@vibesdotdev/infra-core 0.0.2 → 1.0.0-rc.4

package/dist/kinds/service-release.kind.js

@@ -0,0 +1,676 @@
+/**
+ * Kind: infra/service-release
+ *
+ * A provider-neutral release unit for one public stateless gateway backed by
+ * one private, durable service. Provider adapters project this contract into
+ * their native workload, service, storage, and network-policy resources.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
+import { CredentialReferenceSchema } from "./object-storage.kind.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
+const DnsLabelSchema = z
+    .string()
+    .min(1)
+    .max(63)
+    .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/, 'must be a DNS label');
+const ImageReferenceSchema = z
+    .string()
+    .min(1)
+    .regex(/@sha256:[a-f0-9]{64}$/, 'image must be pinned by a 64-character sha256 digest');
+const RevisionSchema = z
+    .string()
+    .min(1)
+    .max(63)
+    .regex(/^[A-Za-z0-9](?:[A-Za-z0-9_.-]*[A-Za-z0-9])?$/, 'must be a Kubernetes label value');
+const CronScheduleSchema = z
+    .string()
+    .regex(/^(?:\S+\s+){4}\S+$/, 'must be a five-field cron schedule');
+const StorageQuantitySchema = z.string().regex(/^\d+(?:Mi|Gi|Ti)$/);
+/**
+ * A storage quantity in MiB, or `undefined` for one its own field already refused:
+ * a refinement runs on fields that failed their checks, so it never throws.
+ */
+function storageQuantityMi(value) {
+    const match = value.match(/^(\d+)(Mi|Gi|Ti)$/);
+    if (!match)
+        return undefined;
+    const amount = Number(match[1]);
+    return amount * (match[2] === 'Ti' ? 1024 * 1024 : match[2] === 'Gi' ? 1024 : 1);
+}
+/**
+ * The parts of a URL, or `undefined` for text that is not one. Zod runs a
+ * refinement even when the field's own `url()` check failed, so every URL read
+ * inside a refinement goes through here and never throws out of `safeParse`.
+ */
+function urlOf(value) {
+    return URL.canParse(value) ? new URL(value) : undefined;
+}
+const BoundedIpv4CidrSchema = z.string().refine((value) => {
+    const match = value.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d|[12]\d|3[0-2])$/);
+    if (!match)
+        return false;
+    const octets = match.slice(1, 5).map(Number);
+    const prefix = Number(match[5]);
+    if (octets.some((octet) => octet > 255) || prefix < 8)
+        return false;
+    const address = octets.reduce((result, octet) => result * 256 + octet, 0);
+    return address % 2 ** (32 - prefix) === 0;
+}, 'must be a canonical bounded IPv4 CIDR; world-scale prefixes /0 through /7 are forbidden');
+const BoundedIpv4CidrListSchema = z
+    .array(BoundedIpv4CidrSchema)
+    .min(1)
+    .max(64)
+    .refine((cidrs) => new Set(cidrs).size === cidrs.length, 'CIDRs must be unique');
+const EgressHostnameListSchema = z
+    .array(z.string().regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/, 'must be an exact lowercase DNS hostname'))
+    .min(1)
+    .max(8)
+    .refine((hostnames) => new Set(hostnames).size === hostnames.length, 'hostnames must be unique');
+const DnsZoneListSchema = z
+    .array(z.string().regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/, 'must be an exact lowercase DNS zone'))
+    .min(1)
+    .max(8)
+    .refine((zones) => new Set(zones).size === zones.length, 'DNS zones must be unique');
+const SecretStoreKeySchema = z
+    .string()
+    .regex(/^[A-Z][A-Z0-9_]+$/, 'secret-store keys must use the canonical uppercase key form');
+export const ServiceReleaseSecretRefSchema = z.object({
+    name: DnsLabelSchema,
+    key: z.string().min(1)
+});
