@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/declared-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-provider.js","sourceRoot":"","sources":["../src/declared-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAgD,MAAM,qBAAqB,CAAC;AAQ9H,wFAAwF;AACxF,SAAS,gBAAgB,CAAC,OAA8C,EAAE,QAAgB;IACzF,OAAO,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC;WAC/C,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,OAAiE,EACjE,UAAsC,EACtC,MAAc;IAEd,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtF,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAA2B;YACvC,MAAM,EAAE,uCAAuC;YAC/C,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE;YACrD,YAAY,EAAE,qCAAqC,SAAS,OAAO,MAAM,GAAG;SAC5E,CAAC;QACF,IAAI,OAAO,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC1E,MAAM,IAAI,eAAe,CAAC,+EAA+E,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACpI,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO;QAAE,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAClF,CAAC"}

package/dist/deployment-collisions.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Deployment identity-collision detection.
+ *
+ * Two managed `deployment.config.ts` files that render the SAME Cloudflare Worker
+ * script name (or share an `appId`) are a deploy footgun. `vibes infra deploy
+ * run` is PATH-based: it loads whatever config sits at the path you point it at
+ * and pushes a worker by the name that config renders. If two configs render one
+ * name, deploying either SILENTLY clobbers the other's live image, bindings, and
+ * Durable-Object migrations on the single Cloudflare worker of that name — and
+ * nothing in the deploy path asserts uniqueness.
+ *
+ * This module is that assertion. It is pure (no IO) so it can be shared by:
+ *   - the regen orchestrator (`regenerateAll`), which hard-errors a collision at
+ *     regen/deploy time, and
+ *   - the `check:deployment-collisions` gate wired into `bun run check`, which
+ *     fails the build before a duplicate can ever reach deploy.
+ *
+ * The canonical home for `vibes-forge-ci` is `apps/forge-ci-worker`; the
+ * duplicate `workers/forge-ci` that motivated this guard was deleted. See
+ * `apps/forge-ci-worker/deployment.config.ts`.
+ */
+/** The minimal shape needed to detect a collision. */
+export interface DeploymentIdentity {
+    /** The deployment `appId` (from `createAppDeployment`). */
+    appId: string;
+    /** The dir holding the `deployment.config.ts` (absolute or repo-relative). */
+    appDir: string;
+    /**
+     * The provider's name for the deployed unit (e.g. a Worker script name).
+     * `null` / absent when the module names none — those cannot collide on a
+     * unit, so they are ignored for the `unitName` key (but still grouped by
+     * `appId`).
+     */
+    unitName?: string | null;
+}
+export type CollisionKind = 'unitName' | 'appId';
+export interface DeploymentCollision {
+    kind: CollisionKind;
+    /** The shared value — the duplicated worker name or appId. */
+    key: string;
+    /** Every identity that maps to `key`, sorted by `appDir` for stable output. */
+    members: DeploymentIdentity[];
+}
+/**
+ * Group the identities by rendered worker name and by appId; return every group
+ * with more than one member. Pure — performs no IO.
+ *
+ * Identities with a null/empty `unitName` are excluded from the `unitName`
+ * grouping (a non-worker deployment can't clobber a worker), but every identity
+ * participates in the `appId` grouping.
+ */
+export declare function detectDeploymentCollisions(items: readonly DeploymentIdentity[]): DeploymentCollision[];
+/** Render one collision as a single-line, human-readable error message. */
+export declare function formatCollision(collision: DeploymentCollision): string;
+//# sourceMappingURL=deployment-collisions.d.ts.map

package/dist/deployment-collisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-collisions.d.ts","sourceRoot":"","sources":["../src/deployment-collisions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IAClC,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,OAAO,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,aAAa,CAAC;IACpB,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,SAAS,kBAAkB,EAAE,GAClC,mBAAmB,EAAE,CA2BvB;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,SAAS,EAAE,mBAAmB,GAAG,MAAM,CAStE"}

