@vibesdotdev/infra-core 0.0.1 → 1.0.0-rc.4

package/dist/kinds/rum.kind.d.ts

@@ -12,8 +12,8 @@
  * The kind decouples *configuration* (which hostnames, which token,
  * which privacy mode) from *delivery* (how the beacon `<script>` tag
  * lands in the HTML). For SvelteKit apps, the
- * `@vibesdotdev/cloudflare-web-analytics` package provides a `handle`
- * hook that injects the beacon via `transformPageChunk` — no
+ * `@vibesdotdev/integrations-cloudflare/svelte/web-analytics` surface provides a
+ * `handle` hook that injects the beacon via `transformPageChunk` — no
  * per-app `app.html` edits required once the kind is wired in.
  */
 import * as z from 'zod/v4';
@@ -32,10 +32,10 @@ export type RumPrivacy = z.infer<typeof RumPrivacySchema>;
  *   custom                 → caller injects however they want; we just track config
  */
 declare const RumInjectionSchema: z.ZodEnum<{
+    custom: "custom";
     "app-html": "app-html";
     "sveltekit-hook": "sveltekit-hook";
     "provider-auto": "provider-auto";
-    custom: "custom";
 }>;
 export type RumInjection = z.infer<typeof RumInjectionSchema>;
 declare const RumBaseSchema: z.ZodObject<{
@@ -45,9 +45,19 @@ declare const RumBaseSchema: z.ZodObject<{
     tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
     hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
     priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
     requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
     optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
     kind: z.ZodLiteral<"infra/rum">;
     adapter: z.ZodString;
     adapterConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -58,10 +68,10 @@ declare const RumBaseSchema: z.ZodObject<{
     }, z.core.$strip>]>;
     hostnames: z.ZodDefault<z.ZodArray<z.ZodString>>;
     injection: z.ZodDefault<z.ZodEnum<{
+        custom: "custom";
         "app-html": "app-html";
         "sveltekit-hook": "sveltekit-hook";
         "provider-auto": "provider-auto";
-        custom: "custom";
     }>>;
     privacy: z.ZodDefault<z.ZodObject<{
         excludeEU: z.ZodDefault<z.ZodBoolean>;
@@ -89,7 +99,27 @@ export interface RumSiteSnapshot {
     pageViews24h?: number;
     createdAt?: string;
 }
+/** Real provider measurements, normalized to milliseconds. Empty is not healthy. */
+export interface RumPerformanceSnapshot {
+    start: string;
+    end: string;
+    rows: Array<{
+        hostname: string;
+        path: string;
+        samples: number;
+        lcpP75Ms: number;
+    }>;
+    /** A truncated result must not be used to assert complete coverage. */
+    truncated: boolean;
+}
+export interface RumPerformanceQuery {
+    hostname: string;
+    start: string;
+    end: string;
+}
 export interface RumImplementation {
+    /** Optional read capability; unsupported providers report unavailable, never zero. */
+    getPerformance?(query: RumPerformanceQuery): Promise<RumPerformanceSnapshot>;
     /** Enumerate the configured RUM sites on the provider. */
     listSites(): Promise<RumSiteSnapshot[]>;
     /** Look up a single site by siteTag. */
@@ -106,7 +136,7 @@ export interface RumImplementation {
     /** Toggle enabled state. */
     setEnabled(siteTag: string, enabled: boolean): Promise<void>;
 }
-export declare const rumKind: import("@vibesdotdev/runtime").RuntimeKindDescriptorRecord<RumImplementation>;
+export declare const rumKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<RumImplementation>;
 export type InfraRumKind = InfraRumDescriptor;
 export type InfraRumKindInput = InfraRumDescriptorInput;
 export { RumBaseSchema as InfraRumDescriptorSchema, RumPrivacySchema, RumInjectionSchema };

