@relkit/deploy 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 rel-kit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,5 @@
+# @relkit/deploy
+
+Unsupported internal RELKIT deployment contracts; use @relkit/cli.
+
+See [@relkit/app](https://github.com/rel-kit/relkit) for supported application APIs.

package/dist/diff-utils.d.ts

@@ -0,0 +1,15 @@
+import { type JsonValue } from "@relkit/contracts";
+import type { DeploymentOperation } from "./diff.js";
+import type { DeploymentPlan } from "./plan.js";
+export interface Resource {
+    readonly id: string;
+    readonly stableId: string;
+    readonly kind: string;
+    readonly logicalName: string;
+    readonly value: JsonValue;
+}
+export declare function resources(plan: DeploymentPlan): readonly Resource[];
+export declare function changedFields(before: JsonValue, after: JsonValue): readonly string[];
+export declare function keys(value: JsonValue): readonly string[];
+export declare function isSecuritySensitive(kind: string, operation: DeploymentOperation, fields: readonly string[], before: JsonValue | undefined, after: JsonValue | undefined): boolean;
+//# sourceMappingURL=diff-utils.d.ts.map

package/dist/diff-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-utils.d.ts","sourceRoot":"","sources":["../src/diff-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,QAAQ,EAAE,CA0BnE;AAmBD,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAKpF;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAExD;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,mBAAmB,EAC9B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,KAAK,EAAE,SAAS,GAAG,SAAS,GAC3B,OAAO,CAaT"}

package/dist/diff-utils.js

@@ -0,0 +1,71 @@
+import { canonicalJson } from "@relkit/contracts";
+export function resources(plan) {
+    const result = [
+        resource("application", plan.application.id, plan.application.id, {
+            ...plan.application,
+            contractVersion: plan.contractVersion,
+            graphHash: plan.graphHash,
+        }),
+        resource("http", plan.http.logicalName, plan.http.logicalName, plan.http),
+        ...(plan.observability === undefined
+            ? []
+            : [
+                resource("observability", plan.observability.logicalName, plan.observability.logicalName, plan.observability),
+            ]),
+        ...entries("job", plan.jobs),
+        ...entries("schedule", plan.schedules),
+        ...entries("event", plan.events),
+        ...entries("event-trigger", plan.eventTriggers),
+        ...entries("bucket", plan.buckets),
+        ...entries("cache", plan.caches),
+    ];
+    return result.sort((left, right) => left.stableId.localeCompare(right.stableId));
+}
+function entries(kind, values) {
+    return values.map((value) => resource(kind, value.id, value.logicalName, value));
+}
+function resource(kind, id, logicalName, value) {
+    return {
+        id,
+        stableId: `${kind}:${id}`,
+        kind,
+        logicalName,
+        value: value,
+    };
+}
+export function changedFields(before, after) {
+    if (!isRecord(before) || !isRecord(after))
+        return ["value"];
+    return [...new Set([...Object.keys(before), ...Object.keys(after)])]
+        .filter((key) => canonicalJson(before[key]) !== canonicalJson(after[key]))
+        .sort();
+}
+export function keys(value) {
+    return isRecord(value) ? Object.keys(value).sort() : ["value"];
+}
+export function isSecuritySensitive(kind, operation, fields, before, after) {
+    const changed = operation === "create" || operation === "delete" ? [] : fields;
+    if (changed.some((field) => /configurationNames|environmentNames|provider|profile/i.test(field)))
+        return true;
+    if (changed.includes("visibility") && [before, after].some((value) => hasPublicVisibility(value)))
+        return true;
+    if (changed.includes("metadata") && [before, after].some((value) => hasSecurityMetadata(value)))
+        return true;
+    if (operation === "create" || operation === "delete")
+        return [before, after].some((value) => hasSecurityMetadata(value) || hasPublicVisibility(value));
+    return false;
+}
+function hasPublicVisibility(value) {
+    return isRecord(value) && value.visibility === "public";
+}
+function hasSecurityMetadata(value) {
+    if (!isRecord(value))
+        return false;
+    return Object.entries(value).some(([key, child]) => /iam|permission|policy|credential|secret|token|role|security/i.test(key)
+        ? true
+        : hasSecurityMetadata(child));
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=diff-utils.js.map

