@relkit/deploy 0.0.0

package/dist/from-graph-resources.d.ts

@@ -0,0 +1,63 @@
+import type { GraphNode } from "@relkit/graph";
+import { type PlanContext } from "./from-graph-context.js";
+export declare function events(context: PlanContext): {
+    version: number;
+    payload: import("@relkit/contracts").JsonValue;
+    id: string;
+    logicalName: string;
+    bindingId: string;
+    profile?: string;
+    configurationNames: readonly string[];
+    capabilities?: readonly string[];
+    tags?: Readonly<Record<string, string>>;
+    metadata?: import("@relkit/contracts").JsonValue;
+}[];
+export declare function eventTriggers(context: PlanContext): {
+    concurrency?: number;
+    retry?: string | number | boolean | readonly import("@relkit/contracts").JsonValue[] | {
+        readonly [key: string]: import("@relkit/contracts").JsonValue;
+    };
+    targetFunctionId: string;
+    expansion: `${string}@${number}`[];
+    delivery: "ephemeral" | "durable";
+    id: string;
+    logicalName: string;
+    bindingId: string;
+    profile?: string;
+    configurationNames: readonly string[];
+    capabilities?: readonly string[];
+    tags?: Readonly<Record<string, string>>;
+    metadata?: import("@relkit/contracts").JsonValue;
+}[];
+export declare function buckets(context: PlanContext): {
+    allowedContentTypes?: string[];
+    maxObjectBytes?: number;
+    profile: string;
+    visibility: "private" | "public";
+    id: string;
+    logicalName: string;
+    bindingId: string;
+    configurationNames: readonly string[];
+    capabilities?: readonly string[];
+    tags?: Readonly<Record<string, string>>;
+    metadata?: import("@relkit/contracts").JsonValue;
+}[];
+export declare function caches(context: PlanContext): {
+    maxTtlMs?: number;
+    defaultTtlMs?: number;
+    profile: string;
+    id: string;
+    logicalName: string;
+    bindingId: string;
+    configurationNames: readonly string[];
+    capabilities?: readonly string[];
+    tags?: Readonly<Record<string, string>>;
+    metadata?: import("@relkit/contracts").JsonValue;
+}[];
+export declare function routes(graphNodes: readonly GraphNode[]): {
+    id: string;
+    method: string;
+    path: string;
+    targetFunctionId: string;
+}[];
+//# sourceMappingURL=from-graph-resources.d.ts.map

package/dist/from-graph-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-resources.d.ts","sourceRoot":"","sources":["../src/from-graph-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,SAAS,EAAE,MAAM,eAAe,CAAC;AAInE,OAAO,EAAQ,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEjE,wBAAgB,MAAM,CAAC,OAAO,EAAE,WAAW;;;;;;;;;;;IAgB1C;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW;;;;;;;;;;;;;;;;IA8BjD;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW;;;;;;;;;;;;IAoB3C;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,WAAW;;;;;;;;;;;IAiB1C;AAED,wBAAgB,MAAM,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE;;;;;IAgBtD"}

