@vibesdotdev/infra-core 0.0.2 → 1.0.0-rc.11

package/dist/kinds/object-storage.kind.js

@@ -3,17 +3,23 @@
  *
  * Describes object/blob storage.
  *
- * Schema shape: strict common base + `config` discriminated union.
+ * Schema shape: strict common base + an open, adapter-keyed `config`.
  *
  * - The base defines fields universal across adapters: id/kind/name +
  *   the storage shape (bucket, cors, lifecycle, publicAccess).
- * - Adapter-specific fields (region, acl, …) live under `config`.
- *   Each adapter package defines its own concrete schema.
+ * - Adapter-specific fields (region, acl, …) live under `config`, keyed by
+ *   a non-empty `adapter` discriminator. Each adapter package defines and
+ *   parses its own concrete schema (DigitalOcean Spaces' lives in
+ *   `@vibesdotdev/integrations-digitalocean`; Cloudflare R2's in
+ *   `@vibesdotdev/integrations-cloudflare`); this kind names no provider,
+ *   so a config for any adapter — including one contributed by a user
+ *   plugin — parses here, and the adapter validates its own grammar.
  */
 import * as z from 'zod/v4';
-import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
-import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
-import { INFRA_DISCOVERY_PATTERN, extractStem } from "./discovery.js";
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
 export const CorsRuleSchema = z.object({
     allowedOrigins: z.array(z.string()).default(['*']),
     allowedMethods: z.array(z.string()).default(['GET']),
@@ -25,6 +31,11 @@ export const LifecycleRuleSchema = z.object({
     prefix: z.string().optional(),
     /** Days until expiration */
     expiration: z.number().int().positive().optional(),
+    /**
+     * Days after which incomplete multipart uploads are aborted.
+     * Maps to S3-compatible `AbortIncompleteMultipartUpload`.
+     */
+    abortIncompleteMultipartUploadDays: z.number().int().positive().optional(),
     /** Storage class transition */
     transition: z
         .object({
@@ -33,6 +44,16 @@ export const LifecycleRuleSchema = z.object({
     })
         .optional()
 });
+/**
+ * Reference to a credential or secret materialized at apply time. The shape
+ * is intentionally permissive — full validation lives in the credentials
+ * runtime. Keeping it inline keeps this kind decoupled from runtime/secrets.
+ */
+export const CredentialReferenceSchema = z.object({
+    store: z.string().min(1).optional(),
+    key: z.string().min(1),
+    env: z.string().min(1).optional()
+});
 const ObjectStorageBaseSchema = RuntimeDescriptorSchema.extend({
     kind: z.literal('infra/object-storage'),
     /** Bucket name (defaults to descriptor id when omitted). */
@@ -44,38 +65,34 @@ const ObjectStorageBaseSchema = RuntimeDescriptorSchema.extend({
     /** Whether the bucket is publicly readable. */
     publicAccess: z.boolean().optional()
 });
-export const DOSpacesConfigSchema = z.object({
-    /** DO region (default: nyc3). */
-    region: z.string().min(1).default('nyc3')
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no provider, so a config for any adapter — including one contributed by a
+ * user plugin — parses here, and the adapter validates its own grammar.
+ */
+export const ObjectStorageConfigSchema = z.looseObject({
+    adapter: z.string().min(1)
 });
-export const CloudflareR2ConfigSchema = z.object({});
-export const ObjectStorageConfigSchema = z.union([
-    DOSpacesConfigSchema.extend({ adapter: z.literal('do-spaces') }),
-    CloudflareR2ConfigSchema.extend({ adapter: z.literal('cloudflare-r2') })
-]);
 export const ObjectStorageDescriptorSchema = ObjectStorageBaseSchema.extend({
-    /**
-     * Adapter-specific configuration. Discriminated union — each adapter
-     * package defines its own config schema under its discriminator key.
