(s, "sparkVersion", v)),
+	withMinWorkers: (v) => computeClusterNode(guardrail(s, "minWorkers", v)),
+	withMaxWorkers: (v) => computeClusterNode(guardrail(s, "maxWorkers", v)),
+	withAutoTerminationMinutes: (v) => computeClusterNode(guardrail(s, "autoTerminationMinutes", v)),
+	withDataSecurityMode: (v) => computeClusterNode(guardrail(s, "dataSecurityMode", v))
+});
+const ComputeCluster = (cfg) => computeClusterNode(newNode(cfg.id, "BigData.ComputeCluster"));
+const dataProcessingJobNode = (s) => ({
+	state: s,
+	withJobName: (v) => dataProcessingJobNode(guardrail(s, "jobName", v)),
+	withTaskType: (v) => dataProcessingJobNode(guardrail(s, "taskType", v)),
+	withCronSchedule: (v) => dataProcessingJobNode(guardrail(s, "cronSchedule", v)),
+	withMaxRetries: (v) => dataProcessingJobNode(guardrail(s, "maxRetries", v)),
+	dependsOn: (other) => dataProcessingJobNode(addDependency(s, other.state.id))
+});
+const DataProcessingJob = (cfg) => dataProcessingJobNode(newNode(cfg.id, "BigData.DataProcessingJob"));
+const mlExperimentNode = (s) => ({
+	state: s,
+	withExperimentName: (v) => mlExperimentNode(guardrail(s, "experimentName", v))
+});
+const MlExperiment = (cfg) => mlExperimentNode(newNode(cfg.id, "BigData.MlExperiment"));
+const datalakeNode = (s) => ({
+	state: s,
+	withRegion: (v) => datalakeNode(guardrail(s, "region", v)),
+	withVersioningEnabled: (v) => datalakeNode(guardrail(s, "versioningEnabled", v)),
+	withRetentionDays: (v) => datalakeNode(guardrail(s, "retentionDays", v))
+});
+const Datalake = (cfg) => datalakeNode(newNode(cfg.id, "BigData.Datalake"));
+const distributedDataProcessingNode = (s) => ({
+	state: s,
+	withWorkspaceName: (v) => distributedDataProcessingNode(guardrail(s, "workspaceName", v))
+});
+const DistributedDataProcessing = (cfg) => distributedDataProcessingNode(newNode(cfg.id, "BigData.DistributedDataProcessing"));
+
+//#endregion
+//#region src/model/components/messaging.ts
+/**
+* components/messaging.ts — Messaging domain Component factories (Level 1).
+*
+* Abstract, vendor-agnostic Components for the locked Fractal model. Agnostic
+* `.withXxx()` setters are GUARDRAILS (locked at design time) via guardrail().
+* Offers that satisfy these Components live in offers/messaging.ts.
+*/
+const brokerNode = (s) => ({
+	state: s,
+	withTier: (v) => brokerNode(guardrail(s, "tier", v)),
+	withRegion: (v) => brokerNode(guardrail(s, "region", v)),
+	withEncryption: (v) => brokerNode(guardrail(s, "encryption", v))
+});
+const Broker = (cfg) => brokerNode(newNode(cfg.id, "Messaging.Broker"));
+const messagingEntityNode = (s) => ({
+	state: s,
+	withMessageRetentionHours: (v) => messagingEntityNode(guardrail(s, "messageRetentionHours", v)),
+	withPartitionCount: (v) => messagingEntityNode(guardrail(s, "partitionCount", v)),
+	withDeadLetterEnabled: (v) => messagingEntityNode(guardrail(s, "deadLetterEnabled", v)),
+	withMaxDeliveryAttempts: (v) => messagingEntityNode(guardrail(s, "maxDeliveryAttempts", v)),
+	dependsOn: (other) => messagingEntityNode(addDependency(s, other.state.id))
+});
+const MessagingEntity = (cfg) => messagingEntityNode(newNode(cfg.id, "Messaging.MessagingEntity"));
+
+//#endregion
+//#region src/model/components/api_management.ts
+/**
+* components/api_management.ts — APIManagement Component factories.
+*
+* Each agnostic blueprint parameter is a typed `.withXxx()` guardrail setter
+* (locked at design time). Vendor knobs do NOT live here — they belong on
+* Offers (see offers/api_management.ts).
