@ankhorage/contracts 16.0.0 → 17.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/README.md +1 -1
- package/dist/infra/isInfraDeploymentSpec.js +6 -0
- package/dist/infra/isInfraDeploymentSpec.js.map +1 -1
- package/dist/infra/isInfraEnvironmentSpec.d.ts.map +1 -1
- package/dist/infra/isInfraEnvironmentSpec.js +12 -0
- package/dist/infra/isInfraEnvironmentSpec.js.map +1 -1
- package/dist/infra/isInfraWorkloadValue.d.ts.map +1 -1
- package/dist/infra/isInfraWorkloadValue.js +7 -0
- package/dist/infra/isInfraWorkloadValue.js.map +1 -1
- package/dist/types/infraAdapters.d.ts +3 -3
- package/dist/types/infraAdapters.d.ts.map +1 -1
- package/dist/types/infraAdapters.js.map +1 -1
- package/dist/types/infraManifest.d.ts +10 -0
- package/dist/types/infraManifest.d.ts.map +1 -1
- package/dist/types/infraManifest.js.map +1 -1
- package/dist/types/infraWorkload.d.ts +5 -1
- package/dist/types/infraWorkload.d.ts.map +1 -1
- package/dist/types/infraWorkload.js.map +1 -1
- package/package.json +1 -1
- package/src/infra/isInfraDeploymentSpec.ts +8 -0
- package/src/infra/isInfraEnvironmentSpec.ts +18 -0
- package/src/infra/isInfraWorkloadValue.ts +7 -0
- package/src/infra-types.test.ts +17 -0
- package/src/infra-workload.test.ts +50 -0
- package/src/infra.test.ts +32 -0
- package/src/types/infraAdapters.ts +9 -2
- package/src/types/infraManifest.ts +13 -1
- package/src/types/infraWorkload.ts +6 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,17 @@
|
|
|
1
1
|
# @ankhorage/contracts
|
|
2
2
|
|
|
3
|
+
## 17.0.0
|
|
4
|
+
|
|
5
|
+
### Major Changes
|
|
6
|
+
|
|
7
|
+
- ba68b95: Allow runtime-neutral workloads to reference keyed control-plane bootstrap credentials, let Cerbos selections carry explicit portable policy files, and require desired runtime targets for status, suspend and destroy so adapters remain stateless across CLI invocations.
|
|
8
|
+
|
|
9
|
+
## 16.1.0
|
|
10
|
+
|
|
11
|
+
### Minor Changes
|
|
12
|
+
|
|
13
|
+
- 89990ec: Add separate Hetzner SSH bootstrap configuration without conflating it with cloud API credentials.
|
|
14
|
+
|
|
3
15
|
## 16.0.0
|
|
4
16
|
|
|
5
17
|
### Major Changes
|
package/README.md
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
|
|
4
4
|
# @ankhorage/contracts
|
|
5
5
|
|
|
6
|
-
         
|
|
7
7
|
|
|
8
8
|
Serializable app, action, theme, auth, and secret-store contracts for Ankhorage.
|
|
9
9
|
|
|
@@ -29,6 +29,12 @@ function isCompute(value) {
|
|
|
29
29
|
serverType: infraFields.optionalText,
|
|
30
30
|
image: infraFields.optionalText,
|
|
31
31
|
credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),
|
|
32
|
+
ssh: (ssh) => ssh === undefined ||
|
|
33
|
+
isInfraShape(ssh, {
|
|
34
|
+
user: infraFields.optionalText,
|
|
35
|
+
port: infraFields.optionalPositiveInteger,
|
|
36
|
+
credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),
|
|
37
|
+
}),
|
|
32
38
|
});
|
|
33
39
|
}
|
|
34
40
|
/*** Runtime topology expresses host roles and never couples k3s to a compute vendor. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isInfraDeploymentSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraDeploymentSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAQ7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,kGAAkG;AAClG,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAC5B,OAAO,YAAY,CAAC,KAAK,EAAE;YACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO;YAC5C,gBAAgB,EAAE,WAAW,CAAC,YAAY;SACU,CAAC,CAAC;IAC1D,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS;QAC9C,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,WAAW,CAAC,YAAY;QACpC,KAAK,EAAE,WAAW,CAAC,YAAY;QAC/B,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"isInfraDeploymentSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraDeploymentSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAQ7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,kGAAkG;AAClG,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAC5B,OAAO,YAAY,CAAC,KAAK,EAAE;YACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO;YAC5C,gBAAgB,EAAE,WAAW,CAAC,YAAY;SACU,CAAC,CAAC;IAC1D,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS;QAC9C,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,WAAW,CAAC,YAAY;QACpC,KAAK,EAAE,WAAW,CAAC,YAAY;QAC/B,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC;QAC5F,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CACX,GAAG,KAAK,SAAS;YACjB,YAAY,CAAC,GAAG,EAAE;gBAChB,IAAI,EAAE,WAAW,CAAC,YAAY;gBAC9B,IAAI,EAAE,WAAW,CAAC,uBAAuB;gBACzC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAC3B,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC;aACjE,CAAC;KACkD,CAAC,CAAC;AAC5D,CAAC;AAED,wFAAwF;AACxF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,QAAQ,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvB,KAAK,UAAU;YACb,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;gBAC/C,OAAO,EAAE,WAAW,CAAC,YAAY;gBACjC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ;gBACtF,IAAI,EAAE,WAAW,CAAC,uBAAuB;gBACzC,SAAS,EAAE,WAAW,CAAC,uBAAuB;aACS,CAAC,CAAC;QAC7D,KAAK,KAAK;YACR,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK;gBAC1C,OAAO,EAAE,WAAW,CAAC,YAAY;gBACjC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS;oBACtB,YAAY,CAAC,QAAQ,EAAE;wBACrB,OAAO,EAAE,WAAW,CAAC,eAAe;wBACpC,MAAM,EAAE,WAAW,CAAC,kBAAkB;qBACvC,CAAC;aAC8C,CAAC,CAAC;QACxD,KAAK,gBAAgB;YACnB,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,gBAAgB;gBACrD,WAAW,EAAE,WAAW,CAAC,YAAY;aACwB,CAAC,CAAC;QACnE;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport type {\n InfraComputeSelection,\n InfraDeploymentSpec,\n InfraRuntimeSelection,\n} from '../types/infraManifest';\nimport type { InfraShape } from '../types/infraValidation';\nimport { INFRA_RUNTIME_COMPATIBILITY } from './constants';\nimport { infraFields } from './infraFields';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Validate provider-specific config and the exact same compatibility map used by TypeScript. */\nexport function isInfraDeploymentSpec(value: unknown): value is InfraDeploymentSpec {\n if (!isInfraShape(value, { compute: isCompute, runtime: isRuntime }) || !isRecord(value))\n return false;\n if (!isRecord(value.compute) || !isRecord(value.runtime)) return false;\n const compute = value.compute.provider;\n const runtime = value.runtime.provider;\n return Object.entries(INFRA_RUNTIME_COMPATIBILITY).some(\n ([id, providers]) => id === runtime && providers.some((provider) => provider === compute),\n );\n}\n\n/*** Compute configuration is closed per provider; control-plane refs cannot be managed secrets. */\nfunction isCompute(value: unknown): boolean {\n if (!isRecord(value)) return false;\n if (value.provider === 'local')\n return isInfraShape(value, {\n provider: (provider) => provider === 'local',\n workingDirectory: infraFields.optionalText,\n } satisfies InfraShape<InfraComputeSelection<'local'>>);\n return isInfraShape(value, {\n provider: (provider) => provider === 'hetzner',\n location: isNonEmptyString,\n serverType: infraFields.optionalText,\n image: infraFields.optionalText,\n credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),\n ssh: (ssh) =>\n ssh === undefined ||\n isInfraShape(ssh, {\n user: infraFields.optionalText,\n port: infraFields.optionalPositiveInteger,\n credentials: (credentials) =>\n credentials === undefined || isInfraCredentialRef(credentials),\n }),\n } satisfies InfraShape<InfraComputeSelection<'hetzner'>>);\n}\n\n/*** Runtime topology expresses host roles and never couples k3s to a compute vendor. */\nfunction isRuntime(value: unknown): boolean {\n if (!isRecord(value)) return false;\n switch (value.provider) {\n case 'minikube':\n return isInfraShape(value, {\n provider: (provider) => provider === 'minikube',\n profile: infraFields.optionalText,\n driver: (driver) => driver === undefined || driver === 'docker' || driver === 'podman',\n cpus: infraFields.optionalPositiveInteger,\n memoryMiB: infraFields.optionalPositiveInteger,\n } satisfies InfraShape<InfraRuntimeSelection<'minikube'>>);\n case 'k3s':\n return isInfraShape(value, {\n provider: (provider) => provider === 'k3s',\n version: infraFields.optionalText,\n topology: (topology) =>\n topology === undefined ||\n isInfraShape(topology, {\n servers: infraFields.positiveInteger,\n agents: infraFields.nonnegativeInteger,\n }),\n } satisfies InfraShape<InfraRuntimeSelection<'k3s'>>);\n case 'docker-compose':\n return isInfraShape(value, {\n provider: (provider) => provider === 'docker-compose',\n projectName: infraFields.optionalText,\n } satisfies InfraShape<InfraRuntimeSelection<'docker-compose'>>);\n default:\n return false;\n }\n}\n"]}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isInfraEnvironmentSpec.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraEnvironmentSpec.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"isInfraEnvironmentSpec.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraEnvironmentSpec.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAA0B,MAAM,wBAAwB,CAAC;AAU3F,8FAA8F;AAC9F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF"}