package/dist/from-graph-resources.js

@@ -0,0 +1,77 @@
+import { byLogical, isManaged, nodes } from "./from-graph-validation.js";
+import { iam } from "./from-graph-aws.js";
+import { base } from "./from-graph-context.js";
+export function events(context) {
+    return nodes(context.graph.nodes, "event")
+        .filter(() => isManaged(context.providers, "events", "default"))
+        .map((event) => ({
+        ...base(context, event.id, "event", "events", "default", iam("events", event.id, context.graph.edges)),
+        version: event.version,
+        payload: event.payload,
+    }))
+        .sort(byLogical);
+}
+export function eventTriggers(context) {
+    return context.graph.nodes
+        .filter((node) => node.kind === "trigger" && node.triggerType === "event")
+        .filter((node) => {
+        const config = node.config;
+        return isManaged(context.providers, "events", config.profile ?? "default");
+    })
+        .map((node) => {
+        const config = node.config;
+        const profile = config.profile ?? "default";
+        return {
+            ...base(context, node.id, "event-trigger", "events", profile, config.delivery === "durable" ? iam("jobs", node.id, context.graph.edges) : []),
+            targetFunctionId: node.targetFunctionId,
+            expansion: [...config.expansion].sort(),
+            delivery: config.delivery,
+            ...(defined(config.retry) ? { retry: config.retry } : {}),
+            ...(defined(config.concurrency) ? { concurrency: config.concurrency } : {}),
+        };
+    })
+        .sort(byLogical);
+}
+export function buckets(context) {
+    return nodes(context.graph.nodes, "bucket")
+        .filter((bucket) => isManaged(context.providers, "buckets", bucket.profile))
+        .map((bucket) => ({
+        ...base(context, bucket.id, "bucket", "buckets", bucket.profile, iam("buckets", bucket.id, context.graph.edges)),
+        profile: bucket.profile,
+        visibility: bucket.visibility,
+        ...(defined(bucket.maxObjectBytes) ? { maxObjectBytes: bucket.maxObjectBytes } : {}),
+        ...(defined(bucket.allowedContentTypes)
+            ? { allowedContentTypes: [...bucket.allowedContentTypes].sort() }
+            : {}),
+    }))
+        .sort(byLogical);
+}
+export function caches(context) {
+    return nodes(context.graph.nodes, "cache")
+        .filter((cache) => isManaged(context.providers, "cache", cache.profile))
+        .map((cache) => ({
+        ...base(context, cache.id, "cache", "cache", cache.profile, iam("cache", cache.id, context.graph.edges)),
+        profile: cache.profile,
+        ...(defined(cache.defaultTtlMs) ? { defaultTtlMs: cache.defaultTtlMs } : {}),
+        ...(defined(cache.maxTtlMs) ? { maxTtlMs: cache.maxTtlMs } : {}),
+    }))
+        .sort(byLogical);
+}
+export function routes(graphNodes) {
+    return graphNodes
+        .filter((node) => node.kind === "trigger" && node.triggerType === "http")
+        .map((node) => {
+        const config = node.config;
+        return {
+            id: node.id,
+            method: config.method,
+            path: config.path,
+            targetFunctionId: node.targetFunctionId,
+        };
+    })
+        .sort((left, right) => left.id.localeCompare(right.id));
+}
+function defined(value) {
+    return value !== null && value !== undefined;
+}
+//# sourceMappingURL=from-graph-resources.js.map

package/dist/from-graph-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-resources.js","sourceRoot":"","sources":["../src/from-graph-resources.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAoB,MAAM,yBAAyB,CAAC;AAEjE,MAAM,UAAU,MAAM,CAAC,OAAoB;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;SACvC,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;SAC/D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,GAAG,IAAI,CACL,OAAO,EACP,KAAK,CAAC,EAAE,EACR,OAAO,EACP,QAAQ,EACR,SAAS,EACT,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAC7C;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;SACF,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK;SACvB,MAAM,CACL,CAAC,IAAI,EAAmD,EAAE,CACxD,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CAC1D;SACA,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,MAAuC,CAAC;QAC5D,OAAO,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAuC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;QAC5C,OAAO;YACL,GAAG,IAAI,CACL,OAAO,EACP,IAAI,CAAC,EAAE,EACP,eAAe,EACf,QAAQ,EACR,OAAO,EACP,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/E;YACD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE;YACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC;SACxC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;SAC3E,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChB,GAAG,IAAI,CACL,OAAO,EACP,MAAM,CAAC,EAAE,EACT,QAAQ,EACR,SAAS,EACT,MAAM,CAAC,OAAO,EACd,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAC/C;QACD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC;YACrC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;SACF,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAoB;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;SACvC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,GAAG,IAAI,CACL,OAAO,EACP,KAAK,CAAC,EAAE,EACR,OAAO,EACP,OAAO,EACP,KAAK,CAAC,OAAO,EACb,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAC5C;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC,CAAC;SACF,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,UAAgC;IACrD,OAAO,UAAU;SACd,MAAM,CACL,CAAC,IAAI,EAAmD,EAAE,CACxD,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CACzD;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAA4D,CAAC;QACjF,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO,CAAI,KAA2B;IAC7C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;AAC/C,CAAC"}