+export const ServiceReleaseSecretBindingSchema = z.object({
+    source: z.discriminatedUnion('kind', [
+        z.object({ kind: z.literal('secret-store'), key: SecretStoreKeySchema }),
+        z.object({
+            kind: z.literal('repository-file'),
+            path: z
+                .string()
+                .min(1)
+                .refine((path) => !path.startsWith('/') && !path.split('/').includes('..'), 'must be a repository-relative path')
+        })
+    ]),
+    target: ServiceReleaseSecretRefSchema,
+    description: z.string().min(1)
+});
+export const ServiceReleaseSecretBindingsSchema = z
+    .array(ServiceReleaseSecretBindingSchema)
+    .min(1)
+    .refine((bindings) => new Set(bindings.map((binding) => `${binding.target.name}/${binding.target.key}`)).size ===
+    bindings.length, 'each Kubernetes Secret key must have exactly one source binding');
+export const ServiceReleaseEnvSchema = z.discriminatedUnion('source', [
+    z.object({ source: z.literal('literal'), name: z.string().regex(/^[A-Z_][A-Z0-9_]*$/), value: z.string() }),
+    z.object({
+        source: z.literal('secret'),
+        name: z.string().regex(/^[A-Z_][A-Z0-9_]*$/),
+        secretRef: ServiceReleaseSecretRefSchema
+    })
+]).superRefine((entry, ctx) => {
+    if (entry.source === 'literal' &&
+        /(SECRET|TOKEN|PASSWORD|PRIVATE_KEY|API_KEY)/.test(entry.name) &&
+        !/(DIR|PATH|FILE|URL|SCHEME)$/.test(entry.name)) {
+        ctx.addIssue({ code: 'custom', message: 'secret-shaped environment variables must use a secret reference' });
+    }
+});
+export const ServiceReleaseSecretMountSchema = z.object({
+    secretName: DnsLabelSchema,
+    mountPath: z.string().startsWith('/'),
+    /** Secret keys projected as files (each file named by its key). */
+    keys: z.array(z.string().min(1)).optional(),
+    readOnly: z.literal(true).default(true)
+});
+const ContainerResourcesSchema = z.object({
+    requests: z.object({ cpu: z.string().min(1), memory: z.string().min(1) }),
+    limits: z.object({ cpu: z.string().min(1), memory: z.string().min(1) })
+});
+/**
+ * Environment variables owned by the managed gateway topology.
+ * These names are reserved because the gateway container sets them
+ * from its own configuration and host-key authority.
+ */
+const GatewayReservedEnv = new Set([
+    'GITD_ROOT',
+    'GITD_SESSION_URL',
+    'GIT_SSH_GATEWAY_PORT',
+    'VIBES_SSH_HOST_KEY',
+    'VIBES_SSH_HOST_KEY_FILE'
+]);
+export const ServiceReleaseGatewaySchema = z.object({
+    name: DnsLabelSchema,
+    image: ImageReferenceSchema,
+    revision: RevisionSchema,
+    replicas: z.number().int().min(2),
+    port: z.literal(22).default(22),
+    listenPort: z.number().int().min(1024).max(65535).default(2222),
+    /** Public gateway hostname. Must be a valid DNS name / FQDN. */
+    hostname: z.string().regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/, 'must be a valid DNS hostname'),
+    hostKeyAuthority: z.object({
+        publicKey: z.string().regex(/^ssh-ed25519 [A-Za-z0-9+/]+={0,2}(?: [^\r\n]+)?$/),
+        fingerprint: z.string().regex(/^SHA256:[A-Za-z0-9+/]{43}$/),
+        source: z.object({
+            repository: z.string().regex(/^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/),
+            path: z.string().min(1).refine((path) => !path.startsWith('/') && !path.split('/').includes('..'), 'must be a repository-relative path')
+        }),
+        secretRef: z.object({
+            name: DnsLabelSchema,
+            privateKeyKey: z.string().min(1),
+            publicKeyKey: z.string().min(1),