package/dist/diff-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-utils.js","sourceRoot":"","sources":["../src/diff-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAkB,MAAM,mBAAmB,CAAC;AAYlE,MAAM,UAAU,SAAS,CAAC,IAAoB;IAC5C,MAAM,MAAM,GAAe;QACzB,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;YAChE,GAAG,IAAI,CAAC,WAAW;YACnB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,QAAQ,CACN,eAAe,EACf,IAAI,CAAC,aAAa,CAAC,WAAW,EAC9B,IAAI,CAAC,aAAa,CAAC,WAAW,EAC9B,IAAI,CAAC,aAAa,CACnB;aACF,CAAC;QACN,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC;QAC5B,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;QACtC,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QAChC,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC;QAC/C,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;QAClC,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;KACjC,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,OAAO,CACd,IAAY,EACZ,MAAwE;IAExE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,EAAU,EAAE,WAAmB,EAAE,KAAc;IAC7E,OAAO;QACL,EAAE;QACF,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE;QACzB,IAAI;QACJ,WAAW;QACX,KAAK,EAAE,KAAkB;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,KAAgB;IAC/D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACjE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;SACzE,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAgB;IACnC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,SAA8B,EAC9B,MAAyB,EACzB,MAA6B,EAC7B,KAA4B;IAE5B,MAAM,OAAO,GAAG,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uDAAuD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ;QAClD,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,CACpE,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA4B;IACvD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA4B;IACvD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACjD,8DAA8D,CAAC,IAAI,CAAC,GAAG,CAAC;QACtE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAA4B;IAC5C,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/diff.d.ts

@@ -0,0 +1,46 @@
+import type { DeploymentPlan } from "./plan.js";
+export declare const DEPLOYMENT_OPERATIONS: readonly ["create", "update", "delete", "replace"];
+export type DeploymentOperation = (typeof DEPLOYMENT_OPERATIONS)[number];
+export declare const DEPLOYMENT_RISKS: readonly ["low", "medium", "high", "critical"];
+export type DeploymentRisk = (typeof DEPLOYMENT_RISKS)[number];
+export type ConfirmationReason = "destructive" | "security-sensitive";
+export type ConfirmationClassification = "none" | "destructive" | "security-sensitive" | "destructive-and-security-sensitive";
+export interface DeploymentResourceChange {
+    /** The descriptor or logical resource ID; it never contains a source path. */
+    readonly id: string;
+    /** Kind-qualified ID used to order and match resources without array positions. */
+    readonly stableId: string;
+    readonly kind: string;
+    readonly logicalName: string;
+    readonly operation: DeploymentOperation;
+    readonly risk: DeploymentRisk;
+    readonly securitySensitive: boolean;
+    readonly confirmation: "none" | "required";
+    readonly confirmationClassification: ConfirmationClassification;
+    readonly confirmationReasons: readonly ConfirmationReason[];
+    readonly fields: readonly string[];
+}
+export interface DeploymentRiskSummary {
+    readonly create: number;
+    readonly update: number;
+    readonly delete: number;
+    readonly replace: number;
+    readonly securitySensitive: number;
+    readonly destructive: number;
+    readonly requiresConfirmation: boolean;
+    readonly confirmation: "none" | "required";
+    readonly highestRisk?: DeploymentRisk;
+}
+export interface DeploymentDiff {
+    readonly changes: readonly DeploymentResourceChange[];
+    readonly summary: DeploymentRiskSummary;
+    readonly hasDestructiveChanges: boolean;
+    readonly requiresConfirmation: boolean;
+}
+/** Compares deployment resources; this is intentionally separate from graph contract diffing. */
+export declare function diffDeploymentPlans(before: DeploymentPlan, after: DeploymentPlan): DeploymentDiff;
+export declare const diffDeploymentPlan: typeof diffDeploymentPlans;
+export declare const diffDeployment: typeof diffDeploymentPlans;
+/** Aggregates stable deployment changes for confirmation and human/machine reports. */
+export declare function summarizeDeploymentChanges(changes: readonly DeploymentResourceChange[]): DeploymentRiskSummary;
+//# sourceMappingURL=diff.d.ts.map

