@ankhorage/contracts 14.0.0 → 15.0.0

package/dist/infra/isInfraAuthSpec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraAuthSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraAuthSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,EACnC,8BAA8B,EAC9B,WAAW,EACX,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,2GAA2G;AAC3G,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;QAC/C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC;QACnF,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC;QACtD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CACjB,MAAM,KAAK,SAAS;YACpB,YAAY,CAAC,MAAM,EAAE;gBACnB,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CACnB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;oBAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;aAC1E,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,CAAC;QAChE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC;QAC3D,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,aAAa,CAAC,OAAO,CAAC;KAClC,CAAC,CAAC;AACzC,CAAC;AAED,kGAAkG;AAClG,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;QACjD,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;QACrD,WAAW,EAAE,gBAAgB;QAC7B,YAAY,EAAE,gBAAgB;QAC9B,mBAAmB,EAAE,gBAAgB;QACrC,QAAQ,EAAE,gBAAgB;QAC1B,iBAAiB,EAAE,gBAAgB;KACpC,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,cAAc,EAAE,aAAa;QAC7B,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,CAAC;QACzE,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACvB,MAAM,KAAK,SAAS,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,SAAS;QAClD,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;QACnD,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,mBAAmB,CAAC;KAC3F,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACT,OAAO,EAAE,KAAK,QAAQ;YACtB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACxE,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS;QACrE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,CAAC;QACjE,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CACtB,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAClF,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC;QACtD,cAAc,EAAE,gBAAgB;KACjC,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,gBAAgB;QACvB,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAClB,GAAG,KAAK,SAAS,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC;QACvF,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC3B,QAAQ,KAAK,SAAS,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC5F,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC3B,QAAQ,KAAK,SAAS,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC;KAC7F,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isStringArray } from '@ankhorage/utility/array';\nimport { isRecordOf } from '@ankhorage/utility/object';\nimport { isOptionalString } from '@ankhorage/utility/string';\n\nimport { isIconSpec } from '../appManifest/icon';\nimport { AUTH_OAUTH_PROVIDER_IDS } from '../auth';\nimport {\n  AUTH_PROFILE_CREATE_STRATEGIES,\n  AUTH_PROFILE_PRIMARY_KEY_STRATEGIES,\n  AUTH_PROFILE_UPDATE_STRATEGIES,\n  AUTH_SCOPES,\n  AUTH_SIGN_IN_IDENTIFIERS,\n  AUTH_SIGN_UP_POLICIES,\n} from '../types';\nimport type { InfraAuthSpec } from '../types/infraManifest';\nimport type { InfraShape } from '../types/infraValidation';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Preserve application auth configuration while rejecting nested authorization and unknown providers. */\nexport function isInfraAuthSpec(value: unknown): value is InfraAuthSpec {\n  return isInfraShape(value, {\n    provider: (provider) => provider === 'supabase',\n    scope: (scope) => scope === undefined || AUTH_SCOPES.some((item) => item === scope),\n    flow: (flow) => flow === undefined || isAuthFlow(flow),\n    signIn: (signIn) =>\n      signIn === undefined ||\n      isInfraShape(signIn, {\n        identifiers: (ids) =>\n          Array.isArray(ids) &&\n          ids.every((id) => AUTH_SIGN_IN_IDENTIFIERS.some((item) => item === id)),\n      }),\n    signUp: (signUp) => signUp === undefined || isAuthSignUp(signUp),\n    oauth: (oauth) => oauth === undefined || isAuthOAuth(oauth),\n    profile: (profile) => profile === undefined || isAuthProfile(profile),\n  } satisfies InfraShape<InfraAuthSpec>);\n}\n\n/*** Auth routing intent stays separate from provider-runtime callbacks and Navigator topology. */\nfunction isAuthFlow(value: unknown): boolean {\n  return isInfraShape(value, {\n    signInRoute: (route) => typeof route === 'string',\n    postSignInRoute: (route) => typeof route === 'string',\n    signUpRoute: isOptionalString,\n    signOutRoute: isOptionalString,\n    forgotPasswordRoute: isOptionalString,\n    otpRoute: isOptionalString,\n    unauthorizedRoute: isOptionalString,\n  });\n}\n\n/*** Validate sign-up field intent using the existing application auth contract. */\nfunction isAuthSignUp(value: unknown): boolean {\n  return isInfraShape(value, {\n    requiredFields: isStringArray,\n    optionalFields: (fields) => fields === undefined || isStringArray(fields),\n    signUpPolicy: (policy) =>\n      policy === undefined || AUTH_SIGN_UP_POLICIES.some((item) => item === policy),\n  });\n}\n\n/*** OAuth references contain no credential payload. Custom OAuth identities remain application-owned. */\nfunction isAuthOAuth(value: unknown): boolean {\n  return isInfraShape(value, {\n    enabled: (enabled) => typeof enabled === 'boolean',\n    callbackRoute: (route) => typeof route === 'string',\n    providers: (providers) => Array.isArray(providers) && providers.every(isAuthOAuthProvider),\n  });\n}\n\n/*** Validate OAuth display/config metadata, preserving explicitly extensible OAuth provider IDs. */\nfunction isAuthOAuthProvider(value: unknown): boolean {\n  return isInfraShape(value, {\n    id: (id) =>\n      typeof id === 'string' &&\n      (AUTH_OAUTH_PROVIDER_IDS.some((item) => item === id) || id.length > 0),\n    label: isOptionalString,\n    enabled: (value) => value === undefined || typeof value === 'boolean',\n    scopes: (scopes) => scopes === undefined || isStringArray(scopes),\n    queryParams: (params) =>\n      params === undefined || isRecordOf(params, (entry) => typeof entry === 'string'),\n    icon: (icon) => icon === undefined || isIconSpec(icon),\n    credentialsRef: isOptionalString,\n  });\n}\n\n/*** Validate profile provisioning choices without inventing a new application profile model. */\nfunction isAuthProfile(value: unknown): boolean {\n  return isInfraShape(value, {\n    fields: isStringArray,\n    table: isOptionalString,\n    primaryKey: (key) =>\n      key === undefined || AUTH_PROFILE_PRIMARY_KEY_STRATEGIES.some((item) => item === key),\n    createStrategy: (strategy) =>\n      strategy === undefined || AUTH_PROFILE_CREATE_STRATEGIES.some((item) => item === strategy),\n    updateStrategy: (strategy) =>\n      strategy === undefined || AUTH_PROFILE_UPDATE_STRATEGIES.some((item) => item === strategy),\n  });\n}\n"]}