+            mountPath: z.string().startsWith('/')
+        }),
+        provisioning: z.object({
+            owner: z.literal('secret-management'),
+            mode: z.literal('external-preprovisioned')
+        }),
+        rotation: z.object({
+            generation: z.number().int().positive(),
+            strategy: z.literal('preprovisioned-atomic'),
+            previousFingerprint: z.string().regex(/^SHA256:[A-Za-z0-9+/]{43}$/).optional(),
+            knownHostsOverlapUntil: z.string().datetime().optional()
+        }).superRefine((rotation, ctx) => {
+            if (rotation.generation > 1 && (!rotation.previousFingerprint || !rotation.knownHostsOverlapUntil)) {
+                ctx.addIssue({ code: 'custom', message: 'rotations after generation 1 require the prior fingerprint and a known-hosts overlap deadline' });
+            }
+        })
+    }),
+    env: z.array(ServiceReleaseEnvSchema).default([]),
+    secretMounts: z.array(ServiceReleaseSecretMountSchema).default([]),
+    resources: ContainerResourcesSchema,
+    maxUnavailable: z.literal(0).default(0),
+    maxSurge: z.number().int().positive().default(1)
+}).superRefine((gateway, ctx) => {
+    for (const [index, env] of gateway.env.entries()) {
+        if (GatewayReservedEnv.has(env.name)) {
+            ctx.addIssue({ code: 'custom', path: ['env', index, 'name'], message: `${env.name} is owned by the managed gateway topology` });
+        }
+    }
+});
+export const ServiceReleaseControlPlaneRouterSchema = z.object({
+    image: ImageReferenceSchema,
+    revision: RevisionSchema,
+    publicPort: z.literal(443),
+    listenPort: z.number().int().min(1024).max(65535).default(8443),
+    tlsSecretRef: z.object({
+        name: DnsLabelSchema,
+        certificateKey: z.string().min(1).default('tls.crt'),
+        privateKeyKey: z.string().min(1).default('tls.key')
+    }),
+    smartGit: z.object({
+        enabled: z.literal(true),
+        authorizationOwner: z.literal('stateful'),
+        pathContract: z.literal('owner/repo.git')
+    }).default({ enabled: true, authorizationOwner: 'stateful', pathContract: 'owner/repo.git' }),
+    allowedPathPrefixes: z
+        .array(z
+        .string()
+        .regex(/^\/(?:[^/]+\/)*$/, 'must start and end with / and contain no .. segments')
+        .refine((prefix) => prefix !== '/', 'admin path prefixes must name a bounded subtree, never the root')
+        .refine((prefix) => !prefix.split('/').some((segment) => segment === '.' || segment === '..'), 'admin path prefixes must not contain . or .. segments'))
+        .min(1)
+        .max(8)
+        .refine((prefixes) => new Set(prefixes).size === prefixes.length, 'path prefixes must be unique'),
+    /**
+     * When true, the router proxies repo-scoped browse requests to the stateful
+     * service. The caller must declare this explicitly if the router plane offers
+     * it; the default is true because a service release normally serves browse.
+     */
+    proxyRepoBrowse: z.boolean().default(true),
+    /**
+     * When true, the router proxies repo-scoped merge-control requests to the
+     * stateful service. The caller must declare this explicitly if the router
+     * plane offers it; the default is true because a service release normally
+     * serves merge control.
+     */
+    proxyMergeControl: z.boolean().default(true),
+    /**
+     * Destination URL for requests that match no declared route. When set, the
+     * router redirects unmatched requests here (e.g. a human-facing UI). Omit to
+     * respond 404. Must be a valid, credential-free URL.