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { isRecord } from '@ankhorage/utility/object';
|
|
2
|
+
import { isNonEmptyString } from '@ankhorage/utility/string';
|
|
2
3
|
import { INFRA_ADAPTER_CATALOG } from './constants';
|
|
3
4
|
import { infraFields } from './infraFields';
|
|
4
5
|
import { isInfraAuthSpec } from './isInfraAuthSpec';
|
|
@@ -25,6 +26,7 @@ function isEnvironmentShape(value) {
|
|
|
25
26
|
isInfraShape(authz, {
|
|
26
27
|
provider: (provider) => provider === 'cerbos',
|
|
27
28
|
kind: (kind) => kind === 'ABAC' || kind === 'RBAC',
|
|
29
|
+
policies: (policies) => policies === undefined || isPolicyFiles(policies),
|
|
28
30
|
}),
|
|
29
31
|
secretStore: (store) => store === undefined ||
|
|
30
32
|
isInfraShape(store, {
|
|
@@ -35,6 +37,16 @@ function isEnvironmentShape(value) {
|
|
|
35
37
|
workloads: (workloads) => workloads === undefined || isWorkloads(workloads),
|
|
36
38
|
});
|
|
37
39
|
}
|
|
40
|
+
/*** Validate portable, unique Cerbos policy files without host paths or traversal. */
|
|
41
|
+
function isPolicyFiles(value) {
|
|
42
|
+
return (Array.isArray(value) &&
|
|
43
|
+
value.every((policy) => isInfraShape(policy, {
|
|
44
|
+
path: (path) => isNonEmptyString(path) && !path.startsWith('/') && !path.split('/').includes('..'),
|
|
45
|
+
content: isNonEmptyString,
|
|
46
|
+
})) &&
|
|
47
|
+
new Set(value.map((policy) => (isRecord(policy) ? policy.path : undefined))).size ===
|
|
48
|
+
value.length);
|
|
49
|
+
}
|
|
38
50
|
/*** Object storage can vary independently from database/auth; there is no implicit auto provider. */
|
|
39
51
|
function isObjectStorage(value) {
|
|
40
52
|
if (!isRecord(value))
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isInfraEnvironmentSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraEnvironmentSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"isInfraEnvironmentSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraEnvironmentSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAI7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,2FAA2F;AAC3F,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,UAAU,EAAE,qBAAqB;QACjC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS;YACtB,YAAY,CAAC,QAAQ,EAAE;gBACrB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;gBAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;aACxE,CAAC;QACJ,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC;QAC7E,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC;QAC3D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ;gBAC7C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;gBAClD,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC;aAC1E,CAAC;QACJ,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,gBAAgB;gBACrD,MAAM,EAAE,WAAW,CAAC,YAAY;aACjC,CAAC;QACJ,UAAU,EAAE,CAAC,UAAU,EAAE,EAAE,CACzB,UAAU,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;QAC5F,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC;KACjC,CAAC,CAAC;AAChD,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,YAAY,CAAC,MAAM,EAAE;YACnB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CACb,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpF,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CACH;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/E,KAAK,CAAC,MAAM,CACf,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,CAAC,QAAiB,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAC5D,OAAO,EAAE,WAAW,CAAC,eAAe;KACrC,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,GAAG,MAAM;QACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY;QACnC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC;KACV,CAAC,CAAC;AACxF,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAChC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CACpE,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,sBAAsB,CAAC,KAA2B;IACzD,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,WAAW;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAC1D,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS;QACnC,SAAS;QACT,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;QAChC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport type { InfraEnvironmentSpec, InfraObjectStorageSpec } from '../types/infraManifest';\nimport type { InfraShape } from '../types/infraValidation';\nimport { INFRA_ADAPTER_CATALOG } from './constants';\nimport { infraFields } from './infraFields';\nimport { isInfraAuthSpec } from './isInfraAuthSpec';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraDeploymentSpec } from './isInfraDeploymentSpec';\nimport { isInfraShape } from './isInfraShape';\nimport { isInfraWorkloadSpec } from './isInfraWorkloadSpec';\n\n/*** Validate sibling capabilities and their required relationships within one environment. */\nexport function isInfraEnvironmentSpec(value: unknown): value is InfraEnvironmentSpec {\n return isEnvironmentShape(value) && hasServiceDependencies(value);\n}\n\n/*** Check all environment field shapes before inspecting canonical dependency metadata. */\nfunction isEnvironmentShape(value: unknown): value is InfraEnvironmentSpec {\n return isInfraShape(value, {\n deployment: isInfraDeploymentSpec,\n database: (database) =>\n database === undefined ||\n isInfraShape(database, {\n provider: (provider) => provider === 'supabase',\n tier: (tier) => tier === undefined || tier === 'dev' || tier === 'prod',\n }),\n objectStorage: (storage) => storage === undefined || isObjectStorage(storage),\n auth: (auth) => auth === undefined || isInfraAuthSpec(auth),\n authz: (authz) =>\n authz === undefined ||\n isInfraShape(authz, {\n provider: (provider) => provider === 'cerbos',\n kind: (kind) => kind === 'ABAC' || kind === 'RBAC',\n policies: (policies) => policies === undefined || isPolicyFiles(policies),\n }),\n secretStore: (store) =>\n store === undefined ||\n isInfraShape(store, {\n provider: (provider) => provider === 'supabase-vault',\n schema: infraFields.optionalText,\n }),\n networking: (networking) =>\n networking === undefined || isInfraShape(networking, { domain: infraFields.optionalText }),\n workloads: (workloads) => workloads === undefined || isWorkloads(workloads),\n } satisfies InfraShape<InfraEnvironmentSpec>);\n}\n\n/*** Validate portable, unique Cerbos policy files without host paths or traversal. */\nfunction isPolicyFiles(value: unknown): boolean {\n return (\n Array.isArray(value) &&\n value.every((policy) =>\n isInfraShape(policy, {\n path: (path) =>\n isNonEmptyString(path) && !path.startsWith('/') && !path.split('/').includes('..'),\n content: isNonEmptyString,\n }),\n ) &&\n new Set(value.map((policy) => (isRecord(policy) ? policy.path : undefined))).size ===\n value.length\n );\n}\n\n/*** Object storage can vary independently from database/auth; there is no implicit auto provider. */\nfunction isObjectStorage(value: unknown): boolean {\n if (!isRecord(value)) return false;\n const common = {\n provider: (provider: unknown) => provider === value.provider,\n buckets: infraFields.optionalStrings,\n };\n if (value.provider === 'supabase') return isInfraShape(value, common);\n return isInfraShape(value, {\n ...common,\n provider: (provider) => provider === 'r2',\n accountId: infraFields.optionalText,\n credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),\n } satisfies InfraShape<Extract<InfraObjectStorageSpec, { readonly provider: 'r2' }>>);\n}\n\n/*** Duplicate desired workload identities cannot be reconciled safely. */\nfunction isWorkloads(value: unknown): boolean {\n return (\n Array.isArray(value) &&\n value.every(isInfraWorkloadSpec) &&\n new Set(value.map((workload) => workload.id)).size === value.length\n );\n}\n\n/*** Check catalog dependencies against selected sibling capabilities and runtime capabilities. */\nfunction hasServiceDependencies(value: InfraEnvironmentSpec): boolean {\n const selections = [\n value.database,\n value.auth,\n value.authz,\n value.objectStorage,\n value.secretStore,\n ];\n const runtime = Object.values(INFRA_ADAPTER_CATALOG).find(\n (entry) => entry.id === value.deployment.runtime.provider,\n );\n const capabilities = new Set<string>([\n 'compute',\n ...(runtime?.capabilities ?? []),\n ...Object.entries(value)\n .filter(([, selection]) => selection !== undefined)\n .map(([capability]) => capability),\n ]);\n return Object.values(INFRA_ADAPTER_CATALOG)\n .filter((entry) => selections.some((selection) => selection?.provider === entry.id))\n .every((entry) => entry.dependencies.every((dependency) => capabilities.has(dependency)));\n}\n"]}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isInfraWorkloadValue.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"isInfraWorkloadValue.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAOA,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA4B5D"}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { isRecord } from '@ankhorage/utility/object';