package/dist/kinds/rum.kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rum.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/rum.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,QAAA,MAAM,gBAAgB;;;;iBAOpB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,QAAA,MAAM,kBAAkB;;;;;EAKtB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2BjB,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC/D,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IACjC,0DAA0D;IAC1D,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,wCAAwC;IACxC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;OAIG;IACH,UAAU,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC;QACnD,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KACjB,CAAC,CAAC;IACH,4BAA4B;IAC5B,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,eAAO,MAAM,OAAO,+EAKlB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAC9C,MAAM,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAExD,OAAO,EACN,aAAa,IAAI,wBAAwB,EACzC,gBAAgB,EAChB,kBAAkB,EAClB,CAAC"}
+{"version":3,"file":"rum.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/rum.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,QAAA,MAAM,gBAAgB;;;;iBAOpB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,QAAA,MAAM,kBAAkB;;;;;EAKtB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2BjB,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC/D,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,iBAAiB;IACjC,sFAAsF;IACtF,cAAc,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC7E,0DAA0D;IAC1D,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,wCAAwC;IACxC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;OAIG;IACH,UAAU,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC;QACnD,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KACjB,CAAC,CAAC;IACH,4BAA4B;IAC5B,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,eAAO,MAAM,OAAO,8EAIlB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAC9C,MAAM,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAExD,OAAO,EACN,aAAa,IAAI,wBAAwB,EACzC,gBAAgB,EAChB,kBAAkB,EAClB,CAAC"}

package/dist/kinds/rum.kind.js

@@ -12,14 +12,14 @@
  * The kind decouples *configuration* (which hostnames, which token,
  * which privacy mode) from *delivery* (how the beacon `<script>` tag
  * lands in the HTML). For SvelteKit apps, the
- * `@vibesdotdev/cloudflare-web-analytics` package provides a `handle`
- * hook that injects the beacon via `transformPageChunk` — no
+ * `@vibesdotdev/integrations-cloudflare/svelte/web-analytics` surface provides a
+ * `handle` hook that injects the beacon via `transformPageChunk` — no
  * per-app `app.html` edits required once the kind is wired in.
  */
 import * as z from 'zod/v4';
-import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
-import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
-import { INFRA_DISCOVERY_PATTERN, extractStem } from "./discovery.js";
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
 const RumPrivacySchema = z.object({
     /** Drop EU visitor data at the beacon level (GDPR fast path). */
     excludeEU: z.boolean().default(false),
@@ -73,8 +73,7 @@ const RumBaseSchema = RuntimeDescriptorSchema.extend({
 export const rumKind = createRuntimeKind({
     id: 'infra/rum',
     descriptorSchema: RumBaseSchema,
-    discoveryPattern: INFRA_DISCOVERY_PATTERN,
-    extractStem
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
 });
 export { RumBaseSchema as InfraRumDescriptorSchema, RumPrivacySchema, RumInjectionSchema };
 //# sourceMappingURL=rum.kind.js.map

package/dist/kinds/rum.kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"rum.kind.js","sourceRoot":"","sources":["../../src/kinds/rum.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,iEAAiE;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,2DAA2D;IAC3D,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,8DAA8D;IAC9D,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC5C,CAAC,CAAC;AAIH;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,UAAU;IACV,gBAAgB;IAChB,eAAe;IACf,QAAQ;CACR,CAAC,CAAC;AAIH,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC;;;;;;;OAOG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;QAClB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,SAAS,EAAE,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACvD,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,SAAS,EAAE,KAAK;QAChB,iBAAiB,EAAE,IAAI;QACvB,gBAAgB,EAAE,KAAK;KACvB,CAAC,CAAC;IACH,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClC,CAAC,CAAC;AAyCH,MAAM,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAwC;IAC/E,EAAE,EAAE,WAAW;IACf,gBAAgB,EAAE,aAAa;IAC/B,gBAAgB,EAAE,uBAAuB;IACzC,WAAW;CACX,CAAC,CAAC;AAKH,OAAO,EACN,aAAa,IAAI,wBAAwB,EACzC,gBAAgB,EAChB,kBAAkB,EAClB,CAAC"}
+{"version":3,"file":"rum.kind.js","sourceRoot":"","sources":["../../src/kinds/rum.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,iEAAiE;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,2DAA2D;IAC3D,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,8DAA8D;IAC9D,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC5C,CAAC,CAAC;AAIH;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,UAAU;IACV,gBAAgB;IAChB,eAAe;IACf,QAAQ;CACR,CAAC,CAAC;AAIH,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC;;;;;;;OAOG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;QAClB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,SAAS,EAAE,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACvD,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,SAAS,EAAE,KAAK;QAChB,iBAAiB,EAAE,IAAI;QACvB,gBAAgB,EAAE,KAAK;KACvB,CAAC,CAAC;IACH,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClC,CAAC,CAAC;AA0DH,MAAM,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAwC;IAC/E,EAAE,EAAE,WAAW;IACf,gBAAgB,EAAE,aAAa;IAC/B,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC;AAKH,OAAO,EACN,aAAa,IAAI,wBAAwB,EACzC,gBAAgB,EAChB,kBAAkB,EAClB,CAAC"}