package/dist/deployment-collisions.js

@@ -0,0 +1,70 @@
+/**
+ * Deployment identity-collision detection.
+ *
+ * Two managed `deployment.config.ts` files that render the SAME Cloudflare Worker
+ * script name (or share an `appId`) are a deploy footgun. `vibes infra deploy
+ * run` is PATH-based: it loads whatever config sits at the path you point it at
+ * and pushes a worker by the name that config renders. If two configs render one
+ * name, deploying either SILENTLY clobbers the other's live image, bindings, and
+ * Durable-Object migrations on the single Cloudflare worker of that name — and
+ * nothing in the deploy path asserts uniqueness.
+ *
+ * This module is that assertion. It is pure (no IO) so it can be shared by:
+ *   - the regen orchestrator (`regenerateAll`), which hard-errors a collision at
+ *     regen/deploy time, and
+ *   - the `check:deployment-collisions` gate wired into `bun run check`, which
+ *     fails the build before a duplicate can ever reach deploy.
+ *
+ * The canonical home for `vibes-forge-ci` is `apps/forge-ci-worker`; the
+ * duplicate `workers/forge-ci` that motivated this guard was deleted. See
+ * `apps/forge-ci-worker/deployment.config.ts`.
+ */
+/**
+ * Group the identities by rendered worker name and by appId; return every group
+ * with more than one member. Pure — performs no IO.
+ *
+ * Identities with a null/empty `unitName` are excluded from the `unitName`
+ * grouping (a non-worker deployment can't clobber a worker), but every identity
+ * participates in the `appId` grouping.
+ */
+export function detectDeploymentCollisions(items) {
+    const collisions = [];
+    const keyers = [
+        ['unitName', (i) => i.unitName],
+        ['appId', (i) => i.appId]
+    ];
+    for (const [kind, keyOf] of keyers) {
+        const groups = new Map();
+        for (const item of items) {
+            const raw = keyOf(item);
+            const key = (raw ?? '').trim();
+            if (!key)
+                continue;
+            const list = groups.get(key);
+            if (list)
+                list.push(item);
+            else
+                groups.set(key, [item]);
+        }
+        for (const [key, members] of groups) {
+            if (members.length > 1) {
+                collisions.push({
+                    kind,
+                    key,
+                    members: [...members].sort((a, b) => a.appDir.localeCompare(b.appDir))
+                });
+            }
+        }
+    }
+    return collisions;
+}
+/** Render one collision as a single-line, human-readable error message. */
+export function formatCollision(collision) {
+    const where = collision.members.map((m) => m.appDir).join(', ');
+    return (`Duplicate ${collision.kind} "${collision.key}": ${collision.members.length} managed ` +
+        `deployments map to it (${where}). Two configs cannot target one Cloudflare ` +
+        `worker — \`vibes infra deploy run\` is path-based and would clobber the live ` +
+        `worker's image/bindings/migrations. Give each a distinct ${collision.kind}, or ` +
+        `delete the redundant config.`);
+}
+//# sourceMappingURL=deployment-collisions.js.map

package/dist/deployment-collisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-collisions.js","sourceRoot":"","sources":["../src/deployment-collisions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA2BH;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACzC,KAAoC;IAEpC,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAiF;QAC5F,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/B,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;KACzB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACrB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,UAAU,CAAC,IAAI,CAAC;oBACf,IAAI;oBACJ,GAAG;oBACH,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;iBACtE,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,SAA8B;IAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,CACN,aAAa,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,WAAW;QACtF,0BAA0B,KAAK,8CAA8C;QAC7E,+EAA+E;QAC/E,4DAA4D,SAAS,CAAC,IAAI,OAAO;QACjF,8BAA8B,CAC9B,CAAC;AACH,CAAC"}

package/dist/deployment-environment.d.ts

@@ -0,0 +1,57 @@
+import type { AppDeployment } from '@vibesdotdev/infra-core/deployment';
+import type { DeploymentEnvironmentFacts } from '@vibesdotdev/infra-core/kinds';
+export { requireDeploymentProviderConfig, resolveDeploymentProviderConfig, selectDeploymentEnvironment, type ResolvedProviderConfig } from '@vibesdotdev/infra-core/deployment-environment';
+export type DeploymentMutationSurface = 'deploy-run' | 'preview-create' | 'local-only';
+export type DeploymentRouteOwnership = 'production' | 'selected-environment' | 'preview' | 'none' | 'unowned';
+export type DeploymentSecretCapability = 'secrets-store' | 'requirements-only' | 'preview-runtime' | 'local-runtime' | 'unavailable';
+export type RuntimeEnvironmentDescriptor = {
+    id: string;
+    apiUrl?: string;
+    apps?: Record<string, string>;
+};
+export type ResolvedDeploymentRoute = {
+    pattern: string;
+    ownership: DeploymentRouteOwnership;
+};
+export type DeploymentEnvironmentResolution = {
+    environment: string;
+    runtimeDescriptorId: string | null;
+    selectedOrigin?: string | null;
+    providerEnvironment: string | null;
+    mutationSurface: DeploymentMutationSurface;
+    providerMutationAllowed: boolean;
+    routesInherited: boolean;
+    routes: ResolvedDeploymentRoute[];
+    secretCapability: DeploymentSecretCapability;
+    requiredSecrets: string[];
+    optionalSecrets: string[];
+    boundSecrets: string[];
+    violations: string[];
+};
+export type DeploymentEnvironmentRunRefusal = {
+    code: 'INVALID_INPUT' | 'UNAVAILABLE';
+    message: string;
+    recoveryHint?: string;
+};
+/** Return the fail-closed reason for an `infra deploy run`, if any. */
+export declare function deploymentEnvironmentRunRefusal(resolution: DeploymentEnvironmentResolution, selectors?: {
+    environment?: string;
+    providerEnvironment?: string;
+}): DeploymentEnvironmentRunRefusal | null;
+/**
+ * Resolve the selected deployment environment from the runtime-owned
+ * `config/environment` catalog plus the provider-generated projection.
+ *
+ * This function never reads secret values. It reports requirement and binding
+ * names only, so readiness and dry-run can explain capability without exposing
+ * credentials.
+ */
+export declare function resolveDeploymentEnvironment(input: {
+    deployment: AppDeployment;
+    /** What the deployment's provider reports for the selected environment. */
+    facts: DeploymentEnvironmentFacts;
+    environment?: string;
+    runtimeEnvironments?: readonly RuntimeEnvironmentDescriptor[];
+}): DeploymentEnvironmentResolution;
+export declare function formatDeploymentEnvironmentResolution(resolution: DeploymentEnvironmentResolution): string;
+//# sourceMappingURL=deployment-environment.d.ts.map