package/dist/from-graph-validation.d.ts

@@ -0,0 +1,39 @@
+import type { AppNode, ApplicationGraph, GraphNode, ProviderProfileNode } from "@relkit/graph";
+export declare const AWS_DEPLOYMENT_CAPABILITIES: readonly ["buckets", "cache", "events", "jobs", "models", "observability"];
+export type Capability = (typeof AWS_DEPLOYMENT_CAPABILITIES)[number];
+type EnvNode = Extract<GraphNode, {
+    kind: "env";
+}>;
+export interface FromGraphOptions {
+    readonly image?: import("./plan.js").ContainerImagePlan;
+    readonly httpPort?: number;
+}
+export type DeploymentPlanErrorCode = "RELKIT_DEPLOY_GRAPH_INVALID" | "RELKIT_DEPLOY_SECRET_UNSUPPORTED" | "RELKIT_DEPLOY_LIVE_OBJECT_UNSUPPORTED" | "RELKIT_DEPLOY_AWS_CAPABILITY_UNSUPPORTED" | "RELKIT_DEPLOY_AWS_PROFILE_UNSUPPORTED" | "RELKIT_DEPLOY_CONFIGURATION_MISSING";
+export declare class DeploymentPlanError extends Error {
+    readonly code: DeploymentPlanErrorCode;
+    constructor(code: DeploymentPlanErrorCode, message: string);
+}
+export declare function providerMap(nodes: readonly GraphNode[]): Map<string, ProviderProfileNode>;
+export declare function validateProviders(app: AppNode, providers: Map<string, ProviderProfileNode>, nodes: readonly GraphNode[], edges: ApplicationGraph["edges"]): void;
+export declare function requireProvider(providers: Map<string, ProviderProfileNode>, capability: Capability, profile: string): ProviderProfileNode;
+export declare function configNames(providers: Map<string, ProviderProfileNode>, name: Capability, profile: string): string[];
+export declare function isManaged(providers: Map<string, ProviderProfileNode>, capability: Capability, profile: string): boolean;
+export declare function providerId(capability: string, profile: string): string;
+export declare function onlyApp(nodes: readonly GraphNode[]): Extract<GraphNode, {
+    kind: "app";
+}>;
+export declare function nodes<K extends GraphNode["kind"]>(values: readonly GraphNode[], kind: K): Extract<GraphNode, {
+    kind: K;
+}>[];
+export declare function envNodes(nodes: readonly GraphNode[]): Map<string, EnvNode>;
+export declare function envNames(nodes: readonly GraphNode[]): string[];
+export declare function logicalName(appId: string, kind: string, id: string): string;
+export declare function byLogical(left: {
+    readonly logicalName: string;
+}, right: {
+    readonly logicalName: string;
+}): number;
+export declare function secretName(value: string): boolean;
+export declare function fail(code: DeploymentPlanErrorCode, message: string): never;
+export {};
+//# sourceMappingURL=from-graph-validation.d.ts.map

package/dist/from-graph-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-validation.d.ts","sourceRoot":"","sources":["../src/from-graph-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAG/F,eAAO,MAAM,2BAA2B,4EAO9B,CAAC;AACX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,KAAK,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAWnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,WAAW,EAAE,kBAAkB,CAAC;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,uBAAuB,GAC/B,6BAA6B,GAC7B,kCAAkC,GAClC,uCAAuC,GACvC,0CAA0C,GAC1C,uCAAuC,GACvC,qCAAqC,CAAC;AAE1C,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,IAAI,EAAE,uBAAuB;gBAA7B,IAAI,EAAE,uBAAuB,EACtC,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAMzF;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAC3C,KAAK,EAAE,SAAS,SAAS,EAAE,EAC3B,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAC/B,IAAI,CA0BN;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAC3C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,MAAM,GACd,mBAAmB,CAOrB;AAED,wBAAgB,WAAW,CACzB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAC3C,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAMV;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAC3C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,MAAM,GACd,OAAO,CAET;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAOxF;AAED,wBAAgB,KAAK,CAAC,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,EAC/C,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,SAAS,EAAE;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAEnC;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAI1E;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,EAAE,CAK9D;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAU3E;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EACtC,KAAK,EAAE;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtC,MAAM,CAER;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIjD;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAE1E"}