+     */
+    fallbackRedirect: z.url().optional(),
+    resources: ContainerResourcesSchema
+});
+export const ServiceReleaseRepositoryMigrationSchema = z.object({
+    mode: z.literal('mirror-ssh'),
+    migrationId: z.string().min(1).max(63).regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/),
+    source: z.object({
+        origin: z.url().refine((value) => {
+            const parsed = urlOf(value);
+            return parsed !== undefined && parsed.protocol === 'ssh:' && parsed.username === 'git' && !parsed.password &&
+                (!parsed.port || parsed.port === '22') &&
+                parsed.pathname === '/' && !parsed.search && !parsed.hash;
+        }, 'migration source must be a credential-free SSH origin with the git user and no port or port 22'),
+        inventoryUrl: z.url().refine((value) => {
+            const parsed = urlOf(value);
+            return parsed !== undefined && parsed.protocol === 'https:' && !parsed.port &&
+                parsed.pathname === '/api/internal/repositories/migration-inventory' &&
+                !parsed.username && !parsed.password && !parsed.search && !parsed.hash;
+        }, 'migration inventory must be a credential-free HTTPS URL with the exact path contract'),
+        sshLeaseUrl: z.url().refine((value) => {
+            const parsed = urlOf(value);
+            return parsed !== undefined && parsed.protocol === 'https:' && !parsed.port &&
+                !parsed.username && !parsed.password &&
+                parsed.pathname === '/api/internal/forge-migrations/ssh-leases' &&
+                !parsed.search && !parsed.hash;
+        }, 'migration SSH lease URL must be a credential-free HTTPS URL with the exact path contract'),
+        inventoryAuthoritySecretRef: ServiceReleaseSecretRefSchema
+    }).superRefine((source, ctx) => {
+        const inventory = urlOf(source.inventoryUrl);
+        const lease = urlOf(source.sshLeaseUrl);
+        if (inventory !== undefined && lease !== undefined && inventory.origin !== lease.origin) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['sshLeaseUrl'],
+                message: 'migration inventory and SSH lease must share one credential-free authority origin'
+            });
+        }
+    }),
+    expected: z.object({
+        repositoryCount: z.number().int().positive().max(10_000),
+        owners: z.array(z.object({
+            ownerType: z.enum(['user', 'organization']),
+            ownerId: z.string().min(1).max(128),
+            repositoryCount: z.number().int().positive()
+        })).min(1).max(128)
+    }).superRefine((expected, ctx) => {
+        const ownerKeys = expected.owners.map((owner) => `${owner.ownerType}:${owner.ownerId}`);
+        if (new Set(ownerKeys).size !== ownerKeys.length) {
+            ctx.addIssue({ code: 'custom', path: ['owners'], message: 'migration owner scopes must be unique' });
+        }
+        if (expected.owners.reduce((sum, owner) => sum + owner.repositoryCount, 0) !== expected.repositoryCount) {
+            ctx.addIssue({ code: 'custom', path: ['owners'], message: 'migration owner counts must sum to the exact repository count' });
+        }
+    }),
+    receipt: z.object({ configMapName: DnsLabelSchema }),
+    convergence: z.object({ stablePasses: z.literal(2) }),
+    rollback: z.object({ mode: z.literal('source-authoritative-until-public-cutover') })
+});
+export const ServiceReleaseStatefulSchema = z.object({
+    name: DnsLabelSchema,
+    exposure: z.literal('internal').default('internal'),
+    adminExposure: z.literal('internal').default('internal'),
+    image: ImageReferenceSchema,
+    revision: RevisionSchema,
+    replicas: z.literal(1),
+    port: z.number().int().min(1).max(65535),
+    storage: z.object({
+        mountPath: z.string().startsWith('/'),
+        size: z.string().regex(/^\d+(?:Mi|Gi|Ti)$/),
+        accessMode: z.literal('ReadWriteOnce'),
+        storageClassName: z.string().min(1).optional(),
+        schemaVersion: z.number().int().positive(),
+        releaseCompatibility: z.object({
+            readFrom: z.number().int().positive(),
+            readThrough: z.number().int().positive(),
+            writeVersion: z.number().int().positive()
+        })
+    }),
+    backup: z.discriminatedUnion('mode', [z.object({
+            mode: z.literal('restic-s3'),
+            toolImage: ImageReferenceSchema,
+            repository: z.string().startsWith('s3:https://').refine((value) => {
+                const url = urlOf(value.slice(3));
+                return url !== undefined && !url.username && !url.password && url.pathname.length > 1;
+            }, 'must be a credential-free S3-compatible restic repository URL'),
+            credentials: z.object({
+                accessKeyId: CredentialReferenceSchema,
