@medicine-wheel/infra 0.5.5

package/README.md

@@ -0,0 +1,140 @@
+# @medicine-wheel/infra
+
+Typed infrastructure facets for the Medicine Wheel Developer Suite.
+
+A host, a tenant, and a service are already beings the suite can reason about —
+`land`, `human`, `knowledge` in the closed `NodeType` union. What has had no home
+is their machine specifics: the port, the unit name, whether linger is on. Those
+leak into `metadata: Record<string, unknown>`, where nothing can check them.
+
+This package gives them a typed home **keyed by node id**, so a systemd unit
+reads as a being with the same grammar as a ceremony — and so `ontology-core`
+does not have to change to make that true.
+
+## Install
+
+```bash
+npm install @medicine-wheel/infra
+```
+
+Depends only on `@medicine-wheel/ontology-core` and `zod`.
+
+## What is here
+
+```ts
+import {
+  detectPortConflicts,
+  type HostFacet,
+  type TenantFacet,
+  type ServiceFacet,
+  type PortBinding,
+  type MetisHold,
+} from '@medicine-wheel/infra';
+```
+
+A **facet annotates an existing `RelationalNode` by id** — it never re-declares
+one, and it inherits `direction` from the node rather than re-encoding it.
+
+| Facet | Annotates a node of type | Direction it serves |
+|---|---|---|
+| `HostFacet` | `land` | — the machine itself |
+| `TenantFacet` | `human` | South — an account is a being, and `linger` is a precondition |
+| `ServiceFacet` | `knowledge` | West — the thing that executes |
+| `PortBinding` | *(carried by `ServiceFacet`)* | South — a claim that must hold before West runs |
+
+Every facet carries an optional `MetisHold`.
+
+## `detectPortConflicts`
+
+```ts
+const conflicts = detectPortConflicts([...declared, ...observed]);
+// [{ host: 'node:land:eury', port: 443, proto: 'tcp',
+//    claimants: ['node:knowledge:ava:...', 'node:knowledge:gmusic:...'] }, ...]
+```
+
+Declared bindings are authored by eury; observed ones are read live from systemd
+by gaia. Neither side alone can see a collision — this is the traversal over
+their union, so the collision returns **before** the second tenant is
+provisioned instead of at deploy time.
+
+Three properties are load-bearing:
+
+- **One service seen twice is not a conflict.** The input is declared ∪
+  observed, so the same claim arrives from both sides. Claimants de-duplicate by
+  `boundBy`; only two *distinct* services collide.
+- **Ports are scarce per host, not globally.** `:4444` on `eury` and `:4444` on
+  `gaia` are not in tension.
+- **Output is deterministic** — sorted by host, then proto, then port, with
+  claimants sorted inside each row — so two runs can be diffed.
+
+A binding with no `proto` is read as `tcp`, so shorthand and longhand tcp claims
+collide with each other while tcp and udp on the same number do not.
+
+`PortConflict` carries a `proto` field that the specification's shape (§S3) does
+not name. Without it, a host colliding on both tcp/53 and udp/53 returns two rows
+that cannot be told apart.
+
+## `MetisHold` — what the grid must not flatten
+
+The four-directions ontology is an imposed legibility grid. Legibility is what
+lets an operator reason at all; a grid that becomes the *only* sanctioned way to
+describe a system erases the métis — the "restart it twice," the "that BSSID lock
+is load-bearing," the credential path everyone just knows.
+
+```ts
+const zulip: ServiceFacet = {
+  // ...
+  execStop: 'docker compose stop',
+  metis: {
+    exceptions: ['compose stop, never down — down drops the volumes'],
+    heldBy: 'William',
+  },
+};
+```
+
+`heldBy` names a person on purpose. Invisible work gets surfaced with its
+carrier attached, not anonymised into the schema.
+
+## Validation at the boundary
+
+Every facet ships a Zod schema, because a legible-but-stale model lies with a
+straight face. Parse an emitted manifest before trusting it:
+
+```ts
+import { ServiceFacetSchema } from '@medicine-wheel/infra';
+
+const parsed = ServiceFacetSchema.safeParse(emitted);
+if (!parsed.success) { /* the emitter misread systemd — do not reconcile on this */ }
+```
+
+Port numbers are integers in 1–65535. A misparsed `0` is rejected here rather
+than silently never colliding with anything downstream.
+
+## Scope of `0.1.0`
+
+Ships S1, S3, S5 only — facets, `detectPortConflicts`, `MetisHold`, schemas.
