@vibesdotdev/infra-core 0.0.2 → 1.0.0-rc.11

package/dist/kinds/inventory.kind.js

@@ -0,0 +1,243 @@
+/**
+ * Kind: infra/inventory
+ *
+ * Generic read-only inventory descriptor. Implementations enumerate provider
+ * resources without mutating them. Used by `vibes infra inventory` and
+ * provider-specific list/status commands.
+ */
+import * as z from 'zod/v4';
+import { settleUntrusted } from '@vibesdotdev/config/manifest/read-untrusted';
+import { CapabilityError, CaughtFailureSchema, isCapabilityError } from '@vibesdotdev/kernel';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
+import { WorkerDescriptorSchema } from "./worker.kind.js";
+export const InventoryResourceSchema = z.object({
+    id: z.string(),
+    kind: z.string(),
+    name: z.string().optional(),
+    region: z.string().optional(),
+    status: z.string().optional(),
+    managedBy: z.string().optional(),
+    tags: z.array(z.string()).optional(),
+    createdAt: z.string().optional(),
+    raw: z.unknown().optional()
+});
+export const InfraProviderFailureSchema = z.object({
+    code: z.string(),
+    message: z.string(),
+    retryable: z.boolean().optional()
+});
+const FAILURE_UNREADABLE = {
+    code: 'INVALID_INPUT',
+    reason: 'infra-provider-failure-unreadable',
+    message: () => 'Provider failure evidence does not read.'
+};
+/** The evidence a failure that does not read as `InfraProviderFailure` is carried as. */
+const UNREADABLE_FAILURE = {
+    code: 'PROVIDER_UNAVAILABLE',
+    message: 'Provider operation failed; inspect the provider-specific sanitized diagnostics.'
+};
+/** `failure` as the schema reads it; one that does not read (or throws when read) is the fixed unreadable evidence. */
+function readFailure(failure) {
+    const read = settleUntrusted(InfraProviderFailureSchema, () => failure, FAILURE_UNREADABLE);
+    return read.ok ? read.data : UNREADABLE_FAILURE;
+}
+/**
+ * Provider-sanitized failure evidence as a typed `UNAVAILABLE
+ * infra-provider-failure`. The provider's own code stays on `failure.code`
+ * (and in details); the message is the provider's sanitized message.
+ */
+export class SanitizedInfraProviderError extends CapabilityError {
+    failure;
+    constructor(failure, cause) {
+        const parsed = readFailure(failure);
+        const options = {
+            reason: 'infra-provider-failure',
+            retryable: parsed.retryable,
+            details: { providerCode: parsed.code }
+        };
+        if (cause !== undefined)
+            options.cause = cause;
+        super(parsed.message, 'UNAVAILABLE', options);
+        this.name = 'SanitizedInfraProviderError';
+        this.failure = parsed;
+    }
+}
+export function createSanitizedInfraProviderError(failure, cause) {
+    return new SanitizedInfraProviderError(failure, cause);
+}
+export const InfraAuthorityFingerprintSchema = z.object({
+    provider: z.string().min(1),
+    requestedEnvironment: z.string().min(1),
+    resolvedEnvironment: z.string().min(1),
+    source: z.string().min(1),
+    account: z.string().min(1),
+    /** Stable, non-display digest used to compare identities hidden by redaction. */
+    accountIdentity: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    capabilities: z.array(z.string().min(1))
+});
+/** Stable, provider-neutral text form for operator-facing inventory and audit output. */
+export function formatInfraAuthorityFingerprint(authority) {
+    const parsed = InfraAuthorityFingerprintSchema.parse(authority);
+    return [
+        `provider=${parsed.provider}`,
+        `requested=${parsed.requestedEnvironment}`,
+        `resolved=${parsed.resolvedEnvironment}`,
+        `source=${parsed.source}`,
+        `account=${parsed.account}`,
+        `capabilities=${[...parsed.capabilities].sort().join(',')}`
+    ].join(' ');
+}
+/**
+ * Reconcile authority evidence emitted by several provider surfaces. Identity
+ * must be identical; capabilities are the honest union of operations actually
+ * requested by those surfaces.