package/dist/kinds/sandbox.kind.d.ts

@@ -5,17 +5,23 @@
  * subprocess capabilities. Used for agent code execution, tool sandboxing,
  * and long-running background tasks.
  *
- * Schema shape: strict common base + `config` discriminated union.
+ * Schema shape: strict common base + an open, adapter-keyed `config`.
  *
  * - The base defines fields universal across every adapter:
  *   id/kind/name + the sandbox shape (entrypoint, image, limits,
  *   outboundProxy, liveView, persistent, env).
- * - Adapter-specific fields live under `config`. Each adapter package
- *   defines its own concrete schema under its discriminator key.
+ * - Adapter-specific fields live under `config`, keyed by a non-empty
+ *   `adapter` discriminator. Cloud provider adapter schemas live in their
+ *   integrations owners (Cloudflare's in `@vibesdotdev/integrations-cloudflare`,
+ *   DigitalOcean droplet and DOKS job configs in
+ *   `@vibesdotdev/integrations-digitalocean`); this kind names no cloud
+ *   provider, so a config for any adapter — including one contributed by a
+ *   user plugin — parses here, and the adapter validates its own grammar.
+ *   The local docker adapter is not a cloud integration and is defined here.
  */
 import * as z from 'zod/v4';
-import type { RuntimeKindDescriptorRecord } from '@vibesdotdev/runtime/schemas/kind';
-import type { RuntimeDescriptor } from '@vibesdotdev/runtime/schemas/descriptor';
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
 export declare const SandboxOutboundProxySchema: z.ZodObject<{
     binding: z.ZodString;
     workerPath: z.ZodOptional<z.ZodString>;
@@ -30,27 +36,94 @@ export declare const SandboxResourceLimitsSchema: z.ZodObject<{
     timeoutSeconds: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type SandboxResourceLimits = z.infer<typeof SandboxResourceLimitsSchema>;
-export declare const CloudflareSandboxConfigSchema: z.ZodObject<{
-    image: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
+/** Host bootstrap accepted by a provisioner; omitted preserves legacy cloud-init callers. */
+export declare const SandboxBootstrapSchema: z.ZodEnum<{
+    entrypoint: "entrypoint";
+    "cloud-init": "cloud-init";
+}>;
+export type SandboxBootstrap = z.infer<typeof SandboxBootstrapSchema>;
+export interface SandboxProvisionOptions {
+    /** Stable noncredential configuration, included in operation identity. */
+    env?: Record<string, string>;
+    /** Resolve transient authority only when a new process must be started. Never persisted. */
+    resolveCredentials?: () => Promise<Record<string, string>>;
+}
+/** Local docker sandbox adapter: a container image plus volume mounts. */
 export declare const DockerSandboxConfigSchema: z.ZodObject<{
     image: z.ZodString;
     volumes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
-export declare const DigitalOceanDropletSandboxConfigSchema: z.ZodObject<{
-    dropletSize: z.ZodString;
-}, z.core.$strip>;
-export declare const SandboxConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
+export type DockerSandboxConfig = z.infer<typeof DockerSandboxConfigSchema>;
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no cloud provider, so a config for any adapter — including one contributed
+ * by a user plugin — parses here, and the adapter validates its own grammar.
+ */
+export declare const SandboxConfigSchema: z.ZodObject<{
+    adapter: z.ZodString;
+}, z.core.$loose>;
+export type SandboxConfig = z.infer<typeof SandboxConfigSchema>;
+/** Placement a host profile supplies when a launch omits size, region or image. */
+export declare const SandboxHostPlacementDefaultsSchema: z.ZodObject<{
+    size: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
     image: z.ZodOptional<z.ZodString>;
-    adapter: z.ZodLiteral<"cloudflare-sandbox">;
-}, z.core.$strip>, z.ZodObject<{
-    image: z.ZodString;
-    volumes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    adapter: z.ZodLiteral<"docker">;
-}, z.core.$strip>, z.ZodObject<{
-    dropletSize: z.ZodString;
-    adapter: z.ZodLiteral<"digitalocean-droplet">;
-}, z.core.$strip>]>;
+}, z.core.$strip>;
+export type SandboxHostPlacementDefaults = z.infer<typeof SandboxHostPlacementDefaultsSchema>;
+/**
+ * How the provider's `advancePause` stops compute billing:
+ * - `snapshot-destroy`: snapshot the disk, then delete the instance; only the
+ *   snapshot bills while paused (a provider whose stopped instances still bill).
+ * - `power-off`: stop the instance in place; the provider stops compute billing.
+ */
+export declare const SandboxPauseStrategySchema: z.ZodEnum<{
+    "snapshot-destroy": "snapshot-destroy";
+    "power-off": "power-off";
+}>;
+export type SandboxPauseStrategy = z.infer<typeof SandboxPauseStrategySchema>;
+/**
+ * The fleet-host profile a provisioner declares: what `vibes fleet launch`
+ * may request from it and what it supplies on omission. Generic launch reads