package/dist/deployment-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-environment.d.ts","sourceRoot":"","sources":["../src/deployment-environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAIhF,OAAO,EACN,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,MAAM,gDAAgD,CAAC;AAExD,MAAM,MAAM,yBAAyB,GAAG,YAAY,GAAG,gBAAgB,GAAG,YAAY,CAAC;AACvF,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,sBAAsB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAC9G,MAAM,MAAM,0BAA0B,GACnC,eAAe,GACf,mBAAmB,GACnB,iBAAiB,GACjB,eAAe,GACf,aAAa,CAAC;AAEjB,MAAM,MAAM,4BAA4B,GAAG;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,wBAAwB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,eAAe,EAAE,yBAAyB,CAAC;IAC3C,uBAAuB,EAAE,OAAO,CAAC;IACjC,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClC,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC7C,IAAI,EAAE,eAAe,GAAG,aAAa,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,uEAAuE;AACvE,wBAAgB,+BAA+B,CAC9C,UAAU,EAAE,+BAA+B,EAC3C,SAAS,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAO,GACpE,+BAA+B,GAAG,IAAI,CA8BxC;AAoCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IACnD,UAAU,EAAE,aAAa,CAAC;IAC1B,2EAA2E;IAC3E,KAAK,EAAE,0BAA0B,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC9D,GAAG,+BAA+B,CAiIlC;AAED,wBAAgB,qCAAqC,CACpD,UAAU,EAAE,+BAA+B,GACzC,MAAM,CAiBR"}