package/dist/from-graph-validation.js

@@ -0,0 +1,104 @@
+import { usedCapabilities } from "./from-graph-aws.js";
+export const AWS_DEPLOYMENT_CAPABILITIES = [
+    "buckets",
+    "cache",
+    "events",
+    "jobs",
+    "models",
+    "observability",
+];
+const AWS_ADAPTERS = {
+    buckets: ["s3"],
+    cache: ["redis"],
+    events: ["eventbridge"],
+    jobs: ["sqs"],
+    models: [],
+    observability: ["cloudwatch"],
+};
+export class DeploymentPlanError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "DeploymentPlanError";
+    }
+}
+export function providerMap(nodes) {
+    return new Map(nodes
+        .filter((node) => node.kind === "provider")
+        .map((node) => [node.id, node]));
+}
+export function validateProviders(app, providers, nodes, edges) {
+    for (const provider of providers.values()) {
+        if (!AWS_DEPLOYMENT_CAPABILITIES.includes(provider.capability)) {
+            fail("RELKIT_DEPLOY_AWS_CAPABILITY_UNSUPPORTED", `AWS does not support capability ${provider.capability}.`);
+        }
+        if (provider.ownership === "managed" &&
+            !AWS_ADAPTERS[provider.capability].includes(provider.adapter)) {
+            fail("RELKIT_DEPLOY_AWS_CAPABILITY_UNSUPPORTED", `AWS does not support managed ${provider.capability}:${provider.adapter}.`);
+        }
+    }
+    for (const id of app.providerBindings ?? []) {
+        if (!providers.has(id)) {
+            fail("RELKIT_DEPLOY_AWS_PROFILE_UNSUPPORTED", `Provider binding ${id} is missing.`);
+        }
+    }
+    for (const { capability, profile } of usedCapabilities(nodes, edges)) {
+        requireProvider(providers, capability, profile);
+    }
+}
+export function requireProvider(providers, capability, profile) {
+    const provider = providers.get(providerId(capability, profile));
+    if (provider !== undefined)
+        return provider;
+    fail("RELKIT_DEPLOY_AWS_PROFILE_UNSUPPORTED", `Provider profile ${profile} does not implement ${capability}.`);
+}
+export function configNames(providers, name, profile) {
+    const provider = requireProvider(providers, name, profile);
+    return provider.environment
+        .filter((entry) => !entry.sensitive && !secretName(entry.name))
+        .map((entry) => entry.name)
+        .sort();
+}
+export function isManaged(providers, capability, profile) {
+    return requireProvider(providers, capability, profile).ownership === "managed";
+}
+export function providerId(capability, profile) {
+    return `provider.${capability}.${profile}`;
+}
+export function onlyApp(nodes) {
+    const apps = nodes.filter((node) => node.kind === "app");
+    if (apps.length !== 1)
+        fail("RELKIT_DEPLOY_GRAPH_INVALID", "Graph must contain exactly one app node.");
+    return apps[0];
+}
+export function nodes(values, kind) {
+    return values.filter((node) => node.kind === kind);
+}
+export function envNodes(nodes) {
+    return new Map(nodes.filter((node) => node.kind === "env").map((node) => [node.name, node]));
+}
+export function envNames(nodes) {
+    return [...envNodes(nodes).values()]
+        .filter((node) => !node.sensitive && !secretName(node.name))
+        .map((node) => node.name)
+        .sort();
+}
+export function logicalName(appId, kind, id) {
+    return [appId, kind, id]
+        .map((value) => value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-|-$/g, "") || "resource")
+        .join("-");
+}
+export function byLogical(left, right) {
+    return left.logicalName.localeCompare(right.logicalName);
+}
+export function secretName(value) {
+    return /api[-_]?key|password|secret(value)?|private[-_]?key|access[-_]?key|credential/i.test(value);
+}
+export function fail(code, message) {
+    throw new DeploymentPlanError(code, message);
+}
+//# sourceMappingURL=from-graph-validation.js.map