+Deliberately **not** here:
+
+- **`0.2.0`** (S4) — `Precondition`, `preconditionGuard`, `readyService`. Where
+  the machine fact `linger` and the human, withdrawable `ConsentRecord` that
+  authorized the root step reference each other by id without either collapsing
+  into the other.
+- **`0.3.0`** (S6) — level-triggered `reconcile()` + `ObservedState` and the four
+  drift states, which keep `satisfied` from becoming a stale snapshot.
+- **`ontology-core@0.6.0`** (S2) — `part-of` / `ordered-after` / `binds-port` in
+  the governed `KINSHIP_EDGE_TYPES` registry. Until then a dependency edge is an
+  ordinary `Relation`; `infra` does not fork the vocabulary.
+
+Each step makes the next honest. None is a backlog item for this one.
+
+## Grounding
+
+- Specification: `/opt/eury/rispecs/foundations/02-specifications.md` §S1, §S3, §S5
+- Argument: `/opt/eury/foundations/relational-infrastructure/synthesis.md`
+- The collision this exists to catch: `jgwill/gaia#75`
+- The outage that motivated observed state: `jgwill/gaia#74`
+- Consumer requirements: `jgwill/eury#3`
+
+## License
+
+MIT — IAIP Collaborative, Shawinigan, QC.

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @medicine-wheel/infra
+ *
+ * Typed infrastructure facets for the Medicine Wheel Developer Suite — a home
+ * for the machine specifics (`port`, `unit`, `linger`) that otherwise leak into
+ * `metadata: Record<string, unknown>`.
+ *
+ * A new sibling package built **on** `ontology-core`, exactly as
+ * `consent-lifecycle` and `transformation-tracker` are. It changes no published
+ * package: the closed `NodeType` union is reused, never widened, and facets are
+ * keyed by node id rather than re-declaring nodes.
+ *
+ * Scope of `0.1.0` — S1, S3, S5 only. `Precondition` / `preconditionGuard` /
+ * `readyService` are `0.2.0` (S4); `reconcile()` / `ObservedState` are `0.3.0`
+ * (S6). Neither is shipped here.
+ *
+ * @packageDocumentation
+ */
+export type { NodeId, MetisHold, LingerState, Reachability, PortProto, ServiceScope, HostFacet, TenantFacet, ServiceFacet, PortBinding, PortConflict, FacetKind, } from './types';
+export { DEFAULT_PORT_PROTO, FACET_NODE_TYPES } from './types';
+export { MetisHoldSchema, LingerStateSchema, ReachabilitySchema, PortProtoSchema, ServiceScopeSchema, PortNumberSchema, PortBindingSchema, PortConflictSchema, HostFacetSchema, TenantFacetSchema, ServiceFacetSchema, } from './schemas';
+export type { ValidatedMetisHold, ValidatedPortBinding, ValidatedPortConflict, ValidatedHostFacet, ValidatedTenantFacet, ValidatedServiceFacet, } from './schemas';
+export { detectPortConflicts } from './ports';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,YAAY,EACV,MAAM,EACN,SAAS,EACT,WAAW,EACX,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,GACV,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAEnB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * @medicine-wheel/infra
+ *
+ * Typed infrastructure facets for the Medicine Wheel Developer Suite — a home
+ * for the machine specifics (`port`, `unit`, `linger`) that otherwise leak into
+ * `metadata: Record<string, unknown>`.
+ *
+ * A new sibling package built **on** `ontology-core`, exactly as
+ * `consent-lifecycle` and `transformation-tracker` are. It changes no published
+ * package: the closed `NodeType` union is reused, never widened, and facets are
+ * keyed by node id rather than re-declaring nodes.
+ *
+ * Scope of `0.1.0` — S1, S3, S5 only. `Precondition` / `preconditionGuard` /
+ * `readyService` are `0.2.0` (S4); `reconcile()` / `ObservedState` are `0.3.0`
+ * (S6). Neither is shipped here.