package/dist/deployment-environment.js

@@ -0,0 +1,198 @@
+import { normalizeDeploymentEnvironment as normalizeEnvironment } from '@vibesdotdev/infra-core/deployment-environment';
+// The environment and provider-block selection is infra-core's; re-exported for this package's callers.
+export { requireDeploymentProviderConfig, resolveDeploymentProviderConfig, selectDeploymentEnvironment } from '@vibesdotdev/infra-core/deployment-environment';
+/** Return the fail-closed reason for an `infra deploy run`, if any. */
+export function deploymentEnvironmentRunRefusal(resolution, selectors = {}) {
+    if (selectors.environment && selectors.providerEnvironment) {
+        const requestedEnvironment = normalizeEnvironment(selectors.environment);
+        const requestedProviderEnvironment = normalizeEnvironment(selectors.providerEnvironment);
+        if (requestedEnvironment !== requestedProviderEnvironment) {
+            return {
+                code: 'INVALID_INPUT',
+                message: `Conflicting environment selectors: --environment ${selectors.environment} and --wrangler-env ${selectors.providerEnvironment} select different semantic environments.`
+            };
+        }
+    }
+    if (resolution.violations.length > 0) {
+        return {
+            code: 'UNAVAILABLE',
+            message: `Refusing deploy for unsafe environment "${resolution.environment}": ${resolution.violations.join(' ')}`,
+            recoveryHint: 'Repair the runtime environment descriptor or generated provider projection; do not bypass the environment gate.'
+        };
+    }
+    if (!resolution.providerMutationAllowed) {
+        return {
+            code: 'INVALID_INPUT',
+            message: `Environment "${resolution.environment}" is ${resolution.mutationSurface}, not an infra deploy run target.`,
+            recoveryHint: resolution.mutationSurface === 'preview-create'
+                ? 'Preview stand-up is unavailable through vibes infra deploy today (no dedicated preview CLI). Keep originKind preview as the signal; reuse config/environment + infra/web-app|worker|edge-tls when Product lands preview under the infra/CI family. Do not invent a preview kind id.'
+                : 'Use the local development runtime; local is not a provider deployment target.'
+        };
+    }
+    return null;
+}
+function hostname(value) {
+    const candidate = value.includes('://') ? value : `https://${value}`;
+    if (!URL.canParse(candidate))
+        return null;
+    return new URL(candidate).hostname.toLowerCase();
+}
+function selectedRuntimeDescriptor(environment, descriptors) {
+    return descriptors.find((descriptor) => descriptor.id === environment);
+}
+function selectedEnvironmentOrigin(descriptor, appId) {
+    return descriptor?.apps?.[appId] ?? (appId === 'home' ? descriptor?.apiUrl : undefined) ?? null;
+}
+function routeOwnership(input) {
+    const routeHost = hostname(input.pattern);
+    if (!routeHost)
+        return 'unowned';
+    if (input.productionHosts.has(routeHost))
+        return 'production';
+    if (input.selectedHost === routeHost)
+        return 'selected-environment';
+    if (input.environment === 'preview')
+        return 'preview';
+    return 'unowned';
+}
+/**
+ * Resolve the selected deployment environment from the runtime-owned
+ * `config/environment` catalog plus the provider-generated projection.
+ *
+ * This function never reads secret values. It reports requirement and binding
+ * names only, so readiness and dry-run can explain capability without exposing
+ * credentials.
+ */
+export function resolveDeploymentEnvironment(input) {
+    const environment = normalizeEnvironment(input.environment);
+    const facts = input.facts;
+    const descriptors = input.runtimeEnvironments ?? [];
+    const runtimeDescriptor = selectedRuntimeDescriptor(environment, descriptors);
+    const selectedOrigin = selectedEnvironmentOrigin(runtimeDescriptor, input.deployment.appId);
+    const selectedHost = selectedOrigin ? hostname(selectedOrigin) : null;
+    const productionHosts = new Set(input.deployment.origins
+        .filter((origin) => origin.kind === 'primary' || origin.kind === 'redirect')
+        .map((origin) => hostname(origin.hostname))
+        .filter((value) => Boolean(value)));
+    const routeValues = facts.routes;
+    const routes = routeValues.map((pattern) => ({
+        pattern,
+        ownership: routeOwnership({ pattern, productionHosts, selectedHost, environment })
+    }));
+    const requiredSecrets = input.deployment.env
+        .filter((entry) => entry.secret && entry.required !== false)
+        .map((entry) => entry.name)
+        .sort((left, right) => left.localeCompare(right));
+    const optionalSecrets = input.deployment.env
+        .filter((entry) => entry.secret && entry.required === false)
+        .map((entry) => entry.name)
+        .sort((left, right) => left.localeCompare(right));
+    const boundSecrets = [...facts.boundSecrets].sort((left, right) => left.localeCompare(right));
+    const declaredRequirements = facts.declaredRequirements;
+    const mutationSurface = environment === 'preview'
+        ? 'preview-create'
+        : environment === 'local'
+            ? 'local-only'
+            : 'deploy-run';
+    let secretCapability;
+    if (environment === 'preview')
+        secretCapability = 'preview-runtime';
+    else if (environment === 'local')
+        secretCapability = 'local-runtime';
+    else if (boundSecrets.length > 0)
+        secretCapability = 'secrets-store';
+    else if (declaredRequirements.length > 0)
+        secretCapability = 'requirements-only';
+    else if (requiredSecrets.length > 0)
+        secretCapability = 'unavailable';
+    else
+        secretCapability = 'requirements-only';
+    const violations = [];
+    if (facts.generated && !facts.resolved) {
+        violations.push('Provider-generated configuration could not be resolved.');
+    }
+    if (environment !== 'development' && environment !== 'preview' && !runtimeDescriptor) {
+        violations.push(`Runtime config/environment has no explicit "${environment}" descriptor.`);
+    }
+    if (environment === 'production') {
+        const expectedRoutes = [...productionHosts].sort();
+        const actualRoutes = routeValues
+            .map((route) => hostname(route))
+            .filter((value) => Boolean(value))
+            .sort();
+        if (expectedRoutes.length !== actualRoutes.length ||
+            expectedRoutes.some((route, index) => route !== actualRoutes[index])) {
+            violations.push('Production routes do not exactly match deployment.config.ts origins.');
+        }
+        if (selectedHost) {
+            const primary = input.deployment.origins.find((origin) => origin.kind === 'primary');
+            if (!primary || hostname(primary.hostname) !== selectedHost) {
+                violations.push(`Runtime environment "${environment}" does not own the deployment primary origin.`);
+            }
+        }
+    }
+    else if (facts.generated && environment !== 'local' && environment !== 'preview') {
+        if (!facts.explicitEnvironment) {
+            violations.push(`Provider projection has no explicit "${facts.providerEnvironment}" environment.`);
+        }
+        if (facts.routesInherited) {
+            violations.push(`Environment "${environment}" inherits top-level routes instead of declaring its own route policy.`);
+        }
+        for (const route of routes) {
+            if (route.ownership === 'production') {
+                violations.push(`Environment "${environment}" resolves production-owned route "${route.pattern}".`);
+            }
+            else if (route.ownership === 'unowned') {
+                violations.push(`Environment "${environment}" resolves unowned route "${route.pattern}".`);
+            }
+        }
+    }
+    if (environment !== 'local' && environment !== 'preview') {
+        // A required secret is satisfied ONLY by an actual binding in the projected
+        // config — never by merely being declared in `secrets.required`. Counting a
+        // declaration as satisfaction let a credential-resolution failure regenerate a
+        // config with zero bindings yet still pass readiness, stripping live
+        // secret-store bindings on deploy. `requirements-only` is a local
+        // render/equivalence artifact, not a production capability for required
+        // secrets (red-team fleet scan: no first-party app deploys a nonempty
+        // required-secret set via requirements-only).
+        const bound = new Set(boundSecrets);
+        const missingRequired = requiredSecrets.filter((name) => !bound.has(name));
+        if (missingRequired.length > 0) {
+            violations.push(`Environment "${environment}" has no deploy binding for required secret names: ${missingRequired.join(', ')}.`);
+        }
+    }
+    return {
+        environment,
+        runtimeDescriptorId: runtimeDescriptor?.id ?? null,
+        selectedOrigin,
+        providerEnvironment: facts.providerEnvironment,
+        mutationSurface,
+        providerMutationAllowed: mutationSurface === 'deploy-run',
+        routesInherited: facts.routesInherited,
+        routes,
+        secretCapability,
+        requiredSecrets,
+        optionalSecrets,
+        boundSecrets,
+        violations
+    };
+}
+export function formatDeploymentEnvironmentResolution(resolution) {
+    const routes = resolution.routes.length === 0
+        ? 'none'
+        : resolution.routes
+            .map((route) => `${route.pattern} (${route.ownership})`)
+            .join(', ');
+    return [
+        `selected=${resolution.environment}`,
+        `runtime=${resolution.runtimeDescriptorId ?? 'generated-only'}`,
+        `provider-env=${resolution.providerEnvironment ?? 'top-level'}`,
+        `surface=${resolution.mutationSurface}`,
+        `routes=${routes}`,
+        `secrets=${resolution.secretCapability}`,
+        `required=${resolution.requiredSecrets.length}`,
+        `optional=${resolution.optionalSecrets.length}`
+    ].join(' ');
+}
+//# sourceMappingURL=deployment-environment.js.map