package/dist/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../src/diff.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAShD,eAAO,MAAM,qBAAqB,oDAAqD,CAAC;AACxF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,gBAAgB,gDAAiD,CAAC;AAC/E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AACtE,MAAM,MAAM,0BAA0B,GACpC,MAAM,GAAG,aAAa,GAAG,oBAAoB,GAAG,oCAAoC,CAAC;AAEvF,MAAM,WAAW,wBAAwB;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,0BAA0B,EAAE,0BAA0B,CAAC;IAChE,QAAQ,CAAC,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC5D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;CACxC;AAED,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,cAAc,CAejG;AAED,eAAO,MAAM,kBAAkB,4BAAsB,CAAC;AACtD,eAAO,MAAM,cAAc,4BAAsB,CAAC;AAElD,uFAAuF;AACvF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,SAAS,wBAAwB,EAAE,GAC3C,qBAAqB,CAmBvB"}

package/dist/diff.js

@@ -0,0 +1,103 @@
+import { canonicalJson, deepFreeze } from "@relkit/contracts";
+import { changedFields, isSecuritySensitive, keys, resources, } from "./diff-utils.js";
+export const DEPLOYMENT_OPERATIONS = ["create", "update", "delete", "replace"];
+export const DEPLOYMENT_RISKS = ["low", "medium", "high", "critical"];
+/** Compares deployment resources; this is intentionally separate from graph contract diffing. */
+export function diffDeploymentPlans(before, after) {
+    const left = resources(before);
+    const right = resources(after);
+    const beforeById = new Map(left.map((resource) => [resource.stableId, resource]));
+    const afterById = new Map(right.map((resource) => [resource.stableId, resource]));
+    const changes = [...new Set([...beforeById.keys(), ...afterById.keys()])]
+        .sort()
+        .flatMap((stableId) => change(beforeById.get(stableId), afterById.get(stableId)));
+    const summary = summarizeDeploymentChanges(changes);
+    return deepFreeze({
+        changes,
+        summary,
+        hasDestructiveChanges: summary.destructive > 0,
+        requiresConfirmation: summary.requiresConfirmation,
+    });
+}
+export const diffDeploymentPlan = diffDeploymentPlans;
+export const diffDeployment = diffDeploymentPlans;
+/** Aggregates stable deployment changes for confirmation and human/machine reports. */
+export function summarizeDeploymentChanges(changes) {
+    const counts = { create: 0, update: 0, delete: 0, replace: 0 };
+    for (const change of changes)
+        counts[change.operation] += 1;
+    const securitySensitive = changes.filter((change) => change.securitySensitive).length;
+    const destructive = counts.delete + counts.replace;
+    const requiresConfirmation = changes.some((change) => change.confirmation === "required");
+    const highestRisk = changes.reduce((current, change) => current === undefined || rank(change.risk) > rank(current) ? change.risk : current, undefined);
+    return deepFreeze({
+        ...counts,
+        securitySensitive,
+        destructive,
+        requiresConfirmation,
+        confirmation: requiresConfirmation ? "required" : "none",
+        ...(highestRisk === undefined ? {} : { highestRisk }),
+    });
+}
+function change(before, after) {
+    if (before === undefined && after === undefined)
+        return [];
+    const resource = after ?? before;
+    if (before !== undefined &&
+        after !== undefined &&
+        canonicalJson(before.value) === canonicalJson(after.value))
+        return [];
+    const operation = before === undefined
+        ? "create"
+        : after === undefined
+            ? "delete"
+            : before.logicalName !== after.logicalName
+                ? "replace"
+                : "update";
+    const fields = before === undefined
+        ? keys(resource.value)
+        : after === undefined
+            ? keys(resource.value)
+            : changedFields(before.value, after.value);
+    const securitySensitive = isSecuritySensitive(resource.kind, operation, fields, before?.value, after?.value);
+    const reasons = [];
+    if (operation === "delete" || operation === "replace")
+        reasons.push("destructive");
+    if (securitySensitive)
+        reasons.push("security-sensitive");
+    const confirmationClassification = reasons.includes("destructive")
+        ? reasons.includes("security-sensitive")
+            ? "destructive-and-security-sensitive"
+            : "destructive"
+        : reasons.includes("security-sensitive")
+            ? "security-sensitive"
+            : "none";
+    return [
+        {
+            id: resource.id,
+            stableId: resource.stableId,
+            kind: resource.kind,
+            logicalName: resource.logicalName,
+            operation,
+            risk: risk(operation, securitySensitive),
+            securitySensitive,
+            confirmation: confirmationClassification === "none" ? "none" : "required",
+            confirmationClassification,
+            confirmationReasons: reasons,
+            fields,
+        },
+    ];
+}
+function risk(operation, securitySensitive) {
+    if (operation === "replace")
+        return "critical";
+    if (operation === "delete")
+        return securitySensitive ? "critical" : "high";
+    if (securitySensitive)
+        return "high";
+    return operation === "update" ? "medium" : "low";
+}
+function rank(value) {
+    return DEPLOYMENT_RISKS.indexOf(value);
+}
+//# sourceMappingURL=diff.js.map