package/dist/infra/isInfraCredentialRef.d.ts

@@ -0,0 +1,3 @@
+/*** Bootstrap credential references are explicitly separate from managed runtime secrets. */
+export declare function isInfraCredentialRef(value: unknown): boolean;
+//# sourceMappingURL=isInfraCredentialRef.d.ts.map

package/dist/infra/isInfraCredentialRef.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraCredentialRef.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraCredentialRef.ts"],"names":[],"mappings":"AAIA,6FAA6F;AAC7F,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAK5D"}

package/dist/infra/isInfraCredentialRef.js

@@ -0,0 +1,10 @@
+import { isNonEmptyString } from '@ankhorage/utility/string';
+import { isInfraShape } from './isInfraShape';
+/*** Bootstrap credential references are explicitly separate from managed runtime secrets. */
+export function isInfraCredentialRef(value) {
+    return isInfraShape(value, {
+        source: (source) => source === 'control-plane',
+        name: isNonEmptyString,
+    });
+}
+//# sourceMappingURL=isInfraCredentialRef.js.map

package/dist/infra/isInfraCredentialRef.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraCredentialRef.js","sourceRoot":"","sources":["../../src/infra/isInfraCredentialRef.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,6FAA6F;AAC7F,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,eAAe;QAC9C,IAAI,EAAE,gBAAgB;KACvB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { isInfraShape } from './isInfraShape';\n\n/*** Bootstrap credential references are explicitly separate from managed runtime secrets. */\nexport function isInfraCredentialRef(value: unknown): boolean {\n  return isInfraShape(value, {\n    source: (source) => source === 'control-plane',\n    name: isNonEmptyString,\n  });\n}\n"]}

package/dist/infra/isInfraDeploymentSpec.d.ts

@@ -0,0 +1,4 @@
+import type { InfraDeploymentSpec } from '../types/infraManifest';
+/*** Validate provider-specific config and the exact same compatibility map used by TypeScript. */
+export declare function isInfraDeploymentSpec(value: unknown): value is InfraDeploymentSpec;
+//# sourceMappingURL=isInfraDeploymentSpec.d.ts.map

package/dist/infra/isInfraDeploymentSpec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraDeploymentSpec.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraDeploymentSpec.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,mBAAmB,EAEpB,MAAM,wBAAwB,CAAC;AAOhC,kGAAkG;AAClG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CASlF"}

package/dist/infra/isInfraDeploymentSpec.js

@@ -0,0 +1,66 @@
+import { isRecord } from '@ankhorage/utility/object';
+import { isNonEmptyString } from '@ankhorage/utility/string';
+import { INFRA_RUNTIME_COMPATIBILITY } from './constants';
+import { infraFields } from './infraFields';
+import { isInfraCredentialRef } from './isInfraCredentialRef';
+import { isInfraShape } from './isInfraShape';
+/*** Validate provider-specific config and the exact same compatibility map used by TypeScript. */
+export function isInfraDeploymentSpec(value) {
+    if (!isInfraShape(value, { compute: isCompute, runtime: isRuntime }) || !isRecord(value))
+        return false;
+    if (!isRecord(value.compute) || !isRecord(value.runtime))
+        return false;
+    const compute = value.compute.provider;
+    const runtime = value.runtime.provider;
+    return Object.entries(INFRA_RUNTIME_COMPATIBILITY).some(([id, providers]) => id === runtime && providers.some((provider) => provider === compute));
+}
+/*** Compute configuration is closed per provider; control-plane refs cannot be managed secrets. */
+function isCompute(value) {
+    if (!isRecord(value))
+        return false;
+    if (value.provider === 'local')
+        return isInfraShape(value, {
+            provider: (provider) => provider === 'local',
+            workingDirectory: infraFields.optionalText,
+        });
+    return isInfraShape(value, {
+        provider: (provider) => provider === 'hetzner',
+        location: isNonEmptyString,
+        serverType: infraFields.optionalText,
+        image: infraFields.optionalText,
+        credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),
+    });
+}
+/*** Runtime topology expresses host roles and never couples k3s to a compute vendor. */
+function isRuntime(value) {
+    if (!isRecord(value))
+        return false;
+    switch (value.provider) {
+        case 'minikube':
+            return isInfraShape(value, {
+                provider: (provider) => provider === 'minikube',
+                profile: infraFields.optionalText,
+                driver: (driver) => driver === undefined || driver === 'docker' || driver === 'podman',
+                cpus: infraFields.optionalPositiveInteger,
+                memoryMiB: infraFields.optionalPositiveInteger,
+            });
+        case 'k3s':
+            return isInfraShape(value, {
+                provider: (provider) => provider === 'k3s',
+                version: infraFields.optionalText,
+                topology: (topology) => topology === undefined ||
+                    isInfraShape(topology, {
+                        servers: infraFields.positiveInteger,
+                        agents: infraFields.nonnegativeInteger,
+                    }),
+            });
+        case 'docker-compose':
+            return isInfraShape(value, {
+                provider: (provider) => provider === 'docker-compose',
+                projectName: infraFields.optionalText,
+            });
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=isInfraDeploymentSpec.js.map

