@ankhorage/contracts 17.0.0 → 19.0.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @ankhorage/contracts
 
+## 19.0.0
+
+### Major Changes
+
+- cb4bee3: Require compute adapters to implement `inspectAsync` and return an `InfraComputeSnapshot` without
+  creating, updating, or deleting resources. `ensureAsync` now returns the same canonical snapshot
+  shape.
+
+  This separates read-only target discovery from reconciliation so `infra plan`, `infra generate`,
+  and validation can resolve existing portable targets without invoking a mutating lifecycle method.
+  Compute-adapter consumers must add `inspectAsync(context, selection)` before upgrading.
+
+## 18.0.0
+
+### Major Changes
+
+- 922bb42: Add runtime-neutral workload value templates for values composed from literals, secrets, bootstrap credentials and resource outputs. Add a canonical public HTTP(S) base URL to environment networking so services can configure external URLs before startup without runtime-specific interpolation. Persist portable compute targets and safe outputs in the canonical Infra ledger so later CLI processes can resume runtime lifecycle and render outputs without resolved credential values.
+
 ## 17.0.0
 
 ### Major Changes

package/README.md

@@ -3,7 +3,7 @@
 
 # @ankhorage/contracts
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v16.1.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v18.0.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Serializable app, action, theme, auth, and secret-store contracts for Ankhorage.
 

package/dist/infra/isInfraEnvironmentSpec.js

@@ -33,10 +33,26 @@ function isEnvironmentShape(value) {
                 provider: (provider) => provider === 'supabase-vault',
                 schema: infraFields.optionalText,
             }),
-        networking: (networking) => networking === undefined || isInfraShape(networking, { domain: infraFields.optionalText }),
+        networking: (networking) => networking === undefined ||
+            isInfraShape(networking, {
+                domain: infraFields.optionalText,
+                publicBaseUrl: (publicBaseUrl) => publicBaseUrl === undefined || isPublicHttpOrigin(publicBaseUrl),
+            }),
         workloads: (workloads) => workloads === undefined || isWorkloads(workloads),
     });
 }
+/*** Public workload configuration uses one canonical absolute HTTP(S) origin without path state. */
+function isPublicHttpOrigin(value) {
+    if (!isNonEmptyString(value))
+        return false;
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'http:' || url.protocol === 'https:') && url.origin === value;
+    }
+    catch {
+        return false;
+    }
+}
 /*** Validate portable, unique Cerbos policy files without host paths or traversal. */
 function isPolicyFiles(value) {
     return (Array.isArray(value) &&

