@ankhorage/contracts 13.0.1 → 15.0.0

package/src/infra.test.ts

@@ -0,0 +1,268 @@
+import { describe, expect, it } from 'bun:test';
+
+import {
+  INFRA_ADAPTER_CATALOG,
+  INFRA_RUNTIME_COMPATIBILITY,
+  type InfraEnvironmentSpec,
+  type InfraManifest,
+  isInfraAdapterDescriptor,
+  isInfraDeploymentSpec,
+  isInfraEnvironmentSpec,
+  isInfraManifest,
+  parseInfraManifest,
+  validateInfraAdapterSelection,
+} from './infra';
+
+const local = {
+  deployment: { compute: { provider: 'local' }, runtime: { provider: 'minikube' } },
+} as const satisfies InfraEnvironmentSpec;
+const production = {
+  deployment: {
+    compute: { provider: 'hetzner', location: 'nbg1' },
+    runtime: { provider: 'k3s', topology: { servers: 1, agents: 0 } },
+  },
+  database: { provider: 'supabase' },
+  auth: { provider: 'supabase' },
+  objectStorage: { provider: 'r2', buckets: ['media'] },
+  authz: { provider: 'cerbos', kind: 'ABAC' },
+  secretStore: { provider: 'supabase-vault' },
+  networking: { domain: 'api.example.ch' },
+} as const satisfies InfraEnvironmentSpec;
+
+describe('standalone Infra environments', () => {
+  it('parses local/preview/production without an AppManifest or Deploy', () => {
+    const manifest = {
+      environments: { local, preview: production, production },
+      modules: [],
+    } satisfies InfraManifest;
+    expect(parseInfraManifest(JSON.parse(JSON.stringify(manifest)))).toEqual({
+      ok: true,
+      value: manifest,
+      diagnostics: [],
+    });
+  });
+
+  it.each([
+    null,
+    {},
+    { modules: [] },
+    { environments: {}, modules: [] },
+    { environments: { production }, modules: [] },
+    { environments: { local, staging: local }, modules: [] },
+    { environments: { local, preview: null }, modules: [] },
+    { environments: { local }, modules: [42] },
+    { environments: { local }, modules: [], modulesConfig: [] },
+    { environments: { local }, modules: [], apis: 'invalid' },
+  ])('rejects invalid environment boundaries: %j', (value) => {
+    expect(isInfraManifest(value)).toBe(false);
+    expect(parseInfraManifest(value).ok).toBe(false);
+  });
+
+  it.each([
+    'deployment',
+    'storage',
+    'state',
+    'auth',
+    'database',
+    'networking',
+    'secretStore',
+    'plugins',
+    'pluginsConfig',
+  ])('rejects removed top-level %s', (key) => {
+    expect(isInfraManifest({ environments: { local }, modules: [], [key]: {} })).toBe(false);
+  });
+
+  it.each(['storage', 'state', 'monitoring', 'observability', 'target'])(
+    'rejects obsolete or speculative environment %s',
+    (key) => {
+      expect(isInfraEnvironmentSpec({ ...local, [key]: {} })).toBe(false);
+    },
+  );
+});
+
+describe('exact deployment compatibility', () => {
+  it('tests every registered compute/runtime pair against the same catalog', () => {
+    const computes = Object.values(INFRA_ADAPTER_CATALOG).filter(
+      (entry) => entry.kind === 'compute',
+    );
+    for (const compute of computes) {
+      for (const [runtime, allowed] of Object.entries(INFRA_RUNTIME_COMPATIBILITY)) {
+        const selection = {
+          compute: {
+            provider: compute.id,
+            ...(compute.id === 'hetzner' ? { location: 'nbg1' } : {}),
+          },
+          runtime: { provider: runtime },
+        };
+        expect(isInfraDeploymentSpec(selection)).toBe(allowed.some((id) => id === compute.id));
+      }
+    }
+  });
+
+  it.each([
