@ankhorage/contracts 13.0.1 → 15.0.0

package/src/contracts.test.ts

@@ -9,11 +9,10 @@ import {
   APP_CATEGORIES,
   type AppCategory,
   type AppManifest,
-  AUTH_PROVIDERS,
+  type AppStateSpec,
   AUTH_SIGN_IN_IDENTIFIERS,
   AUTH_SIGN_UP_POLICIES,
   type AuthFlowConfig,
-  type AuthSpec,
   type ButtonPressEventDto,
   type CollectionItemPressEventDto,
   type ComponentEventDto,
@@ -22,16 +21,12 @@ import {
   type DbAdminAdapter,
   type DbChangeEvent,
   type DbRealtimeAdapter,
-  DEPLOYMENT_TARGETS,
   type FormSubmitEventDto,
   type ImageAssetSource,
+  type InfraAuthSpec,
   type InfraManifest,
   NAVIGATOR_TYPES,
   type RouteDefinition,
-  type SplashScreenSpec,
-  STATE_PERSISTENCE_MODES,
-  STATE_PROVIDERS,
-  type StateSpec,
   type StoragePublicUrlResult,
   type StorageResult,
   type StorageUploadResult,
@@ -106,10 +101,6 @@ describe('contracts', () => {
       'utilities_tools',
       'weather',
     ]);
-    expect(DEPLOYMENT_TARGETS).toEqual(['minikube']);
-    expect(AUTH_PROVIDERS).toEqual(['supabase']);
-    expect(STATE_PROVIDERS).toEqual(['legend']);
-    expect(STATE_PERSISTENCE_MODES).toEqual(['none', 'local', 'secure', 'database']);
   });
 
   it('exports the app category union for template packages', () => {
@@ -196,25 +187,6 @@ describe('contracts', () => {
     expect(theme.recipes?.patterns?.Panel?.padding).toBe('xl');
   });
 
-  it('accepts serializable splash screen branding on app manifests', () => {
-    const splashScreen: SplashScreenSpec = {
-      backgroundColor: '#ffffff',
-      image: { mediaId: 'splash-logo' },
-      imageWidth: 160,
-      resizeMode: 'contain',
-      dark: {
-        backgroundColor: '#000000',
-        image: { mediaId: 'splash-logo-dark' },
-        imageWidth: 160,
-        resizeMode: 'contain',
-      },
-    };
-
-    const manifest: Pick<AppManifest, 'splashScreen'> = { splashScreen };
-
-    expect(JSON.parse(JSON.stringify(manifest))).toEqual({ splashScreen });
-  });
-
   it('accepts screens with operation data loaders and repeat empty-state nodes', () => {
     const manifest: Pick<AppManifest, 'screens'> = {
       screens: {
@@ -275,14 +247,19 @@ describe('contracts', () => {
     expect(manifest.screens.products?.root.repeat?.empty?.[0]?.type).toBe('Notice');
   });
 
-  it('accepts provider-neutral state infra selection on app manifests', () => {
-    const state: StateSpec = {
+  it('selects in-memory application state independently from infrastructure', () => {
+    const state: AppStateSpec = {
       provider: 'legend',
-      persistence: 'none',
+      persistence: false,
     };
-    const manifest: Pick<AppManifest, 'infra'> = {
+    const manifest: Pick<AppManifest, 'infra' | 'state'> = {
+      state,
       infra: {
-        state,
+        environments: {
+          local: {
+            deployment: { compute: { provider: 'local' }, runtime: { provider: 'minikube' } },
+          },
+        },
         modules: [],
         modulesConfig: {
           localization: {
@@ -293,8 +270,9 @@ describe('contracts', () => {
     };
 
     expect(JSON.parse(JSON.stringify(manifest))).toEqual({
+      state,
       infra: {
-        state,
+        environments: manifest.infra.environments,
         modules: [],
         modulesConfig: {
           localization: {
@@ -312,6 +290,11 @@ describe('contracts', () => {
     const hasLegacyModules: HasLegacyModules = false;
     const hasLegacyModulesConfig: HasLegacyModulesConfig = false;
     const infra: InfraManifest = {
+      environments: {
+        local: {
+          deployment: { compute: { provider: 'local' }, runtime: { provider: 'minikube' } },
+        },
+      },
       modules: ['expo-localization'],
       modulesConfig: {
         'expo-localization': {
@@ -328,7 +311,7 @@ describe('contracts', () => {
 