+ */
+export function mergeInfraAuthorityFingerprints(authorities) {
+    if (authorities.length === 0)
+        return undefined;
+    const parsed = authorities.map((authority) => InfraAuthorityFingerprintSchema.parse(authority));
+    const [first, ...rest] = parsed;
+    if (parsed.length > 1 && parsed.some((authority) => !authority.accountIdentity)) {
+        throw createSanitizedInfraProviderError({
+            code: 'INFRA_AUTHORITY_DIVERGENCE',
+            message: 'Infrastructure provider surfaces resolved different operator authorities.',
+            retryable: false
+        });
+    }
+    for (const authority of rest) {
+        if (authority.provider !== first.provider ||
+            authority.requestedEnvironment !== first.requestedEnvironment ||
+            authority.resolvedEnvironment !== first.resolvedEnvironment ||
+            authority.source !== first.source ||
+            authority.account !== first.account ||
+            authority.accountIdentity !== first.accountIdentity) {
+            throw createSanitizedInfraProviderError({
+                code: 'INFRA_AUTHORITY_DIVERGENCE',
+                message: 'Infrastructure provider surfaces resolved different operator authorities.',
+                retryable: false
+            });
+        }
+    }
+    return InfraAuthorityFingerprintSchema.parse({
+        ...first,
+        capabilities: [...new Set(parsed.flatMap((authority) => authority.capabilities))].sort()
+    });
+}
+/**
+ * Convert arbitrary backend exceptions into bounded operator-safe evidence: a
+ * `SanitizedInfraProviderError` keeps its evidence; anything else is the fixed
+ * unreadable evidence (what it says is never repeated).
+ */
+export function sanitizeInfraProviderFailure(error, declaredCredentialKeys = []) {
+    const caught = CaughtFailureSchema.parse(error);
+    if (caught instanceof SanitizedInfraProviderError)
+        return caught.failure;
+    return typedFailureEvidence(caught, new Set(declaredCredentialKeys)) ?? UNREADABLE_FAILURE;
+}
+/** The deepest `cause` chain read when naming a typed failure. */
+const TYPED_CHAIN_LIMIT = 6;
+/** A credential key name is an environment-style name; it is named only when a declared requirement lists it. */
+const CREDENTIAL_KEY_NAME = /^[A-Z][A-Z0-9_]{0,95}$/;
+const TYPED_REASON = /^[a-z][a-z0-9-]{0,63}$/;
+const TYPED_KEY_LIMIT = 8;
+/**
+ * The names of the credential keys a typed failure's details carry
+ * (`details.keys`) that a declared credential requirement lists. An
+ * identifier-shaped string that no requirement declares (a token prefix, an
+ * access-key id) is never named.
+ */
+function credentialKeyNames(error, declared) {
+    const keys = error.details?.keys;
+    if (!Array.isArray(keys))
+        return [];
+    return keys
+        .filter((key) => typeof key === 'string' && CREDENTIAL_KEY_NAME.test(key) && declared.has(key))
+        .slice(0, TYPED_KEY_LIMIT);
+}
+/**
+ * The typed reasons (outermost first) and credential key names a
+ * `CapabilityError` chain carries. A `CapabilityError` states its reason and
+ * details value-free by contract; its message and any untyped link are never
+ * read, so a credential value cannot reach the evidence. `undefined` when the
+ * failure is not typed.
