@vibesdotdev/infra-core 0.0.2 → 1.0.0-rc.5

package/dist/kinds/observability.kind.d.ts

@@ -7,15 +7,16 @@
  *
  *   1. The CLI can introspect + write settings across the entire fleet
  *      without going through deploy.
- *   2. Cross-cutting policies (e.g. "10% sampling on every customer-facing
- *      Worker") have a single declarative shape.
+ *   2. Cross-cutting policies (e.g. "full log capture on every Worker")
+ *      have a single declarative shape.
  *   3. Provider impls map onto the native control plane (CF Workers
  *      Observability, DO Monitoring, Datadog, etc.).
  *
  * CLI surface (`vibes infra observability …`):
  *   status [--worker]                      read current settings
- *   set    [--worker] --sampling 0.1       write new settings
- *   exports list|add|remove                (Phase 2.5; not yet wired)
+ *   set    [--worker] --sampling 1         write new settings
+ *   exports list                         read safe export inventory
+ *   exports add|remove                   (not yet wired)
  *
  * Production Workers consume settings via their wrangler.jsonc; the CLI
  * writes directly to the provider API for immediate effect. To avoid
@@ -23,6 +24,7 @@
  * path — the CLI here is for ops-time tuning between deploys.
  */
 import * as z from 'zod/v4';
+import { type InfraAuthorityFingerprint, type InfraProviderFailure } from './inventory.kind.ts';
 declare const ObservabilityScopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"worker">;
     workerName: z.ZodString;
@@ -72,6 +74,33 @@ declare const ObservabilitySettingsSchema: z.ZodObject<{
     }, z.core.$strip>], "kind">>>;
 }, z.core.$strip>;
 export type ObservabilitySettings = z.infer<typeof ObservabilitySettingsSchema>;
+/**
+ * Provider-neutral queue health evidence collected from an adapter's live
+ * control plane. `oldestMessageAgeMs` is an age, rather than a provider
+ * timestamp, so consumers can compare it directly to a declared retention
+ * window.
+ */
+export declare const QueueBacklogSchema: z.ZodObject<{
+    queueName: z.ZodString;
+    backlogCount: z.ZodNumber;
+    backlogBytes: z.ZodNumber;
+    oldestMessageAgeMs: z.ZodNumber;
+    capturedAt: z.ZodString;
+}, z.core.$strip>;
+export type QueueBacklog = z.infer<typeof QueueBacklogSchema>;
+export interface QueueBacklogAlert {
+    alerting: boolean;
+    thresholdMs: number;
+}
+/**
+ * A queue is alerting only after its oldest message has consumed more than
+ * half of its retention window. Equality is deliberately healthy: the
+ * policy is strictly `age > retention / 2`.
+ */
+export declare function evaluateQueueBacklogAlert(queueBacklog: QueueBacklog, retentionMs: number): QueueBacklogAlert;
+export interface QueueBacklogImplementation {
+    listQueueBacklogs(): Promise<QueueBacklog[]>;
+}
 declare const ObservabilityBaseSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodOptional<z.ZodString>;
@@ -80,9 +109,19 @@ declare const ObservabilityBaseSchema: z.ZodObject<{
     hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
     enabled: z.ZodOptional<z.ZodBoolean>;
     priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
     requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
     optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
     kind: z.ZodLiteral<"infra/observability">;
     adapter: z.ZodString;
     adapterConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -141,7 +180,62 @@ export interface ObservabilitySnapshot {
     settings: ObservabilitySettings;
     /** Last-modified timestamp from the provider, when available. */
     modifiedAt?: string;
+    /** Bounded provider-safe evidence when this worker could not be read. */
+    failure?: InfraProviderFailure;
 }
+/** Public inventory deliberately excludes destination credentials and URL paths. */
+export declare const ObservabilityExportDestinationSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    signal: z.ZodEnum<{
+        unknown: "unknown";
+        logs: "logs";
+        traces: "traces";
+    }>;
+    enabled: z.ZodBoolean;
+    endpointOrigin: z.ZodOptional<z.ZodPipe<z.ZodURL, z.ZodTransform<string, string>>>;
+    transport: z.ZodEnum<{
+        unknown: "unknown";
+        http: "http";
+        https: "https";
+    }>;
+    headerNames: z.ZodArray<z.ZodString>;
+    lastDeliveredAt: z.ZodOptional<z.ZodISODateTime>;
+    lastErrorAt: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ObservabilityExportDestination = z.infer<typeof ObservabilityExportDestinationSchema>;
+export declare const ObservabilityExportInventorySchema: z.ZodObject<{
+    destinations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        signal: z.ZodEnum<{
+            unknown: "unknown";
+            logs: "logs";
+            traces: "traces";
+        }>;
