@vibesdotdev/infra-core 0.0.2 → 1.0.0-rc.11

package/dist/kinds/edge-tls.kind.d.ts

@@ -0,0 +1,194 @@
+/**
+ * Infra Edge TLS Kind
+ *
+ * Provider-agnostic schema for the TLS policy an edge/CDN uses when it
+ * connects to an origin. This governs the edge→origin leg only; the
+ * browser→edge leg is certificate and hostname configuration, not this kind.
+ *
+ * The policy is modeled per hostname rather than per zone because a zone
+ * routinely fronts origins with different certificate maturity: a hardened
+ * origin needs `verified`, while a legacy origin with a self-signed or
+ * expired certificate still answers only under `opportunistic`. A zone-wide
+ * value forces the weakest origin's policy onto every hostname.
+ *
+ * `opportunistic` is a loop hazard, not merely weak: when the edge speaks
+ * plaintext to an origin that redirects to HTTPS, a same-zone subrequest
+ * bounces between edge and origin until the edge gives up. Any hostname whose
+ * origin redirects HTTP to HTTPS must be `verified` or `encrypted`.
+ */
+import * as z from 'zod/v4';
+import type { InfraAuthorityFingerprint } from './inventory.kind.ts';
+/**
+ * - `verified`: encrypt and require a valid certificate for the origin hostname.
+ * - `encrypted`: encrypt without validating the origin certificate.
+ * - `opportunistic`: connect in plaintext when the origin allows it.
+ * - `off`: never encrypt the edge→origin leg.
+ */
+declare const OriginTlsPolicySchema: z.ZodEnum<{
+    off: "off";
+    verified: "verified";
+    encrypted: "encrypted";
+    opportunistic: "opportunistic";
+}>;
+export type OriginTlsPolicy = z.infer<typeof OriginTlsPolicySchema>;
+declare const EdgeTlsPolicySchema: z.ZodObject<{
+    hostnames: z.ZodArray<z.ZodString>;
+    policy: z.ZodEnum<{
+        off: "off";
+        verified: "verified";
+        encrypted: "encrypted";
+        opportunistic: "opportunistic";
+    }>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type EdgeTlsPolicy = z.infer<typeof EdgeTlsPolicySchema>;
+export type EdgeTlsPolicyInput = z.input<typeof EdgeTlsPolicySchema>;
+declare const EdgeTlsBaseSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"infra/edge-tls">;
+    adapter: z.ZodString;
+    adapterConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    zone: z.ZodOptional<z.ZodString>;
+    environment: z.ZodDefault<z.ZodString>;
+    policies: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        hostnames: z.ZodArray<z.ZodString>;
+        policy: z.ZodEnum<{
+            off: "off";
+            verified: "verified";
+            encrypted: "encrypted";
+            opportunistic: "opportunistic";
+        }>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type InfraEdgeTlsDescriptor = z.infer<typeof EdgeTlsBaseSchema>;
+export type InfraEdgeTlsDescriptorInput = z.input<typeof EdgeTlsBaseSchema>;
+/** A policy as it exists on the provider, carrying provider-assigned identity. */
+export interface LiveEdgeTlsPolicy {
+    providerId: string;
+    zone: string;
+    hostnames: string[];
+    /** Null when the provider reports a value outside this kind's enum. */
+    policy: OriginTlsPolicy | null;
+    /** Raw provider value, kept so unmapped policies stay visible as evidence. */
+    providerValue: string;
+    /** Provider-native match condition, kept as evidence of what really matches. */
+    expression: string;
+    enabled: boolean;
+    description?: string;
+    /**
+     * False when the live shape is outside what this kind writes — a compound
+     * rule, or a condition that is not a plain hostname set. Unmanaged policies
+     * are reported but never rewritten.
+     */
+    managed: boolean;
+}
+export interface EdgeTlsZoneDefault {
+    zone: string;
+    /** Null when the provider reports a value outside this kind's enum. */
+    policy: OriginTlsPolicy | null;
+    providerValue: string;
+    /** False when the provider forbids changing the default on this plan. */
+    editable: boolean;
+}
+export interface EdgeTlsSnapshot {
+    zone: string;
+    default: EdgeTlsZoneDefault;
+    policies: LiveEdgeTlsPolicy[];
+    /**
+     * Configuration a co-tenant owns in the same provider container, which a
+     * write must carry forward untouched. Non-zero here means this kind is not
+     * the only author, so a full-replacement write would destroy work.
+     */
+    coTenantRules: number;
+}
+export interface EdgeTlsWriteResult {
+    providerId: string;
+    created: boolean;
+    /** Co-tenant configuration re-sent verbatim by this write. */
+    preservedRules: number;
+    /** Total entries in the provider container after the write. */
+    totalRules: number;
+}
+export interface EdgeTlsDeleteResult {
+    /** Policies removed outright because the hostname was their only member. */
+    removed: string[];
+    /** Policies kept but narrowed because they also covered other hostnames. */
+    narrowed: string[];
+    preservedRules: number;
+    totalRules: number;
+}
+export interface EdgeTlsZoneDefaultChange {
+    zone: string;
+    from: OriginTlsPolicy | null;
+    to: OriginTlsPolicy;
+}
+/**
+ * Implementation contract every provider implements.
+ *
+ * `setPolicy` is idempotent on the hostname set: it updates the live policy
+ * for exactly those hostnames rather than adding a second policy that would
+ * race it. Providers that store policies in a shared, wholesale-replaced
+ * container must merge co-tenant entries forward; the reported
+ * `preservedRules` is the evidence that they did.
+ */
+export interface EdgeTlsImplementation {
+    /** Redacted authority used by the latest provider request. */
+    getAuthority?(): Promise<InfraAuthorityFingerprint>;
+    /** Live per-hostname policies plus the zone default, optionally narrowed. */
+    read(filter?: {
+        hostname?: string;
+    }): Promise<EdgeTlsSnapshot>;
+    setPolicy(policy: EdgeTlsPolicyInput): Promise<EdgeTlsWriteResult>;
+    /** Drop one hostname's policy. Absence is not an error. */
+    deletePolicy(filter: {
+        hostname: string;
+    }): Promise<EdgeTlsDeleteResult>;
+    /**
+     * Change the zone-wide default. `verified` breaks every hostname whose
+     * origin does not serve a valid certificate for its own name, including
+     * hostnames with no per-hostname policy of their own, so implementations
+     * refuse the call until the caller acknowledges that blast radius.
+     */
+    setZoneDefault(policy: OriginTlsPolicy, options: {
+        acknowledgeOriginBreakage: boolean;
+    }): Promise<EdgeTlsZoneDefaultChange>;
+    /**
+     * Diff desired against live for the hostname sets in `desired`. Policies
+     * outside those sets are never reported for deletion — this kind is
+     * additive by default so it can coexist with co-tenant policies.
+     */
+    diff(desired: EdgeTlsPolicyInput[]): Promise<{
+        create: EdgeTlsPolicy[];
+        update: Array<{
+            providerId: string;
+            from: LiveEdgeTlsPolicy;
+            to: EdgeTlsPolicy;
+        }>;
+        unchanged: LiveEdgeTlsPolicy[];
+    }>;
+}
+export declare const edgeTlsKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<EdgeTlsImplementation>;
+export type InfraEdgeTlsKind = InfraEdgeTlsDescriptor;
+export type InfraEdgeTlsKindInput = InfraEdgeTlsDescriptorInput;
+export { EdgeTlsBaseSchema as InfraEdgeTlsDescriptorSchema, EdgeTlsPolicySchema, OriginTlsPolicySchema };
+//# sourceMappingURL=edge-tls.kind.d.ts.map