|
|
2
2
|
import { isNonEmptyString } from '@ankhorage/utility/string';
|
|
3
3
|
import { APP_ENVIRONMENT_IDS } from '../environments';
|
|
4
|
+
import { isInfraCredentialRef } from './isInfraCredentialRef';
|
|
4
5
|
import { isInfraShape } from './isInfraShape';
|
|
5
6
|
/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */
|
|
6
7
|
export function isInfraWorkloadValue(value) {
|
|
@@ -23,6 +24,12 @@ export function isInfraWorkloadValue(value) {
|
|
|
23
24
|
kind: (kind) => kind === 'secret',
|
|
24
25
|
reference: isSecretReference,
|
|
25
26
|
});
|
|
27
|
+
case 'credential':
|
|
28
|
+
return isInfraShape(value, {
|
|
29
|
+
kind: (kind) => kind === 'credential',
|
|
30
|
+
reference: isInfraCredentialRef,
|
|
31
|
+
key: isNonEmptyString,
|
|
32
|
+
});
|
|
26
33
|
default:
|
|
27
34
|
return false;
|
|
28
35
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isInfraWorkloadValue.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS;gBAClC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;aAC5C,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;QACL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,cAAc;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC;QAClF,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;KACtB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { APP_ENVIRONMENT_IDS } from '../environments';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */\nexport function isInfraWorkloadValue(value: unknown): boolean {\n if (!isRecord(value)) return false;\n switch (value.kind) {\n case 'literal':\n return isInfraShape(value, {\n kind: (kind) => kind === 'literal',\n value: (field) => typeof field === 'string',\n });\n case 'output':\n return isInfraShape(value, {\n kind: (kind) => kind === 'output',\n resourceId: isNonEmptyString,\n output: isNonEmptyString,\n });\n case 'secret':\n return isInfraShape(value, {\n kind: (kind) => kind === 'secret',\n reference: isSecretReference,\n });\n default:\n return false;\n }\n}\n\n/*** Managed secret references contain identity only, never privileged payloads. */\nfunction isSecretReference(value: unknown): boolean {\n return isInfraShape(value, {\n source: (source) => source === 'secret-store',\n projectId: isNonEmptyString,\n environment: (environment) => APP_ENVIRONMENT_IDS.some((id) => id === environment),\n ref: isNonEmptyString,\n key: isNonEmptyString,\n });\n}\n"]}
|
|
1
|
+
{"version":3,"file":"isInfraWorkloadValue.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS;gBAClC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;aAC5C,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;QACL,KAAK,YAAY;YACf,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,YAAY;gBACrC,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,gBAAgB;aACtB,CAAC,CAAC;QACL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,cAAc;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC;QAClF,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;KACtB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { APP_ENVIRONMENT_IDS } from '../environments';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */\nexport function isInfraWorkloadValue(value: unknown): boolean {\n if (!isRecord(value)) return false;\n switch (value.kind) {\n case 'literal':\n return isInfraShape(value, {\n kind: (kind) => kind === 'literal',\n value: (field) => typeof field === 'string',\n });\n case 'output':\n return isInfraShape(value, {\n kind: (kind) => kind === 'output',\n resourceId: isNonEmptyString,\n output: isNonEmptyString,\n });\n case 'secret':\n return isInfraShape(value, {\n kind: (kind) => kind === 'secret',\n reference: isSecretReference,\n });\n case 'credential':\n return isInfraShape(value, {\n kind: (kind) => kind === 'credential',\n reference: isInfraCredentialRef,\n key: isNonEmptyString,\n });\n default:\n return false;\n }\n}\n\n/*** Managed secret references contain identity only, never privileged payloads. */\nfunction isSecretReference(value: unknown): boolean {\n return isInfraShape(value, {\n source: (source) => source === 'secret-store',\n projectId: isNonEmptyString,\n environment: (environment) => APP_ENVIRONMENT_IDS.some((id) => id === environment),\n ref: isNonEmptyString,\n key: isNonEmptyString,\n });\n}\n"]}
|
|
@@ -67,9 +67,9 @@ export interface InfraRuntimeAdapter<P extends InfraRuntimeProviderId = InfraRun
|
|
|
67
67
|
validateAsync(context: InfraExecutionContext, desired: InfraRuntimeDesiredState<P>): Promise<InfraResult<null>>;
|
|
68
68
|
planAsync(context: InfraExecutionContext, desired: InfraRuntimeDesiredState<P>): Promise<InfraResult<readonly InfraPlanAction[]>>;
|
|
69
69
|
ensureAsync(context: InfraExecutionContext, desired: InfraRuntimeDesiredState<P>): Promise<InfraResult<InfraReconcileResult>>;
|
|
70
|
-
statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;
|
|
71
|
-
suspendAsync(context: InfraExecutionContext): Promise<InfraResult<InfraReconcileResult>>;
|
|
72
|
-
destroyAsync(context: InfraExecutionContext, request: InfraDestroyRequest): Promise<InfraResult<InfraReconcileResult>>;
|
|
70
|
+
statusAsync(context: InfraExecutionContext, desired: InfraRuntimeDesiredState<P>): Promise<InfraResult<readonly InfraResourceStatus[]>>;
|
|
71
|
+
suspendAsync(context: InfraExecutionContext, desired: InfraRuntimeDesiredState<P>): Promise<InfraResult<InfraReconcileResult>>;
|
|
72
|
+
destroyAsync(context: InfraExecutionContext, desired: InfraRuntimeDesiredState<P>, request: InfraDestroyRequest): Promise<InfraResult<InfraReconcileResult>>;
|
|
73
73
|
generateAsync?(context: InfraExecutionContext, desired: InfraRuntimeDesiredState<P>): Promise<InfraResult<readonly InfraGeneratedArtifact[]>>;
|
|
74
74
|
}
|
|
75
75
|
/** A service can own several capabilities but contributes one deduplicated platform instance. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"infraAdapters.d.ts","sourceRoot":"","sources":["../../src/types/infraAdapters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,0GAA0G;AAC1G,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,IAAI;KAC7E,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG;QAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAC,EAAE,CAAC;KACtF;CACF,CAAC,CAAC,CAAC,CAAC;AAEL,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC;CAC1C,GAAG,CACA;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,8BAA8B,CAAC;IACpD,+FAA+F;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,CACJ,CAAC;AAEF,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE;QACpB,YAAY,CACV,SAAS,EAAE,8BAA8B,GACxC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;KAC7E,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAC5F,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,aAAa,CACX,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,SAAS,CACP,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IACpD,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CACR,WAAW,CAAC,oBAAoB,GAAG;QAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAA;KAAE,CAAC,CACxF,CAAC;IACF,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAClG,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,wBAAwB,CACvC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAEzD,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,WAAW,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAC5F,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/C,iFAAiF;IACjF,aAAa,CACX,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,SAAS,CACP,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IACpD,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,WAAW,
|
|
1
|
+
