@wildo-ai/platform-infra-providers 1.1.2

package/src/aws-s3/aws-s3.infra.module.ts

@@ -0,0 +1,120 @@
+/**
+ * `AwsS3InfraProviderModule` — seventh concrete `InfraProviderModule`
+ * (Slice 5.1 of `infra-provider-planner.md`).
+ *
+ * Implements the `AWS_S3` `InfraProvider`. Shares the one-bucket,
+ * prefix-namespaced object layout of `MinioSelfInfraProviderModule` —
+ * the only differences are (a) no compose / K8s contribution (S3 is
+ * managed), and (b) the bucket endpoint is the regional AWS hostname
+ * instead of the in-cluster `minio` service.
+ *
+ * ## ⚠️ NOT USABLE TODAY — selecting this provider leaves apps with no
+ * storage credential (2026-08-10)
+ *
+ * The application-tier `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` env
+ * vars were removed **for every provider**: they were the object store's
+ * ROOT pair, handed to every app, minion and worker. Applications now
+ * obtain short-lived, prefix-confined credentials from apps-manager.
+ *
+ * That replacement is implemented for **MinIO only**. apps-manager's
+ * `ObjectStorageStsBrokerService` speaks MinIO's STS `AssumeRole` with an
+ * inline session policy; AWS STS requires a role ARN the broker does not
+ * supply, so an `AWS_S3` deployment would fail at storage initialisation
+ * with no credential and no path to one.
+ *
+ * No environment selects this provider today (every example uses
+ * `BackingServiceSource.SELF` → MinIO), which is why this is recorded as
+ * a gap rather than an outage. But it IS reachable — `s3: { source:
+ * MANAGED }` or `provider: 'aws'` resolves here — so **do not select
+ * `AWS_S3` until the AWS STS path exists.** Tracked in
+ * `.claude/plans/object-storage-root-credential-distribution.md`.
+ *
+ * The module still reuses the `STORAGE_*` env contract for the
+ * NON-secret values (endpoint, region, bucket, provider); it is only the
+ * credential half that is gone.
+ *
+ * **Why this module exists despite "no compose / no mint"**: it
+ * gives the lockfile a stable digest entry (so a switch from
+ * `minio-self` to `aws-s3` shows up as a `wildo lock check` drift)
+ * AND it formalizes which env vars the operator must set for AWS
+ * (`STORAGE_REGION` is mandatory; `STORAGE_ENDPOINT` is optional —
+ * defaults to the AWS regional endpoint when unset).
+ *
+ * **No mint methods here** — and the reason is no longer the one this
+ * block used to give. It said per-app credentials were out of scope
+ * "because the engine adapter uses a single shared SDK client", which
+ * stopped being true when the adapter moved to a credential provider that
+ * rebuilds its client whenever the credential changes. Per-application
+ * isolation exists; what is missing for AWS is only the broker's ability
+ * to speak AWS STS.
+ *
+ * Nor should the missing piece be per-app IAM users or roles, which is
+ * what this block previously anticipated. The MinIO path deliberately
+ * rejected long-lived per-principal accounts in favour of `AssumeRole`
+ * with an inline session policy — nothing long-lived exists to leak, and
+ * credential-rotation safety dissolves instead of needing a design. The
+ * AWS equivalent is the same shape: `AssumeRole` against a role ARN the
+ * operator supplies, with a session policy confining the principal to
+ * `applications/<applicationId>/`. That role ARN is the one input the
+ * broker does not have today, and is the whole of the gap.
+ */
+
+import {
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+  InfraProviderModule,
+  InfraProviderPlanContribution,
+} from '@wildo-ai/platform-config-lib';
+
+export const AwsS3InfraProviderModule: InfraProviderModule = {
+  provider: InfraProvider.AWS_S3,
+  supportedCapabilities: [InfraCapability.OBJECT_STORAGE],
+
+  /**
+   * Shared bucket, shared access key — no per-app credential is minted, so there is nothing
+   * per-principal to confine. Confinement for object storage is done by STS session policy at
+   * request time, not by a secret in the application blob.
+   */
+  perPrincipalSecretBlobPaths: [],
+
+  plan(): InfraProviderPlanContribution {
+    return {
+      // No compose service — S3 is fully managed.
+      // No K8s manifest — same reason.
+      platformAdmin: {
+        envVars: {
+          STORAGE_PROVIDER: 's3',
+          // Endpoint and port have AWS defaults; operator may override
+          // for region-specific or VPC-endpoint topologies via the
+          // env's authored `backingServices.s3` config.
+          STORAGE_USE_SSL: 'true',
+        },
+        secretEnvVars: [
+          'STORAGE_ACCESS_KEY',
+          'STORAGE_SECRET_KEY',
+          // Region is sensitive-ish (deployment topology) and is
+          // delivered via the secret env channel for symmetry with
+          // the access keys, even though it's not strictly secret.
+          // The legacy treatment was env-var, not secret-env-var; if
+          // operators object, this can flip to `envVars` later
+          // without breaking the contract.
+          'STORAGE_REGION',
+        ],
+        consumers: [
+          InfraPlatformAdminConsumer.APPS_MANAGER,
+          InfraPlatformAdminConsumer.COMPANION,
+        ],
+      },
+      // Same shared bucket as MinIO_Self. Apps receive the NON-secret
+      // `STORAGE_*` values via the bootstrap env contract; the credential
+      // half is no longer emitted for any provider — see the ⚠️ block in
+      // this module's JSDoc for why that makes AWS_S3 currently unusable.
+    };
+  },
+
+  // No `mintAppCredentials` / `revokeAppCredentials` — not because the model
+  // is shared-bucket (it is, but that is not the reason), but because
+  // per-application isolation is delivered by BROKERED STS SESSIONS rather than
+  // by minted long-lived accounts. See this module's JSDoc.
+};