package/dist/infra/isInfraDeploymentSpec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraDeploymentSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraDeploymentSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAQ7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,kGAAkG;AAClG,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAC5B,OAAO,YAAY,CAAC,KAAK,EAAE;YACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO;YAC5C,gBAAgB,EAAE,WAAW,CAAC,YAAY;SACU,CAAC,CAAC;IAC1D,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS;QAC9C,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,WAAW,CAAC,YAAY;QACpC,KAAK,EAAE,WAAW,CAAC,YAAY;QAC/B,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC;KACtC,CAAC,CAAC;AAC5D,CAAC;AAED,wFAAwF;AACxF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,QAAQ,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvB,KAAK,UAAU;YACb,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;gBAC/C,OAAO,EAAE,WAAW,CAAC,YAAY;gBACjC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ;gBACtF,IAAI,EAAE,WAAW,CAAC,uBAAuB;gBACzC,SAAS,EAAE,WAAW,CAAC,uBAAuB;aACS,CAAC,CAAC;QAC7D,KAAK,KAAK;YACR,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK;gBAC1C,OAAO,EAAE,WAAW,CAAC,YAAY;gBACjC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS;oBACtB,YAAY,CAAC,QAAQ,EAAE;wBACrB,OAAO,EAAE,WAAW,CAAC,eAAe;wBACpC,MAAM,EAAE,WAAW,CAAC,kBAAkB;qBACvC,CAAC;aAC8C,CAAC,CAAC;QACxD,KAAK,gBAAgB;YACnB,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,gBAAgB;gBACrD,WAAW,EAAE,WAAW,CAAC,YAAY;aACwB,CAAC,CAAC;QACnE;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport type {\n  InfraComputeSelection,\n  InfraDeploymentSpec,\n  InfraRuntimeSelection,\n} from '../types/infraManifest';\nimport type { InfraShape } from '../types/infraValidation';\nimport { INFRA_RUNTIME_COMPATIBILITY } from './constants';\nimport { infraFields } from './infraFields';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Validate provider-specific config and the exact same compatibility map used by TypeScript. */\nexport function isInfraDeploymentSpec(value: unknown): value is InfraDeploymentSpec {\n  if (!isInfraShape(value, { compute: isCompute, runtime: isRuntime }) || !isRecord(value))\n    return false;\n  if (!isRecord(value.compute) || !isRecord(value.runtime)) return false;\n  const compute = value.compute.provider;\n  const runtime = value.runtime.provider;\n  return Object.entries(INFRA_RUNTIME_COMPATIBILITY).some(\n    ([id, providers]) => id === runtime && providers.some((provider) => provider === compute),\n  );\n}\n\n/*** Compute configuration is closed per provider; control-plane refs cannot be managed secrets. */\nfunction isCompute(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  if (value.provider === 'local')\n    return isInfraShape(value, {\n      provider: (provider) => provider === 'local',\n      workingDirectory: infraFields.optionalText,\n    } satisfies InfraShape<InfraComputeSelection<'local'>>);\n  return isInfraShape(value, {\n    provider: (provider) => provider === 'hetzner',\n    location: isNonEmptyString,\n    serverType: infraFields.optionalText,\n    image: infraFields.optionalText,\n    credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),\n  } satisfies InfraShape<InfraComputeSelection<'hetzner'>>);\n}\n\n/*** Runtime topology expresses host roles and never couples k3s to a compute vendor. */\nfunction isRuntime(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  switch (value.provider) {\n    case 'minikube':\n      return isInfraShape(value, {\n        provider: (provider) => provider === 'minikube',\n        profile: infraFields.optionalText,\n        driver: (driver) => driver === undefined || driver === 'docker' || driver === 'podman',\n        cpus: infraFields.optionalPositiveInteger,\n        memoryMiB: infraFields.optionalPositiveInteger,\n      } satisfies InfraShape<InfraRuntimeSelection<'minikube'>>);\n    case 'k3s':\n      return isInfraShape(value, {\n        provider: (provider) => provider === 'k3s',\n        version: infraFields.optionalText,\n        topology: (topology) =>\n          topology === undefined ||\n          isInfraShape(topology, {\n            servers: infraFields.positiveInteger,\n            agents: infraFields.nonnegativeInteger,\n          }),\n      } satisfies InfraShape<InfraRuntimeSelection<'k3s'>>);\n    case 'docker-compose':\n      return isInfraShape(value, {\n        provider: (provider) => provider === 'docker-compose',\n        projectName: infraFields.optionalText,\n      } satisfies InfraShape<InfraRuntimeSelection<'docker-compose'>>);\n    default:\n      return false;\n  }\n}\n"]}

package/dist/infra/isInfraEnvironmentSpec.d.ts

@@ -0,0 +1,4 @@
+import type { InfraEnvironmentSpec } from '../types/infraManifest';
+/*** Validate sibling capabilities and their required relationships within one environment. */
+export declare function isInfraEnvironmentSpec(value: unknown): value is InfraEnvironmentSpec;
+//# sourceMappingURL=isInfraEnvironmentSpec.d.ts.map

package/dist/infra/isInfraEnvironmentSpec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraEnvironmentSpec.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraEnvironmentSpec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAA0B,MAAM,wBAAwB,CAAC;AAU3F,8FAA8F;AAC9F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF"}

package/dist/infra/isInfraEnvironmentSpec.js

@@ -0,0 +1,82 @@
+import { isRecord } from '@ankhorage/utility/object';
+import { INFRA_ADAPTER_CATALOG } from './constants';
+import { infraFields } from './infraFields';
+import { isInfraAuthSpec } from './isInfraAuthSpec';
+import { isInfraCredentialRef } from './isInfraCredentialRef';
+import { isInfraDeploymentSpec } from './isInfraDeploymentSpec';
+import { isInfraShape } from './isInfraShape';
+import { isInfraWorkloadSpec } from './isInfraWorkloadSpec';
+/*** Validate sibling capabilities and their required relationships within one environment. */
+export function isInfraEnvironmentSpec(value) {
+    return isEnvironmentShape(value) && hasServiceDependencies(value);
+}
+/*** Check all environment field shapes before inspecting canonical dependency metadata. */
+function isEnvironmentShape(value) {
+    return isInfraShape(value, {
+        deployment: isInfraDeploymentSpec,
+        database: (database) => database === undefined ||
+            isInfraShape(database, {
+                provider: (provider) => provider === 'supabase',
+                tier: (tier) => tier === undefined || tier === 'dev' || tier === 'prod',
+            }),
+        objectStorage: (storage) => storage === undefined || isObjectStorage(storage),
+        auth: (auth) => auth === undefined || isInfraAuthSpec(auth),
+        authz: (authz) => authz === undefined ||
+            isInfraShape(authz, {
+                provider: (provider) => provider === 'cerbos',
+                kind: (kind) => kind === 'ABAC' || kind === 'RBAC',
+            }),
+        secretStore: (store) => store === undefined ||
+            isInfraShape(store, {
+                provider: (provider) => provider === 'supabase-vault',
+                schema: infraFields.optionalText,
+            }),
+        networking: (networking) => networking === undefined || isInfraShape(networking, { domain: infraFields.optionalText }),
+        workloads: (workloads) => workloads === undefined || isWorkloads(workloads),
+    });
+}
+/*** Object storage can vary independently from database/auth; there is no implicit auto provider. */
+function isObjectStorage(value) {
+    if (!isRecord(value))
+        return false;
+    const common = {
+        provider: (provider) => provider === value.provider,
+        buckets: infraFields.optionalStrings,
+    };
+    if (value.provider === 'supabase')
+        return isInfraShape(value, common);
+    return isInfraShape(value, {
+        ...common,
+        provider: (provider) => provider === 'r2',
+        accountId: infraFields.optionalText,
+        credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),
+    });
+}
+/*** Duplicate desired workload identities cannot be reconciled safely. */
+function isWorkloads(value) {
+    return (Array.isArray(value) &&
+        value.every(isInfraWorkloadSpec) &&
+        new Set(value.map((workload) => workload.id)).size === value.length);
+}
+/*** Check catalog dependencies against selected sibling capabilities and runtime capabilities. */
+function hasServiceDependencies(value) {
+    const selections = [
+        value.database,
+        value.auth,
+        value.authz,
+        value.objectStorage,
+        value.secretStore,
+    ];
+    const runtime = Object.values(INFRA_ADAPTER_CATALOG).find((entry) => entry.id === value.deployment.runtime.provider);
+    const capabilities = new Set([
+        'compute',
+        ...(runtime?.capabilities ?? []),
+        ...Object.entries(value)
+            .filter(([, selection]) => selection !== undefined)
+            .map(([capability]) => capability),
+    ]);
+    return Object.values(INFRA_ADAPTER_CATALOG)
+        .filter((entry) => selections.some((selection) => selection?.provider === entry.id))
+        .every((entry) => entry.dependencies.every((dependency) => capabilities.has(dependency)));
+}
+//# sourceMappingURL=isInfraEnvironmentSpec.js.map