package/dist/kinds/edge-tls.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-tls.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/edge-tls.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAErE;;;;;GAKG;AACH,QAAA,MAAM,qBAAqB;;;;;EAA4D,CAAC;AAExF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,QAAA,MAAM,mBAAmB;;;;;;;;;iBAUvB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,QAAA,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUrB,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AACvE,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5E,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,uEAAuE;IACvE,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IACnC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,eAAe,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACrC,8DAA8D;IAC9D,YAAY,CAAC,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACpD,6EAA6E;IAC7E,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,SAAS,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnE,2DAA2D;IAC3D,YAAY,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzE;;;;;OAKG;IACH,cAAc,CACb,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE;QAAE,yBAAyB,EAAE,OAAO,CAAA;KAAE,GAC7C,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;QAC5C,MAAM,EAAE,aAAa,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,iBAAiB,CAAC;YAAC,EAAE,EAAE,aAAa,CAAA;SAAE,CAAC,CAAC;QAClF,SAAS,EAAE,iBAAiB,EAAE,CAAC;KAC/B,CAAC,CAAC;CACH;AAED,eAAO,MAAM,WAAW,kFAItB,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACtD,MAAM,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAEhE,OAAO,EACN,iBAAiB,IAAI,4BAA4B,EACjD,mBAAmB,EACnB,qBAAqB,EACrB,CAAC"}