package/dist/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../src/diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,IAAI,EACJ,SAAS,GAEV,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAGxF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AA0C/E,iGAAiG;AACjG,MAAM,UAAU,mBAAmB,CAAC,MAAsB,EAAE,KAAqB;IAC/E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACtE,IAAI,EAAE;SACN,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC;QAChB,OAAO;QACP,OAAO;QACP,qBAAqB,EAAE,OAAO,CAAC,WAAW,GAAG,CAAC;QAC9C,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;KACnD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AACtD,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD,uFAAuF;AACvF,MAAM,UAAU,0BAA0B,CACxC,OAA4C;IAE5C,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;IACtF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IACnD,MAAM,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,CAAC,CAAC;IAC1F,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAChC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAClB,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EACpF,SAAS,CACV,CAAC;IACF,OAAO,UAAU,CAAC;QAChB,GAAG,MAAM;QACT,iBAAiB;QACjB,WAAW;QACX,oBAAoB;QACpB,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;QACxD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CACb,MAA4B,EAC5B,KAA2B;IAE3B,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,KAAK,IAAI,MAAO,CAAC;IAClC,IACE,MAAM,KAAK,SAAS;QACpB,KAAK,KAAK,SAAS;QACnB,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;QAE1D,OAAO,EAAE,CAAC;IACZ,MAAM,SAAS,GACb,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,KAAK,KAAK,SAAS;YACnB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBACxC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,QAAQ,CAAC;IACnB,MAAM,MAAM,GACV,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,CAAC,CAAC,KAAK,KAAK,SAAS;YACnB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,iBAAiB,GAAG,mBAAmB,CAC3C,QAAQ,CAAC,IAAI,EACb,SAAS,EACT,MAAM,EACN,MAAM,EAAE,KAAK,EACb,KAAK,EAAE,KAAK,CACb,CAAC;IACF,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACnF,IAAI,iBAAiB;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC1D,MAAM,0BAA0B,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAChE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACtC,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,aAAa;QACjB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACtC,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,MAAM,CAAC;IACb,OAAO;QACL;YACE,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS;YACT,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;YACxC,iBAAiB;YACjB,YAAY,EAAE,0BAA0B,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;YACzE,0BAA0B;YAC1B,mBAAmB,EAAE,OAAO;YAC5B,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,SAA8B,EAAE,iBAA0B;IACtE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAC/C,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3E,IAAI,iBAAiB;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED,SAAS,IAAI,CAAC,KAAqB;IACjC,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/from-graph-aws.d.ts