package/dist/infra/isInfraEnvironmentSpec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraEnvironmentSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraEnvironmentSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAIrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,2FAA2F;AAC3F,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,UAAU,EAAE,qBAAqB;QACjC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS;YACtB,YAAY,CAAC,QAAQ,EAAE;gBACrB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;gBAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;aACxE,CAAC;QACJ,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC;QAC7E,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC;QAC3D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ;gBAC7C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;aACnD,CAAC;QACJ,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,gBAAgB;gBACrD,MAAM,EAAE,WAAW,CAAC,YAAY;aACjC,CAAC;QACJ,UAAU,EAAE,CAAC,UAAU,EAAE,EAAE,CACzB,UAAU,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;QAC5F,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC;KACjC,CAAC,CAAC;AAChD,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,CAAC,QAAiB,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAC5D,OAAO,EAAE,WAAW,CAAC,eAAe;KACrC,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,GAAG,MAAM;QACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY;QACnC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC;KACV,CAAC,CAAC;AACxF,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAChC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CACpE,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,sBAAsB,CAAC,KAA2B;IACzD,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,WAAW;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAC1D,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS;QACnC,SAAS;QACT,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;QAChC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\n\nimport type { InfraEnvironmentSpec, InfraObjectStorageSpec } from '../types/infraManifest';\nimport type { InfraShape } from '../types/infraValidation';\nimport { INFRA_ADAPTER_CATALOG } from './constants';\nimport { infraFields } from './infraFields';\nimport { isInfraAuthSpec } from './isInfraAuthSpec';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraDeploymentSpec } from './isInfraDeploymentSpec';\nimport { isInfraShape } from './isInfraShape';\nimport { isInfraWorkloadSpec } from './isInfraWorkloadSpec';\n\n/*** Validate sibling capabilities and their required relationships within one environment. */\nexport function isInfraEnvironmentSpec(value: unknown): value is InfraEnvironmentSpec {\n  return isEnvironmentShape(value) && hasServiceDependencies(value);\n}\n\n/*** Check all environment field shapes before inspecting canonical dependency metadata. */\nfunction isEnvironmentShape(value: unknown): value is InfraEnvironmentSpec {\n  return isInfraShape(value, {\n    deployment: isInfraDeploymentSpec,\n    database: (database) =>\n      database === undefined ||\n      isInfraShape(database, {\n        provider: (provider) => provider === 'supabase',\n        tier: (tier) => tier === undefined || tier === 'dev' || tier === 'prod',\n      }),\n    objectStorage: (storage) => storage === undefined || isObjectStorage(storage),\n    auth: (auth) => auth === undefined || isInfraAuthSpec(auth),\n    authz: (authz) =>\n      authz === undefined ||\n      isInfraShape(authz, {\n        provider: (provider) => provider === 'cerbos',\n        kind: (kind) => kind === 'ABAC' || kind === 'RBAC',\n      }),\n    secretStore: (store) =>\n      store === undefined ||\n      isInfraShape(store, {\n        provider: (provider) => provider === 'supabase-vault',\n        schema: infraFields.optionalText,\n      }),\n    networking: (networking) =>\n      networking === undefined || isInfraShape(networking, { domain: infraFields.optionalText }),\n    workloads: (workloads) => workloads === undefined || isWorkloads(workloads),\n  } satisfies InfraShape<InfraEnvironmentSpec>);\n}\n\n/*** Object storage can vary independently from database/auth; there is no implicit auto provider. */\nfunction isObjectStorage(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  const common = {\n    provider: (provider: unknown) => provider === value.provider,\n    buckets: infraFields.optionalStrings,\n  };\n  if (value.provider === 'supabase') return isInfraShape(value, common);\n  return isInfraShape(value, {\n    ...common,\n    provider: (provider) => provider === 'r2',\n    accountId: infraFields.optionalText,\n    credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),\n  } satisfies InfraShape<Extract<InfraObjectStorageSpec, { readonly provider: 'r2' }>>);\n}\n\n/*** Duplicate desired workload identities cannot be reconciled safely. */\nfunction isWorkloads(value: unknown): boolean {\n  return (\n    Array.isArray(value) &&\n    value.every(isInfraWorkloadSpec) &&\n    new Set(value.map((workload) => workload.id)).size === value.length\n  );\n}\n\n/*** Check catalog dependencies against selected sibling capabilities and runtime capabilities. */\nfunction hasServiceDependencies(value: InfraEnvironmentSpec): boolean {\n  const selections = [\n    value.database,\n    value.auth,\n    value.authz,\n    value.objectStorage,\n    value.secretStore,\n  ];\n  const runtime = Object.values(INFRA_ADAPTER_CATALOG).find(\n    (entry) => entry.id === value.deployment.runtime.provider,\n  );\n  const capabilities = new Set<string>([\n    'compute',\n    ...(runtime?.capabilities ?? []),\n    ...Object.entries(value)\n      .filter(([, selection]) => selection !== undefined)\n      .map(([capability]) => capability),\n  ]);\n  return Object.values(INFRA_ADAPTER_CATALOG)\n    .filter((entry) => selections.some((selection) => selection?.provider === entry.id))\n    .every((entry) => entry.dependencies.every((dependency) => capabilities.has(dependency)));\n}\n"]}