package/dist/kinds/edge-tls.kind.js

@@ -0,0 +1,58 @@
+/**
+ * Infra Edge TLS Kind
+ *
+ * Provider-agnostic schema for the TLS policy an edge/CDN uses when it
+ * connects to an origin. This governs the edge→origin leg only; the
+ * browser→edge leg is certificate and hostname configuration, not this kind.
+ *
+ * The policy is modeled per hostname rather than per zone because a zone
+ * routinely fronts origins with different certificate maturity: a hardened
+ * origin needs `verified`, while a legacy origin with a self-signed or
+ * expired certificate still answers only under `opportunistic`. A zone-wide
+ * value forces the weakest origin's policy onto every hostname.
+ *
+ * `opportunistic` is a loop hazard, not merely weak: when the edge speaks
+ * plaintext to an origin that redirects to HTTPS, a same-zone subrequest
+ * bounces between edge and origin until the edge gives up. Any hostname whose
+ * origin redirects HTTP to HTTPS must be `verified` or `encrypted`.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
+/**
+ * - `verified`: encrypt and require a valid certificate for the origin hostname.
+ * - `encrypted`: encrypt without validating the origin certificate.
+ * - `opportunistic`: connect in plaintext when the origin allows it.
+ * - `off`: never encrypt the edge→origin leg.
+ */
+const OriginTlsPolicySchema = z.enum(['verified', 'encrypted', 'opportunistic', 'off']);
+const EdgeTlsPolicySchema = z.object({
+    /**
+     * Hostnames this policy applies to. Treated as a set: order and case do
+     * not change identity, so an equivalent declaration resolves to the same
+     * live policy instead of adding a second one.
+     */
+    hostnames: z.array(z.string().min(1)).min(1),
+    policy: OriginTlsPolicySchema,
+    /** Operator note stored with the policy where the provider supports it. */
+    description: z.string().optional()
+});
+const EdgeTlsBaseSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('infra/edge-tls'),
+    /** Adapter id (e.g. 'cloudflare-edge-tls'). */
+    adapter: z.string().min(1),
+    adapterConfig: z.record(z.string(), z.unknown()).optional(),
+    /** Apex zone this descriptor is authoritative for (e.g. `vibes.dev`). */
+    zone: z.string().min(1).optional(),
+    /** Environment name for credential resolution via `vibes secrets`. */
+    environment: z.string().default('local'),
+    policies: z.array(EdgeTlsPolicySchema).default([])
+});
+export const edgeTlsKind = createRuntimeKind({
+    id: 'infra/edge-tls',
+    descriptorSchema: EdgeTlsBaseSchema,
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
+});
+export { EdgeTlsBaseSchema as InfraEdgeTlsDescriptorSchema, EdgeTlsPolicySchema, OriginTlsPolicySchema };
+//# sourceMappingURL=edge-tls.kind.js.map

package/dist/kinds/edge-tls.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-tls.kind.js","sourceRoot":"","sources":["../../src/kinds/edge-tls.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAG1D;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAIxF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,qBAAqB;IAC7B,2EAA2E;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAKH,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACjC,+CAA+C;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,yEAAyE;IACzE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,sEAAsE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AA8GH,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAgD;IAC3F,EAAE,EAAE,gBAAgB;IACpB,gBAAgB,EAAE,iBAAiB;IACnC,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC;AAKH,OAAO,EACN,iBAAiB,IAAI,4BAA4B,EACjD,mBAAmB,EACnB,qBAAqB,EACrB,CAAC"}