     expect(hasLegacyModules).toBe(false);
     expect(hasLegacyModulesConfig).toBe(false);
-    expect(Object.keys(infra).sort()).toEqual(['modules', 'modulesConfig']);
+    expect(Object.keys(infra).sort()).toEqual(['environments', 'modules', 'modulesConfig']);
     expect(expoConfig.plugins).toEqual(['expo-router']);
   });
 
@@ -387,10 +370,9 @@ describe('contracts', () => {
       unauthorizedRoute: '/sign-in',
     };
 
-    const auth: AuthSpec = {
+    const auth: InfraAuthSpec = {
       scope: 'global',
       provider: 'supabase',
-      authorization: { kind: 'RBAC', engine: 'cerbos' },
       flow: authFlow,
       signIn: { identifiers: ['email'] },
       signUp: {

package/src/deploy.test.ts

@@ -4,8 +4,9 @@ import { join } from 'node:path';
 import { describe, expect, it } from 'bun:test';
 
 import { isAppManifest } from './appManifest';
-import { APP_DEPLOY_ENVIRONMENT_IDS, APP_DEPLOY_TARGET_IDS, isAppDeployManifest } from './deploy';
-import { DEPLOYMENT_TARGETS } from './types';
+import { APP_DEPLOY_TARGET_IDS, isAppDeployManifest } from './deploy';
+import { APP_ENVIRONMENT_IDS } from './environments';
+import { INFRA_RUNTIME_COMPATIBILITY } from './infra';
 
 function createManifest(deploy?: unknown): Record<string, unknown> {
   return {
@@ -26,7 +27,14 @@ function createManifest(deploy?: unknown): Record<string, unknown> {
     ],
     activeThemeId: 'default',
     ...(deploy === undefined ? {} : { deploy }),
-    infra: { deployment: { target: 'minikube', monitoring: true }, modules: [] },
+    infra: {
+      environments: {
+        local: {
+          deployment: { compute: { provider: 'local' }, runtime: { provider: 'minikube' } },
+        },
+      },
+      modules: [],
+    },
     navigator: { type: 'stack', routes: [] },
     screens: {},
     settings: { localization: { defaultLocale: 'en', locales: ['en'] } },
@@ -36,11 +44,11 @@ function createManifest(deploy?: unknown): Record<string, unknown> {
 describe('app deployment contracts', () => {
   it('keeps app distribution targets distinct from Infra deployment targets', () => {
     expect(APP_DEPLOY_TARGET_IDS).toEqual(['web', 'android', 'ios']);
-    expect(DEPLOYMENT_TARGETS).toEqual(['minikube']);
+    expect(Object.keys(INFRA_RUNTIME_COMPATIBILITY)).toEqual(['minikube', 'k3s', 'docker-compose']);
   });
 
   it('defines one logical environment vocabulary across platform-specific execution', () => {
-    expect(APP_DEPLOY_ENVIRONMENT_IDS).toEqual(['local', 'preview', 'production']);
+    expect(APP_ENVIRONMENT_IDS).toEqual(['local', 'preview', 'production']);
   });
 
   it('accepts canonical web, Android, and iOS desired state with stable native schemes', () => {

package/src/deploy.ts

@@ -2,17 +2,6 @@ export const APP_DEPLOY_TARGET_IDS = ['web', 'android', 'ios'] as const;
 
 export type AppDeployTargetId = (typeof APP_DEPLOY_TARGET_IDS)[number];
 