+ */
+function typedFailureEvidence(caught, declared) {
+    const reasons = [];
+    const keys = [];
+    let retryable;
+    let link = caught;
+    for (let depth = 0; depth < TYPED_CHAIN_LIMIT && link instanceof Error && isCapabilityError(link); depth++) {
+        if (TYPED_REASON.test(link.reason) && !reasons.includes(link.reason))
+            reasons.push(link.reason);
+        for (const key of credentialKeyNames(link, declared))
+            if (!keys.includes(key))
+                keys.push(key);
+        if (retryable === undefined)
+            retryable = link.retryable;
+        link = link.cause;
+    }
+    if (reasons.length === 0)
+        return undefined;
+    const named = keys.length > 0 ? ` (credential keys: ${keys.join(', ')})` : '';
+    const evidence = {
+        code: 'PROVIDER_UNAVAILABLE',
+        message: `Provider operation failed: ${reasons.join(' <- ')}${named}.`
+    };
+    if (retryable !== undefined)
+        evidence.retryable = retryable;
+    return evidence;
+}
+export const InventoryDeclaredResourceSchema = z.object({
+    kind: z.string().min(1),
+    id: z.string().min(1),
+    name: z.string().min(1).optional()
+});
+export const InventorySnapshotSchema = z.object({
+    provider: z.string(),
+    collectedAt: z.string(),
+    resources: z.array(InventoryResourceSchema),
+    declarations: z.array(InventoryDeclaredResourceSchema).optional(),
+    authority: InfraAuthorityFingerprintSchema.optional(),
+    /** Credential-route evidence only; never includes a credential value or key material. */
+    credentialPath: z.string().min(1).optional()
+});
+export const InventoryWorkspaceSourcesSchema = z.object({
+    deploymentProviders: z.array(z.string().min(1)).default([]),
+    workerAdapters: z.array(z.string().min(1)).default([])
+});
+export const InventoryWorkspaceSchema = z.object({
+    deployments: z.array(z.object({
+        provider: z.string().min(1),
+        unitName: z.string().nullable()
+    })).default([]),
+    workers: z.array(WorkerDescriptorSchema).default([])
+});
+const InventoryBaseSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('infra/inventory'),
+    provider: z.string().min(1).optional(),
+    providerAliases: z.array(z.string().min(1)).optional(),
+    resourceKinds: z.array(z.string()).optional(),
+    workspaceSources: InventoryWorkspaceSourcesSchema.optional()
+});
+export const InventoryDescriptorSchema = InventoryBaseSchema;
+class DefaultInventoryImplementation {
+    descriptor;
+    context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
+    constructor(descriptor, context) {
+        this.descriptor = descriptor;
+        this.context = context;
+        this.config = readKindDescriptor(InventoryDescriptorSchema, descriptor);
+    }
+}
+export const inventoryKind = createRuntimeKind({
+    id: 'infra/inventory',
+    descriptorSchema: InventoryDescriptorSchema,
+    defaultImplementation: DefaultInventoryImplementation,
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
+});
+//# sourceMappingURL=inventory.kind.js.map

package/dist/kinds/inventory.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.kind.js","sourceRoot":"","sources":["../../src/kinds/inventory.kind.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAA6B,MAAM,6CAA6C,CAAC;AACzG,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,MAAM,kBAAkB,GAAyB;IAChD,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,mCAAmC;IAC3C,OAAO,EAAE,GAAG,EAAE,CAAC,0CAA0C;CACzD,CAAC;AAEF,yFAAyF;AACzF,MAAM,kBAAkB,GAAyB;IAChD,IAAI,EAAE,sBAAsB;IAC5B,OAAO,EAAE,iFAAiF;CAC1F,CAAC;AAEF,uHAAuH;AACvH,SAAS,WAAW,CAAC,OAA6B;IACjD,MAAM,IAAI,GAAG,eAAe,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,2BAA4B,SAAQ,eAAe;IACtD,OAAO,CAAuB;IAEvC,YAAY,OAA6B,EAAE,KAAwB;QAClE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,OAAO,GAA2B;YACvC,MAAM,EAAE,wBAAwB;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE;SACtC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,CAAC;CACD;AAED,MAAM,UAAU,iCAAiC,CAChD,OAA6B,EAC7B,KAAwB;IAExB,OAAO,IAAI,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACrE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACxC,CAAC,CAAC;AAGH,yFAAyF