+        enabled: z.ZodBoolean;
+        endpointOrigin: z.ZodOptional<z.ZodPipe<z.ZodURL, z.ZodTransform<string, string>>>;
+        transport: z.ZodEnum<{
+            unknown: "unknown";
+            http: "http";
+            https: "https";
+        }>;
+        headerNames: z.ZodArray<z.ZodString>;
+        lastDeliveredAt: z.ZodOptional<z.ZodISODateTime>;
+        lastErrorAt: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+    workers: z.ZodArray<z.ZodObject<{
+        workerName: z.ZodString;
+        logs: z.ZodArray<z.ZodString>;
+        traces: z.ZodArray<z.ZodString>;
+        failure: z.ZodOptional<z.ZodObject<{
+            code: z.ZodString;
+            message: z.ZodString;
+            retryable: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ObservabilityExportInventory = z.infer<typeof ObservabilityExportInventorySchema>;
 export interface SetObservabilityInput {
     scope: ObservabilityScope;
     settings: ObservabilitySettings;
@@ -164,12 +258,16 @@ export interface SetObservabilityResult {
  * Implementation contract every provider implements.
  */
 export interface ObservabilityImplementation {
+    /** Redacted authority used by the latest provider request, when applicable. */
+    getAuthority?(): Promise<InfraAuthorityFingerprint>;
     /** Read current settings for a scope. account-wide → one snapshot per Worker. */
     getStatus(scope: ObservabilityScope): Promise<ObservabilitySnapshot[]>;
+    /** Read export destinations and worker bindings without proving collector delivery. */
+    listExports?(scope: ObservabilityScope): Promise<ObservabilityExportInventory>;
     /** Apply settings to a scope. Returns per-Worker outcome. */
     set(input: SetObservabilityInput): Promise<SetObservabilityResult>;
 }
-export declare const observabilityKind: import("@vibesdotdev/runtime").RuntimeKindDescriptorRecord<ObservabilityImplementation>;
+export declare const observabilityKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<ObservabilityImplementation>;
 export type InfraObservabilityKind = InfraObservabilityDescriptor;
 export type InfraObservabilityKindInput = InfraObservabilityDescriptorInput;
 export { ObservabilityBaseSchema as InfraObservabilityDescriptorSchema, ObservabilityScopeSchema, ObservabilitySettingsSchema };

package/dist/kinds/observability.kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/observability.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,QAAA,MAAM,wBAAwB;;;;;;2BAU5B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmD/B,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB3B,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACnF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAC;QAAC,KAAK,EAAE,qBAAqB,CAAA;KAAE,CAAC,CAAC;IACpG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC3C,iFAAiF;IACjF,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvE,6DAA6D;IAC7D,GAAG,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACnE;AAED,eAAO,MAAM,iBAAiB,yFAQ5B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAClE,MAAM,MAAM,2BAA2B,GAAG,iCAAiC,CAAC;AAE5E,OAAO,EACN,uBAAuB,IAAI,kCAAkC,EAC7D,wBAAwB,EACxB,2BAA2B,EAC3B,CAAC"}
+{"version":3,"file":"observability.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/observability.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,OAAO,EAEN,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAG7B,QAAA,MAAM,wBAAwB;;;;;;2BAU5B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmD/B,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;;;iBAM7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,MAAM,GACjB,iBAAiB,CAWnB;AAED,MAAM,WAAW,0BAA0B;IAC1C,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;CAC7C;AAED,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB3B,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACnF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,OAAO,CAAC,EAAE,oBAAoB,CAAC;CAC/B;AAED,oFAAoF;AACpF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;iBAc/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAC;QAAC,KAAK,EAAE,qBAAqB,CAAA;KAAE,CAAC,CAAC;IACpG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC3C,+EAA+E;IAC/E,YAAY,CAAC,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACpD,iFAAiF;IACjF,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvE,uFAAuF;IACvF,WAAW,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC/E,6DAA6D;IAC7D,GAAG,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACnE;AAED,eAAO,MAAM,iBAAiB,wFAO5B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAClE,MAAM,MAAM,2BAA2B,GAAG,iCAAiC,CAAC;AAE5E,OAAO,EACN,uBAAuB,IAAI,kCAAkC,EAC7D,wBAAwB,EACxB,2BAA2B,EAC3B,CAAC"}

package/dist/kinds/observability.kind.js

@@ -7,15 +7,16 @@
  *
  *   1. The CLI can introspect + write settings across the entire fleet
  *      without going through deploy.