package/dist/from-graph-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph-validation.js","sourceRoot":"","sources":["../src/from-graph-validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,SAAS;IACT,OAAO;IACP,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,eAAe;CACP,CAAC;AAIX,MAAM,YAAY,GAAoD;IACpE,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,MAAM,EAAE,CAAC,aAAa,CAAC;IACvB,IAAI,EAAE,CAAC,KAAK,CAAC;IACb,MAAM,EAAE,EAAE;IACV,aAAa,EAAE,CAAC,YAAY,CAAC;CAC9B,CAAC;AAeF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IADX,YACW,IAA6B,EACtC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAyB;QAItC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,KAA2B;IACrD,OAAO,IAAI,GAAG,CACZ,KAAK;SACF,MAAM,CAAC,CAAC,IAAI,EAA+B,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC;SACvE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAY,EACZ,SAA2C,EAC3C,KAA2B,EAC3B,KAAgC;IAEhC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAE,2BAAiD,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACtF,IAAI,CACF,0CAA0C,EAC1C,mCAAmC,QAAQ,CAAC,UAAU,GAAG,CAC1D,CAAC;QACJ,CAAC;QACD,IACE,QAAQ,CAAC,SAAS,KAAK,SAAS;YAChC,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAwB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC3E,CAAC;YACD,IAAI,CACF,0CAA0C,EAC1C,gCAAgC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,OAAO,GAAG,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,uCAAuC,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACrE,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAA2C,EAC3C,UAAsB,EACtB,OAAe;IAEf,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,CACF,uCAAuC,EACvC,oBAAoB,OAAO,uBAAuB,UAAU,GAAG,CAChE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,SAA2C,EAC3C,IAAgB,EAChB,OAAe;IAEf,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,QAAQ,CAAC,WAAW;SACxB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC9D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAA2C,EAC3C,UAAsB,EACtB,OAAe;IAEf,OAAO,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,OAAe;IAC5D,OAAO,YAAY,UAAU,IAAI,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAA2B;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CACvB,CAAC,IAAI,EAA+C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAC3E,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QACnB,IAAI,CAAC,6BAA6B,EAAE,0CAA0C,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,MAA4B,EAC5B,IAAO;IAEP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAA2C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAA2B;IAClD,OAAO,IAAI,GAAG,CACZ,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAmB,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC9F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAA2B;IAClD,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;SACjC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC3D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,IAAY,EAAE,EAAU;IACjE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;SACrB,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,KAAK;SACF,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,UAAU,CACzC;SACA,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAsC,EACtC,KAAuC;IAEvC,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,gFAAgF,CAAC,IAAI,CAC1F,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAA6B,EAAE,OAAe;IACjE,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC"}

package/dist/from-graph.d.ts

@@ -0,0 +1,6 @@
+import { type ApplicationGraph } from "@relkit/graph";
+import { AWS_DEPLOYMENT_CAPABILITIES, DeploymentPlanError, type DeploymentPlanErrorCode, type FromGraphOptions } from "./from-graph-validation.js";
+export { AWS_DEPLOYMENT_CAPABILITIES, DeploymentPlanError, type DeploymentPlanErrorCode, type FromGraphOptions, };
+export declare function fromGraph(graph: ApplicationGraph, options?: FromGraphOptions): import("./plan.js").DeploymentPlan;
+export declare const createDeploymentPlan: typeof fromGraph;
+//# sourceMappingURL=from-graph.d.ts.map

package/dist/from-graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph.d.ts","sourceRoot":"","sources":["../src/from-graph.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EAInB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACtB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,CAAC;AAEF,wBAAgB,SAAS,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,GAAE,gBAAqB,sCA2BhF;AAED,eAAO,MAAM,oBAAoB,kBAAY,CAAC"}

package/dist/from-graph.js

@@ -0,0 +1,28 @@
+import { GRAPH_VERSION } from "@relkit/contracts";
+import { canonicalizeGraph, hashGraph, validateGraphShape, } from "@relkit/graph";
+import { validateBoundary } from "./from-graph-boundary.js";
+import { buildPlan } from "./from-graph-plan.js";
+import { AWS_DEPLOYMENT_CAPABILITIES, DeploymentPlanError, onlyApp, providerMap, validateProviders, } from "./from-graph-validation.js";
+export { AWS_DEPLOYMENT_CAPABILITIES, DeploymentPlanError, };
+export function fromGraph(graph, options = {}) {
+    validateBoundary(graph);
+    validateBoundary(options);
+    try {
+        validateGraphShape(graph);
+    }
+    catch (error) {
+        throw new DeploymentPlanError("RELKIT_DEPLOY_GRAPH_INVALID", error instanceof Error ? error.message : "Graph shape is invalid.");
+    }
+    const normalized = canonicalizeGraph(graph);
+    if (normalized.contractVersion !== GRAPH_VERSION)
+        throw new DeploymentPlanError("RELKIT_DEPLOY_GRAPH_INVALID", "Unsupported graph contract version.");
+    const app = onlyApp(normalized.nodes);
+    const appId = normalized.appId ?? app.id;
+    if (normalized.appId !== undefined && normalized.appId !== app.id)
+        throw new DeploymentPlanError("RELKIT_DEPLOY_GRAPH_INVALID", "Graph appId does not match its app node.");
+    const providers = providerMap(normalized.nodes);
+    validateProviders(app, providers, normalized.nodes, normalized.edges);
+    return buildPlan(normalized, appId, hashGraph(normalized), options, providers);
+}
+export const createDeploymentPlan = fromGraph;
+//# sourceMappingURL=from-graph.js.map