+                secretAccessKey: CredentialReferenceSchema,
+                encryptionKey: CredentialReferenceSchema
+            }),
+            schedule: CronScheduleSchema,
+            retention: z.object({
+                keepDaily: z.number().int().positive(),
+                keepWeekly: z.number().int().positive(),
+                keepMonthly: z.number().int().positive()
+            }),
+            restoreVerify: z.object({
+                schedule: CronScheduleSchema,
+                scratchSize: z.string().regex(/^\d+(?:Mi|Gi|Ti)$/),
+                timeoutSeconds: z.number().int().positive().max(86400)
+            })
+        }).superRefine((backup, ctx) => {
+            for (const [name, ref] of Object.entries(backup.credentials)) {
+                if (!ref.store)
+                    ctx.addIssue({ code: 'custom', path: ['credentials', name], message: 'DOKS backup CredentialReferences require a preprovisioned Kubernetes Secret store name' });
+            }
+        }), z.object({
+            mode: z.literal('csi-volume-snapshot'),
+            toolImage: ImageReferenceSchema,
+            snapshotClassName: DnsLabelSchema,
+            deletionPolicy: z.literal('Delete'),
+            schedule: CronScheduleSchema,
+            retention: z.object({
+                verifiedGenerations: z.number().int().min(2)
+            }),
+            restoreVerify: z.object({
+                schedule: CronScheduleSchema,
+                scratchSize: z.string().regex(/^\d+(?:Mi|Gi|Ti)$/),
+                timeoutSeconds: z.number().int().positive().max(86400)
+            })
+        })]),
+    repositoryMigration: ServiceReleaseRepositoryMigrationSchema.optional(),
+    env: z.array(ServiceReleaseEnvSchema).default([]),
+    secretMounts: z.array(ServiceReleaseSecretMountSchema).default([]),
+    resources: ContainerResourcesSchema
+}).superRefine((stateful, ctx) => {
+    const reserved = new Set(['GITD_HOST', 'GITD_PORT', 'GITD_ROOT']);
+    for (const [index, env] of stateful.env.entries()) {
+        if (reserved.has(env.name)) {
+            ctx.addIssue({ code: 'custom', path: ['env', index, 'name'], message: `${env.name} is owned by the managed stateful topology` });
+        }
+    }
+});
+export const ServiceReleaseNetworkPolicySchema = z.object({
+    defaultDenyIngress: z.literal(true),
+    allowGatewayToStateful: z.literal(true),
+    egress: z.object({
+        defaultDeny: z.literal(true),
+        platformAuthCidrs: BoundedIpv4CidrListSchema,
+        objectBackupCidrs: BoundedIpv4CidrListSchema.optional(),
+        objectBackupHostnames: EgressHostnameListSchema.optional()
+    }).superRefine((egress, ctx) => {
+        if (Boolean(egress.objectBackupCidrs) && Boolean(egress.objectBackupHostnames)) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'object backup egress may declare only one of bounded CIDRs or Cilium FQDN hostnames'
+            });
+        }
+    })
+});
+/**
+ * The provider-neutral shape of a release target: an adapter id plus whatever
+ * that adapter's own integration package validates once it resolves the target.
+ */
+export const ServiceReleaseTargetSchema = z.looseObject({ adapter: z.string().min(1) });
+export const ServiceReleaseNamespaceQuotaSchema = z.object({
+    name: DnsLabelSchema,
+    hard: z.object({
+        'limits.cpu': z.string().regex(/^\d+(?:m)?$/),
+        'limits.memory': StorageQuantitySchema,
+        persistentvolumeclaims: z.string().regex(/^\d+$/),
+        pods: z.string().regex(/^\d+$/),
+        'requests.cpu': z.string().regex(/^\d+(?:m)?$/),
+        'requests.memory': StorageQuantitySchema,
+        'requests.storage': StorageQuantitySchema
+    })
+});
+export const ServiceReleaseBackupStorageSchema = z.object({
+    adapter: z.literal('s3-compatible'),
+    authority: z.object({
+        provider: z.string().min(1),
+        name: z.string().regex(/^[a-z0-9][a-z0-9.-]{1,62}[a-z0-9]$/, 'must be a stable object-storage key name'),
+        requiredControlPlaneScopes: z.array(z.string().min(1)).min(1)
+    }),
+    bucket: z.string()
+        .min(3)
+        .max(63)
+        .regex(/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])$/, 'must be a lowercase S3-compatible bucket name')
+        .refine((value) => !/^\d{1,3}(?:\.\d{1,3}){3}$/.test(value), 'must not be formatted as an IP address'),
+    region: z.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/, 'must be a source-owned S3-compatible region'),
+    endpoint: z.url().refine((value) => {
+        const parsed = urlOf(value);
+        return parsed !== undefined && parsed.protocol === 'https:' &&
+            !parsed.username &&
+            !parsed.password &&
+            parsed.pathname === '/' &&
+            !parsed.search &&
+            !parsed.hash;
