@wildo-ai/platform-infra-providers 1.1.2

package/dist/esm/index.js

@@ -0,0 +1,125 @@
+/**
+ * `@wildo-ai/platform-infra-providers` — concrete `InfraProviderModule`
+ * catalog (Slice 2.5c-1 of `infra-provider-planner.md`).
+ *
+ * Tier-portable: the modules import only `@wildo-ai/platform-config-lib`
+ * (contracts) and have no DI / mongoose / axios runtime dependencies.
+ * This lets both `platform-apps-manager` (orchestrator) and
+ * `wildo-cli` (lockfile materializer) consume the same module
+ * objects — apps-manager passes a real admin-client implementation
+ * via `AppCredentialMintingContext.adminClient`; wildo-cli only
+ * needs `module.plan()` for the lockfile digest.
+ *
+ * Each module is exported by name (no intermediary barrels per
+ * platform/CLAUDE.md "no intermediary index.ts barrels"). The
+ * `INFRA_PROVIDER_MODULES` map below is the canonical catalog —
+ * consumers iterate it (or look up by `InfraProvider` value) instead
+ * of importing modules one by one.
+ */
+import { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module.js';
+import { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module.js';
+import { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module.js';
+import { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module.js';
+import { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module.js';
+// Slice 5 of `infra-provider-planner.md` — object-storage + stateless infra.
+import { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module.js';
+import { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module.js';
+import { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module.js';
+import { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module.js';
+export { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module.js';
+export { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module.js';
+export { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module.js';
+export { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module.js';
+export { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module.js';
+export { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module.js';
+export { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module.js';
+export { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module.js';
+export { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module.js';
+/**
+ * Canonical `InfraProvider` → `InfraProviderModule` catalog. Caller
+ * (CLI, apps-manager) builds a `Map<InfraProvider, InfraProviderModule>`
+ * from this constant when threading modules into
+ * `materializeInfraSection`.
+ *
+ * **Why a const array instead of a `Map` literal**: arrays serialize
+ * stably under tsc and roll up to a deterministic order. The
+ * downstream `Map` is built once at program start; the catalog
+ * itself is a value-level fixture.
+ *
+ * **Coverage** (Slice 5 baseline, 2026-05-10):
+ * - `RABBITMQ_SELF`, `REDIS_SELF`, `POSTGRES_SELF`, `MONGODB_SELF`,
+ *   `MONGODB_ATLAS` — five stateful modules with mint/revoke
+ *   methods.
+ * - `MINIO_SELF`, `AWS_S3` — object storage (shared-bucket model;
+ *   no per-app credentials).
+ * - `CLAMAV_SELF`, `GOTENBERG_SELF` — stateless infra (no auth, no
+ *   per-app state; `plan()` only).
+ *
+ * **NOT covered** (catalog entries without modules):
+ * - `POSTGRES_MANAGED`, `POSTGRES_AWS_RDS`, `POSTGRES_GCP_CLOUD_SQL`,
+ *   `POSTGRES_AZURE_DATABASE`, `POSTGRES_SUPABASE`, `POSTGRES_NEON`,
+ *   `POSTGRES_RENDER` — managed-Postgres brand catalog entries
+ *   (Slice 4.B.0). No module yet; trigger = real customer.
+ *
+ * `materializeInfraSection` falls back to the authored-entry digest
+ * when a selected `InfraProvider` is not in the map (preserves the
+ * Slice 2.5b behavior for uncovered providers).
+ */
+export const INFRA_PROVIDER_MODULES = [
+    RabbitmqSelfInfraProviderModule,
+    RedisSelfInfraProviderModule,
+    PostgresSelfInfraProviderModule,
+    MongodbAtlasInfraProviderModule,
+    MongodbSelfInfraProviderModule,
+    MinioSelfInfraProviderModule,
+    AwsS3InfraProviderModule,
+    ClamavSelfInfraProviderModule,
+    GotenbergSelfInfraProviderModule,
+];
+/**
+ * Every `Wildo_Application_Secrets` JSON path that ANY provider module can mint per runtime
+ * principal — the union of the catalog's own static declarations.
+ *
+ * ## Why this is derived rather than written down
+ *
+ * The consumer is the secret-DELIVERY path in apps-manager: it strips exactly this set from the
+ * application blob before overlaying a principal's own material, so a principal receives a
+ * credential only where one was minted FOR IT. A hand-maintained copy at that consumer would be a
+ * second source — add a provider that mints a new credential path and delivery keeps shipping the
+ * APPLICATION's value for it, silently. That is the defect class this repo has paid for twice: the
+ * party that CONSTRAINS is not the party that DECLARES.
+ *
+ * Derived from `INFRA_PROVIDER_MODULES`, so a new module is covered the day it enters the catalog.
+ *
+ * Deliberately the union across ALL modules, not the ones a given application selected: a principal
+ * must not receive an application-wide credential for a provider it does not use either, and the
+ * selected set is not knowable at the delivery call site without threading app config through it.
+ * Stripping a path no module minted for this app is harmless — it is absent from the blob anyway.
+ */
+export function collectPerPrincipalSecretBlobPaths() {
+    const paths = new Set();
+    for (const module of INFRA_PROVIDER_MODULES) {
+        for (const path of module.perPrincipalSecretBlobPaths) {
+            paths.add(path);
+        }
+    }
+    return paths;
+}
+/**
+ * Build a `Map<InfraProvider, InfraProviderModule>` for the
+ * canonical catalog. Callers store the result once at startup and
+ * pass it to `materializeInfraSection` (digest derivation) or to
+ * orchestrator paths that look up modules by `InfraProvider`.