{"version":3,"file":"infraAdapters.d.ts","sourceRoot":"","sources":["../../src/types/infraAdapters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,0GAA0G;AAC1G,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,IAAI;KAC7E,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG;QAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAC,EAAE,CAAC;KACtF;CACF,CAAC,CAAC,CAAC,CAAC;AAEL,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC;CAC1C,GAAG,CACA;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,8BAA8B,CAAC;IACpD,+FAA+F;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,CACJ,CAAC;AAEF,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE;QACpB,YAAY,CACV,SAAS,EAAE,8BAA8B,GACxC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;KAC7E,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAC5F,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,aAAa,CACX,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,SAAS,CACP,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IACpD,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CACR,WAAW,CAAC,oBAAoB,GAAG;QAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAA;KAAE,CAAC,CACxF,CAAC;IACF,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAClG,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,wBAAwB,CACvC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAEzD,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,WAAW,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAC5F,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/C,iFAAiF;IACjF,aAAa,CACX,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,SAAS,CACP,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IACpD,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACxD,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,EACpC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,aAAa,CAAC,CACZ,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAAC,CAAC;CAC5D;AAED,iGAAiG;AACjG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,UAAU,GAAG,QAAQ,GAAG,IAAI,GAAG,gBAAgB,CAAC,CAAC;IAC7F,iFAAiF;IACjF,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,SAAS,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IAC5F,qBAAqB,CACnB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,WAAW,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACtD,cAAc,CACZ,OAAO,EAAE,qBAAqB,EAC9B,cAAc,EAAE,SAAS,WAAW,EAAE,GACrC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAClG,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,YAAY,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;CAC3F"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"infraAdapters.js","sourceRoot":"","sources":["../../src/types/infraAdapters.ts"],"names":[],"mappings":"","sourcesContent":["import type { AppEnvironmentId } from '../environments';\nimport type { INFRA_ADAPTER_CATALOG } from '../infra/constants';\nimport type {\n InfraDestroyRequest,\n InfraGeneratedArtifact,\n InfraLedger,\n InfraOutput,\n InfraOwnedResource,\n InfraPlanAction,\n InfraResourceStatus,\n InfraResult,\n} from './infraLifecycle';\nimport type {\n InfraAdapterId,\n InfraComputeProviderId,\n InfraComputeSelection,\n InfraEnvironmentSpec,\n InfraRuntimeProviderId,\n InfraRuntimeSelection,\n} from './infraManifest';\nimport type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';\nimport type { InfraWorkloadSpec } from './infraWorkload';\n\n/** Package exports must match this exact catalog entry; optional operations are advertised explicitly. */\nexport type InfraAdapterDescriptor<P extends InfraAdapterId = InfraAdapterId> = {\n [K in P]: (typeof INFRA_ADAPTER_CATALOG)[K] & {\n readonly operations?: readonly ('suspend' | 'resume' | 'generate' | 'diagnostics')[];\n };\n}[P];\n\nexport type InfraComputeTarget = {\n readonly id: string;\n readonly os: 'linux' | 'darwin' | 'windows';\n readonly architecture: 'amd64' | 'arm64';\n} & (\n | { readonly kind: 'local-host' }\n | {\n readonly kind: 'ssh-host';\n readonly host: string;\n readonly port: number;\n readonly user: string;\n readonly credential: InfraControlPlaneCredentialRef;\n /** Expected host key supplied by the compute owner; runtimes must verify host authenticity. */\n readonly hostKeyFingerprint: string;\n }\n);\n\n/** Trusted execution-only ports. Implementations must not serialize resolved credential values. */\nexport interface InfraExecutionContext {\n readonly projectId: string;\n readonly environment: AppEnvironmentId;\n readonly desired: InfraEnvironmentSpec;\n readonly previous?: InfraLedger;\n readonly signal?: AbortSignal;\n readonly credentials: {\n resolveAsync(\n reference: InfraControlPlaneCredentialRef,\n ): Promise<InfraResult<Readonly<Record<string, string>>>>;\n };\n readonly secrets: {\n resolveAsync(reference: InfraSecretReference): Promise<InfraResult<string>>;\n };\n}\n\nexport interface InfraReconcileResult {\n readonly resources: readonly InfraOwnedResource[];\n readonly outputs: readonly InfraOutput[];\n}\n\nexport interface InfraComputeAdapter<P extends InfraComputeProviderId = InfraComputeProviderId> {\n readonly descriptor: InfraAdapterDescriptor<P>;\n /** Read-only prerequisites, config and control-plane credential validation. */\n validateAsync(\n context: InfraExecutionContext,\n selection: InfraComputeSelection<P>,\n ): Promise<InfraResult<null>>;\n planAsync(\n context: InfraExecutionContext,\n selection: InfraComputeSelection<P>,\n ): Promise<InfraResult<readonly InfraPlanAction[]>>;\n ensureAsync(\n context: InfraExecutionContext,\n selection: InfraComputeSelection<P>,\n ): Promise<\n InfraResult<InfraReconcileResult & { readonly targets: readonly InfraComputeTarget[] }>\n >;\n statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n destroyAsync(\n context: InfraExecutionContext,\n request: InfraDestroyRequest,\n ): Promise<InfraResult<InfraReconcileResult>>;\n}\n\nexport interface InfraRuntimeDesiredState<\n P extends InfraRuntimeProviderId = InfraRuntimeProviderId,\n> {\n readonly selection: InfraRuntimeSelection<P>;\n readonly targets: readonly InfraComputeTarget[];\n readonly workloads: readonly InfraWorkloadSpec[];\n /** Previously resolved outputs available to portable workload value references. */\n readonly availableOutputs: readonly InfraOutput[];\n}\n\nexport interface InfraRuntimeAdapter<P extends InfraRuntimeProviderId = InfraRuntimeProviderId> {\n readonly descriptor: InfraAdapterDescriptor<P>;\n /** Read-only prerequisites and desired-state validation; no cluster creation. */\n validateAsync(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n ): Promise<InfraResult<null>>;\n planAsync(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n ): Promise<InfraResult<readonly InfraPlanAction[]>>;\n ensureAsync(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n ): Promise<InfraResult<InfraReconcileResult>>;\n statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n suspendAsync(context: InfraExecutionContext): Promise<InfraResult<InfraReconcileResult>>;\n destroyAsync(\n context: InfraExecutionContext,\n request: InfraDestroyRequest,\n ): Promise<InfraResult<InfraReconcileResult>>;\n generateAsync?(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n ): Promise<InfraResult<readonly InfraGeneratedArtifact[]>>;\n}\n\n/** A service can own several capabilities but contributes one deduplicated platform instance. */\nexport interface InfraServiceAdapter {\n readonly descriptor: InfraAdapterDescriptor<'supabase' | 'cerbos' | 'r2' | 'supabase-vault'>;\n /** Read-only service config, bootstrap credentials and dependency validation. */\n validateAsync(context: InfraExecutionContext): Promise<InfraResult<null>>;\n planAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraPlanAction[]>>;\n desiredWorkloadsAsync(\n context: InfraExecutionContext,\n ): Promise<InfraResult<readonly InfraWorkloadSpec[]>>;\n reconcileAsync(\n context: InfraExecutionContext,\n runtimeOutputs: readonly InfraOutput[],\n ): Promise<InfraResult<InfraReconcileResult>>;\n statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n destroyAsync(\n context: InfraExecutionContext,\n request: InfraDestroyRequest,\n ): Promise<InfraResult<InfraReconcileResult>>;\n suspendAsync?(context: InfraExecutionContext): Promise<InfraResult<InfraReconcileResult>>;\n}\n"]}
|
|
1
|
+
{"version":3,"file":"infraAdapters.js","sourceRoot":"","sources":["../../src/types/infraAdapters.ts"],"names":[],"mappings":"","sourcesContent":["import type { AppEnvironmentId } from '../environments';\nimport type { INFRA_ADAPTER_CATALOG } from '../infra/constants';\nimport type {\n InfraDestroyRequest,\n InfraGeneratedArtifact,\n InfraLedger,\n InfraOutput,\n InfraOwnedResource,\n InfraPlanAction,\n InfraResourceStatus,\n InfraResult,\n} from './infraLifecycle';\nimport type {\n InfraAdapterId,\n InfraComputeProviderId,\n InfraComputeSelection,\n InfraEnvironmentSpec,\n InfraRuntimeProviderId,\n InfraRuntimeSelection,\n} from './infraManifest';\nimport type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';\nimport type { InfraWorkloadSpec } from './infraWorkload';\n\n/** Package exports must match this exact catalog entry; optional operations are advertised explicitly. */\nexport type InfraAdapterDescriptor<P extends InfraAdapterId = InfraAdapterId> = {\n [K in P]: (typeof INFRA_ADAPTER_CATALOG)[K] & {\n readonly operations?: readonly ('suspend' | 'resume' | 'generate' | 'diagnostics')[];\n };\n}[P];\n\nexport type InfraComputeTarget = {\n readonly id: string;\n readonly os: 'linux' | 'darwin' | 'windows';\n readonly architecture: 'amd64' | 'arm64';\n} & (\n | { readonly kind: 'local-host' }\n | {\n readonly kind: 'ssh-host';\n readonly host: string;\n readonly port: number;\n readonly user: string;\n readonly credential: InfraControlPlaneCredentialRef;\n /** Expected host key supplied by the compute owner; runtimes must verify host authenticity. */\n readonly hostKeyFingerprint: string;\n }\n);\n\n/** Trusted execution-only ports. Implementations must not serialize resolved credential values. */\nexport interface InfraExecutionContext {\n readonly projectId: string;\n readonly environment: AppEnvironmentId;\n readonly desired: InfraEnvironmentSpec;\n readonly previous?: InfraLedger;\n readonly signal?: AbortSignal;\n readonly credentials: {\n resolveAsync(\n reference: InfraControlPlaneCredentialRef,\n ): Promise<InfraResult<Readonly<Record<string, string>>>>;\n };\n readonly secrets: {\n resolveAsync(reference: InfraSecretReference): Promise<InfraResult<string>>;\n };\n}\n\nexport interface InfraReconcileResult {\n readonly resources: readonly InfraOwnedResource[];\n readonly outputs: readonly InfraOutput[];\n}\n\nexport interface InfraComputeAdapter<P extends InfraComputeProviderId = InfraComputeProviderId> {\n readonly descriptor: InfraAdapterDescriptor<P>;\n /** Read-only prerequisites, config and control-plane credential validation. */\n validateAsync(\n context: InfraExecutionContext,\n selection: InfraComputeSelection<P>,\n ): Promise<InfraResult<null>>;\n planAsync(\n context: InfraExecutionContext,\n selection: InfraComputeSelection<P>,\n ): Promise<InfraResult<readonly InfraPlanAction[]>>;\n ensureAsync(\n context: InfraExecutionContext,\n selection: InfraComputeSelection<P>,\n ): Promise<\n InfraResult<InfraReconcileResult & { readonly targets: readonly InfraComputeTarget[] }>\n >;\n statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n destroyAsync(\n context: InfraExecutionContext,\n request: InfraDestroyRequest,\n ): Promise<InfraResult<InfraReconcileResult>>;\n}\n\nexport interface InfraRuntimeDesiredState<\n P extends InfraRuntimeProviderId = InfraRuntimeProviderId,\n> {\n readonly selection: InfraRuntimeSelection<P>;\n readonly targets: readonly InfraComputeTarget[];\n readonly workloads: readonly InfraWorkloadSpec[];\n /** Previously resolved outputs available to portable workload value references. */\n readonly availableOutputs: readonly InfraOutput[];\n}\n\nexport interface InfraRuntimeAdapter<P extends InfraRuntimeProviderId = InfraRuntimeProviderId> {\n readonly descriptor: InfraAdapterDescriptor<P>;\n /** Read-only prerequisites and desired-state validation; no cluster creation. */\n validateAsync(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n ): Promise<InfraResult<null>>;\n planAsync(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n ): Promise<InfraResult<readonly InfraPlanAction[]>>;\n ensureAsync(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n ): Promise<InfraResult<InfraReconcileResult>>;\n statusAsync(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n ): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n suspendAsync(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n ): Promise<InfraResult<InfraReconcileResult>>;\n destroyAsync(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n request: InfraDestroyRequest,\n ): Promise<InfraResult<InfraReconcileResult>>;\n generateAsync?(\n context: InfraExecutionContext,\n desired: InfraRuntimeDesiredState<P>,\n ): Promise<InfraResult<readonly InfraGeneratedArtifact[]>>;\n}\n\n/** A service can own several capabilities but contributes one deduplicated platform instance. */\nexport interface InfraServiceAdapter {\n readonly descriptor: InfraAdapterDescriptor<'supabase' | 'cerbos' | 'r2' | 'supabase-vault'>;\n /** Read-only service config, bootstrap credentials and dependency validation. */\n validateAsync(context: InfraExecutionContext): Promise<InfraResult<null>>;\n planAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraPlanAction[]>>;\n desiredWorkloadsAsync(\n context: InfraExecutionContext,\n ): Promise<InfraResult<readonly InfraWorkloadSpec[]>>;\n reconcileAsync(\n context: InfraExecutionContext,\n runtimeOutputs: readonly InfraOutput[],\n ): Promise<InfraResult<InfraReconcileResult>>;\n statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n destroyAsync(\n context: InfraExecutionContext,\n request: InfraDestroyRequest,\n ): Promise<InfraResult<InfraReconcileResult>>;\n suspendAsync?(context: InfraExecutionContext): Promise<InfraResult<InfraReconcileResult>>;\n}\n"]}
|
|
@@ -22,6 +22,11 @@ export interface InfraComputeConfigMap {
|
|
|
22
22
|
readonly serverType?: string;
|
|
23
23
|
readonly image?: string;
|
|
24
24
|
readonly credentials?: InfraControlPlaneCredentialRef;
|
|
25
|
+
readonly ssh?: {
|
|
26
|
+
readonly user?: string;
|
|
27
|
+
readonly port?: number;
|
|
28
|
+
readonly credentials?: InfraControlPlaneCredentialRef;
|
|
29
|
+
};
|
|
25
30
|
};
|
|
26
31
|
}
|
|
27
32
|
export interface InfraRuntimeConfigMap {
|
|
@@ -87,8 +92,13 @@ export interface InfraAuthConfigMap {
|
|
|
87
92
|
export interface InfraAuthzConfigMap {
|
|
88
93
|
readonly cerbos: {
|
|
89
94
|
readonly kind: 'RBAC' | 'ABAC';
|
|
95
|
+
readonly policies?: readonly InfraAuthzPolicyFile[];
|
|
90
96
|
};
|
|
91
97
|
}
|
|
98
|
+
export interface InfraAuthzPolicyFile {
|
|
99
|
+
readonly path: string;
|
|
100
|
+
readonly content: string;
|
|
101
|
+
}
|
|
92
102
|
export interface InfraSecretStoreConfigMap {
|
|
93
103
|
readonly 'supabase-vault': {
|
|
94
104
|
readonly schema?: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"infraManifest.d.ts","sourceRoot":"","sources":["../../src/types/infraManifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,qBAAqB,CAAC;AAChE,MAAM,MAAM,eAAe,GACzB,CAAC,OAAO,qBAAqB,CAAC,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AACzE,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI;KACvD,CAAC,IAAI,cAAc,GAAG,CAAC,SAAS,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,GACtF,CAAC,GACD,KAAK;CACV,CAAC,cAAc,CAAC,CAAC;AAClB,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACjE,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,2BAA2B,CAAC;AAE9E,kGAAkG;AAClG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;
|
|
1
|
+
{"version":3,"file":"infraManifest.d.ts","sourceRoot":"","sources":["../../src/types/infraManifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,qBAAqB,CAAC;AAChE,MAAM,MAAM,eAAe,GACzB,CAAC,OAAO,qBAAqB,CAAC,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AACzE,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI;KACvD,CAAC,IAAI,cAAc,GAAG,CAAC,SAAS,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,GACtF,CAAC,GACD,KAAK;CACV,CAAC,cAAc,CAAC,CAAC;AAClB,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACjE,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,2BAA2B,CAAC;AAE9E,kGAAkG;AAClG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;QACtD,QAAQ,CAAC,GAAG,CAAC,EAAE;YACb,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;SACvD,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,CAAC;IACF,QAAQ,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB,IAAI;KAC5F,CAAC,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC;CAC9D,CAAC,CAAC,CAAC,CAAC;AACL,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB,IAAI;KAC5F,CAAC,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC;CAC9D,CAAC,CAAC,CAAC,CAAC;AAEL,yFAAyF;AACzF,MAAM,MAAM,mBAAmB,GAAG;KAC/B,CAAC,IAAI,sBAAsB,GAAG;QAC7B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;KAC5C;CACF,CAAC,sBAAsB,CAAC,CAAC;AAE1B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC;CACvD;AACD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,EAAE,EAAE;QACX,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;KACvD,CAAC;CACH;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;QAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;QACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;QACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;QACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;KACpC,CAAC;CACH;AACD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;KACrD,CAAC;CACH;AACD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,MAAM,MAAM,iBAAiB,GAAG;KAC7B,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,sBAAsB,CAAC,CAAC,CAAC;CAC1F,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;AAChC,MAAM,MAAM,sBAAsB,GAAG;KAClC,CAAC,IAAI,gBAAgB,CAAC,eAAe,CAAC,GAAG;QACxC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;KACtB,GAAG,2BAA2B,CAAC,CAAC,CAAC;CACnC,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC;AACrC,MAAM,MAAM,aAAa,GAAG;KACzB,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC;CAClF,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5B,MAAM,MAAM,cAAc,GAAG;KAC1B,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC;CACpF,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7B,MAAM,MAAM,oBAAoB,GAAG;KAChC,CAAC,IAAI,gBAAgB,CAAC,aAAa,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,yBAAyB,CAAC,CAAC,CAAC;CAChG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAC7B,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC,GACnC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAC5E,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5D"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"infraManifest.js","sourceRoot":"","sources":["../../src/types/infraManifest.ts"],"names":[],"mappings":"","sourcesContent":["import