package/src/clamav-self/__tests__/clamav-self.infra.module.test.ts

@@ -0,0 +1,65 @@
+/**
+ * Tests for `ClamavSelfInfraProviderModule` (Slice 5.2 of
+ * `infra-provider-planner.md`).
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+} from '@wildo-ai/platform-config-lib';
+import { ClamavSelfInfraProviderModule } from '../clamav-self.infra.module';
+
+describe('ClamavSelfInfraProviderModule.plan()', () => {
+  const contribution = ClamavSelfInfraProviderModule.plan({
+    environment: 'local',
+    runtime: 'docker-compose',
+    backingServiceKey: 'clamav',
+    config: {},
+  });
+
+  it('declares the right provider + capability triple', () => {
+    expect(ClamavSelfInfraProviderModule.provider).toBe(InfraProvider.CLAMAV_SELF);
+    expect(ClamavSelfInfraProviderModule.supportedCapabilities).toEqual([
+      InfraCapability.ANTIVIRUS_SCANNING,
+    ]);
+  });
+
+  it('contributes the clamav compose service + K8s manifest', () => {
+    expect(contribution.dockerComposeServices).toEqual(['clamav']);
+    expect(contribution.k8sResources).toEqual([
+      'templates/infra/k8s/internal/clamav/deployment.yaml.hbs',
+    ]);
+  });
+
+  it('declares CLAMAV_HOST/PORT env (no auth — no secret env vars)', () => {
+    expect(contribution.platformAdmin?.envVars).toEqual({
+      CLAMAV_HOST: 'clamav',
+      CLAMAV_PORT: '3310',
+    });
+    expect(contribution.platformAdmin?.secretEnvVars).toBeUndefined();
+    expect(contribution.platformAdmin?.consumers).toEqual([
+      InfraPlatformAdminConsumer.APPS_MANAGER,
+      InfraPlatformAdminConsumer.COMPANION,
+    ]);
+  });
+
+  it('declares NO appRuntime contribution (stateless — apps connect by host:port)', () => {
+    expect(contribution.appRuntime).toBeUndefined();
+  });
+});
+
+describe('ClamavSelfInfraProviderModule stateless absence', () => {
+  it('does NOT declare mintAppCredentials (no auth, no per-app state)', () => {
+    expect(ClamavSelfInfraProviderModule.mintAppCredentials).toBeUndefined();
+  });
+
+  it('does NOT declare revokeAppCredentials', () => {
+    expect(ClamavSelfInfraProviderModule.revokeAppCredentials).toBeUndefined();
+  });
+
+  it('does NOT declare mintPlatformServiceCredentials', () => {
+    expect(ClamavSelfInfraProviderModule.mintPlatformServiceCredentials).toBeUndefined();
+  });
+});