;AACzF,MAAM,UAAU,+BAA+B,CAAC,SAAoC;IACnF,MAAM,MAAM,GAAG,+BAA+B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,OAAO;QACN,YAAY,MAAM,CAAC,QAAQ,EAAE;QAC7B,aAAa,MAAM,CAAC,oBAAoB,EAAE;QAC1C,YAAY,MAAM,CAAC,mBAAmB,EAAE;QACxC,UAAU,MAAM,CAAC,MAAM,EAAE;QACzB,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,gBAAgB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;KAC3D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC9C,WAAiD;IAEjD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,+BAA+B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAChG,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QACjF,MAAM,iCAAiC,CAAC;YACvC,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,2EAA2E;YACpF,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC9B,IACC,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YACrC,SAAS,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB;YAC7D,SAAS,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;YAC3D,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YACjC,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YACnC,SAAS,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,EAClD,CAAC;YACF,MAAM,iCAAiC,CAAC;gBACvC,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,2EAA2E;gBACpF,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,OAAO,+BAA+B,CAAC,KAAK,CAAC;QAC5C,GAAG,KAAK;QACR,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KACxF,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC3C,KAAa,EACb,yBAA2C,EAAE;IAE7C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,YAAY,2BAA2B;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IACzE,OAAO,oBAAoB,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC,IAAI,kBAAkB,CAAC;AAC5F,CAAC;AAED,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,iHAAiH;AACjH,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AACrD,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAC9C,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAsB,EAAE,QAA6B;IAChF,MAAM,IAAI,GAAY,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,IAAI;SACT,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SAC7G,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,MAA2C,EAAE,QAA6B;IACvG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,SAA8B,CAAC;IACnC,IAAI,IAAI,GAAY,MAAM,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,iBAAiB,IAAI,IAAI,YAAY,KAAK,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5G,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChG,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9F,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACxD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAyB;QACtC,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,8BAA8B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG;KACtE,CAAC;IACF,IAAI,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5D,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC3C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;IACjE,SAAS,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACrD,yFAAyF;IACzF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACtD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACf,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpD,CAAC,CAAC;AAGH,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC1D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAU7D,MAAM,8BAA8B;IAIlB;IACA;IAJjB,qDAAqD;IAC5C,MAAM,CAAsB;IACrC,YACiB,UAA6B,EAC7B,OAAoB;QADpB,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAa;QAEpC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,yBAAyB,EAAE,UAAU,CAAC,CAAC;IACzE,CAAC;CAED;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAC7C;IACC,EAAE,EAAE,iBAAiB;IACrB,gBAAgB,EAAE,yBAAyB;IAC3C,qBAAqB,EAAE,8BAA8B;IACrD,iBAAiB,EAAE,wBAAwB;CAC3C,CACD,CAAC"}

package/dist/kinds/load-balancer.kind.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Kind: infra/load-balancer
+ *
+ * Provider-neutral load balancer descriptor.
+ *
+ * `config` is an open, adapter-keyed shape (DigitalOcean's load balancer
+ * config lives in `@vibesdotdev/integrations-digitalocean`); this kind
+ * names no provider, so a config for any adapter parses here and the
+ * adapter validates its own grammar.