+    }, 'must be a credential-free HTTPS origin'),
+    forcePathStyle: z.literal(true),
+    versioning: z.literal('Enabled'),
+    publicAccess: z.literal('private')
+});
+/** The release config: an open adapter object plus the provider-neutral parts this kind checks across fields. */
+export const ServiceReleaseConfigSchema = ServiceReleaseTargetSchema.extend({
+    dnsOwnerRef: z.string().regex(/^infra\/dns:[a-z0-9.-]+$/),
+    namespaceQuota: ServiceReleaseNamespaceQuotaSchema.optional(),
+    backupStorage: ServiceReleaseBackupStorageSchema.optional(),
+    certificate: z.object({
+        manager: z.literal('cert-manager'),
+        issuerRef: z.object({
+            kind: z.union([z.literal('ClusterIssuer'), z.literal('Issuer')]),
+            name: DnsLabelSchema
+        }),
+        provisioning: z.object({
+            owner: z.literal('service-release'),
+            mode: z.literal('namespace-acme-dns01'),
+            server: z.url().refine((value) => {
+                const parsed = urlOf(value);
+                return parsed !== undefined && parsed.protocol === 'https:' && !parsed.username && !parsed.password;
+            }, 'ACME server must be a credential-free HTTPS URL'),
+            email: z.email(),
+            privateKeySecretRef: z.object({ name: DnsLabelSchema }),
+            solver: z.object({
+                provider: z.string().min(1),
+                dnsZones: DnsZoneListSchema,
+                apiToken: z.object({
+                    environment: z.literal('local'),
+                    sourceKeys: z.array(SecretStoreKeySchema).min(1).max(4)
+                        .refine((keys) => new Set(keys).size === keys.length, 'certificate solver source keys must be unique'),
+                    target: z.object({ name: DnsLabelSchema, key: z.string().min(1) })
+                })
+            })
+        }).optional(),
+        duration: z.literal('2160h').default('2160h'),
+        renewBefore: z.literal('360h').default('360h'),
+        privateKey: z.object({
+            algorithm: z.literal('ECDSA').default('ECDSA'),
+            size: z.literal(256).default(256),
+            rotationPolicy: z.literal('Always').default('Always')
+        }).default({ algorithm: 'ECDSA', size: 256, rotationPolicy: 'Always' })
+    }).optional()
+});
+export const ServiceReleaseDescriptorSchema = RuntimeDescriptorSchema.extend({
+    id: DnsLabelSchema,
+    kind: z.literal('infra/service-release'),
+    namespace: DnsLabelSchema,
+    gateway: ServiceReleaseGatewaySchema,
+    controlPlaneRouter: ServiceReleaseControlPlaneRouterSchema,
+    stateful: ServiceReleaseStatefulSchema,
+    secretBindings: ServiceReleaseSecretBindingsSchema,
+    networkPolicy: ServiceReleaseNetworkPolicySchema,
+    config: ServiceReleaseConfigSchema
+}).superRefine((descriptor, ctx) => {
+    if (descriptor.gateway.name === descriptor.stateful.name) {
+        ctx.addIssue({ code: 'custom', message: 'gateway and stateful workload names must differ' });
+    }
+    if (descriptor.gateway.listenPort === descriptor.controlPlaneRouter.listenPort) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['controlPlaneRouter', 'listenPort'],
+            message: 'SSH and HTTPS listeners share one pod network and must use different ports'
+        });
+    }
+    const compatibility = descriptor.stateful.storage.releaseCompatibility;
+    const schemaVersion = descriptor.stateful.storage.schemaVersion;
+    if (compatibility.readFrom > schemaVersion || compatibility.readThrough < schemaVersion) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['stateful', 'storage', 'releaseCompatibility'],
+            message: 'the release must be able to read the declared PVC schema version'
+        });
+    }
+    if (compatibility.writeVersion !== schemaVersion) {
+        ctx.addIssue({ code: 'custom', path: ['stateful', 'storage', 'releaseCompatibility', 'writeVersion'], message: 'service-release does not perform storage migrations; writeVersion must equal the declared PVC schema version' });
+    }
+    if (descriptor.config.dnsOwnerRef !== `infra/dns:${descriptor.gateway.hostname}`) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['config', 'dnsOwnerRef'],
+            message: 'DNS owner reference must exactly name the public gateway hostname'
+        });
+    }
+    const namespaceQuota = descriptor.config.namespaceQuota;
+    if (namespaceQuota) {
+        const primaryMi = storageQuantityMi(descriptor.stateful.storage.size);
+        const scratchMi = storageQuantityMi(descriptor.stateful.backup.restoreVerify.scratchSize);
+        const declaredMi = storageQuantityMi(namespaceQuota.hard['requests.storage']);
+        // A quantity its own field refused is already an issue; the budget is checked only over readable ones.