@@ -0,0 +1,8 @@
+import type { ApplicationGraph, GraphNode } from "@relkit/graph";
+import type { Capability } from "./from-graph-validation.js";
+export declare function iam(name: Capability, id: string, edges: ApplicationGraph["edges"]): string[];
+export declare function usedCapabilities(nodes: readonly GraphNode[], edges: ApplicationGraph["edges"]): readonly {
+    readonly capability: Capability;
+    readonly profile: string;
+}[];
+//# sourceMappingURL=from-graph-aws.d.ts.map

package/dist/from-graph-aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-aws.d.ts","sourceRoot":"","sources":["../src/from-graph-aws.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,wBAAgB,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAc5F;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,SAAS,SAAS,EAAE,EAC3B,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAC/B,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CA8B1E"}

package/dist/from-graph-aws.js

@@ -0,0 +1,52 @@
+export function iam(name, id, edges) {
+    const linked = (kind) => edges.some((edge) => edge.kind === kind && edge.to === id);
+    if (name === "buckets" && linked("uses-bucket"))
+        return ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"];
+    if (name === "jobs")
+        return [
+            "sqs:ReceiveMessage",
+            "sqs:DeleteMessage",
+            "sqs:ChangeMessageVisibility",
+            ...(linked("enqueues-job") ? ["sqs:SendMessage"] : []),
+        ];
+    if (name === "events" && linked("publishes-event"))
+        return ["events:PutEvents"];
+    if (name === "cache" && linked("uses-cache"))
+        return ["elasticache:Connect"];
+    return [];
+}
+export function usedCapabilities(nodes, edges) {
+    const used = new Map();
+    const add = (capability, profile = "default") => {
+        used.set(`${capability}\0${profile}`, { capability, profile });
+    };
+    for (const node of nodes) {
+        if (node.kind === "job")
+            add("jobs", node.profile);
+        if (node.kind === "bucket")
+            add("buckets", node.profile);
+        if (node.kind === "cache")
+            add("cache", node.profile);
+        if (node.kind === "event")
+            add("events");
+        if (node.kind === "agent")
+            add("models");
+        if (node.kind === "trigger" && node.triggerType === "event") {
+            const profile = node.config !== null &&
+                typeof node.config === "object" &&
+                !Array.isArray(node.config) &&
+                typeof node.config.profile === "string"
+                ? node.config.profile
+                : "default";
+            add("events", profile);
+        }
+        if (node.kind === "trigger" &&
+            (node.triggerType === "queue" || node.triggerType === "schedule"))
+            add("jobs");
+    }
+    for (const edge of edges)
+        if (edge.kind === "publishes-event" || edge.kind === "listens-to-event")
+            add("events");
+    return [...used.values()];
+}
+//# sourceMappingURL=from-graph-aws.js.map

package/dist/from-graph-aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-aws.js","sourceRoot":"","sources":["../src/from-graph-aws.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,EAAU,EAAE,KAAgC;IAChF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5F,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC;QAC7C,OAAO,CAAC,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;IAC9E,IAAI,IAAI,KAAK,MAAM;QACjB,OAAO;YACL,oBAAoB;YACpB,mBAAmB;YACnB,6BAA6B;YAC7B,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC;IACJ,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChF,IAAI,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAA2B,EAC3B,KAAgC;IAEhC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuD,CAAC;IAC5E,MAAM,GAAG,GAAG,CAAC,UAAsB,EAAE,OAAO,GAAG,SAAS,EAAE,EAAE;QAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5D,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,KAAK,IAAI;gBACpB,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC3B,OAAQ,IAAI,CAAC,MAAyC,CAAC,OAAO,KAAK,QAAQ;gBACzE,CAAC,CAAE,IAAI,CAAC,MAAuC,CAAC,OAAO;gBACvD,CAAC,CAAC,SAAS,CAAC;YAChB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,IACE,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,CAAC,IAAI,CAAC,WAAW,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,CAAC;YAEjE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK;QACtB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB;YAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC"}