+*/
+const apiGatewayNode = (s) => ({
+	state: s,
+	withHttpsOnly: (v) => apiGatewayNode(guardrail(s, "httpsOnly", v)),
+	withCustomDomain: (v) => apiGatewayNode(guardrail(s, "customDomain", v)),
+	withCors: (v) => apiGatewayNode(guardrail(s, "cors", v)),
+	withRateLimit: (v) => apiGatewayNode(guardrail(s, "rateLimit", v)),
+	withRoutes: (v) => apiGatewayNode(guardrail(s, "routes", v))
+});
+const ApiGateway = (cfg) => apiGatewayNode(newNode(cfg.id, "APIManagement.ApiGateway"));
+
+//#endregion
+//#region src/model/components/observability.ts
+/**
+* components/observability.ts — Observability domain Component factories (Level 1).
+*
+* Abstract, vendor-agnostic capability contracts:
+*   - Observability.Monitoring
+*   - Observability.Tracing
+*   - Observability.Logging
+*
+* Each agnostic parameter is a typed `.withXxx()` guardrail setter (locks the
+* key at design time). Built exclusively on the LOCKED engine in ../core.
+*/
+const monitoringNode = (s) => ({
+	state: s,
+	withRetentionDays: (v) => monitoringNode(guardrail(s, "retentionDays", v)),
+	withScrapeInterval: (v) => monitoringNode(guardrail(s, "scrapeInterval", v))
+});
+const Monitoring = (cfg) => monitoringNode(newNode(cfg.id, "Observability.Monitoring"));
+const tracingNode = (s) => ({
+	state: s,
+	withRetentionDays: (v) => tracingNode(guardrail(s, "retentionDays", v)),
+	withSamplingRate: (v) => tracingNode(guardrail(s, "samplingRate", v))
+});
+const Tracing = (cfg) => tracingNode(newNode(cfg.id, "Observability.Tracing"));
+const loggingNode = (s) => ({
+	state: s,
+	withRetentionDays: (v) => loggingNode(guardrail(s, "retentionDays", v))
+});
+const Logging = (cfg) => loggingNode(newNode(cfg.id, "Observability.Logging"));
+
+//#endregion
+//#region src/model/components/security.ts
+/**
+* components/security.ts — Security domain Component factories (Level 1).
+*
+* Abstract, vendor-agnostic capability contracts:
+*   - Security.ServiceMesh
+*   - Security.IdentityProvider
+*
+* Each agnostic parameter is a typed `.withXxx()` guardrail setter (locks the
+* key at design time). Built exclusively on the LOCKED engine in ../core.
+*/
+const serviceMeshNode = (s) => ({
+	state: s,
+	withMtlsMode: (v) => serviceMeshNode(guardrail(s, "mtlsMode", v)),
+	withAuthenticationMode: (v) => serviceMeshNode(guardrail(s, "authenticationMode", v)),
+	withTags: (v) => serviceMeshNode(guardrail(s, "tags", v))
+});
+const ServiceMesh = (cfg) => serviceMeshNode(newNode(cfg.id, "Security.ServiceMesh"));
+const identityProviderNode = (s) => ({
+	state: s,
+	withUserDirectoryName: (v) => identityProviderNode(guardrail(s, "userDirectoryName", v)),
+	withPasswordPolicy: (v) => identityProviderNode(guardrail(s, "passwordPolicy", v)),
+	withMfaConfiguration: (v) => identityProviderNode(guardrail(s, "mfaConfiguration", v)),
+	withSessionDuration: (v) => identityProviderNode(guardrail(s, "sessionDuration", v)),
+	withTags: (v) => identityProviderNode(guardrail(s, "tags", v))
+});
+const IdentityProvider = (cfg) => identityProviderNode(newNode(cfg.id, "Security.IdentityProvider"));
+
+//#endregion
+//#region src/model/components/custom_workloads.ts
+/**
+* components/custom_workloads.ts — CustomWorkloads domain Component factories
+* (Level 1, abstract).
+*
+* Each agnostic param is a typed `.withXxx()` guardrail setter (locked at design
+* time via `guardrail`). Vendor knobs never appear here — they live on Offers.
