@wildo-ai/platform-infra-providers 1.1.2

package/LICENSE

@@ -0,0 +1,34 @@
+Copyright (c) 2026 P2C Consulting, s.à r.l.-S
+RCS Luxembourg B307591
+6C, Porte de France, L-4360 Esch-sur-Alzette, Luxembourg
+
+All rights reserved.
+
+This software and its accompanying materials (the "Software") are the
+confidential and proprietary property of P2C Consulting, s.à r.l.-S (the
+"Licensor"). The Software is made available for viewing only. No licence,
+right, or permission of any kind is granted by its publication or by its
+availability on any package registry or source repository.
+
+Without the Licensor's prior written permission, you may not use, copy,
+reproduce, modify, adapt, translate, merge, publish, distribute, sublicense,
+sell, host, or create derivative works of the Software, in whole or in part,
+nor use it to provide a service to any third party.
+
+Publication of the Software in any public registry is for distribution to
+authorised recipients and for technical evaluation of its packaging only. It
+does not place the Software in the public domain, does not constitute an open
+source release, and does not waive any right of the Licensor.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+Third-party components distributed with the Software remain governed by their
+own licences.
+
+Contact: P2C Consulting, s.à r.l.-S, 6C, Porte de France, L-4360
+Esch-sur-Alzette, Luxembourg.

package/dist/esm/aws-s3/aws-s3.infra.module.d.ts

@@ -0,0 +1,63 @@
+/**
+ * `AwsS3InfraProviderModule` — seventh concrete `InfraProviderModule`
+ * (Slice 5.1 of `infra-provider-planner.md`).
+ *
+ * Implements the `AWS_S3` `InfraProvider`. Shares the one-bucket,
+ * prefix-namespaced object layout of `MinioSelfInfraProviderModule` —
+ * the only differences are (a) no compose / K8s contribution (S3 is
+ * managed), and (b) the bucket endpoint is the regional AWS hostname
+ * instead of the in-cluster `minio` service.
+ *
+ * ## ⚠️ NOT USABLE TODAY — selecting this provider leaves apps with no
+ * storage credential (2026-08-10)
+ *
+ * The application-tier `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` env
+ * vars were removed **for every provider**: they were the object store's
+ * ROOT pair, handed to every app, minion and worker. Applications now
+ * obtain short-lived, prefix-confined credentials from apps-manager.
+ *
+ * That replacement is implemented for **MinIO only**. apps-manager's
+ * `ObjectStorageStsBrokerService` speaks MinIO's STS `AssumeRole` with an
+ * inline session policy; AWS STS requires a role ARN the broker does not
+ * supply, so an `AWS_S3` deployment would fail at storage initialisation
+ * with no credential and no path to one.
+ *
+ * No environment selects this provider today (every example uses
+ * `BackingServiceSource.SELF` → MinIO), which is why this is recorded as
+ * a gap rather than an outage. But it IS reachable — `s3: { source:
+ * MANAGED }` or `provider: 'aws'` resolves here — so **do not select
+ * `AWS_S3` until the AWS STS path exists.** Tracked in
+ * `.claude/plans/object-storage-root-credential-distribution.md`.
+ *
+ * The module still reuses the `STORAGE_*` env contract for the
+ * NON-secret values (endpoint, region, bucket, provider); it is only the
+ * credential half that is gone.
+ *
+ * **Why this module exists despite "no compose / no mint"**: it
+ * gives the lockfile a stable digest entry (so a switch from
+ * `minio-self` to `aws-s3` shows up as a `wildo lock check` drift)
+ * AND it formalizes which env vars the operator must set for AWS
+ * (`STORAGE_REGION` is mandatory; `STORAGE_ENDPOINT` is optional —
+ * defaults to the AWS regional endpoint when unset).
+ *
+ * **No mint methods here** — and the reason is no longer the one this
+ * block used to give. It said per-app credentials were out of scope
+ * "because the engine adapter uses a single shared SDK client", which
+ * stopped being true when the adapter moved to a credential provider that
+ * rebuilds its client whenever the credential changes. Per-application
+ * isolation exists; what is missing for AWS is only the broker's ability
+ * to speak AWS STS.
+ *
+ * Nor should the missing piece be per-app IAM users or roles, which is
+ * what this block previously anticipated. The MinIO path deliberately
+ * rejected long-lived per-principal accounts in favour of `AssumeRole`
+ * with an inline session policy — nothing long-lived exists to leak, and
+ * credential-rotation safety dissolves instead of needing a design. The
+ * AWS equivalent is the same shape: `AssumeRole` against a role ARN the
+ * operator supplies, with a session policy confining the principal to
+ * `applications/<applicationId>/`. That role ARN is the one input the
+ * broker does not have today, and is the whole of the gap.
+ */
+import { InfraProviderModule } from '@wildo-ai/platform-config-lib';
+export declare const AwsS3InfraProviderModule: InfraProviderModule;
+//# sourceMappingURL=aws-s3.infra.module.d.ts.map