+ * only this; a sandbox without a profile is never selected implicitly.
+ */
+export declare const SandboxHostProfileSchema: z.ZodObject<{
+    provider: z.ZodString;
+    aliases: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    sizes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    gpuSizes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaults: z.ZodDefault<z.ZodObject<{
+        size: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodString>;
+        image: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    gpuDefaults: z.ZodDefault<z.ZodObject<{
+        image: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    pause: z.ZodOptional<z.ZodEnum<{
+        "snapshot-destroy": "snapshot-destroy";
+        "power-off": "power-off";
+    }>>;
+}, z.core.$strip>;
+export type SandboxHostProfile = z.infer<typeof SandboxHostProfileSchema>;
+/** One fleet-host launch as the selected provider sees it before any paid call. */
+export interface SandboxHostLaunchRequest {
+    size: string;
+    region: string;
+    image: string;
+    gpu: boolean;
+    sshKeyIds: readonly string[];
+}
+/**
+ * Optional `infra/sandbox` implementation operation: refuse a launch the
+ * provider would reject (throw a `CapabilityError`) before the platform is
+ * asked to provision. Provider-specific rules live here, never in generic launch.
+ */
+export interface SandboxHostLaunchPreflight {
+    preflightHostLaunch(request: SandboxHostLaunchRequest): void | Promise<void>;
+}
+export declare function hasSandboxHostLaunchPreflight(implementation: Partial<SandboxHostLaunchPreflight> | null | undefined): implementation is SandboxHostLaunchPreflight;
 export declare const SandboxDescriptorSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodOptional<z.ZodString>;
@@ -59,9 +132,42 @@ export declare const SandboxDescriptorSchema: z.ZodObject<{
     hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
     enabled: z.ZodOptional<z.ZodBoolean>;
     priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
     requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
     optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
     kind: z.ZodLiteral<"infra/sandbox">;
+    bootstrap: z.ZodOptional<z.ZodEnum<{
+        entrypoint: "entrypoint";
+        "cloud-init": "cloud-init";
+    }>>;
+    hostProfile: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodString;
+        aliases: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        sizes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        gpuSizes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        defaults: z.ZodDefault<z.ZodObject<{
+            size: z.ZodOptional<z.ZodString>;
+            region: z.ZodOptional<z.ZodString>;
+            image: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        gpuDefaults: z.ZodDefault<z.ZodObject<{
+            image: z.ZodOptional<z.ZodString>;
+            region: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        pause: z.ZodOptional<z.ZodEnum<{
+            "snapshot-destroy": "snapshot-destroy";
+            "power-off": "power-off";
+        }>>;
+    }, z.core.$strip>>;
     entrypoint: z.ZodOptional<z.ZodString>;
     image: z.ZodOptional<z.ZodString>;
     limits: z.ZodOptional<z.ZodObject<{
@@ -86,26 +192,20 @@ export declare const SandboxDescriptorSchema: z.ZodObject<{
         secret: z.ZodOptional<z.ZodBoolean>;
         description: z.ZodOptional<z.ZodString>;
         storeKey: z.ZodOptional<z.ZodString>;
+        storeBinding: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
-    config: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
-        image: z.ZodOptional<z.ZodString>;
-        adapter: z.ZodLiteral<"cloudflare-sandbox">;
-    }, z.core.$strip>, z.ZodObject<{
-        image: z.ZodString;
-        volumes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        adapter: z.ZodLiteral<"docker">;
-    }, z.core.$strip>, z.ZodObject<{
-        dropletSize: z.ZodString;
-        adapter: z.ZodLiteral<"digitalocean-droplet">;
-    }, z.core.$strip>]>>;
+    config: z.ZodOptional<z.ZodObject<{
+        adapter: z.ZodString;
+    }, z.core.$loose>>;
 }, z.core.$strip>;
 export type SandboxDescriptor = z.infer<typeof SandboxDescriptorSchema>;
 declare class DefaultSandboxImplementation {
     readonly descriptor: RuntimeDescriptor;
-    readonly context: unknown;
-    constructor(descriptor: RuntimeDescriptor, context: unknown);
-    get config(): SandboxDescriptor;
+    readonly context: KindContext;
+    /** The descriptor as this kind's schema reads it. */
+    readonly config: SandboxDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
 }
-export declare const sandboxKind: RuntimeKindDescriptorRecord<DefaultSandboxImplementation>;
+export declare const sandboxKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<DefaultSandboxImplementation>;
 export {};
 //# sourceMappingURL=sandbox.kind.d.ts.map