+*/
+const workloadNode = (s) => ({
+	state: s,
+	withImage: (v) => workloadNode(guardrail(s, "image", v)),
+	withPort: (v) => workloadNode(guardrail(s, "port", v)),
+	withReplicas: (v) => workloadNode(guardrail(s, "replicas", v)),
+	withEnv: (v) => workloadNode(guardrail(s, "env", v)),
+	withCpuRequest: (v) => workloadNode(guardrail(s, "cpuRequest", v)),
+	withMemoryRequest: (v) => workloadNode(guardrail(s, "memoryRequest", v)),
+	withMaxReplicas: (v) => workloadNode(guardrail(s, "maxReplicas", v)),
+	withHealthCheck: (v) => workloadNode(guardrail(s, "healthCheck", v))
+});
+const Workload = (cfg) => workloadNode(newNode(cfg.id, "CustomWorkloads.Workload"));
+const functionNode = (s) => ({
+	state: s,
+	withSourceArtifact: (v) => functionNode(guardrail(s, "sourceArtifact", v)),
+	withRuntime: (v) => functionNode(guardrail(s, "runtime", v)),
+	withEnvironment: (v) => functionNode(guardrail(s, "environment", v)),
+	withMemory: (v) => functionNode(guardrail(s, "memory", v)),
+	withTimeout: (v) => functionNode(guardrail(s, "timeout", v)),
+	withConcurrency: (v) => functionNode(guardrail(s, "concurrency", v))
+});
+const Function = (cfg) => functionNode(newNode(cfg.id, "CustomWorkloads.Function"));
+
+//#endregion
+//#region src/model/offers/network_and_compute.ts
+/**
+* offers/network_and_compute.ts — NetworkAndCompute Offer catalogue (Level 3).
+*
+* Each offer declares which abstract Component it satisfies, its 3-part offer
+* type, its vendor (provider) and delivery model, and carries vendor knobs in
+* its config type. Offers with no extra vendor knobs use config type `{}`.
+*/
+const AwsVpc = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualNetwork",
+	offerType: "NetworkAndCompute.IaaS.AwsVpc",
+	provider: "AWS",
+	deliveryModel: "IaaS"
+});
+const AzureVnet = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualNetwork",
+	offerType: "NetworkAndCompute.IaaS.AzureVnet",
+	provider: "Azure",
+	deliveryModel: "IaaS"
+});
+const GcpVpc = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualNetwork",
+	offerType: "NetworkAndCompute.IaaS.GcpVpc",
+	provider: "GCP",
+	deliveryModel: "IaaS"
+});
+const AwsSubnet = defineOffer({
+	satisfies: "NetworkAndCompute.Subnet",
+	offerType: "NetworkAndCompute.IaaS.AwsSubnet",
+	provider: "AWS",
+	deliveryModel: "IaaS"
+});
+const AzureSubnet = defineOffer({
+	satisfies: "NetworkAndCompute.Subnet",
+	offerType: "NetworkAndCompute.IaaS.AzureSubnet",
+	provider: "Azure",
+	deliveryModel: "IaaS"
+});
+const GcpSubnet = defineOffer({
+	satisfies: "NetworkAndCompute.Subnet",
+	offerType: "NetworkAndCompute.IaaS.GcpSubnet",
+	provider: "GCP",
+	deliveryModel: "IaaS"
+});
+const AwsSecurityGroup = defineOffer({
+	satisfies: "NetworkAndCompute.SecurityGroup",
+	offerType: "NetworkAndCompute.IaaS.AwsSecurityGroup",
+	provider: "AWS",
+	deliveryModel: "IaaS"
+});
+const AzureNsg = defineOffer({
+	satisfies: "NetworkAndCompute.SecurityGroup",
+	offerType: "NetworkAndCompute.IaaS.AzureNsg",
+	provider: "Azure",
+	deliveryModel: "IaaS"
+});
+const GcpFirewall = defineOffer({
+	satisfies: "NetworkAndCompute.SecurityGroup",
+	offerType: "NetworkAndCompute.IaaS.GcpFirewall",
+	provider: "GCP",
+	deliveryModel: "IaaS"
+});
+const Ec2Instance = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualMachine",
+	offerType: "NetworkAndCompute.IaaS.Ec2Instance",
+	provider: "AWS",
+	deliveryModel: "IaaS"
+});
+const AzureVm = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualMachine",
+	offerType: "NetworkAndCompute.IaaS.AzureVm",
+	provider: "Azure",
+	deliveryModel: "IaaS"
+});
+const GcpVm = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualMachine",
+	offerType: "NetworkAndCompute.IaaS.GcpVm",
+	provider: "GCP",
+	deliveryModel: "IaaS"
+});