package/dist/deployment-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-environment.js","sourceRoot":"","sources":["../src/deployment-environment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,IAAI,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAExH,wGAAwG;AACxG,OAAO,EACN,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAE3B,MAAM,gDAAgD,CAAC;AA4CxD,uEAAuE;AACvE,MAAM,UAAU,+BAA+B,CAC9C,UAA2C,EAC3C,YAAoE,EAAE;IAEtE,IAAI,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,mBAAmB,EAAE,CAAC;QAC5D,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,4BAA4B,GAAG,oBAAoB,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACzF,IAAI,oBAAoB,KAAK,4BAA4B,EAAE,CAAC;YAC3D,OAAO;gBACN,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,oDAAoD,SAAS,CAAC,WAAW,uBAAuB,SAAS,CAAC,mBAAmB,0CAA0C;aAChL,CAAC;QACH,CAAC;IACF,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,2CAA2C,UAAU,CAAC,WAAW,MAAM,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACjH,YAAY,EACX,iHAAiH;SAClH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC;QACzC,OAAO;YACN,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,gBAAgB,UAAU,CAAC,WAAW,QAAQ,UAAU,CAAC,eAAe,mCAAmC;YACpH,YAAY,EACX,UAAU,CAAC,eAAe,KAAK,gBAAgB;gBAC9C,CAAC,CAAC,qRAAqR;gBACvR,CAAC,CAAC,+EAA+E;SACnF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;IACrE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,yBAAyB,CACjC,WAAmB,EACnB,WAAoD;IAEpD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,yBAAyB,CACjC,UAAoD,EACpD,KAAa;IAEb,OAAO,UAAU,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AACjG,CAAC;AAED,SAAS,cAAc,CAAC,KAKvB;IACA,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IAC9D,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,sBAAsB,CAAC;IACpE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAM5C;IACA,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC;IACpD,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,yBAAyB,CAAC,iBAAiB,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,eAAe,GAAG,IAAI,GAAG,CAC9B,KAAK,CAAC,UAAU,CAAC,OAAO;SACtB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC;SAC3E,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO;QACP,SAAS,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;KAClF,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC;SAC3D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC;SAC3D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9F,MAAM,oBAAoB,GAAG,KAAK,CAAC,oBAAoB,CAAC;IACxD,MAAM,eAAe,GACpB,WAAW,KAAK,SAAS;QACxB,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,WAAW,KAAK,OAAO;YACxB,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,YAAY,CAAC;IAClB,IAAI,gBAA4C,CAAC;IACjD,IAAI,WAAW,KAAK,SAAS;QAAE,gBAAgB,GAAG,iBAAiB,CAAC;SAC/D,IAAI,WAAW,KAAK,OAAO;QAAE,gBAAgB,GAAG,eAAe,CAAC;SAChE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,gBAAgB,GAAG,eAAe,CAAC;SAChE,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;QAAE,gBAAgB,GAAG,mBAAmB,CAAC;SAC5E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,gBAAgB,GAAG,aAAa,CAAC;;QACjE,gBAAgB,GAAG,mBAAmB,CAAC;IAE5C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,WAAW,KAAK,aAAa,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtF,UAAU,CAAC,IAAI,CACd,+CAA+C,WAAW,eAAe,CACzE,CAAC;IACH,CAAC;IAED,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,WAAW;aAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aAC/B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aAClD,IAAI,EAAE,CAAC;QACT,IACC,cAAc,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;YAC7C,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,EACnE,CAAC;YACF,UAAU,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YACrF,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,YAAY,EAAE,CAAC;gBAC7D,UAAU,CAAC,IAAI,CACd,wBAAwB,WAAW,+CAA+C,CAClF,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACpF,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CACd,wCAAwC,KAAK,CAAC,mBAAmB,gBAAgB,CACjF,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CACd,gBAAgB,WAAW,wEAAwE,CACnG,CAAC;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CACd,gBAAgB,WAAW,sCAAsC,KAAK,CAAC,OAAO,IAAI,CAClF,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC1C,UAAU,CAAC,IAAI,CACd,gBAAgB,WAAW,6BAA6B,KAAK,CAAC,OAAO,IAAI,CACzE,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC1D,4EAA4E;QAC5E,4EAA4E;QAC5E,+EAA+E;QAC/E,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,sEAAsE;QACtE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACpC,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CACd,gBAAgB,WAAW,sDAAsD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO;QACN,WAAW;QACX,mBAAmB,EAAE,iBAAiB,EAAE,EAAE,IAAI,IAAI;QAClD,cAAc;QACd,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,eAAe;QACf,uBAAuB,EAAE,eAAe,KAAK,YAAY;QACzD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,MAAM;QACN,gBAAgB;QAChB,eAAe;QACf,eAAe;QACf,YAAY;QACZ,UAAU;KACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qCAAqC,CACpD,UAA2C;IAE3C,MAAM,MAAM,GACX,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CAAC,MAAM;aAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC;aACvD,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO;QACN,YAAY,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,UAAU,CAAC,mBAAmB,IAAI,gBAAgB,EAAE;QAC/D,gBAAgB,UAAU,CAAC,mBAAmB,IAAI,WAAW,EAAE;QAC/D,WAAW,UAAU,CAAC,eAAe,EAAE;QACvC,UAAU,MAAM,EAAE;QAClB,WAAW,UAAU,CAAC,gBAAgB,EAAE;QACxC,YAAY,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE;QAC/C,YAAY,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE;KAC/C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC"}