package/dist/kinds/firewall.kind.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Kind: infra/firewall
+ *
+ * Provider-neutral firewall descriptor. Used both for compute-level firewalls
+ * (e.g., DigitalOcean cloud firewall, attached to droplets) and the DOKS
+ * control-plane firewall.
+ *
+ * `config` is an open, adapter-keyed shape (DigitalOcean's firewall config
+ * lives in `@vibesdotdev/integrations-digitalocean`); this kind names no
+ * provider, so a config for any adapter parses here and the adapter
+ * validates its own grammar.
+ */
+import * as z from 'zod/v4';
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+export declare const FirewallRuleSchema: z.ZodObject<{
+    protocol: z.ZodEnum<{
+        tcp: "tcp";
+        udp: "udp";
+        icmp: "icmp";
+    }>;
+    ports: z.ZodOptional<z.ZodString>;
+    sources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    destinations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type FirewallRule = z.infer<typeof FirewallRuleSchema>;
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no provider, so a config for any adapter — including one contributed by a
+ * user plugin — parses here, and the adapter validates its own grammar.
+ */
+export declare const FirewallConfigSchema: z.ZodObject<{
+    adapter: z.ZodString;
+}, z.core.$loose>;
+export type FirewallConfig = z.infer<typeof FirewallConfigSchema>;
+export declare const FirewallDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"infra/firewall">;
+    inboundRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        protocol: z.ZodEnum<{
+            tcp: "tcp";
+            udp: "udp";
+            icmp: "icmp";
+        }>;
+        ports: z.ZodOptional<z.ZodString>;
+        sources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        destinations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    outboundRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        protocol: z.ZodEnum<{
+            tcp: "tcp";
+            udp: "udp";
+            icmp: "icmp";
+        }>;
+        ports: z.ZodOptional<z.ZodString>;
+        sources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        destinations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    config: z.ZodOptional<z.ZodObject<{
+        adapter: z.ZodString;
+    }, z.core.$loose>>;
+}, z.core.$strip>;
+export type FirewallDescriptor = z.infer<typeof FirewallDescriptorSchema>;
+declare class DefaultFirewallImplementation {
+    readonly descriptor: RuntimeDescriptor;
+    readonly context: KindContext;
+    /** The descriptor as this kind's schema reads it. */
+    readonly config: FirewallDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
+}
+export declare const firewallKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<DefaultFirewallImplementation>;
+export {};
+//# sourceMappingURL=firewall.kind.d.ts.map

package/dist/kinds/firewall.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/firewall.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAIpE,eAAO,MAAM,kBAAkB;;;;;;;;;iBAK7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAQ9D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,cAAM,6BAA6B;aAIjB,UAAU,EAAE,iBAAiB;aAC7B,OAAO,EAAE,WAAW;IAJrC,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAEnB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,WAAW;CAKrC;AAED,eAAO,MAAM,YAAY,0FAKvB,CAAC"}