+const VsphereVm = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualMachine",
+	offerType: "NetworkAndCompute.IaaS.VsphereVm",
+	provider: "VMware",
+	deliveryModel: "IaaS"
+});
+const OpenshiftVm = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualMachine",
+	offerType: "NetworkAndCompute.CaaS.OpenshiftVm",
+	provider: "RedHat",
+	deliveryModel: "CaaS"
+});
+const Eks = defineOffer({
+	satisfies: "NetworkAndCompute.ContainerPlatform",
+	offerType: "NetworkAndCompute.PaaS.Eks",
+	provider: "AWS",
+	deliveryModel: "PaaS"
+});
+const Aks = defineOffer({
+	satisfies: "NetworkAndCompute.ContainerPlatform",
+	offerType: "NetworkAndCompute.PaaS.Aks",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const Gke = defineOffer({
+	satisfies: "NetworkAndCompute.ContainerPlatform",
+	offerType: "NetworkAndCompute.PaaS.Gke",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+const AwsLb = defineOffer({
+	satisfies: "NetworkAndCompute.LoadBalancer",
+	offerType: "NetworkAndCompute.IaaS.AwsLb",
+	provider: "AWS",
+	deliveryModel: "IaaS"
+});
+const AzureLb = defineOffer({
+	satisfies: "NetworkAndCompute.LoadBalancer",
+	offerType: "NetworkAndCompute.IaaS.AzureLb",
+	provider: "Azure",
+	deliveryModel: "IaaS"
+});
+const GcpGlb = defineOffer({
+	satisfies: "NetworkAndCompute.LoadBalancer",
+	offerType: "NetworkAndCompute.IaaS.GcpGlb",
+	provider: "GCP",
+	deliveryModel: "IaaS"
+});
+const OciVcn = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualNetwork",
+	offerType: "NetworkAndCompute.IaaS.OciVcn",
+	provider: "OCI",
+	deliveryModel: "IaaS"
+});
+const OciSubnet = defineOffer({
+	satisfies: "NetworkAndCompute.Subnet",
+	offerType: "NetworkAndCompute.IaaS.OciSubnet",
+	provider: "OCI",
+	deliveryModel: "IaaS"
+});
+const OciSecurityList = defineOffer({
+	satisfies: "NetworkAndCompute.SecurityGroup",
+	offerType: "NetworkAndCompute.IaaS.OciSecurityList",
+	provider: "OCI",
+	deliveryModel: "IaaS"
+});
+const OciInstance = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualMachine",
+	offerType: "NetworkAndCompute.IaaS.OciInstance",
+	provider: "OCI",
+	deliveryModel: "IaaS"
+});
+const HetznerNetwork = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualNetwork",
+	offerType: "NetworkAndCompute.IaaS.HetznerNetwork",
+	provider: "Hetzner",
+	deliveryModel: "IaaS"
+});
+const HetznerSubnet = defineOffer({
+	satisfies: "NetworkAndCompute.Subnet",
+	offerType: "NetworkAndCompute.IaaS.HetznerSubnet",
+	provider: "Hetzner",
+	deliveryModel: "IaaS"
+});
+const HetznerFirewall = defineOffer({
+	satisfies: "NetworkAndCompute.SecurityGroup",
+	offerType: "NetworkAndCompute.IaaS.HetznerFirewall",
+	provider: "Hetzner",
+	deliveryModel: "IaaS"
+});
+const HetznerServer = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualMachine",
+	offerType: "NetworkAndCompute.IaaS.HetznerServer",
+	provider: "Hetzner",
+	deliveryModel: "IaaS"
+});
+const VspherePortGroup = defineOffer({
+	satisfies: "NetworkAndCompute.VirtualNetwork",
+	offerType: "NetworkAndCompute.IaaS.VspherePortGroup",
+	provider: "VMware",
+	deliveryModel: "IaaS"
+});
+const VsphereVlan = defineOffer({
+	satisfies: "NetworkAndCompute.Subnet",
+	offerType: "NetworkAndCompute.IaaS.VsphereVlan",
+	provider: "VMware",
+	deliveryModel: "IaaS"
+});
+const OpenshiftSecurityGroup = defineOffer({
+	satisfies: "NetworkAndCompute.SecurityGroup",
+	offerType: "NetworkAndCompute.CaaS.OpenshiftNetworkPolicy",
+	provider: "RedHat",
+	deliveryModel: "CaaS"
+});
+const OpenshiftService = defineOffer({
+	satisfies: "NetworkAndCompute.LoadBalancer",
+	offerType: "NetworkAndCompute.CaaS.OpenshiftService",
+	provider: "RedHat",
+	deliveryModel: "CaaS"
+});
+
+//#endregion
+//#region src/model/offers/storage.ts
+/**
+* offers/storage.ts — Storage domain Offers (Catalogue, Level 3).