+ */
+export function buildInfraProviderModuleMap() {
+    const map = new Map();
+    for (const m of INFRA_PROVIDER_MODULES) {
+        if (map.has(m.provider)) {
+            throw new Error(`INFRA_PROVIDER_MODULES contains duplicate provider '${m.provider}' — ` +
+                `each InfraProvider may have at most one module.`);
+        }
+        map.set(m.provider, m);
+    }
+    return map;
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC;AAEhG,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,+BAA+B;IAC/B,4BAA4B;IAC5B,+BAA+B;IAC/B,+BAA+B;IAC/B,8BAA8B;IAC9B,4BAA4B;IAC5B,wBAAwB;IACxB,6BAA6B;IAC7B,gCAAgC;CACjC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,kCAAkC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACtD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,uDAAuD,CAAC,CAAC,QAAQ,MAAM;gBACvE,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * `@wildo-ai/platform-infra-providers` — concrete `InfraProviderModule`\n * catalog (Slice 2.5c-1 of `infra-provider-planner.md`).\n *\n * Tier-portable: the modules import only `@wildo-ai/platform-config-lib`\n * (contracts) and have no DI / mongoose / axios runtime dependencies.\n * This lets both `platform-apps-manager` (orchestrator) and\n * `wildo-cli` (lockfile materializer) consume the same module\n * objects — apps-manager passes a real admin-client implementation\n * via `AppCredentialMintingContext.adminClient`; wildo-cli only\n * needs `module.plan()` for the lockfile digest.\n *\n * Each module is exported by name (no intermediary barrels per\n * platform/CLAUDE.md \"no intermediary index.ts barrels\"). The\n * `INFRA_PROVIDER_MODULES` map below is the canonical catalog —\n * consumers iterate it (or look up by `InfraProvider` value) instead\n * of importing modules one by one.\n */\n\nimport type { InfraProvider, InfraProviderModule } from '@wildo-ai/platform-config-lib';\n\nimport { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module';\nimport { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module';\nimport { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module';\nimport { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module';\nimport { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module';\n// Slice 5 of `infra-provider-planner.md` — object-storage + stateless infra.\nimport { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module';\nimport { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module';\nimport { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module';\nimport { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module';\n\nexport { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module';\nexport { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module';\nexport { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module';\nexport { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module';\nexport { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module';\nexport { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module';\nexport { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module';\nexport { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module';\nexport { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module';\n\n/**\n * Canonical `InfraProvider` → `InfraProviderModule` catalog. Caller\n * (CLI, apps-manager) builds a `Map<InfraProvider, InfraProviderModule>`\n * from this constant when threading modules into\n * `materializeInfraSection`.\n *\n * **Why a const array instead of a `Map` literal**: arrays serialize\n * stably under tsc and roll up to a deterministic order. The\n * downstream `Map` is built once at program start; the catalog\n * itself is a value-level fixture.\n *\n * **Coverage** (Slice 5 baseline, 2026-05-10):\n * - `RABBITMQ_SELF`, `REDIS_SELF`, `POSTGRES_SELF`, `MONGODB_SELF`,\n *   `MONGODB_ATLAS` — five stateful modules with mint/revoke\n *   methods.\n * - `MINIO_SELF`, `AWS_S3` — object storage (shared-bucket model;\n *   no per-app credentials).\n * - `CLAMAV_SELF`, `GOTENBERG_SELF` — stateless infra (no auth, no\n *   per-app state; `plan()` only).\n *\n * **NOT covered** (catalog entries without modules):\n * - `POSTGRES_MANAGED`, `POSTGRES_AWS_RDS`, `POSTGRES_GCP_CLOUD_SQL`,\n *   `POSTGRES_AZURE_DATABASE`, `POSTGRES_SUPABASE`, `POSTGRES_NEON`,\n *   `POSTGRES_RENDER` — managed-Postgres brand catalog entries\n *   (Slice 4.B.0). No module yet; trigger = real customer.\n *\n * `materializeInfraSection` falls back to the authored-entry digest\n * when a selected `InfraProvider` is not in the map (preserves the\n * Slice 2.5b behavior for uncovered providers).\n */\nexport const INFRA_PROVIDER_MODULES: ReadonlyArray<InfraProviderModule> = [\n  RabbitmqSelfInfraProviderModule,\n  RedisSelfInfraProviderModule,\n  PostgresSelfInfraProviderModule,\n  MongodbAtlasInfraProviderModule,\n  MongodbSelfInfraProviderModule,\n  MinioSelfInfraProviderModule,\n  AwsS3InfraProviderModule,\n  ClamavSelfInfraProviderModule,\n  GotenbergSelfInfraProviderModule,\n];\n\n/**\n * Every `Wildo_Application_Secrets` JSON path that ANY provider module can mint per runtime\n * principal — the union of the catalog's own static declarations.\n *\n * ## Why this is derived rather than written down\n *\n * The consumer is the secret-DELIVERY path in apps-manager: it strips exactly this set from the\n * application blob before overlaying a principal's own material, so a principal receives a\n * credential only where one was minted FOR IT. A hand-maintained copy at that consumer would be a\n * second source — add a provider that mints a new credential path and delivery keeps shipping the\n * APPLICATION's value for it, silently. That is the defect class this repo has paid for twice: the\n * party that CONSTRAINS is not the party that DECLARES.\n *\n * Derived from `INFRA_PROVIDER_MODULES`, so a new module is covered the day it enters the catalog.\n *\n * Deliberately the union across ALL modules, not the ones a given application selected: a principal\n * must not receive an application-wide credential for a provider it does not use either, and the\n * selected set is not knowable at the delivery call site without threading app config through it.\n * Stripping a path no module minted for this app is harmless — it is absent from the blob anyway.\n */\nexport function collectPerPrincipalSecretBlobPaths(): ReadonlySet<string> {\n  const paths = new Set<string>();\n  for (const module of INFRA_PROVIDER_MODULES) {\n    for (const path of module.perPrincipalSecretBlobPaths) {\n      paths.add(path);\n    }\n  }\n  return paths;\n}\n\n/**\n * Build a `Map<InfraProvider, InfraProviderModule>` for the\n * canonical catalog. Callers store the result once at startup and\n * pass it to `materializeInfraSection` (digest derivation) or to\n * orchestrator paths that look up modules by `InfraProvider`.\n */\nexport function buildInfraProviderModuleMap(): ReadonlyMap<InfraProvider, InfraProviderModule> {\n  const map = new Map<InfraProvider, InfraProviderModule>();\n  for (const m of INFRA_PROVIDER_MODULES) {\n    if (map.has(m.provider)) {\n      throw new Error(\n        `INFRA_PROVIDER_MODULES contains duplicate provider '${m.provider}' — ` +\n        `each InfraProvider may have at most one module.`,\n      );\n    }\n    map.set(m.provider, m);\n  }\n  return map;\n}\n"]}

package/dist/esm/minio-self/minio-self.infra.module.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `MinioSelfInfraProviderModule` — sixth concrete `InfraProviderModule`
+ * (Slice 5.1 of `infra-provider-planner.md`, generalizing the
+ * Slice 2 / 4.B pattern to object storage).
+ *
+ * Implements the `MINIO_SELF` `InfraProvider`. One shared MinIO bucket
+ * serves every application; the object-key tree is namespaced
+ * `${prefix}/applications/${applicationId}/files/${fileId}`.
+ *
+ * `mintAppCredentials` / `revokeAppCredentials` are absent from THIS
+ * module, and that remains accurate — but it no longer means what it
+ * used to. Per-application credential isolation exists; it is simply
+ * not implemented here. See below.