+    { compute: { provider: 'gcp' }, runtime: { provider: 'ecs' } },
+    { compute: { provider: 'hetzner', location: 'nbg1' }, runtime: { provider: 'eks' } },
+    { compute: { provider: 'hetzner', location: 'nbg1' }, runtime: { provider: 'minikube' } },
+    { compute: { provider: 'hetzner' }, runtime: { provider: 'k3s' } },
+    { compute: { provider: 'hetzner', location: ' ' }, runtime: { provider: 'k3s' } },
+    { compute: { provider: 'local', location: 'nbg1' }, runtime: { provider: 'k3s' } },
+    { ...local.deployment, monitoring: false },
+    { target: 'minikube', monitoring: true },
+  ])('rejects unsupported/config-mismatched deployment: %j', (value) => {
+    expect(isInfraDeploymentSpec(value)).toBe(false);
+  });
+});
+
+describe('runtime topology configuration', () => {
+  it.each([
+    { provider: 'k3s', topology: { servers: 0, agents: 1 } },
+    { provider: 'k3s', topology: { servers: 1, agents: -1 } },
+    { provider: 'k3s', topology: { servers: 1.5, agents: 0 } },
+    { provider: 'k3s', topology: { servers: 1, agents: Infinity } },
+    { provider: 'k3s', topology: { servers: 1 } },
+    { provider: 'minikube', cpus: 0 },
+    { provider: 'minikube', memoryMiB: NaN },
+    { provider: 'minikube', driver: 'unknown' },
+    { provider: 'docker-compose', profile: 'minikube' },
+  ])('rejects malformed runtime configuration: %j', (runtime) => {
+    expect(isInfraDeploymentSpec({ compute: { provider: 'local' }, runtime })).toBe(false);
+  });
+
+  it('accepts multi-node topology on both supported k3s computes', () => {
+    for (const compute of [{ provider: 'local' }, { provider: 'hetzner', location: 'nbg1' }]) {
+      expect(
+        isInfraDeploymentSpec({
+          compute,
+          runtime: { provider: 'k3s', topology: { servers: 3, agents: 4 } },
+        }),
+      ).toBe(true);
+    }
+  });
+});
+
+describe('sibling service configuration', () => {
+  it('accepts Supabase auth, Cerbos and independent R2 storage', () => {
+    expect(isInfraEnvironmentSpec(production)).toBe(true);
+    expect(isInfraEnvironmentSpec({ ...production, objectStorage: { provider: 'supabase' } })).toBe(
+      true,
+    );
+    expect(isInfraEnvironmentSpec({ ...local, auth: { provider: 'supabase' } })).toBe(true);
+  });
+
+  it.each([
+    { database: { provider: 'postgres' } },
+    { database: { provider: 'supabase', tier: 'enterprise' } },
+    { objectStorage: { provider: 'auto' } },
+    { objectStorage: { provider: 's3' } },
+    { objectStorage: { provider: 'supabase', buckets: [1] } },
+    { objectStorage: { provider: 'supabase', accountId: 'r2-account' } },
+    { auth: { provider: 'custom' } },
+    { auth: { provider: 'supabase', scope: 'unknown' } },
+    { auth: { provider: 'supabase', authorization: { kind: 'ABAC', engine: 'cerbos' } } },
+    { authz: { provider: 'native', kind: 'RBAC' } },
+    { authz: { engine: 'cerbos', kind: 'ABAC' } },
+    { authz: { provider: 'cerbos', kind: 'unknown' } },
+    { secretStore: { provider: 'unknown' } },
+    { secretStore: { provider: 'supabase-vault' } },
+    { networking: { domain: 'example.ch', cdn: true } },
+  ])('rejects unsupported service selection: %j', (selection) => {
+    expect(isInfraEnvironmentSpec({ ...local, ...selection })).toBe(false);
+  });
+});
+
+describe('authentication configuration', () => {
+  it('preserves auth flow, profile and OAuth credential references', () => {
+    expect(