-     */
+    /** Adapter-specific configuration, parsed by the adapter that owns it. */
     config: ObjectStorageConfigSchema.optional()
 });
 class DefaultObjectStorageImplementation {
     descriptor;
     context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
     constructor(descriptor, context) {
         this.descriptor = descriptor;
         this.context = context;
-    }
-    get config() {
-        return this.descriptor;
+        this.config = readKindDescriptor(ObjectStorageDescriptorSchema, descriptor);
     }
 }
 export const objectStorageKind = createRuntimeKind({
     id: 'infra/object-storage',
     descriptorSchema: ObjectStorageDescriptorSchema,
     defaultImplementation: DefaultObjectStorageImplementation,
-    discoveryPattern: INFRA_DISCOVERY_PATTERN,
-    extractStem
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
 });
 //# sourceMappingURL=object-storage.kind.js.map

package/dist/kinds/object-storage.kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"object-storage.kind.js","sourceRoot":"","sources":["../../src/kinds/object-storage.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,yCAAyC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,4BAA4B;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,+BAA+B;IAC/B,UAAU,EAAE,CAAC;SACX,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,QAAQ,EAAE;CACZ,CAAC,CAAC;AAGH,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAEvC,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEpC,kBAAkB;IAClB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAExC,uBAAuB;IACvB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAElD,+CAA+C;IAC/C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAErD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC;IAChD,oBAAoB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAChE,wBAAwB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;CACxE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC3E;;;OAGG;IACH,MAAM,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAIH,MAAM,kCAAkC;IAEtB;IACA;IAFjB,YACiB,UAA6B,EAC7B,OAAgB;QADhB,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAS;IAC9B,CAAC;IAEJ,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,UAAqC,CAAC;IACnD,CAAC;CACD;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAGhD;IACD,EAAE,EAAE,sBAAsB;IAC1B,gBAAgB,EAAE,6BAA6B;IAC/C,qBAAqB,EAAE,kCAAkC;IACzD,gBAAgB,EAAE,uBAAuB;IACzC,WAAW;CACX,CAAC,CAAC"}
+{"version":3,"file":"object-storage.kind.js","sourceRoot":"","sources":["../../src/kinds/object-storage.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,yCAAyC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,4BAA4B;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD;;;OAGG;IACH,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1E,+BAA+B;IAC/B,UAAU,EAAE,CAAC;SACX,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,QAAQ,EAAE;CACZ,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAEvC,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEpC,kBAAkB;IAClB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAExC,uBAAuB;IACvB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAElD,+CAA+C;IAC/C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC3E,0EAA0E;IAC1E,MAAM,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAIH,MAAM,kCAAkC;IAItB;IACA;IAJjB,qDAAqD;IAC5C,MAAM,CAA0B;IACzC,YACiB,UAA6B,EAC7B,OAAoB;QADpB,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAa;QAEpC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;IAC7E,CAAC;CAED;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAGhD;IACD,EAAE,EAAE,sBAAsB;IAC1B,gBAAgB,EAAE,6BAA6B;IAC/C,qBAAqB,EAAE,kCAAkC;IACzD,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC"}

package/dist/kinds/observability.kind.d.ts

@@ -7,15 +7,16 @@
  *
  *   1. The CLI can introspect + write settings across the entire fleet
  *      without going through deploy.
- *   2. Cross-cutting policies (e.g. "10% sampling on every customer-facing
- *      Worker") have a single declarative shape.
+ *   2. Cross-cutting policies (e.g. "full log capture on every Worker")
+ *      have a single declarative shape.
  *   3. Provider impls map onto the native control plane (CF Workers
  *      Observability, DO Monitoring, Datadog, etc.).
  *
  * CLI surface (`vibes infra observability …`):
  *   status [--worker]                      read current settings
- *   set    [--worker] --sampling 0.1       write new settings
- *   exports list|add|remove                (Phase 2.5; not yet wired)
+ *   set    [--worker] --sampling 1         write new settings
+ *   exports list                         read safe export inventory
+ *   exports add|remove                   (not yet wired)
  *
  * Production Workers consume settings via their wrangler.jsonc; the CLI
  * writes directly to the provider API for immediate effect. To avoid
@@ -23,6 +24,7 @@
  * path — the CLI here is for ops-time tuning between deploys.