package/src/clamav-self/clamav-self.infra.module.ts

@@ -0,0 +1,72 @@
+/**
+ * `ClamavSelfInfraProviderModule` — eighth concrete `InfraProviderModule`
+ * (Slice 5.2 of `infra-provider-planner.md`).
+ *
+ * Implements the `CLAMAV_SELF` `InfraProvider`. **Stateless**: ClamAV
+ * is a network virus-scanning service with no auth and no per-tenant
+ * state. Apps connect to the shared host:port and submit files for
+ * scanning over the ClamAV protocol; nothing is persisted, nothing
+ * is per-app. The module's only job is to declare the resource +
+ * env vars in `plan()`; there are no `mintAppCredentials`,
+ * `revokeAppCredentials`, or `mintPlatformServiceCredentials`
+ * methods because there are no credentials.
+ *
+ * **Apps consume**: `CLAMAV_HOST`, `CLAMAV_PORT` env vars (delivered
+ * via the bootstrap env contract). The engine's antivirus-scanning
+ * adapter (`saas-backend-lib/.../antivirus/...`) opens a TCP
+ * connection per scan request.
+ *
+ * **Why declare it as a module at all (vs. inline compose service)?**
+ * The module gives the lockfile a stable `planContributionDigest`
+ * for `ANTIVIRUS_SCANNING` so `wildo lock check` catches drift in
+ * the ClamAV resource shape (port change, env-var rename, K8s
+ * manifest move). Without a module, the digest would be the
+ * authored-entry digest (which is empty — ClamAV has no configurable
+ * `BackingService` shape today, just the `BackingServiceKind`
+ * enum value).
+ */
+
+import {
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+  InfraProviderModule,
+  InfraProviderPlanContribution,
+} from '@wildo-ai/platform-config-lib';
+
+const DEFAULT_CLAMAV_PORT = 3310;
+
+export const ClamavSelfInfraProviderModule: InfraProviderModule = {
+  provider: InfraProvider.CLAMAV_SELF,
+  supportedCapabilities: [InfraCapability.ANTIVIRUS_SCANNING],
+
+  /**
+   * Stateless infra with no authentication and no per-app state — `plan()` only.
+   */
+  perPrincipalSecretBlobPaths: [],
+
+  plan(): InfraProviderPlanContribution {
+    return {
+      dockerComposeServices: ['clamav'],
+      k8sResources: ['templates/infra/k8s/internal/clamav/deployment.yaml.hbs'],
+      platformAdmin: {
+        envVars: {
+          CLAMAV_HOST: 'clamav',
+          CLAMAV_PORT: String(DEFAULT_CLAMAV_PORT),
+        },
+        // No secret env vars — ClamAV has no auth.
+        // Audience-1 declared so the planner emits the env vars to
+        // both apps-manager and companion (companion runs scans
+        // locally during dev for parity with prod behavior).
+        consumers: [
+          InfraPlatformAdminConsumer.APPS_MANAGER,
+          InfraPlatformAdminConsumer.COMPANION,
+        ],
+      },
+      // No `appRuntime` blob paths — apps connect via the same
+      // `CLAMAV_HOST:CLAMAV_PORT` regardless of app identity.
+    };
+  },
+
+  // No mint methods — ClamAV is stateless.
+};

package/src/gotenberg-self/__tests__/gotenberg-self.infra.module.test.ts

@@ -0,0 +1,65 @@
+/**
+ * Tests for `GotenbergSelfInfraProviderModule` (Slice 5.3 of
+ * `infra-provider-planner.md`).
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+} from '@wildo-ai/platform-config-lib';
+import { GotenbergSelfInfraProviderModule } from '../gotenberg-self.infra.module';
+
+describe('GotenbergSelfInfraProviderModule.plan()', () => {
+  const contribution = GotenbergSelfInfraProviderModule.plan({
+    environment: 'local',
+    runtime: 'docker-compose',
+    backingServiceKey: 'gotenberg',
+    config: {},
+  });
+
+  it('declares the right provider + capability triple', () => {
+    expect(GotenbergSelfInfraProviderModule.provider).toBe(InfraProvider.GOTENBERG_SELF);
+    expect(GotenbergSelfInfraProviderModule.supportedCapabilities).toEqual([
+      InfraCapability.DOCUMENT_RENDERING,
+    ]);
+  });
+
+  it('contributes the gotenberg compose service + K8s manifest', () => {
+    expect(contribution.dockerComposeServices).toEqual(['gotenberg']);
+    expect(contribution.k8sResources).toEqual([
+      'templates/infra/k8s/internal/gotenberg/deployment.yaml.hbs',
+    ]);
+  });
+
+  it('declares GOTENBERG_HOST/PORT env (no auth — no secret env vars)', () => {
+    expect(contribution.platformAdmin?.envVars).toEqual({
+      GOTENBERG_HOST: 'gotenberg',
+      GOTENBERG_PORT: '3000',
+    });
+    expect(contribution.platformAdmin?.secretEnvVars).toBeUndefined();
+    expect(contribution.platformAdmin?.consumers).toEqual([
+      InfraPlatformAdminConsumer.APPS_MANAGER,
+      InfraPlatformAdminConsumer.COMPANION,
+    ]);
+  });
+
+  it('declares NO appRuntime contribution (stateless — apps connect by host:port)', () => {
+    expect(contribution.appRuntime).toBeUndefined();
+  });
+});
+
+describe('GotenbergSelfInfraProviderModule stateless absence', () => {
+  it('does NOT declare mintAppCredentials (no auth, no per-app state)', () => {
+    expect(GotenbergSelfInfraProviderModule.mintAppCredentials).toBeUndefined();
+  });
+
+  it('does NOT declare revokeAppCredentials', () => {
+    expect(GotenbergSelfInfraProviderModule.revokeAppCredentials).toBeUndefined();
+  });
+
+  it('does NOT declare mintPlatformServiceCredentials', () => {
+    expect(GotenbergSelfInfraProviderModule.mintPlatformServiceCredentials).toBeUndefined();
+  });
+});