package/dist/esm/aws-s3/aws-s3.infra.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-s3.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/aws-s3/aws-s3.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAIL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAEvC,eAAO,MAAM,wBAAwB,EAAE,mBAkDtC,CAAC"}

package/dist/esm/aws-s3/aws-s3.infra.module.js

@@ -0,0 +1,110 @@
+/**
+ * `AwsS3InfraProviderModule` — seventh concrete `InfraProviderModule`
+ * (Slice 5.1 of `infra-provider-planner.md`).
+ *
+ * Implements the `AWS_S3` `InfraProvider`. Shares the one-bucket,
+ * prefix-namespaced object layout of `MinioSelfInfraProviderModule` —
+ * the only differences are (a) no compose / K8s contribution (S3 is
+ * managed), and (b) the bucket endpoint is the regional AWS hostname
+ * instead of the in-cluster `minio` service.
+ *
+ * ## ⚠️ NOT USABLE TODAY — selecting this provider leaves apps with no
+ * storage credential (2026-08-10)
+ *
+ * The application-tier `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` env
+ * vars were removed **for every provider**: they were the object store's
+ * ROOT pair, handed to every app, minion and worker. Applications now
+ * obtain short-lived, prefix-confined credentials from apps-manager.
+ *
+ * That replacement is implemented for **MinIO only**. apps-manager's
+ * `ObjectStorageStsBrokerService` speaks MinIO's STS `AssumeRole` with an
+ * inline session policy; AWS STS requires a role ARN the broker does not
+ * supply, so an `AWS_S3` deployment would fail at storage initialisation
+ * with no credential and no path to one.
+ *
+ * No environment selects this provider today (every example uses
+ * `BackingServiceSource.SELF` → MinIO), which is why this is recorded as
+ * a gap rather than an outage. But it IS reachable — `s3: { source:
+ * MANAGED }` or `provider: 'aws'` resolves here — so **do not select
+ * `AWS_S3` until the AWS STS path exists.** Tracked in
+ * `.claude/plans/object-storage-root-credential-distribution.md`.
+ *
+ * The module still reuses the `STORAGE_*` env contract for the
+ * NON-secret values (endpoint, region, bucket, provider); it is only the
+ * credential half that is gone.
+ *
+ * **Why this module exists despite "no compose / no mint"**: it
+ * gives the lockfile a stable digest entry (so a switch from
+ * `minio-self` to `aws-s3` shows up as a `wildo lock check` drift)
+ * AND it formalizes which env vars the operator must set for AWS
+ * (`STORAGE_REGION` is mandatory; `STORAGE_ENDPOINT` is optional —
+ * defaults to the AWS regional endpoint when unset).
+ *
+ * **No mint methods here** — and the reason is no longer the one this
+ * block used to give. It said per-app credentials were out of scope
+ * "because the engine adapter uses a single shared SDK client", which
+ * stopped being true when the adapter moved to a credential provider that
+ * rebuilds its client whenever the credential changes. Per-application
+ * isolation exists; what is missing for AWS is only the broker's ability
+ * to speak AWS STS.
+ *
+ * Nor should the missing piece be per-app IAM users or roles, which is
+ * what this block previously anticipated. The MinIO path deliberately
+ * rejected long-lived per-principal accounts in favour of `AssumeRole`
+ * with an inline session policy — nothing long-lived exists to leak, and
+ * credential-rotation safety dissolves instead of needing a design. The
+ * AWS equivalent is the same shape: `AssumeRole` against a role ARN the
+ * operator supplies, with a session policy confining the principal to
+ * `applications/<applicationId>/`. That role ARN is the one input the
+ * broker does not have today, and is the whole of the gap.
+ */
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, } from '@wildo-ai/platform-config-lib';
+export const AwsS3InfraProviderModule = {
+    provider: InfraProvider.AWS_S3,
+    supportedCapabilities: [InfraCapability.OBJECT_STORAGE],
+    /**
+     * Shared bucket, shared access key — no per-app credential is minted, so there is nothing
+     * per-principal to confine. Confinement for object storage is done by STS session policy at
+     * request time, not by a secret in the application blob.
+     */
+    perPrincipalSecretBlobPaths: [],
+    plan() {
+        return {
+            // No compose service — S3 is fully managed.
+            // No K8s manifest — same reason.
+            platformAdmin: {
+                envVars: {
+                    STORAGE_PROVIDER: 's3',
+                    // Endpoint and port have AWS defaults; operator may override
+                    // for region-specific or VPC-endpoint topologies via the
+                    // env's authored `backingServices.s3` config.
+                    STORAGE_USE_SSL: 'true',
+                },
+                secretEnvVars: [
+                    'STORAGE_ACCESS_KEY',
+                    'STORAGE_SECRET_KEY',
+                    // Region is sensitive-ish (deployment topology) and is
+                    // delivered via the secret env channel for symmetry with
+                    // the access keys, even though it's not strictly secret.
+                    // The legacy treatment was env-var, not secret-env-var; if
+                    // operators object, this can flip to `envVars` later
+                    // without breaking the contract.
+                    'STORAGE_REGION',
+                ],
+                consumers: [
+                    InfraPlatformAdminConsumer.APPS_MANAGER,
+                    InfraPlatformAdminConsumer.COMPANION,
+                ],
+            },
+            // Same shared bucket as MinIO_Self. Apps receive the NON-secret
+            // `STORAGE_*` values via the bootstrap env contract; the credential
+            // half is no longer emitted for any provider — see the ⚠️ block in
+            // this module's JSDoc for why that makes AWS_S3 currently unusable.
+        };
+    },
+    // No `mintAppCredentials` / `revokeAppCredentials` — not because the model
+    // is shared-bucket (it is, but that is not the reason), but because
+    // per-application isolation is delivered by BROKERED STS SESSIONS rather than
+    // by minted long-lived accounts. See this module's JSDoc.
+};
+//# sourceMappingURL=aws-s3.infra.module.js.map