+ *
+ * @packageDocumentation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectPortConflicts = exports.ServiceFacetSchema = exports.TenantFacetSchema = exports.HostFacetSchema = exports.PortConflictSchema = exports.PortBindingSchema = exports.PortNumberSchema = exports.ServiceScopeSchema = exports.PortProtoSchema = exports.ReachabilitySchema = exports.LingerStateSchema = exports.MetisHoldSchema = exports.FACET_NODE_TYPES = exports.DEFAULT_PORT_PROTO = void 0;
+var types_1 = require("./types");
+Object.defineProperty(exports, "DEFAULT_PORT_PROTO", { enumerable: true, get: function () { return types_1.DEFAULT_PORT_PROTO; } });
+Object.defineProperty(exports, "FACET_NODE_TYPES", { enumerable: true, get: function () { return types_1.FACET_NODE_TYPES; } });
+// ── Zod schemas ─────────────────────────────────────────────────────────────
+var schemas_1 = require("./schemas");
+Object.defineProperty(exports, "MetisHoldSchema", { enumerable: true, get: function () { return schemas_1.MetisHoldSchema; } });
+Object.defineProperty(exports, "LingerStateSchema", { enumerable: true, get: function () { return schemas_1.LingerStateSchema; } });
+Object.defineProperty(exports, "ReachabilitySchema", { enumerable: true, get: function () { return schemas_1.ReachabilitySchema; } });
+Object.defineProperty(exports, "PortProtoSchema", { enumerable: true, get: function () { return schemas_1.PortProtoSchema; } });
+Object.defineProperty(exports, "ServiceScopeSchema", { enumerable: true, get: function () { return schemas_1.ServiceScopeSchema; } });
+Object.defineProperty(exports, "PortNumberSchema", { enumerable: true, get: function () { return schemas_1.PortNumberSchema; } });
+Object.defineProperty(exports, "PortBindingSchema", { enumerable: true, get: function () { return schemas_1.PortBindingSchema; } });
+Object.defineProperty(exports, "PortConflictSchema", { enumerable: true, get: function () { return schemas_1.PortConflictSchema; } });
+Object.defineProperty(exports, "HostFacetSchema", { enumerable: true, get: function () { return schemas_1.HostFacetSchema; } });
+Object.defineProperty(exports, "TenantFacetSchema", { enumerable: true, get: function () { return schemas_1.TenantFacetSchema; } });
+Object.defineProperty(exports, "ServiceFacetSchema", { enumerable: true, get: function () { return schemas_1.ServiceFacetSchema; } });
+// ── Port-conflict detection ─────────────────────────────────────────────────
+var ports_1 = require("./ports");
+Object.defineProperty(exports, "detectPortConflicts", { enumerable: true, get: function () { return ports_1.detectPortConflicts; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAkBH,iCAA+D;AAAtD,2GAAA,kBAAkB,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AAE7C,+EAA+E;AAC/E,qCAYmB;AAXjB,0GAAA,eAAe,OAAA;AACf,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,0GAAA,eAAe,OAAA;AACf,6GAAA,kBAAkB,OAAA;AAClB,2GAAA,gBAAgB,OAAA;AAChB,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,0GAAA,eAAe,OAAA;AACf,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAYpB,+EAA+E;AAC/E,iCAA8C;AAArC,4GAAA,mBAAmB,OAAA"}

package/dist/ports.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Port-conflict detection over the union of declared and observed bindings.
+ *
+ * The ownership split (§0) puts declared bindings in eury and observed ones in
+ * gaia. Neither side alone can see a collision. `detectPortConflicts` is the
+ * traversal over their union — so the collision returns as **rows, before the
+ * second tenant is provisioned**, instead of as a table a human reads after the
+ * fact (jgwill/gaia#75).
+ *
+ * A pure function over plain data. No I/O, no ontology traversal, no clock.
+ *
+ * Spec: /opt/eury/rispecs/foundations/02-specifications.md §S3.
+ */
+import type { PortBinding, PortConflict } from './types';
+/**
+ * Every port on a host claimed by more than one service.
+ *
+ * Two properties are load-bearing and are what the tests pin:
+ *
+ * 1. **The same service claiming the same slot twice is not a conflict.** The
+ *    input is declared ∪ observed, so eury declaring `assembly-mux.service` on
+ *    `:9081` and gaia observing it there produces two bindings for one claim.
+ *    Claimants are de-duplicated by `boundBy`; only two *distinct* services
+ *    collide.
+ * 2. **Ports are scarce per host, not globally.** `gmusic` on `:4444` on `eury`
+ *    and something on `:4444` on `gaia` are not in tension.
+ *
+ * Bindings with no `proto` are read as {@link DEFAULT_PORT_PROTO}, so a tcp
+ * claim written longhand and one written shorthand still collide with
+ * each other, while tcp and udp on the same number do not.
+ *
+ * Output is deterministic — rows sorted by host, then proto, then port;
+ * claimants sorted within each row — so a caller can diff two runs.