-/**
- * Logical application environments shared across platform-specific planning.
- *
- * `local` maps to local Web, iOS development, and Android debug execution.
- * Environment-specific endpoints, signing material, and credentials are owned
- * by their dedicated deployment/infra configuration rather than this identity contract.
- */
-export const APP_DEPLOY_ENVIRONMENT_IDS = ['local', 'preview', 'production'] as const;
-
-export type AppDeployEnvironmentId = (typeof APP_DEPLOY_ENVIRONMENT_IDS)[number];
-
 export interface AppDeployProviderSelection {
   readonly build?: string;
   readonly publish?: string;

package/src/environments.ts

@@ -0,0 +1,4 @@
+/** Logical application environments shared by infrastructure and application shipment. */
+export const APP_ENVIRONMENT_IDS = ['local', 'preview', 'production'] as const;
+
+export type AppEnvironmentId = (typeof APP_ENVIRONMENT_IDS)[number];

package/src/index.ts

@@ -5,12 +5,13 @@ export * from './cli';
 export * from './data';
 export * from './db';
 export * from './deploy';
+export * from './environments';
+export * from './infra';
 export * from './media';
 export * from './navigator';
 export * from './repository';
 export * from './requirements';
 export * from './runtimeCallbacks';
-export * from './secretManifest';
 export * from './secrets';
 export * from './state';
 export * from './storage';

package/src/infra/constants.ts

@@ -0,0 +1,91 @@
+/** One compatibility source for manifest types, validation, discovery and configuration UIs. */
+export const INFRA_RUNTIME_COMPATIBILITY = {
+  minikube: ['local'],
+  k3s: ['local', 'hetzner'],
+  'docker-compose': ['local', 'hetzner'],
+} as const;
+
+/** Canonical package identities. Capabilities describe ownership, not eight mandatory methods. */
+export const INFRA_ADAPTER_CATALOG = {
+  local: {
+    id: 'local',
+    package: '@ankhorage/local',
+    kind: 'compute',
+    configVersion: 1,
+    capabilities: ['compute'],
+    targets: ['local-host'],
+    dependencies: [],
+  },
+  hetzner: {
+    id: 'hetzner',
+    package: '@ankhorage/hetzner',
+    kind: 'compute',
+    configVersion: 1,
+    capabilities: ['compute'],
+    targets: ['ssh-host'],
+    dependencies: [],
+  },
+  minikube: {
+    id: 'minikube',
+    package: '@ankhorage/minikube',
+    kind: 'runtime',
+    configVersion: 1,
+    capabilities: ['runtime', 'workloads', 'networking'],
+    targets: ['local-host'],
+    dependencies: ['compute'],
+  },
+  k3s: {
+    id: 'k3s',
+    package: '@ankhorage/k3s',
+    kind: 'runtime',
+    configVersion: 1,
+    capabilities: ['runtime', 'workloads', 'networking'],
+    targets: ['local-host', 'ssh-host'],
+    dependencies: ['compute'],
+  },
+  'docker-compose': {
+    id: 'docker-compose',
+    package: '@ankhorage/docker-compose',
+    kind: 'runtime',
+    configVersion: 1,
+    capabilities: ['runtime', 'workloads', 'networking'],
+    targets: ['local-host', 'ssh-host'],
+    dependencies: ['compute'],
+  },
+  supabase: {
+    id: 'supabase',
+    package: '@ankhorage/supabase',
+    kind: 'service',
+    configVersion: 1,
+    capabilities: ['database', 'auth', 'objectStorage'],
+    targets: [],
+    dependencies: ['workloads'],
+  },
+  cerbos: {
+    id: 'cerbos',
+    package: '@ankhorage/cerbos',
+    kind: 'service',
+    configVersion: 1,
+    capabilities: ['authz'],
+    targets: [],
+    dependencies: ['workloads'],
+  },
+  r2: {
+    id: 'r2',
+    package: '@ankhorage/r2',
+    kind: 'service',
+    configVersion: 1,
+    capabilities: ['objectStorage'],
+    targets: [],
+    dependencies: [],
+  },
+  'supabase-vault': {
+    id: 'supabase-vault',
+    package: '@ankhorage/supabase-vault',
+    kind: 'service',
+    configVersion: 1,
+    capabilities: ['secretStore'],
+    targets: [],
+    dependencies: ['database'],
+  },
+} as const;