+ *
+ * ## ⚠️ Corrected 2026-08-10 — this block described a posture the
+ * system no longer has
+ *
+ * It previously stated that every app shares "one access-key/secret-key
+ * pair", that per-app isolation "comes from `STORAGE_BUCKET_PREFIX`",
+ * and that app-scoped credentials were "NONE — apps consume the shared
+ * `STORAGE_*` env". All three were true when written and are now false:
+ *
+ * - Applications no longer receive any long-lived storage credential.
+ *   `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are no longer emitted
+ *   into application-tier env at all — they were the object store's
+ *   ROOT pair, and handing them to every app, minion and worker is the
+ *   exposure this was corrected to remove.
+ * - Isolation is enforced by a **credential**, not by a prefix
+ *   convention. `apps-manager`'s `ObjectStorageStsBrokerService` issues
+ *   short-lived STS sessions whose inline policy confines each
+ *   application to `applications/<applicationId>/`, keyed on the
+ *   platform-minted id — never on `STORAGE_BUCKET_PREFIX`, which an
+ *   application authors for itself and therefore cannot be a security
+ *   boundary. The prefix is now cosmetic namespacing.
+ *
+ * The three prerequisites this block listed for per-app credentials
+ * were addressed rather than deferred: the adapter threads per-principal
+ * credentials through a credential provider (1); the session policy
+ * replaces per-app bucket-policy authoring (2); and rotation safety (3)
+ * dissolved — STS credentials expire by construction, so there is no
+ * long-lived key whose rotation must be coordinated across pods.
+ *
+ * **Why the mint methods still do not live here.** MinIO's JS client
+ * ships no user-management API, so minting would need the `mc` binary or
+ * hand-written admin-API crypto. STS needs neither, and belongs with the
+ * service that holds the admin credential — apps-manager — rather than
+ * with this planning module, which contributes deployment topology.
+ *
+ * **Audience-1 (platform-admin)**: cluster-wide MinIO admin creds
+ * delivered via env. Consumers: `apps-manager` (which brokers STS from
+ * them) and `companion`. Whether these consumers should hold *root*
+ * specifically, rather than a narrower admin credential, is OQ-2 in the
+ * plan below.
+ *
+ * **Audience-3 (app-scoped)**: no per-app MinIO STATE is minted here —
+ * but applications DO receive a per-application storage credential at
+ * runtime, from apps-manager. "No app-scoped audience in this module" is
+ * not "no app-scoped credential in the system".
+ *
+ * See `.claude/plans/object-storage-root-credential-distribution.md`.
+ */
+import { InfraProviderModule } from '@wildo-ai/platform-config-lib';
+export declare const MinioSelfInfraProviderModule: InfraProviderModule;
+//# sourceMappingURL=minio-self.infra.module.d.ts.map

package/dist/esm/minio-self/minio-self.infra.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minio-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/minio-self/minio-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EAIL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAIvC,eAAO,MAAM,4BAA4B,EAAE,mBA2C1C,CAAC"}

package/dist/esm/minio-self/minio-self.infra.module.js

@@ -0,0 +1,105 @@
+/**
+ * `MinioSelfInfraProviderModule` — sixth concrete `InfraProviderModule`
+ * (Slice 5.1 of `infra-provider-planner.md`, generalizing the
+ * Slice 2 / 4.B pattern to object storage).
+ *
+ * Implements the `MINIO_SELF` `InfraProvider`. One shared MinIO bucket
+ * serves every application; the object-key tree is namespaced
+ * `${prefix}/applications/${applicationId}/files/${fileId}`.
+ *
+ * `mintAppCredentials` / `revokeAppCredentials` are absent from THIS
+ * module, and that remains accurate — but it no longer means what it
+ * used to. Per-application credential isolation exists; it is simply
+ * not implemented here. See below.
+ *
+ * ## ⚠️ Corrected 2026-08-10 — this block described a posture the
+ * system no longer has
+ *
+ * It previously stated that every app shares "one access-key/secret-key
+ * pair", that per-app isolation "comes from `STORAGE_BUCKET_PREFIX`",
+ * and that app-scoped credentials were "NONE — apps consume the shared
+ * `STORAGE_*` env". All three were true when written and are now false:
+ *
+ * - Applications no longer receive any long-lived storage credential.
+ *   `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are no longer emitted
+ *   into application-tier env at all — they were the object store's
+ *   ROOT pair, and handing them to every app, minion and worker is the
+ *   exposure this was corrected to remove.
+ * - Isolation is enforced by a **credential**, not by a prefix
+ *   convention. `apps-manager`'s `ObjectStorageStsBrokerService` issues
+ *   short-lived STS sessions whose inline policy confines each
+ *   application to `applications/<applicationId>/`, keyed on the
+ *   platform-minted id — never on `STORAGE_BUCKET_PREFIX`, which an
+ *   application authors for itself and therefore cannot be a security
+ *   boundary. The prefix is now cosmetic namespacing.
+ *
+ * The three prerequisites this block listed for per-app credentials
+ * were addressed rather than deferred: the adapter threads per-principal
+ * credentials through a credential provider (1); the session policy
+ * replaces per-app bucket-policy authoring (2); and rotation safety (3)
+ * dissolved — STS credentials expire by construction, so there is no
+ * long-lived key whose rotation must be coordinated across pods.
+ *
+ * **Why the mint methods still do not live here.** MinIO's JS client
+ * ships no user-management API, so minting would need the `mc` binary or
+ * hand-written admin-API crypto. STS needs neither, and belongs with the
+ * service that holds the admin credential — apps-manager — rather than
+ * with this planning module, which contributes deployment topology.
+ *
+ * **Audience-1 (platform-admin)**: cluster-wide MinIO admin creds
+ * delivered via env. Consumers: `apps-manager` (which brokers STS from
+ * them) and `companion`. Whether these consumers should hold *root*
+ * specifically, rather than a narrower admin credential, is OQ-2 in the
+ * plan below.
+ *
+ * **Audience-3 (app-scoped)**: no per-app MinIO STATE is minted here —
+ * but applications DO receive a per-application storage credential at
+ * runtime, from apps-manager. "No app-scoped audience in this module" is
+ * not "no app-scoped credential in the system".
+ *
+ * See `.claude/plans/object-storage-root-credential-distribution.md`.