+ */
+export declare function detectPortConflicts(bindings: PortBinding[]): PortConflict[];
+//# sourceMappingURL=ports.d.ts.map

package/dist/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../src/ports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAa,MAAM,SAAS,CAAC;AAOpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,YAAY,EAAE,CAmC3E"}

package/dist/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../src/ports.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AA8BH,kDAmCC;AA/DD,mCAA6C;AAG7C,4DAA4D;AAC5D,SAAS,OAAO,CAAC,IAAY,EAAE,KAAgB,EAAE,IAAY;IAC3D,OAAO,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,mBAAmB,CAAC,QAAuB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAGlB,CAAC;IAEJ,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,0BAAkB,CAAC;QAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvD,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAC/E,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAClB,CAAC;AACJ,CAAC"}

package/dist/schemas.d.ts

@@ -0,0 +1,251 @@
+/**
+ * Zod schemas for every facet type.
+ *
+ * These exist so an emitted manifest can be validated **at the boundary**
+ * between gaia (which emits observed facets read live from systemd) and eury
+ * (which authors desired-state edges) before it is trusted. A legible-but-stale
+ * model lies with a straight face; the parse is where that gets caught.
+ *
+ * Spec: /opt/eury/rispecs/foundations/02-specifications.md §S1.
+ */
+import { z } from 'zod';
+export declare const MetisHoldSchema: z.ZodObject<{
+    exceptions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    invisibleWork: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    heldBy: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    exceptions?: string[] | undefined;
+    invisibleWork?: string[] | undefined;
+    notes?: string[] | undefined;
+    heldBy?: string | undefined;
+}, {
+    exceptions?: string[] | undefined;
+    invisibleWork?: string[] | undefined;
+    notes?: string[] | undefined;
+    heldBy?: string | undefined;
+}>;
+export declare const LingerStateSchema: z.ZodEnum<["enabled", "disabled", "unknown"]>;
+export declare const ReachabilitySchema: z.ZodEnum<["lan", "tailnet", "cloudflare", "ngrok"]>;
+export declare const PortProtoSchema: z.ZodEnum<["tcp", "udp"]>;
+export declare const ServiceScopeSchema: z.ZodEnum<["user", "system"]>;
+/**
+ * A port number as the kernel means it: an integer in 1–65535. Rejecting 0 and
+ * 65536 at the boundary is the point — an emitter that produces one has
+ * misparsed, and a misparsed binding silently never collides with anything.
+ */
+export declare const PortNumberSchema: z.ZodNumber;
+export declare const PortBindingSchema: z.ZodObject<{
+    port: z.ZodNumber;
+    proto: z.ZodOptional<z.ZodEnum<["tcp", "udp"]>>;
+    host: z.ZodString;
+    boundBy: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    host: string;
+    port: number;
+    boundBy: string;
+    proto?: "tcp" | "udp" | undefined;
+}, {
+    host: string;
+    port: number;
+    boundBy: string;
+    proto?: "tcp" | "udp" | undefined;
+}>;
+export declare const PortConflictSchema: z.ZodObject<{
+    host: z.ZodString;
+    port: z.ZodNumber;
+    proto: z.ZodEnum<["tcp", "udp"]>;
+    claimants: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    host: string;
+    port: number;
+    proto: "tcp" | "udp";
+    claimants: string[];
+}, {
+    host: string;
+    port: number;
+    proto: "tcp" | "udp";
+    claimants: string[];
+}>;
+export declare const HostFacetSchema: z.ZodObject<{
+    nodeId: z.ZodString;
+    hostname: z.ZodString;
+    fqdn: z.ZodOptional<z.ZodString>;
+    os: z.ZodOptional<z.ZodString>;
+    reachableVia: z.ZodOptional<z.ZodArray<z.ZodEnum<["lan", "tailnet", "cloudflare", "ngrok"]>, "many">>;
+    metis: z.ZodOptional<z.ZodObject<{
+        exceptions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        invisibleWork: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        heldBy: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    }, {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    nodeId: string;
+    hostname: string;
+    fqdn?: string | undefined;
+    os?: string | undefined;
+    reachableVia?: ("lan" | "tailnet" | "cloudflare" | "ngrok")[] | undefined;
+    metis?: {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    } | undefined;
+}, {
+    nodeId: string;
+    hostname: string;
+    fqdn?: string | undefined;
+    os?: string | undefined;
+    reachableVia?: ("lan" | "tailnet" | "cloudflare" | "ngrok")[] | undefined;
+    metis?: {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    } | undefined;
+}>;
+export declare const TenantFacetSchema: z.ZodObject<{
+    nodeId: z.ZodString;