type { AuthFlowConfig, AuthOAuthConfig } from '../auth';\nimport type { ApiDefinitionList } from '../data';\nimport type { AppEnvironmentId } from '../environments';\nimport type { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from '../infra/constants';\nimport type { AuthProfileSpec, AuthScope, AuthSignInSpec, AuthSignUpSpec } from '../types';\nimport type { InfraControlPlaneCredentialRef } from './infraSecrets';\nimport type { InfraWorkloadSpec } from './infraWorkload';\n\nexport type InfraAdapterId = keyof typeof INFRA_ADAPTER_CATALOG;\nexport type InfraCapability =\n (typeof INFRA_ADAPTER_CATALOG)[InfraAdapterId]['capabilities'][number];\nexport type InfraProviderFor<C extends InfraCapability> = {\n [P in InfraAdapterId]: C extends (typeof INFRA_ADAPTER_CATALOG)[P]['capabilities'][number]\n ? P\n : never;\n}[InfraAdapterId];\nexport type InfraComputeProviderId = InfraProviderFor<'compute'>;\nexport type InfraRuntimeProviderId = keyof typeof INFRA_RUNTIME_COMPATIBILITY;\n\n/** Non-secret provider configuration; credentials are resolved only at the execution boundary. */\nexport interface InfraComputeConfigMap {\n readonly local: { readonly workingDirectory?: string };\n readonly hetzner: {\n readonly location: string;\n readonly serverType?: string;\n readonly image?: string;\n readonly credentials?: InfraControlPlaneCredentialRef;\n };\n}\n\nexport interface InfraRuntimeConfigMap {\n readonly minikube: {\n readonly profile?: string;\n readonly driver?: 'docker' | 'podman';\n readonly cpus?: number;\n readonly memoryMiB?: number;\n };\n readonly k3s: {\n readonly version?: string;\n readonly topology?: { readonly servers: number; readonly agents: number };\n };\n readonly 'docker-compose': { readonly projectName?: string };\n}\n\nexport type InfraComputeSelection<P extends InfraComputeProviderId = InfraComputeProviderId> = {\n [K in P]: { readonly provider: K } & InfraComputeConfigMap[K];\n}[P];\nexport type InfraRuntimeSelection<P extends InfraRuntimeProviderId = InfraRuntimeProviderId> = {\n [K in P]: { readonly provider: K } & InfraRuntimeConfigMap[K];\n}[P];\n\n/** A discriminated union derived from the runtime catalog, never a Cartesian product. */\nexport type InfraDeploymentSpec = {\n [R in InfraRuntimeProviderId]: {\n readonly compute: InfraComputeSelection<(typeof INFRA_RUNTIME_COMPATIBILITY)[R][number]>;\n readonly runtime: InfraRuntimeSelection<R>;\n };\n}[InfraRuntimeProviderId];\n\nexport interface InfraDatabaseConfigMap {\n readonly supabase: { readonly tier?: 'dev' | 'prod' };\n}\nexport interface InfraObjectStorageConfigMap {\n readonly supabase: { readonly buckets?: readonly string[] };\n readonly r2: {\n readonly buckets?: readonly string[];\n readonly accountId?: string;\n readonly credentials?: InfraControlPlaneCredentialRef;\n };\n}\nexport interface InfraAuthConfigMap {\n readonly supabase: {\n readonly scope?: AuthScope;\n readonly flow?: AuthFlowConfig;\n readonly signIn?: AuthSignInSpec;\n readonly signUp?: AuthSignUpSpec;\n readonly oauth?: AuthOAuthConfig;\n readonly profile?: AuthProfileSpec;\n };\n}\nexport interface InfraAuthzConfigMap {\n readonly cerbos: {
|
|
1
|
+
{"version":3,"file":"infraManifest.js","sourceRoot":"","sources":["../../src/types/infraManifest.ts"],"names":[],"mappings":"","sourcesContent":["import type { AuthFlowConfig, AuthOAuthConfig } from '../auth';\nimport type { ApiDefinitionList } from '../data';\nimport type { AppEnvironmentId } from '../environments';\nimport type { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from '../infra/constants';\nimport type { AuthProfileSpec, AuthScope, AuthSignInSpec, AuthSignUpSpec } from '../types';\nimport type { InfraControlPlaneCredentialRef } from './infraSecrets';\nimport type { InfraWorkloadSpec } from './infraWorkload';\n\nexport type InfraAdapterId = keyof typeof INFRA_ADAPTER_CATALOG;\nexport type InfraCapability =\n (typeof INFRA_ADAPTER_CATALOG)[InfraAdapterId]['capabilities'][number];\nexport type InfraProviderFor<C extends InfraCapability> = {\n [P in InfraAdapterId]: C extends (typeof INFRA_ADAPTER_CATALOG)[P]['capabilities'][number]\n ? P\n : never;\n}[InfraAdapterId];\nexport type InfraComputeProviderId = InfraProviderFor<'compute'>;\nexport type InfraRuntimeProviderId = keyof typeof INFRA_RUNTIME_COMPATIBILITY;\n\n/** Non-secret provider configuration; credentials are resolved only at the execution boundary. */\nexport interface InfraComputeConfigMap {\n readonly local: { readonly workingDirectory?: string };\n readonly hetzner: {\n readonly location: string;\n readonly serverType?: string;\n readonly image?: string;\n readonly credentials?: InfraControlPlaneCredentialRef;\n readonly ssh?: {\n readonly user?: string;\n readonly port?: number;\n readonly credentials?: InfraControlPlaneCredentialRef;\n };\n };\n}\n\nexport interface InfraRuntimeConfigMap {\n readonly minikube: {\n readonly profile?: string;\n readonly driver?: 'docker' | 'podman';\n readonly cpus?: number;\n readonly memoryMiB?: number;\n };\n readonly k3s: {\n readonly version?: string;\n readonly topology?: { readonly servers: number; readonly agents: number };\n };\n readonly 'docker-compose': { readonly projectName?: string };\n}\n\nexport type InfraComputeSelection<P extends InfraComputeProviderId = InfraComputeProviderId> = {\n [K in P]: { readonly provider: K } & InfraComputeConfigMap[K];\n}[P];\nexport type InfraRuntimeSelection<P extends InfraRuntimeProviderId = InfraRuntimeProviderId> = {\n [K in P]: { readonly provider: K } & InfraRuntimeConfigMap[K];\n}[P];\n\n/** A discriminated union derived from the runtime catalog, never a Cartesian product. */\nexport type InfraDeploymentSpec = {\n [R in InfraRuntimeProviderId]: {\n readonly compute: InfraComputeSelection<(typeof INFRA_RUNTIME_COMPATIBILITY)[R][number]>;\n readonly runtime: InfraRuntimeSelection<R>;\n };\n}[InfraRuntimeProviderId];\n\nexport interface InfraDatabaseConfigMap {\n readonly supabase: { readonly tier?: 'dev' | 'prod' };\n}\nexport interface InfraObjectStorageConfigMap {\n readonly supabase: { readonly buckets?: readonly string[] };\n readonly r2: {\n readonly buckets?: readonly string[];\n readonly accountId?: string;\n readonly credentials?: InfraControlPlaneCredentialRef;\n };\n}\nexport interface InfraAuthConfigMap {\n readonly supabase: {\n readonly scope?: AuthScope;\n readonly flow?: AuthFlowConfig;\n readonly signIn?: AuthSignInSpec;\n readonly signUp?: AuthSignUpSpec;\n readonly oauth?: AuthOAuthConfig;\n readonly profile?: AuthProfileSpec;\n };\n}\nexport interface InfraAuthzConfigMap {\n readonly cerbos: {\n readonly kind: 'RBAC' | 'ABAC';\n readonly policies?: readonly InfraAuthzPolicyFile[];\n };\n}\nexport interface InfraAuthzPolicyFile {\n readonly path: string;\n readonly content: string;\n}\nexport interface InfraSecretStoreConfigMap {\n readonly 'supabase-vault': { readonly schema?: string };\n}\n\nexport type InfraDatabaseSpec = {\n [P in InfraProviderFor<'database'>]: { readonly provider: P } & InfraDatabaseConfigMap[P];\n}[InfraProviderFor<'database'>];\nexport type InfraObjectStorageSpec = {\n [P in InfraProviderFor<'objectStorage'>]: {\n readonly provider: P;\n } & InfraObjectStorageConfigMap[P];\n}[InfraProviderFor<'objectStorage'>];\nexport type InfraAuthSpec = {\n [P in InfraProviderFor<'auth'>]: { readonly provider: P } & InfraAuthConfigMap[P];\n}[InfraProviderFor<'auth'>];\nexport type InfraAuthzSpec = {\n [P in InfraProviderFor<'authz'>]: { readonly provider: P } & InfraAuthzConfigMap[P];\n}[InfraProviderFor<'authz'>];\nexport type InfraSecretStoreSpec = {\n [P in InfraProviderFor<'secretStore'>]: { readonly provider: P } & InfraSecretStoreConfigMap[P];\n}[InfraProviderFor<'secretStore'>];\n\nexport interface InfraNetworkingSpec {\n /** Public DNS name intent, not automatic DNS/CDN vendor provisioning. */\n readonly domain?: string;\n}\n\nexport interface InfraEnvironmentSpec {\n readonly deployment: InfraDeploymentSpec;\n readonly database?: InfraDatabaseSpec;\n readonly objectStorage?: InfraObjectStorageSpec;\n readonly auth?: InfraAuthSpec;\n readonly authz?: InfraAuthzSpec;\n readonly secretStore?: InfraSecretStoreSpec;\n readonly networking?: InfraNetworkingSpec;\n readonly workloads?: readonly InfraWorkloadSpec[];\n}\n\nexport interface InfraManifest {\n readonly environments: Readonly<\n Record<'local', InfraEnvironmentSpec> &\n Partial<Record<Exclude<AppEnvironmentId, 'local'>, InfraEnvironmentSpec>>\n >;\n readonly apis?: ApiDefinitionList;\n readonly modules: readonly string[];\n readonly modulesConfig?: Readonly<Record<string, unknown>>;\n}\n"]}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { InfraSecretReference } from './infraSecrets';