package/dist/infra/isInfraEnvironmentSpec.js.map

@@ -1 +1 @@
-{"version":3,"file":"isInfraEnvironmentSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraEnvironmentSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAI7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,2FAA2F;AAC3F,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,UAAU,EAAE,qBAAqB;QACjC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS;YACtB,YAAY,CAAC,QAAQ,EAAE;gBACrB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;gBAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;aACxE,CAAC;QACJ,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC;QAC7E,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC;QAC3D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ;gBAC7C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;gBAClD,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC;aAC1E,CAAC;QACJ,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,gBAAgB;gBACrD,MAAM,EAAE,WAAW,CAAC,YAAY;aACjC,CAAC;QACJ,UAAU,EAAE,CAAC,UAAU,EAAE,EAAE,CACzB,UAAU,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;QAC5F,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC;KACjC,CAAC,CAAC;AAChD,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,YAAY,CAAC,MAAM,EAAE;YACnB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CACb,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpF,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CACH;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/E,KAAK,CAAC,MAAM,CACf,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,CAAC,QAAiB,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAC5D,OAAO,EAAE,WAAW,CAAC,eAAe;KACrC,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,GAAG,MAAM;QACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY;QACnC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC;KACV,CAAC,CAAC;AACxF,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAChC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CACpE,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,sBAAsB,CAAC,KAA2B;IACzD,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,WAAW;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAC1D,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS;QACnC,SAAS;QACT,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;QAChC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport type { InfraEnvironmentSpec, InfraObjectStorageSpec } from '../types/infraManifest';\nimport type { InfraShape } from '../types/infraValidation';\nimport { INFRA_ADAPTER_CATALOG } from './constants';\nimport { infraFields } from './infraFields';\nimport { isInfraAuthSpec } from './isInfraAuthSpec';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraDeploymentSpec } from './isInfraDeploymentSpec';\nimport { isInfraShape } from './isInfraShape';\nimport { isInfraWorkloadSpec } from './isInfraWorkloadSpec';\n\n/*** Validate sibling capabilities and their required relationships within one environment. */\nexport function isInfraEnvironmentSpec(value: unknown): value is InfraEnvironmentSpec {\n  return isEnvironmentShape(value) && hasServiceDependencies(value);\n}\n\n/*** Check all environment field shapes before inspecting canonical dependency metadata. */\nfunction isEnvironmentShape(value: unknown): value is InfraEnvironmentSpec {\n  return isInfraShape(value, {\n    deployment: isInfraDeploymentSpec,\n    database: (database) =>\n      database === undefined ||\n      isInfraShape(database, {\n        provider: (provider) => provider === 'supabase',\n        tier: (tier) => tier === undefined || tier === 'dev' || tier === 'prod',\n      }),\n    objectStorage: (storage) => storage === undefined || isObjectStorage(storage),\n    auth: (auth) => auth === undefined || isInfraAuthSpec(auth),\n    authz: (authz) =>\n      authz === undefined ||\n      isInfraShape(authz, {\n        provider: (provider) => provider === 'cerbos',\n        kind: (kind) => kind === 'ABAC' || kind === 'RBAC',\n        policies: (policies) => policies === undefined || isPolicyFiles(policies),\n      }),\n    secretStore: (store) =>\n      store === undefined ||\n      isInfraShape(store, {\n        provider: (provider) => provider === 'supabase-vault',\n        schema: infraFields.optionalText,\n      }),\n    networking: (networking) =>\n      networking === undefined || isInfraShape(networking, { domain: infraFields.optionalText }),\n    workloads: (workloads) => workloads === undefined || isWorkloads(workloads),\n  } satisfies InfraShape<InfraEnvironmentSpec>);\n}\n\n/*** Validate portable, unique Cerbos policy files without host paths or traversal. */\nfunction isPolicyFiles(value: unknown): boolean {\n  return (\n    Array.isArray(value) &&\n    value.every((policy) =>\n      isInfraShape(policy, {\n        path: (path) =>\n          isNonEmptyString(path) && !path.startsWith('/') && !path.split('/').includes('..'),\n        content: isNonEmptyString,\n      }),\n    ) &&\n    new Set(value.map((policy) => (isRecord(policy) ? policy.path : undefined))).size ===\n      value.length\n  );\n}\n\n/*** Object storage can vary independently from database/auth; there is no implicit auto provider. */\nfunction isObjectStorage(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  const common = {\n    provider: (provider: unknown) => provider === value.provider,\n    buckets: infraFields.optionalStrings,\n  };\n  if (value.provider === 'supabase') return isInfraShape(value, common);\n  return isInfraShape(value, {\n    ...common,\n    provider: (provider) => provider === 'r2',\n    accountId: infraFields.optionalText,\n    credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),\n  } satisfies InfraShape<Extract<InfraObjectStorageSpec, { readonly provider: 'r2' }>>);\n}\n\n/*** Duplicate desired workload identities cannot be reconciled safely. */\nfunction isWorkloads(value: unknown): boolean {\n  return (\n    Array.isArray(value) &&\n    value.every(isInfraWorkloadSpec) &&\n    new Set(value.map((workload) => workload.id)).size === value.length\n  );\n}\n\n/*** Check catalog dependencies against selected sibling capabilities and runtime capabilities. */\nfunction hasServiceDependencies(value: InfraEnvironmentSpec): boolean {\n  const selections = [\n    value.database,\n    value.auth,\n    value.authz,\n    value.objectStorage,\n    value.secretStore,\n  ];\n  const runtime = Object.values(INFRA_ADAPTER_CATALOG).find(\n    (entry) => entry.id === value.deployment.runtime.provider,\n  );\n  const capabilities = new Set<string>([\n    'compute',\n    ...(runtime?.capabilities ?? []),\n    ...Object.entries(value)\n      .filter(([, selection]) => selection !== undefined)\n      .map(([capability]) => capability),\n  ]);\n  return Object.values(INFRA_ADAPTER_CATALOG)\n    .filter((entry) => selections.some((selection) => selection?.provider === entry.id))\n    .every((entry) => entry.dependencies.every((dependency) => capabilities.has(dependency)));\n}\n"]}
+{"version":3,"file":"isInfraEnvironmentSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraEnvironmentSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAI7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,2FAA2F;AAC3F,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,UAAU,EAAE,qBAAqB;QACjC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS;YACtB,YAAY,CAAC,QAAQ,EAAE;gBACrB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;gBAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;aACxE,CAAC;QACJ,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC;QAC7E,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC;QAC3D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ;gBAC7C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;gBAClD,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC;aAC1E,CAAC;QACJ,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,gBAAgB;gBACrD,MAAM,EAAE,WAAW,CAAC,YAAY;aACjC,CAAC;QACJ,UAAU,EAAE,CAAC,UAAU,EAAE,EAAE,CACzB,UAAU,KAAK,SAAS;YACxB,YAAY,CAAC,UAAU,EAAE;gBACvB,MAAM,EAAE,WAAW,CAAC,YAAY;gBAChC,aAAa,EAAE,CAAC,aAAa,EAAE,EAAE,CAC/B,aAAa,KAAK,SAAS,IAAI,kBAAkB,CAAC,aAAa,CAAC;aACnE,CAAC;QACJ,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC;KACjC,CAAC,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,YAAY,CAAC,MAAM,EAAE;YACnB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CACb,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpF,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CACH;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/E,KAAK,CAAC,MAAM,CACf,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,CAAC,QAAiB,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAC5D,OAAO,EAAE,WAAW,CAAC,eAAe;KACrC,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,GAAG,MAAM;QACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY;QACnC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC;KACV,CAAC,CAAC;AACxF,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAChC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CACpE,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,sBAAsB,CAAC,KAA2B;IACzD,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,WAAW;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAC1D,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS;QACnC,SAAS;QACT,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;QAChC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport type { InfraEnvironmentSpec, InfraObjectStorageSpec } from '../types/infraManifest';\nimport type { InfraShape } from '../types/infraValidation';\nimport { INFRA_ADAPTER_CATALOG } from './constants';\nimport { infraFields } from './infraFields';\nimport { isInfraAuthSpec } from './isInfraAuthSpec';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraDeploymentSpec } from './isInfraDeploymentSpec';\nimport { isInfraShape } from './isInfraShape';\nimport { isInfraWorkloadSpec } from './isInfraWorkloadSpec';\n\n/*** Validate sibling capabilities and their required relationships within one environment. */\nexport function isInfraEnvironmentSpec(value: unknown): value is InfraEnvironmentSpec {\n  return isEnvironmentShape(value) && hasServiceDependencies(value);\n}\n\n/*** Check all environment field shapes before inspecting canonical dependency metadata. */\nfunction isEnvironmentShape(value: unknown): value is InfraEnvironmentSpec {\n  return isInfraShape(value, {\n    deployment: isInfraDeploymentSpec,\n    database: (database) =>\n      database === undefined ||\n      isInfraShape(database, {\n        provider: (provider) => provider === 'supabase',\n        tier: (tier) => tier === undefined || tier === 'dev' || tier === 'prod',\n      }),\n    objectStorage: (storage) => storage === undefined || isObjectStorage(storage),\n    auth: (auth) => auth === undefined || isInfraAuthSpec(auth),\n    authz: (authz) =>\n      authz === undefined ||\n      isInfraShape(authz, {\n        provider: (provider) => provider === 'cerbos',\n        kind: (kind) => kind === 'ABAC' || kind === 'RBAC',\n        policies: (policies) => policies === undefined || isPolicyFiles(policies),\n      }),\n    secretStore: (store) =>\n      store === undefined ||\n      isInfraShape(store, {\n        provider: (provider) => provider === 'supabase-vault',\n        schema: infraFields.optionalText,\n      }),\n    networking: (networking) =>\n      networking === undefined ||\n      isInfraShape(networking, {\n        domain: infraFields.optionalText,\n        publicBaseUrl: (publicBaseUrl) =>\n          publicBaseUrl === undefined || isPublicHttpOrigin(publicBaseUrl),\n      }),\n    workloads: (workloads) => workloads === undefined || isWorkloads(workloads),\n  } satisfies InfraShape<InfraEnvironmentSpec>);\n}\n\n/*** Public workload configuration uses one canonical absolute HTTP(S) origin without path state. */\nfunction isPublicHttpOrigin(value: unknown): boolean {\n  if (!isNonEmptyString(value)) return false;\n  try {\n    const url = new URL(value);\n    return (url.protocol === 'http:' || url.protocol === 'https:') && url.origin === value;\n  } catch {\n    return false;\n  }\n}\n\n/*** Validate portable, unique Cerbos policy files without host paths or traversal. */\nfunction isPolicyFiles(value: unknown): boolean {\n  return (\n    Array.isArray(value) &&\n    value.every((policy) =>\n      isInfraShape(policy, {\n        path: (path) =>\n          isNonEmptyString(path) && !path.startsWith('/') && !path.split('/').includes('..'),\n        content: isNonEmptyString,\n      }),\n    ) &&\n    new Set(value.map((policy) => (isRecord(policy) ? policy.path : undefined))).size ===\n      value.length\n  );\n}\n\n/*** Object storage can vary independently from database/auth; there is no implicit auto provider. */\nfunction isObjectStorage(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  const common = {\n    provider: (provider: unknown) => provider === value.provider,\n    buckets: infraFields.optionalStrings,\n  };\n  if (value.provider === 'supabase') return isInfraShape(value, common);\n  return isInfraShape(value, {\n    ...common,\n    provider: (provider) => provider === 'r2',\n    accountId: infraFields.optionalText,\n    credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),\n  } satisfies InfraShape<Extract<InfraObjectStorageSpec, { readonly provider: 'r2' }>>);\n}\n\n/*** Duplicate desired workload identities cannot be reconciled safely. */\nfunction isWorkloads(value: unknown): boolean {\n  return (\n    Array.isArray(value) &&\n    value.every(isInfraWorkloadSpec) &&\n    new Set(value.map((workload) => workload.id)).size === value.length\n  );\n}\n\n/*** Check catalog dependencies against selected sibling capabilities and runtime capabilities. */\nfunction hasServiceDependencies(value: InfraEnvironmentSpec): boolean {\n  const selections = [\n    value.database,\n    value.auth,\n    value.authz,\n    value.objectStorage,\n    value.secretStore,\n  ];\n  const runtime = Object.values(INFRA_ADAPTER_CATALOG).find(\n    (entry) => entry.id === value.deployment.runtime.provider,\n  );\n  const capabilities = new Set<string>([\n    'compute',\n    ...(runtime?.capabilities ?? []),\n    ...Object.entries(value)\n      .filter(([, selection]) => selection !== undefined)\n      .map(([capability]) => capability),\n  ]);\n  return Object.values(INFRA_ADAPTER_CATALOG)\n    .filter((entry) => selections.some((selection) => selection?.provider === entry.id))\n    .every((entry) => entry.dependencies.every((dependency) => capabilities.has(dependency)));\n}\n"]}

package/dist/infra/isInfraWorkloadValue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isInfraWorkloadValue.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAOA,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA4B5D"}
+{"version":3,"file":"isInfraWorkloadValue.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAQA,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW5D"}

package/dist/infra/isInfraWorkloadValue.js

@@ -5,6 +5,16 @@ import { isInfraCredentialRef } from './isInfraCredentialRef';
 import { isInfraShape } from './isInfraShape';
 /*** Workload values explicitly distinguish public literals, output dependencies and secret references. */
 export function isInfraWorkloadValue(value) {
+    return (isInfraWorkloadScalarValue(value) ||
+        isInfraShape(value, {
+            kind: (kind) => kind === 'template',
+            segments: (segments) => Array.isArray(segments) &&
+                segments.length > 0 &&
+                segments.every(isInfraWorkloadScalarValue),
+        }));
+}
+/*** Validate one non-composite workload value segment. */
+function isInfraWorkloadScalarValue(value) {
     if (!isRecord(value))
         return false;
     switch (value.kind) {