+    account: z.ZodString;
+    uid: z.ZodOptional<z.ZodNumber>;
+    home: z.ZodOptional<z.ZodString>;
+    onHost: z.ZodString;
+    linger: z.ZodEnum<["enabled", "disabled", "unknown"]>;
+    metis: z.ZodOptional<z.ZodObject<{
+        exceptions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        invisibleWork: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        heldBy: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    }, {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    nodeId: string;
+    account: string;
+    onHost: string;
+    linger: "enabled" | "disabled" | "unknown";
+    metis?: {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    } | undefined;
+    uid?: number | undefined;
+    home?: string | undefined;
+}, {
+    nodeId: string;
+    account: string;
+    onHost: string;
+    linger: "enabled" | "disabled" | "unknown";
+    metis?: {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    } | undefined;
+    uid?: number | undefined;
+    home?: string | undefined;
+}>;
+export declare const ServiceFacetSchema: z.ZodObject<{
+    nodeId: z.ZodString;
+    unit: z.ZodString;
+    scope: z.ZodEnum<["user", "system"]>;
+    ownedBy: z.ZodString;
+    ports: z.ZodArray<z.ZodObject<{
+        port: z.ZodNumber;
+        proto: z.ZodOptional<z.ZodEnum<["tcp", "udp"]>>;
+        host: z.ZodString;
+        boundBy: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        host: string;
+        port: number;
+        boundBy: string;
+        proto?: "tcp" | "udp" | undefined;
+    }, {
+        host: string;
+        port: number;
+        boundBy: string;
+        proto?: "tcp" | "udp" | undefined;
+    }>, "many">;
+    workingDirectory: z.ZodOptional<z.ZodString>;
+    execStop: z.ZodOptional<z.ZodString>;
+    metis: z.ZodOptional<z.ZodObject<{
+        exceptions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        invisibleWork: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        heldBy: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    }, {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    nodeId: string;
+    unit: string;
+    scope: "user" | "system";
+    ownedBy: string;
+    ports: {
+        host: string;
+        port: number;
+        boundBy: string;
+        proto?: "tcp" | "udp" | undefined;
+    }[];
+    metis?: {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    } | undefined;
+    workingDirectory?: string | undefined;
+    execStop?: string | undefined;
+}, {
+    nodeId: string;
+    unit: string;
+    scope: "user" | "system";
+    ownedBy: string;
+    ports: {
+        host: string;
+        port: number;
+        boundBy: string;
+        proto?: "tcp" | "udp" | undefined;
+    }[];
+    metis?: {
+        exceptions?: string[] | undefined;
+        invisibleWork?: string[] | undefined;
+        notes?: string[] | undefined;
+        heldBy?: string | undefined;
+    } | undefined;
+    workingDirectory?: string | undefined;
+    execStop?: string | undefined;
+}>;
+export type ValidatedMetisHold = z.infer<typeof MetisHoldSchema>;
+export type ValidatedPortBinding = z.infer<typeof PortBindingSchema>;
+export type ValidatedPortConflict = z.infer<typeof PortConflictSchema>;
+export type ValidatedHostFacet = z.infer<typeof HostFacetSchema>;
+export type ValidatedTenantFacet = z.infer<typeof TenantFacetSchema>;
+export type ValidatedServiceFacet = z.infer<typeof ServiceFacetSchema>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;EAK1B,CAAC;AAIH,eAAO,MAAM,iBAAiB,+CAA6C,CAAC;AAE5E,eAAO,MAAM,kBAAkB,sDAAoD,CAAC;AAEpF,eAAO,MAAM,eAAe,2BAAyB,CAAC;AAEtD,eAAO,MAAM,kBAAkB,+BAA6B,CAAC;AAI7D;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,aAAqC,CAAC;AAEnE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;EAK5B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;EAK7B,CAAC;AAIH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO1B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ5B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS7B,CAAC;AAOH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACjE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AACrE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACjE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AACrE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/schemas.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * Zod schemas for every facet type.
+ *
+ * These exist so an emitted manifest can be validated **at the boundary**
+ * between gaia (which emits observed facets read live from systemd) and eury
+ * (which authors desired-state edges) before it is trusted. A legible-but-stale
+ * model lies with a straight face; the parse is where that gets caught.