package/dist/kinds/firewall.kind.js

@@ -0,0 +1,59 @@
+/**
+ * Kind: infra/firewall
+ *
+ * Provider-neutral firewall descriptor. Used both for compute-level firewalls
+ * (e.g., DigitalOcean cloud firewall, attached to droplets) and the DOKS
+ * control-plane firewall.
+ *
+ * `config` is an open, adapter-keyed shape (DigitalOcean's firewall config
+ * lives in `@vibesdotdev/integrations-digitalocean`); this kind names no
+ * provider, so a config for any adapter parses here and the adapter
+ * validates its own grammar.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
+export const FirewallRuleSchema = z.object({
+    protocol: z.enum(['tcp', 'udp', 'icmp']),
+    ports: z.string().optional(),
+    sources: z.array(z.string()).optional(),
+    destinations: z.array(z.string()).optional()
+});
+const FirewallBaseSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('infra/firewall'),
+    inboundRules: z.array(FirewallRuleSchema).optional(),
+    outboundRules: z.array(FirewallRuleSchema).optional()
+});
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no provider, so a config for any adapter — including one contributed by a
+ * user plugin — parses here, and the adapter validates its own grammar.
+ */
+export const FirewallConfigSchema = z.looseObject({
+    adapter: z.string().min(1)
+});
+export const FirewallDescriptorSchema = FirewallBaseSchema.extend({
+    /** Adapter-specific configuration, parsed by the adapter that owns it. */
+    config: FirewallConfigSchema.optional()
+});
+class DefaultFirewallImplementation {
+    descriptor;
+    context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
+    constructor(descriptor, context) {
+        this.descriptor = descriptor;
+        this.context = context;
+        this.config = readKindDescriptor(FirewallDescriptorSchema, descriptor);
+    }
+}
+export const firewallKind = createRuntimeKind({
+    id: 'infra/firewall',
+    descriptorSchema: FirewallDescriptorSchema,
+    defaultImplementation: DefaultFirewallImplementation,
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
+});
+//# sourceMappingURL=firewall.kind.js.map

package/dist/kinds/firewall.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall.kind.js","sourceRoot":"","sources":["../../src/kinds/firewall.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACpD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACjE,0EAA0E;IAC1E,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAIH,MAAM,6BAA6B;IAIjB;IACA;IAJjB,qDAAqD;IAC5C,MAAM,CAAqB;IACpC,YACiB,UAA6B,EAC7B,OAAoB;QADpB,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAa;QAEpC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC;CAED;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,iBAAiB,CAAoD;IAChG,EAAE,EAAE,gBAAgB;IACpB,gBAAgB,EAAE,wBAAwB;IAC1C,qBAAqB,EAAE,6BAA6B;IACpD,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC"}