package/dist/infra/isInfraWorkloadValue.js.map

@@ -1 +1 @@
-{"version":3,"file":"isInfraWorkloadValue.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS;gBAClC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;aAC5C,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;QACL,KAAK,YAAY;YACf,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,YAAY;gBACrC,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,gBAAgB;aACtB,CAAC,CAAC;QACL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,cAAc;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC;QAClF,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;KACtB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { APP_ENVIRONMENT_IDS } from '../environments';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */\nexport function isInfraWorkloadValue(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  switch (value.kind) {\n    case 'literal':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'literal',\n        value: (field) => typeof field === 'string',\n      });\n    case 'output':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'output',\n        resourceId: isNonEmptyString,\n        output: isNonEmptyString,\n      });\n    case 'secret':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'secret',\n        reference: isSecretReference,\n      });\n    case 'credential':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'credential',\n        reference: isInfraCredentialRef,\n        key: isNonEmptyString,\n      });\n    default:\n      return false;\n  }\n}\n\n/*** Managed secret references contain identity only, never privileged payloads. */\nfunction isSecretReference(value: unknown): boolean {\n  return isInfraShape(value, {\n    source: (source) => source === 'secret-store',\n    projectId: isNonEmptyString,\n    environment: (environment) => APP_ENVIRONMENT_IDS.some((id) => id === environment),\n    ref: isNonEmptyString,\n    key: isNonEmptyString,\n  });\n}\n"]}
+{"version":3,"file":"isInfraWorkloadValue.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,CACL,0BAA0B,CAAC,KAAK,CAAC;QACjC,YAAY,CAAC,KAAK,EAAE;YAClB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU;YACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvB,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACnB,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC;SAC7C,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,SAAS,0BAA0B,CAAC,KAAc;IAChD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS;gBAClC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;aAC5C,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;QACL,KAAK,YAAY;YACf,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,YAAY;gBACrC,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,gBAAgB;aACtB,CAAC,CAAC;QACL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,cAAc;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC;QAClF,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;KACtB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { APP_ENVIRONMENT_IDS } from '../environments';\nimport type { InfraWorkloadScalarValue } from '../types/infraWorkload';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */\nexport function isInfraWorkloadValue(value: unknown): boolean {\n  return (\n    isInfraWorkloadScalarValue(value) ||\n    isInfraShape(value, {\n      kind: (kind) => kind === 'template',\n      segments: (segments) =>\n        Array.isArray(segments) &&\n        segments.length > 0 &&\n        segments.every(isInfraWorkloadScalarValue),\n    })\n  );\n}\n\n/*** Validate one non-composite workload value segment. */\nfunction isInfraWorkloadScalarValue(value: unknown): value is InfraWorkloadScalarValue {\n  if (!isRecord(value)) return false;\n  switch (value.kind) {\n    case 'literal':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'literal',\n        value: (field) => typeof field === 'string',\n      });\n    case 'output':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'output',\n        resourceId: isNonEmptyString,\n        output: isNonEmptyString,\n      });\n    case 'secret':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'secret',\n        reference: isSecretReference,\n      });\n    case 'credential':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'credential',\n        reference: isInfraCredentialRef,\n        key: isNonEmptyString,\n      });\n    default:\n      return false;\n  }\n}\n\n/*** Managed secret references contain identity only, never privileged payloads. */\nfunction isSecretReference(value: unknown): boolean {\n  return isInfraShape(value, {\n    source: (source) => source === 'secret-store',\n    projectId: isNonEmptyString,\n    environment: (environment) => APP_ENVIRONMENT_IDS.some((id) => id === environment),\n    ref: isNonEmptyString,\n    key: isNonEmptyString,\n  });\n}\n"]}

package/dist/infra.d.ts

@@ -12,5 +12,6 @@ export type * from './types/infraAdapters';
 export type * from './types/infraLifecycle';
 export type * from './types/infraManifest';
 export type * from './types/infraSecrets';
+export type * from './types/infraTargets';
 export type * from './types/infraWorkload';
 //# sourceMappingURL=infra.d.ts.map

package/dist/infra.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra.d.ts","sourceRoot":"","sources":["../src/infra.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,wBAAwB,CAAC;AAC5C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,uBAAuB,CAAC"}
+{"version":3,"file":"infra.d.ts","sourceRoot":"","sources":["../src/infra.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,wBAAwB,CAAC;AAC5C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,uBAAuB,CAAC"}

package/dist/infra.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra.js","sourceRoot":"","sources":["../src/infra.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC","sourcesContent":["/** Canonical standalone infrastructure contracts, catalog and side-effect-free validation. */\nexport { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from './infra/constants';\nexport { isInfraAdapterDescriptor } from './infra/isInfraAdapterDescriptor';\nexport { isInfraAuthSpec } from './infra/isInfraAuthSpec';\nexport { isInfraDeploymentSpec } from './infra/isInfraDeploymentSpec';\nexport { isInfraEnvironmentSpec } from './infra/isInfraEnvironmentSpec';\nexport { isInfraManifest } from './infra/isInfraManifest';\nexport { isInfraWorkloadSpec } from './infra/isInfraWorkloadSpec';\nexport { parseInfraManifest } from './infra/parseInfraManifest';\nexport { validateInfraAdapterSelection } from './infra/validateInfraAdapterSelection';\nexport type * from './types/infraAdapters';\nexport type * from './types/infraLifecycle';\nexport type * from './types/infraManifest';\nexport type * from './types/infraSecrets';\nexport type * from './types/infraWorkload';\n"]}
+{"version":3,"file":"infra.js","sourceRoot":"","sources":["../src/infra.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC","sourcesContent":["/** Canonical standalone infrastructure contracts, catalog and side-effect-free validation. */\nexport { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from './infra/constants';\nexport { isInfraAdapterDescriptor } from './infra/isInfraAdapterDescriptor';\nexport { isInfraAuthSpec } from './infra/isInfraAuthSpec';\nexport { isInfraDeploymentSpec } from './infra/isInfraDeploymentSpec';\nexport { isInfraEnvironmentSpec } from './infra/isInfraEnvironmentSpec';\nexport { isInfraManifest } from './infra/isInfraManifest';\nexport { isInfraWorkloadSpec } from './infra/isInfraWorkloadSpec';\nexport { parseInfraManifest } from './infra/parseInfraManifest';\nexport { validateInfraAdapterSelection } from './infra/validateInfraAdapterSelection';\nexport type * from './types/infraAdapters';\nexport type * from './types/infraLifecycle';\nexport type * from './types/infraManifest';\nexport type * from './types/infraSecrets';\nexport type * from './types/infraTargets';\nexport type * from './types/infraWorkload';\n"]}

package/dist/types/infraAdapters.d.ts

@@ -3,6 +3,7 @@ import type { INFRA_ADAPTER_CATALOG } from '../infra/constants';
 import type { InfraDestroyRequest, InfraGeneratedArtifact, InfraLedger, InfraOutput, InfraOwnedResource, InfraPlanAction, InfraResourceStatus, InfraResult } from './infraLifecycle';
 import type { InfraAdapterId, InfraComputeProviderId, InfraComputeSelection, InfraEnvironmentSpec, InfraRuntimeProviderId, InfraRuntimeSelection } from './infraManifest';
 import type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';
+import type { InfraComputeTarget } from './infraTargets';
 import type { InfraWorkloadSpec } from './infraWorkload';
 /** Package exports must match this exact catalog entry; optional operations are advertised explicitly. */
 export type InfraAdapterDescriptor<P extends InfraAdapterId = InfraAdapterId> = {
@@ -10,21 +11,6 @@ export type InfraAdapterDescriptor<P extends InfraAdapterId = InfraAdapterId> =
         readonly operations?: readonly ('suspend' | 'resume' | 'generate' | 'diagnostics')[];
     };
 }[P];
-export type InfraComputeTarget = {
-    readonly id: string;
-    readonly os: 'linux' | 'darwin' | 'windows';
-    readonly architecture: 'amd64' | 'arm64';
-} & ({
-    readonly kind: 'local-host';
-} | {
-    readonly kind: 'ssh-host';
-    readonly host: string;
-    readonly port: number;
-    readonly user: string;
-    readonly credential: InfraControlPlaneCredentialRef;
-    /** Expected host key supplied by the compute owner; runtimes must verify host authenticity. */
-    readonly hostKeyFingerprint: string;
-});
 /** Trusted execution-only ports. Implementations must not serialize resolved credential values. */
 export interface InfraExecutionContext {
     readonly projectId: string;
@@ -43,14 +29,18 @@ export interface InfraReconcileResult {
     readonly resources: readonly InfraOwnedResource[];
     readonly outputs: readonly InfraOutput[];
 }
+/** Current portable compute state resolved without creating, updating or deleting resources. */
+export interface InfraComputeSnapshot extends InfraReconcileResult {
+    readonly targets: readonly InfraComputeTarget[];
+}
 export interface InfraComputeAdapter<P extends InfraComputeProviderId = InfraComputeProviderId> {
     readonly descriptor: InfraAdapterDescriptor<P>;
     /** Read-only prerequisites, config and control-plane credential validation. */
     validateAsync(context: InfraExecutionContext, selection: InfraComputeSelection<P>): Promise<InfraResult<null>>;
+    /** Read-only discovery for planning and stateless runtime projection. Missing compute is empty. */
+    inspectAsync(context: InfraExecutionContext, selection: InfraComputeSelection<P>): Promise<InfraResult<InfraComputeSnapshot>>;
     planAsync(context: InfraExecutionContext, selection: InfraComputeSelection<P>): Promise<InfraResult<readonly InfraPlanAction[]>>;
-    ensureAsync(context: InfraExecutionContext, selection: InfraComputeSelection<P>): Promise<InfraResult<InfraReconcileResult & {
-        readonly targets: readonly InfraComputeTarget[];
-    }>>;
+    ensureAsync(context: InfraExecutionContext, selection: InfraComputeSelection<P>): Promise<InfraResult<InfraComputeSnapshot>>;
     statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;
     destroyAsync(context: InfraExecutionContext, request: InfraDestroyRequest): Promise<InfraResult<InfraReconcileResult>>;
 }