  */
 import * as z from 'zod/v4';
+import { type InfraAuthorityFingerprint, type InfraProviderFailure } from './inventory.kind.ts';
 declare const ObservabilityScopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"worker">;
     workerName: z.ZodString;
@@ -72,6 +74,33 @@ declare const ObservabilitySettingsSchema: z.ZodObject<{
     }, z.core.$strip>], "kind">>>;
 }, z.core.$strip>;
 export type ObservabilitySettings = z.infer<typeof ObservabilitySettingsSchema>;
+/**
+ * Provider-neutral queue health evidence collected from an adapter's live
+ * control plane. `oldestMessageAgeMs` is an age, rather than a provider
+ * timestamp, so consumers can compare it directly to a declared retention
+ * window.
+ */
+export declare const QueueBacklogSchema: z.ZodObject<{
+    queueName: z.ZodString;
+    backlogCount: z.ZodNumber;
+    backlogBytes: z.ZodNumber;
+    oldestMessageAgeMs: z.ZodNumber;
+    capturedAt: z.ZodString;
+}, z.core.$strip>;
+export type QueueBacklog = z.infer<typeof QueueBacklogSchema>;
+export interface QueueBacklogAlert {
+    alerting: boolean;
+    thresholdMs: number;
+}
+/**
+ * A queue is alerting only after its oldest message has consumed more than
+ * half of its retention window. Equality is deliberately healthy: the
+ * policy is strictly `age > retention / 2`.
+ */
+export declare function evaluateQueueBacklogAlert(queueBacklog: QueueBacklog, retentionMs: number): QueueBacklogAlert;
+export interface QueueBacklogImplementation {
+    listQueueBacklogs(): Promise<QueueBacklog[]>;
+}
 declare const ObservabilityBaseSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodOptional<z.ZodString>;
@@ -80,9 +109,19 @@ declare const ObservabilityBaseSchema: z.ZodObject<{
     hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
     enabled: z.ZodOptional<z.ZodBoolean>;
     priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
     requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
     optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
     kind: z.ZodLiteral<"infra/observability">;
     adapter: z.ZodString;
     adapterConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -141,7 +180,62 @@ export interface ObservabilitySnapshot {
     settings: ObservabilitySettings;
     /** Last-modified timestamp from the provider, when available. */
     modifiedAt?: string;
+    /** Bounded provider-safe evidence when this worker could not be read. */
+    failure?: InfraProviderFailure;
 }
+/** Public inventory deliberately excludes destination credentials and URL paths. */
+export declare const ObservabilityExportDestinationSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    signal: z.ZodEnum<{
+        unknown: "unknown";
+        logs: "logs";
+        traces: "traces";
+    }>;
+    enabled: z.ZodBoolean;
+    endpointOrigin: z.ZodOptional<z.ZodPipe<z.ZodURL, z.ZodTransform<string, string>>>;
+    transport: z.ZodEnum<{
+        unknown: "unknown";
+        http: "http";
+        https: "https";
+    }>;
+    headerNames: z.ZodArray<z.ZodString>;
+    lastDeliveredAt: z.ZodOptional<z.ZodISODateTime>;
+    lastErrorAt: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ObservabilityExportDestination = z.infer<typeof ObservabilityExportDestinationSchema>;
+export declare const ObservabilityExportInventorySchema: z.ZodObject<{
+    destinations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        signal: z.ZodEnum<{
+            unknown: "unknown";
+            logs: "logs";
+            traces: "traces";
+        }>;
+        enabled: z.ZodBoolean;
+        endpointOrigin: z.ZodOptional<z.ZodPipe<z.ZodURL, z.ZodTransform<string, string>>>;
+        transport: z.ZodEnum<{
+            unknown: "unknown";
+            http: "http";
+            https: "https";
+        }>;
+        headerNames: z.ZodArray<z.ZodString>;
+        lastDeliveredAt: z.ZodOptional<z.ZodISODateTime>;
+        lastErrorAt: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+    workers: z.ZodArray<z.ZodObject<{
+        workerName: z.ZodString;
+        logs: z.ZodArray<z.ZodString>;
+        traces: z.ZodArray<z.ZodString>;
+        failure: z.ZodOptional<z.ZodObject<{
+            code: z.ZodString;
+            message: z.ZodString;
+            retryable: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ObservabilityExportInventory = z.infer<typeof ObservabilityExportInventorySchema>;
 export interface SetObservabilityInput {
     scope: ObservabilityScope;
     settings: ObservabilitySettings;
@@ -164,12 +258,16 @@ export interface SetObservabilityResult {
  * Implementation contract every provider implements.