package/dist/kinds/git-hosting.kind.d.ts

@@ -3,18 +3,19 @@
  *
  * Describes a git hosting service instance (e.g. Gitea, Forgejo).
  *
- * Schema shape: strict common base + `config` discriminated union.
+ * Schema shape: strict common base + an open, adapter-keyed `config`.
  *
  * - The base (this file) defines fields that are universal across every
  *   adapter: id/kind/name + the hosting shape every git host declares
  *   (domain, url, storagePath, authMethod, etc.).
- * - Adapter-specific fields (dropletSize, dockerImage, volumeSizeGb, …)
- *   live exclusively under `config`. Each adapter package defines its own
- *   concrete schema under its discriminator key.
+ * - Adapter-specific fields live exclusively under `config`, keyed by
+ *   `adapter`. Each adapter package defines and parses its own concrete
+ *   schema (the DigitalOcean Gitea adapter's lives in
+ *   `@vibesdotdev/integrations-digitalocean`); this kind names no provider.
  */
 import * as z from 'zod/v4';
-import type { RuntimeKindDescriptorRecord } from '@vibesdotdev/runtime/schemas/kind';
-import type { RuntimeDescriptor } from '@vibesdotdev/runtime/schemas/descriptor';
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
 export declare const GitHostingTypeSchema: z.ZodEnum<{
     gitea: "gitea";
     forgejo: "forgejo";
@@ -22,27 +23,18 @@ export declare const GitHostingTypeSchema: z.ZodEnum<{
 export type GitHostingType = z.infer<typeof GitHostingTypeSchema>;
 export declare const GitHostingAuthMethodSchema: z.ZodEnum<{
     local: "local";
-    oauth: "oauth";
     token: "token";
+    oauth: "oauth";
 }>;
 export type GitHostingAuthMethod = z.infer<typeof GitHostingAuthMethodSchema>;
-export declare const GiteaDoksGitHostingConfigSchema: z.ZodObject<{
-    dropletSize: z.ZodDefault<z.ZodString>;
-    dockerImage: z.ZodDefault<z.ZodString>;
-    volumeSizeGb: z.ZodDefault<z.ZodNumber>;
-    domain: z.ZodString;
-    sshPort: z.ZodDefault<z.ZodNumber>;
-    httpPort: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip>;
-export declare const GitHostingConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
-    dropletSize: z.ZodDefault<z.ZodString>;
-    dockerImage: z.ZodDefault<z.ZodString>;
-    volumeSizeGb: z.ZodDefault<z.ZodNumber>;
-    domain: z.ZodString;
-    sshPort: z.ZodDefault<z.ZodNumber>;
-    httpPort: z.ZodDefault<z.ZodNumber>;
-    adapter: z.ZodLiteral<"gitea-doks">;
-}, z.core.$strip>]>;
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no provider.
+ */
+export declare const GitHostingConfigSchema: z.ZodObject<{
+    adapter: z.ZodString;
+}, z.core.$loose>;
 export declare const GitHostingDescriptorSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodOptional<z.ZodString>;
@@ -51,8 +43,18 @@ export declare const GitHostingDescriptorSchema: z.ZodObject<{
     hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
     enabled: z.ZodOptional<z.ZodBoolean>;
     priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
     requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
     optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
     kind: z.ZodLiteral<"infra/git-hosting">;
     url: z.ZodString;
     hostname: z.ZodString;
@@ -63,8 +65,8 @@ export declare const GitHostingDescriptorSchema: z.ZodObject<{
     storagePath: z.ZodDefault<z.ZodString>;
     authMethod: z.ZodDefault<z.ZodEnum<{
         local: "local";
-        oauth: "oauth";
         token: "token";
+        oauth: "oauth";
     }>>;
     ssl: z.ZodDefault<z.ZodBoolean>;
     env: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -75,24 +77,20 @@ export declare const GitHostingDescriptorSchema: z.ZodObject<{
         secret: z.ZodOptional<z.ZodBoolean>;
         description: z.ZodOptional<z.ZodString>;
         storeKey: z.ZodOptional<z.ZodString>;
+        storeBinding: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
-    config: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
-        dropletSize: z.ZodDefault<z.ZodString>;
-        dockerImage: z.ZodDefault<z.ZodString>;
-        volumeSizeGb: z.ZodDefault<z.ZodNumber>;
-        domain: z.ZodString;
-        sshPort: z.ZodDefault<z.ZodNumber>;
-        httpPort: z.ZodDefault<z.ZodNumber>;
-        adapter: z.ZodLiteral<"gitea-doks">;
-    }, z.core.$strip>]>>;
+    config: z.ZodOptional<z.ZodObject<{
+        adapter: z.ZodString;
+    }, z.core.$loose>>;
 }, z.core.$strip>;
 export type GitHostingDescriptor = z.infer<typeof GitHostingDescriptorSchema>;
 declare class DefaultGitHostingImplementation {
     readonly descriptor: RuntimeDescriptor;
-    readonly context: unknown;
-    constructor(descriptor: RuntimeDescriptor, context: unknown);
-    get config(): GitHostingDescriptor;
+    readonly context: KindContext;
+    /** The descriptor as this kind's schema reads it. */
+    readonly config: GitHostingDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
 }
-export declare const gitHostingKind: RuntimeKindDescriptorRecord<DefaultGitHostingImplementation>;
+export declare const gitHostingKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<DefaultGitHostingImplementation>;
 export {};
 //# sourceMappingURL=git-hosting.kind.d.ts.map

package/dist/kinds/git-hosting.kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-hosting.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/git-hosting.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAErF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAIjF,eAAO,MAAM,oBAAoB;;;EAA+B,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,0BAA0B;;;;EAAsC,CAAC;AAC9E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AA2B9E,eAAO,MAAM,+BAA+B;;;;;;;iBAa1C,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;mBAEjC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,cAAM,+BAA+B;aAEnB,UAAU,EAAE,iBAAiB;aAC7B,OAAO,EAAE,OAAO;gBADhB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,OAAO;IAGjC,IAAI,MAAM,IAAI,oBAAoB,CAEjC;CACD;AAED,eAAO,MAAM,cAAc,8DAMzB,CAAC"}
+{"version":3,"file":"git-hosting.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/git-hosting.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAKpE,eAAO,MAAM,oBAAoB;;;EAA+B,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,0BAA0B;;;;EAAsC,CAAC;AAC9E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AA2B9E;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,cAAM,+BAA+B;aAInB,UAAU,EAAE,iBAAiB;aAC7B,OAAO,EAAE,WAAW;IAJrC,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBAErB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,WAAW;CAKrC;AAED,eAAO,MAAM,cAAc,4FAKzB,CAAC"}