package/dist/types/infraAdapters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infraAdapters.d.ts","sourceRoot":"","sources":["../../src/types/infraAdapters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,0GAA0G;AAC1G,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,IAAI;KAC7E,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG;QAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAC,EAAE,CAAC;KACtF;CACF,CAAC,CAAC,CAAC,CAAC;AAEL,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC;CAC1C,GAAG,CACA;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,8BAA8B,CAAC;IACpD,+FAA+F;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,CACJ,CAAC;AAEF,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE;QACpB,YAAY,CACV,SAAS,EAAE,8BAA8B,GACxC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;KAC7E,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAC5F,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,aAAa,CACX,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,SAAS,CACP,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IACpD,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CACR,WAAW,CAAC,oBAAoB,GAAG;QAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAA;KAAE,CAAC,CACxF,CAAC;IACF,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAClG,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,wBAAwB,CACvC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAEzD,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,WAAW,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAC5F,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/C,iFAAiF;IACjF,aAAa,CACX,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,SAAS,CACP,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IACpD,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACxD,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,EACpC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,aAAa,CAAC,CACZ,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAAC,CAAC;CAC5D;AAED,iGAAiG;AACjG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,UAAU,GAAG,QAAQ,GAAG,IAAI,GAAG,gBAAgB,CAAC,CAAC;IAC7F,iFAAiF;IACjF,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,SAAS,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IAC5F,qBAAqB,CACnB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,WAAW,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACtD,cAAc,CACZ,OAAO,EAAE,qBAAqB,EAC9B,cAAc,EAAE,SAAS,WAAW,EAAE,GACrC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAClG,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,YAAY,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;CAC3F"}
+{"version":3,"file":"infraAdapters.d.ts","sourceRoot":"","sources":["../../src/types/infraAdapters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,0GAA0G;AAC1G,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,IAAI;KAC7E,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG;QAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAC,EAAE,CAAC;KACtF;CACF,CAAC,CAAC,CAAC,CAAC;AAEL,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE;QACpB,YAAY,CACV,SAAS,EAAE,8BAA8B,GACxC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;KAC7E,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAC5F,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,aAAa,CACX,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,mGAAmG;IACnG,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,SAAS,CACP,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IACpD,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAClG,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,wBAAwB,CACvC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAEzD,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,WAAW,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAC5F,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/C,iFAAiF;IACjF,aAAa,CACX,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,SAAS,CACP,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IACpD,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACxD,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,EACpC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,aAAa,CAAC,CACZ,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAAC,CAAC;CAC5D;AAED,iGAAiG;AACjG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,UAAU,GAAG,QAAQ,GAAG,IAAI,GAAG,gBAAgB,CAAC,CAAC;IAC7F,iFAAiF;IACjF,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,SAAS,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;IAC5F,qBAAqB,CACnB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,WAAW,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACtD,cAAc,CACZ,OAAO,EAAE,qBAAqB,EAC9B,cAAc,EAAE,SAAS,WAAW,EAAE,GACrC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAClG,YAAY,CACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,YAAY,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC;CAC3F"}

package/dist/types/infraAdapters.js.map

@@ -1 +1 @@
-{"version":3,"file":"infraAdapters.js","sourceRoot":"","sources":["../../src/types/infraAdapters.ts"],"names":[],"mappings":"","sourcesContent":["import type { AppEnvironmentId } from '../environments';\nimport type { INFRA_ADAPTER_CATALOG } from '../infra/constants';\nimport type {\n  InfraDestroyRequest,\n  InfraGeneratedArtifact,\n  InfraLedger,\n  InfraOutput,\n  InfraOwnedResource,\n  InfraPlanAction,\n  InfraResourceStatus,\n  InfraResult,\n} from './infraLifecycle';\nimport type {\n  InfraAdapterId,\n  InfraComputeProviderId,\n  InfraComputeSelection,\n  InfraEnvironmentSpec,\n  InfraRuntimeProviderId,\n  InfraRuntimeSelection,\n} from './infraManifest';\nimport type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';\nimport type { InfraWorkloadSpec } from './infraWorkload';\n\n/** Package exports must match this exact catalog entry; optional operations are advertised explicitly. */\nexport type InfraAdapterDescriptor<P extends InfraAdapterId = InfraAdapterId> = {\n  [K in P]: (typeof INFRA_ADAPTER_CATALOG)[K] & {\n    readonly operations?: readonly ('suspend' | 'resume' | 'generate' | 'diagnostics')[];\n  };\n}[P];\n\nexport type InfraComputeTarget = {\n  readonly id: string;\n  readonly os: 'linux' | 'darwin' | 'windows';\n  readonly architecture: 'amd64' | 'arm64';\n} & (\n  | { readonly kind: 'local-host' }\n  | {\n      readonly kind: 'ssh-host';\n      readonly host: string;\n      readonly port: number;\n      readonly user: string;\n      readonly credential: InfraControlPlaneCredentialRef;\n      /** Expected host key supplied by the compute owner; runtimes must verify host authenticity. */\n      readonly hostKeyFingerprint: string;\n    }\n);\n\n/** Trusted execution-only ports. Implementations must not serialize resolved credential values. */\nexport interface InfraExecutionContext {\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  readonly desired: InfraEnvironmentSpec;\n  readonly previous?: InfraLedger;\n  readonly signal?: AbortSignal;\n  readonly credentials: {\n    resolveAsync(\n      reference: InfraControlPlaneCredentialRef,\n    ): Promise<InfraResult<Readonly<Record<string, string>>>>;\n  };\n  readonly secrets: {\n    resolveAsync(reference: InfraSecretReference): Promise<InfraResult<string>>;\n  };\n}\n\nexport interface InfraReconcileResult {\n  readonly resources: readonly InfraOwnedResource[];\n  readonly outputs: readonly InfraOutput[];\n}\n\nexport interface InfraComputeAdapter<P extends InfraComputeProviderId = InfraComputeProviderId> {\n  readonly descriptor: InfraAdapterDescriptor<P>;\n  /** Read-only prerequisites, config and control-plane credential validation. */\n  validateAsync(\n    context: InfraExecutionContext,\n    selection: InfraComputeSelection<P>,\n  ): Promise<InfraResult<null>>;\n  planAsync(\n    context: InfraExecutionContext,\n    selection: InfraComputeSelection<P>,\n  ): Promise<InfraResult<readonly InfraPlanAction[]>>;\n  ensureAsync(\n    context: InfraExecutionContext,\n    selection: InfraComputeSelection<P>,\n  ): Promise<\n    InfraResult<InfraReconcileResult & { readonly targets: readonly InfraComputeTarget[] }>\n  >;\n  statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n  destroyAsync(\n    context: InfraExecutionContext,\n    request: InfraDestroyRequest,\n  ): Promise<InfraResult<InfraReconcileResult>>;\n}\n\nexport interface InfraRuntimeDesiredState<\n  P extends InfraRuntimeProviderId = InfraRuntimeProviderId,\n> {\n  readonly selection: InfraRuntimeSelection<P>;\n  readonly targets: readonly InfraComputeTarget[];\n  readonly workloads: readonly InfraWorkloadSpec[];\n  /** Previously resolved outputs available to portable workload value references. */\n  readonly availableOutputs: readonly InfraOutput[];\n}\n\nexport interface InfraRuntimeAdapter<P extends InfraRuntimeProviderId = InfraRuntimeProviderId> {\n  readonly descriptor: InfraAdapterDescriptor<P>;\n  /** Read-only prerequisites and desired-state validation; no cluster creation. */\n  validateAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<null>>;\n  planAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<readonly InfraPlanAction[]>>;\n  ensureAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<InfraReconcileResult>>;\n  statusAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n  suspendAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<InfraReconcileResult>>;\n  destroyAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n    request: InfraDestroyRequest,\n  ): Promise<InfraResult<InfraReconcileResult>>;\n  generateAsync?(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<readonly InfraGeneratedArtifact[]>>;\n}\n\n/** A service can own several capabilities but contributes one deduplicated platform instance. */\nexport interface InfraServiceAdapter {\n  readonly descriptor: InfraAdapterDescriptor<'supabase' | 'cerbos' | 'r2' | 'supabase-vault'>;\n  /** Read-only service config, bootstrap credentials and dependency validation. */\n  validateAsync(context: InfraExecutionContext): Promise<InfraResult<null>>;\n  planAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraPlanAction[]>>;\n  desiredWorkloadsAsync(\n    context: InfraExecutionContext,\n  ): Promise<InfraResult<readonly InfraWorkloadSpec[]>>;\n  reconcileAsync(\n    context: InfraExecutionContext,\n    runtimeOutputs: readonly InfraOutput[],\n  ): Promise<InfraResult<InfraReconcileResult>>;\n  statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n  destroyAsync(\n    context: InfraExecutionContext,\n    request: InfraDestroyRequest,\n  ): Promise<InfraResult<InfraReconcileResult>>;\n  suspendAsync?(context: InfraExecutionContext): Promise<InfraResult<InfraReconcileResult>>;\n}\n"]}
+{"version":3,"file":"infraAdapters.js","sourceRoot":"","sources":["../../src/types/infraAdapters.ts"],"names":[],"mappings":"","sourcesContent":["import type { AppEnvironmentId } from '../environments';\nimport type { INFRA_ADAPTER_CATALOG } from '../infra/constants';\nimport type {\n  InfraDestroyRequest,\n  InfraGeneratedArtifact,\n  InfraLedger,\n  InfraOutput,\n  InfraOwnedResource,\n  InfraPlanAction,\n  InfraResourceStatus,\n  InfraResult,\n} from './infraLifecycle';\nimport type {\n  InfraAdapterId,\n  InfraComputeProviderId,\n  InfraComputeSelection,\n  InfraEnvironmentSpec,\n  InfraRuntimeProviderId,\n  InfraRuntimeSelection,\n} from './infraManifest';\nimport type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';\nimport type { InfraComputeTarget } from './infraTargets';\nimport type { InfraWorkloadSpec } from './infraWorkload';\n\n/** Package exports must match this exact catalog entry; optional operations are advertised explicitly. */\nexport type InfraAdapterDescriptor<P extends InfraAdapterId = InfraAdapterId> = {\n  [K in P]: (typeof INFRA_ADAPTER_CATALOG)[K] & {\n    readonly operations?: readonly ('suspend' | 'resume' | 'generate' | 'diagnostics')[];\n  };\n}[P];\n\n/** Trusted execution-only ports. Implementations must not serialize resolved credential values. */\nexport interface InfraExecutionContext {\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  readonly desired: InfraEnvironmentSpec;\n  readonly previous?: InfraLedger;\n  readonly signal?: AbortSignal;\n  readonly credentials: {\n    resolveAsync(\n      reference: InfraControlPlaneCredentialRef,\n    ): Promise<InfraResult<Readonly<Record<string, string>>>>;\n  };\n  readonly secrets: {\n    resolveAsync(reference: InfraSecretReference): Promise<InfraResult<string>>;\n  };\n}\n\nexport interface InfraReconcileResult {\n  readonly resources: readonly InfraOwnedResource[];\n  readonly outputs: readonly InfraOutput[];\n}\n\n/** Current portable compute state resolved without creating, updating or deleting resources. */\nexport interface InfraComputeSnapshot extends InfraReconcileResult {\n  readonly targets: readonly InfraComputeTarget[];\n}\n\nexport interface InfraComputeAdapter<P extends InfraComputeProviderId = InfraComputeProviderId> {\n  readonly descriptor: InfraAdapterDescriptor<P>;\n  /** Read-only prerequisites, config and control-plane credential validation. */\n  validateAsync(\n    context: InfraExecutionContext,\n    selection: InfraComputeSelection<P>,\n  ): Promise<InfraResult<null>>;\n  /** Read-only discovery for planning and stateless runtime projection. Missing compute is empty. */\n  inspectAsync(\n    context: InfraExecutionContext,\n    selection: InfraComputeSelection<P>,\n  ): Promise<InfraResult<InfraComputeSnapshot>>;\n  planAsync(\n    context: InfraExecutionContext,\n    selection: InfraComputeSelection<P>,\n  ): Promise<InfraResult<readonly InfraPlanAction[]>>;\n  ensureAsync(\n    context: InfraExecutionContext,\n    selection: InfraComputeSelection<P>,\n  ): Promise<InfraResult<InfraComputeSnapshot>>;\n  statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n  destroyAsync(\n    context: InfraExecutionContext,\n    request: InfraDestroyRequest,\n  ): Promise<InfraResult<InfraReconcileResult>>;\n}\n\nexport interface InfraRuntimeDesiredState<\n  P extends InfraRuntimeProviderId = InfraRuntimeProviderId,\n> {\n  readonly selection: InfraRuntimeSelection<P>;\n  readonly targets: readonly InfraComputeTarget[];\n  readonly workloads: readonly InfraWorkloadSpec[];\n  /** Previously resolved outputs available to portable workload value references. */\n  readonly availableOutputs: readonly InfraOutput[];\n}\n\nexport interface InfraRuntimeAdapter<P extends InfraRuntimeProviderId = InfraRuntimeProviderId> {\n  readonly descriptor: InfraAdapterDescriptor<P>;\n  /** Read-only prerequisites and desired-state validation; no cluster creation. */\n  validateAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<null>>;\n  planAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<readonly InfraPlanAction[]>>;\n  ensureAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<InfraReconcileResult>>;\n  statusAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n  suspendAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<InfraReconcileResult>>;\n  destroyAsync(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n    request: InfraDestroyRequest,\n  ): Promise<InfraResult<InfraReconcileResult>>;\n  generateAsync?(\n    context: InfraExecutionContext,\n    desired: InfraRuntimeDesiredState<P>,\n  ): Promise<InfraResult<readonly InfraGeneratedArtifact[]>>;\n}\n\n/** A service can own several capabilities but contributes one deduplicated platform instance. */\nexport interface InfraServiceAdapter {\n  readonly descriptor: InfraAdapterDescriptor<'supabase' | 'cerbos' | 'r2' | 'supabase-vault'>;\n  /** Read-only service config, bootstrap credentials and dependency validation. */\n  validateAsync(context: InfraExecutionContext): Promise<InfraResult<null>>;\n  planAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraPlanAction[]>>;\n  desiredWorkloadsAsync(\n    context: InfraExecutionContext,\n  ): Promise<InfraResult<readonly InfraWorkloadSpec[]>>;\n  reconcileAsync(\n    context: InfraExecutionContext,\n    runtimeOutputs: readonly InfraOutput[],\n  ): Promise<InfraResult<InfraReconcileResult>>;\n  statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;\n  destroyAsync(\n    context: InfraExecutionContext,\n    request: InfraDestroyRequest,\n  ): Promise<InfraResult<InfraReconcileResult>>;\n  suspendAsync?(context: InfraExecutionContext): Promise<InfraResult<InfraReconcileResult>>;\n}\n"]}