package/dist/from-graph-boundary.d.ts

@@ -0,0 +1,2 @@
+export declare function validateBoundary(value: unknown): void;
+//# sourceMappingURL=from-graph-boundary.d.ts.map

package/dist/from-graph-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-boundary.d.ts","sourceRoot":"","sources":["../src/from-graph-boundary.ts"],"names":[],"mappings":"AAGA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAUrD"}

package/dist/from-graph-boundary.js

@@ -0,0 +1,23 @@
+import { canonicalJson } from "@relkit/contracts";
+import { fail, secretName } from "./from-graph-validation.js";
+export function validateBoundary(value) {
+    try {
+        canonicalJson(value);
+    }
+    catch (error) {
+        fail("RELKIT_DEPLOY_GRAPH_INVALID", error instanceof Error ? error.message : "Boundary is not JSON-safe.");
+    }
+    scan(value);
+}
+function scan(value) {
+    if (value === null || typeof value !== "object")
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        if (/^(pulumi|client|live(client|object)?|resource)$/i.test(key))
+            fail("RELKIT_DEPLOY_LIVE_OBJECT_UNSUPPORTED", "Live deployment objects cannot cross the graph boundary.");
+        if (secretName(key) && (child === null || typeof child !== "object") && child !== true)
+            fail("RELKIT_DEPLOY_SECRET_UNSUPPORTED", "Secret values cannot cross the graph boundary.");
+        scan(child);
+    }
+}
+//# sourceMappingURL=from-graph-boundary.js.map

package/dist/from-graph-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-boundary.js","sourceRoot":"","sources":["../src/from-graph-boundary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE9D,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,CAAC;QACH,aAAa,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CACF,6BAA6B,EAC7B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IACxD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9D,IAAI,CACF,uCAAuC,EACvC,0DAA0D,CAC3D,CAAC;QACJ,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI;YACpF,IAAI,CAAC,kCAAkC,EAAE,gDAAgD,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/from-graph-context.d.ts

@@ -0,0 +1,11 @@
+import type { ApplicationGraph, ProviderProfileNode } from "@relkit/graph";
+import type { DeploymentCapabilityPlan } from "./plan.js";
+import type { Capability } from "./from-graph-validation.js";
+export interface PlanContext {
+    readonly appId: string;
+    readonly graphHash: string;
+    readonly graph: ApplicationGraph;
+    readonly providers: Map<string, ProviderProfileNode>;
+}
+export declare function base(context: PlanContext, id: string, kind: string, name: Capability, profile: string, actions?: readonly string[]): DeploymentCapabilityPlan;
+//# sourceMappingURL=from-graph-context.d.ts.map

package/dist/from-graph-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-context.d.ts","sourceRoot":"","sources":["../src/from-graph-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAG7D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CACtD;AAED,wBAAgB,IAAI,CAClB,OAAO,EAAE,WAAW,EACpB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,wBAAwB,CAW1B"}

package/dist/from-graph-context.js

@@ -0,0 +1,14 @@
+import { configNames, logicalName, providerId } from "./from-graph-validation.js";
+export function base(context, id, kind, name, profile, actions = []) {
+    return {
+        id,
+        logicalName: logicalName(context.appId, kind, id),
+        bindingId: providerId(name, profile),
+        profile,
+        configurationNames: configNames(context.providers, name, profile),
+        capabilities: [name],
+        tags: { app: context.appId, graphHash: context.graphHash, "managed-by": "relkit" },
+        ...(actions.length === 0 ? {} : { metadata: { iamCapabilities: actions } }),
+    };
+}
+//# sourceMappingURL=from-graph-context.js.map

package/dist/from-graph-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-context.js","sourceRoot":"","sources":["../src/from-graph-context.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AASlF,MAAM,UAAU,IAAI,CAClB,OAAoB,EACpB,EAAU,EACV,IAAY,EACZ,IAAgB,EAChB,OAAe,EACf,UAA6B,EAAE;IAE/B,OAAO;QACL,EAAE;QACF,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACjD,SAAS,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;QACpC,OAAO;QACP,kBAAkB,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC;QACjE,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE;QAClF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC"}