+        if (primaryMi !== undefined && scratchMi !== undefined && declaredMi !== undefined && declaredMi < primaryMi * 2 + scratchMi) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['config', 'namespaceQuota', 'hard', 'requests.storage'],
+                message: 'namespace storage quota must fit the primary, verified restore scratch, and one emergency replacement claim'
+            });
+        }
+    }
+    const certificate = descriptor.config.certificate;
+    if (certificate?.issuerRef.kind === 'Issuer' && !certificate.provisioning) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['config', 'certificate', 'provisioning'],
+            message: 'a namespace Issuer requires source-owned service-release provisioning'
+        });
+    }
+    if (certificate?.issuerRef.kind === 'ClusterIssuer' && certificate.provisioning) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['config', 'certificate', 'provisioning'],
+            message: 'service-release certificate authority provisioning is namespace-scoped and cannot own a ClusterIssuer'
+        });
+    }
+    if (certificate?.provisioning &&
+        !certificate.provisioning.solver.dnsZones.some((zone) => descriptor.gateway.hostname === zone || descriptor.gateway.hostname.endsWith(`.${zone}`))) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['config', 'certificate', 'provisioning', 'solver', 'dnsZones'],
+            message: 'certificate solver DNS zones must own the public gateway hostname'
+        });
+    }
+    if (descriptor.config.backupStorage) {
+        const storage = descriptor.config.backupStorage;
+        if (descriptor.stateful.backup.mode !== 'restic-s3') {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['config', 'backupStorage'],
+                message: 'S3 backup storage may be bound only to a restic-s3 backup'
+            });
+        }
+        else {
+            const endpoint = urlOf(storage.endpoint);
+            const expectedPrefix = endpoint === undefined ? undefined : `s3:${endpoint.origin}/${storage.bucket}/`;
+            if (expectedPrefix !== undefined && !descriptor.stateful.backup.repository.startsWith(expectedPrefix)) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: ['stateful', 'backup', 'repository'],
+                    message: `backup repository must live below declared storage ${expectedPrefix}`
+                });
+            }
+            const allowedHostnames = descriptor.networkPolicy.egress.objectBackupHostnames;
+            if (endpoint !== undefined && allowedHostnames && !allowedHostnames.includes(endpoint.hostname)) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: ['networkPolicy', 'egress', 'objectBackupHostnames'],
+                    message: `backup storage endpoint hostname ${endpoint.hostname} must be explicitly allowed`
+                });
+            }
+        }
+    }
+    const hasObjectBackupEgress = Boolean(descriptor.networkPolicy.egress.objectBackupCidrs ||
+        descriptor.networkPolicy.egress.objectBackupHostnames);
+    if (descriptor.stateful.backup.mode === 'restic-s3' && !hasObjectBackupEgress) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['networkPolicy', 'egress'],
+            message: 'restic-s3 backup requires bounded object-backup egress'
+        });
+    }
+    if (descriptor.stateful.backup.mode === 'csi-volume-snapshot' && hasObjectBackupEgress) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['networkPolicy', 'egress'],
+            message: 'CSI snapshot backup must not retain object-backup egress'
+        });
+    }
+    if (descriptor.stateful.backup.mode === 'csi-volume-snapshot' &&
+        !descriptor.stateful.storage.storageClassName) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['stateful', 'storage', 'storageClassName'],
+            message: 'CSI snapshot restore verification requires an explicit storage class'
+        });
+    }