package/dist/kinds/sandbox.kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/sandbox.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAErF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAIjF,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;;;;;iBAMtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AA2BhF,eAAO,MAAM,6BAA6B;;iBAGxC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;iBAKpC,CAAC;AAEH,eAAO,MAAM,sCAAsC;;iBAGjD,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;mBAI9B,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,cAAM,4BAA4B;aAEhB,UAAU,EAAE,iBAAiB;aAC7B,OAAO,EAAE,OAAO;gBADhB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,OAAO;IAGjC,IAAI,MAAM,IAAI,iBAAiB,CAE9B;CACD;AAED,eAAO,MAAM,WAAW,2DAMtB,CAAC"}
+{"version":3,"file":"sandbox.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/sandbox.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAKhF,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;;;;;iBAMtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB;;;EAAuC,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,WAAW,uBAAuB;IACvC,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,4FAA4F;IAC5F,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAED,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;;;iBAKpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAIhE,mFAAmF;AACnF,eAAO,MAAM,kCAAkC;;;;iBAI7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;EAA4C,CAAC;AACpF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;iBAkBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,mFAAmF;AACnF,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IAC1C,mBAAmB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E;AAED,wBAAgB,6BAA6B,CAC5C,cAAc,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,IAAI,GAAG,SAAS,GACpE,cAAc,IAAI,0BAA0B,CAE9C;AA+BD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,cAAM,4BAA4B;aAIhB,UAAU,EAAE,iBAAiB;aAC7B,OAAO,EAAE,WAAW;IAJrC,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;gBAElB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,WAAW;CAKrC;AAED,eAAO,MAAM,WAAW,yFAKtB,CAAC"}