- *   2. Cross-cutting policies (e.g. "10% sampling on every customer-facing
- *      Worker") have a single declarative shape.
+ *   2. Cross-cutting policies (e.g. "full log capture on every Worker")
+ *      have a single declarative shape.
  *   3. Provider impls map onto the native control plane (CF Workers
  *      Observability, DO Monitoring, Datadog, etc.).
  *
  * CLI surface (`vibes infra observability …`):
  *   status [--worker]                      read current settings
- *   set    [--worker] --sampling 0.1       write new settings
- *   exports list|add|remove                (Phase 2.5; not yet wired)
+ *   set    [--worker] --sampling 1         write new settings
+ *   exports list                         read safe export inventory
+ *   exports add|remove                   (not yet wired)
  *
  * Production Workers consume settings via their wrangler.jsonc; the CLI
  * writes directly to the provider API for immediate effect. To avoid
@@ -23,9 +24,11 @@
  * path — the CLI here is for ops-time tuning between deploys.
  */
 import * as z from 'zod/v4';
-import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
-import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
-import { INFRA_DISCOVERY_PATTERN, extractStem } from "./discovery.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { InfraProviderFailureSchema } from "./inventory.kind.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
 const ObservabilityScopeSchema = z.discriminatedUnion('kind', [
     z.object({
         kind: z.literal('worker'),
@@ -92,6 +95,36 @@ const ObservabilitySettingsSchema = z.object({
     ]))
         .optional()
 });
+/**
+ * Provider-neutral queue health evidence collected from an adapter's live
+ * control plane. `oldestMessageAgeMs` is an age, rather than a provider
+ * timestamp, so consumers can compare it directly to a declared retention
+ * window.
+ */
+export const QueueBacklogSchema = z.object({
+    queueName: z.string().min(1),
+    backlogCount: z.number().int().nonnegative(),
+    backlogBytes: z.number().int().nonnegative(),
+    oldestMessageAgeMs: z.number().int().nonnegative(),
+    capturedAt: z.string().datetime()
+});
+/**
+ * A queue is alerting only after its oldest message has consumed more than
+ * half of its retention window. Equality is deliberately healthy: the
+ * policy is strictly `age > retention / 2`.
+ */
+export function evaluateQueueBacklogAlert(queueBacklog, retentionMs) {
+    if (!Number.isFinite(retentionMs) || retentionMs <= 0) {
+        throw new CapabilityError('Queue backlog retention must be a positive finite number of milliseconds.', 'INVALID_INPUT', {
+            reason: 'queue-backlog-retention-invalid'
+        });
+    }
+    const thresholdMs = retentionMs / 2;
+    return {
+        alerting: queueBacklog.oldestMessageAgeMs > thresholdMs,
+        thresholdMs
+    };
+}
 const ObservabilityBaseSchema = RuntimeDescriptorSchema.extend({
     kind: z.literal('infra/observability'),
     adapter: z.string().min(1),
@@ -110,11 +143,36 @@ const ObservabilityBaseSchema = RuntimeDescriptorSchema.extend({
      */
     settings: ObservabilitySettingsSchema.optional()
 });
+/** Public inventory deliberately excludes destination credentials and URL paths. */
+export const ObservabilityExportDestinationSchema = z.object({
+    id: z.string().min(1),
+    name: z.string(),
+    signal: z.enum(['logs', 'traces', 'unknown']),
+    enabled: z.boolean(),
+    endpointOrigin: z
+        .url({ protocol: /^https?$/ })
+        .transform((value) => new URL(value).origin)
+        .optional(),
+    /** URL scheme only; does not certify an OTLP encoding or collector. */
+    transport: z.enum(['http', 'https', 'unknown']),
+    headerNames: z.array(z.string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/)),
+    lastDeliveredAt: z.iso.datetime().optional(),
+    lastErrorAt: z.iso.datetime().optional()
+});
+export const ObservabilityExportInventorySchema = z.object({
+    destinations: z.array(ObservabilityExportDestinationSchema),
+    workers: z.array(z.object({
+        workerName: z.string().min(1),
+        logs: z.array(z.string()),
+        traces: z.array(z.string()),
+        /** When present, empty lists mean unreadable, not confirmed unconfigured. */
+        failure: InfraProviderFailureSchema.optional()
+    }))
+});
 export const observabilityKind = createRuntimeKind({
     id: 'infra/observability',
     descriptorSchema: ObservabilityBaseSchema,
-    discoveryPattern: INFRA_DISCOVERY_PATTERN,
-    extractStem
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
 });