+      isInfraEnvironmentSpec({
+        ...production,
+        auth: {
+          provider: 'supabase',
+          scope: 'global',
+          flow: { signInRoute: '/sign-in', postSignInRoute: '/' },
+          signIn: { identifiers: ['email'] },
+          signUp: { requiredFields: ['email', 'password'], signUpPolicy: 'requireVerification' },
+          profile: {
+            fields: ['email'],
+            primaryKey: 'authUserId',
+            createStrategy: 'trigger',
+            updateStrategy: 'api',
+          },
+          oauth: {
+            enabled: true,
+            callbackRoute: '/auth/callback',
+            providers: [{ id: 'google', credentialsRef: 'auth/oauth/google' }],
+          },
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it.each([
+    { flow: { signInRoute: '/' } },
+    { signIn: { identifiers: ['social'] } },
+    { signUp: { requiredFields: [], signUpPolicy: 'unknown' } },
+    { profile: { fields: ['email'], createStrategy: 'unknown' } },
+    {
+      oauth: {
+        enabled: true,
+        callbackRoute: '/',
+        providers: [{ id: 'google', clientSecret: 'sentinel' }],
+      },
+    },
+  ])('rejects malformed auth configuration: %j', (config) => {
+    expect(isInfraEnvironmentSpec({ ...local, auth: { provider: 'supabase', ...config } })).toBe(
+      false,
+    );
+  });
+});
+
+describe('adapter package discovery contracts', () => {
+  it('accepts every canonical descriptor and deduplicates a multi-capability Supabase platform', () => {
+    for (const descriptor of Object.values(INFRA_ADAPTER_CATALOG))
+      expect(isInfraAdapterDescriptor(descriptor)).toBe(true);
+    const environment = { ...production, objectStorage: { provider: 'supabase' } } as const;
+    const result = validateInfraAdapterSelection(environment, Object.values(INFRA_ADAPTER_CATALOG));
+    expect(result.ok).toBe(true);
+    if (!result.ok) throw new Error('Expected installed descriptors.');
+    expect(result.value.filter((descriptor) => descriptor.id === 'supabase')).toHaveLength(1);
+    expect(result.value.some((descriptor) => descriptor.id === 'r2')).toBe(false);
+  });
+
+  it.each([
+    { package: '@ankhorage/supabase-db' },
+    { id: 'custom' },
+    { kind: 'runtime' },
+    { configVersion: 2 },
+    { capabilities: ['auth'] },
+    { dependencies: [] },
+    { targets: ['local-host'] },
+    { operations: ['drop-all'] },
+  ])('rejects a mismatched package descriptor: %j', (override) => {
+    expect(isInfraAdapterDescriptor({ ...INFRA_ADAPTER_CATALOG.supabase, ...override })).toBe(
+      false,
+    );
+  });
+
+  it('reports the exact missing selected package without requiring unselected providers', () => {
+    expect(
+      validateInfraAdapterSelection(local, [
+        INFRA_ADAPTER_CATALOG.local,
+        INFRA_ADAPTER_CATALOG.minikube,
+      ]).ok,
+    ).toBe(true);
+    const result = validateInfraAdapterSelection(local, [INFRA_ADAPTER_CATALOG.local]);
+    expect(result.ok).toBe(false);
+    expect(result.diagnostics[0]?.message).toContain('@ankhorage/minikube');
+    expect(result.diagnostics[0]?.code).toBe('adapter_unavailable');
+  });
+
+  it('rejects ambiguous duplicate installed descriptors', () => {
+    expect(
+      validateInfraAdapterSelection(local, [
+        INFRA_ADAPTER_CATALOG.local,
+        INFRA_ADAPTER_CATALOG.local,
+        INFRA_ADAPTER_CATALOG.minikube,
+      ]).ok,
+    ).toBe(false);
+  });
+});