package/dist/kinds/sandbox.kind.js

@@ -5,19 +5,26 @@
  * subprocess capabilities. Used for agent code execution, tool sandboxing,
  * and long-running background tasks.
  *
- * Schema shape: strict common base + `config` discriminated union.
+ * Schema shape: strict common base + an open, adapter-keyed `config`.
  *
  * - The base defines fields universal across every adapter:
  *   id/kind/name + the sandbox shape (entrypoint, image, limits,
  *   outboundProxy, liveView, persistent, env).
- * - Adapter-specific fields live under `config`. Each adapter package
- *   defines its own concrete schema under its discriminator key.
+ * - Adapter-specific fields live under `config`, keyed by a non-empty
+ *   `adapter` discriminator. Cloud provider adapter schemas live in their
+ *   integrations owners (Cloudflare's in `@vibesdotdev/integrations-cloudflare`,
+ *   DigitalOcean droplet and DOKS job configs in
+ *   `@vibesdotdev/integrations-digitalocean`); this kind names no cloud
+ *   provider, so a config for any adapter — including one contributed by a
+ *   user plugin — parses here, and the adapter validates its own grammar.
+ *   The local docker adapter is not a cloud integration and is defined here.
  */
 import * as z from 'zod/v4';
-import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
-import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
 import { deploymentEnvRequirementSchema } from "../schemas.js";
-import { INFRA_DISCOVERY_PATTERN, extractStem } from "./discovery.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
 export const SandboxOutboundProxySchema = z.object({
     binding: z.string().min(1),
     workerPath: z.string().min(1).optional(),
@@ -30,8 +37,70 @@ export const SandboxResourceLimitsSchema = z.object({
     maxSubprocesses: z.number().int().positive().optional(),
     timeoutSeconds: z.number().int().positive().optional()
 });
+/** Host bootstrap accepted by a provisioner; omitted preserves legacy cloud-init callers. */
+export const SandboxBootstrapSchema = z.enum(['cloud-init', 'entrypoint']);
+/** Local docker sandbox adapter: a container image plus volume mounts. */
+export const DockerSandboxConfigSchema = z.object({
+    /** Container image. */
+    image: z.string(),
+    /** Volume mounts (hostPath: containerPath). */
+    volumes: z.record(z.string(), z.string()).optional()
+});
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no cloud provider, so a config for any adapter — including one contributed
+ * by a user plugin — parses here, and the adapter validates its own grammar.
+ */
+export const SandboxConfigSchema = z.looseObject({
+    adapter: z.string().min(1)
+});
+const SandboxSlugSchema = z.string().trim().min(1);
+/** Placement a host profile supplies when a launch omits size, region or image. */
+export const SandboxHostPlacementDefaultsSchema = z.object({
+    size: SandboxSlugSchema.optional(),
+    region: SandboxSlugSchema.optional(),
+    image: SandboxSlugSchema.optional()
+});
+/**
+ * How the provider's `advancePause` stops compute billing:
+ * - `snapshot-destroy`: snapshot the disk, then delete the instance; only the
+ *   snapshot bills while paused (a provider whose stopped instances still bill).
+ * - `power-off`: stop the instance in place; the provider stops compute billing.
+ */
+export const SandboxPauseStrategySchema = z.enum(['snapshot-destroy', 'power-off']);
+/**
+ * The fleet-host profile a provisioner declares: what `vibes fleet launch`
+ * may request from it and what it supplies on omission. Generic launch reads
+ * only this; a sandbox without a profile is never selected implicitly.
+ */
+export const SandboxHostProfileSchema = z.object({
+    /** Host provider id recorded on the platform host row. */
+    provider: SandboxSlugSchema,
+    /** Other names a launch may select this profile by. */
+    aliases: z.array(SandboxSlugSchema).default([]),
+    /** CPU sizes a launch may request. Absent: the provider validates sizes itself. */
+    sizes: z.array(SandboxSlugSchema).min(1).optional(),
+    /** Sizes admitted only for a GPU launch. */
+    gpuSizes: z.array(SandboxSlugSchema).default([]),
+    /** Placement for an omitted value on a CPU launch. */
+    defaults: SandboxHostPlacementDefaultsSchema.default({}),
+    /**
+     * Region and image for an omitted value on a GPU launch. A GPU size is never
+     * defaulted: an omitted size must not start a paid GPU host.
+     */
+    gpuDefaults: SandboxHostPlacementDefaultsSchema.omit({ size: true }).strict().default({}),
+    /** Pause semantics of this provider's `advancePause`. Absent: the provider cannot pause. */
+    pause: SandboxPauseStrategySchema.optional()
+});
+export function hasSandboxHostLaunchPreflight(implementation) {
+    return typeof implementation?.preflightHostLaunch === 'function';
+}
 const SandboxBaseSchema = RuntimeDescriptorSchema.extend({
     kind: z.literal('infra/sandbox'),
+    bootstrap: SandboxBootstrapSchema.optional(),
+    /** Fleet-host profile; present when this sandbox provisions fleet hosts. */
+    hostProfile: SandboxHostProfileSchema.optional(),
     /** Shell or script to run on sandbox start. */
     entrypoint: z.string().optional(),
     /** Container image or template snapshot. */
@@ -47,48 +116,25 @@ const SandboxBaseSchema = RuntimeDescriptorSchema.extend({
     /** Environment variable requirements. */
     env: z.array(deploymentEnvRequirementSchema).optional()
 });
-export const CloudflareSandboxConfigSchema = z.object({
-    /** Container image or template snapshot. */
-    image: z.string().optional()
-});
-export const DockerSandboxConfigSchema = z.object({
-    /** Container image. */
-    image: z.string(),
-    /** Volume mounts (hostPath: containerPath). */
-    volumes: z.record(z.string(), z.string()).optional()
-});
-export const DigitalOceanDropletSandboxConfigSchema = z.object({
-    /** Droplet size slug (e.g., 's-2vcpu-2gb'). */
-    dropletSize: z.string().min(1)
-});
-export const SandboxConfigSchema = z.union([
-    CloudflareSandboxConfigSchema.extend({ adapter: z.literal('cloudflare-sandbox') }),
-    DockerSandboxConfigSchema.extend({ adapter: z.literal('docker') }),
-    DigitalOceanDropletSandboxConfigSchema.extend({ adapter: z.literal('digitalocean-droplet') })
-]);
 export const SandboxDescriptorSchema = SandboxBaseSchema.extend({
-    /**
-     * Adapter-specific configuration. Discriminated union — each adapter
-     * package defines its own config schema under its discriminator key.
-     */
+    /** Adapter-specific configuration, parsed by the adapter that owns it. */
     config: SandboxConfigSchema.optional()
 });
 class DefaultSandboxImplementation {
     descriptor;
     context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
     constructor(descriptor, context) {
         this.descriptor = descriptor;
         this.context = context;
-    }
-    get config() {
-        return this.descriptor;
+        this.config = readKindDescriptor(SandboxDescriptorSchema, descriptor);
     }
 }
 export const sandboxKind = createRuntimeKind({
     id: 'infra/sandbox',
     descriptorSchema: SandboxDescriptorSchema,
     defaultImplementation: DefaultSandboxImplementation,
-    discoveryPattern: INFRA_DISCOVERY_PATTERN,
-    extractStem
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
 });
 //# sourceMappingURL=sandbox.kind.js.map