  */
 export interface ObservabilityImplementation {
+    /** Redacted authority used by the latest provider request, when applicable. */
+    getAuthority?(): Promise<InfraAuthorityFingerprint>;
     /** Read current settings for a scope. account-wide → one snapshot per Worker. */
     getStatus(scope: ObservabilityScope): Promise<ObservabilitySnapshot[]>;
+    /** Read export destinations and worker bindings without proving collector delivery. */
+    listExports?(scope: ObservabilityScope): Promise<ObservabilityExportInventory>;
     /** Apply settings to a scope. Returns per-Worker outcome. */
     set(input: SetObservabilityInput): Promise<SetObservabilityResult>;
 }
-export declare const observabilityKind: import("@vibesdotdev/runtime").RuntimeKindDescriptorRecord<ObservabilityImplementation>;
+export declare const observabilityKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<ObservabilityImplementation>;
 export type InfraObservabilityKind = InfraObservabilityDescriptor;
 export type InfraObservabilityKindInput = InfraObservabilityDescriptorInput;
 export { ObservabilityBaseSchema as InfraObservabilityDescriptorSchema, ObservabilityScopeSchema, ObservabilitySettingsSchema };

package/dist/kinds/observability.kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/observability.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,QAAA,MAAM,wBAAwB;;;;;;2BAU5B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmD/B,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB3B,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACnF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAC;QAAC,KAAK,EAAE,qBAAqB,CAAA;KAAE,CAAC,CAAC;IACpG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC3C,iFAAiF;IACjF,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvE,6DAA6D;IAC7D,GAAG,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACnE;AAED,eAAO,MAAM,iBAAiB,yFAQ5B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAClE,MAAM,MAAM,2BAA2B,GAAG,iCAAiC,CAAC;AAE5E,OAAO,EACN,uBAAuB,IAAI,kCAAkC,EAC7D,wBAAwB,EACxB,2BAA2B,EAC3B,CAAC"}
+{"version":3,"file":"observability.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/observability.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,OAAO,EAEN,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAG7B,QAAA,MAAM,wBAAwB;;;;;;2BAU5B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmD/B,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;;;iBAM7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,MAAM,GACjB,iBAAiB,CAWnB;AAED,MAAM,WAAW,0BAA0B;IAC1C,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;CAC7C;AAED,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB3B,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACnF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,OAAO,CAAC,EAAE,oBAAoB,CAAC;CAC/B;AAED,oFAAoF;AACpF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;iBAc/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAC;QAAC,KAAK,EAAE,qBAAqB,CAAA;KAAE,CAAC,CAAC;IACpG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC3C,+EAA+E;IAC/E,YAAY,CAAC,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACpD,iFAAiF;IACjF,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvE,uFAAuF;IACvF,WAAW,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC/E,6DAA6D;IAC7D,GAAG,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACnE;AAED,eAAO,MAAM,iBAAiB,wFAO5B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAClE,MAAM,MAAM,2BAA2B,GAAG,iCAAiC,CAAC;AAE5E,OAAO,EACN,uBAAuB,IAAI,kCAAkC,EAC7D,wBAAwB,EACxB,2BAA2B,EAC3B,CAAC"}

package/dist/kinds/observability.kind.js

@@ -7,15 +7,16 @@
  *
  *   1. The CLI can introspect + write settings across the entire fleet
  *      without going through deploy.
- *   2. Cross-cutting policies (e.g. "10% sampling on every customer-facing
- *      Worker") have a single declarative shape.
+ *   2. Cross-cutting policies (e.g. "full log capture on every Worker")
+ *      have a single declarative shape.
  *   3. Provider impls map onto the native control plane (CF Workers
  *      Observability, DO Monitoring, Datadog, etc.).