+ */
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, } from '@wildo-ai/platform-config-lib';
+const DEFAULT_MINIO_PORT = 9000;
+export const MinioSelfInfraProviderModule = {
+    provider: InfraProvider.MINIO_SELF,
+    supportedCapabilities: [InfraCapability.OBJECT_STORAGE],
+    /**
+     * Shared bucket, shared root key — same as AWS S3: object-storage confinement is an STS session
+     * policy minted per request, never a per-principal secret in the application blob.
+     */
+    perPrincipalSecretBlobPaths: [],
+    plan() {
+        return {
+            dockerComposeServices: ['minio'],
+            k8sResources: ['templates/infra/k8s/internal/minio/deployment.yaml.hbs'],
+            platformAdmin: {
+                envVars: {
+                    STORAGE_PROVIDER: 'minio',
+                    STORAGE_ENDPOINT: 'minio',
+                    STORAGE_PORT: String(DEFAULT_MINIO_PORT),
+                    STORAGE_USE_SSL: 'false',
+                },
+                // Cluster-wide bucket access creds. Every app uses the same
+                // pair. Per-app isolation is via `STORAGE_BUCKET_PREFIX`
+                // (see module JSDoc).
+                secretEnvVars: ['STORAGE_ACCESS_KEY', 'STORAGE_SECRET_KEY'],
+                consumers: [
+                    InfraPlatformAdminConsumer.APPS_MANAGER,
+                    InfraPlatformAdminConsumer.COMPANION,
+                ],
+            },
+            // Apps receive `STORAGE_*` via the bootstrap env contract
+            // (engine-side `application-backend-env.contracts.ts`). No
+            // per-app blob-path additions because the values are static
+            // across all apps in the same env. `appRuntime` intentionally
+            // empty so the contribution stays an honest "shared bucket,
+            // no per-app state".
+        };
+    },
+    // No `mintAppCredentials` / `revokeAppCredentials` —
+    // shared-bucket model (see module JSDoc).
+    // No `mintPlatformServiceCredentials` — platform services use the
+    // same shared bucket as customer apps.
+};
+//# sourceMappingURL=minio-self.infra.module.js.map

package/dist/esm/minio-self/minio-self.infra.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minio-self.infra.module.js","sourceRoot":"","sources":["../../../../src/minio-self/minio-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,aAAa,GAGd,MAAM,+BAA+B,CAAC;AAEvC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,MAAM,CAAC,MAAM,4BAA4B,GAAwB;IAC/D,QAAQ,EAAE,aAAa,CAAC,UAAU;IAClC,qBAAqB,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC;IAEvD;;;OAGG;IACH,2BAA2B,EAAE,EAAE;IAE/B,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,OAAO,CAAC;YAChC,YAAY,EAAE,CAAC,wDAAwD,CAAC;YACxE,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,gBAAgB,EAAE,OAAO;oBACzB,gBAAgB,EAAE,OAAO;oBACzB,YAAY,EAAE,MAAM,CAAC,kBAAkB,CAAC;oBACxC,eAAe,EAAE,OAAO;iBACzB;gBACD,4DAA4D;gBAC5D,yDAAyD;gBACzD,sBAAsB;gBACtB,aAAa,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;gBAC3D,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,0DAA0D;YAC1D,2DAA2D;YAC3D,4DAA4D;YAC5D,8DAA8D;YAC9D,4DAA4D;YAC5D,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,0CAA0C;IAC1C,kEAAkE;IAClE,uCAAuC;CACxC,CAAC","sourcesContent":["/**\n * `MinioSelfInfraProviderModule` — sixth concrete `InfraProviderModule`\n * (Slice 5.1 of `infra-provider-planner.md`, generalizing the\n * Slice 2 / 4.B pattern to object storage).\n *\n * Implements the `MINIO_SELF` `InfraProvider`. One shared MinIO bucket\n * serves every application; the object-key tree is namespaced\n * `${prefix}/applications/${applicationId}/files/${fileId}`.\n *\n * `mintAppCredentials` / `revokeAppCredentials` are absent from THIS\n * module, and that remains accurate — but it no longer means what it\n * used to. Per-application credential isolation exists; it is simply\n * not implemented here. See below.\n *\n * ## ⚠️ Corrected 2026-08-10 — this block described a posture the\n * system no longer has\n *\n * It previously stated that every app shares \"one access-key/secret-key\n * pair\", that per-app isolation \"comes from `STORAGE_BUCKET_PREFIX`\",\n * and that app-scoped credentials were \"NONE — apps consume the shared\n * `STORAGE_*` env\". All three were true when written and are now false:\n *\n * - Applications no longer receive any long-lived storage credential.\n *   `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are no longer emitted\n *   into application-tier env at all — they were the object store's\n *   ROOT pair, and handing them to every app, minion and worker is the\n *   exposure this was corrected to remove.\n * - Isolation is enforced by a **credential**, not by a prefix\n *   convention. `apps-manager`'s `ObjectStorageStsBrokerService` issues\n *   short-lived STS sessions whose inline policy confines each\n *   application to `applications/<applicationId>/`, keyed on the\n *   platform-minted id — never on `STORAGE_BUCKET_PREFIX`, which an\n *   application authors for itself and therefore cannot be a security\n *   boundary. The prefix is now cosmetic namespacing.\n *\n * The three prerequisites this block listed for per-app credentials\n * were addressed rather than deferred: the adapter threads per-principal\n * credentials through a credential provider (1); the session policy\n * replaces per-app bucket-policy authoring (2); and rotation safety (3)\n * dissolved — STS credentials expire by construction, so there is no\n * long-lived key whose rotation must be coordinated across pods.\n *\n * **Why the mint methods still do not live here.** MinIO's JS client\n * ships no user-management API, so minting would need the `mc` binary or\n * hand-written admin-API crypto. STS needs neither, and belongs with the\n * service that holds the admin credential — apps-manager — rather than\n * with this planning module, which contributes deployment topology.\n *\n * **Audience-1 (platform-admin)**: cluster-wide MinIO admin creds\n * delivered via env. Consumers: `apps-manager` (which brokers STS from\n * them) and `companion`. Whether these consumers should hold *root*\n * specifically, rather than a narrower admin credential, is OQ-2 in the\n * plan below.\n *\n * **Audience-3 (app-scoped)**: no per-app MinIO STATE is minted here —\n * but applications DO receive a per-application storage credential at\n * runtime, from apps-manager. \"No app-scoped audience in this module\" is\n * not \"no app-scoped credential in the system\".\n *\n * See `.claude/plans/object-storage-root-credential-distribution.md`.\n */\n\nimport {\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n} from '@wildo-ai/platform-config-lib';\n\nconst DEFAULT_MINIO_PORT = 9000;\n\nexport const MinioSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.MINIO_SELF,\n  supportedCapabilities: [InfraCapability.OBJECT_STORAGE],\n\n  /**\n   * Shared bucket, shared root key — same as AWS S3: object-storage confinement is an STS session\n   * policy minted per request, never a per-principal secret in the application blob.\n   */\n  perPrincipalSecretBlobPaths: [],\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['minio'],\n      k8sResources: ['templates/infra/k8s/internal/minio/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {\n          STORAGE_PROVIDER: 'minio',\n          STORAGE_ENDPOINT: 'minio',\n          STORAGE_PORT: String(DEFAULT_MINIO_PORT),\n          STORAGE_USE_SSL: 'false',\n        },\n        // Cluster-wide bucket access creds. Every app uses the same\n        // pair. Per-app isolation is via `STORAGE_BUCKET_PREFIX`\n        // (see module JSDoc).\n        secretEnvVars: ['STORAGE_ACCESS_KEY', 'STORAGE_SECRET_KEY'],\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      // Apps receive `STORAGE_*` via the bootstrap env contract\n      // (engine-side `application-backend-env.contracts.ts`). No\n      // per-app blob-path additions because the values are static\n      // across all apps in the same env. `appRuntime` intentionally\n      // empty so the contribution stays an honest \"shared bucket,\n      // no per-app state\".\n    };\n  },\n\n  // No `mintAppCredentials` / `revokeAppCredentials` —\n  // shared-bucket model (see module JSDoc).\n  // No `mintPlatformServiceCredentials` — platform services use the\n  // same shared bucket as customer apps.\n};\n"]}

package/dist/esm/mongodb-atlas/mongodb-atlas.infra.module.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `MongodbAtlasInfraProviderModule` — fourth concrete `InfraProviderModule`
+ * (Slice 4.B.3 of `infra-provider-planner.md`, generalizing the Slice
+ * 2 / 4.B.1 / 4.B.2 pattern to MongoDB Atlas).