package/dist/from-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-graph.js","sourceRoot":"","sources":["../src/from-graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,OAAO,EACP,WAAW,EACX,iBAAiB,GAGlB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GAGpB,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,KAAuB,EAAE,UAA4B,EAAE;IAC/E,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,eAAe,KAAK,aAAa;QAC9C,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,qCAAqC,CACtC,CAAC;IACJ,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;IACzC,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,KAAK,GAAG,CAAC,EAAE;QAC/D,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,0CAA0C,CAC3C,CAAC;IACJ,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAChD,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC"}

package/dist/iam.d.ts

@@ -0,0 +1,5 @@
+import type { ApplicationGraph, ProviderProfileNode } from "@relkit/graph";
+import type { DeploymentIamPlan } from "./plan.js";
+/** Builds edge-derived shared-role policy data and future per-function grants. */
+export declare function createIamPlan(appId: string, graph: ApplicationGraph, providers: ReadonlyMap<string, ProviderProfileNode>): DeploymentIamPlan;
+//# sourceMappingURL=iam.d.ts.map

package/dist/iam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAa,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEtF,OAAO,KAAK,EAEV,iBAAiB,EAElB,MAAM,WAAW,CAAC;AAwBnB,kFAAkF;AAClF,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAClD,iBAAiB,CAwDnB"}

package/dist/iam.js

@@ -0,0 +1,96 @@
+import { logicalName } from "./from-graph-validation.js";
+const ACTIONS = {
+    bucket: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"],
+    cache: ["elasticache:Connect"],
+    eventPublish: ["events:PutEvents"],
+    jobConsume: ["sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility"],
+    eventConsume: [
+        "sqs:ReceiveMessage",
+        "sqs:DeleteMessage",
+        "sqs:ChangeMessageVisibility",
+        "sqs:GetQueueAttributes",
+    ],
+    jobPublish: ["sqs:SendMessage"],
+};
+/** Builds edge-derived shared-role policy data and future per-function grants. */
+export function createIamPlan(appId, graph, providers) {
+    const grants = new Map();
+    const managedResources = new Set(graph.edges.flatMap((edge) => {
+        if (edge.kind !== "uses-provider-profile")
+            return [];
+        return providers.get(edge.to)?.ownership === "managed" ? [edge.from] : [];
+    }));
+    const functionIds = new Set(graph.nodes.filter((node) => node.kind === "function").map((node) => node.id));
+    const add = (functionId, capability, resourceId, kind, actions) => {
+        if (actions.length === 0 || !managedResources.has(resourceId))
+            return;
+        const resource = logicalName(appId, kind, resourceId);
+        const key = [functionId, capability, resourceId, actions.join(",")].join("\0");
+        grants.set(key, { functionId, capability, resourceId, resource, actions });
+    };
+    for (const edge of graph.edges) {
+        if (!functionIds.has(edge.from))
+            continue;
+        if (edge.kind === "uses-bucket")
+            add(edge.from, "buckets", edge.to, "bucket", ACTIONS.bucket);
+        if (edge.kind === "uses-cache")
+            add(edge.from, "cache", edge.to, "cache", ACTIONS.cache);
+        if (edge.kind === "enqueues-job")
+            add(edge.from, "jobs", edge.to, "job", ACTIONS.jobPublish);
+        if (edge.kind === "publishes-event")
+            add(edge.from, "events", edge.to, "event", ACTIONS.eventPublish);
+    }
+    for (const node of graph.nodes) {
+        if (node.kind === "job")
+            add(node.targetFunctionId, "jobs", node.id, "job", ACTIONS.jobConsume);
+        if (node.kind === "trigger" &&
+            node.triggerType === "event" &&
+            isRecord(node.config) &&
+            node.config.delivery === "durable")
+            add(node.targetFunctionId, "jobs", node.id, "event-trigger", ACTIONS.eventConsume);
+    }
+    const perFunction = [...grants.values()]
+        .sort(compareGrants)
+        .map(({ functionId, capability, resourceId, actions }) => ({
+        functionId,
+        capability,
+        resourceId,
+        actions: [...actions],
+    }));
+    return {
+        serviceRole: { statements: statements([...grants.values()]) },
+        perFunction,
+    };
+}
+function statements(grants) {
+    const grouped = new Map();
+    for (const grant of grants) {
+        const key = `${grant.capability}\0${grant.actions.join(",")}`;
+        const current = grouped.get(key) ?? {
+            capability: grant.capability,
+            actions: grant.actions,
+            resources: new Set(),
+        };
+        current.resources.add(grant.resource);
+        grouped.set(key, current);
+    }
+    return [...grouped.values()]
+        .map(({ capability, actions, resources }) => ({
+        capability,
+        actions: [...actions],
+        resources: [...resources].sort(),
+    }))
+        .sort((left, right) => left.capability.localeCompare(right.capability) ||
+        left.actions.join(",").localeCompare(right.actions.join(",")) ||
+        left.resources.join(",").localeCompare(right.resources.join(",")));
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function compareGrants(left, right) {
+    return (left.functionId.localeCompare(right.functionId) ||
+        left.capability.localeCompare(right.capability) ||
+        left.resourceId.localeCompare(right.resourceId) ||
+        left.actions.join(",").localeCompare(right.actions.join(",")));
+}
+//# sourceMappingURL=iam.js.map