package/dist/esm/aws-s3/aws-s3.infra.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-s3.infra.module.js","sourceRoot":"","sources":["../../../../src/aws-s3/aws-s3.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,aAAa,GAGd,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,MAAM,wBAAwB,GAAwB;IAC3D,QAAQ,EAAE,aAAa,CAAC,MAAM;IAC9B,qBAAqB,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC;IAEvD;;;;OAIG;IACH,2BAA2B,EAAE,EAAE;IAE/B,IAAI;QACF,OAAO;YACL,4CAA4C;YAC5C,iCAAiC;YACjC,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,gBAAgB,EAAE,IAAI;oBACtB,6DAA6D;oBAC7D,yDAAyD;oBACzD,8CAA8C;oBAC9C,eAAe,EAAE,MAAM;iBACxB;gBACD,aAAa,EAAE;oBACb,oBAAoB;oBACpB,oBAAoB;oBACpB,uDAAuD;oBACvD,yDAAyD;oBACzD,yDAAyD;oBACzD,2DAA2D;oBAC3D,qDAAqD;oBACrD,iCAAiC;oBACjC,gBAAgB;iBACjB;gBACD,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,gEAAgE;YAChE,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;SACrE,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,oEAAoE;IACpE,8EAA8E;IAC9E,0DAA0D;CAC3D,CAAC","sourcesContent":["/**\n * `AwsS3InfraProviderModule` — seventh concrete `InfraProviderModule`\n * (Slice 5.1 of `infra-provider-planner.md`).\n *\n * Implements the `AWS_S3` `InfraProvider`. Shares the one-bucket,\n * prefix-namespaced object layout of `MinioSelfInfraProviderModule` —\n * the only differences are (a) no compose / K8s contribution (S3 is\n * managed), and (b) the bucket endpoint is the regional AWS hostname\n * instead of the in-cluster `minio` service.\n *\n * ## ⚠️ NOT USABLE TODAY — selecting this provider leaves apps with no\n * storage credential (2026-08-10)\n *\n * The application-tier `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` env\n * vars were removed **for every provider**: they were the object store's\n * ROOT pair, handed to every app, minion and worker. Applications now\n * obtain short-lived, prefix-confined credentials from apps-manager.\n *\n * That replacement is implemented for **MinIO only**. apps-manager's\n * `ObjectStorageStsBrokerService` speaks MinIO's STS `AssumeRole` with an\n * inline session policy; AWS STS requires a role ARN the broker does not\n * supply, so an `AWS_S3` deployment would fail at storage initialisation\n * with no credential and no path to one.\n *\n * No environment selects this provider today (every example uses\n * `BackingServiceSource.SELF` → MinIO), which is why this is recorded as\n * a gap rather than an outage. But it IS reachable — `s3: { source:\n * MANAGED }` or `provider: 'aws'` resolves here — so **do not select\n * `AWS_S3` until the AWS STS path exists.** Tracked in\n * `.claude/plans/object-storage-root-credential-distribution.md`.\n *\n * The module still reuses the `STORAGE_*` env contract for the\n * NON-secret values (endpoint, region, bucket, provider); it is only the\n * credential half that is gone.\n *\n * **Why this module exists despite \"no compose / no mint\"**: it\n * gives the lockfile a stable digest entry (so a switch from\n * `minio-self` to `aws-s3` shows up as a `wildo lock check` drift)\n * AND it formalizes which env vars the operator must set for AWS\n * (`STORAGE_REGION` is mandatory; `STORAGE_ENDPOINT` is optional —\n * defaults to the AWS regional endpoint when unset).\n *\n * **No mint methods here** — and the reason is no longer the one this\n * block used to give. It said per-app credentials were out of scope\n * \"because the engine adapter uses a single shared SDK client\", which\n * stopped being true when the adapter moved to a credential provider that\n * rebuilds its client whenever the credential changes. Per-application\n * isolation exists; what is missing for AWS is only the broker's ability\n * to speak AWS STS.\n *\n * Nor should the missing piece be per-app IAM users or roles, which is\n * what this block previously anticipated. The MinIO path deliberately\n * rejected long-lived per-principal accounts in favour of `AssumeRole`\n * with an inline session policy — nothing long-lived exists to leak, and\n * credential-rotation safety dissolves instead of needing a design. The\n * AWS equivalent is the same shape: `AssumeRole` against a role ARN the\n * operator supplies, with a session policy confining the principal to\n * `applications/<applicationId>/`. That role ARN is the one input the\n * broker does not have today, and is the whole of the gap.\n */\n\nimport {\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n} from '@wildo-ai/platform-config-lib';\n\nexport const AwsS3InfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.AWS_S3,\n  supportedCapabilities: [InfraCapability.OBJECT_STORAGE],\n\n  /**\n   * Shared bucket, shared access key — no per-app credential is minted, so there is nothing\n   * per-principal to confine. Confinement for object storage is done by STS session policy at\n   * request time, not by a secret in the application blob.\n   */\n  perPrincipalSecretBlobPaths: [],\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      // No compose service — S3 is fully managed.\n      // No K8s manifest — same reason.\n      platformAdmin: {\n        envVars: {\n          STORAGE_PROVIDER: 's3',\n          // Endpoint and port have AWS defaults; operator may override\n          // for region-specific or VPC-endpoint topologies via the\n          // env's authored `backingServices.s3` config.\n          STORAGE_USE_SSL: 'true',\n        },\n        secretEnvVars: [\n          'STORAGE_ACCESS_KEY',\n          'STORAGE_SECRET_KEY',\n          // Region is sensitive-ish (deployment topology) and is\n          // delivered via the secret env channel for symmetry with\n          // the access keys, even though it's not strictly secret.\n          // The legacy treatment was env-var, not secret-env-var; if\n          // operators object, this can flip to `envVars` later\n          // without breaking the contract.\n          'STORAGE_REGION',\n        ],\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      // Same shared bucket as MinIO_Self. Apps receive the NON-secret\n      // `STORAGE_*` values via the bootstrap env contract; the credential\n      // half is no longer emitted for any provider — see the ⚠️ block in\n      // this module's JSDoc for why that makes AWS_S3 currently unusable.\n    };\n  },\n\n  // No `mintAppCredentials` / `revokeAppCredentials` — not because the model\n  // is shared-bucket (it is, but that is not the reason), but because\n  // per-application isolation is delivered by BROKERED STS SESSIONS rather than\n  // by minted long-lived accounts. See this module's JSDoc.\n};\n"]}