  *
  * CLI surface (`vibes infra observability …`):
  *   status [--worker]                      read current settings
- *   set    [--worker] --sampling 0.1       write new settings
- *   exports list|add|remove                (Phase 2.5; not yet wired)
+ *   set    [--worker] --sampling 1         write new settings
+ *   exports list                         read safe export inventory
+ *   exports add|remove                   (not yet wired)
  *
  * Production Workers consume settings via their wrangler.jsonc; the CLI
  * writes directly to the provider API for immediate effect. To avoid
@@ -23,9 +24,11 @@
  * path — the CLI here is for ops-time tuning between deploys.
  */
 import * as z from 'zod/v4';
-import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
-import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
-import { INFRA_DISCOVERY_PATTERN, extractStem } from "./discovery.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { InfraProviderFailureSchema } from "./inventory.kind.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
 const ObservabilityScopeSchema = z.discriminatedUnion('kind', [
     z.object({
         kind: z.literal('worker'),
@@ -92,6 +95,36 @@ const ObservabilitySettingsSchema = z.object({
     ]))
         .optional()
 });
+/**
+ * Provider-neutral queue health evidence collected from an adapter's live
+ * control plane. `oldestMessageAgeMs` is an age, rather than a provider
+ * timestamp, so consumers can compare it directly to a declared retention
+ * window.
+ */
+export const QueueBacklogSchema = z.object({
+    queueName: z.string().min(1),
+    backlogCount: z.number().int().nonnegative(),
+    backlogBytes: z.number().int().nonnegative(),
+    oldestMessageAgeMs: z.number().int().nonnegative(),
+    capturedAt: z.string().datetime()
+});
+/**
+ * A queue is alerting only after its oldest message has consumed more than
+ * half of its retention window. Equality is deliberately healthy: the
+ * policy is strictly `age > retention / 2`.
+ */
+export function evaluateQueueBacklogAlert(queueBacklog, retentionMs) {
+    if (!Number.isFinite(retentionMs) || retentionMs <= 0) {
+        throw new CapabilityError('Queue backlog retention must be a positive finite number of milliseconds.', 'INVALID_INPUT', {
+            reason: 'queue-backlog-retention-invalid'
+        });
+    }
+    const thresholdMs = retentionMs / 2;
+    return {
+        alerting: queueBacklog.oldestMessageAgeMs > thresholdMs,
+        thresholdMs
+    };
+}
 const ObservabilityBaseSchema = RuntimeDescriptorSchema.extend({
     kind: z.literal('infra/observability'),
     adapter: z.string().min(1),
@@ -110,11 +143,36 @@ const ObservabilityBaseSchema = RuntimeDescriptorSchema.extend({
      */
     settings: ObservabilitySettingsSchema.optional()
 });
+/** Public inventory deliberately excludes destination credentials and URL paths. */
+export const ObservabilityExportDestinationSchema = z.object({
+    id: z.string().min(1),
+    name: z.string(),
+    signal: z.enum(['logs', 'traces', 'unknown']),
+    enabled: z.boolean(),
+    endpointOrigin: z
+        .url({ protocol: /^https?$/ })
+        .transform((value) => new URL(value).origin)
+        .optional(),
+    /** URL scheme only; does not certify an OTLP encoding or collector. */
+    transport: z.enum(['http', 'https', 'unknown']),
+    headerNames: z.array(z.string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/)),
+    lastDeliveredAt: z.iso.datetime().optional(),
+    lastErrorAt: z.iso.datetime().optional()
+});
+export const ObservabilityExportInventorySchema = z.object({
+    destinations: z.array(ObservabilityExportDestinationSchema),
+    workers: z.array(z.object({
+        workerName: z.string().min(1),
+        logs: z.array(z.string()),
+        traces: z.array(z.string()),
+        /** When present, empty lists mean unreadable, not confirmed unconfigured. */
+        failure: InfraProviderFailureSchema.optional()
+    }))
+});
 export const observabilityKind = createRuntimeKind({
     id: 'infra/observability',
     descriptorSchema: ObservabilityBaseSchema,
-    discoveryPattern: INFRA_DISCOVERY_PATTERN,
-    extractStem
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
 });
 export { ObservabilityBaseSchema as InfraObservabilityDescriptorSchema, ObservabilityScopeSchema, ObservabilitySettingsSchema };
 //# sourceMappingURL=observability.kind.js.map