+ *
+ * Spec: /opt/eury/rispecs/foundations/02-specifications.md §S1.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceFacetSchema = exports.TenantFacetSchema = exports.HostFacetSchema = exports.PortConflictSchema = exports.PortBindingSchema = exports.PortNumberSchema = exports.ServiceScopeSchema = exports.PortProtoSchema = exports.ReachabilitySchema = exports.LingerStateSchema = exports.MetisHoldSchema = void 0;
+const zod_1 = require("zod");
+// ── Métis (S5) ──────────────────────────────────────────────────────────────
+exports.MetisHoldSchema = zod_1.z.object({
+    exceptions: zod_1.z.array(zod_1.z.string()).optional(),
+    invisibleWork: zod_1.z.array(zod_1.z.string()).optional(),
+    notes: zod_1.z.array(zod_1.z.string()).optional(),
+    heldBy: zod_1.z.string().optional(),
+});
+// ── Enumerations ────────────────────────────────────────────────────────────
+exports.LingerStateSchema = zod_1.z.enum(['enabled', 'disabled', 'unknown']);
+exports.ReachabilitySchema = zod_1.z.enum(['lan', 'tailnet', 'cloudflare', 'ngrok']);
+exports.PortProtoSchema = zod_1.z.enum(['tcp', 'udp']);
+exports.ServiceScopeSchema = zod_1.z.enum(['user', 'system']);
+// ── Port bindings (S1, S3) ──────────────────────────────────────────────────
+/**
+ * A port number as the kernel means it: an integer in 1–65535. Rejecting 0 and
+ * 65536 at the boundary is the point — an emitter that produces one has
+ * misparsed, and a misparsed binding silently never collides with anything.
+ */
+exports.PortNumberSchema = zod_1.z.number().int().min(1).max(65535);
+exports.PortBindingSchema = zod_1.z.object({
+    port: exports.PortNumberSchema,
+    proto: exports.PortProtoSchema.optional(),
+    host: zod_1.z.string().min(1),
+    boundBy: zod_1.z.string().min(1),
+});
+exports.PortConflictSchema = zod_1.z.object({
+    host: zod_1.z.string().min(1),
+    port: exports.PortNumberSchema,
+    proto: exports.PortProtoSchema,
+    claimants: zod_1.z.array(zod_1.z.string().min(1)).min(2),
+});
+// ── Facets (S1) ─────────────────────────────────────────────────────────────
+exports.HostFacetSchema = zod_1.z.object({
+    nodeId: zod_1.z.string().min(1),
+    hostname: zod_1.z.string().min(1),
+    fqdn: zod_1.z.string().optional(),
+    os: zod_1.z.string().optional(),
+    reachableVia: zod_1.z.array(exports.ReachabilitySchema).optional(),
+    metis: exports.MetisHoldSchema.optional(),
+});
+exports.TenantFacetSchema = zod_1.z.object({
+    nodeId: zod_1.z.string().min(1),
+    account: zod_1.z.string().min(1),
+    uid: zod_1.z.number().int().nonnegative().optional(),
+    home: zod_1.z.string().optional(),
+    onHost: zod_1.z.string().min(1),
+    linger: exports.LingerStateSchema,
+    metis: exports.MetisHoldSchema.optional(),
+});
+exports.ServiceFacetSchema = zod_1.z.object({
+    nodeId: zod_1.z.string().min(1),
+    unit: zod_1.z.string().min(1),
+    scope: exports.ServiceScopeSchema,
+    ownedBy: zod_1.z.string().min(1),
+    ports: zod_1.z.array(exports.PortBindingSchema),
+    workingDirectory: zod_1.z.string().optional(),
+    execStop: zod_1.z.string().optional(),
+    metis: exports.MetisHoldSchema.optional(),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,6BAAwB;AAExB,+EAA+E;AAElE,QAAA,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IACtC,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,+EAA+E;AAElE,QAAA,iBAAiB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAE/D,QAAA,kBAAkB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvE,QAAA,eAAe,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAEzC,QAAA,kBAAkB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE7D,+EAA+E;AAE/E;;;;GAIG;AACU,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAEtD,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,wBAAgB;IACtB,KAAK,EAAE,uBAAe,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEU,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,wBAAgB;IACtB,KAAK,EAAE,uBAAe;IACtB,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH,+EAA+E;AAElE,QAAA,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,0BAAkB,CAAC,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,uBAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEU,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC9C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,yBAAiB;IACzB,KAAK,EAAE,uBAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEU,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,0BAAkB;IACzB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,yBAAiB,CAAC;IACjC,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,uBAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Facet types for @medicine-wheel/infra.
+ *
+ * A facet **annotates an existing `RelationalNode` by id** — it never re-declares
+ * one. Each facet gives a typed home to the machine specifics (`port`, `unit`,
+ * `linger`) that today leak into `metadata: Record<string, unknown>`.
+ *
+ * A facet inherits `direction` from the node it annotates and never re-encodes it.
+ * `ontology-core`'s closed `NodeType` union stays untouched: infra entities reuse
+ * the existing values via {@link FACET_NODE_TYPES}.
+ *
+ * Spec: /opt/eury/rispecs/foundations/02-specifications.md §S1, §S5.