+ *
+ * Implements the `MONGODB_ATLAS` `InfraProvider` over the
+ * `IMongoAtlasClient` transport (Atlas REST API + digest auth, exposed
+ * by `MongoAtlasManagerService` after the Slice 4.B.3 5C policy/
+ * transport split). Owns ALL per-app naming policy — the per-app
+ * username convention (`<applicationNamespace>_user`, mirroring the
+ * legacy `getOrGenerateCredentials.generateNewCredentials`).
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `applicationNamespace` — used as the source for the per-app
+ *   username (legacy convention `${ns}_user`).
+ * - `secretInputs['database.mongodb.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs['databaseName']` — required, the
+ *   per-app database name (orchestrator derives via
+ *   `deriveDefaultMongoDatabaseName`).
+ * - `applicationConfigInputs['clusterName']` — required, the
+ *   Atlas cluster name (orchestrator passes `appInfo.clusterName ||
+ *   'Cluster0'`).
+ * - `adminClient` — narrowed to `IMongoAtlasClient`.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin)**: Atlas API public/private key
+ *    pair + project id + base URL. Consumers: `apps-manager` only
+ *    (companion uses self-managed locally; Atlas is remote-only).
+ *
+ * 2. **Audience-3 (app-scoped, via `mintAppCredentials`)**:
+ *    per-customer-app Atlas database user. Result threaded into
+ *    `Wildo_Application_Secrets.database.mongodb.{username,password}`
+ *    via `_merge_WildoApplicationSecrets`; the SRV connection
+ *    string returned via `runtimeArtifacts.connectionString` for
+ *    transient app-init operations (NOT persisted — the persistence
+ *    shape is split between config (host/protocol/options/database)
+ *    and secrets (username/password)).
+ *
+ * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:
+ * - **Audience-2 (platform-service-scoped)**: no platform service
+ *   uses Atlas for inter-service messaging today. Method omitted.
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+import { InfraProviderModule } from '@wildo-ai/platform-config-lib';
+export declare const MongodbAtlasInfraProviderModule: InfraProviderModule;
+//# sourceMappingURL=mongodb-atlas.infra.module.d.ts.map

package/dist/esm/mongodb-atlas/mongodb-atlas.infra.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongodb-atlas.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/mongodb-atlas/mongodb-atlas.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAOL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAqDvC,eAAO,MAAM,+BAA+B,EAAE,mBA2H7C,CAAC"}

package/dist/esm/mongodb-atlas/mongodb-atlas.infra.module.js

@@ -0,0 +1,201 @@
+/**
+ * `MongodbAtlasInfraProviderModule` — fourth concrete `InfraProviderModule`
+ * (Slice 4.B.3 of `infra-provider-planner.md`, generalizing the Slice
+ * 2 / 4.B.1 / 4.B.2 pattern to MongoDB Atlas).
+ *
+ * Implements the `MONGODB_ATLAS` `InfraProvider` over the
+ * `IMongoAtlasClient` transport (Atlas REST API + digest auth, exposed
+ * by `MongoAtlasManagerService` after the Slice 4.B.3 5C policy/
+ * transport split). Owns ALL per-app naming policy — the per-app
+ * username convention (`<applicationNamespace>_user`, mirroring the
+ * legacy `getOrGenerateCredentials.generateNewCredentials`).
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `applicationNamespace` — used as the source for the per-app
+ *   username (legacy convention `${ns}_user`).
+ * - `secretInputs['database.mongodb.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs['databaseName']` — required, the
+ *   per-app database name (orchestrator derives via
+ *   `deriveDefaultMongoDatabaseName`).
+ * - `applicationConfigInputs['clusterName']` — required, the
+ *   Atlas cluster name (orchestrator passes `appInfo.clusterName ||
+ *   'Cluster0'`).
+ * - `adminClient` — narrowed to `IMongoAtlasClient`.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin)**: Atlas API public/private key
+ *    pair + project id + base URL. Consumers: `apps-manager` only
+ *    (companion uses self-managed locally; Atlas is remote-only).
+ *
+ * 2. **Audience-3 (app-scoped, via `mintAppCredentials`)**:
+ *    per-customer-app Atlas database user. Result threaded into
+ *    `Wildo_Application_Secrets.database.mongodb.{username,password}`
+ *    via `_merge_WildoApplicationSecrets`; the SRV connection
+ *    string returned via `runtimeArtifacts.connectionString` for
+ *    transient app-init operations (NOT persisted — the persistence
+ *    shape is split between config (host/protocol/options/database)
+ *    and secrets (username/password)).
+ *
+ * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:
+ * - **Audience-2 (platform-service-scoped)**: no platform service
+ *   uses Atlas for inter-service messaging today. Method omitted.