package/dist/from-graph-plan.d.ts

@@ -0,0 +1,5 @@
+import type { ApplicationGraph, ProviderProfileNode } from "@relkit/graph";
+import { type DeploymentPlan } from "./plan.js";
+import type { FromGraphOptions } from "./from-graph-validation.js";
+export declare function buildPlan(graph: ApplicationGraph, appId: string, graphHash: string, options: FromGraphOptions, providers: Map<string, ProviderProfileNode>): DeploymentPlan;
+//# sourceMappingURL=from-graph-plan.d.ts.map

package/dist/from-graph-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-plan.d.ts","sourceRoot":"","sources":["../src/from-graph-plan.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAoD,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAOnE,wBAAgB,SAAS,CACvB,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAC1C,cAAc,CAqChB"}

package/dist/from-graph-plan.js

@@ -0,0 +1,118 @@
+import { deepFreeze } from "@relkit/contracts";
+import { DEPLOYMENT_PLAN_VERSION } from "./plan.js";
+import { byLogical, envNames, isManaged, logicalName, nodes } from "./from-graph-validation.js";
+import { iam } from "./from-graph-aws.js";
+import { base } from "./from-graph-context.js";
+import { createIamPlan } from "./iam.js";
+import { buckets, caches, eventTriggers, events, routes } from "./from-graph-resources.js";
+export function buildPlan(graph, appId, graphHash, options, providers) {
+    const context = { appId, graphHash, graph, providers };
+    const image = options.image ?? defaultImage(appId, options.httpPort ?? 3000);
+    validateImage(image);
+    const environmentNames = envNames(graph.nodes);
+    return deepFreeze({
+        contractVersion: DEPLOYMENT_PLAN_VERSION,
+        graphHash,
+        application: { id: appId, image, environmentNames },
+        providerBindings: [...providers.values()]
+            .filter((provider) => provider.ownership === "managed")
+            .map((provider) => ({
+            id: provider.id,
+            capability: provider.capability,
+            profile: provider.profile,
+            adapter: provider.adapter,
+            ownership: "managed",
+            configuration: provider.configuration,
+            environment: provider.environment,
+        }))
+            .sort((left, right) => left.id.localeCompare(right.id)),
+        http: {
+            logicalName: logicalName(appId, "http", "public"),
+            port: image.health.port,
+            health: image.health,
+            routes: routes(graph.nodes),
+            configurationNames: environmentNames,
+        },
+        jobs: jobs(context),
+        schedules: schedules(context),
+        events: events(context),
+        eventTriggers: eventTriggers(context),
+        buckets: buckets(context),
+        caches: caches(context),
+        iam: createIamPlan(appId, graph, providers),
+        ...managedObservability(providers, appId, environmentNames),
+    });
+}
+function managedObservability(providers, appId, environmentNames) {
+    const binding = [...providers.values()].find((provider) => provider.capability === "observability" && provider.ownership === "managed");
+    if (binding === undefined)
+        return {};
+    return {
+        observability: {
+            logicalName: logicalName(appId, "observability", binding.profile),
+            configurationNames: environmentNames.filter((name) => /log|trace|otlp/i.test(name)),
+            logs: true,
+            traces: true,
+        },
+    };
+}
+function jobs(context) {
+    return nodes(context.graph.nodes, "job")
+        .filter((job) => isManaged(context.providers, "jobs", job.profile))
+        .map((job) => ({
+        ...base(context, job.id, "job", "jobs", job.profile, iam("jobs", job.id, context.graph.edges)),
+        targetFunctionId: job.targetFunctionId,
+        profile: job.profile,
+        ...(defined(job.retry) ? { retry: job.retry } : {}),
+        ...(defined(job.timeoutMs) ? { timeoutMs: job.timeoutMs } : {}),
+        ...(defined(job.concurrency) ? { concurrency: job.concurrency } : {}),
+        ...(defined(job.idempotency) ? { idempotency: job.idempotency } : {}),
+    }))
+        .sort(byLogical);
+}
+function schedules(context) {
+    return nodes(context.graph.nodes, "job")
+        .filter((job) => isManaged(context.providers, "jobs", job.profile))
+        .flatMap((job) => {
+        if (!Array.isArray(job.schedule))
+            return [];
+        return job.schedule.map((schedule, index) => ({
+            ...base(context, descriptorId(schedule, `${job.id}:schedule:${index}`), "schedule", "jobs", job.profile),
+            jobId: job.id,
+            schedule,
+        }));
+    })
+        .sort(byLogical);
+}
+function defaultImage(appId, port) {
+    return {
+        name: appId,
+        tag: "latest",
+        health: {
+            livenessPath: "/_relkit/v1/health/live",
+            readinessPath: "/_relkit/v1/health/ready",
+            port,
+        },
+    };
+}
+function descriptorId(value, fallback) {
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        const id = value.id;
+        if (typeof id === "string" && id.length > 0)
+            return id;
+    }
+    return fallback;
+}
+function validateImage(image) {
+    if (!image.name ||
+        !image.health ||
+        !image.health.livenessPath ||
+        !image.health.readinessPath ||
+        !Number.isInteger(image.health.port) ||
+        image.health.port < 1)
+        throw new TypeError("Deployment image health metadata is invalid.");
+}
+function defined(value) {
+    return value !== null && value !== undefined;
+}
+//# sourceMappingURL=from-graph-plan.js.map