package/dist/kinds/observability.kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability.kind.js","sourceRoot":"","sources":["../../src/kinds/observability.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAC/B,uEAAuE;QACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACF,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC;SACL,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB;;;;WAIG;QACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAClC,wEAAwE;QACxE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,0DAA0D;QAC1D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,QAAQ,EAAE;IACZ,MAAM,EAAE,CAAC;SACP,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC;aACT,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;YAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACrC,CAAC;aACD,QAAQ,EAAE;KACZ,CAAC;SACD,QAAQ,EAAE;IACZ,OAAO,EAAE,CAAC;SACR,KAAK,CACL,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC5B,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;SAC1B,CAAC;QACF,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;YAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;SACnB,CAAC;KACF,CAAC,CACF;SACA,QAAQ,EAAE;CACZ,CAAC,CAAC;AAIH,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC;;;;OAIG;IACH,YAAY,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACxE;;;;OAIG;IACH,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAuCH,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAGhD;IACD,EAAE,EAAE,qBAAqB;IACzB,gBAAgB,EAAE,uBAAuB;IACzC,gBAAgB,EAAE,uBAAuB;IACzC,WAAW;CACX,CAAC,CAAC;AAKH,OAAO,EACN,uBAAuB,IAAI,kCAAkC,EAC7D,wBAAwB,EACxB,2BAA2B,EAC3B,CAAC"}
+{"version":3,"file":"observability.kind.js","sourceRoot":"","sources":["../../src/kinds/observability.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACN,0BAA0B,EAG1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAC/B,uEAAuE;QACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACF,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC;SACL,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB;;;;WAIG;QACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAClC,wEAAwE;QACxE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,0DAA0D;QAC1D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,QAAQ,EAAE;IACZ,MAAM,EAAE,CAAC;SACP,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC;aACT,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;YAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACrC,CAAC;aACD,QAAQ,EAAE;KACZ,CAAC;SACD,QAAQ,EAAE;IACZ,OAAO,EAAE,CAAC;SACR,KAAK,CACL,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC5B,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;SAC1B,CAAC;QACF,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;YAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;SACnB,CAAC;KACF,CAAC,CACF;SACA,QAAQ,EAAE;CACZ,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AASH;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,YAA0B,EAC1B,WAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,eAAe,CAAC,2EAA2E,EAAE,eAAe,EAAE;YACvH,MAAM,EAAE,iCAAiC;SACzC,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,GAAG,CAAC,CAAC;IACpC,OAAO;QACN,QAAQ,EAAE,YAAY,CAAC,kBAAkB,GAAG,WAAW;QACvD,WAAW;KACX,CAAC;AACH,CAAC;AAMD,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC;;;;OAIG;IACH,YAAY,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACxE;;;;OAIG;IACH,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAkBH,oFAAoF;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,cAAc,EAAE,CAAC;SACf,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;SAC7B,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;SAC3C,QAAQ,EAAE;IACZ,uEAAuE;IACvE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACvE,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,KAAK,CACf,CAAC,CAAC,MAAM,CAAC;QACR,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,6EAA6E;QAC7E,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;KAC9C,CAAC,CACF;CACD,CAAC,CAAC;AA8BH,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAGhD;IACD,EAAE,EAAE,qBAAqB;IACzB,gBAAgB,EAAE,uBAAuB;IACzC,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC;AAKH,OAAO,EACN,uBAAuB,IAAI,kCAAkC,EAC7D,wBAAwB,EACxB,2BAA2B,EAC3B,CAAC"}

package/dist/kinds/package-registry.kind.d.ts

@@ -11,10 +11,18 @@
  * - Adapter-specific fields (dockerImage, storageSize, domain, …)
  *   live exclusively under `config`. Each adapter package defines its own
  *   concrete schema under its discriminator key.
+ * - `publish` is how a release writes to this registry: the Secrets key that
+ *   holds its credential, the second factor the account asks for, and, for a
+ *   registry that only ever carries another registry's exact bytes, `mirrorOf`.