|
|
1
|
+
import type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';
|
|
2
2
|
export interface InfraWorkloadArtifact {
|
|
3
3
|
readonly kind: 'image';
|
|
4
4
|
/** Prebuilt image, optionally pinned by digest. No registry/build provider requirement. */
|
|
@@ -10,6 +10,10 @@ export type InfraWorkloadValue = {
|
|
|
10
10
|
} | {
|
|
11
11
|
readonly kind: 'secret';
|
|
12
12
|
readonly reference: InfraSecretReference;
|
|
13
|
+
} | {
|
|
14
|
+
readonly kind: 'credential';
|
|
15
|
+
readonly reference: InfraControlPlaneCredentialRef;
|
|
16
|
+
readonly key: string;
|
|
13
17
|
} | {
|
|
14
18
|
readonly kind: 'output';
|
|
15
19
|
readonly resourceId: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"infraWorkload.d.ts","sourceRoot":"","sources":["../../src/types/infraWorkload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"infraWorkload.d.ts","sourceRoot":"","sources":["../../src/types/infraWorkload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;CAAE,GACrE;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC,GAAG,CACA;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CACpE,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,mBAAmB,CAAC;CACpD;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,yBAAyB,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"infraWorkload.js","sourceRoot":"","sources":["../../src/types/infraWorkload.ts"],"names":[],"mappings":"","sourcesContent":["import type { InfraSecretReference } from './infraSecrets';\n\nexport interface InfraWorkloadArtifact {\n readonly kind: 'image';\n /** Prebuilt image, optionally pinned by digest. No registry/build provider requirement. */\n readonly image: string;\n}\n\nexport type InfraWorkloadValue =\n | { readonly kind: 'literal'; readonly value: string }\n | { readonly kind: 'secret'; readonly reference: InfraSecretReference }\n | { readonly kind: 'output'; readonly resourceId: string; readonly output: string };\n\nexport interface InfraWorkloadPort {\n readonly name: string;\n readonly port: number;\n readonly protocol?: 'tcp' | 'udp';\n}\n\nexport type InfraWorkloadHealthSpec = {\n readonly intervalSeconds?: number;\n readonly timeoutSeconds?: number;\n readonly failureThreshold?: number;\n} & (\n | { readonly kind: 'http'; readonly port: number; readonly path: string }\n | { readonly kind: 'tcp'; readonly port: number }\n | { readonly kind: 'command'; readonly command: readonly string[] }\n);\n\nexport interface InfraWorkloadResourceSpec {\n readonly cpuMillis?: number;\n readonly memoryMiB?: number;\n}\n\nexport interface InfraWorkloadVolumeSpec {\n readonly id: string;\n readonly mountPath: string;\n readonly sizeGiB: number;\n /** Persistence survives down and is retained by default on destroy. */\n readonly retention: 'retain' | 'delete-on-destroy';\n}\n\n/** Portable config/policy files; secret values are materialized by the runtime. */\nexport interface InfraWorkloadFileSpec {\n readonly path: string;\n readonly content: InfraWorkloadValue;\n}\n\nexport interface InfraWorkloadSpec {\n readonly id: string;\n readonly artifact: InfraWorkloadArtifact;\n readonly command?: readonly string[];\n readonly args?: readonly string[];\n readonly ports?: readonly InfraWorkloadPort[];\n readonly environment?: Readonly<Record<string, InfraWorkloadValue>>;\n readonly files?: readonly InfraWorkloadFileSpec[];\n readonly health?: InfraWorkloadHealthSpec;\n readonly resources?: InfraWorkloadResourceSpec;\n readonly persistence?: readonly InfraWorkloadVolumeSpec[];\n readonly exposure?: 'internal' | 'public';\n readonly replicas?: number;\n /** IDs in the composed desired-state graph; the orchestrator validates missing/cyclic edges. */\n readonly dependsOn?: readonly string[];\n}\n"]}
|
|
1
|
+
{"version":3,"file":"infraWorkload.js","sourceRoot":"","sources":["../../src/types/infraWorkload.ts"],"names":[],"mappings":"","sourcesContent":["import type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';\n\nexport interface InfraWorkloadArtifact {\n readonly kind: 'image';\n /** Prebuilt image, optionally pinned by digest. No registry/build provider requirement. */\n readonly image: string;\n}\n\nexport type InfraWorkloadValue =\n | { readonly kind: 'literal'; readonly value: string }\n | { readonly kind: 'secret'; readonly reference: InfraSecretReference }\n | {\n readonly kind: 'credential';\n readonly reference: InfraControlPlaneCredentialRef;\n readonly key: string;\n }\n | { readonly kind: 'output'; readonly resourceId: string; readonly output: string };\n\nexport interface InfraWorkloadPort {\n readonly name: string;\n readonly port: number;\n readonly protocol?: 'tcp' | 'udp';\n}\n\nexport type InfraWorkloadHealthSpec = {\n readonly intervalSeconds?: number;\n readonly timeoutSeconds?: number;\n readonly failureThreshold?: number;\n} & (\n | { readonly kind: 'http'; readonly port: number; readonly path: string }\n | { readonly kind: 'tcp'; readonly port: number }\n | { readonly kind: 'command'; readonly command: readonly string[] }\n);\n\nexport interface InfraWorkloadResourceSpec {\n readonly cpuMillis?: number;\n readonly memoryMiB?: number;\n}\n\nexport interface InfraWorkloadVolumeSpec {\n readonly id: string;\n readonly mountPath: string;\n readonly sizeGiB: number;\n /** Persistence survives down and is retained by default on destroy. */\n readonly retention: 'retain' | 'delete-on-destroy';\n}\n\n/** Portable config/policy files; secret values are materialized by the runtime. */\nexport interface InfraWorkloadFileSpec {\n readonly path: string;\n readonly content: InfraWorkloadValue;\n}\n\nexport interface InfraWorkloadSpec {\n readonly id: string;\n readonly artifact: InfraWorkloadArtifact;\n readonly command?: readonly string[];\n readonly args?: readonly string[];\n readonly ports?: readonly InfraWorkloadPort[];\n readonly environment?: Readonly<Record<string, InfraWorkloadValue>>;\n readonly files?: readonly InfraWorkloadFileSpec[];\n readonly health?: InfraWorkloadHealthSpec;\n readonly resources?: InfraWorkloadResourceSpec;\n readonly persistence?: readonly InfraWorkloadVolumeSpec[];\n readonly exposure?: 'internal' | 'public';\n readonly replicas?: number;\n /** IDs in the composed desired-state graph; the orchestrator validates missing/cyclic edges. */\n readonly dependsOn?: readonly string[];\n}\n"]}
|
package/package.json
CHANGED
|
@@ -38,6 +38,14 @@ function isCompute(value: unknown): boolean {
|
|
|
38
38
|
serverType: infraFields.optionalText,
|
|
39
39
|
image: infraFields.optionalText,
|
|
40
40
|
credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),
|
|
41
|
+
ssh: (ssh) =>
|
|
42
|
+
ssh === undefined ||
|
|
43
|
+
isInfraShape(ssh, {
|
|
44
|
+
user: infraFields.optionalText,
|
|
45
|
+
port: infraFields.optionalPositiveInteger,
|
|
46
|
+
credentials: (credentials) =>
|
|
47
|
+
credentials === undefined || isInfraCredentialRef(credentials),
|
|
48
|
+
}),
|
|
41
49
|
} satisfies InfraShape<InfraComputeSelection<'hetzner'>>);
|
|
42
50
|
}
|
|
43
51
|
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { isRecord } from '@ankhorage/utility/object';
|
|
2
|
+
import { isNonEmptyString } from '@ankhorage/utility/string';
|
|
2
3
|
|
|
3
4
|
import type { InfraEnvironmentSpec, InfraObjectStorageSpec } from '../types/infraManifest';
|
|
4
5
|
import type { InfraShape } from '../types/infraValidation';
|
|
@@ -32,6 +33,7 @@ function isEnvironmentShape(value: unknown): value is InfraEnvironmentSpec {
|
|
|
32
33
|
isInfraShape(authz, {
|
|
33
34
|
provider: (provider) => provider === 'cerbos',
|
|
34
35
|
kind: (kind) => kind === 'ABAC' || kind === 'RBAC',
|
|
36
|
+
policies: (policies) => policies === undefined || isPolicyFiles(policies),
|
|
35
37
|
}),
|
|
36
38
|
secretStore: (store) =>
|
|
37
39
|
store === undefined ||
|
|
@@ -45,6 +47,22 @@ function isEnvironmentShape(value: unknown): value is InfraEnvironmentSpec {
|
|
|
45
47
|
} satisfies InfraShape<InfraEnvironmentSpec>);
|
|
46
48
|
}
|
|
47
49
|
|
|
50
|
+
/*** Validate portable, unique Cerbos policy files without host paths or traversal. */
|
|
51
|
+
function isPolicyFiles(value: unknown): boolean {
|
|
52
|
+
return (
|
|
53
|
+
Array.isArray(value) &&
|
|
54
|
+
value.every((policy) =>
|
|
55
|
+
isInfraShape(policy, {
|
|
56
|
+
path: (path) =>
|
|
57
|
+
isNonEmptyString(path) && !path.startsWith('/') && !path.split('/').includes('..'),
|
|
58
|
+
content: isNonEmptyString,
|
|
59
|
+
}),
|
|
60
|
+
) &&
|
|
61
|
+
new Set(value.map((policy) => (isRecord(policy) ? policy.path : undefined))).size ===
|
|
62
|
+
value.length
|
|
63
|
+
);
|
|
64
|
+
}
|
|
65
|
+
|
|
48
66
|
/*** Object storage can vary independently from database/auth; there is no implicit auto provider. */
|
|
49
67
|
function isObjectStorage(value: unknown): boolean {