package/dist/esm/clamav-self/clamav-self.infra.module.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `ClamavSelfInfraProviderModule` — eighth concrete `InfraProviderModule`
+ * (Slice 5.2 of `infra-provider-planner.md`).
+ *
+ * Implements the `CLAMAV_SELF` `InfraProvider`. **Stateless**: ClamAV
+ * is a network virus-scanning service with no auth and no per-tenant
+ * state. Apps connect to the shared host:port and submit files for
+ * scanning over the ClamAV protocol; nothing is persisted, nothing
+ * is per-app. The module's only job is to declare the resource +
+ * env vars in `plan()`; there are no `mintAppCredentials`,
+ * `revokeAppCredentials`, or `mintPlatformServiceCredentials`
+ * methods because there are no credentials.
+ *
+ * **Apps consume**: `CLAMAV_HOST`, `CLAMAV_PORT` env vars (delivered
+ * via the bootstrap env contract). The engine's antivirus-scanning
+ * adapter (`saas-backend-lib/.../antivirus/...`) opens a TCP
+ * connection per scan request.
+ *
+ * **Why declare it as a module at all (vs. inline compose service)?**
+ * The module gives the lockfile a stable `planContributionDigest`
+ * for `ANTIVIRUS_SCANNING` so `wildo lock check` catches drift in
+ * the ClamAV resource shape (port change, env-var rename, K8s
+ * manifest move). Without a module, the digest would be the
+ * authored-entry digest (which is empty — ClamAV has no configurable
+ * `BackingService` shape today, just the `BackingServiceKind`
+ * enum value).
+ */
+import { InfraProviderModule } from '@wildo-ai/platform-config-lib';
+export declare const ClamavSelfInfraProviderModule: InfraProviderModule;
+//# sourceMappingURL=clamav-self.infra.module.d.ts.map

package/dist/esm/clamav-self/clamav-self.infra.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clamav-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/clamav-self/clamav-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAIL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAIvC,eAAO,MAAM,6BAA6B,EAAE,mBAiC3C,CAAC"}