+ *
+ * Every release surface (`vibes infra npm publish`, `vibes infra npm mirror`,
+ * Forge's `publish:` step) resolves a registry by id through this kind and
+ * calls its implementation ({@link PackageRegistryImplementation}). The adapter
+ * named by `config.adapter` registers that implementation per descriptor id;
+ * a registry with no registered implementation refuses typed
+ * (`package-registry-implementation-missing`), never a silent fallback.
  */
 import * as z from 'zod/v4';
-import type { RuntimeKindDescriptorRecord } from '@vibesdotdev/runtime/schemas/kind';
-import type { RuntimeDescriptor } from '@vibesdotdev/runtime/schemas/descriptor';
 export declare const PackageRegistryTypeSchema: z.ZodEnum<{
     npm: "npm";
     docker: "docker";
@@ -22,21 +30,23 @@ export declare const PackageRegistryTypeSchema: z.ZodEnum<{
     helm: "helm";
 }>;
 export type PackageRegistryType = z.infer<typeof PackageRegistryTypeSchema>;
-export declare const VerdaccioDoksPackageRegistryConfigSchema: z.ZodObject<{
-    dockerImage: z.ZodDefault<z.ZodString>;
-    storageSize: z.ZodDefault<z.ZodString>;
-    domain: z.ZodString;
-    upstreamNpmUrl: z.ZodDefault<z.ZodString>;
-    authEnabled: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-export declare const PackageRegistryConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
-    dockerImage: z.ZodDefault<z.ZodString>;
-    storageSize: z.ZodDefault<z.ZodString>;
-    domain: z.ZodString;
-    upstreamNpmUrl: z.ZodDefault<z.ZodString>;
-    authEnabled: z.ZodDefault<z.ZodBoolean>;
-    adapter: z.ZodLiteral<"verdaccio-doks">;
-}, z.core.$strip>]>;
+/** What a release writes with: the credential's Secrets key, the account's second factor, and an exact-bytes source. */
+export declare const PackageRegistryPublishSchema: z.ZodObject<{
+    credential: z.ZodObject<{
+        secret: z.ZodString;
+    }, z.core.$strict>;
+    secondFactor: z.ZodDefault<z.ZodEnum<{
+        web: "web";
+        none: "none";
+        otp: "otp";
+    }>>;
+    mirrorOf: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type PackageRegistryPublish = z.infer<typeof PackageRegistryPublishSchema>;
+/** Open adapter config: the adapter package that owns `adapter` validates the rest. */
+export declare const PackageRegistryConfigSchema: z.ZodObject<{
+    adapter: z.ZodString;
+}, z.core.$loose>;
 export declare const PackageRegistryDescriptorSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodOptional<z.ZodString>;
@@ -45,10 +55,21 @@ export declare const PackageRegistryDescriptorSchema: z.ZodObject<{
     hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
     enabled: z.ZodOptional<z.ZodBoolean>;
     priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
     requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
     optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
     kind: z.ZodLiteral<"infra/package-registry">;
-    url: z.ZodString;
+    url: z.ZodOptional<z.ZodString>;
+    service: z.ZodOptional<z.ZodString>;
     registryType: z.ZodDefault<z.ZodEnum<{
         npm: "npm";
         docker: "docker";
@@ -67,23 +88,108 @@ export declare const PackageRegistryDescriptorSchema: z.ZodObject<{
         secret: z.ZodOptional<z.ZodBoolean>;
         description: z.ZodOptional<z.ZodString>;
         storeKey: z.ZodOptional<z.ZodString>;
+        storeBinding: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
-    config: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
-        dockerImage: z.ZodDefault<z.ZodString>;
-        storageSize: z.ZodDefault<z.ZodString>;
-        domain: z.ZodString;
-        upstreamNpmUrl: z.ZodDefault<z.ZodString>;
-        authEnabled: z.ZodDefault<z.ZodBoolean>;
-        adapter: z.ZodLiteral<"verdaccio-doks">;
-    }, z.core.$strip>]>>;
+    publish: z.ZodOptional<z.ZodObject<{
+        credential: z.ZodObject<{
+            secret: z.ZodString;
+        }, z.core.$strict>;
+        secondFactor: z.ZodDefault<z.ZodEnum<{
+            web: "web";
+            none: "none";
+            otp: "otp";
+        }>>;
+        mirrorOf: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    config: z.ZodOptional<z.ZodObject<{
+        adapter: z.ZodString;