+ */
+import * as z from 'zod/v4';
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+export declare const LoadBalancerForwardingRuleSchema: z.ZodObject<{
+    entryProtocol: z.ZodEnum<{
+        tcp: "tcp";
+        http: "http";
+        udp: "udp";
+        http2: "http2";
+        https: "https";
+        http3: "http3";
+    }>;
+    entryPort: z.ZodNumber;
+    targetProtocol: z.ZodEnum<{
+        tcp: "tcp";
+        http: "http";
+        udp: "udp";
+        http2: "http2";
+        https: "https";
+    }>;
+    targetPort: z.ZodNumber;
+    certificateId: z.ZodOptional<z.ZodString>;
+    tlsPassthrough: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type LoadBalancerForwardingRule = z.infer<typeof LoadBalancerForwardingRuleSchema>;
+export declare const LoadBalancerHealthCheckSchema: z.ZodObject<{
+    protocol: z.ZodEnum<{
+        tcp: "tcp";
+        http: "http";
+        https: "https";
+    }>;
+    port: z.ZodOptional<z.ZodNumber>;
+    path: z.ZodOptional<z.ZodString>;
+    checkIntervalSeconds: z.ZodOptional<z.ZodNumber>;
+    responseTimeoutSeconds: z.ZodOptional<z.ZodNumber>;
+    unhealthyThreshold: z.ZodOptional<z.ZodNumber>;
+    healthyThreshold: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type LoadBalancerHealthCheck = z.infer<typeof LoadBalancerHealthCheckSchema>;
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no provider, so a config for any adapter — including one contributed by a
+ * user plugin — parses here, and the adapter validates its own grammar.
+ */
+export declare const LoadBalancerConfigSchema: z.ZodObject<{
+    adapter: z.ZodString;
+}, z.core.$loose>;
+export type LoadBalancerConfig = z.infer<typeof LoadBalancerConfigSchema>;
+export declare const LoadBalancerDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"infra/load-balancer">;
+    region: z.ZodOptional<z.ZodString>;
+    forwardingRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        entryProtocol: z.ZodEnum<{
+            tcp: "tcp";
+            http: "http";
+            udp: "udp";
+            http2: "http2";
+            https: "https";
+            http3: "http3";
+        }>;
+        entryPort: z.ZodNumber;
+        targetProtocol: z.ZodEnum<{
+            tcp: "tcp";
+            http: "http";
+            udp: "udp";
+            http2: "http2";
+            https: "https";
+        }>;
+        targetPort: z.ZodNumber;
+        certificateId: z.ZodOptional<z.ZodString>;
+        tlsPassthrough: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+    healthCheck: z.ZodOptional<z.ZodObject<{
+        protocol: z.ZodEnum<{
+            tcp: "tcp";
+            http: "http";
+            https: "https";
+        }>;
+        port: z.ZodOptional<z.ZodNumber>;
+        path: z.ZodOptional<z.ZodString>;
+        checkIntervalSeconds: z.ZodOptional<z.ZodNumber>;
+        responseTimeoutSeconds: z.ZodOptional<z.ZodNumber>;
+        unhealthyThreshold: z.ZodOptional<z.ZodNumber>;
+        healthyThreshold: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    algorithm: z.ZodOptional<z.ZodEnum<{
+        round_robin: "round_robin";
+        least_connections: "least_connections";
+    }>>;
+    redirectHttpToHttps: z.ZodOptional<z.ZodBoolean>;
+    config: z.ZodOptional<z.ZodObject<{
+        adapter: z.ZodString;
+    }, z.core.$loose>>;
+}, z.core.$strip>;
+export type LoadBalancerDescriptor = z.infer<typeof LoadBalancerDescriptorSchema>;
+declare class DefaultLoadBalancerImplementation {
+    readonly descriptor: RuntimeDescriptor;
+    readonly context: KindContext;
+    /** The descriptor as this kind's schema reads it. */
+    readonly config: LoadBalancerDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
+}
+export declare const loadBalancerKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<DefaultLoadBalancerImplementation>;
+export {};
+//# sourceMappingURL=load-balancer.kind.d.ts.map

package/dist/kinds/load-balancer.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-balancer.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/load-balancer.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAIpE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;iBAO3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;iBAQxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAWpF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;iBAEnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,cAAM,iCAAiC;aAIrB,UAAU,EAAE,iBAAiB;aAC7B,OAAO,EAAE,WAAW;IAJrC,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;gBAEvB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,WAAW;CAKrC;AAED,eAAO,MAAM,gBAAgB,8FAK3B,CAAC"}

package/dist/kinds/load-balancer.kind.js

@@ -0,0 +1,71 @@
+/**
+ * Kind: infra/load-balancer
+ *
+ * Provider-neutral load balancer descriptor.