package/dist/esm/clamav-self/clamav-self.infra.module.js

@@ -0,0 +1,61 @@
+/**
+ * `ClamavSelfInfraProviderModule` — eighth concrete `InfraProviderModule`
+ * (Slice 5.2 of `infra-provider-planner.md`).
+ *
+ * Implements the `CLAMAV_SELF` `InfraProvider`. **Stateless**: ClamAV
+ * is a network virus-scanning service with no auth and no per-tenant
+ * state. Apps connect to the shared host:port and submit files for
+ * scanning over the ClamAV protocol; nothing is persisted, nothing
+ * is per-app. The module's only job is to declare the resource +
+ * env vars in `plan()`; there are no `mintAppCredentials`,
+ * `revokeAppCredentials`, or `mintPlatformServiceCredentials`
+ * methods because there are no credentials.
+ *
+ * **Apps consume**: `CLAMAV_HOST`, `CLAMAV_PORT` env vars (delivered
+ * via the bootstrap env contract). The engine's antivirus-scanning
+ * adapter (`saas-backend-lib/.../antivirus/...`) opens a TCP
+ * connection per scan request.
+ *
+ * **Why declare it as a module at all (vs. inline compose service)?**
+ * The module gives the lockfile a stable `planContributionDigest`
+ * for `ANTIVIRUS_SCANNING` so `wildo lock check` catches drift in
+ * the ClamAV resource shape (port change, env-var rename, K8s
+ * manifest move). Without a module, the digest would be the
+ * authored-entry digest (which is empty — ClamAV has no configurable
+ * `BackingService` shape today, just the `BackingServiceKind`
+ * enum value).
+ */
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, } from '@wildo-ai/platform-config-lib';
+const DEFAULT_CLAMAV_PORT = 3310;
+export const ClamavSelfInfraProviderModule = {
+    provider: InfraProvider.CLAMAV_SELF,
+    supportedCapabilities: [InfraCapability.ANTIVIRUS_SCANNING],
+    /**
+     * Stateless infra with no authentication and no per-app state — `plan()` only.
+     */
+    perPrincipalSecretBlobPaths: [],
+    plan() {
+        return {
+            dockerComposeServices: ['clamav'],
+            k8sResources: ['templates/infra/k8s/internal/clamav/deployment.yaml.hbs'],
+            platformAdmin: {
+                envVars: {
+                    CLAMAV_HOST: 'clamav',
+                    CLAMAV_PORT: String(DEFAULT_CLAMAV_PORT),
+                },
+                // No secret env vars — ClamAV has no auth.
+                // Audience-1 declared so the planner emits the env vars to
+                // both apps-manager and companion (companion runs scans
+                // locally during dev for parity with prod behavior).
+                consumers: [
+                    InfraPlatformAdminConsumer.APPS_MANAGER,
+                    InfraPlatformAdminConsumer.COMPANION,
+                ],
+            },
+            // No `appRuntime` blob paths — apps connect via the same
+            // `CLAMAV_HOST:CLAMAV_PORT` regardless of app identity.
+        };
+    },
+    // No mint methods — ClamAV is stateless.
+};
+//# sourceMappingURL=clamav-self.infra.module.js.map

package/dist/esm/clamav-self/clamav-self.infra.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clamav-self.infra.module.js","sourceRoot":"","sources":["../../../../src/clamav-self/clamav-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,aAAa,GAGd,MAAM,+BAA+B,CAAC;AAEvC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,CAAC,MAAM,6BAA6B,GAAwB;IAChE,QAAQ,EAAE,aAAa,CAAC,WAAW;IACnC,qBAAqB,EAAE,CAAC,eAAe,CAAC,kBAAkB,CAAC;IAE3D;;OAEG;IACH,2BAA2B,EAAE,EAAE;IAE/B,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,QAAQ,CAAC;YACjC,YAAY,EAAE,CAAC,yDAAyD,CAAC;YACzE,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,WAAW,EAAE,QAAQ;oBACrB,WAAW,EAAE,MAAM,CAAC,mBAAmB,CAAC;iBACzC;gBACD,2CAA2C;gBAC3C,2DAA2D;gBAC3D,wDAAwD;gBACxD,qDAAqD;gBACrD,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,yDAAyD;YACzD,wDAAwD;SACzD,CAAC;IACJ,CAAC;IAED,yCAAyC;CAC1C,CAAC","sourcesContent":["/**\n * `ClamavSelfInfraProviderModule` — eighth concrete `InfraProviderModule`\n * (Slice 5.2 of `infra-provider-planner.md`).\n *\n * Implements the `CLAMAV_SELF` `InfraProvider`. **Stateless**: ClamAV\n * is a network virus-scanning service with no auth and no per-tenant\n * state. Apps connect to the shared host:port and submit files for\n * scanning over the ClamAV protocol; nothing is persisted, nothing\n * is per-app. The module's only job is to declare the resource +\n * env vars in `plan()`; there are no `mintAppCredentials`,\n * `revokeAppCredentials`, or `mintPlatformServiceCredentials`\n * methods because there are no credentials.\n *\n * **Apps consume**: `CLAMAV_HOST`, `CLAMAV_PORT` env vars (delivered\n * via the bootstrap env contract). The engine's antivirus-scanning\n * adapter (`saas-backend-lib/.../antivirus/...`) opens a TCP\n * connection per scan request.\n *\n * **Why declare it as a module at all (vs. inline compose service)?**\n * The module gives the lockfile a stable `planContributionDigest`\n * for `ANTIVIRUS_SCANNING` so `wildo lock check` catches drift in\n * the ClamAV resource shape (port change, env-var rename, K8s\n * manifest move). Without a module, the digest would be the\n * authored-entry digest (which is empty — ClamAV has no configurable\n * `BackingService` shape today, just the `BackingServiceKind`\n * enum value).\n */\n\nimport {\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n} from '@wildo-ai/platform-config-lib';\n\nconst DEFAULT_CLAMAV_PORT = 3310;\n\nexport const ClamavSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.CLAMAV_SELF,\n  supportedCapabilities: [InfraCapability.ANTIVIRUS_SCANNING],\n\n  /**\n   * Stateless infra with no authentication and no per-app state — `plan()` only.\n   */\n  perPrincipalSecretBlobPaths: [],\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['clamav'],\n      k8sResources: ['templates/infra/k8s/internal/clamav/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {\n          CLAMAV_HOST: 'clamav',\n          CLAMAV_PORT: String(DEFAULT_CLAMAV_PORT),\n        },\n        // No secret env vars — ClamAV has no auth.\n        // Audience-1 declared so the planner emits the env vars to\n        // both apps-manager and companion (companion runs scans\n        // locally during dev for parity with prod behavior).\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      // No `appRuntime` blob paths — apps connect via the same\n      // `CLAMAV_HOST:CLAMAV_PORT` regardless of app identity.\n    };\n  },\n\n  // No mint methods — ClamAV is stateless.\n};\n"]}