package/dist/iam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.js","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAOzD,MAAM,OAAO,GAAG;IACd,MAAM,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,CAAC;IAC5E,KAAK,EAAE,CAAC,qBAAqB,CAAC;IAC9B,YAAY,EAAE,CAAC,kBAAkB,CAAC;IAClC,UAAU,EAAE,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,6BAA6B,CAAC;IACtF,YAAY,EAAE;QACZ,oBAAoB;QACpB,mBAAmB;QACnB,6BAA6B;QAC7B,wBAAwB;KACzB;IACD,UAAU,EAAE,CAAC,iBAAiB,CAAC;CACvB,CAAC;AAUX,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,KAAuB,EACvB,SAAmD;IAEnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IACxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB;YAAE,OAAO,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,CAAC,CAAC,CACH,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC9E,CAAC;IACF,MAAM,GAAG,GAAG,CACV,UAAkB,EAClB,UAAkB,EAClB,UAAkB,EAClB,IAAY,EACZ,OAA0B,EACpB,EAAE;QACR,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO;QACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7F,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;YACjC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAChG,IACE,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,WAAW,KAAK,OAAO;YAC5B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;YAElC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;SACrC,IAAI,CAAC,aAAa,CAAC;SACnB,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,EAAgC,EAAE,CAAC,CAAC;QACvF,UAAU;QACV,UAAU;QACV,UAAU;QACV,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC,CAAC;IACN,OAAO;QACL,WAAW,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;QAC7D,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAwB;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAGpB,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;YAClC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,IAAI,GAAG,EAAU;SAC7B,CAAC;QACF,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;SACzB,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,UAAU;QACV,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;QACrB,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE;KACjC,CAAC,CAAC;SACF,IAAI,CACH,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CACpE,CAAC;AACN,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,IAAW,EAAE,KAAY;IAC9C,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./plan.js";
+export * from "./from-graph.js";
+export * from "./diff.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from "./plan.js";
+export * from "./from-graph.js";
+export * from "./diff.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC"}