+*
+* Concrete, vendor-specific implementations declaring which abstract Storage
+* Component each satisfies. Vendor knobs live in each offer's config only.
+* Vendor-neutral self-hosted offers (e.g. MinIO on any cluster) omit `provider`.
+*/
+/**
+* A DBMS offer emits itself PLUS one Database live component per child the
+* application added via `withDatabases` — each database lives in the DBMS's
+* vendor family, so it is not independently offer-selected. Swap the DBMS offer
+* and the databases' offer type follows.
+*/
+const dbmsInstantiate = (dbmsType, provider, databaseType) => (ctx, config) => [{
+	id: ctx.id,
+	type: dbmsType,
+	provider,
+	deliveryModel: "PaaS",
+	parameters: {
+		...ctx.parameters,
+		...config
+	},
+	dependencies: [...ctx.dependencies],
+	links: [...ctx.links]
+}, ...ctx.children.map((child) => ({
+	id: child.id,
+	type: databaseType,
+	provider,
+	deliveryModel: "PaaS",
+	parameters: { ...child.parameters },
+	dependencies: [...child.dependencies],
+	links: [...child.links]
+}))];
+const AwsS3 = defineOffer({
+	satisfies: "Storage.ObjectStorage",
+	offerType: "Storage.PaaS.S3",
+	provider: "AWS",
+	deliveryModel: "PaaS"
+});
+const AzureBlob = defineOffer({
+	satisfies: "Storage.ObjectStorage",
+	offerType: "Storage.PaaS.AzureBlob",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const GcsBucket = defineOffer({
+	satisfies: "Storage.ObjectStorage",
+	offerType: "Storage.PaaS.GcsBucket",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+const MinIO = defineOffer({
+	satisfies: "Storage.ObjectStorage",
+	offerType: "Storage.CaaS.MinIO",
+	deliveryModel: "CaaS"
+});
+const AzurePostgresDbms = defineOffer({
+	satisfies: "Storage.RelationalDbms",
+	offerType: "Storage.PaaS.AzurePostgresDbms",
+	provider: "Azure",
+	deliveryModel: "PaaS",
+	instantiate: dbmsInstantiate("Storage.PaaS.AzurePostgresDbms", "Azure", "Storage.PaaS.AzurePostgresDatabase")
+});
+const GcpPostgresDbms = defineOffer({
+	satisfies: "Storage.RelationalDbms",
+	offerType: "Storage.PaaS.GcpPostgresDbms",
+	provider: "GCP",
+	deliveryModel: "PaaS",
+	instantiate: dbmsInstantiate("Storage.PaaS.GcpPostgresDbms", "GCP", "Storage.PaaS.GcpPostgresDatabase")
+});
+const ArubaMySqlDbms = defineOffer({
+	satisfies: "Storage.RelationalDbms",
+	offerType: "Storage.PaaS.ArubaMySqlDbms",
+	provider: "Aruba",
+	deliveryModel: "PaaS",
+	instantiate: dbmsInstantiate("Storage.PaaS.ArubaMySqlDbms", "Aruba", "Storage.PaaS.ArubaMySqlDatabase")
+});
+const AzurePostgresDatabase = defineOffer({
+	satisfies: "Storage.RelationalDatabase",
+	offerType: "Storage.PaaS.AzurePostgresDatabase",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const GcpPostgresDatabase = defineOffer({
+	satisfies: "Storage.RelationalDatabase",
+	offerType: "Storage.PaaS.GcpPostgresDatabase",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+const OpenshiftPersistentVolume = defineOffer({
+	satisfies: "Storage.ObjectStorage",
+	offerType: "Storage.CaaS.OpenshiftPersistentVolume",
+	provider: "RedHat",
+	deliveryModel: "CaaS"
+});
+
+//#endregion
+//#region src/model/offers/big_data.ts
+/**
+* offers/big_data.ts — BigData domain Offers (Catalogue, Level 3, concrete).
+*
+* Each offer declares which Component it satisfies, its 3-part offer type, its
+* delivery model and (for cloud offers) its vendor. Vendor-neutral CaaS offers
+* OMIT `provider` — they run on any cluster and are identified by deliveryModel
+* + offerType. Vendor knobs live in each offer's config type.