package/dist/esm/gotenberg-self/gotenberg-self.infra.module.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `GotenbergSelfInfraProviderModule` — ninth concrete
+ * `InfraProviderModule` (Slice 5.3 of `infra-provider-planner.md`).
+ *
+ * Implements the `GOTENBERG_SELF` `InfraProvider`. **Stateless**:
+ * Gotenberg is a network HTML-to-PDF rendering service with no auth
+ * and no per-tenant state. Apps POST HTML/Office docs and receive
+ * rendered PDFs; nothing is persisted server-side. Same shape as
+ * `ClamavSelfInfraProviderModule` — `plan()` only, no mint methods.
+ *
+ * **Apps consume**: `GOTENBERG_HOST`, `GOTENBERG_PORT` env vars (TBD
+ * naming — current engine adapter reads these from
+ * `BackingServicesEnvConfig` via the catalog at
+ * `wildo-cli/.../service-catalog.schemas.ts:78`). The plan emits
+ * the env vars under those names.
+ *
+ * **Two ports** (Slice 5.3 design note): Gotenberg exposes both a
+ * public port (3000 by default) for HTTP API access and an internal
+ * port (3001) for health-check/metrics. The CLI's docker-compose
+ * generator already wires both. The module's `plan()` only emits
+ * the public port — the internal port is a docker-compose-only
+ * concern and isn't part of the customer-app env-var surface.
+ */
+import { InfraProviderModule } from '@wildo-ai/platform-config-lib';
+export declare const GotenbergSelfInfraProviderModule: InfraProviderModule;
+//# sourceMappingURL=gotenberg-self.infra.module.d.ts.map

package/dist/esm/gotenberg-self/gotenberg-self.infra.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gotenberg-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/gotenberg-self/gotenberg-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAIL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAIvC,eAAO,MAAM,gCAAgC,EAAE,mBA8B9C,CAAC"}