package/dist/kinds/sandbox.kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.kind.js","sourceRoot":"","sources":["../../src/kinds/sandbox.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC7C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAEhC,+CAA+C;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,4CAA4C;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5B,uBAAuB;IACvB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAE9C,iEAAiE;IACjE,aAAa,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEpD,oDAAoD;IACpD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhC,sCAAsC;IACtC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAElC,yCAAyC;IACzC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,4CAA4C;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,uBAAuB;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,+CAA+C;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1C,6BAA6B,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;IAClF,yBAAyB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAClE,sCAAsC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;CAC7F,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,MAAM,CAAC;IAC/D;;;OAGG;IACH,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAIH,MAAM,4BAA4B;IAEhB;IACA;IAFjB,YACiB,UAA6B,EAC7B,OAAgB;QADhB,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAS;IAC9B,CAAC;IAEJ,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,UAA+B,CAAC;IAC7C,CAAC;CACD;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAkD;IAC7F,EAAE,EAAE,eAAe;IACnB,gBAAgB,EAAE,uBAAuB;IACzC,qBAAqB,EAAE,4BAA4B;IACnD,gBAAgB,EAAE,uBAAuB;IACzC,WAAW;CACX,CAAC,CAAC"}
+{"version":3,"file":"sandbox.kind.js","sourceRoot":"","sources":["../../src/kinds/sandbox.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC7C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AAU3E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,uBAAuB;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,+CAA+C;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAGH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEnD,mFAAmF;AACnF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC;AAGpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,0DAA0D;IAC1D,QAAQ,EAAE,iBAAiB;IAC3B,uDAAuD;IACvD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,mFAAmF;IACnF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,sDAAsD;IACtD,QAAQ,EAAE,kCAAkC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxD;;;OAGG;IACH,WAAW,EAAE,kCAAkC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACzF,4FAA4F;IAC5F,KAAK,EAAE,0BAA0B,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAqBH,MAAM,UAAU,6BAA6B,CAC5C,cAAsE;IAEtE,OAAO,OAAO,cAAc,EAAE,mBAAmB,KAAK,UAAU,CAAC;AAClE,CAAC;AAED,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE5C,4EAA4E;IAC5E,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAEhD,+CAA+C;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,4CAA4C;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5B,uBAAuB;IACvB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAE9C,iEAAiE;IACjE,aAAa,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEpD,oDAAoD;IACpD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhC,sCAAsC;IACtC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAElC,yCAAyC;IACzC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,MAAM,CAAC;IAC/D,0EAA0E;IAC1E,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAIH,MAAM,4BAA4B;IAIhB;IACA;IAJjB,qDAAqD;IAC5C,MAAM,CAAoB;IACnC,YACiB,UAA6B,EAC7B,OAAoB;QADpB,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAa;QAEpC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAC;IACvE,CAAC;CAED;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAkD;IAC7F,EAAE,EAAE,eAAe;IACnB,gBAAgB,EAAE,uBAAuB;IACzC,qBAAqB,EAAE,4BAA4B;IACnD,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC"}