package/dist/types/infraLifecycle.d.ts

@@ -1,6 +1,7 @@
 import type { AppEnvironmentId } from '../environments';
 import type { InfraAdapterId } from './infraManifest';
 import type { InfraSecretReference } from './infraSecrets';
+import type { InfraComputeTarget } from './infraTargets';
 /** Identity must be verified before mutation; unowned resources must never be pruned. */
 export interface InfraResourceIdentity {
     readonly projectId: string;
@@ -82,7 +83,11 @@ export interface InfraLedger {
     readonly schemaVersion: 1;
     readonly projectId: string;
     readonly environment: AppEnvironmentId;
+    /** Last successfully reconciled portable targets required by stateless runtime operations. */
+    readonly targets: readonly InfraComputeTarget[];
     readonly resources: readonly InfraOwnedResource[];
+    /** Last successfully reconciled public values and privileged references; never resolved secrets. */
+    readonly outputs: readonly InfraOutput[];
     readonly artifacts: readonly {
         readonly owner: InfraResourceIdentity;
         readonly path: string;

package/dist/types/infraLifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infraLifecycle.d.ts","sourceRoot":"","sources":["../../src/types/infraLifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,yFAAyF;AACzF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,mBAAmB,CAAC;IACnD,QAAQ,CAAC,SAAS,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;CACxC;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,IACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,CAAC;AAE7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,cAAc,CAAC;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,KAAK,EACZ,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACpD;AAED,2FAA2F;AAC3F,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,CACzF;IACE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC;CACtC,CACJ,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjG;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;KAAE,CAAC;IAC9F,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAChB;QAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;KAAE,GAC7B;QAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,qBAAqB,EAAE,CAAA;KAAE,CAAC;CAClG"}
+{"version":3,"file":"infraLifecycle.d.ts","sourceRoot":"","sources":["../../src/types/infraLifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,yFAAyF;AACzF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,mBAAmB,CAAC;IACnD,QAAQ,CAAC,SAAS,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;CACxC;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,IACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,CAAC;AAE7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,cAAc,CAAC;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,KAAK,EACZ,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACpD;AAED,2FAA2F;AAC3F,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,CACzF;IACE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC;CACtC,CACJ,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,oGAAoG;IACpG,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjG;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;KAAE,CAAC;IAC9F,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAChB;QAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;KAAE,GAC7B;QAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,qBAAqB,EAAE,CAAA;KAAE,CAAC;CAClG"}