package/src/gotenberg-self/gotenberg-self.infra.module.ts

@@ -0,0 +1,65 @@
+/**
+ * `GotenbergSelfInfraProviderModule` — ninth concrete
+ * `InfraProviderModule` (Slice 5.3 of `infra-provider-planner.md`).
+ *
+ * Implements the `GOTENBERG_SELF` `InfraProvider`. **Stateless**:
+ * Gotenberg is a network HTML-to-PDF rendering service with no auth
+ * and no per-tenant state. Apps POST HTML/Office docs and receive
+ * rendered PDFs; nothing is persisted server-side. Same shape as
+ * `ClamavSelfInfraProviderModule` — `plan()` only, no mint methods.
+ *
+ * **Apps consume**: `GOTENBERG_HOST`, `GOTENBERG_PORT` env vars (TBD
+ * naming — current engine adapter reads these from
+ * `BackingServicesEnvConfig` via the catalog at
+ * `wildo-cli/.../service-catalog.schemas.ts:78`). The plan emits
+ * the env vars under those names.
+ *
+ * **Two ports** (Slice 5.3 design note): Gotenberg exposes both a
+ * public port (3000 by default) for HTTP API access and an internal
+ * port (3001) for health-check/metrics. The CLI's docker-compose
+ * generator already wires both. The module's `plan()` only emits
+ * the public port — the internal port is a docker-compose-only
+ * concern and isn't part of the customer-app env-var surface.
+ */
+
+import {
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+  InfraProviderModule,
+  InfraProviderPlanContribution,
+} from '@wildo-ai/platform-config-lib';
+
+const DEFAULT_GOTENBERG_PORT = 3000;
+
+export const GotenbergSelfInfraProviderModule: InfraProviderModule = {
+  provider: InfraProvider.GOTENBERG_SELF,
+  supportedCapabilities: [InfraCapability.DOCUMENT_RENDERING],
+
+  /**
+   * Stateless infra with no authentication and no per-app state — `plan()` only.
+   */
+  perPrincipalSecretBlobPaths: [],
+
+  plan(): InfraProviderPlanContribution {
+    return {
+      dockerComposeServices: ['gotenberg'],
+      k8sResources: ['templates/infra/k8s/internal/gotenberg/deployment.yaml.hbs'],
+      platformAdmin: {
+        envVars: {
+          GOTENBERG_HOST: 'gotenberg',
+          GOTENBERG_PORT: String(DEFAULT_GOTENBERG_PORT),
+        },
+        // No secret env vars — Gotenberg has no auth.
+        consumers: [
+          InfraPlatformAdminConsumer.APPS_MANAGER,
+          InfraPlatformAdminConsumer.COMPANION,
+        ],
+      },
+      // No `appRuntime` blob paths — apps connect via the same
+      // `GOTENBERG_HOST:GOTENBERG_PORT` regardless of app identity.
+    };
+  },
+
+  // No mint methods — Gotenberg is stateless.
+};