 export { ObservabilityBaseSchema as InfraObservabilityDescriptorSchema, ObservabilityScopeSchema, ObservabilitySettingsSchema };
 //# sourceMappingURL=observability.kind.js.map

package/dist/kinds/observability.kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability.kind.js","sourceRoot":"","sources":["../../src/kinds/observability.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAC/B,uEAAuE;QACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACF,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC;SACL,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB;;;;WAIG;QACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAClC,wEAAwE;QACxE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,0DAA0D;QAC1D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,QAAQ,EAAE;IACZ,MAAM,EAAE,CAAC;SACP,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC;aACT,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;YAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACrC,CAAC;aACD,QAAQ,EAAE;KACZ,CAAC;SACD,QAAQ,EAAE;IACZ,OAAO,EAAE,CAAC;SACR,KAAK,CACL,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC5B,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;SAC1B,CAAC;QACF,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;YAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;SACnB,CAAC;KACF,CAAC,CACF;SACA,QAAQ,EAAE;CACZ,CAAC,CAAC;AAIH,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC;;;;OAIG;IACH,YAAY,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACxE;;;;OAIG;IACH,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAuCH,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAGhD;IACD,EAAE,EAAE,qBAAqB;IACzB,gBAAgB,EAAE,uBAAuB;IACzC,gBAAgB,EAAE,uBAAuB;IACzC,WAAW;CACX,CAAC,CAAC;AAKH,OAAO,EACN,uBAAuB,IAAI,kCAAkC,EAC7D,wBAAwB,EACxB,2BAA2B,EAC3B,CAAC"}
+{"version":3,"file":"observability.kind.js","sourceRoot":"","sources":["../../src/kinds/observability.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACN,0BAA0B,EAG1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAC/B,uEAAuE;QACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACF,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC;SACL,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB;;;;WAIG;QACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAClC,wEAAwE;QACxE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,0DAA0D;QAC1D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,QAAQ,EAAE;IACZ,MAAM,EAAE,CAAC;SACP,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC;aACT,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;YAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACrC,CAAC;aACD,QAAQ,EAAE;KACZ,CAAC;SACD,QAAQ,EAAE;IACZ,OAAO,EAAE,CAAC;SACR,KAAK,CACL,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC5B,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;SAC1B,CAAC;QACF,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;YAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,CAAC,CAAC,MAAM,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;SACnB,CAAC;KACF,CAAC,CACF;SACA,QAAQ,EAAE;CACZ,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AASH;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,YAA0B,EAC1B,WAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,eAAe,CAAC,2EAA2E,EAAE,eAAe,EAAE;YACvH,MAAM,EAAE,iCAAiC;SACzC,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,GAAG,CAAC,CAAC;IACpC,OAAO;QACN,QAAQ,EAAE,YAAY,CAAC,kBAAkB,GAAG,WAAW;QACvD,WAAW;KACX,CAAC;AACH,CAAC;AAMD,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC;;;;OAIG;IACH,YAAY,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACxE;;;;OAIG;IACH,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAkBH,oFAAoF;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,cAAc,EAAE,CAAC;SACf,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;SAC7B,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;SAC3C,QAAQ,EAAE;IACZ,uEAAuE;IACvE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACvE,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,KAAK,CACf,CAAC,CAAC,MAAM,CAAC;QACR,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,6EAA6E;QAC7E,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;KAC9C,CAAC,CACF;CACD,CAAC,CAAC;AA8BH,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAGhD;IACD,EAAE,EAAE,qBAAqB;IACzB,gBAAgB,EAAE,uBAAuB;IACzC,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC;AAKH,OAAO,EACN,uBAAuB,IAAI,kCAAkC,EAC7D,wBAAwB,EACxB,2BAA2B,EAC3B,CAAC"}

package/dist/kinds/package-registry.kind.d.ts

@@ -11,10 +11,18 @@
  * - Adapter-specific fields (dockerImage, storageSize, domain, …)
  *   live exclusively under `config`. Each adapter package defines its own
  *   concrete schema under its discriminator key.