+ *
+ * `config` is an open, adapter-keyed shape (DigitalOcean's load balancer
+ * config lives in `@vibesdotdev/integrations-digitalocean`); this kind
+ * names no provider, so a config for any adapter parses here and the
+ * adapter validates its own grammar.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
+export const LoadBalancerForwardingRuleSchema = z.object({
+    entryProtocol: z.enum(['http', 'https', 'http2', 'http3', 'tcp', 'udp']),
+    entryPort: z.number().int().positive(),
+    targetProtocol: z.enum(['http', 'https', 'http2', 'tcp', 'udp']),
+    targetPort: z.number().int().positive(),
+    certificateId: z.string().optional(),
+    tlsPassthrough: z.boolean().optional()
+});
+export const LoadBalancerHealthCheckSchema = z.object({
+    protocol: z.enum(['http', 'https', 'tcp']),
+    port: z.number().int().positive().optional(),
+    path: z.string().optional(),
+    checkIntervalSeconds: z.number().int().positive().optional(),
+    responseTimeoutSeconds: z.number().int().positive().optional(),
+    unhealthyThreshold: z.number().int().positive().optional(),
+    healthyThreshold: z.number().int().positive().optional()
+});
+const LoadBalancerBaseSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('infra/load-balancer'),
+    region: z.string().min(1).optional(),
+    forwardingRules: z.array(LoadBalancerForwardingRuleSchema).optional(),
+    healthCheck: LoadBalancerHealthCheckSchema.optional(),
+    algorithm: z.enum(['round_robin', 'least_connections']).optional(),
+    redirectHttpToHttps: z.boolean().optional()
+});
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no provider, so a config for any adapter — including one contributed by a
+ * user plugin — parses here, and the adapter validates its own grammar.
+ */
+export const LoadBalancerConfigSchema = z.looseObject({
+    adapter: z.string().min(1)
+});
+export const LoadBalancerDescriptorSchema = LoadBalancerBaseSchema.extend({
+    /** Adapter-specific configuration, parsed by the adapter that owns it. */
+    config: LoadBalancerConfigSchema.optional()
+});
+class DefaultLoadBalancerImplementation {
+    descriptor;
+    context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
+    constructor(descriptor, context) {
+        this.descriptor = descriptor;
+        this.context = context;
+        this.config = readKindDescriptor(LoadBalancerDescriptorSchema, descriptor);
+    }
+}
+export const loadBalancerKind = createRuntimeKind({
+    id: 'infra/load-balancer',
+    descriptorSchema: LoadBalancerDescriptorSchema,
+    defaultImplementation: DefaultLoadBalancerImplementation,
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
+});
+//# sourceMappingURL=load-balancer.kind.js.map

package/dist/kinds/load-balancer.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-balancer.kind.js","sourceRoot":"","sources":["../../src/kinds/load-balancer.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5D,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAGH,MAAM,sBAAsB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC7D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IACrE,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,WAAW,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,sBAAsB,CAAC,MAAM,CAAC;IACzE,0EAA0E;IAC1E,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,MAAM,iCAAiC;IAIrB;IACA;IAJjB,qDAAqD;IAC5C,MAAM,CAAyB;IACxC,YACiB,UAA6B,EAC7B,OAAoB;QADpB,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAa;QAEpC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,4BAA4B,EAAE,UAAU,CAAC,CAAC;IAC5E,CAAC;CAED;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAA4D;IAC5G,EAAE,EAAE,qBAAqB;IACzB,gBAAgB,EAAE,4BAA4B;IAC9C,qBAAqB,EAAE,iCAAiC;IACxD,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC"}

package/dist/kinds/logs.kind.d.ts

@@ -5,6 +5,10 @@
  * Provides programmatic access to logs for tailing, queries, and analytics.