package/dist/deployment-settings.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A unit's `infra.deployment` settings, read through the config owner. A
+ * runtime that composes no `infra.deployment` manifest (or no config owner), or
+ * an app directory outside the bound workspace (the operator names it), has no
+ * unit config to read: the manifest's declared defaults apply, which is the
+ * migration path (the unit's `deployment.config.ts` module).
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type { ConfigLoadHost } from './config-loader.ts';
+import { type InfraDeploymentConfig } from './deployment.config.descriptor.ts';
+export declare function readDeploymentSettings(runtime: RuntimeRef, appDir: string): Promise<InfraDeploymentConfig>;
+/** The unit's own config file: where a declared (data) deployment or non-deployable marker lives. */
+export declare const UNIT_CONFIG_FILE = "vibes.config.ts";
+/** The unit's deployment module: the `infra.deployment` `module` setting (default `deployment.config.ts`), relative to the app directory. */
+export declare function findConfigFile(host: ConfigLoadHost, appDir: string, module?: string): Promise<string>;
+/**
+ * The one answer to "where does this unit's deployment live": the unit's
+ * `vibes.config.ts` when it declares a deployment or non-deployable marker as
+ * data, else the declared module. Null when the unit declares no deployment.
+ */
+export declare function locateDeploymentSource(runtime: RuntimeRef, host: ConfigLoadHost, appDir: string): Promise<{
+    settings: InfraDeploymentConfig;
+    configPath: string | null;
+}>;
+/** True when the unit declares a deployment (data, non-deployable marker, or an existing module). */
+export declare function declaresDeployment(runtime: RuntimeRef, host: ConfigLoadHost, appDir: string): Promise<boolean>;
+//# sourceMappingURL=deployment-settings.d.ts.map

package/dist/deployment-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-settings.d.ts","sourceRoot":"","sources":["../src/deployment-settings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAI/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAmB,EAA0D,KAAK,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAMnJ,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAQhH;AAED,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD,6IAA6I;AAC7I,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,MAAkC,GAAG,OAAO,CAAC,MAAM,CAAC,CAQtI;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAO/K;AAED,qGAAqG;AACrG,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpH"}