package/dist/types/infraLifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"infraLifecycle.js","sourceRoot":"","sources":["../../src/types/infraLifecycle.ts"],"names":[],"mappings":"","sourcesContent":["import type { AppEnvironmentId } from '../environments';\nimport type { InfraAdapterId } from './infraManifest';\nimport type { InfraSecretReference } from './infraSecrets';\n\n/** Identity must be verified before mutation; unowned resources must never be pruned. */\nexport interface InfraResourceIdentity {\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  readonly adapter: InfraAdapterId;\n  readonly resourceId: string;\n}\n\nexport interface InfraOwnedResource {\n  readonly identity: InfraResourceIdentity;\n  readonly externalId?: string;\n  readonly persistent: boolean;\n  readonly retention: 'retain' | 'delete-on-destroy';\n  readonly dependsOn: readonly InfraResourceIdentity[];\n}\n\nexport interface InfraDiagnostic {\n  readonly severity: 'info' | 'warning' | 'error';\n  readonly code: string;\n  /** Safe human-readable detail. Tokens and privileged values must be redacted by the producer. */\n  readonly message: string;\n  readonly path?: readonly (string | number)[];\n  readonly owner?: InfraResourceIdentity;\n}\n\nexport type InfraResult<T> =\n  | { readonly ok: true; readonly value: T; readonly diagnostics: readonly InfraDiagnostic[] }\n  | { readonly ok: false; readonly diagnostics: readonly InfraDiagnostic[] };\n\nexport interface InfraPlanAction {\n  readonly owner: InfraResourceIdentity;\n  readonly operation: 'create' | 'update' | 'delete' | 'retain' | 'noop';\n  readonly impact: 'none' | 'interrupts-service' | 'deletes-data';\n  readonly detail: string;\n  readonly dependsOn: readonly InfraResourceIdentity[];\n}\n\nexport interface InfraPlan {\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  /** Ordered dependency-first; teardown consumers reverse dependency order. */\n  readonly actions: readonly InfraPlanAction[];\n}\n\nexport interface InfraResourceStatus {\n  readonly owner: InfraResourceIdentity;\n  readonly state:\n    'absent' | 'pending' | 'ready' | 'degraded' | 'stopped' | 'retained' | 'failed' | 'unknown';\n  readonly detail?: string;\n  readonly diagnostics?: readonly InfraDiagnostic[];\n}\n\nexport interface InfraStatus {\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  readonly state: InfraResourceStatus['state'];\n  readonly resources: readonly InfraResourceStatus[];\n}\n\n/** A privileged output has a reference, never a value field or environment export name. */\nexport type InfraOutput = { readonly owner: InfraResourceIdentity; readonly name: string } & (\n  | {\n      readonly visibility: 'public';\n      readonly value: string | number | boolean;\n      readonly environmentVariable?: string;\n      readonly reference?: never;\n    }\n  | {\n      readonly visibility: 'secret';\n      readonly reference: InfraSecretReference;\n      readonly value?: never;\n      readonly environmentVariable?: never;\n    }\n);\n\nexport interface InfraGeneratedArtifact {\n  readonly owner: InfraResourceIdentity;\n  /** Project-relative file path validated by the writer before touching the filesystem. */\n  readonly path: string;\n  readonly content: string;\n  readonly executable?: boolean;\n}\n\nexport interface InfraLedger {\n  readonly schemaVersion: 1;\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  readonly resources: readonly InfraOwnedResource[];\n  readonly artifacts: readonly { readonly owner: InfraResourceIdentity; readonly path: string }[];\n}\n\n/** No default environment or confirmation is possible for destruction. */\nexport interface InfraDestroyRequest {\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  readonly confirmation: { readonly projectId: string; readonly environment: AppEnvironmentId };\n  /** Data deletion is a separate, explicit resource-scoped authorization in every environment. */\n  readonly persistence:\n    | { readonly policy: 'retain' }\n    | { readonly policy: 'delete'; readonly confirmedResources: readonly InfraResourceIdentity[] };\n}\n"]}
+{"version":3,"file":"infraLifecycle.js","sourceRoot":"","sources":["../../src/types/infraLifecycle.ts"],"names":[],"mappings":"","sourcesContent":["import type { AppEnvironmentId } from '../environments';\nimport type { InfraAdapterId } from './infraManifest';\nimport type { InfraSecretReference } from './infraSecrets';\nimport type { InfraComputeTarget } from './infraTargets';\n\n/** Identity must be verified before mutation; unowned resources must never be pruned. */\nexport interface InfraResourceIdentity {\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  readonly adapter: InfraAdapterId;\n  readonly resourceId: string;\n}\n\nexport interface InfraOwnedResource {\n  readonly identity: InfraResourceIdentity;\n  readonly externalId?: string;\n  readonly persistent: boolean;\n  readonly retention: 'retain' | 'delete-on-destroy';\n  readonly dependsOn: readonly InfraResourceIdentity[];\n}\n\nexport interface InfraDiagnostic {\n  readonly severity: 'info' | 'warning' | 'error';\n  readonly code: string;\n  /** Safe human-readable detail. Tokens and privileged values must be redacted by the producer. */\n  readonly message: string;\n  readonly path?: readonly (string | number)[];\n  readonly owner?: InfraResourceIdentity;\n}\n\nexport type InfraResult<T> =\n  | { readonly ok: true; readonly value: T; readonly diagnostics: readonly InfraDiagnostic[] }\n  | { readonly ok: false; readonly diagnostics: readonly InfraDiagnostic[] };\n\nexport interface InfraPlanAction {\n  readonly owner: InfraResourceIdentity;\n  readonly operation: 'create' | 'update' | 'delete' | 'retain' | 'noop';\n  readonly impact: 'none' | 'interrupts-service' | 'deletes-data';\n  readonly detail: string;\n  readonly dependsOn: readonly InfraResourceIdentity[];\n}\n\nexport interface InfraPlan {\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  /** Ordered dependency-first; teardown consumers reverse dependency order. */\n  readonly actions: readonly InfraPlanAction[];\n}\n\nexport interface InfraResourceStatus {\n  readonly owner: InfraResourceIdentity;\n  readonly state:\n    'absent' | 'pending' | 'ready' | 'degraded' | 'stopped' | 'retained' | 'failed' | 'unknown';\n  readonly detail?: string;\n  readonly diagnostics?: readonly InfraDiagnostic[];\n}\n\nexport interface InfraStatus {\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  readonly state: InfraResourceStatus['state'];\n  readonly resources: readonly InfraResourceStatus[];\n}\n\n/** A privileged output has a reference, never a value field or environment export name. */\nexport type InfraOutput = { readonly owner: InfraResourceIdentity; readonly name: string } & (\n  | {\n      readonly visibility: 'public';\n      readonly value: string | number | boolean;\n      readonly environmentVariable?: string;\n      readonly reference?: never;\n    }\n  | {\n      readonly visibility: 'secret';\n      readonly reference: InfraSecretReference;\n      readonly value?: never;\n      readonly environmentVariable?: never;\n    }\n);\n\nexport interface InfraGeneratedArtifact {\n  readonly owner: InfraResourceIdentity;\n  /** Project-relative file path validated by the writer before touching the filesystem. */\n  readonly path: string;\n  readonly content: string;\n  readonly executable?: boolean;\n}\n\nexport interface InfraLedger {\n  readonly schemaVersion: 1;\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  /** Last successfully reconciled portable targets required by stateless runtime operations. */\n  readonly targets: readonly InfraComputeTarget[];\n  readonly resources: readonly InfraOwnedResource[];\n  /** Last successfully reconciled public values and privileged references; never resolved secrets. */\n  readonly outputs: readonly InfraOutput[];\n  readonly artifacts: readonly { readonly owner: InfraResourceIdentity; readonly path: string }[];\n}\n\n/** No default environment or confirmation is possible for destruction. */\nexport interface InfraDestroyRequest {\n  readonly projectId: string;\n  readonly environment: AppEnvironmentId;\n  readonly confirmation: { readonly projectId: string; readonly environment: AppEnvironmentId };\n  /** Data deletion is a separate, explicit resource-scoped authorization in every environment. */\n  readonly persistence:\n    | { readonly policy: 'retain' }\n    | { readonly policy: 'delete'; readonly confirmedResources: readonly InfraResourceIdentity[] };\n}\n"]}

package/dist/types/infraManifest.d.ts

@@ -132,6 +132,8 @@ export type InfraSecretStoreSpec = {
 export interface InfraNetworkingSpec {
     /** Public DNS name intent, not automatic DNS/CDN vendor provisioning. */
     readonly domain?: string;
+    /** Absolute HTTP(S) origin used by workloads that must know their external URL at startup. */
+    readonly publicBaseUrl?: string;
 }
 export interface InfraEnvironmentSpec {
     readonly deployment: InfraDeploymentSpec;