+ */
+import type { RelationalNode } from '@medicine-wheel/ontology-core';
+/** The id of the `RelationalNode` a facet annotates. */
+export type NodeId = RelationalNode['id'];
+/**
+ * The tacit operator knowledge a legibility grid must **hold** rather than
+ * flatten. The four-directions ontology is an imposed grid; a grid that becomes
+ * the only sanctioned way to describe a system erases the "you have to restart
+ * it twice" and the "don't remove the BSSID lock" that kept it alive.
+ *
+ * Optional on every facet, on principle — infrastructure studies exists to
+ * surface invisible work, not standardise it away.
+ */
+export interface MetisHold {
+    /** 'restart twice; first start races the mount' */
+    exceptions?: string[];
+    /** 'BELL917 BSSID lock is load-bearing — do not remove' */
+    invisibleWork?: string[];
+    /** credential paths, ordering lore, the unwritten */
+    notes?: string[];
+    /** who carries this know-how — accountability, not anonymised */
+    heldBy?: string;
+}
+/**
+ * Whether a tenant's user units survive logout.
+ *
+ * A machine fact read at runtime — a checkbox with no authority and no ability
+ * to withdraw. It is deliberately **not** a consent state: the human
+ * authorization to run the root step that sets it is a `ConsentRecord` in
+ * `@medicine-wheel/consent-lifecycle`, and the two are never collapsed. The
+ * structured `Precondition` that references both arrives in `0.2.0` (§S4).
+ */
+export type LingerState = 'enabled' | 'disabled' | 'unknown';
+/** How a host can be reached. */
+export type Reachability = 'lan' | 'tailnet' | 'cloudflare' | 'ngrok';
+/** Transport of a port binding. Absent means {@link DEFAULT_PORT_PROTO}. */
+export type PortProto = 'tcp' | 'udp';
+/** systemd manager a unit belongs to. */
+export type ServiceScope = 'user' | 'system';
+/** The proto a `PortBinding` is read as when it declares none. */
+export declare const DEFAULT_PORT_PROTO: PortProto;
+/** A machine. Annotates a `RelationalNode` of type `'land'`. */
+export interface HostFacet {
+    /** → `RelationalNode.id` (type: `'land'`) */
+    nodeId: NodeId;
+    /** 'gaia' | 'eury' */
+    hostname: string;
+    fqdn?: string;
+    os?: string;
+    reachableVia?: Reachability[];
+    metis?: MetisHold;
+}
+/**
+ * A unix account. Annotates a `RelationalNode` of type `'human'` — an account is
+ * a being, not a namespace.
+ */
+export interface TenantFacet {
+    /** → `RelationalNode.id` (type: `'human'`) */
+    nodeId: NodeId;
+    /** unix user: 'gmusic' | 'ava' */
+    account: string;
+    uid?: number;
+    home?: string;
+    /** → `HostFacet.nodeId` */
+    onHost: NodeId;
+    /** consent *precondition*, not consent — see {@link LingerState} */
+    linger: LingerState;
+    metis?: MetisHold;
+}
+/**
+ * A systemd unit. Annotates a `RelationalNode` of type `'knowledge'` — West
+ * (the thing that executes) made typed.
+ */
+export interface ServiceFacet {
+    /** → `RelationalNode.id` (type: `'knowledge'`) */
+    nodeId: NodeId;
+    /** 'assembly-mux.service' */
+    unit: string;
+    scope: ServiceScope;
+    /** → `TenantFacet.nodeId` */
+    ownedBy: NodeId;
+    ports: PortBinding[];
+    /** the docker-zulip `.env`-is-read-from-cwd finding (jgwill/gaia#74) */
+    workingDirectory?: string;
+    /** 'compose stop', never 'compose down' (jgwill/gaia#74) */
+    execStop?: string;
+    metis?: MetisHold;
+}
+/**
+ * A service's claim on a port. South, structurally: a precondition that must
+ * hold before West runs. Ports are scarce **per host**, which is why `host` is
+ * part of the identity of a binding and not an annotation on it.
+ */
+export interface PortBinding {
+    port: number;
+    proto?: PortProto;
+    /** → `HostFacet.nodeId` */
+    host: NodeId;
+    /** → `ServiceFacet.nodeId` */
+    boundBy: NodeId;
+}
+/** One port on one host claimed by more than one service. */
+export interface PortConflict {
+    /** → `HostFacet.nodeId` */
+    host: NodeId;
+    port: number;
+    /**
+     * The transport the claimants collide on.
+     *
+     * Addition to the §S3 shape, which names only `host`/`port`/`claimants`.