package/src/infra.ts

@@ -0,0 +1,15 @@
+/** Canonical standalone infrastructure contracts, catalog and side-effect-free validation. */
+export { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from './infra/constants';
+export { isInfraAdapterDescriptor } from './infra/isInfraAdapterDescriptor';
+export { isInfraAuthSpec } from './infra/isInfraAuthSpec';
+export { isInfraDeploymentSpec } from './infra/isInfraDeploymentSpec';
+export { isInfraEnvironmentSpec } from './infra/isInfraEnvironmentSpec';
+export { isInfraManifest } from './infra/isInfraManifest';
+export { isInfraWorkloadSpec } from './infra/isInfraWorkloadSpec';
+export { parseInfraManifest } from './infra/parseInfraManifest';
+export { validateInfraAdapterSelection } from './infra/validateInfraAdapterSelection';
+export type * from './types/infraAdapters';
+export type * from './types/infraLifecycle';
+export type * from './types/infraManifest';
+export type * from './types/infraSecrets';
+export type * from './types/infraWorkload';

package/src/media.ts

@@ -1,10 +1,13 @@
+import { isRecord } from '@ankhorage/utility/object';
+import { isNonEmptyString } from '@ankhorage/utility/string';
+
 export const MEDIA_ASSET_KINDS = ['image', 'audio', 'video', 'font', 'file'] as const;
 
 export type MediaAssetKind = (typeof MEDIA_ASSET_KINDS)[number];
 
 export interface MediaStorageSource {
   readonly kind: 'storage';
-  /** Optional logical storage connection identifier for future multi-storage apps. */
+  /*** Optional logical storage connection identifier for future multi-storage apps. */
   readonly storageId?: string;
   readonly bucket: string;
   readonly path: string;
@@ -12,13 +15,13 @@ export interface MediaStorageSource {
 
 export interface MediaUrlSource {
   readonly kind: 'url';
-  /** Stable remote URL. Transient/local URL schemes are not canonical media sources. */
+  /*** Stable remote URL. Transient/local URL schemes are not canonical media sources. */
   readonly url: string;
 }
 
 export interface MediaBundledSource {
   readonly kind: 'bundled';
-  /** App-relative bundled asset path resolved by the generated/runtime host. */
+  /*** App-relative bundled asset path resolved by the generated/runtime host. */
   readonly path: string;
 }
 
@@ -33,7 +36,7 @@ export interface MediaAssetMetadata {
   readonly durationMs?: number;
 }
 
-/** Canonical Studio-managed authoring media entry. */
+/*** Canonical Studio-managed authoring media entry. */
 export interface MediaAsset {
   readonly id: string;
   readonly name: string;
@@ -45,24 +48,22 @@ export interface MediaAsset {
 
 export type MediaAssetRegistry = Readonly<Record<string, MediaAsset>>;
 
-/** App-authoring media pool. Runtime/user-generated uploads do not belong here. */
+/*** App-authoring media pool. Runtime/user-generated uploads do not belong here. */
 export interface MediaManifest {
   readonly assets: MediaAssetRegistry;
 }
 
-/** Stable component/property reference to one entry in `AppManifest.media.assets`. */
+/*** Stable component/property reference to one entry in `AppManifest.media.assets`. */
 export interface MediaAssetReference {
   readonly mediaId: string;
 }
 
+/*** Validate an authored media reference with exactly one enumerable key and a non-empty media ID. */
 export function isMediaAssetReference(value: unknown): value is MediaAssetReference {
   return (
-    typeof value === 'object' &&
-    value !== null &&
-    !Array.isArray(value) &&
+    isRecord(value) &&
     Object.keys(value).length === 1 &&
     'mediaId' in value &&
-    typeof value.mediaId === 'string' &&
-    value.mediaId.trim().length > 0
+    isNonEmptyString(value.mediaId)
   );
 }

package/src/profile-contract.test.ts

@@ -4,7 +4,7 @@ import {
   AUTH_PROFILE_CREATE_STRATEGIES,
   AUTH_PROFILE_PRIMARY_KEY_STRATEGIES,
   AUTH_PROFILE_UPDATE_STRATEGIES,
-  type AuthSpec,
+  type InfraAuthSpec,
 } from './index';
 
 describe('profile contract', () => {
@@ -15,10 +15,9 @@ describe('profile contract', () => {
   });
 
   it('serializes profile settings on an auth spec', () => {
-    const auth: AuthSpec = {
+    const auth: InfraAuthSpec = {
       scope: 'global',
       provider: 'supabase',
-      authorization: { kind: 'RBAC', engine: 'native' },
       profile: {
         fields: ['email', 'displayName', 'avatarUrl'],
         table: 'profiles',

package/src/secrets.test.ts

@@ -1,15 +1,13 @@
-import './secretManifest';
-
 import { describe, expect, test } from 'bun:test';
 
 import type { AuthOAuthProviderConfig } from './auth';
+import type { InfraManifest } from './infra';
 import {
   findForbiddenInlineSecretFields,
   normalizeSecretRef,
   normalizeSecretScope,
   validateSecretPayload,
 } from './secrets';
-import type { InfraManifest } from './types';
 