package/src/infra/infraFields.ts

@@ -0,0 +1,20 @@
+import { isStringArray } from '@ankhorage/utility/array';
+import { isNonEmptyString } from '@ankhorage/utility/string';
+
+/*** Primitive field rules for portable Infra configuration, shared by its exact-shape validators. */
+export const infraFields = {
+  optionalText: (value: unknown): boolean => value === undefined || isNonEmptyString(value),
+  strings: (value: unknown): boolean => isStringArray(value) && value.every(isNonEmptyString),
+  optionalStrings: (value: unknown): boolean =>
+    value === undefined || (isStringArray(value) && value.every(isNonEmptyString)),
+  positiveInteger: (value: unknown): boolean =>
+    typeof value === 'number' && Number.isSafeInteger(value) && value > 0,
+  nonnegativeInteger: (value: unknown): boolean =>
+    typeof value === 'number' && Number.isSafeInteger(value) && value >= 0,
+  optionalPositiveInteger: (value: unknown): boolean =>
+    value === undefined || (typeof value === 'number' && Number.isSafeInteger(value) && value > 0),
+  optionalNonnegativeInteger: (value: unknown): boolean =>
+    value === undefined || (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0),
+  port: (value: unknown): boolean =>
+    typeof value === 'number' && Number.isInteger(value) && value > 0 && value <= 65535,
+};

package/src/infra/isInfraAdapterDescriptor.ts

@@ -0,0 +1,37 @@
+import { isRecord } from '@ankhorage/utility/object';
+
+import type { InfraAdapterDescriptor } from '../types/infraAdapters';
+import { INFRA_ADAPTER_CATALOG } from './constants';
+import { isInfraShape } from './isInfraShape';
+
+/*** Installed adapters must match the canonical identity, capabilities, targets and config version exactly. */
+export function isInfraAdapterDescriptor(value: unknown): value is InfraAdapterDescriptor {
+  if (!isRecord(value)) return false;
+  const entry = Object.values(INFRA_ADAPTER_CATALOG).find((candidate) => candidate.id === value.id);
+  if (!entry) return false;
+  return isInfraShape(value, {
+    id: (id) => id === entry.id,
+    package: (name) => name === entry.package,
+    kind: (kind) => kind === entry.kind,
+    configVersion: (version) => version === entry.configVersion,
+    capabilities: (items) => matchesCatalogList(items, entry.capabilities),
+    targets: (items) => matchesCatalogList(items, entry.targets),
+    dependencies: (items) => matchesCatalogList(items, entry.dependencies),
+    operations: (items) =>
+      items === undefined ||
+      (Array.isArray(items) &&
+        new Set(items).size === items.length &&
+        items.every((item: unknown) =>
+          ['suspend', 'resume', 'generate', 'diagnostics'].some((operation) => operation === item),
+        )),
+  });
+}
+
+/*** Canonical descriptor lists are ordered so JSON discovery and conformance are deterministic. */
+function matchesCatalogList(value: unknown, expected: readonly string[]): boolean {
+  return (
+    Array.isArray(value) &&
+    value.length === expected.length &&
+    value.every((item, index) => item === expected.at(index))
+  );
+}