package/dist/deployment-settings.js

@@ -0,0 +1,52 @@
+/**
+ * A unit's `infra.deployment` settings, read through the config owner. A
+ * runtime that composes no `infra.deployment` manifest (or no config owner), or
+ * an app directory outside the bound workspace (the operator names it), has no
+ * unit config to read: the manifest's declared defaults apply, which is the
+ * migration path (the unit's `deployment.config.ts` module).
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { isWithinBoundWorkspace } from '@vibesdotdev/kernel/bootstrap/unit-config';
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import descriptor, { DEFAULT_DEPLOYMENT_MODULE, InfraDeploymentConfigSchema } from "./deployment.config.descriptor.js";
+function manifestComposed(runtime) {
+    return runtime.hasKind('config/manifest') && runtime.query('config/manifest').descriptors().some((candidate) => candidate.id === descriptor.id);
+}
+export async function readDeploymentSettings(runtime, appDir) {
+    const defaults = InfraDeploymentConfigSchema.parse({});
+    if (!manifestComposed(runtime) || !runtime.hasContext('runtime/workspace-path'))
+        return defaults;
+    // An app directory outside the bound workspace has no unit config to read (the owner's containment
+    // rule); every refusal of a read inside it, a config linking outside included, propagates.
+    if (!(await isWithinBoundWorkspace(runtime, appDir)))
+        return defaults;
+    const config = await getVibesClient('config', runtime);
+    return config.readUnit({ id: descriptor.id, schema: InfraDeploymentConfigSchema }, appDir);
+}
+/** The unit's own config file: where a declared (data) deployment or non-deployable marker lives. */
+export const UNIT_CONFIG_FILE = 'vibes.config.ts';
+/** The unit's deployment module: the `infra.deployment` `module` setting (default `deployment.config.ts`), relative to the app directory. */
+export async function findConfigFile(host, appDir, module = DEFAULT_DEPLOYMENT_MODULE) {
+    const candidate = host.paths.isAbsolute(module) ? module : host.paths.join(appDir, module);
+    if (await host.files.exists(candidate))
+        return candidate;
+    throw new CapabilityError(`No deployment config found in ${appDir}. Expected the \`infra.deployment\` declaration in its vibes.config.ts, or the module ${module}.`, 'NOT_FOUND', { reason: 'deployment-config-missing', details: { appDir, module } });
+}
+/**
+ * The one answer to "where does this unit's deployment live": the unit's
+ * `vibes.config.ts` when it declares a deployment or non-deployable marker as
+ * data, else the declared module. Null when the unit declares no deployment.
+ */
+export async function locateDeploymentSource(runtime, host, appDir) {
+    const settings = await readDeploymentSettings(runtime, appDir);
+    if (settings.webAppId !== undefined || settings.deployment !== undefined || settings.nonDeployable !== undefined) {
+        return { settings, configPath: host.paths.join(appDir, UNIT_CONFIG_FILE) };
+    }
+    const candidate = host.paths.isAbsolute(settings.module) ? settings.module : host.paths.join(appDir, settings.module);
+    return { settings, configPath: (await host.files.exists(candidate)) ? candidate : null };
+}
+/** True when the unit declares a deployment (data, non-deployable marker, or an existing module). */
+export async function declaresDeployment(runtime, host, appDir) {
+    return (await locateDeploymentSource(runtime, host, appDir)).configPath !== null;
+}
+//# sourceMappingURL=deployment-settings.js.map

package/dist/deployment-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-settings.js","sourceRoot":"","sources":["../src/deployment-settings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAA2C,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAG5D,OAAO,UAAU,EAAE,EAAE,yBAAyB,EAAE,2BAA2B,EAA8B,MAAM,mCAAmC,CAAC;AAEnJ,SAAS,gBAAgB,CAAC,OAAmB;IAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAoB,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC;AACpK,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAmB,EAAE,MAAc;IAC/E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjG,mGAAmG;IACnG,2FAA2F;IAC3F,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAe,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5F,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAElD,6IAA6I;AAC7I,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAoB,EAAE,MAAc,EAAE,SAAiB,yBAAyB;IACpH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3F,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,IAAI,eAAe,CACxB,iCAAiC,MAAM,yFAAyF,MAAM,GAAG,EACzI,WAAW,EACX,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CACpE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAmB,EAAE,IAAoB,EAAE,MAAc;IACrG,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAClH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAmB,EAAE,IAAoB,EAAE,MAAc;IACjG,OAAO,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC;AAClF,CAAC"}

package/dist/deployment.config.descriptor.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `infra.deployment` — how a unit (an app directory) is deployed, read through
+ * the config owner like every other setting: the unit's own `vibes.config.ts`
+ * under `config['infra.deployment']`, over the workspace value.
+ *
+ * A unit declares its deployment one of three ways:
+ *  - `deployment`: the AppDeployment as data (no code). Nothing is imported.
+ *  - `nonDeployable`: the unit is deliberately not deployable, with the reason.
+ *  - neither: its deployment lives in a module (`module`, default
+ *    `deployment.config.ts` — the declared migration path). A module is the only
+ *    form that can carry code (`generateWranglerConfig`, the managed renderer),
+ *    which JSON config values cannot; it is evaluated by this package's loader.
+ */
+import * as z from 'zod/v4';
+export declare const DEFAULT_DEPLOYMENT_MODULE: "deployment.config.ts";
+export declare const InfraDeploymentConfigSchema: z.ZodObject<{
+    webAppId: z.ZodOptional<z.ZodString>;
+    module: z.ZodDefault<z.ZodString>;
+    deployment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+    nonDeployable: z.ZodOptional<z.ZodObject<{
+        reason: z.ZodString;
+        appId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type InfraDeploymentConfig = z.infer<typeof InfraDeploymentConfigSchema>;
+export declare const INFRA_DEPLOYMENT_CONFIG_MANIFEST_ID = "infra.deployment";
+declare const descriptor: {
+    kind: "config/manifest";
+    id: string;
+    name: string;
+    namespace: string;
+    description: string;
+    schema: z.ZodObject<{
+        webAppId: z.ZodOptional<z.ZodString>;
+        module: z.ZodDefault<z.ZodString>;
+        deployment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+        nonDeployable: z.ZodOptional<z.ZodObject<{
+            reason: z.ZodString;
+            appId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    scope: "project";
+    tier: "system";
+    storedLayer: "none";
+    allowedAdapters: string[];
+    fields: {
+        module: {
+            ui: {
+                label: string;
+                component: "input";
+            };
+        };
+    };
+    customTables: false;
+    version: number;
+    internal: false;
+};
+export default descriptor;
+//# sourceMappingURL=deployment.config.descriptor.d.ts.map