 describe('secret-store contracts', () => {
   test('normalizes logical secret references', () => {
@@ -70,19 +68,27 @@ describe('secret-store contracts', () => {
 
     const infra: InfraManifest = {
       modules: [],
-      secretStore: { provider: 'supabase-vault' },
-      auth: {
-        scope: 'global',
-        provider: 'supabase',
-        oauth: {
-          enabled: true,
-          callbackRoute: '/auth/callback',
-          providers: [provider],
+      environments: {
+        local: {
+          deployment: { compute: { provider: 'local' }, runtime: { provider: 'minikube' } },
+          database: { provider: 'supabase' },
+          secretStore: { provider: 'supabase-vault' },
+          auth: {
+            scope: 'global',
+            provider: 'supabase',
+            oauth: {
+              enabled: true,
+              callbackRoute: '/auth/callback',
+              providers: [provider],
+            },
+          },
         },
       },
     };
 
-    expect(infra.secretStore?.provider).toBe('supabase-vault');
-    expect(infra.auth?.oauth?.providers[0]?.credentialsRef).toBe('auth/oauth/google');
+    expect(infra.environments.local.secretStore?.provider).toBe('supabase-vault');
+    expect(infra.environments.local.auth?.oauth?.providers[0]?.credentialsRef).toBe(
+      'auth/oauth/google',
+    );
   });
 });

package/src/state.ts

@@ -1,3 +1,9 @@
+/** Legend currently implements in-memory state only; unsupported persistence cannot be selected. */
+export interface AppStateSpec {
+  readonly provider: 'legend';
+  readonly persistence?: false;
+}
+
 export type StatePrimitive = string | number | boolean | null;
 
 export type StateValue =

package/src/types/appManifest.ts

@@ -0,0 +1,5 @@
+import type { AppManifest } from '../types';
+
+export type AppManifestParseResult =
+  | { readonly ok: true; readonly manifest: AppManifest }
+  | { readonly ok: false; readonly message: string };