package/dist/esm/gotenberg-self/gotenberg-self.infra.module.js

@@ -0,0 +1,54 @@
+/**
+ * `GotenbergSelfInfraProviderModule` — ninth concrete
+ * `InfraProviderModule` (Slice 5.3 of `infra-provider-planner.md`).
+ *
+ * Implements the `GOTENBERG_SELF` `InfraProvider`. **Stateless**:
+ * Gotenberg is a network HTML-to-PDF rendering service with no auth
+ * and no per-tenant state. Apps POST HTML/Office docs and receive
+ * rendered PDFs; nothing is persisted server-side. Same shape as
+ * `ClamavSelfInfraProviderModule` — `plan()` only, no mint methods.
+ *
+ * **Apps consume**: `GOTENBERG_HOST`, `GOTENBERG_PORT` env vars (TBD
+ * naming — current engine adapter reads these from
+ * `BackingServicesEnvConfig` via the catalog at
+ * `wildo-cli/.../service-catalog.schemas.ts:78`). The plan emits
+ * the env vars under those names.
+ *
+ * **Two ports** (Slice 5.3 design note): Gotenberg exposes both a
+ * public port (3000 by default) for HTTP API access and an internal
+ * port (3001) for health-check/metrics. The CLI's docker-compose
+ * generator already wires both. The module's `plan()` only emits
+ * the public port — the internal port is a docker-compose-only
+ * concern and isn't part of the customer-app env-var surface.
+ */
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, } from '@wildo-ai/platform-config-lib';
+const DEFAULT_GOTENBERG_PORT = 3000;
+export const GotenbergSelfInfraProviderModule = {
+    provider: InfraProvider.GOTENBERG_SELF,
+    supportedCapabilities: [InfraCapability.DOCUMENT_RENDERING],
+    /**
+     * Stateless infra with no authentication and no per-app state — `plan()` only.
+     */
+    perPrincipalSecretBlobPaths: [],
+    plan() {
+        return {
+            dockerComposeServices: ['gotenberg'],
+            k8sResources: ['templates/infra/k8s/internal/gotenberg/deployment.yaml.hbs'],
+            platformAdmin: {
+                envVars: {
+                    GOTENBERG_HOST: 'gotenberg',
+                    GOTENBERG_PORT: String(DEFAULT_GOTENBERG_PORT),
+                },
+                // No secret env vars — Gotenberg has no auth.
+                consumers: [
+                    InfraPlatformAdminConsumer.APPS_MANAGER,
+                    InfraPlatformAdminConsumer.COMPANION,
+                ],
+            },
+            // No `appRuntime` blob paths — apps connect via the same
+            // `GOTENBERG_HOST:GOTENBERG_PORT` regardless of app identity.
+        };
+    },
+    // No mint methods — Gotenberg is stateless.
+};
+//# sourceMappingURL=gotenberg-self.infra.module.js.map

package/dist/esm/gotenberg-self/gotenberg-self.infra.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gotenberg-self.infra.module.js","sourceRoot":"","sources":["../../../../src/gotenberg-self/gotenberg-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,aAAa,GAGd,MAAM,+BAA+B,CAAC;AAEvC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,MAAM,CAAC,MAAM,gCAAgC,GAAwB;IACnE,QAAQ,EAAE,aAAa,CAAC,cAAc;IACtC,qBAAqB,EAAE,CAAC,eAAe,CAAC,kBAAkB,CAAC;IAE3D;;OAEG;IACH,2BAA2B,EAAE,EAAE;IAE/B,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,WAAW,CAAC;YACpC,YAAY,EAAE,CAAC,4DAA4D,CAAC;YAC5E,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,cAAc,EAAE,WAAW;oBAC3B,cAAc,EAAE,MAAM,CAAC,sBAAsB,CAAC;iBAC/C;gBACD,8CAA8C;gBAC9C,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,yDAAyD;YACzD,8DAA8D;SAC/D,CAAC;IACJ,CAAC;IAED,4CAA4C;CAC7C,CAAC","sourcesContent":["/**\n * `GotenbergSelfInfraProviderModule` — ninth concrete\n * `InfraProviderModule` (Slice 5.3 of `infra-provider-planner.md`).\n *\n * Implements the `GOTENBERG_SELF` `InfraProvider`. **Stateless**:\n * Gotenberg is a network HTML-to-PDF rendering service with no auth\n * and no per-tenant state. Apps POST HTML/Office docs and receive\n * rendered PDFs; nothing is persisted server-side. Same shape as\n * `ClamavSelfInfraProviderModule` — `plan()` only, no mint methods.\n *\n * **Apps consume**: `GOTENBERG_HOST`, `GOTENBERG_PORT` env vars (TBD\n * naming — current engine adapter reads these from\n * `BackingServicesEnvConfig` via the catalog at\n * `wildo-cli/.../service-catalog.schemas.ts:78`). The plan emits\n * the env vars under those names.\n *\n * **Two ports** (Slice 5.3 design note): Gotenberg exposes both a\n * public port (3000 by default) for HTTP API access and an internal\n * port (3001) for health-check/metrics. The CLI's docker-compose\n * generator already wires both. The module's `plan()` only emits\n * the public port — the internal port is a docker-compose-only\n * concern and isn't part of the customer-app env-var surface.\n */\n\nimport {\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n} from '@wildo-ai/platform-config-lib';\n\nconst DEFAULT_GOTENBERG_PORT = 3000;\n\nexport const GotenbergSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.GOTENBERG_SELF,\n  supportedCapabilities: [InfraCapability.DOCUMENT_RENDERING],\n\n  /**\n   * Stateless infra with no authentication and no per-app state — `plan()` only.\n   */\n  perPrincipalSecretBlobPaths: [],\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['gotenberg'],\n      k8sResources: ['templates/infra/k8s/internal/gotenberg/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {\n          GOTENBERG_HOST: 'gotenberg',\n          GOTENBERG_PORT: String(DEFAULT_GOTENBERG_PORT),\n        },\n        // No secret env vars — Gotenberg has no auth.\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      // No `appRuntime` blob paths — apps connect via the same\n      // `GOTENBERG_HOST:GOTENBERG_PORT` regardless of app identity.\n    };\n  },\n\n  // No mint methods — Gotenberg is stateless.\n};\n"]}