+ * - `publish` is how a release writes to this registry: the Secrets key that
+ *   holds its credential, the second factor the account asks for, and, for a
+ *   registry that only ever carries another registry's exact bytes, `mirrorOf`.
+ *
+ * Every release surface (`vibes infra npm publish`, `vibes infra npm mirror`,
+ * Forge's `publish:` step) resolves a registry by id through this kind and
+ * calls its implementation ({@link PackageRegistryImplementation}). The adapter
+ * named by `config.adapter` registers that implementation per descriptor id;
+ * a registry with no registered implementation refuses typed
+ * (`package-registry-implementation-missing`), never a silent fallback.
  */
 import * as z from 'zod/v4';
-import type { RuntimeKindDescriptorRecord } from '@vibesdotdev/runtime/schemas/kind';
-import type { RuntimeDescriptor } from '@vibesdotdev/runtime/schemas/descriptor';
 export declare const PackageRegistryTypeSchema: z.ZodEnum<{
     npm: "npm";
     docker: "docker";
@@ -22,21 +30,23 @@ export declare const PackageRegistryTypeSchema: z.ZodEnum<{
     helm: "helm";
 }>;
 export type PackageRegistryType = z.infer<typeof PackageRegistryTypeSchema>;
-export declare const VerdaccioDoksPackageRegistryConfigSchema: z.ZodObject<{
-    dockerImage: z.ZodDefault<z.ZodString>;
-    storageSize: z.ZodDefault<z.ZodString>;
-    domain: z.ZodString;
-    upstreamNpmUrl: z.ZodDefault<z.ZodString>;
-    authEnabled: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-export declare const PackageRegistryConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
-    dockerImage: z.ZodDefault<z.ZodString>;
-    storageSize: z.ZodDefault<z.ZodString>;
-    domain: z.ZodString;
-    upstreamNpmUrl: z.ZodDefault<z.ZodString>;
-    authEnabled: z.ZodDefault<z.ZodBoolean>;
-    adapter: z.ZodLiteral<"verdaccio-doks">;
-}, z.core.$strip>]>;
+/** What a release writes with: the credential's Secrets key, the account's second factor, and an exact-bytes source. */
+export declare const PackageRegistryPublishSchema: z.ZodObject<{
+    credential: z.ZodObject<{
+        secret: z.ZodString;
+    }, z.core.$strict>;
+    secondFactor: z.ZodDefault<z.ZodEnum<{
+        web: "web";
+        none: "none";
+        otp: "otp";
+    }>>;
+    mirrorOf: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type PackageRegistryPublish = z.infer<typeof PackageRegistryPublishSchema>;
+/** Open adapter config: the adapter package that owns `adapter` validates the rest. */
+export declare const PackageRegistryConfigSchema: z.ZodObject<{
+    adapter: z.ZodString;
+}, z.core.$loose>;
 export declare const PackageRegistryDescriptorSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodOptional<z.ZodString>;
@@ -45,10 +55,21 @@ export declare const PackageRegistryDescriptorSchema: z.ZodObject<{
     hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
     enabled: z.ZodOptional<z.ZodBoolean>;
     priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
     requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
     optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
     kind: z.ZodLiteral<"infra/package-registry">;
-    url: z.ZodString;
+    url: z.ZodOptional<z.ZodString>;
+    service: z.ZodOptional<z.ZodString>;
     registryType: z.ZodDefault<z.ZodEnum<{
         npm: "npm";
         docker: "docker";
@@ -67,23 +88,108 @@ export declare const PackageRegistryDescriptorSchema: z.ZodObject<{
         secret: z.ZodOptional<z.ZodBoolean>;
         description: z.ZodOptional<z.ZodString>;
         storeKey: z.ZodOptional<z.ZodString>;
+        storeBinding: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
-    config: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
-        dockerImage: z.ZodDefault<z.ZodString>;
-        storageSize: z.ZodDefault<z.ZodString>;
-        domain: z.ZodString;
-        upstreamNpmUrl: z.ZodDefault<z.ZodString>;
-        authEnabled: z.ZodDefault<z.ZodBoolean>;
-        adapter: z.ZodLiteral<"verdaccio-doks">;
-    }, z.core.$strip>]>>;
+    publish: z.ZodOptional<z.ZodObject<{
+        credential: z.ZodObject<{
+            secret: z.ZodString;