package/src/types/infraAdapters.ts

@@ -0,0 +1,148 @@
+import type { AppEnvironmentId } from '../environments';
+import type { INFRA_ADAPTER_CATALOG } from '../infra/constants';
+import type {
+  InfraDestroyRequest,
+  InfraGeneratedArtifact,
+  InfraLedger,
+  InfraOutput,
+  InfraOwnedResource,
+  InfraPlanAction,
+  InfraResourceStatus,
+  InfraResult,
+} from './infraLifecycle';
+import type {
+  InfraAdapterId,
+  InfraComputeProviderId,
+  InfraComputeSelection,
+  InfraEnvironmentSpec,
+  InfraRuntimeProviderId,
+  InfraRuntimeSelection,
+} from './infraManifest';
+import type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';
+import type { InfraWorkloadSpec } from './infraWorkload';
+
+/** Package exports must match this exact catalog entry; optional operations are advertised explicitly. */
+export type InfraAdapterDescriptor<P extends InfraAdapterId = InfraAdapterId> = {
+  [K in P]: (typeof INFRA_ADAPTER_CATALOG)[K] & {
+    readonly operations?: readonly ('suspend' | 'resume' | 'generate' | 'diagnostics')[];
+  };
+}[P];
+
+export type InfraComputeTarget = {
+  readonly id: string;
+  readonly os: 'linux' | 'darwin' | 'windows';
+  readonly architecture: 'amd64' | 'arm64';
+} & (
+  | { readonly kind: 'local-host' }
+  | {
+      readonly kind: 'ssh-host';
+      readonly host: string;
+      readonly port: number;
+      readonly user: string;
+      readonly credential: InfraControlPlaneCredentialRef;
+      /** Expected host key supplied by the compute owner; runtimes must verify host authenticity. */
+      readonly hostKeyFingerprint: string;
+    }
+);
+
+/** Trusted execution-only ports. Implementations must not serialize resolved credential values. */
+export interface InfraExecutionContext {
+  readonly projectId: string;
+  readonly environment: AppEnvironmentId;
+  readonly desired: InfraEnvironmentSpec;
+  readonly previous?: InfraLedger;
+  readonly signal?: AbortSignal;
+  readonly credentials: {
+    resolveAsync(
+      reference: InfraControlPlaneCredentialRef,
+    ): Promise<InfraResult<Readonly<Record<string, string>>>>;
+  };
+  readonly secrets: {
+    resolveAsync(reference: InfraSecretReference): Promise<InfraResult<string>>;
+  };
+}
+
+export interface InfraReconcileResult {
+  readonly resources: readonly InfraOwnedResource[];
+  readonly outputs: readonly InfraOutput[];
+}
+
+export interface InfraComputeAdapter<P extends InfraComputeProviderId = InfraComputeProviderId> {
+  readonly descriptor: InfraAdapterDescriptor<P>;
+  /** Read-only prerequisites, config and control-plane credential validation. */
+  validateAsync(
+    context: InfraExecutionContext,
+    selection: InfraComputeSelection<P>,
+  ): Promise<InfraResult<null>>;
+  planAsync(
+    context: InfraExecutionContext,
+    selection: InfraComputeSelection<P>,
+  ): Promise<InfraResult<readonly InfraPlanAction[]>>;
+  ensureAsync(
+    context: InfraExecutionContext,
+    selection: InfraComputeSelection<P>,
+  ): Promise<
+    InfraResult<InfraReconcileResult & { readonly targets: readonly InfraComputeTarget[] }>
+  >;
+  statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;
+  destroyAsync(
+    context: InfraExecutionContext,
+    request: InfraDestroyRequest,
+  ): Promise<InfraResult<InfraReconcileResult>>;
+}
+
+export interface InfraRuntimeDesiredState<
+  P extends InfraRuntimeProviderId = InfraRuntimeProviderId,
+> {
+  readonly selection: InfraRuntimeSelection<P>;
+  readonly targets: readonly InfraComputeTarget[];
+  readonly workloads: readonly InfraWorkloadSpec[];
+}
+
+export interface InfraRuntimeAdapter<P extends InfraRuntimeProviderId = InfraRuntimeProviderId> {
+  readonly descriptor: InfraAdapterDescriptor<P>;
+  /** Read-only prerequisites and desired-state validation; no cluster creation. */
+  validateAsync(
+    context: InfraExecutionContext,
+    desired: InfraRuntimeDesiredState<P>,
+  ): Promise<InfraResult<null>>;
+  planAsync(
+    context: InfraExecutionContext,
+    desired: InfraRuntimeDesiredState<P>,
+  ): Promise<InfraResult<readonly InfraPlanAction[]>>;
+  ensureAsync(
+    context: InfraExecutionContext,
+    desired: InfraRuntimeDesiredState<P>,
+  ): Promise<InfraResult<InfraReconcileResult>>;
+  statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;
+  suspendAsync(context: InfraExecutionContext): Promise<InfraResult<InfraReconcileResult>>;
+  destroyAsync(
+    context: InfraExecutionContext,
+    request: InfraDestroyRequest,
+  ): Promise<InfraResult<InfraReconcileResult>>;
+  generateAsync?(
+    context: InfraExecutionContext,
+    desired: InfraRuntimeDesiredState<P>,
+  ): Promise<InfraResult<readonly InfraGeneratedArtifact[]>>;
+}
+
+/** A service can own several capabilities but contributes one deduplicated platform instance. */
+export interface InfraServiceAdapter {
+  readonly descriptor: InfraAdapterDescriptor<'supabase' | 'cerbos' | 'r2' | 'supabase-vault'>;
+  /** Read-only service config, bootstrap credentials and dependency validation. */
+  validateAsync(context: InfraExecutionContext): Promise<InfraResult<null>>;
+  planAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraPlanAction[]>>;
+  desiredWorkloadsAsync(
+    context: InfraExecutionContext,
+  ): Promise<InfraResult<readonly InfraWorkloadSpec[]>>;
+  reconcileAsync(
+    context: InfraExecutionContext,
+    runtimeOutputs: readonly InfraOutput[],
+  ): Promise<InfraResult<InfraReconcileResult>>;
+  statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;
+  destroyAsync(
+    context: InfraExecutionContext,
+    request: InfraDestroyRequest,
+  ): Promise<InfraResult<InfraReconcileResult>>;
+  suspendAsync?(context: InfraExecutionContext): Promise<InfraResult<InfraReconcileResult>>;
+}