package/dist/esm/index.d.ts

@@ -0,0 +1,88 @@
+/**
+ * `@wildo-ai/platform-infra-providers` — concrete `InfraProviderModule`
+ * catalog (Slice 2.5c-1 of `infra-provider-planner.md`).
+ *
+ * Tier-portable: the modules import only `@wildo-ai/platform-config-lib`
+ * (contracts) and have no DI / mongoose / axios runtime dependencies.
+ * This lets both `platform-apps-manager` (orchestrator) and
+ * `wildo-cli` (lockfile materializer) consume the same module
+ * objects — apps-manager passes a real admin-client implementation
+ * via `AppCredentialMintingContext.adminClient`; wildo-cli only
+ * needs `module.plan()` for the lockfile digest.
+ *
+ * Each module is exported by name (no intermediary barrels per
+ * platform/CLAUDE.md "no intermediary index.ts barrels"). The
+ * `INFRA_PROVIDER_MODULES` map below is the canonical catalog —
+ * consumers iterate it (or look up by `InfraProvider` value) instead
+ * of importing modules one by one.
+ */
+import type { InfraProvider, InfraProviderModule } from '@wildo-ai/platform-config-lib';
+export { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module';
+export { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module';
+export { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module';
+export { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module';
+export { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module';
+export { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module';
+export { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module';
+export { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module';
+export { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module';
+/**
+ * Canonical `InfraProvider` → `InfraProviderModule` catalog. Caller
+ * (CLI, apps-manager) builds a `Map<InfraProvider, InfraProviderModule>`
+ * from this constant when threading modules into
+ * `materializeInfraSection`.
+ *
+ * **Why a const array instead of a `Map` literal**: arrays serialize
+ * stably under tsc and roll up to a deterministic order. The
+ * downstream `Map` is built once at program start; the catalog
+ * itself is a value-level fixture.
+ *
+ * **Coverage** (Slice 5 baseline, 2026-05-10):
+ * - `RABBITMQ_SELF`, `REDIS_SELF`, `POSTGRES_SELF`, `MONGODB_SELF`,
+ *   `MONGODB_ATLAS` — five stateful modules with mint/revoke
+ *   methods.
+ * - `MINIO_SELF`, `AWS_S3` — object storage (shared-bucket model;
+ *   no per-app credentials).
+ * - `CLAMAV_SELF`, `GOTENBERG_SELF` — stateless infra (no auth, no
+ *   per-app state; `plan()` only).
+ *
+ * **NOT covered** (catalog entries without modules):
+ * - `POSTGRES_MANAGED`, `POSTGRES_AWS_RDS`, `POSTGRES_GCP_CLOUD_SQL`,
+ *   `POSTGRES_AZURE_DATABASE`, `POSTGRES_SUPABASE`, `POSTGRES_NEON`,
+ *   `POSTGRES_RENDER` — managed-Postgres brand catalog entries
+ *   (Slice 4.B.0). No module yet; trigger = real customer.
+ *
+ * `materializeInfraSection` falls back to the authored-entry digest
+ * when a selected `InfraProvider` is not in the map (preserves the
+ * Slice 2.5b behavior for uncovered providers).
+ */
+export declare const INFRA_PROVIDER_MODULES: ReadonlyArray<InfraProviderModule>;
+/**
+ * Every `Wildo_Application_Secrets` JSON path that ANY provider module can mint per runtime
+ * principal — the union of the catalog's own static declarations.
+ *
+ * ## Why this is derived rather than written down
+ *
+ * The consumer is the secret-DELIVERY path in apps-manager: it strips exactly this set from the
+ * application blob before overlaying a principal's own material, so a principal receives a
+ * credential only where one was minted FOR IT. A hand-maintained copy at that consumer would be a
+ * second source — add a provider that mints a new credential path and delivery keeps shipping the
+ * APPLICATION's value for it, silently. That is the defect class this repo has paid for twice: the
+ * party that CONSTRAINS is not the party that DECLARES.
+ *
+ * Derived from `INFRA_PROVIDER_MODULES`, so a new module is covered the day it enters the catalog.
+ *
+ * Deliberately the union across ALL modules, not the ones a given application selected: a principal
+ * must not receive an application-wide credential for a provider it does not use either, and the
+ * selected set is not knowable at the delivery call site without threading app config through it.
+ * Stripping a path no module minted for this app is harmless — it is absent from the blob anyway.
+ */
+export declare function collectPerPrincipalSecretBlobPaths(): ReadonlySet<string>;
+/**
+ * Build a `Map<InfraProvider, InfraProviderModule>` for the
+ * canonical catalog. Callers store the result once at startup and
+ * pass it to `materializeInfraSection` (digest derivation) or to
+ * orchestrator paths that look up modules by `InfraProvider`.
+ */
+export declare function buildInfraProviderModuleMap(): ReadonlyMap<InfraProvider, InfraProviderModule>;
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAaxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,sBAAsB,EAAE,aAAa,CAAC,mBAAmB,CAUrE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kCAAkC,IAAI,WAAW,CAAC,MAAM,CAAC,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,WAAW,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAY7F"}