+        }, z.core.$strict>;
+        secondFactor: z.ZodDefault<z.ZodEnum<{
+            web: "web";
+            none: "none";
+            otp: "otp";
+        }>>;
+        mirrorOf: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    config: z.ZodOptional<z.ZodObject<{
+        adapter: z.ZodString;
+    }, z.core.$loose>>;
 }, z.core.$strip>;
 export type PackageRegistryDescriptor = z.infer<typeof PackageRegistryDescriptorSchema>;
-declare class DefaultPackageRegistryImplementation {
-    readonly descriptor: RuntimeDescriptor;
-    readonly context: unknown;
-    constructor(descriptor: RuntimeDescriptor, context: unknown);
-    get config(): PackageRegistryDescriptor;
+/** One released version as a registry serves it. */
+export type PackageRegistryRelease = {
+    version: string;
+    integrity: string;
+};
+/** What reading a package's release tag found. */
+export type PackageRegistryReleaseRead = {
+    state: 'released';
+    release: PackageRegistryRelease;
+}
+/** The registry does not serve the package to this reader. */
+ | {
+    state: 'absent';
+} | {
+    state: 'untagged';
+};
+/** Every release tag a registry serves for one package. */
+export type PackageRegistryReleasesRead = {
+    state: 'released';
+    tags: Record<string, PackageRegistryRelease>;
+}
+/** The registry does not serve the package to this reader. */
+ | {
+    state: 'absent';
+};
+/** The second factor a write answers with, as the descriptor's `publish.secondFactor` asks. */
+export type PackageRegistrySecondFactor = {
+    kind: 'otp';
+    code: string;
+}
+/**
+ * `announce` shows the approval URL to the account owner; the write waits for the approval.
+ * With `retryOnTimeout`, an approval that expires unanswered is asked for again.
+ */
+ | {
+    kind: 'web';
+    announce: (authUrl: string) => void | Promise<void>;
+    retryOnTimeout?: boolean;
+};
+/** Exact package bytes to write, with the digests the source recorded for them. */
+export type PackageRegistryPublishInput = {
+    bytes: Uint8Array;
+    tag: string;
+    access?: 'public' | 'restricted';
+    dist: {
+        integrity: string;
+        shasum: string;
+    };
+    secondFactor?: PackageRegistrySecondFactor;
+};
+/** The release contract every `infra/package-registry` implementation answers. */
+export interface PackageRegistryImplementation {
+    readonly config: PackageRegistryDescriptor;
+    /** The same registry reading its credential from another Secrets environment. */
+    forEnvironment(environment: string): PackageRegistryImplementation;
+    /** The registry origin: `url`, or the named service's configured primary origin. */
+    origin(): Promise<string>;
+    /** The version on `tag`, read as an anonymous caller when `anonymous` (what the public is served). */
+    readRelease(name: string, tag: string, options?: {
+        anonymous?: boolean;
+    }): Promise<PackageRegistryReleaseRead>;
+    /** Every release tag of `name`, read as an anonymous caller when `anonymous`. */
+    readReleases(name: string, options?: {
+        anonymous?: boolean;
+    }): Promise<PackageRegistryReleasesRead>;
+    /** The package's current dist-tags (tag → version); empty when the registry holds no such package. */
+    distTags(name: string): Promise<Record<string, string>>;
+    /** Points `tag` at an existing `version`, answered with the second factor the descriptor asks for. */
+    setTag(input: {
+        name: string;
+        tag: string;
+        version: string;
+        secondFactor?: PackageRegistrySecondFactor;
+    }): Promise<void>;
+    /** The integrity this registry records for `name@version`, or `undefined` when it holds no such version. */
+    versionIntegrity(name: string, version: string): Promise<string | undefined>;
+    /** The bytes of `name@version`, refused unless they match `integrity`. */
+    tarball(name: string, version: string, integrity: string): Promise<Uint8Array>;
+    /** Writes exactly `input.bytes` and returns once the registry accepts them (serving them may lag). */
+    publish(input: PackageRegistryPublishInput): Promise<{
+        name: string;
+        version: string;