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, } from '@wildo-ai/platform-config-lib';
+/**
+ * The `Wildo_Application_Secrets` JSON paths this module writes
+ * through `mintAppCredentials.secretBlobValues`. Declared once and
+ * reused as `appRuntime.perAppSecretBlobPaths` in `plan()` AND as
+ * the keys of the result, so a refactor that renames a path fails
+ * loudly at one place.
+ */
+const MONGODB_USERNAME_PATH = 'database.mongodb.username';
+const MONGODB_PASSWORD_PATH = 'database.mongodb.password';
+/**
+ * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.
+ *
+ * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip
+ * these from the application blob before delivering a principal's own material) AND spread into
+ * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery
+ * path would silently stop covering a path this module still mints.
+ */
+const PER_PRINCIPAL_SECRET_BLOB_PATHS = [MONGODB_USERNAME_PATH, MONGODB_PASSWORD_PATH];
+/**
+ * Key the module looks for in `secretInputs` for the orchestrator-
+ * supplied password.
+ */
+const MONGODB_PASSWORD_INPUT_KEY = 'database.mongodb.password';
+/**
+ * Required keys in `applicationConfigInputs`. The orchestrator
+ * derives both before calling `mintAppCredentials`.
+ */
+const DATABASE_NAME_INPUT_KEY = 'databaseName';
+const CLUSTER_NAME_INPUT_KEY = 'clusterName';
+/**
+ * Key in `runtimeArtifacts` carrying the SRV connection string with
+ * credentials embedded. Exposed for orchestrator transient use
+ * (app-init seeding); deliberately NOT persisted.
+ */
+const CONNECTION_STRING_ARTIFACT_KEY = 'connectionString';
+/**
+ * Compute the per-app Atlas database username. Mirrors the legacy
+ * convention at
+ * `wildo-application-lifecycle.service.ts:2607` /
+ * `generateNewCredentials` — `mongoUsername = ${ns}_user`.
+ * Centralized here so future changes touch one site.
+ */
+function buildMongodbUsername(applicationNamespace) {
+    return `${applicationNamespace}_user`;
+}
+export const MongodbAtlasInfraProviderModule = {
+    provider: InfraProvider.MONGODB_ATLAS,
+    supportedCapabilities: [InfraCapability.DOCUMENT_DATABASE],
+    perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,
+    plan() {
+        return {
+            // Atlas is remote-only — no compose service / no K8s manifest.
+            // The plan's `externalEndpoints` (in the wider envelope) carry
+            // the Atlas host topology; this module's `plan()` covers only
+            // admin-API access + per-app secret paths.
+            platformAdmin: {
+                envVars: {
+                    // ATLAS_API_BASE_URL is non-secret because it identifies
+                    // the Atlas API surface (default https://cloud.mongodb.com/api/atlas/v1.0).
+                    // ATLAS_PROJECT_ID + ATLAS_CLUSTER_NAME are non-secret
+                    // identifiers — public information about the customer's
+                    // Atlas project.
+                    ATLAS_API_BASE_URL: 'https://cloud.mongodb.com/api/atlas/v1.0',
+                    // PROJECT_ID + CLUSTER_NAME default to authored values; the
+                    // CLI's env-vars-builder writes them per-env from the
+                    // operator's `wildo.infra.<env>.config.ts > backingServices.mongodb`.
+                    ATLAS_PROJECT_ID: '',
+                    ATLAS_CLUSTER_NAME: 'Cluster0',
+                },
+                secretEnvVars: ['ATLAS_PUBLIC_KEY', 'ATLAS_PRIVATE_KEY'],
+                // Atlas is admin-API only for apps-manager. Companion runs
+                // locally against self-managed Mongo, NOT Atlas (no
+                // companion consumer for the Atlas variant).
+                consumers: [InfraPlatformAdminConsumer.APPS_MANAGER],
+            },
+            appRuntime: {
+                // Static topology for the app pod. The actual host /
+                // protocol / options for Atlas connections are derived
+                // server-side at runtime from cluster info; the persistence
+                // shape mirrors the legacy `_merge_WildoApplicationConfig`
+                // mongodb section.
+                perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],
+            },
+        };
+    },
+    async mintAppCredentials(context) {
+        const adminClient = context.adminClient;
+        const password = context.secretInputs[MONGODB_PASSWORD_INPUT_KEY];
+        if (!password) {
+            throw new Error(`MongodbAtlasInfraProviderModule.mintAppCredentials: ` +
+                `secretInputs is missing '${MONGODB_PASSWORD_INPUT_KEY}'. ` +
+                `The orchestrator MUST supply the Mongo password — modules are upsert-only.`);
+        }
+        if (!context.applicationNamespace) {
+            throw new Error(`MongodbAtlasInfraProviderModule.mintAppCredentials: ` +
+                `applicationNamespace is empty. ` +
+                `The orchestrator MUST supply a non-empty namespace.`);
+        }
+        const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];
+        if (!databaseName) {
+            throw new Error(`MongodbAtlasInfraProviderModule.mintAppCredentials: ` +
+                `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}'. ` +
+                `The orchestrator MUST supply the per-app database name.`);
+        }
+        const clusterName = context.applicationConfigInputs?.[CLUSTER_NAME_INPUT_KEY];
+        if (!clusterName) {
+            throw new Error(`MongodbAtlasInfraProviderModule.mintAppCredentials: ` +
+                `applicationConfigInputs is missing '${CLUSTER_NAME_INPUT_KEY}'. ` +
+                `The orchestrator MUST supply the Atlas cluster name.`);
+        }
+        const username = buildMongodbUsername(context.applicationNamespace);
+        // POST /databaseUsers (with PATCH-fallback) — idempotent upsert.
+        // Returns the SRV connection string with credentials embedded.
+        const { connectionString } = await adminClient.upsertApplicationDatabase({
+            clusterName,
+            databaseName,
+            username,
+            password,
+        });
+        return {
+            secretBlobValues: {
+                [MONGODB_USERNAME_PATH]: username,
+                // Echo of input password — proves upsert-only.
+                [MONGODB_PASSWORD_PATH]: password,
+            },
+            runtimeArtifacts: {
+                // Transient only — orchestrator uses for app-init seeding,
+                // does NOT persist.
+                [CONNECTION_STRING_ARTIFACT_KEY]: connectionString,
+            },
+        };
+    },
+    /**
+     * Tear down the per-app Atlas database user. Idempotent.
+     *
+     * **Caller status**: no caller wires this in Slices 1–4.B.3.