+    const repositoryMigration = descriptor.stateful.repositoryMigration;
+    if (repositoryMigration && urlOf(repositoryMigration.source.origin)?.hostname !== descriptor.gateway.hostname) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['stateful', 'repositoryMigration', 'source', 'origin'],
+            message: 'repository migration source must be the declared public gateway hostname'
+        });
+    }
+    const targetKey = (name, key) => `${name}/${key}`;
+    const requiredTargets = new Set();
+    const publicFileTargets = new Set();
+    const hostSecret = descriptor.gateway.hostKeyAuthority.secretRef;
+    requiredTargets.add(targetKey(hostSecret.name, hostSecret.privateKeyKey));
+    requiredTargets.add(targetKey(hostSecret.name, hostSecret.publicKeyKey));
+    publicFileTargets.add(targetKey(hostSecret.name, hostSecret.publicKeyKey));
+    const routerSecret = descriptor.controlPlaneRouter.tlsSecretRef;
+    if (!descriptor.config.certificate) {
+        requiredTargets.add(targetKey(routerSecret.name, routerSecret.certificateKey));
+        requiredTargets.add(targetKey(routerSecret.name, routerSecret.privateKeyKey));
+        publicFileTargets.add(targetKey(routerSecret.name, routerSecret.certificateKey));
+    }
+    for (const env of [...descriptor.gateway.env, ...descriptor.stateful.env]) {
+        if (env.source === 'secret')
+            requiredTargets.add(targetKey(env.secretRef.name, env.secretRef.key));
+    }
+    for (const mount of [...descriptor.gateway.secretMounts, ...descriptor.stateful.secretMounts]) {
+        for (const key of mount.keys ?? [])
+            requiredTargets.add(targetKey(mount.secretName, key));
+    }
+    if (descriptor.stateful.backup.mode === 'restic-s3') {
+        for (const credential of Object.values(descriptor.stateful.backup.credentials)) {
+            requiredTargets.add(targetKey(credential.store, credential.key));
+        }
+    }
+    if (repositoryMigration) {
+        requiredTargets.add(targetKey(repositoryMigration.source.inventoryAuthoritySecretRef.name, repositoryMigration.source.inventoryAuthoritySecretRef.key));
+    }
+    const boundTargets = new Set(descriptor.secretBindings.map((binding) => targetKey(binding.target.name, binding.target.key)));
+    for (const required of requiredTargets) {
+        if (!boundTargets.has(required)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['secretBindings'],
+                message: `missing source binding for Kubernetes Secret key ${required}`
+            });
+        }
+    }
+    for (const [index, binding] of descriptor.secretBindings.entries()) {
+        const target = targetKey(binding.target.name, binding.target.key);
+        if (!requiredTargets.has(target)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['secretBindings', index, 'target'],
+                message: `binding target ${target} is not consumed by this service release`
+            });
+        }
+        if (binding.source.kind === 'repository-file' && !publicFileTargets.has(target)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['secretBindings', index, 'source'],
+                message: 'repository files may source only public host-key or TLS-certificate material'
+            });
+        }
+    }
+});
+class DefaultServiceReleaseImplementation {
+    descriptor;
+    context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
+    constructor(descriptor, context) {
+        this.descriptor = descriptor;
+        this.context = context;
+        this.config = readKindDescriptor(ServiceReleaseDescriptorSchema, descriptor);
+    }
+}
+export const serviceReleaseKind = createRuntimeKind({
+    id: 'infra/service-release',
+    descriptorSchema: ServiceReleaseDescriptorSchema,
+    defaultImplementation: DefaultServiceReleaseImplementation,
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
+});
+//# sourceMappingURL=service-release.kind.js.map