+        integrity: string;
+    }>;
 }
-export declare const packageRegistryKind: RuntimeKindDescriptorRecord<DefaultPackageRegistryImplementation>;
-export {};
+export declare const packageRegistryKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<PackageRegistryImplementation>;
 //# sourceMappingURL=package-registry.kind.d.ts.map

package/dist/kinds/package-registry.kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package-registry.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/package-registry.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAErF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAIjF,eAAO,MAAM,yBAAyB;;;;;EAA6C,CAAC;AACpF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AA2B5E,eAAO,MAAM,wCAAwC;;;;;;iBAWnD,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;mBAEtC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAM1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,cAAM,oCAAoC;aAExB,UAAU,EAAE,iBAAiB;aAC7B,OAAO,EAAE,OAAO;gBADhB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,OAAO;IAGjC,IAAI,MAAM,IAAI,yBAAyB,CAEtC;CACD;AAED,eAAO,MAAM,mBAAmB,mEAM9B,CAAC"}
+{"version":3,"file":"package-registry.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/package-registry.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAU5B,eAAO,MAAM,yBAAyB;;;;;EAA6C,CAAC;AACpF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AA8B5E,wHAAwH;AACxH,eAAO,MAAM,4BAA4B;;;;;;;;;;kBAUvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,uFAAuF;AACvF,eAAO,MAAM,2BAA2B;;iBAAgD,CAAC;AAEzF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAU1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,oDAAoD;AACpD,MAAM,MAAM,sBAAsB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,kDAAkD;AAClD,MAAM,MAAM,0BAA0B,GACnC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAA;CAAE;AACxD,8DAA8D;GAC5D;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzB,2DAA2D;AAC3D,MAAM,MAAM,2BAA2B,GACpC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;CAAE;AACrE,8DAA8D;GAC5D;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB,+FAA+F;AAC/F,MAAM,MAAM,2BAA2B,GACpC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC/B;;;GAGG;GACD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAElG,mFAAmF;AACnF,MAAM,MAAM,2BAA2B,GAAG;IACzC,KAAK,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IACjC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,YAAY,CAAC,EAAE,2BAA2B,CAAC;CAC3C,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,iFAAiF;IACjF,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,6BAA6B,CAAC;IACnE,oFAAoF;IACpF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,sGAAsG;IACtG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/G,iFAAiF;IACjF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpG,sGAAsG;IACtG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,sGAAsG;IACtG,MAAM,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,2BAA2B,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzH,4GAA4G;IAC5G,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7E,0EAA0E;IAC1E,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,sGAAsG;IACtG,OAAO,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3G;AAiCD,eAAO,MAAM,mBAAmB,0FAK9B,CAAC"}

package/dist/kinds/package-registry.kind.js

@@ -11,17 +11,31 @@
  * - Adapter-specific fields (dockerImage, storageSize, domain, …)
  *   live exclusively under `config`. Each adapter package defines its own
  *   concrete schema under its discriminator key.
+ * - `publish` is how a release writes to this registry: the Secrets key that
+ *   holds its credential, the second factor the account asks for, and, for a
+ *   registry that only ever carries another registry's exact bytes, `mirrorOf`.
+ *
+ * Every release surface (`vibes infra npm publish`, `vibes infra npm mirror`,
+ * Forge's `publish:` step) resolves a registry by id through this kind and
+ * calls its implementation ({@link PackageRegistryImplementation}). The adapter
+ * named by `config.adapter` registers that implementation per descriptor id;
+ * a registry with no registered implementation refuses typed
+ * (`package-registry-implementation-missing`), never a silent fallback.