  */
 import * as z from 'zod/v4';
+import type { WorkerLogRequest, ActiveLogStream } from '../schemas/log-stream.ts';
+import type { DatabaseMigrationCredentialSource, DatabaseMigrationLog } from '../schemas/database-migration.ts';
+import type { JsonValue } from '@vibesdotdev/kernel/schemas/json';
+export { WorkerLogRequestSchema, ActiveLogStreamSchema, type WorkerLogRequest, type ActiveLogStream } from '../schemas/log-stream.ts';
 export declare const InfraLogsDescriptorSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodOptional<z.ZodString>;
@@ -13,12 +17,23 @@ export declare const InfraLogsDescriptorSchema: z.ZodObject<{
     hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
     enabled: z.ZodOptional<z.ZodBoolean>;
     priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
     requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
     optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
     kind: z.ZodLiteral<"infra/logs">;
     adapter: z.ZodString;
     adapterConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    environment: z.ZodOptional<z.ZodString>;
     sources: z.ZodDefault<z.ZodArray<z.ZodObject<{
         type: z.ZodEnum<{
             worker: "worker";
@@ -26,11 +41,12 @@ export declare const InfraLogsDescriptorSchema: z.ZodObject<{
             d1: "d1";
             r2: "r2";
             kv: "kv";
+            pod: "pod";
         }>;
         name: z.ZodString;
         environment: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
-    retention: z.ZodOptional<z.ZodObject<{
+    logRetention: z.ZodOptional<z.ZodObject<{
         hotDays: z.ZodDefault<z.ZodNumber>;
         coldDays: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
@@ -48,7 +64,60 @@ export declare const InfraLogsDescriptorSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type InfraLogsDescriptor = z.infer<typeof InfraLogsDescriptorSchema>;
 export type InfraLogsDescriptorInput = z.input<typeof InfraLogsDescriptorSchema>;
+export type LogQueryView = 'events' | 'invocations' | 'calculations' | 'calculations_by_invocation' | 'traces' | 'requests' | 'agents';
+export type LogQueryFilterOperation = 'eq' | 'neq' | 'includes' | 'not_includes' | 'starts_with' | 'ends_with' | 'regex' | 'exists' | 'is_null' | 'in' | 'not_in' | 'gt' | 'gte' | 'lt' | 'lte';
+export interface LogQueryFilter {
+    key: string;
+    operation: LogQueryFilterOperation;
+    type?: 'string' | 'number' | 'boolean';
+    value?: string | number | boolean;
+}
+export interface LogQueryOptions {
+    view?: LogQueryView;
+    filters?: LogQueryFilter[];
+    filterCombination?: 'and' | 'or';
+    needle?: {
+        value: string;
+        isRegex?: boolean;
+        matchCase?: boolean;
+    };
+    limit?: number;
+    offset?: string;
+    from: number;
+    to: number;
+    orderBy?: {
+        value: string;
+        order: 'asc' | 'desc';
+    };
+}
+/** A historical query's answer. The view fields keep the provider's JSON shape; callers normalize what they read. */
+export interface LogQueryResult {
+    queryId?: string;
+    events?: JsonValue;
+    invocations?: JsonValue;
+    calculations?: JsonValue;
+    rows?: JsonValue;
+    result?: JsonValue;
+    count?: number;
+    /** How many rows matched before the limit applied, so a truncated answer never reads as complete. */
+    matchedBeforeLimit?: number;
+    /** Provider-reported scalar facts about what was read (for example the cluster and how many sources). */
+    facts?: Readonly<Record<string, string | number | boolean>>;
+}
+/** One command's credential choice for a log source: whose credentials, for which environment. */
+export interface LogsSourceOptions {
+    /** `ambient` is the operator's explicit opt-in to the shell's provider credentials; it never consults a store. */
+    readonly credentialSource: DatabaseMigrationCredentialSource;
+    /** The Vibes deployment environment whose stored credentials the source reads; absent, the runtime's own. */
+    readonly environment?: string;
+    /** Where the source reports which store supplied its credentials. */
+    readonly log: Pick<DatabaseMigrationLog, 'info' | 'warn'>;
+}
 export interface LogsImplementation {
+    /** The same source under one command's credential choice; a source without it reads only its default credentials. */