package/dist/types/infraManifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infraManifest.d.ts","sourceRoot":"","sources":["../../src/types/infraManifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,qBAAqB,CAAC;AAChE,MAAM,MAAM,eAAe,GACzB,CAAC,OAAO,qBAAqB,CAAC,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AACzE,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI;KACvD,CAAC,IAAI,cAAc,GAAG,CAAC,SAAS,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,GACtF,CAAC,GACD,KAAK;CACV,CAAC,cAAc,CAAC,CAAC;AAClB,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACjE,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,2BAA2B,CAAC;AAE9E,kGAAkG;AAClG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;QACtD,QAAQ,CAAC,GAAG,CAAC,EAAE;YACb,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;SACvD,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,CAAC;IACF,QAAQ,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB,IAAI;KAC5F,CAAC,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC;CAC9D,CAAC,CAAC,CAAC,CAAC;AACL,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB,IAAI;KAC5F,CAAC,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC;CAC9D,CAAC,CAAC,CAAC,CAAC;AAEL,yFAAyF;AACzF,MAAM,MAAM,mBAAmB,GAAG;KAC/B,CAAC,IAAI,sBAAsB,GAAG;QAC7B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;KAC5C;CACF,CAAC,sBAAsB,CAAC,CAAC;AAE1B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC;CACvD;AACD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,EAAE,EAAE;QACX,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;KACvD,CAAC;CACH;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;QAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;QACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;QACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;QACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;KACpC,CAAC;CACH;AACD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;KACrD,CAAC;CACH;AACD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,MAAM,MAAM,iBAAiB,GAAG;KAC7B,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,sBAAsB,CAAC,CAAC,CAAC;CAC1F,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;AAChC,MAAM,MAAM,sBAAsB,GAAG;KAClC,CAAC,IAAI,gBAAgB,CAAC,eAAe,CAAC,GAAG;QACxC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;KACtB,GAAG,2BAA2B,CAAC,CAAC,CAAC;CACnC,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC;AACrC,MAAM,MAAM,aAAa,GAAG;KACzB,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC;CAClF,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5B,MAAM,MAAM,cAAc,GAAG;KAC1B,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC;CACpF,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7B,MAAM,MAAM,oBAAoB,GAAG;KAChC,CAAC,IAAI,gBAAgB,CAAC,aAAa,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,yBAAyB,CAAC,CAAC,CAAC;CAChG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAC7B,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC,GACnC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAC5E,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5D"}
+{"version":3,"file":"infraManifest.d.ts","sourceRoot":"","sources":["../../src/types/infraManifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,qBAAqB,CAAC;AAChE,MAAM,MAAM,eAAe,GACzB,CAAC,OAAO,qBAAqB,CAAC,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AACzE,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI;KACvD,CAAC,IAAI,cAAc,GAAG,CAAC,SAAS,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,GACtF,CAAC,GACD,KAAK;CACV,CAAC,cAAc,CAAC,CAAC;AAClB,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACjE,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,2BAA2B,CAAC;AAE9E,kGAAkG;AAClG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;QACtD,QAAQ,CAAC,GAAG,CAAC,EAAE;YACb,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;SACvD,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,CAAC;IACF,QAAQ,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB,IAAI;KAC5F,CAAC,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC;CAC9D,CAAC,CAAC,CAAC,CAAC;AACL,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB,IAAI;KAC5F,CAAC,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC;CAC9D,CAAC,CAAC,CAAC,CAAC;AAEL,yFAAyF;AACzF,MAAM,MAAM,mBAAmB,GAAG;KAC/B,CAAC,IAAI,sBAAsB,GAAG;QAC7B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;KAC5C;CACF,CAAC,sBAAsB,CAAC,CAAC;AAE1B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC;CACvD;AACD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,EAAE,EAAE;QACX,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;KACvD,CAAC;CACH;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;QAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;QACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;QACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;QACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;KACpC,CAAC;CACH;AACD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;KACrD,CAAC;CACH;AACD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,MAAM,MAAM,iBAAiB,GAAG;KAC7B,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,sBAAsB,CAAC,CAAC,CAAC;CAC1F,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;AAChC,MAAM,MAAM,sBAAsB,GAAG;KAClC,CAAC,IAAI,gBAAgB,CAAC,eAAe,CAAC,GAAG;QACxC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;KACtB,GAAG,2BAA2B,CAAC,CAAC,CAAC;CACnC,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC;AACrC,MAAM,MAAM,aAAa,GAAG;KACzB,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC;CAClF,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5B,MAAM,MAAM,cAAc,GAAG;KAC1B,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC;CACpF,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7B,MAAM,MAAM,oBAAoB,GAAG;KAChC,CAAC,IAAI,gBAAgB,CAAC,aAAa,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,yBAAyB,CAAC,CAAC,CAAC;CAChG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAC7B,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC,GACnC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAC5E,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5D"}