package/dist/infra/isInfraManifest.d.ts

@@ -0,0 +1,4 @@
+import type { InfraManifest } from '../types/infraManifest';
+/*** Validate standalone infrastructure without AppManifest, Deploy or provider package side effects. */
+export declare function isInfraManifest(value: unknown): value is InfraManifest;
+//# sourceMappingURL=isInfraManifest.d.ts.map

package/dist/infra/isInfraManifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraManifest.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraManifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAM5D,wGAAwG;AACxG,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAOtE"}

package/dist/infra/isInfraManifest.js

@@ -0,0 +1,23 @@
+import { isRecord } from '@ankhorage/utility/object';
+import { isApiDefinitionList } from '../appManifest/apis';
+import { APP_ENVIRONMENT_IDS } from '../environments';
+import { infraFields } from './infraFields';
+import { isInfraEnvironmentSpec } from './isInfraEnvironmentSpec';
+import { isInfraShape } from './isInfraShape';
+/*** Validate standalone infrastructure without AppManifest, Deploy or provider package side effects. */
+export function isInfraManifest(value) {
+    return isInfraShape(value, {
+        environments: isEnvironments,
+        apis: (apis) => apis === undefined || isApiDefinitionList(apis),
+        modules: infraFields.strings,
+        modulesConfig: (config) => config === undefined || isRecord(config),
+    });
+}
+/*** Local is required; preview and production are optional but never inferred from arbitrary keys. */
+function isEnvironments(value) {
+    if (!isRecord(value) || !isInfraEnvironmentSpec(value.local))
+        return false;
+    return Object.entries(value).every(([key, environment]) => APP_ENVIRONMENT_IDS.some((id) => id === key) &&
+        ((environment === undefined && key !== 'local') || isInfraEnvironmentSpec(environment)));
+}
+//# sourceMappingURL=isInfraManifest.js.map

package/dist/infra/isInfraManifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraManifest.js","sourceRoot":"","sources":["../../src/infra/isInfraManifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,wGAAwG;AACxG,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,cAAc;QAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC;QAC/D,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;AACzC,CAAC;AAED,sGAAsG;AACtG,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAChC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,CACrB,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC;QAC5C,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAC1F,CAAC;AACJ,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\n\nimport { isApiDefinitionList } from '../appManifest/apis';\nimport { APP_ENVIRONMENT_IDS } from '../environments';\nimport type { InfraManifest } from '../types/infraManifest';\nimport type { InfraShape } from '../types/infraValidation';\nimport { infraFields } from './infraFields';\nimport { isInfraEnvironmentSpec } from './isInfraEnvironmentSpec';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Validate standalone infrastructure without AppManifest, Deploy or provider package side effects. */\nexport function isInfraManifest(value: unknown): value is InfraManifest {\n  return isInfraShape(value, {\n    environments: isEnvironments,\n    apis: (apis) => apis === undefined || isApiDefinitionList(apis),\n    modules: infraFields.strings,\n    modulesConfig: (config) => config === undefined || isRecord(config),\n  } satisfies InfraShape<InfraManifest>);\n}\n\n/*** Local is required; preview and production are optional but never inferred from arbitrary keys. */\nfunction isEnvironments(value: unknown): boolean {\n  if (!isRecord(value) || !isInfraEnvironmentSpec(value.local)) return false;\n  return Object.entries(value).every(\n    ([key, environment]) =>\n      APP_ENVIRONMENT_IDS.some((id) => id === key) &&\n      ((environment === undefined && key !== 'local') || isInfraEnvironmentSpec(environment)),\n  );\n}\n"]}

package/dist/infra/isInfraShape.d.ts

@@ -0,0 +1,3 @@
+/*** Validate an exact Infra object shape, rejecting unknown and superseded configuration keys. */
+export declare function isInfraShape(value: unknown, fields: Readonly<Record<string, (field: unknown) => boolean>>): boolean;
+//# sourceMappingURL=isInfraShape.d.ts.map

package/dist/infra/isInfraShape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraShape.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraShape.ts"],"names":[],"mappings":"AAEA,kGAAkG;AAClG,wBAAgB,YAAY,CAC1B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,GAC5D,OAAO,CAST"}

package/dist/infra/isInfraShape.js

@@ -0,0 +1,10 @@
+import { hasOnlyKeys, isRecord } from '@ankhorage/utility/object';
+/*** Validate an exact Infra object shape, rejecting unknown and superseded configuration keys. */
+export function isInfraShape(value, fields) {
+    if (!isRecord(value))
+        return false;
+    const entries = Object.entries(fields);
+    return (hasOnlyKeys(value, Object.keys(fields)) &&
+        entries.every(([key, validate]) => validate(Object.hasOwn(value, key) ? Reflect.get(value, key) : undefined)));
+}
+//# sourceMappingURL=isInfraShape.js.map

package/dist/infra/isInfraShape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraShape.js","sourceRoot":"","sources":["../../src/infra/isInfraShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAElE,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAC1B,KAAc,EACd,MAA6D;IAE7D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,CACL,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAC1E,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { hasOnlyKeys, isRecord } from '@ankhorage/utility/object';\n\n/*** Validate an exact Infra object shape, rejecting unknown and superseded configuration keys. */\nexport function isInfraShape(\n  value: unknown,\n  fields: Readonly<Record<string, (field: unknown) => boolean>>,\n): boolean {\n  if (!isRecord(value)) return false;\n  const entries = Object.entries(fields);\n  return (\n    hasOnlyKeys(value, Object.keys(fields)) &&\n    entries.every(([key, validate]) =>\n      validate(Object.hasOwn(value, key) ? Reflect.get(value, key) : undefined),\n    )\n  );\n}\n"]}

package/dist/infra/isInfraWorkloadHealth.d.ts

@@ -0,0 +1,3 @@
+/*** Validate runtime-neutral readiness probes and bounded numeric parameters. */
+export declare function isInfraWorkloadHealth(value: unknown): boolean;
+//# sourceMappingURL=isInfraWorkloadHealth.d.ts.map

package/dist/infra/isInfraWorkloadHealth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraWorkloadHealth.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadHealth.ts"],"names":[],"mappings":"AAKA,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA+B7D"}