package/dist/kinds/select-compute-source.d.ts

@@ -0,0 +1,72 @@
+import type { CostBasis } from '@vibesdotdev/shared/billing/cost-basis';
+import type { ComputeSourceDescriptor, ComputeSourceOs, ComputeSourceArch } from './compute-source.kind.ts';
+export interface ComputeDemand {
+    os?: ComputeSourceOs;
+    arch?: ComputeSourceArch;
+    /** Extra capabilities the job needs; every one must be provided. */
+    labels?: readonly string[];
+    /**
+     * Whether the code about to run has been reviewed. `untrusted` is a fork
+     * PR or anything else where the ref is not controlled by the repository
+     * owner, and it restricts selection to ephemeral sources.
+     */
+    trust: 'trusted' | 'untrusted';
+    /** Requesting scope. Required to select a `byo` source. */
+    owner?: {
+        type: string;
+        id: string;
+    };
+    /** Wall-clock ceiling the lease must be able to cover. */
+    maxDurationSeconds?: number;
+}
+/**
+ * What a lease of this length would cost us, in the provider's own terms.
+ *
+ * Conservative on purpose. `usdPerSecondCpuActive` is only charged while the
+ * vCPUs are busy, and we do not measure CPU-seconds in CI, so ranking assumes
+ * they are busy the whole time. Assuming idle would rank a CPU-metered source
+ * as cheap and then hand us the bill — the failure the caller cannot see. A
+ * job that really does idle costs less than this says, never more.
+ *
+ * `minimumUsd` is applied as a floor rather than added, because that is how a
+ * provider minimum actually works: a 10-second droplet costs the minimum, not
+ * the minimum plus 10 seconds.
+ *
+ * When the caller states no duration there is nothing to multiply, so the
+ * comparison falls back to the fixed costs — which still orders a free
+ * bring-your-own machine below a paid one.
+ */
+export declare function expectedCostUsd(source: ComputeSourceDescriptor, maxDurationSeconds: number | undefined): number;
+/**
+ * Which registered compute source should serve this demand.
+ *
+ * Throws rather than returning undefined: a caller that cannot get the machine
+ * class it asked for must stop, not proceed on something else.
+ */
+export declare function selectComputeSource(sources: readonly ComputeSourceDescriptor[], demand: ComputeDemand): ComputeSourceDescriptor;
+/**
+ * The cost basis to bill a lease from, in the billing layer's own vocabulary.
+ *
+ * The rating engine takes `CostBasis[]` and, when given none, falls back to
+ * `unknownCostHeuristic` — a $0.0001/compute-second floor doubled by a safety
+ * multiplier, or $0.72/hour. Every source we own is cheaper than that: a
+ * Cloudflare `standard-4` at full CPU is $0.40/hour and a DigitalOcean
+ * `s-2vcpu-4gb` is $0.036/hour. Handing the engine the real number is
+ * therefore not a tightening — it stops CI from being billed at up to twenty
+ * times what it costs us.
+ *
+ * Deliberately uses the SAME rate `expectedCostUsd` ranks on, including the
+ * assumption that metered CPU is fully active. If selection and the invoice
+ * disagreed about what a source costs, one of them would be lying, and the
+ * cheaper-looking source would win work it could not afford. The assumption
+ * only ever errs toward billing our real exposure rather than under-recovering
+ * it, and it still lands well under the heuristic it replaces.
+ *
+ * `minimumUsd` is NOT expressed here. A provider floor applies to a lease, not
+ * to a second, and there is no way to say "per-unit, but never less than X" in
+ * a per-unit basis. Folding it into the rate would inflate every long lease.
+ * The floor belongs to whatever holds the lease, and this returns only what is
+ * true per second.
+ */
+export declare function computeSourceCostBasis(source: ComputeSourceDescriptor): CostBasis[];
+//# sourceMappingURL=select-compute-source.d.ts.map

package/dist/kinds/select-compute-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"select-compute-source.d.ts","sourceRoot":"","sources":["../../src/kinds/select-compute-source.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE5G,MAAM,WAAW,aAAa;IAC7B,EAAE,CAAC,EAAE,eAAe,CAAC;IACrB,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,oEAAoE;IACpE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,KAAK,EAAE,SAAS,GAAG,WAAW,CAAC;IAC/B,2DAA2D;IAC3D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,0DAA0D;IAC1D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AA0BD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,uBAAuB,EAC/B,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACpC,MAAM,CAMR;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,SAAS,uBAAuB,EAAE,EAC3C,MAAM,EAAE,aAAa,GACnB,uBAAuB,CA+EzB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,EAAE,CAUnF"}