package/dist/deployment.config.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.config.descriptor.d.ts","sourceRoot":"","sources":["../src/deployment.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,eAAO,MAAM,yBAAyB,EAAG,sBAA+B,CAAC;AAEzE,eAAO,MAAM,2BAA2B;;;;;;;;iBAgBtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,mCAAmC,qBAAqB,CAAC;AAEtE,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiBoB,CAAC;AAErC,eAAe,UAAU,CAAC"}

package/dist/deployment.config.descriptor.js

@@ -0,0 +1,54 @@
+/**
+ * `infra.deployment` — how a unit (an app directory) is deployed, read through
+ * the config owner like every other setting: the unit's own `vibes.config.ts`
+ * under `config['infra.deployment']`, over the workspace value.
+ *
+ * A unit declares its deployment one of three ways:
+ *  - `deployment`: the AppDeployment as data (no code). Nothing is imported.
+ *  - `nonDeployable`: the unit is deliberately not deployable, with the reason.
+ *  - neither: its deployment lives in a module (`module`, default
+ *    `deployment.config.ts` — the declared migration path). A module is the only
+ *    form that can carry code (`generateWranglerConfig`, the managed renderer),
+ *    which JSON config values cannot; it is evaluated by this package's loader.
+ */
+import * as z from 'zod/v4';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+export const DEFAULT_DEPLOYMENT_MODULE = 'deployment.config.ts';
+export const InfraDeploymentConfigSchema = z.object({
+    /** The canonical registered infra/web-app selected for this unit. */
+    webAppId: z.string().min(1).optional(),
+    /** The deployment module, relative to the unit: the migration path for deployments that carry code. */
+    module: z.string().min(1).default(DEFAULT_DEPLOYMENT_MODULE),
+    /** The AppDeployment as data (must carry `appId` and `provider`); declared, nothing is imported. */
+    deployment: z.record(z.string(), JsonValueSchema).optional(),
+    /** The unit is not deployable, and why. */
+    nonDeployable: z.object({ reason: z.string().min(1), appId: z.string().min(1).optional() }).optional()
+}).superRefine((settings, issues) => {
+    if (settings.webAppId !== undefined && (settings.deployment !== undefined || settings.nonDeployable !== undefined || settings.module !== DEFAULT_DEPLOYMENT_MODULE)) {
+        issues.addIssue({ code: 'custom', path: ['webAppId'], message: 'A registered web app reference cannot be combined with another deployment declaration.' });
+    }
+    if (settings.deployment !== undefined && settings.nonDeployable !== undefined) {
+        issues.addIssue({ code: 'custom', path: ['nonDeployable'], message: 'A unit declares `deployment` or `nonDeployable`, not both.' });
+    }
+});
+export const INFRA_DEPLOYMENT_CONFIG_MANIFEST_ID = 'infra.deployment';
+const descriptor = {
+    kind: 'config/manifest',
+    id: INFRA_DEPLOYMENT_CONFIG_MANIFEST_ID,
+    name: 'Infra deployment',
+    namespace: 'infra.deployment',
+    description: "How a unit deploys: its AppDeployment as data, a non-deployable marker with its reason, or the module (default deployment.config.ts) that holds a deployment carrying code.",
+    schema: InfraDeploymentConfigSchema,
+    scope: 'project',
+    tier: 'system',
+    storedLayer: 'none',
+    allowedAdapters: ['storage.json', 'storage.localdb'],
+    fields: {
+        module: { ui: { label: 'Deployment module', component: 'input' } }
+    },
+    customTables: false,
+    version: 1,
+    internal: false
+};
+export default descriptor;
+//# sourceMappingURL=deployment.config.descriptor.js.map

package/dist/deployment.config.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.config.descriptor.js","sourceRoot":"","sources":["../src/deployment.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAGnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAA+B,CAAC;AAEzE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,qEAAqE;IACrE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,uGAAuG;IACvG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC5D,oGAAoG;IACpG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC5D,2CAA2C;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtG,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;IACnC,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,yBAAyB,CAAC,EAAE,CAAC;QACrK,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,wFAAwF,EAAE,CAAC,CAAC;IAC5J,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/E,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;IACrI,CAAC;AACF,CAAC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,kBAAkB,CAAC;AAEtE,MAAM,UAAU,GAAG;IAClB,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,mCAAmC;IACvC,IAAI,EAAE,kBAAkB;IACxB,SAAS,EAAE,kBAAkB;IAC7B,WAAW,EAAE,6KAA6K;IAC1L,MAAM,EAAE,2BAA2B;IACnC,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,MAAM;IACnB,eAAe,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;IACpD,MAAM,EAAE;QACP,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;KAClE;IACD,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,KAAK;CACoB,CAAC;AAErC,eAAe,UAAU,CAAC"}