+     * Forward-compat seam.
+     */
+    async revokeAppCredentials(context) {
+        if (!context.applicationNamespace) {
+            throw new Error(`MongodbAtlasInfraProviderModule.revokeAppCredentials: ` +
+                `applicationNamespace is empty. ` +
+                `The orchestrator MUST supply a non-empty namespace.`);
+        }
+        const adminClient = context.adminClient;
+        const username = buildMongodbUsername(context.applicationNamespace);
+        await adminClient.deleteDatabaseUser(username);
+    },
+    // No `mintPlatformServiceCredentials` (D-4).
+};
+//# sourceMappingURL=mongodb-atlas.infra.module.js.map

package/dist/esm/mongodb-atlas/mongodb-atlas.infra.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongodb-atlas.infra.module.js","sourceRoot":"","sources":["../../../../src/mongodb-atlas/mongodb-atlas.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAIL,eAAe,EACf,0BAA0B,EAC1B,aAAa,GAGd,MAAM,+BAA+B,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAA0B,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;AAG9G;;;GAGG;AACH,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAE/D;;;GAGG;AACH,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAC/C,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAE7C;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,kBAAkB,CAAC;AAE1D;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,oBAA4B;IACxD,OAAO,GAAG,oBAAoB,OAAO,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAwB;IAClE,QAAQ,EAAE,aAAa,CAAC,aAAa;IACrC,qBAAqB,EAAE,CAAC,eAAe,CAAC,iBAAiB,CAAC;IAC1D,2BAA2B,EAAE,+BAA+B;IAE5D,IAAI;QACF,OAAO;YACL,+DAA+D;YAC/D,+DAA+D;YAC/D,8DAA8D;YAC9D,2CAA2C;YAC3C,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,yDAAyD;oBACzD,4EAA4E;oBAC5E,uDAAuD;oBACvD,wDAAwD;oBACxD,iBAAiB;oBACjB,kBAAkB,EAAE,0CAA0C;oBAC9D,4DAA4D;oBAC5D,sDAAsD;oBACtD,sEAAsE;oBACtE,gBAAgB,EAAE,EAAE;oBACpB,kBAAkB,EAAE,UAAU;iBAC/B;gBACD,aAAa,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;gBACxD,2DAA2D;gBAC3D,oDAAoD;gBACpD,6CAA6C;gBAC7C,SAAS,EAAE,CAAC,0BAA0B,CAAC,YAAY,CAAC;aACrD;YACD,UAAU,EAAE;gBACV,qDAAqD;gBACrD,uDAAuD;gBACvD,4DAA4D;gBAC5D,2DAA2D;gBAC3D,mBAAmB;gBACnB,qBAAqB,EAAE,CAAC,GAAG,+BAA+B,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAoC;QAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAgC,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,4BAA4B,0BAA0B,KAAK;gBAC3D,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,uBAAuB,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,uCAAuC,uBAAuB,KAAK;gBACnE,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,sBAAsB,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,uCAAuC,sBAAsB,KAAK;gBAClE,sDAAsD,CACvD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAEpE,iEAAiE;QACjE,+DAA+D;QAC/D,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,WAAW,CAAC,yBAAyB,CAAC;YACvE,WAAW;YACX,YAAY;YACZ,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO;YACL,gBAAgB,EAAE;gBAChB,CAAC,qBAAqB,CAAC,EAAE,QAAQ;gBACjC,+CAA+C;gBAC/C,CAAC,qBAAqB,CAAC,EAAE,QAAQ;aAClC;YACD,gBAAgB,EAAE;gBAChB,2DAA2D;gBAC3D,oBAAoB;gBACpB,CAAC,8BAA8B,CAAC,EAAE,gBAAgB;aACnD;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC;QAC7D,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACxD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAgC,CAAC;QAC7D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACpE,MAAM,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,6CAA6C;CAC9C,CAAC","sourcesContent":["/**\n * `MongodbAtlasInfraProviderModule` — fourth concrete `InfraProviderModule`\n * (Slice 4.B.3 of `infra-provider-planner.md`, generalizing the Slice\n * 2 / 4.B.1 / 4.B.2 pattern to MongoDB Atlas).\n *\n * Implements the `MONGODB_ATLAS` `InfraProvider` over the\n * `IMongoAtlasClient` transport (Atlas REST API + digest auth, exposed\n * by `MongoAtlasManagerService` after the Slice 4.B.3 5C policy/\n * transport split). Owns ALL per-app naming policy — the per-app\n * username convention (`<applicationNamespace>_user`, mirroring the\n * legacy `getOrGenerateCredentials.generateNewCredentials`).\n *\n * **What this module reads from `AppCredentialMintingContext`**:\n * - `applicationNamespace` — used as the source for the per-app\n *   username (legacy convention `${ns}_user`).\n * - `secretInputs['database.mongodb.password']` — orchestrator-\n *   supplied password (module is upsert-only, never generator).\n * - `applicationConfigInputs['databaseName']` — required, the\n *   per-app database name (orchestrator derives via\n *   `deriveDefaultMongoDatabaseName`).\n * - `applicationConfigInputs['clusterName']` — required, the\n *   Atlas cluster name (orchestrator passes `appInfo.clusterName ||\n *   'Cluster0'`).\n * - `adminClient` — narrowed to `IMongoAtlasClient`.\n *\n * **Two audiences this module serves:**\n *\n * 1. **Audience-1 (platform-admin)**: Atlas API public/private key\n *    pair + project id + base URL. Consumers: `apps-manager` only\n *    (companion uses self-managed locally; Atlas is remote-only).\n *\n * 2. **Audience-3 (app-scoped, via `mintAppCredentials`)**:\n *    per-customer-app Atlas database user. Result threaded into\n *    `Wildo_Application_Secrets.database.mongodb.{username,password}`\n *    via `_merge_WildoApplicationSecrets`; the SRV connection\n *    string returned via `runtimeArtifacts.connectionString` for\n *    transient app-init operations (NOT persisted — the persistence\n *    shape is split between config (host/protocol/options/database)\n *    and secrets (username/password)).\n *\n * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:\n * - **Audience-2 (platform-service-scoped)**: no platform service\n *   uses Atlas for inter-service messaging today. Method omitted.\n *\n * **`revokeAppCredentials`**: declared and tested, but the integration\n * call site does NOT exist in `wildo-application-lifecycle.service.ts`\n * (no app-deletion ceremony today — F6 of plan review 2026-05-06).\n * Method ships as a forward-compat seam.\n */\n\nimport {\n  AppCredentialMintingContext,\n  AppCredentialMintingResult,\n  IMongoAtlasClient,\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n} from '@wildo-ai/platform-config-lib';\n\n/**\n * The `Wildo_Application_Secrets` JSON paths this module writes\n * through `mintAppCredentials.secretBlobValues`. Declared once and\n * reused as `appRuntime.perAppSecretBlobPaths` in `plan()` AND as\n * the keys of the result, so a refactor that renames a path fails\n * loudly at one place.