|
|
50
68
|
if (!isRecord(value)) return false;
|
|
@@ -2,6 +2,7 @@ import { isRecord } from '@ankhorage/utility/object';
|
|
|
2
2
|
import { isNonEmptyString } from '@ankhorage/utility/string';
|
|
3
3
|
|
|
4
4
|
import { APP_ENVIRONMENT_IDS } from '../environments';
|
|
5
|
+
import { isInfraCredentialRef } from './isInfraCredentialRef';
|
|
5
6
|
import { isInfraShape } from './isInfraShape';
|
|
6
7
|
|
|
7
8
|
/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */
|
|
@@ -24,6 +25,12 @@ export function isInfraWorkloadValue(value: unknown): boolean {
|
|
|
24
25
|
kind: (kind) => kind === 'secret',
|
|
25
26
|
reference: isSecretReference,
|
|
26
27
|
});
|
|
28
|
+
case 'credential':
|
|
29
|
+
return isInfraShape(value, {
|
|
30
|
+
kind: (kind) => kind === 'credential',
|
|
31
|
+
reference: isInfraCredentialRef,
|
|
32
|
+
key: isNonEmptyString,
|
|
33
|
+
});
|
|
27
34
|
default:
|
|
28
35
|
return false;
|
|
29
36
|
}
|
package/src/infra-types.test.ts
CHANGED
|
@@ -11,6 +11,7 @@ import type {
|
|
|
11
11
|
InfraManifest,
|
|
12
12
|
InfraObjectStorageSpec,
|
|
13
13
|
InfraOutput,
|
|
14
|
+
InfraRuntimeAdapter,
|
|
14
15
|
InfraRuntimeDesiredState,
|
|
15
16
|
InfraRuntimeProviderId,
|
|
16
17
|
} from './infra';
|
|
@@ -91,3 +92,19 @@ it('requires resolved outputs at the runtime desired-state boundary', () => {
|
|
|
91
92
|
|
|
92
93
|
expect(outputBoundary).toEqual([false, true]);
|
|
93
94
|
});
|
|
95
|
+
|
|
96
|
+
it('requires runtime desired state for every target-dependent lifecycle operation', () => {
|
|
97
|
+
type Adapter = InfraRuntimeAdapter<'docker-compose'>;
|
|
98
|
+
type Desired = InfraRuntimeDesiredState<'docker-compose'>;
|
|
99
|
+
|
|
100
|
+
const lifecycleBoundary: readonly [
|
|
101
|
+
Assignable<Parameters<Adapter['statusAsync']>, [context: unknown, desired: Desired]>,
|
|
102
|
+
Assignable<Parameters<Adapter['suspendAsync']>, [context: unknown, desired: Desired]>,
|
|
103
|
+
Assignable<
|
|
104
|
+
Parameters<Adapter['destroyAsync']>,
|
|
105
|
+
[context: unknown, desired: Desired, request: InfraDestroyRequest]
|
|
106
|
+
>,
|
|
107
|
+
] = [true, true, true];
|
|
108
|
+
|
|
109
|
+
expect(lifecycleBoundary).toEqual([true, true, true]);
|
|
110
|
+
});
|
|
@@ -25,6 +25,11 @@ const workload = {
|
|
|
25
25
|
environment: {
|
|
26
26
|
NODE_ENV: { kind: 'literal', value: 'production' },
|
|
27
27
|
DB_PASSWORD: { kind: 'secret', reference },
|
|
28
|
+
BOOTSTRAP_PASSWORD: {
|
|
29
|
+
kind: 'credential',
|
|
30
|
+
reference: { source: 'control-plane', name: 'SUPABASE_BOOTSTRAP' },
|
|
31
|
+
key: 'POSTGRES_PASSWORD',
|
|
32
|
+
},
|
|
28
33
|
DB_HOST: { kind: 'output', resourceId: 'database', output: 'host' },
|
|
29
34
|
},
|
|
30
35
|
files: [{ path: '/etc/backend/config.json', content: { kind: 'literal', value: '{}' } }],
|
|
@@ -73,6 +78,23 @@ const invalidWorkloads = [
|
|
|
73
78
|
TOKEN: { kind: 'secret', reference: { source: 'control-plane', name: 'HCLOUD_TOKEN' } },
|
|
74
79
|
},
|
|
75
80
|
},
|
|
81
|
+
{
|
|
82
|
+
environment: {
|
|
83
|
+
TOKEN: {
|
|
84
|
+
kind: 'credential',
|
|
85
|
+
reference: { source: 'control-plane', name: 'SUPABASE_BOOTSTRAP' },
|
|
86
|
+
},
|
|
87
|
+
},
|
|
88
|
+
},
|
|
89
|
+
{
|
|
90
|
+
environment: {
|
|
91
|
+
TOKEN: {
|
|
92
|
+
kind: 'credential',
|
|
93
|
+
reference: { source: 'secret-store', name: 'SUPABASE_BOOTSTRAP' },
|
|
94
|
+
key: 'TOKEN',
|
|
95
|
+
},
|
|
96
|
+
},
|
|
97
|
+
},
|
|
76
98
|
];
|
|
77
99
|
|
|
78
100
|
describe('runtime-neutral workload boundary', () => {
|
|
@@ -134,6 +156,34 @@ describe('control-plane credential separation', () => {
|
|
|
134
156
|
);
|
|
135
157
|
}
|
|
136
158
|
});
|
|
159
|
+
|
|
160
|
+
it('keeps Hetzner API and SSH bootstrap credentials separate', () => {
|
|
161
|
+
expect(
|
|
162
|
+
isInfraDeploymentSpec({
|
|
163
|
+
compute: {
|
|
164
|
+
provider: 'hetzner',
|
|
165
|
+
location: 'nbg1',
|
|
166
|
+
credentials: { source: 'control-plane', name: 'HCLOUD' },
|
|
167
|
+
ssh: {
|
|
168
|
+
user: 'root',
|
|
169
|
+
port: 22,
|
|
170
|
+
credentials: { source: 'control-plane', name: 'HETZNER_SSH' },
|
|
171
|
+
},
|
|
172
|
+
},
|
|
173
|
+
runtime: { provider: 'k3s' },
|
|
174
|
+
}),
|
|
175
|
+
).toBe(true);
|
|
176
|
+
expect(
|
|
177
|
+
isInfraDeploymentSpec({
|
|
178
|
+
compute: {
|
|
179
|
+
provider: 'hetzner',
|
|
180
|
+
location: 'nbg1',
|
|
181
|
+
ssh: { credentials: { source: 'secret-store', name: 'HETZNER_SSH' } },
|
|
182
|
+
},
|
|
183
|
+
runtime: { provider: 'k3s' },
|
|
184
|
+
}),
|
|
185
|
+
).toBe(false);
|
|
186
|
+
});
|
|
137
187
|
});
|
|
138
188
|
|
|
139
189
|
describe('application state boundary', () => {
|
package/src/infra.test.ts
CHANGED
|
@@ -170,6 +170,38 @@ describe('sibling service configuration', () => {
|
|
|
170
170
|
});
|
|
171
171
|
});
|
|
172
172
|
|
|
173
|
+
describe('Cerbos policy configuration', () => {
|
|
174
|
+
it('accepts portable policy files', () => {
|
|
175
|
+
expect(
|
|
176
|
+
isInfraEnvironmentSpec({
|
|
177
|
+
...local,
|
|
178
|
+
authz: {
|
|
179
|
+
provider: 'cerbos',
|
|
180
|
+
kind: 'ABAC',
|
|
181
|
+
policies: [{ path: 'app.yaml', content: 'apiVersion: api.cerbos.dev/v1' }],
|
|
182
|
+
},
|
|
183
|
+
}),
|
|
184
|
+
).toBe(true);
|
|
185
|
+
});
|
|
186
|
+
|
|
187
|
+
it.each([
|
|
188
|
+
{ policies: [{ path: '../app.yaml', content: 'x' }] },
|
|
189
|
+
{
|
|
190
|
+
policies: [
|
|
191
|
+
{ path: 'app.yaml', content: 'x' },
|
|
192
|
+
{ path: 'app.yaml', content: 'y' },
|
|
193
|
+
],
|
|
194
|
+
},
|
|
195
|
+
])('rejects unsafe or duplicate policy files: %j', ({ policies }) => {
|
|
196
|
+
expect(
|
|
197
|
+
isInfraEnvironmentSpec({
|
|
198
|
+
...local,
|
|
199
|
+
authz: { provider: 'cerbos', kind: 'ABAC', policies },
|
|
200
|
+
}),
|
|
201
|
+
).toBe(false);
|
|
202
|
+
});
|
|
203
|
+
});
|
|
204
|
+
|
|
173
205
|
describe('authentication configuration', () => {
|
|
174
206
|
it('preserves auth flow, profile and OAuth credential references', () => {
|
|
175
207
|
expect(
|
|
@@ -116,10 +116,17 @@ export interface InfraRuntimeAdapter<P extends InfraRuntimeProviderId = InfraRun
|
|
|
116
116
|
context: InfraExecutionContext,
|
|
117
117
|
desired: InfraRuntimeDesiredState<P>,
|
|
118
118
|
): Promise<InfraResult<InfraReconcileResult>>;
|
|
119
|
-
statusAsync(
|
|
120
|
-
|
|
119
|
+
statusAsync(
|
|
120
|
+
context: InfraExecutionContext,
|
|
121
|
+
desired: InfraRuntimeDesiredState<P>,
|
|
122
|
+
): Promise<InfraResult<readonly InfraResourceStatus[]>>;
|
|
123
|
+
suspendAsync(
|
|
124
|
+
context: InfraExecutionContext,
|
|
125
|
+
desired: InfraRuntimeDesiredState<P>,
|
|
126
|
+
): Promise<InfraResult<InfraReconcileResult>>;
|
|
121
127
|
destroyAsync(
|
|
122
128
|
context: InfraExecutionContext,
|
|
129
|
+
desired: InfraRuntimeDesiredState<P>,
|
|
123
130
|
request: InfraDestroyRequest,
|
|
124
131
|
): Promise<InfraResult<InfraReconcileResult>>;
|
|
125
132
|
generateAsync?(
|
|
@@ -25,6 +25,11 @@ export interface InfraComputeConfigMap {
|
|
|
25
25
|
readonly serverType?: string;
|
|
26
26
|
readonly image?: string;
|
|
27
27
|
readonly credentials?: InfraControlPlaneCredentialRef;
|
|
28
|
+
readonly ssh?: {
|
|
29
|
+
readonly user?: string;
|
|
30
|
+
readonly port?: number;
|
|
31
|
+
readonly credentials?: InfraControlPlaneCredentialRef;
|
|
32
|
+
};
|
|
28
33
|
};
|
|
29
34
|
}
|
|
30
35
|
|
|
@@ -79,7 +84,14 @@ export interface InfraAuthConfigMap {
|
|
|
79
84
|
};
|
|
80
85
|
}
|
|
81
86
|
export interface InfraAuthzConfigMap {
|
|
82
|
-
readonly cerbos: {
|
|
87
|
+
readonly cerbos: {
|
|
88
|
+
readonly kind: 'RBAC' | 'ABAC';
|
|
89
|
+
readonly policies?: readonly InfraAuthzPolicyFile[];
|
|
90
|
+
};
|
|
91
|
+
}
|
|
92
|
+
export interface InfraAuthzPolicyFile {
|
|
93
|
+
readonly path: string;
|
|
94
|
+
readonly content: string;
|
|
83
95
|
}
|
|
84
96
|
export interface InfraSecretStoreConfigMap {
|
|
85
97
|
readonly 'supabase-vault': { readonly schema?: string };
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { InfraSecretReference } from './infraSecrets';
|
|
1
|
+
import type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';
|
|
2
2
|
|
|
3
3
|
export interface InfraWorkloadArtifact {
|
|
4
4
|
readonly kind: 'image';
|
|
@@ -9,6 +9,11 @@ export interface InfraWorkloadArtifact {
|
|
|
9
9
|
export type InfraWorkloadValue =
|
|
10
10
|
| { readonly kind: 'literal'; readonly value: string }
|
|
11
11
|
| { readonly kind: 'secret'; readonly reference: InfraSecretReference }
|
|
12
|
+
| {
|
|
13
|
+
readonly kind: 'credential';
|
|
14
|
+
readonly reference: InfraControlPlaneCredentialRef;
|
|
15
|
+
readonly key: string;
|
|
16
|
+
}
|
|
12
17
|
| { readonly kind: 'output'; readonly resourceId: string; readonly output: string };
|
|
13
18
|
|
|
14
19
|
export interface InfraWorkloadPort {
|