package/dist/infra/isInfraWorkloadHealth.js

@@ -0,0 +1,37 @@
+import { isRecord } from '@ankhorage/utility/object';
+import { infraFields } from './infraFields';
+import { isInfraShape } from './isInfraShape';
+/*** Validate runtime-neutral readiness probes and bounded numeric parameters. */
+export function isInfraWorkloadHealth(value) {
+    if (!isRecord(value))
+        return false;
+    const timing = {
+        intervalSeconds: infraFields.optionalPositiveInteger,
+        timeoutSeconds: infraFields.optionalPositiveInteger,
+        failureThreshold: infraFields.optionalPositiveInteger,
+    };
+    switch (value.kind) {
+        case 'http':
+            return isInfraShape(value, {
+                ...timing,
+                kind: (kind) => kind === 'http',
+                port: infraFields.port,
+                path: (path) => typeof path === 'string' && path.startsWith('/'),
+            });
+        case 'tcp':
+            return isInfraShape(value, {
+                ...timing,
+                kind: (kind) => kind === 'tcp',
+                port: infraFields.port,
+            });
+        case 'command':
+            return isInfraShape(value, {
+                ...timing,
+                kind: (kind) => kind === 'command',
+                command: (command) => Array.isArray(command) && command.length > 0 && infraFields.strings(command),
+            });
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=isInfraWorkloadHealth.js.map

package/dist/infra/isInfraWorkloadHealth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraWorkloadHealth.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadHealth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG;QACb,eAAe,EAAE,WAAW,CAAC,uBAAuB;QACpD,cAAc,EAAE,WAAW,CAAC,uBAAuB;QACnD,gBAAgB,EAAE,WAAW,CAAC,uBAAuB;KACtD,CAAC;IACF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,GAAG,MAAM;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM;gBAC/B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;aACjE,CAAC,CAAC;QACL,KAAK,KAAK;YACR,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,GAAG,MAAM;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK;gBAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;aACvB,CAAC,CAAC;QACL,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,GAAG,MAAM;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS;gBAClC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CACnB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aAC/E,CAAC,CAAC;QACL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\n\nimport { infraFields } from './infraFields';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Validate runtime-neutral readiness probes and bounded numeric parameters. */\nexport function isInfraWorkloadHealth(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  const timing = {\n    intervalSeconds: infraFields.optionalPositiveInteger,\n    timeoutSeconds: infraFields.optionalPositiveInteger,\n    failureThreshold: infraFields.optionalPositiveInteger,\n  };\n  switch (value.kind) {\n    case 'http':\n      return isInfraShape(value, {\n        ...timing,\n        kind: (kind) => kind === 'http',\n        port: infraFields.port,\n        path: (path) => typeof path === 'string' && path.startsWith('/'),\n      });\n    case 'tcp':\n      return isInfraShape(value, {\n        ...timing,\n        kind: (kind) => kind === 'tcp',\n        port: infraFields.port,\n      });\n    case 'command':\n      return isInfraShape(value, {\n        ...timing,\n        kind: (kind) => kind === 'command',\n        command: (command) =>\n          Array.isArray(command) && command.length > 0 && infraFields.strings(command),\n      });\n    default:\n      return false;\n  }\n}\n"]}

package/dist/infra/isInfraWorkloadSpec.d.ts

@@ -0,0 +1,4 @@
+import type { InfraWorkloadSpec } from '../types/infraWorkload';
+/*** Validate the portable desired workload; runtime-specific fields and plaintext secret objects fail. */
+export declare function isInfraWorkloadSpec(value: unknown): value is InfraWorkloadSpec;
+//# sourceMappingURL=isInfraWorkloadSpec.d.ts.map

package/dist/infra/isInfraWorkloadSpec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraWorkloadSpec.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadSpec.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAMhE,0GAA0G;AAC1G,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAkC9E"}

package/dist/infra/isInfraWorkloadSpec.js

@@ -0,0 +1,70 @@
+import { isStringArray } from '@ankhorage/utility/array';
+import { isRecord } from '@ankhorage/utility/object';
+import { isNonEmptyString } from '@ankhorage/utility/string';
+import { infraFields } from './infraFields';
+import { isInfraShape } from './isInfraShape';
+import { isInfraWorkloadHealth } from './isInfraWorkloadHealth';
+import { isInfraWorkloadValue } from './isInfraWorkloadValue';
+/*** Validate the portable desired workload; runtime-specific fields and plaintext secret objects fail. */
+export function isInfraWorkloadSpec(value) {
+    return isInfraShape(value, {
+        id: isNonEmptyString,
+        artifact: (artifact) => isInfraShape(artifact, { kind: (kind) => kind === 'image', image: isNonEmptyString }),
+        command: infraFields.optionalStrings,
+        args: (args) => args === undefined || isStringArray(args),
+        ports: (ports) => ports === undefined ||
+            (Array.isArray(ports) && ports.every(isPort) && hasUniqueField(ports, 'name')),
+        environment: (environment) => environment === undefined ||
+            (isRecord(environment) && Object.values(environment).every(isInfraWorkloadValue)),
+        files: (files) => files === undefined ||
+            (Array.isArray(files) && files.every(isFile) && hasUniqueField(files, 'path')),
+        health: (health) => health === undefined || isInfraWorkloadHealth(health),
+        resources: (resources) => resources === undefined ||
+            isInfraShape(resources, {
+                cpuMillis: infraFields.optionalPositiveInteger,
+                memoryMiB: infraFields.optionalPositiveInteger,
+            }),
+        persistence: (volumes) => volumes === undefined ||
+            (Array.isArray(volumes) &&
+                volumes.every(isVolume) &&
+                hasUniqueField(volumes, 'id') &&
+                hasUniqueField(volumes, 'mountPath')),
+        exposure: (exposure) => exposure === undefined || exposure === 'internal' || exposure === 'public',
+        replicas: infraFields.optionalNonnegativeInteger,
+        dependsOn: infraFields.optionalStrings,
+    });
+}
+/*** Named transport ports stay independent from runtime resource types. */
+function isPort(value) {
+    return isInfraShape(value, {
+        name: isNonEmptyString,
+        port: infraFields.port,
+        protocol: (protocol) => protocol === undefined || protocol === 'tcp' || protocol === 'udp',
+    });
+}
+/*** Portable files model policy/config materialization without host filesystem access. */
+function isFile(value) {
+    return isInfraShape(value, { path: isAbsoluteWorkloadPath, content: isInfraWorkloadValue });
+}
+/*** Persistence has explicit ownership-local identity and a retention policy. */
+function isVolume(value) {
+    return isInfraShape(value, {
+        id: isNonEmptyString,
+        mountPath: isAbsoluteWorkloadPath,
+        sizeGiB: infraFields.positiveInteger,
+        retention: (retention) => retention === 'retain' || retention === 'delete-on-destroy',
+    });
+}
+/*** Workload paths are absolute container paths, never relative host traversal. */
+function isAbsoluteWorkloadPath(value) {
+    return (typeof value === 'string' &&
+        value.startsWith('/') &&
+        value.length > 1 &&
+        !value.split('/').includes('..'));
+}
+/*** Duplicate workload-local identities would make runtime projection ambiguous. */
+function hasUniqueField(values, field) {
+    const ids = values.map((value) => (isRecord(value) ? Reflect.get(value, field) : undefined));
+    return new Set(ids).size === ids.length;
+}
+//# sourceMappingURL=isInfraWorkloadSpec.js.map