package/dist/plan.d.ts

@@ -0,0 +1,143 @@
+import type { JsonValue } from "@relkit/contracts";
+/** Versioned, JSON-safe protocol name for deployment plans. */
+export declare const DEPLOYMENT_PLAN_PROTOCOL: "relkit.deployment-plan";
+/** Current provider-neutral deployment-plan contract version. */
+export declare const DEPLOYMENT_PLAN_VERSION: 2;
+export type DeploymentPlanVersion = typeof DEPLOYMENT_PLAN_VERSION;
+export interface DeploymentHealthPlan {
+    readonly livenessPath: string;
+    readonly readinessPath: string;
+    readonly port: number;
+    readonly intervalMs?: number;
+    readonly timeoutMs?: number;
+}
+export interface ContainerImagePlan {
+    readonly name: string;
+    readonly tag?: string;
+    readonly digest?: string;
+    readonly health: DeploymentHealthPlan;
+}
+export interface ApplicationDeploymentPlan {
+    readonly id: string;
+    readonly image: ContainerImagePlan;
+    /** Names only; values, including secrets, never cross the plan boundary. */
+    readonly environmentNames: readonly string[];
+}
+export interface DeploymentCapabilityPlan {
+    readonly id: string;
+    readonly logicalName: string;
+    readonly bindingId: string;
+    readonly profile?: string;
+    readonly configurationNames: readonly string[];
+    readonly capabilities?: readonly string[];
+    readonly tags?: Readonly<Record<string, string>>;
+    readonly metadata?: JsonValue;
+}
+export interface ProviderDeploymentPlan {
+    readonly id: string;
+    readonly capability: string;
+    readonly profile: string;
+    readonly adapter: string;
+    readonly ownership: "managed";
+    readonly configuration: JsonValue;
+    readonly environment: readonly {
+        readonly name: string;
+        readonly type: string;
+        readonly sensitive: boolean;
+    }[];
+}
+export interface HttpRouteDeploymentPlan {
+    readonly id: string;
+    readonly method: string;
+    readonly path: string;
+    readonly targetFunctionId: string;
+}
+export interface HttpDeploymentPlan {
+    readonly logicalName: string;
+    readonly port: number;
+    readonly health: DeploymentHealthPlan;
+    readonly routes: readonly HttpRouteDeploymentPlan[];
+    readonly configurationNames: readonly string[];
+}
+export interface JobDeploymentPlan extends DeploymentCapabilityPlan {
+    readonly targetFunctionId: string;
+    readonly profile: string;
+    readonly retry?: JsonValue;
+    readonly timeoutMs?: number;
+    readonly concurrency?: number;
+    readonly idempotency?: JsonValue;
+}
+export interface ScheduleDeploymentPlan extends DeploymentCapabilityPlan {
+    readonly jobId: string;
+    readonly schedule: JsonValue;
+}
+export interface EventDeploymentPlan extends DeploymentCapabilityPlan {
+    readonly version: number;
+    readonly payload: JsonValue;
+}
+export interface EventTriggerDeploymentPlan extends DeploymentCapabilityPlan {
+    readonly targetFunctionId: string;
+    readonly expansion: readonly string[];
+    readonly delivery: "ephemeral" | "durable";
+    readonly retry?: JsonValue;
+    readonly concurrency?: number;
+}
+export interface BucketDeploymentPlan extends DeploymentCapabilityPlan {
+    readonly profile: string;
+    readonly visibility: "private" | "public";
+    readonly maxObjectBytes?: number;
+    readonly allowedContentTypes?: readonly string[];
+}
+export interface CacheDeploymentPlan extends DeploymentCapabilityPlan {
+    readonly profile: string;
+    readonly defaultTtlMs?: number;
+    readonly maxTtlMs?: number;
+}
+export interface ObservabilityDeploymentPlan {
+    readonly logicalName: string;
+    readonly configurationNames: readonly string[];
+    readonly logs: boolean;
+    readonly traces: boolean;
+    readonly retentionDays?: number;
+    readonly export?: {
+        readonly enabled: boolean;
+        readonly configurationNames: readonly string[];
+    };
+}
+/** One safe, logical-resource IAM statement for the shared application role. */
+export interface DeploymentIamStatement {
+    readonly capability: string;
+    readonly actions: readonly string[];
+    /** Stable deployment logical names, never resolved ARNs or secret values. */
+    readonly resources: readonly string[];
+}
+/** Desired isolation metadata retained while the POC uses one shared task role. */
+export interface DeploymentFunctionCapability {
+    readonly functionId: string;
+    readonly capability: string;
+    readonly resourceId: string;
+    readonly actions: readonly string[];
+}
+export interface DeploymentIamPlan {
+    readonly serviceRole: {
+        readonly statements: readonly DeploymentIamStatement[];
+    };
+    readonly perFunction: readonly DeploymentFunctionCapability[];
+}
+/** Complete provider-neutral deployment input for the Pulumi adapter. */
+export interface DeploymentPlan {
+    readonly contractVersion: number;
+    readonly graphHash: string;
+    readonly application: ApplicationDeploymentPlan;
+    readonly providerBindings: readonly ProviderDeploymentPlan[];
+    readonly http: HttpDeploymentPlan;
+    readonly jobs: readonly JobDeploymentPlan[];
+    readonly schedules: readonly ScheduleDeploymentPlan[];
+    readonly events: readonly EventDeploymentPlan[];
+    readonly eventTriggers: readonly EventTriggerDeploymentPlan[];
+    readonly buckets: readonly BucketDeploymentPlan[];
+    readonly caches: readonly CacheDeploymentPlan[];
+    readonly iam: DeploymentIamPlan;
+    readonly observability?: ObservabilityDeploymentPlan;
+}
+//# sourceMappingURL=plan.d.ts.map