+    }, z.core.$loose>>;
 }, z.core.$strip>;
 export type PackageRegistryDescriptor = z.infer<typeof PackageRegistryDescriptorSchema>;
-declare class DefaultPackageRegistryImplementation {
-    readonly descriptor: RuntimeDescriptor;
-    readonly context: unknown;
-    constructor(descriptor: RuntimeDescriptor, context: unknown);
-    get config(): PackageRegistryDescriptor;
+/** One released version as a registry serves it. */
+export type PackageRegistryRelease = {
+    version: string;
+    integrity: string;
+};
+/** What reading a package's release tag found. */
+export type PackageRegistryReleaseRead = {
+    state: 'released';
+    release: PackageRegistryRelease;
+}
+/** The registry does not serve the package to this reader. */
+ | {
+    state: 'absent';
+} | {
+    state: 'untagged';
+};
+/** Every release tag a registry serves for one package. */
+export type PackageRegistryReleasesRead = {
+    state: 'released';
+    tags: Record<string, PackageRegistryRelease>;
+}
+/** The registry does not serve the package to this reader. */
+ | {
+    state: 'absent';
+};
+/** The second factor a write answers with, as the descriptor's `publish.secondFactor` asks. */
+export type PackageRegistrySecondFactor = {
+    kind: 'otp';
+    code: string;
+}
+/**
+ * `announce` shows the approval URL to the account owner; the write waits for the approval.
+ * With `retryOnTimeout`, an approval that expires unanswered is asked for again.
+ */
+ | {
+    kind: 'web';
+    announce: (authUrl: string) => void | Promise<void>;
+    retryOnTimeout?: boolean;
+};
+/** Exact package bytes to write, with the digests the source recorded for them. */
+export type PackageRegistryPublishInput = {
+    bytes: Uint8Array;
+    tag: string;
+    access?: 'public' | 'restricted';
+    dist: {
+        integrity: string;
+        shasum: string;
+    };
+    secondFactor?: PackageRegistrySecondFactor;
+};
+/** The release contract every `infra/package-registry` implementation answers. */
+export interface PackageRegistryImplementation {
+    readonly config: PackageRegistryDescriptor;
+    /** The same registry reading its credential from another Secrets environment. */
+    forEnvironment(environment: string): PackageRegistryImplementation;
+    /** The registry origin: `url`, or the named service's configured primary origin. */
+    origin(): Promise<string>;
+    /** The version on `tag`, read as an anonymous caller when `anonymous` (what the public is served). */
+    readRelease(name: string, tag: string, options?: {
+        anonymous?: boolean;
+    }): Promise<PackageRegistryReleaseRead>;
+    /** Every release tag of `name`, read as an anonymous caller when `anonymous`. */
+    readReleases(name: string, options?: {
+        anonymous?: boolean;
+    }): Promise<PackageRegistryReleasesRead>;
+    /** The package's current dist-tags (tag → version); empty when the registry holds no such package. */
+    distTags(name: string): Promise<Record<string, string>>;
+    /** Points `tag` at an existing `version`, answered with the second factor the descriptor asks for. */
+    setTag(input: {
+        name: string;
+        tag: string;
+        version: string;
+        secondFactor?: PackageRegistrySecondFactor;
+    }): Promise<void>;
+    /** The integrity this registry records for `name@version`, or `undefined` when it holds no such version. */
+    versionIntegrity(name: string, version: string): Promise<string | undefined>;
+    /** The bytes of `name@version`, refused unless they match `integrity`. */
+    tarball(name: string, version: string, integrity: string): Promise<Uint8Array>;
+    /** Writes exactly `input.bytes` and returns once the registry accepts them (serving them may lag). */
+    publish(input: PackageRegistryPublishInput): Promise<{
+        name: string;
+        version: string;
+        integrity: string;
+    }>;
 }
-export declare const packageRegistryKind: RuntimeKindDescriptorRecord<DefaultPackageRegistryImplementation>;
-export {};
+export declare const packageRegistryKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<PackageRegistryImplementation>;
 //# sourceMappingURL=package-registry.kind.d.ts.map