  */
 import * as z from 'zod/v4';
-import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
-import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
-import { INFRA_DISCOVERY_PATTERN, extractStem } from "./discovery.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
 import { deploymentEnvRequirementSchema } from "../schemas.js";
 export const PackageRegistryTypeSchema = z.enum(['npm', 'docker', 'maven', 'helm']);
 const PackageRegistryBaseSchema = RuntimeDescriptorSchema.extend({
     kind: z.literal('infra/package-registry'),
-    /** Primary access URL (e.g. 'https://packages.example.com'). */
-    url: z.string().url(),
+    /** Primary access URL (e.g. 'https://packages.example.com'); or name the `infra/service` that serves it. */
+    url: z.string().url().optional(),
+    /** The `infra/service` id whose configured primary origin is this registry (instead of a fixed `url`). */
+    service: z.string().min(1).optional(),
     /** Package type this registry serves. */
     registryType: PackageRegistryTypeSchema.default('npm'),
     /** Npm scope this registry owns (e.g. '@vibesdotdev'). */
@@ -35,44 +49,60 @@ const PackageRegistryBaseSchema = RuntimeDescriptorSchema.extend({
     /** Environment variable requirements. */
     env: z.array(deploymentEnvRequirementSchema).optional()
 });
-export const VerdaccioDoksPackageRegistryConfigSchema = z.object({
-    /** Docker image for the Verdaccio container. */
-    dockerImage: z.string().default('verdaccio/verdaccio:5'),
-    /** Persistent storage size (e.g. '10Gi'). */
-    storageSize: z.string().default('10Gi'),
-    /** Primary domain for the registry. */
-    domain: z.string().min(1),
-    /** Upstream npm registry URL to proxy. */
-    upstreamNpmUrl: z.string().url().default('https://registry.npmjs.org'),
-    /** Whether built-in authentication is enabled. */
-    authEnabled: z.boolean().default(true)
+/** What a release writes with: the credential's Secrets key, the account's second factor, and an exact-bytes source. */
+export const PackageRegistryPublishSchema = z.strictObject({
+    /** The Secrets key holding the publish credential; the value is resolved at publish time and never printed. */
+    credential: z.strictObject({ secret: z.string().min(1) }),
+    /**
+     * The second factor the registry account asks for on writes: `none`, a one-time
+     * password the operator supplies (`otp`), or a browser approval (`web`).
+     */
+    secondFactor: z.enum(['none', 'otp', 'web']).default('none'),
+    /** The registry id whose exact bytes this registry carries; a release never packs for it. */
+    mirrorOf: z.string().min(1).optional()
 });
-export const PackageRegistryConfigSchema = z.union([
-    VerdaccioDoksPackageRegistryConfigSchema.extend({ adapter: z.literal('verdaccio-doks') })
-]);
+/** Open adapter config: the adapter package that owns `adapter` validates the rest. */
+export const PackageRegistryConfigSchema = z.looseObject({ adapter: z.string().min(1) });
 export const PackageRegistryDescriptorSchema = PackageRegistryBaseSchema.extend({
+    publish: PackageRegistryPublishSchema.optional(),
     /**
-     * Adapter-specific configuration. Discriminated union — each adapter
-     * package defines its own config schema under its discriminator key.
+     * Adapter-specific configuration, discriminated by `adapter`. Each
+     * adapter's integrations package owns its concrete schema.
      */
     config: PackageRegistryConfigSchema.optional()
+}).refine((descriptor) => (descriptor.url === undefined) !== (descriptor.service === undefined), {
+    message: 'a package registry names exactly one of url or service',
+    path: ['url']
 });
+/** Without an adapter's implementation, every release call refuses typed, naming the registry and its adapter. */
 class DefaultPackageRegistryImplementation {
     descriptor;
     context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
     constructor(descriptor, context) {
         this.descriptor = descriptor;
         this.context = context;
+        this.config = readKindDescriptor(PackageRegistryDescriptorSchema, descriptor);
     }
-    get config() {
-        return this.descriptor;
+    missing() {
+        const adapter = this.config.config?.adapter;
+        return new CapabilityError(`Package registry ${this.config.id} has no registered implementation${adapter === undefined ? '' : ` for adapter ${adapter}`}.`, 'UNAVAILABLE', { reason: 'package-registry-implementation-missing', details: { registry: this.config.id, adapter: adapter ?? null } });
     }
+    forEnvironment() { throw this.missing(); }
+    async origin() { throw this.missing(); }
+    async readRelease() { throw this.missing(); }
+    async readReleases() { throw this.missing(); }
+    async distTags() { throw this.missing(); }
+    async setTag() { throw this.missing(); }
+    async versionIntegrity() { throw this.missing(); }
+    async tarball() { throw this.missing(); }
+    async publish() { throw this.missing(); }
 }
 export const packageRegistryKind = createRuntimeKind({
     id: 'infra/package-registry',
     descriptorSchema: PackageRegistryDescriptorSchema,
     defaultImplementation: DefaultPackageRegistryImplementation,
-    discoveryPattern: INFRA_DISCOVERY_PATTERN,
-    extractStem
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
 });
 //# sourceMappingURL=package-registry.kind.js.map