package/src/infra/isInfraAuthSpec.ts

@@ -0,0 +1,98 @@
+import { isStringArray } from '@ankhorage/utility/array';
+import { isRecordOf } from '@ankhorage/utility/object';
+import { isOptionalString } from '@ankhorage/utility/string';
+
+import { isIconSpec } from '../appManifest/icon';
+import { AUTH_OAUTH_PROVIDER_IDS } from '../auth';
+import {
+  AUTH_PROFILE_CREATE_STRATEGIES,
+  AUTH_PROFILE_PRIMARY_KEY_STRATEGIES,
+  AUTH_PROFILE_UPDATE_STRATEGIES,
+  AUTH_SCOPES,
+  AUTH_SIGN_IN_IDENTIFIERS,
+  AUTH_SIGN_UP_POLICIES,
+} from '../types';
+import type { InfraAuthSpec } from '../types/infraManifest';
+import type { InfraShape } from '../types/infraValidation';
+import { isInfraShape } from './isInfraShape';
+
+/*** Preserve application auth configuration while rejecting nested authorization and unknown providers. */
+export function isInfraAuthSpec(value: unknown): value is InfraAuthSpec {
+  return isInfraShape(value, {
+    provider: (provider) => provider === 'supabase',
+    scope: (scope) => scope === undefined || AUTH_SCOPES.some((item) => item === scope),
+    flow: (flow) => flow === undefined || isAuthFlow(flow),
+    signIn: (signIn) =>
+      signIn === undefined ||
+      isInfraShape(signIn, {
+        identifiers: (ids) =>
+          Array.isArray(ids) &&
+          ids.every((id) => AUTH_SIGN_IN_IDENTIFIERS.some((item) => item === id)),
+      }),
+    signUp: (signUp) => signUp === undefined || isAuthSignUp(signUp),
+    oauth: (oauth) => oauth === undefined || isAuthOAuth(oauth),
+    profile: (profile) => profile === undefined || isAuthProfile(profile),
+  } satisfies InfraShape<InfraAuthSpec>);
+}
+
+/*** Auth routing intent stays separate from provider-runtime callbacks and Navigator topology. */
+function isAuthFlow(value: unknown): boolean {
+  return isInfraShape(value, {
+    signInRoute: (route) => typeof route === 'string',
+    postSignInRoute: (route) => typeof route === 'string',
+    signUpRoute: isOptionalString,
+    signOutRoute: isOptionalString,
+    forgotPasswordRoute: isOptionalString,
+    otpRoute: isOptionalString,
+    unauthorizedRoute: isOptionalString,
+  });
+}
+
+/*** Validate sign-up field intent using the existing application auth contract. */
+function isAuthSignUp(value: unknown): boolean {
+  return isInfraShape(value, {
+    requiredFields: isStringArray,
+    optionalFields: (fields) => fields === undefined || isStringArray(fields),
+    signUpPolicy: (policy) =>
+      policy === undefined || AUTH_SIGN_UP_POLICIES.some((item) => item === policy),
+  });
+}
+
+/*** OAuth references contain no credential payload. Custom OAuth identities remain application-owned. */
+function isAuthOAuth(value: unknown): boolean {
+  return isInfraShape(value, {
+    enabled: (enabled) => typeof enabled === 'boolean',
+    callbackRoute: (route) => typeof route === 'string',
+    providers: (providers) => Array.isArray(providers) && providers.every(isAuthOAuthProvider),
+  });
+}
+
+/*** Validate OAuth display/config metadata, preserving explicitly extensible OAuth provider IDs. */
+function isAuthOAuthProvider(value: unknown): boolean {
+  return isInfraShape(value, {
+    id: (id) =>
+      typeof id === 'string' &&
+      (AUTH_OAUTH_PROVIDER_IDS.some((item) => item === id) || id.length > 0),
+    label: isOptionalString,
+    enabled: (value) => value === undefined || typeof value === 'boolean',
+    scopes: (scopes) => scopes === undefined || isStringArray(scopes),
+    queryParams: (params) =>
+      params === undefined || isRecordOf(params, (entry) => typeof entry === 'string'),
+    icon: (icon) => icon === undefined || isIconSpec(icon),
+    credentialsRef: isOptionalString,
+  });
+}
+
+/*** Validate profile provisioning choices without inventing a new application profile model. */
+function isAuthProfile(value: unknown): boolean {
+  return isInfraShape(value, {
+    fields: isStringArray,
+    table: isOptionalString,
+    primaryKey: (key) =>
+      key === undefined || AUTH_PROFILE_PRIMARY_KEY_STRATEGIES.some((item) => item === key),
+    createStrategy: (strategy) =>
+      strategy === undefined || AUTH_PROFILE_CREATE_STRATEGIES.some((item) => item === strategy),
+    updateStrategy: (strategy) =>
+      strategy === undefined || AUTH_PROFILE_UPDATE_STRATEGIES.some((item) => item === strategy),
+  });
+}