package/src/index.ts

@@ -0,0 +1,133 @@
+/**
+ * `@wildo-ai/platform-infra-providers` — concrete `InfraProviderModule`
+ * catalog (Slice 2.5c-1 of `infra-provider-planner.md`).
+ *
+ * Tier-portable: the modules import only `@wildo-ai/platform-config-lib`
+ * (contracts) and have no DI / mongoose / axios runtime dependencies.
+ * This lets both `platform-apps-manager` (orchestrator) and
+ * `wildo-cli` (lockfile materializer) consume the same module
+ * objects — apps-manager passes a real admin-client implementation
+ * via `AppCredentialMintingContext.adminClient`; wildo-cli only
+ * needs `module.plan()` for the lockfile digest.
+ *
+ * Each module is exported by name (no intermediary barrels per
+ * platform/CLAUDE.md "no intermediary index.ts barrels"). The
+ * `INFRA_PROVIDER_MODULES` map below is the canonical catalog —
+ * consumers iterate it (or look up by `InfraProvider` value) instead
+ * of importing modules one by one.
+ */
+
+import type { InfraProvider, InfraProviderModule } from '@wildo-ai/platform-config-lib';
+
+import { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module';
+import { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module';
+import { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module';
+import { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module';
+import { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module';
+// Slice 5 of `infra-provider-planner.md` — object-storage + stateless infra.
+import { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module';
+import { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module';
+import { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module';
+import { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module';
+
+export { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module';
+export { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module';
+export { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module';
+export { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module';
+export { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module';
+export { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module';
+export { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module';
+export { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module';
+export { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module';
+
+/**
+ * Canonical `InfraProvider` → `InfraProviderModule` catalog. Caller
+ * (CLI, apps-manager) builds a `Map<InfraProvider, InfraProviderModule>`
+ * from this constant when threading modules into
+ * `materializeInfraSection`.
+ *
+ * **Why a const array instead of a `Map` literal**: arrays serialize
+ * stably under tsc and roll up to a deterministic order. The
+ * downstream `Map` is built once at program start; the catalog
+ * itself is a value-level fixture.
+ *
+ * **Coverage** (Slice 5 baseline, 2026-05-10):
+ * - `RABBITMQ_SELF`, `REDIS_SELF`, `POSTGRES_SELF`, `MONGODB_SELF`,
+ *   `MONGODB_ATLAS` — five stateful modules with mint/revoke
+ *   methods.
+ * - `MINIO_SELF`, `AWS_S3` — object storage (shared-bucket model;
+ *   no per-app credentials).
+ * - `CLAMAV_SELF`, `GOTENBERG_SELF` — stateless infra (no auth, no
+ *   per-app state; `plan()` only).
+ *
+ * **NOT covered** (catalog entries without modules):
+ * - `POSTGRES_MANAGED`, `POSTGRES_AWS_RDS`, `POSTGRES_GCP_CLOUD_SQL`,
+ *   `POSTGRES_AZURE_DATABASE`, `POSTGRES_SUPABASE`, `POSTGRES_NEON`,
+ *   `POSTGRES_RENDER` — managed-Postgres brand catalog entries
+ *   (Slice 4.B.0). No module yet; trigger = real customer.
+ *
+ * `materializeInfraSection` falls back to the authored-entry digest
+ * when a selected `InfraProvider` is not in the map (preserves the
+ * Slice 2.5b behavior for uncovered providers).
+ */
+export const INFRA_PROVIDER_MODULES: ReadonlyArray<InfraProviderModule> = [
+  RabbitmqSelfInfraProviderModule,
+  RedisSelfInfraProviderModule,
+  PostgresSelfInfraProviderModule,
+  MongodbAtlasInfraProviderModule,
+  MongodbSelfInfraProviderModule,
+  MinioSelfInfraProviderModule,
+  AwsS3InfraProviderModule,
+  ClamavSelfInfraProviderModule,
+  GotenbergSelfInfraProviderModule,
+];
+
+/**
+ * Every `Wildo_Application_Secrets` JSON path that ANY provider module can mint per runtime
+ * principal — the union of the catalog's own static declarations.
+ *
+ * ## Why this is derived rather than written down
+ *
+ * The consumer is the secret-DELIVERY path in apps-manager: it strips exactly this set from the
+ * application blob before overlaying a principal's own material, so a principal receives a
+ * credential only where one was minted FOR IT. A hand-maintained copy at that consumer would be a
+ * second source — add a provider that mints a new credential path and delivery keeps shipping the
+ * APPLICATION's value for it, silently. That is the defect class this repo has paid for twice: the
+ * party that CONSTRAINS is not the party that DECLARES.
+ *
+ * Derived from `INFRA_PROVIDER_MODULES`, so a new module is covered the day it enters the catalog.
+ *
+ * Deliberately the union across ALL modules, not the ones a given application selected: a principal
+ * must not receive an application-wide credential for a provider it does not use either, and the
+ * selected set is not knowable at the delivery call site without threading app config through it.
+ * Stripping a path no module minted for this app is harmless — it is absent from the blob anyway.
+ */
+export function collectPerPrincipalSecretBlobPaths(): ReadonlySet<string> {
+  const paths = new Set<string>();
+  for (const module of INFRA_PROVIDER_MODULES) {
+    for (const path of module.perPrincipalSecretBlobPaths) {
+      paths.add(path);
+    }
+  }
+  return paths;
+}
+
+/**
+ * Build a `Map<InfraProvider, InfraProviderModule>` for the
+ * canonical catalog. Callers store the result once at startup and
+ * pass it to `materializeInfraSection` (digest derivation) or to
+ * orchestrator paths that look up modules by `InfraProvider`.
+ */
+export function buildInfraProviderModuleMap(): ReadonlyMap<InfraProvider, InfraProviderModule> {
+  const map = new Map<InfraProvider, InfraProviderModule>();
+  for (const m of INFRA_PROVIDER_MODULES) {
+    if (map.has(m.provider)) {
+      throw new Error(
+        `INFRA_PROVIDER_MODULES contains duplicate provider '${m.provider}' — ` +
+        `each InfraProvider may have at most one module.`,
+      );
+    }
+    map.set(m.provider, m);
+  }
+  return map;
+}