+    create?(options: LogsSourceOptions): Promise<LogsImplementation>;
+    /** Optional Kubernetes workload log operation; providers validate with WorkerLogRequestSchema. */
+    streamLogs?(request: WorkerLogRequest): Promise<ActiveLogStream>;
     /** Stream logs in real-time (returns WebSocket URL) */
     tailLogs(sourceName: string, options?: {
         status?: 'ok' | 'error' | 'canceled';
@@ -81,11 +150,13 @@ export interface LogsImplementation {
         timeStart: string;
         timeEnd?: string;
     }): Promise<number>;
+    /** Query historical log events/invocations when the provider supports it. */
+    queryLogs?(sourceName: string, options: LogQueryOptions): Promise<LogQueryResult>;
 }
 export interface DefaultLogsImplementation {
     generateConfig: () => InfraLogsDescriptor;
 }
-export declare const logsKind: import("@vibesdotdev/runtime/schemas/kind").RuntimeKindDescriptorRecord<DefaultLogsImplementation>;
+export declare const logsKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<DefaultLogsImplementation>;
 export type InfraLogsKind = InfraLogsDescriptor;
 export type InfraLogsKindInput = InfraLogsDescriptorInput;
 //# sourceMappingURL=logs.kind.d.ts.map

package/dist/kinds/logs.kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logs.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/logs.kind.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAqD5B,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAiB,CAAC;AACxD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEjF,MAAM,WAAW,kBAAkB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,IAAI,GAAG,OAAO,GAAG,UAAU,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpJ,8BAA8B;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,gCAAgC;IAChC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACjF,4BAA4B;IAC5B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1O,qBAAqB;IACrB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvG;AAED,MAAM,WAAW,yBAAyB;IACzC,cAAc,EAAE,MAAM,mBAAmB,CAAC;CAC1C;AAeD,eAAO,MAAM,QAAQ,oGAMnB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAChD,MAAM,MAAM,kBAAkB,GAAG,wBAAwB,CAAC"}
+{"version":3,"file":"logs.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/logs.kind.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAQ5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,KAAK,EAAE,iCAAiC,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAChH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAsDtI,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAiB,CAAC;AACxD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEjF,MAAM,MAAM,YAAY,GACrB,QAAQ,GACR,aAAa,GACb,cAAc,GACd,4BAA4B,GAC5B,QAAQ,GACR,UAAU,GACV,QAAQ,CAAC;AAEZ,MAAM,MAAM,uBAAuB,GAChC,IAAI,GACJ,KAAK,GACL,UAAU,GACV,cAAc,GACd,aAAa,GACb,WAAW,GACX,OAAO,GACP,QAAQ,GACR,SAAS,GACT,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,CAAC;AAET,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,uBAAuB,CAAC;IACnC,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,iBAAiB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,qHAAqH;AACrH,MAAM,WAAW,cAAc;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qGAAqG;IACrG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yGAAyG;IACzG,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAC5D;AAED,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IACjC,kHAAkH;IAClH,QAAQ,CAAC,gBAAgB,EAAE,iCAAiC,CAAC;IAC7D,6GAA6G;IAC7G,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,kBAAkB;IAClC,qHAAqH;IACrH,MAAM,CAAC,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjE,kGAAkG;IAClG,UAAU,CAAC,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjE,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,IAAI,GAAG,OAAO,GAAG,UAAU,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpJ,8BAA8B;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,gCAAgC;IAChC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACjF,4BAA4B;IAC5B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1O,qBAAqB;IACrB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvG,6EAA6E;IAC7E,SAAS,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,yBAAyB;IACzC,cAAc,EAAE,MAAM,mBAAmB,CAAC;CAC1C;AAkBD,eAAO,MAAM,QAAQ,sFAKnB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAChD,MAAM,MAAM,kBAAkB,GAAG,wBAAwB,CAAC"}