package/dist/infra/isInfraWorkloadSpec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraWorkloadSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAI7D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,0GAA0G;AAC1G,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,YAAY,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACvF,OAAO,EAAE,WAAW,CAAC,eAAe;QACpC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC;QACzD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,SAAS;YACnB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChF,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAC3B,WAAW,KAAK,SAAS;YACzB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACnF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,SAAS;YACnB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChF,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,qBAAqB,CAAC,MAAM,CAAC;QACzE,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CACvB,SAAS,KAAK,SAAS;YACvB,YAAY,CAAC,SAAS,EAAE;gBACtB,SAAS,EAAE,WAAW,CAAC,uBAAuB;gBAC9C,SAAS,EAAE,WAAW,CAAC,uBAAuB;aAC/C,CAAC;QACJ,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CACvB,OAAO,KAAK,SAAS;YACrB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACvB,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;gBAC7B,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,QAAQ;QAC5E,QAAQ,EAAE,WAAW,CAAC,0BAA0B;QAChD,SAAS,EAAE,WAAW,CAAC,eAAe;KACC,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK;KAC3F,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,EAAE,EAAE,gBAAgB;QACpB,SAAS,EAAE,sBAAsB;QACjC,OAAO,EAAE,WAAW,CAAC,eAAe;QACpC,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,mBAAmB;KACtF,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,MAA0B,EAAE,KAAa;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7F,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC","sourcesContent":["import { isStringArray } from '@ankhorage/utility/array';\nimport { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport type { InfraShape } from '../types/infraValidation';\nimport type { InfraWorkloadSpec } from '../types/infraWorkload';\nimport { infraFields } from './infraFields';\nimport { isInfraShape } from './isInfraShape';\nimport { isInfraWorkloadHealth } from './isInfraWorkloadHealth';\nimport { isInfraWorkloadValue } from './isInfraWorkloadValue';\n\n/*** Validate the portable desired workload; runtime-specific fields and plaintext secret objects fail. */\nexport function isInfraWorkloadSpec(value: unknown): value is InfraWorkloadSpec {\n  return isInfraShape(value, {\n    id: isNonEmptyString,\n    artifact: (artifact) =>\n      isInfraShape(artifact, { kind: (kind) => kind === 'image', image: isNonEmptyString }),\n    command: infraFields.optionalStrings,\n    args: (args) => args === undefined || isStringArray(args),\n    ports: (ports) =>\n      ports === undefined ||\n      (Array.isArray(ports) && ports.every(isPort) && hasUniqueField(ports, 'name')),\n    environment: (environment) =>\n      environment === undefined ||\n      (isRecord(environment) && Object.values(environment).every(isInfraWorkloadValue)),\n    files: (files) =>\n      files === undefined ||\n      (Array.isArray(files) && files.every(isFile) && hasUniqueField(files, 'path')),\n    health: (health) => health === undefined || isInfraWorkloadHealth(health),\n    resources: (resources) =>\n      resources === undefined ||\n      isInfraShape(resources, {\n        cpuMillis: infraFields.optionalPositiveInteger,\n        memoryMiB: infraFields.optionalPositiveInteger,\n      }),\n    persistence: (volumes) =>\n      volumes === undefined ||\n      (Array.isArray(volumes) &&\n        volumes.every(isVolume) &&\n        hasUniqueField(volumes, 'id') &&\n        hasUniqueField(volumes, 'mountPath')),\n    exposure: (exposure) =>\n      exposure === undefined || exposure === 'internal' || exposure === 'public',\n    replicas: infraFields.optionalNonnegativeInteger,\n    dependsOn: infraFields.optionalStrings,\n  } satisfies InfraShape<InfraWorkloadSpec>);\n}\n\n/*** Named transport ports stay independent from runtime resource types. */\nfunction isPort(value: unknown): boolean {\n  return isInfraShape(value, {\n    name: isNonEmptyString,\n    port: infraFields.port,\n    protocol: (protocol) => protocol === undefined || protocol === 'tcp' || protocol === 'udp',\n  });\n}\n\n/*** Portable files model policy/config materialization without host filesystem access. */\nfunction isFile(value: unknown): boolean {\n  return isInfraShape(value, { path: isAbsoluteWorkloadPath, content: isInfraWorkloadValue });\n}\n\n/*** Persistence has explicit ownership-local identity and a retention policy. */\nfunction isVolume(value: unknown): boolean {\n  return isInfraShape(value, {\n    id: isNonEmptyString,\n    mountPath: isAbsoluteWorkloadPath,\n    sizeGiB: infraFields.positiveInteger,\n    retention: (retention) => retention === 'retain' || retention === 'delete-on-destroy',\n  });\n}\n\n/*** Workload paths are absolute container paths, never relative host traversal. */\nfunction isAbsoluteWorkloadPath(value: unknown): boolean {\n  return (\n    typeof value === 'string' &&\n    value.startsWith('/') &&\n    value.length > 1 &&\n    !value.split('/').includes('..')\n  );\n}\n\n/*** Duplicate workload-local identities would make runtime projection ambiguous. */\nfunction hasUniqueField(values: readonly unknown[], field: string): boolean {\n  const ids = values.map((value) => (isRecord(value) ? Reflect.get(value, field) : undefined));\n  return new Set(ids).size === ids.length;\n}\n"]}

package/dist/infra/isInfraWorkloadValue.d.ts

@@ -0,0 +1,3 @@
+/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */
+export declare function isInfraWorkloadValue(value: unknown): boolean;
+//# sourceMappingURL=isInfraWorkloadValue.d.ts.map