\n */\nconst MONGODB_USERNAME_PATH = 'database.mongodb.username';\nconst MONGODB_PASSWORD_PATH = 'database.mongodb.password';\n/**\n * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.\n *\n * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip\n * these from the application blob before delivering a principal's own material) AND spread into\n * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery\n * path would silently stop covering a path this module still mints.\n */\nconst PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [MONGODB_USERNAME_PATH, MONGODB_PASSWORD_PATH];\n\n\n/**\n * Key the module looks for in `secretInputs` for the orchestrator-\n * supplied password.\n */\nconst MONGODB_PASSWORD_INPUT_KEY = 'database.mongodb.password';\n\n/**\n * Required keys in `applicationConfigInputs`. The orchestrator\n * derives both before calling `mintAppCredentials`.\n */\nconst DATABASE_NAME_INPUT_KEY = 'databaseName';\nconst CLUSTER_NAME_INPUT_KEY = 'clusterName';\n\n/**\n * Key in `runtimeArtifacts` carrying the SRV connection string with\n * credentials embedded. Exposed for orchestrator transient use\n * (app-init seeding); deliberately NOT persisted.\n */\nconst CONNECTION_STRING_ARTIFACT_KEY = 'connectionString';\n\n/**\n * Compute the per-app Atlas database username. Mirrors the legacy\n * convention at\n * `wildo-application-lifecycle.service.ts:2607` /\n * `generateNewCredentials` — `mongoUsername = ${ns}_user`.\n * Centralized here so future changes touch one site.\n */\nfunction buildMongodbUsername(applicationNamespace: string): string {\n  return `${applicationNamespace}_user`;\n}\n\nexport const MongodbAtlasInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.MONGODB_ATLAS,\n  supportedCapabilities: [InfraCapability.DOCUMENT_DATABASE],\n  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      // Atlas is remote-only — no compose service / no K8s manifest.\n      // The plan's `externalEndpoints` (in the wider envelope) carry\n      // the Atlas host topology; this module's `plan()` covers only\n      // admin-API access + per-app secret paths.\n      platformAdmin: {\n        envVars: {\n          // ATLAS_API_BASE_URL is non-secret because it identifies\n          // the Atlas API surface (default https://cloud.mongodb.com/api/atlas/v1.0).\n          // ATLAS_PROJECT_ID + ATLAS_CLUSTER_NAME are non-secret\n          // identifiers — public information about the customer's\n          // Atlas project.\n          ATLAS_API_BASE_URL: 'https://cloud.mongodb.com/api/atlas/v1.0',\n          // PROJECT_ID + CLUSTER_NAME default to authored values; the\n          // CLI's env-vars-builder writes them per-env from the\n          // operator's `wildo.infra.<env>.config.ts > backingServices.mongodb`.\n          ATLAS_PROJECT_ID: '',\n          ATLAS_CLUSTER_NAME: 'Cluster0',\n        },\n        secretEnvVars: ['ATLAS_PUBLIC_KEY', 'ATLAS_PRIVATE_KEY'],\n        // Atlas is admin-API only for apps-manager. Companion runs\n        // locally against self-managed Mongo, NOT Atlas (no\n        // companion consumer for the Atlas variant).\n        consumers: [InfraPlatformAdminConsumer.APPS_MANAGER],\n      },\n      appRuntime: {\n        // Static topology for the app pod. The actual host /\n        // protocol / options for Atlas connections are derived\n        // server-side at runtime from cluster info; the persistence\n        // shape mirrors the legacy `_merge_WildoApplicationConfig`\n        // mongodb section.\n        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],\n      },\n    };\n  },\n\n  async mintAppCredentials(\n    context: AppCredentialMintingContext,\n  ): Promise<AppCredentialMintingResult> {\n    const adminClient = context.adminClient as IMongoAtlasClient;\n    const password = context.secretInputs[MONGODB_PASSWORD_INPUT_KEY];\n    if (!password) {\n      throw new Error(\n        `MongodbAtlasInfraProviderModule.mintAppCredentials: ` +\n        `secretInputs is missing '${MONGODB_PASSWORD_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the Mongo password — modules are upsert-only.`,\n      );\n    }\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `MongodbAtlasInfraProviderModule.mintAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];\n    if (!databaseName) {\n      throw new Error(\n        `MongodbAtlasInfraProviderModule.mintAppCredentials: ` +\n        `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the per-app database name.`,\n      );\n    }\n    const clusterName = context.applicationConfigInputs?.[CLUSTER_NAME_INPUT_KEY];\n    if (!clusterName) {\n      throw new Error(\n        `MongodbAtlasInfraProviderModule.mintAppCredentials: ` +\n        `applicationConfigInputs is missing '${CLUSTER_NAME_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the Atlas cluster name.`,\n      );\n    }\n\n    const username = buildMongodbUsername(context.applicationNamespace);\n\n    // POST /databaseUsers (with PATCH-fallback) — idempotent upsert.\n    // Returns the SRV connection string with credentials embedded.\n    const { connectionString } = await adminClient.upsertApplicationDatabase({\n      clusterName,\n      databaseName,\n      username,\n      password,\n    });\n\n    return {\n      secretBlobValues: {\n        [MONGODB_USERNAME_PATH]: username,\n        // Echo of input password — proves upsert-only.\n        [MONGODB_PASSWORD_PATH]: password,\n      },\n      runtimeArtifacts: {\n        // Transient only — orchestrator uses for app-init seeding,\n        // does NOT persist.\n        [CONNECTION_STRING_ARTIFACT_KEY]: connectionString,\n      },\n    };\n  },\n\n  /**\n   * Tear down the per-app Atlas database user. Idempotent.\n   *\n   * **Caller status**: no caller wires this in Slices 1–4.B.3.\n   * Forward-compat seam.\n   */\n  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `MongodbAtlasInfraProviderModule.revokeAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    const adminClient = context.adminClient as IMongoAtlasClient;\n    const username = buildMongodbUsername(context.applicationNamespace);\n    await adminClient.deleteDatabaseUser(username);\n  },\n\n  // No `mintPlatformServiceCredentials` (D-4).\n};\n"]}