package/dist/kinds/git-hosting.kind.js

@@ -3,19 +3,21 @@
  *
  * Describes a git hosting service instance (e.g. Gitea, Forgejo).
  *
- * Schema shape: strict common base + `config` discriminated union.
+ * Schema shape: strict common base + an open, adapter-keyed `config`.
  *
  * - The base (this file) defines fields that are universal across every
  *   adapter: id/kind/name + the hosting shape every git host declares
  *   (domain, url, storagePath, authMethod, etc.).
- * - Adapter-specific fields (dropletSize, dockerImage, volumeSizeGb, …)
- *   live exclusively under `config`. Each adapter package defines its own
- *   concrete schema under its discriminator key.
+ * - Adapter-specific fields live exclusively under `config`, keyed by
+ *   `adapter`. Each adapter package defines and parses its own concrete
+ *   schema (the DigitalOcean Gitea adapter's lives in
+ *   `@vibesdotdev/integrations-digitalocean`); this kind names no provider.
  */
 import * as z from 'zod/v4';
-import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
-import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
-import { INFRA_DISCOVERY_PATTERN, extractStem } from "./discovery.js";
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
 import { deploymentEnvRequirementSchema } from "../schemas.js";
 export const GitHostingTypeSchema = z.enum(['gitea', 'forgejo']);
 export const GitHostingAuthMethodSchema = z.enum(['local', 'oauth', 'token']);
@@ -36,46 +38,33 @@ const GitHostingBaseSchema = RuntimeDescriptorSchema.extend({
     /** Environment variable requirements. */
     env: z.array(deploymentEnvRequirementSchema).optional()
 });
-export const GiteaDoksGitHostingConfigSchema = z.object({
-    /** DigitalOcean Droplet size. */
-    dropletSize: z.string().default('s-2vcpu-2gb'),
-    /** Docker image for the Gitea container. */
-    dockerImage: z.string().default('gitea/gitea:1.21'),
-    /** Volume size in GiB for persistent storage. */
-    volumeSizeGb: z.number().int().positive().default(50),
-    /** Primary domain for the Gitea instance. */
-    domain: z.string().min(1),
-    /** SSH port exposed on the service. */
-    sshPort: z.number().int().positive().default(22),
-    /** HTTP port exposed on the service. */
-    httpPort: z.number().int().positive().default(3000)
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no provider.
+ */
+export const GitHostingConfigSchema = z.looseObject({
+    adapter: z.string().min(1)
 });
-export const GitHostingConfigSchema = z.union([
-    GiteaDoksGitHostingConfigSchema.extend({ adapter: z.literal('gitea-doks') })
-]);
 export const GitHostingDescriptorSchema = GitHostingBaseSchema.extend({
-    /**
-     * Adapter-specific configuration. Discriminated union — each adapter
-     * package defines its own config schema under its discriminator key.
-     */
+    /** Adapter-specific configuration, parsed by the adapter that owns it. */
     config: GitHostingConfigSchema.optional()
 });
 class DefaultGitHostingImplementation {
     descriptor;
     context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
     constructor(descriptor, context) {
         this.descriptor = descriptor;
         this.context = context;
-    }
-    get config() {
-        return this.descriptor;
+        this.config = readKindDescriptor(GitHostingDescriptorSchema, descriptor);
     }
 }
 export const gitHostingKind = createRuntimeKind({
     id: 'infra/git-hosting',
     descriptorSchema: GitHostingDescriptorSchema,
     defaultImplementation: DefaultGitHostingImplementation,
-    discoveryPattern: INFRA_DISCOVERY_PATTERN,
-    extractStem
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
 });
 //# sourceMappingURL=git-hosting.kind.js.map