package/src/infra/isInfraCredentialRef.ts

@@ -0,0 +1,11 @@
+import { isNonEmptyString } from '@ankhorage/utility/string';
+
+import { isInfraShape } from './isInfraShape';
+
+/*** Bootstrap credential references are explicitly separate from managed runtime secrets. */
+export function isInfraCredentialRef(value: unknown): boolean {
+  return isInfraShape(value, {
+    source: (source) => source === 'control-plane',
+    name: isNonEmptyString,
+  });
+}

package/src/infra/isInfraDeploymentSpec.ts

@@ -0,0 +1,75 @@
+import { isRecord } from '@ankhorage/utility/object';
+import { isNonEmptyString } from '@ankhorage/utility/string';
+
+import type {
+  InfraComputeSelection,
+  InfraDeploymentSpec,
+  InfraRuntimeSelection,
+} from '../types/infraManifest';
+import type { InfraShape } from '../types/infraValidation';
+import { INFRA_RUNTIME_COMPATIBILITY } from './constants';
+import { infraFields } from './infraFields';
+import { isInfraCredentialRef } from './isInfraCredentialRef';
+import { isInfraShape } from './isInfraShape';
+
+/*** Validate provider-specific config and the exact same compatibility map used by TypeScript. */
+export function isInfraDeploymentSpec(value: unknown): value is InfraDeploymentSpec {
+  if (!isInfraShape(value, { compute: isCompute, runtime: isRuntime }) || !isRecord(value))
+    return false;
+  if (!isRecord(value.compute) || !isRecord(value.runtime)) return false;
+  const compute = value.compute.provider;
+  const runtime = value.runtime.provider;
+  return Object.entries(INFRA_RUNTIME_COMPATIBILITY).some(
+    ([id, providers]) => id === runtime && providers.some((provider) => provider === compute),
+  );
+}
+
+/*** Compute configuration is closed per provider; control-plane refs cannot be managed secrets. */
+function isCompute(value: unknown): boolean {
+  if (!isRecord(value)) return false;
+  if (value.provider === 'local')
+    return isInfraShape(value, {
+      provider: (provider) => provider === 'local',
+      workingDirectory: infraFields.optionalText,
+    } satisfies InfraShape<InfraComputeSelection<'local'>>);
+  return isInfraShape(value, {
+    provider: (provider) => provider === 'hetzner',
+    location: isNonEmptyString,
+    serverType: infraFields.optionalText,
+    image: infraFields.optionalText,
+    credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),
+  } satisfies InfraShape<InfraComputeSelection<'hetzner'>>);
+}
+
+/*** Runtime topology expresses host roles and never couples k3s to a compute vendor. */
+function isRuntime(value: unknown): boolean {
+  if (!isRecord(value)) return false;
+  switch (value.provider) {
+    case 'minikube':
+      return isInfraShape(value, {
+        provider: (provider) => provider === 'minikube',
+        profile: infraFields.optionalText,
+        driver: (driver) => driver === undefined || driver === 'docker' || driver === 'podman',
+        cpus: infraFields.optionalPositiveInteger,
+        memoryMiB: infraFields.optionalPositiveInteger,
+      } satisfies InfraShape<InfraRuntimeSelection<'minikube'>>);
+    case 'k3s':
+      return isInfraShape(value, {
+        provider: (provider) => provider === 'k3s',
+        version: infraFields.optionalText,
+        topology: (topology) =>
+          topology === undefined ||
+          isInfraShape(topology, {
+            servers: infraFields.positiveInteger,
+            agents: infraFields.nonnegativeInteger,
+          }),
+      } satisfies InfraShape<InfraRuntimeSelection<'k3s'>>);
+    case 'docker-compose':
+      return isInfraShape(value, {
+        provider: (provider) => provider === 'docker-compose',
+        projectName: infraFields.optionalText,
+      } satisfies InfraShape<InfraRuntimeSelection<'docker-compose'>>);
+    default:
+      return false;
+  }
+}