package/dist/from-graph-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-plan.js","sourceRoot":"","sources":["../src/from-graph-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,uBAAuB,EAAgD,MAAM,WAAW,CAAC;AAElG,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAChG,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAoB,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAE3F,MAAM,UAAU,SAAS,CACvB,KAAuB,EACvB,KAAa,EACb,SAAiB,EACjB,OAAyB,EACzB,SAA2C;IAE3C,MAAM,OAAO,GAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;IAC7E,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC;QAChB,eAAe,EAAE,uBAAuB;QACxC,SAAS;QACT,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACnD,gBAAgB,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;aACtC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC;aACtD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAClB,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,SAAkB;YAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,EAAE;YACJ,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;YACjD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACvB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAC3B,kBAAkB,EAAE,gBAAgB;SACrC;QACD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;QACnB,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;QACvB,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;QACvB,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;QAC3C,GAAG,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC;KAC1C,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,oBAAoB,CAC3B,SAA2C,EAC3C,KAAa,EACb,gBAAmC;IAEnC,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC1C,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,KAAK,eAAe,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,CAC1F,CAAC;IACF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO;QACL,aAAa,EAAE;YACb,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC;YACjE,kBAAkB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnF,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,IAAI;SACb;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,OAAoB;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;SACrC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;SAClE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,GAAG,IAAI,CACL,OAAO,EACP,GAAG,CAAC,EAAE,EACN,KAAK,EACL,MAAM,EACN,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CACzC;QACD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC,CAAC;SACF,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,OAAoB;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;SACrC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;SAClE,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,IAAI,CACL,OAAO,EACP,YAAY,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,EAAE,aAAa,KAAK,EAAE,CAAC,EACrD,UAAU,EACV,MAAM,EACN,GAAG,CAAC,OAAO,CACZ;YACD,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,QAAQ;SACT,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;SACD,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY;IAC/C,OAAO;QACL,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,QAAQ;QACb,MAAM,EAAE;YACN,YAAY,EAAE,yBAAyB;YACvC,aAAa,EAAE,0BAA0B;YACzC,IAAI;SACL;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,QAAgB;IACpD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE,GAAI,KAAmC,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,IACE,CAAC,KAAK,CAAC,IAAI;QACX,CAAC,KAAK,CAAC,MAAM;QACb,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY;QAC1B,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa;QAC3B,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QACpC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;QAErB,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAI,KAA2B;IAC7C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;AAC/C,CAAC"}