+*/
+const AwsDatabricksCluster = defineOffer({
+	satisfies: "BigData.ComputeCluster",
+	offerType: "BigData.PaaS.AwsDatabricksCluster",
+	provider: "AWS",
+	deliveryModel: "PaaS"
+});
+const AzureDatabricksCluster = defineOffer({
+	satisfies: "BigData.ComputeCluster",
+	offerType: "BigData.PaaS.AzureDatabricksCluster",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const GcpDatabricksCluster = defineOffer({
+	satisfies: "BigData.ComputeCluster",
+	offerType: "BigData.PaaS.GcpDatabricksCluster",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+const CaaSSparkCluster = defineOffer({
+	satisfies: "BigData.ComputeCluster",
+	offerType: "BigData.CaaS.CaaSSparkCluster",
+	deliveryModel: "CaaS"
+});
+const AwsDatabricksJob = defineOffer({
+	satisfies: "BigData.DataProcessingJob",
+	offerType: "BigData.PaaS.AwsDatabricksJob",
+	provider: "AWS",
+	deliveryModel: "PaaS"
+});
+const AzureDatabricksJob = defineOffer({
+	satisfies: "BigData.DataProcessingJob",
+	offerType: "BigData.PaaS.AzureDatabricksJob",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const GcpDatabricksJob = defineOffer({
+	satisfies: "BigData.DataProcessingJob",
+	offerType: "BigData.PaaS.GcpDatabricksJob",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+const CaaSSparkJob = defineOffer({
+	satisfies: "BigData.DataProcessingJob",
+	offerType: "BigData.CaaS.CaaSSparkJob",
+	deliveryModel: "CaaS"
+});
+const AwsDatabricksMlflow = defineOffer({
+	satisfies: "BigData.MlExperiment",
+	offerType: "BigData.PaaS.AwsDatabricksMlflow",
+	provider: "AWS",
+	deliveryModel: "PaaS"
+});
+const AzureDatabricksMlflow = defineOffer({
+	satisfies: "BigData.MlExperiment",
+	offerType: "BigData.PaaS.AzureDatabricksMlflow",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const GcpDatabricksMlflow = defineOffer({
+	satisfies: "BigData.MlExperiment",
+	offerType: "BigData.PaaS.GcpDatabricksMlflow",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+const CaaSMlflow = defineOffer({
+	satisfies: "BigData.MlExperiment",
+	offerType: "BigData.CaaS.CaaSMlflow",
+	deliveryModel: "CaaS"
+});
+const AwsS3Datalake = defineOffer({
+	satisfies: "BigData.Datalake",
+	offerType: "BigData.PaaS.AwsS3Datalake",
+	provider: "AWS",
+	deliveryModel: "PaaS"
+});
+const AzureDatalake = defineOffer({
+	satisfies: "BigData.Datalake",
+	offerType: "BigData.PaaS.AzureDatalake",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const GcpDatalake = defineOffer({
+	satisfies: "BigData.Datalake",
+	offerType: "BigData.PaaS.GcpDatalake",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+const AwsDatabricks = defineOffer({
+	satisfies: "BigData.DistributedDataProcessing",
+	offerType: "BigData.PaaS.AwsDatabricks",
+	provider: "AWS",
+	deliveryModel: "PaaS"
+});
+const AzureDatabricks = defineOffer({
+	satisfies: "BigData.DistributedDataProcessing",
+	offerType: "BigData.PaaS.AzureDatabricks",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const GcpDatabricks = defineOffer({
+	satisfies: "BigData.DistributedDataProcessing",
+	offerType: "BigData.PaaS.GcpDatabricks",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+
+//#endregion
+//#region src/model/offers/messaging.ts
+/**
+* offers/messaging.ts — Messaging domain Offers (Catalogue, Level 3).
+*
+* Concrete vendor-specific implementations that satisfy the abstract Messaging
+* Components in components/messaging.ts. Vendor knobs live in each offer's Cfg.
+* Vendor-neutral self-hosted offers (Kafka on any cluster) OMIT `provider`.