package/src/minio-self/__tests__/minio-self.infra.module.test.ts

@@ -0,0 +1,70 @@
+/**
+ * Tests for `MinioSelfInfraProviderModule` (Slice 5.1 of
+ * `infra-provider-planner.md`).
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+} from '@wildo-ai/platform-config-lib';
+import { MinioSelfInfraProviderModule } from '../minio-self.infra.module';
+
+describe('MinioSelfInfraProviderModule.plan()', () => {
+  const contribution = MinioSelfInfraProviderModule.plan({
+    environment: 'local',
+    runtime: 'docker-compose',
+    backingServiceKey: 's3',
+    config: {},
+  });
+
+  it('declares the right provider + capability triple', () => {
+    expect(MinioSelfInfraProviderModule.provider).toBe(InfraProvider.MINIO_SELF);
+    expect(MinioSelfInfraProviderModule.supportedCapabilities).toEqual([
+      InfraCapability.OBJECT_STORAGE,
+    ]);
+  });
+
+  it('contributes the minio compose service + K8s manifest', () => {
+    expect(contribution.dockerComposeServices).toEqual(['minio']);
+    expect(contribution.k8sResources).toEqual([
+      'templates/infra/k8s/internal/minio/deployment.yaml.hbs',
+    ]);
+  });
+
+  it('declares STORAGE_PROVIDER=minio and the default endpoint topology', () => {
+    expect(contribution.platformAdmin?.envVars).toEqual({
+      STORAGE_PROVIDER: 'minio',
+      STORAGE_ENDPOINT: 'minio',
+      STORAGE_PORT: '9000',
+      STORAGE_USE_SSL: 'false',
+    });
+    expect(contribution.platformAdmin?.secretEnvVars).toEqual([
+      'STORAGE_ACCESS_KEY',
+      'STORAGE_SECRET_KEY',
+    ]);
+    expect(contribution.platformAdmin?.consumers).toEqual([
+      InfraPlatformAdminConsumer.APPS_MANAGER,
+      InfraPlatformAdminConsumer.COMPANION,
+    ]);
+  });
+
+  it('declares NO appRuntime contribution (shared-bucket model — no per-app state)', () => {
+    expect(contribution.appRuntime).toBeUndefined();
+  });
+});
+
+describe('MinioSelfInfraProviderModule shared-bucket absence (Slice 5.1)', () => {
+  it('does NOT declare mintAppCredentials (shared bucket — no per-app creds)', () => {
+    expect(MinioSelfInfraProviderModule.mintAppCredentials).toBeUndefined();
+  });
+
+  it('does NOT declare revokeAppCredentials', () => {
+    expect(MinioSelfInfraProviderModule.revokeAppCredentials).toBeUndefined();
+  });
+
+  it('does NOT declare mintPlatformServiceCredentials', () => {
+    expect(MinioSelfInfraProviderModule.mintPlatformServiceCredentials).toBeUndefined();
+  });
+});