+     * Without it, a host colliding on both tcp/53 and udp/53 returns two rows
+     * that cannot be told apart. Always concrete — an absent
+     * `PortBinding.proto` is normalised to {@link DEFAULT_PORT_PROTO}.
+     */
+    proto: PortProto;
+    /** `ServiceFacet.nodeId[]` competing for it — distinct, sorted */
+    claimants: NodeId[];
+}
+/**
+ * Which closed `NodeType` each facet annotates.
+ *
+ * Typed against `ontology-core`'s union on purpose: if that union ever changes
+ * shape, `infra` fails to compile here rather than drifting silently. This is
+ * the whole reason the dependency is load-bearing rather than decorative — no
+ * `NodeType` is widened, the existing values are reused.
+ */
+export declare const FACET_NODE_TYPES: {
+    readonly host: "land";
+    readonly tenant: "human";
+    readonly service: "knowledge";
+};
+/** `'host' | 'tenant' | 'service'` */
+export type FacetKind = keyof typeof FACET_NODE_TYPES;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAY,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE9E,wDAAwD;AACxD,MAAM,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;AAI1C;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7D,iCAAiC;AACjC,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;AAEtE,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK,CAAC;AAEtC,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7C,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,EAAE,SAAiB,CAAC;AAInD,gEAAgE;AAChE,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;IAC9B,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,YAAY,CAAC;IACpB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,KAAK,EAAE,SAAS,CAAC;IACjB,kEAAkE;IAClE,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;CAIgB,CAAC;AAE9C,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,gBAAgB,CAAC"}

package/dist/types.js

@@ -0,0 +1,33 @@
+"use strict";
+/**
+ * Facet types for @medicine-wheel/infra.
+ *
+ * A facet **annotates an existing `RelationalNode` by id** — it never re-declares
+ * one. Each facet gives a typed home to the machine specifics (`port`, `unit`,
+ * `linger`) that today leak into `metadata: Record<string, unknown>`.
+ *
+ * A facet inherits `direction` from the node it annotates and never re-encodes it.
+ * `ontology-core`'s closed `NodeType` union stays untouched: infra entities reuse
+ * the existing values via {@link FACET_NODE_TYPES}.
+ *
+ * Spec: /opt/eury/rispecs/foundations/02-specifications.md §S1, §S5.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FACET_NODE_TYPES = exports.DEFAULT_PORT_PROTO = void 0;
+/** The proto a `PortBinding` is read as when it declares none. */
+exports.DEFAULT_PORT_PROTO = 'tcp';
+// ── Node-type binding ───────────────────────────────────────────────────────
+/**
+ * Which closed `NodeType` each facet annotates.
+ *
+ * Typed against `ontology-core`'s union on purpose: if that union ever changes
+ * shape, `infra` fails to compile here rather than drifting silently. This is
+ * the whole reason the dependency is load-bearing rather than decorative — no
+ * `NodeType` is widened, the existing values are reused.
+ */
+exports.FACET_NODE_TYPES = {
+    host: 'land',
+    tenant: 'human',
+    service: 'knowledge',
+};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAmDH,kEAAkE;AACrD,QAAA,kBAAkB,GAAc,KAAK,CAAC;AAwFnD,+EAA+E;AAE/E;;;;;;;GAOG;AACU,QAAA,gBAAgB,GAAG;IAC9B,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,OAAO;IACf,OAAO,EAAE,WAAW;CACuB,CAAC"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@medicine-wheel/infra",
+  "version": "0.5.5",
+  "description": "Typed infrastructure facets for the Medicine Wheel Developer Suite — hosts, tenants, services, and port bindings as facets keyed by relational node id, with port-conflict detection over declared ∪ observed state",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "import": "./dist/types.js",
+      "require": "./dist/types.js",
+      "default": "./dist/types.js"
+    },
+    "./schemas": {
+      "types": "./dist/schemas.d.ts",
+      "import": "./dist/schemas.js",
+      "require": "./dist/schemas.js",
+      "default": "./dist/schemas.js"
+    }
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "lint": "tsc --noEmit",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "keywords": [
+    "medicine-wheel",
+    "infrastructure",
+    "systemd",
+    "relational-ontology",
+    "port-conflict",
+    "topology-as-data",
+    "metis"
+  ],
+  "author": "IAIP Collaborative - Shawinigan, QC",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jgwill/medicine-wheel.git",
+    "directory": "src/infra"
+  },
+  "dependencies": {
+    "@medicine-wheel/ontology-core": "^0.5.5",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.10.0",
+    "typescript": "^5.3.0"
+  }
+}