+*/
+const AzureServiceBus = defineOffer({
+	satisfies: "Messaging.Broker",
+	offerType: "Messaging.PaaS.AzureServiceBus",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const GcpPubSub = defineOffer({
+	satisfies: "Messaging.Broker",
+	offerType: "Messaging.PaaS.GcpPubSub",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+/** Vendor-neutral self-hosted Kafka — no `provider`. */
+const Kafka = defineOffer({
+	satisfies: "Messaging.Broker",
+	offerType: "Messaging.CaaS.Kafka",
+	deliveryModel: "CaaS"
+});
+const AzureServiceBusTopic = defineOffer({
+	satisfies: "Messaging.MessagingEntity",
+	offerType: "Messaging.PaaS.AzureServiceBusTopic",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const GcpPubSubTopic = defineOffer({
+	satisfies: "Messaging.MessagingEntity",
+	offerType: "Messaging.PaaS.GcpPubSubTopic",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+/** Vendor-neutral self-hosted Kafka topic — no `provider`. */
+const KafkaTopic = defineOffer({
+	satisfies: "Messaging.MessagingEntity",
+	offerType: "Messaging.CaaS.KafkaTopic",
+	deliveryModel: "CaaS"
+});
+
+//#endregion
+//#region src/model/offers/api_management.ts
+/**
+* offers/api_management.ts — APIManagement Offer catalogue (Level 3).
+*
+* Each offer declares which abstract Component it satisfies, its 3-part offer
+* type, its vendor (provider) and delivery model, and carries vendor knobs in
+* its config type. Vendor-neutral self-hosted offers (CaaS) OMIT `provider`.
+*/
+const AwsCloudFront = defineOffer({
+	satisfies: "APIManagement.ApiGateway",
+	offerType: "APIManagement.PaaS.CloudFront",
+	provider: "AWS",
+	deliveryModel: "PaaS"
+});
+const AzureApiManagement = defineOffer({
+	satisfies: "APIManagement.ApiGateway",
+	offerType: "APIManagement.PaaS.ApiManagement",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const GcpApiGateway = defineOffer({
+	satisfies: "APIManagement.ApiGateway",
+	offerType: "APIManagement.PaaS.GcpApiGateway",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+const Ambassador = defineOffer({
+	satisfies: "APIManagement.ApiGateway",
+	offerType: "APIManagement.CaaS.Ambassador",
+	deliveryModel: "CaaS"
+});
+const Traefik = defineOffer({
+	satisfies: "APIManagement.ApiGateway",
+	offerType: "APIManagement.CaaS.Traefik",
+	deliveryModel: "CaaS"
+});
+
+//#endregion
+//#region src/model/offers/observability.ts
+/**
+* offers/observability.ts — Observability domain Offers (Catalogue, Level 3).
+*
+* Concrete implementations declaring which abstract Observability Component each
+* satisfies. Vendor knobs live in each offer's config only. These are all
+* vendor-neutral self-hosted CaaS offers (Prometheus/Jaeger/Elastic on any
+* cluster), so they omit `provider`.
+*/
+const Prometheus = defineOffer({
+	satisfies: "Observability.Monitoring",
+	offerType: "Observability.CaaS.Prometheus",
+	deliveryModel: "CaaS"
+});
+const Jaeger = defineOffer({
+	satisfies: "Observability.Tracing",
+	offerType: "Observability.CaaS.Jaeger",
+	deliveryModel: "CaaS"
+});
+const ObservabilityElastic = defineOffer({
+	satisfies: "Observability.Logging",
+	offerType: "Observability.CaaS.Elastic",
+	deliveryModel: "CaaS"
+});
+
+//#endregion
+//#region src/model/offers/security.ts
+/**
+* offers/security.ts — Security domain Offers (Catalogue, Level 3).
+*
+* Concrete implementations declaring which abstract Security Component each
+* satisfies. Vendor knobs live in each offer's config only. Vendor-neutral
+* self-hosted offers (e.g. Ocelot / Keycloak on any cluster) omit `provider`.
+*/
+const Ocelot = defineOffer({
+	satisfies: "Security.ServiceMesh",
+	offerType: "Security.CaaS.Ocelot",
+	deliveryModel: "CaaS"
+});
+const Cognito = defineOffer({
+	satisfies: "Security.IdentityProvider",
+	offerType: "Security.PaaS.Cognito",
+	provider: "AWS",
+	deliveryModel: "PaaS"
+});
+const Keycloak = defineOffer({
+	satisfies: "Security.IdentityProvider",
+	offerType: "Security.CaaS.Keycloak",
+	deliveryModel: "CaaS"
+});
+
+//#endregion
+//#region src/model/offers/custom_workloads.ts
+/**
+* offers/custom_workloads.ts — CustomWorkloads domain Offers (Catalogue, Level 3,
+* concrete).