package/src/infra/isInfraEnvironmentSpec.ts

@@ -0,0 +1,95 @@
+import { isRecord } from '@ankhorage/utility/object';
+
+import type { InfraEnvironmentSpec, InfraObjectStorageSpec } from '../types/infraManifest';
+import type { InfraShape } from '../types/infraValidation';
+import { INFRA_ADAPTER_CATALOG } from './constants';
+import { infraFields } from './infraFields';
+import { isInfraAuthSpec } from './isInfraAuthSpec';
+import { isInfraCredentialRef } from './isInfraCredentialRef';
+import { isInfraDeploymentSpec } from './isInfraDeploymentSpec';
+import { isInfraShape } from './isInfraShape';
+import { isInfraWorkloadSpec } from './isInfraWorkloadSpec';
+
+/*** Validate sibling capabilities and their required relationships within one environment. */
+export function isInfraEnvironmentSpec(value: unknown): value is InfraEnvironmentSpec {
+  return isEnvironmentShape(value) && hasServiceDependencies(value);
+}
+
+/*** Check all environment field shapes before inspecting canonical dependency metadata. */
+function isEnvironmentShape(value: unknown): value is InfraEnvironmentSpec {
+  return isInfraShape(value, {
+    deployment: isInfraDeploymentSpec,
+    database: (database) =>
+      database === undefined ||
+      isInfraShape(database, {
+        provider: (provider) => provider === 'supabase',
+        tier: (tier) => tier === undefined || tier === 'dev' || tier === 'prod',
+      }),
+    objectStorage: (storage) => storage === undefined || isObjectStorage(storage),
+    auth: (auth) => auth === undefined || isInfraAuthSpec(auth),
+    authz: (authz) =>
+      authz === undefined ||
+      isInfraShape(authz, {
+        provider: (provider) => provider === 'cerbos',
+        kind: (kind) => kind === 'ABAC' || kind === 'RBAC',
+      }),
+    secretStore: (store) =>
+      store === undefined ||
+      isInfraShape(store, {
+        provider: (provider) => provider === 'supabase-vault',
+        schema: infraFields.optionalText,
+      }),
+    networking: (networking) =>
+      networking === undefined || isInfraShape(networking, { domain: infraFields.optionalText }),
+    workloads: (workloads) => workloads === undefined || isWorkloads(workloads),
+  } satisfies InfraShape<InfraEnvironmentSpec>);
+}
+
+/*** Object storage can vary independently from database/auth; there is no implicit auto provider. */
+function isObjectStorage(value: unknown): boolean {
+  if (!isRecord(value)) return false;
+  const common = {
+    provider: (provider: unknown) => provider === value.provider,
+    buckets: infraFields.optionalStrings,
+  };
+  if (value.provider === 'supabase') return isInfraShape(value, common);
+  return isInfraShape(value, {
+    ...common,
+    provider: (provider) => provider === 'r2',
+    accountId: infraFields.optionalText,
+    credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),
+  } satisfies InfraShape<Extract<InfraObjectStorageSpec, { readonly provider: 'r2' }>>);
+}
+
+/*** Duplicate desired workload identities cannot be reconciled safely. */
+function isWorkloads(value: unknown): boolean {
+  return (
+    Array.isArray(value) &&
+    value.every(isInfraWorkloadSpec) &&
+    new Set(value.map((workload) => workload.id)).size === value.length
+  );
+}
+
+/*** Check catalog dependencies against selected sibling capabilities and runtime capabilities. */
+function hasServiceDependencies(value: InfraEnvironmentSpec): boolean {
+  const selections = [
+    value.database,
+    value.auth,
+    value.authz,
+    value.objectStorage,
+    value.secretStore,
+  ];
+  const runtime = Object.values(INFRA_ADAPTER_CATALOG).find(
+    (entry) => entry.id === value.deployment.runtime.provider,
+  );
+  const capabilities = new Set<string>([
+    'compute',
+    ...(runtime?.capabilities ?? []),
+    ...Object.entries(value)
+      .filter(([, selection]) => selection !== undefined)
+      .map(([capability]) => capability),
+  ]);
+  return Object.values(INFRA_ADAPTER_CATALOG)
+    .filter((entry) => selections.some((selection) => selection?.provider === entry.id))
+    .every((entry) => entry.dependencies.every((dependency) => capabilities.has(dependency)));
+}