package/dist/infra/isInfraWorkloadValue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraWorkloadValue.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAMA,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAsB5D"}

package/dist/infra/isInfraWorkloadValue.js

@@ -0,0 +1,40 @@
+import { isRecord } from '@ankhorage/utility/object';
+import { isNonEmptyString } from '@ankhorage/utility/string';
+import { APP_ENVIRONMENT_IDS } from '../environments';
+import { isInfraShape } from './isInfraShape';
+/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */
+export function isInfraWorkloadValue(value) {
+    if (!isRecord(value))
+        return false;
+    switch (value.kind) {
+        case 'literal':
+            return isInfraShape(value, {
+                kind: (kind) => kind === 'literal',
+                value: (field) => typeof field === 'string',
+            });
+        case 'output':
+            return isInfraShape(value, {
+                kind: (kind) => kind === 'output',
+                resourceId: isNonEmptyString,
+                output: isNonEmptyString,
+            });
+        case 'secret':
+            return isInfraShape(value, {
+                kind: (kind) => kind === 'secret',
+                reference: isSecretReference,
+            });
+        default:
+            return false;
+    }
+}
+/*** Managed secret references contain identity only, never privileged payloads. */
+function isSecretReference(value) {
+    return isInfraShape(value, {
+        source: (source) => source === 'secret-store',
+        projectId: isNonEmptyString,
+        environment: (environment) => APP_ENVIRONMENT_IDS.some((id) => id === environment),
+        ref: isNonEmptyString,
+        key: isNonEmptyString,
+    });
+}
+//# sourceMappingURL=isInfraWorkloadValue.js.map

package/dist/infra/isInfraWorkloadValue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraWorkloadValue.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS;gBAClC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;aAC5C,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;QACL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,cAAc;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC;QAClF,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;KACtB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { APP_ENVIRONMENT_IDS } from '../environments';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */\nexport function isInfraWorkloadValue(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  switch (value.kind) {\n    case 'literal':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'literal',\n        value: (field) => typeof field === 'string',\n      });\n    case 'output':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'output',\n        resourceId: isNonEmptyString,\n        output: isNonEmptyString,\n      });\n    case 'secret':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'secret',\n        reference: isSecretReference,\n      });\n    default:\n      return false;\n  }\n}\n\n/*** Managed secret references contain identity only, never privileged payloads. */\nfunction isSecretReference(value: unknown): boolean {\n  return isInfraShape(value, {\n    source: (source) => source === 'secret-store',\n    projectId: isNonEmptyString,\n    environment: (environment) => APP_ENVIRONMENT_IDS.some((id) => id === environment),\n    ref: isNonEmptyString,\n    key: isNonEmptyString,\n  });\n}\n"]}

package/dist/infra/parseInfraManifest.d.ts

@@ -0,0 +1,5 @@
+import type { InfraResult } from '../types/infraLifecycle';
+import type { InfraManifest } from '../types/infraManifest';
+/** Parse unknown infrastructure input; package availability and credentials are separate validation stages. */
+export declare function parseInfraManifest(value: unknown): InfraResult<InfraManifest>;
+//# sourceMappingURL=parseInfraManifest.d.ts.map

package/dist/infra/parseInfraManifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseInfraManifest.d.ts","sourceRoot":"","sources":["../../src/infra/parseInfraManifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG5D,+GAA+G;AAC/G,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAAC,aAAa,CAAC,CAc7E"}

package/dist/infra/parseInfraManifest.js

@@ -0,0 +1,17 @@
+import { isInfraManifest } from './isInfraManifest';
+/** Parse unknown infrastructure input; package availability and credentials are separate validation stages. */
+export function parseInfraManifest(value) {
+    return isInfraManifest(value)
+        ? { ok: true, value, diagnostics: [] }
+        : {
+            ok: false,
+            diagnostics: [
+                {
+                    severity: 'error',
+                    code: 'invalid_manifest',
+                    message: 'Expected canonical Infra environments with supported provider configuration and compute/runtime compatibility.',
+                },
+            ],
+        };
+}
+//# sourceMappingURL=parseInfraManifest.js.map

package/dist/infra/parseInfraManifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseInfraManifest.js","sourceRoot":"","sources":["../../src/infra/parseInfraManifest.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,+GAA+G;AAC/G,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,eAAe,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE;QACtC,CAAC,CAAC;YACE,EAAE,EAAE,KAAK;YACT,WAAW,EAAE;gBACX;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EACL,gHAAgH;iBACnH;aACF;SACF,CAAC;AACR,CAAC","sourcesContent":["import type { InfraResult } from '../types/infraLifecycle';\nimport type { InfraManifest } from '../types/infraManifest';\nimport { isInfraManifest } from './isInfraManifest';\n\n/** Parse unknown infrastructure input; package availability and credentials are separate validation stages. */\nexport function parseInfraManifest(value: unknown): InfraResult<InfraManifest> {\n  return isInfraManifest(value)\n    ? { ok: true, value, diagnostics: [] }\n    : {\n        ok: false,\n        diagnostics: [\n          {\n            severity: 'error',\n            code: 'invalid_manifest',\n            message:\n              'Expected canonical Infra environments with supported provider configuration and compute/runtime compatibility.',\n          },\n        ],\n      };\n}\n"]}

package/dist/infra/validateInfraAdapterSelection.d.ts

@@ -0,0 +1,6 @@
+import type { InfraAdapterDescriptor } from '../types/infraAdapters';
+import type { InfraResult } from '../types/infraLifecycle';
+import type { InfraEnvironmentSpec } from '../types/infraManifest';
+/** Validate supplied installed descriptors without imports or filesystem access; only selected packages matter. */
+export declare function validateInfraAdapterSelection(environment: InfraEnvironmentSpec, installed: readonly unknown[]): InfraResult<readonly InfraAdapterDescriptor[]>;
+//# sourceMappingURL=validateInfraAdapterSelection.d.ts.map

package/dist/infra/validateInfraAdapterSelection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateInfraAdapterSelection.d.ts","sourceRoot":"","sources":["../../src/infra/validateInfraAdapterSelection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAInE,mHAAmH;AACnH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,oBAAoB,EACjC,SAAS,EAAE,SAAS,OAAO,EAAE,GAC5B,WAAW,CAAC,SAAS,sBAAsB,EAAE,CAAC,CA+BhD"}