+*
+* Each offer declares which Component it satisfies, its 3-part offer type, its
+* delivery model and (for cloud offers) its vendor. Vendor-neutral CaaS offers
+* OMIT `provider` — they run on any cluster and are identified by deliveryModel
+* + offerType. Vendor knobs live in each offer's config type.
+*/
+const EcsService = defineOffer({
+	satisfies: "CustomWorkloads.Workload",
+	offerType: "CustomWorkloads.PaaS.EcsService",
+	provider: "AWS",
+	deliveryModel: "PaaS"
+});
+const CloudRun = defineOffer({
+	satisfies: "CustomWorkloads.Workload",
+	offerType: "CustomWorkloads.PaaS.CloudRun",
+	provider: "GCP",
+	deliveryModel: "PaaS"
+});
+const AzureContainerApp = defineOffer({
+	satisfies: "CustomWorkloads.Workload",
+	offerType: "CustomWorkloads.PaaS.AzureContainerApp",
+	provider: "Azure",
+	deliveryModel: "PaaS"
+});
+const OpenshiftWorkload = defineOffer({
+	satisfies: "CustomWorkloads.Workload",
+	offerType: "CustomWorkloads.CaaS.OpenshiftWorkload",
+	provider: "RedHat",
+	deliveryModel: "CaaS"
+});
+const K8sWorkload = defineOffer({
+	satisfies: "CustomWorkloads.Workload",
+	offerType: "CustomWorkloads.CaaS.K8sWorkload",
+	deliveryModel: "CaaS"
+});
+const AwsLambda = defineOffer({
+	satisfies: "CustomWorkloads.Function",
+	offerType: "CustomWorkloads.FaaS.AwsLambda",
+	provider: "AWS",
+	deliveryModel: "FaaS"
+});
+const AzureFunction = defineOffer({
+	satisfies: "CustomWorkloads.Function",
+	offerType: "CustomWorkloads.FaaS.AzureFunction",
+	provider: "Azure",
+	deliveryModel: "FaaS"
+});
+const GcpFunction = defineOffer({
+	satisfies: "CustomWorkloads.Function",
+	offerType: "CustomWorkloads.FaaS.GcpFunction",
+	provider: "GCP",
+	deliveryModel: "FaaS"
+});
+
+//#endregion
+export { Aks, Ambassador, ApiGateway, ArubaMySqlDbms, AwsCloudFront, AwsDatabricks, AwsDatabricksCluster, AwsDatabricksJob, AwsDatabricksMlflow, AwsLambda, AwsLb, AwsS3, AwsS3Datalake, AwsSecurityGroup, AwsSubnet, AwsVpc, AzureApiManagement, AzureBlob, AzureContainerApp, AzureDatabricks, AzureDatabricksCluster, AzureDatabricksJob, AzureDatabricksMlflow, AzureDatalake, AzureFunction, AzureLb, AzureNsg, AzurePostgresDatabase, AzurePostgresDbms, AzureServiceBus, AzureServiceBusTopic, AzureSubnet, AzureVm, AzureVnet, Broker, CaaSMlflow, CaaSSparkCluster, CaaSSparkJob, CloudRun, Cognito, ComputeCluster, ContainerPlatform, DataProcessingJob, Datalake, DistributedDataProcessing, Ec2Instance, EcsService, Eks, Function, GcpApiGateway, GcpDatabricks, GcpDatabricksCluster, GcpDatabricksJob, GcpDatabricksMlflow, GcpDatalake, GcpFirewall, GcpFunction, GcpGlb, GcpPostgresDatabase, GcpPostgresDbms, GcpPubSub, GcpPubSubTopic, GcpSubnet, GcpVm, GcpVpc, GcsBucket, Gke, HetznerFirewall, HetznerNetwork, HetznerServer, HetznerSubnet, IdentityProvider, Jaeger, K8sWorkload, Kafka, KafkaTopic, Keycloak, LoadBalancer, Logging, MessagingEntity, MinIO, MlExperiment, Monitoring, ObjectStorage, ObservabilityElastic, Ocelot, OciInstance, OciSecurityList, OciSubnet, OciVcn, OpenshiftPersistentVolume, OpenshiftSecurityGroup, OpenshiftService, OpenshiftVm, OpenshiftWorkload, Prometheus, RelationalDatabase, RelationalDbms, SecurityGroup, ServiceMesh, Subnet, Tracing, Traefik, VirtualMachine, VirtualNetwork, VspherePortGroup, VsphereVlan, VsphereVm, Workload, addDependency, createFractal, defineOffer, deploy, destroy, guardrail, newNode };