package/dist/types/infraManifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"infraManifest.js","sourceRoot":"","sources":["../../src/types/infraManifest.ts"],"names":[],"mappings":"","sourcesContent":["import type { AuthFlowConfig, AuthOAuthConfig } from '../auth';\nimport type { ApiDefinitionList } from '../data';\nimport type { AppEnvironmentId } from '../environments';\nimport type { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from '../infra/constants';\nimport type { AuthProfileSpec, AuthScope, AuthSignInSpec, AuthSignUpSpec } from '../types';\nimport type { InfraControlPlaneCredentialRef } from './infraSecrets';\nimport type { InfraWorkloadSpec } from './infraWorkload';\n\nexport type InfraAdapterId = keyof typeof INFRA_ADAPTER_CATALOG;\nexport type InfraCapability =\n  (typeof INFRA_ADAPTER_CATALOG)[InfraAdapterId]['capabilities'][number];\nexport type InfraProviderFor<C extends InfraCapability> = {\n  [P in InfraAdapterId]: C extends (typeof INFRA_ADAPTER_CATALOG)[P]['capabilities'][number]\n    ? P\n    : never;\n}[InfraAdapterId];\nexport type InfraComputeProviderId = InfraProviderFor<'compute'>;\nexport type InfraRuntimeProviderId = keyof typeof INFRA_RUNTIME_COMPATIBILITY;\n\n/** Non-secret provider configuration; credentials are resolved only at the execution boundary. */\nexport interface InfraComputeConfigMap {\n  readonly local: { readonly workingDirectory?: string };\n  readonly hetzner: {\n    readonly location: string;\n    readonly serverType?: string;\n    readonly image?: string;\n    readonly credentials?: InfraControlPlaneCredentialRef;\n    readonly ssh?: {\n      readonly user?: string;\n      readonly port?: number;\n      readonly credentials?: InfraControlPlaneCredentialRef;\n    };\n  };\n}\n\nexport interface InfraRuntimeConfigMap {\n  readonly minikube: {\n    readonly profile?: string;\n    readonly driver?: 'docker' | 'podman';\n    readonly cpus?: number;\n    readonly memoryMiB?: number;\n  };\n  readonly k3s: {\n    readonly version?: string;\n    readonly topology?: { readonly servers: number; readonly agents: number };\n  };\n  readonly 'docker-compose': { readonly projectName?: string };\n}\n\nexport type InfraComputeSelection<P extends InfraComputeProviderId = InfraComputeProviderId> = {\n  [K in P]: { readonly provider: K } & InfraComputeConfigMap[K];\n}[P];\nexport type InfraRuntimeSelection<P extends InfraRuntimeProviderId = InfraRuntimeProviderId> = {\n  [K in P]: { readonly provider: K } & InfraRuntimeConfigMap[K];\n}[P];\n\n/** A discriminated union derived from the runtime catalog, never a Cartesian product. */\nexport type InfraDeploymentSpec = {\n  [R in InfraRuntimeProviderId]: {\n    readonly compute: InfraComputeSelection<(typeof INFRA_RUNTIME_COMPATIBILITY)[R][number]>;\n    readonly runtime: InfraRuntimeSelection<R>;\n  };\n}[InfraRuntimeProviderId];\n\nexport interface InfraDatabaseConfigMap {\n  readonly supabase: { readonly tier?: 'dev' | 'prod' };\n}\nexport interface InfraObjectStorageConfigMap {\n  readonly supabase: { readonly buckets?: readonly string[] };\n  readonly r2: {\n    readonly buckets?: readonly string[];\n    readonly accountId?: string;\n    readonly credentials?: InfraControlPlaneCredentialRef;\n  };\n}\nexport interface InfraAuthConfigMap {\n  readonly supabase: {\n    readonly scope?: AuthScope;\n    readonly flow?: AuthFlowConfig;\n    readonly signIn?: AuthSignInSpec;\n    readonly signUp?: AuthSignUpSpec;\n    readonly oauth?: AuthOAuthConfig;\n    readonly profile?: AuthProfileSpec;\n  };\n}\nexport interface InfraAuthzConfigMap {\n  readonly cerbos: {\n    readonly kind: 'RBAC' | 'ABAC';\n    readonly policies?: readonly InfraAuthzPolicyFile[];\n  };\n}\nexport interface InfraAuthzPolicyFile {\n  readonly path: string;\n  readonly content: string;\n}\nexport interface InfraSecretStoreConfigMap {\n  readonly 'supabase-vault': { readonly schema?: string };\n}\n\nexport type InfraDatabaseSpec = {\n  [P in InfraProviderFor<'database'>]: { readonly provider: P } & InfraDatabaseConfigMap[P];\n}[InfraProviderFor<'database'>];\nexport type InfraObjectStorageSpec = {\n  [P in InfraProviderFor<'objectStorage'>]: {\n    readonly provider: P;\n  } & InfraObjectStorageConfigMap[P];\n}[InfraProviderFor<'objectStorage'>];\nexport type InfraAuthSpec = {\n  [P in InfraProviderFor<'auth'>]: { readonly provider: P } & InfraAuthConfigMap[P];\n}[InfraProviderFor<'auth'>];\nexport type InfraAuthzSpec = {\n  [P in InfraProviderFor<'authz'>]: { readonly provider: P } & InfraAuthzConfigMap[P];\n}[InfraProviderFor<'authz'>];\nexport type InfraSecretStoreSpec = {\n  [P in InfraProviderFor<'secretStore'>]: { readonly provider: P } & InfraSecretStoreConfigMap[P];\n}[InfraProviderFor<'secretStore'>];\n\nexport interface InfraNetworkingSpec {\n  /** Public DNS name intent, not automatic DNS/CDN vendor provisioning. */\n  readonly domain?: string;\n}\n\nexport interface InfraEnvironmentSpec {\n  readonly deployment: InfraDeploymentSpec;\n  readonly database?: InfraDatabaseSpec;\n  readonly objectStorage?: InfraObjectStorageSpec;\n  readonly auth?: InfraAuthSpec;\n  readonly authz?: InfraAuthzSpec;\n  readonly secretStore?: InfraSecretStoreSpec;\n  readonly networking?: InfraNetworkingSpec;\n  readonly workloads?: readonly InfraWorkloadSpec[];\n}\n\nexport interface InfraManifest {\n  readonly environments: Readonly<\n    Record<'local', InfraEnvironmentSpec> &\n      Partial<Record<Exclude<AppEnvironmentId, 'local'>, InfraEnvironmentSpec>>\n  >;\n  readonly apis?: ApiDefinitionList;\n  readonly modules: readonly string[];\n  readonly modulesConfig?: Readonly<Record<string, unknown>>;\n}\n"]}
+{"version":3,"file":"infraManifest.js","sourceRoot":"","sources":["../../src/types/infraManifest.ts"],"names":[],"mappings":"","sourcesContent":["import type { AuthFlowConfig, AuthOAuthConfig } from '../auth';\nimport type { ApiDefinitionList } from '../data';\nimport type { AppEnvironmentId } from '../environments';\nimport type { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from '../infra/constants';\nimport type { AuthProfileSpec, AuthScope, AuthSignInSpec, AuthSignUpSpec } from '../types';\nimport type { InfraControlPlaneCredentialRef } from './infraSecrets';\nimport type { InfraWorkloadSpec } from './infraWorkload';\n\nexport type InfraAdapterId = keyof typeof INFRA_ADAPTER_CATALOG;\nexport type InfraCapability =\n  (typeof INFRA_ADAPTER_CATALOG)[InfraAdapterId]['capabilities'][number];\nexport type InfraProviderFor<C extends InfraCapability> = {\n  [P in InfraAdapterId]: C extends (typeof INFRA_ADAPTER_CATALOG)[P]['capabilities'][number]\n    ? P\n    : never;\n}[InfraAdapterId];\nexport type InfraComputeProviderId = InfraProviderFor<'compute'>;\nexport type InfraRuntimeProviderId = keyof typeof INFRA_RUNTIME_COMPATIBILITY;\n\n/** Non-secret provider configuration; credentials are resolved only at the execution boundary. */\nexport interface InfraComputeConfigMap {\n  readonly local: { readonly workingDirectory?: string };\n  readonly hetzner: {\n    readonly location: string;\n    readonly serverType?: string;\n    readonly image?: string;\n    readonly credentials?: InfraControlPlaneCredentialRef;\n    readonly ssh?: {\n      readonly user?: string;\n      readonly port?: number;\n      readonly credentials?: InfraControlPlaneCredentialRef;\n    };\n  };\n}\n\nexport interface InfraRuntimeConfigMap {\n  readonly minikube: {\n    readonly profile?: string;\n    readonly driver?: 'docker' | 'podman';\n    readonly cpus?: number;\n    readonly memoryMiB?: number;\n  };\n  readonly k3s: {\n    readonly version?: string;\n    readonly topology?: { readonly servers: number; readonly agents: number };\n  };\n  readonly 'docker-compose': { readonly projectName?: string };\n}\n\nexport type InfraComputeSelection<P extends InfraComputeProviderId = InfraComputeProviderId> = {\n  [K in P]: { readonly provider: K } & InfraComputeConfigMap[K];\n}[P];\nexport type InfraRuntimeSelection<P extends InfraRuntimeProviderId = InfraRuntimeProviderId> = {\n  [K in P]: { readonly provider: K } & InfraRuntimeConfigMap[K];\n}[P];\n\n/** A discriminated union derived from the runtime catalog, never a Cartesian product. */\nexport type InfraDeploymentSpec = {\n  [R in InfraRuntimeProviderId]: {\n    readonly compute: InfraComputeSelection<(typeof INFRA_RUNTIME_COMPATIBILITY)[R][number]>;\n    readonly runtime: InfraRuntimeSelection<R>;\n  };\n}[InfraRuntimeProviderId];\n\nexport interface InfraDatabaseConfigMap {\n  readonly supabase: { readonly tier?: 'dev' | 'prod' };\n}\nexport interface InfraObjectStorageConfigMap {\n  readonly supabase: { readonly buckets?: readonly string[] };\n  readonly r2: {\n    readonly buckets?: readonly string[];\n    readonly accountId?: string;\n    readonly credentials?: InfraControlPlaneCredentialRef;\n  };\n}\nexport interface InfraAuthConfigMap {\n  readonly supabase: {\n    readonly scope?: AuthScope;\n    readonly flow?: AuthFlowConfig;\n    readonly signIn?: AuthSignInSpec;\n    readonly signUp?: AuthSignUpSpec;\n    readonly oauth?: AuthOAuthConfig;\n    readonly profile?: AuthProfileSpec;\n  };\n}\nexport interface InfraAuthzConfigMap {\n  readonly cerbos: {\n    readonly kind: 'RBAC' | 'ABAC';\n    readonly policies?: readonly InfraAuthzPolicyFile[];\n  };\n}\nexport interface InfraAuthzPolicyFile {\n  readonly path: string;\n  readonly content: string;\n}\nexport interface InfraSecretStoreConfigMap {\n  readonly 'supabase-vault': { readonly schema?: string };\n}\n\nexport type InfraDatabaseSpec = {\n  [P in InfraProviderFor<'database'>]: { readonly provider: P } & InfraDatabaseConfigMap[P];\n}[InfraProviderFor<'database'>];\nexport type InfraObjectStorageSpec = {\n  [P in InfraProviderFor<'objectStorage'>]: {\n    readonly provider: P;\n  } & InfraObjectStorageConfigMap[P];\n}[InfraProviderFor<'objectStorage'>];\nexport type InfraAuthSpec = {\n  [P in InfraProviderFor<'auth'>]: { readonly provider: P } & InfraAuthConfigMap[P];\n}[InfraProviderFor<'auth'>];\nexport type InfraAuthzSpec = {\n  [P in InfraProviderFor<'authz'>]: { readonly provider: P } & InfraAuthzConfigMap[P];\n}[InfraProviderFor<'authz'>];\nexport type InfraSecretStoreSpec = {\n  [P in InfraProviderFor<'secretStore'>]: { readonly provider: P } & InfraSecretStoreConfigMap[P];\n}[InfraProviderFor<'secretStore'>];\n\nexport interface InfraNetworkingSpec {\n  /** Public DNS name intent, not automatic DNS/CDN vendor provisioning. */\n  readonly domain?: string;\n  /** Absolute HTTP(S) origin used by workloads that must know their external URL at startup. */\n  readonly publicBaseUrl?: string;\n}\n\nexport interface InfraEnvironmentSpec {\n  readonly deployment: InfraDeploymentSpec;\n  readonly database?: InfraDatabaseSpec;\n  readonly objectStorage?: InfraObjectStorageSpec;\n  readonly auth?: InfraAuthSpec;\n  readonly authz?: InfraAuthzSpec;\n  readonly secretStore?: InfraSecretStoreSpec;\n  readonly networking?: InfraNetworkingSpec;\n  readonly workloads?: readonly InfraWorkloadSpec[];\n}\n\nexport interface InfraManifest {\n  readonly environments: Readonly<\n    Record<'local', InfraEnvironmentSpec> &\n      Partial<Record<Exclude<AppEnvironmentId, 'local'>, InfraEnvironmentSpec>>\n  >;\n  readonly apis?: ApiDefinitionList;\n  readonly modules: readonly string[];\n  readonly modulesConfig?: Readonly<Record<string, unknown>>;\n}\n"]}

package/dist/types/infraTargets.d.ts

@@ -0,0 +1,18 @@
+import type { InfraControlPlaneCredentialRef } from './infraSecrets';
+/** Portable runtime target state contains credential identity only, never resolved values. */
+export type InfraComputeTarget = {
+    readonly id: string;
+    readonly os: 'linux' | 'darwin' | 'windows';
+    readonly architecture: 'amd64' | 'arm64';
+} & ({
+    readonly kind: 'local-host';
+} | {
+    readonly kind: 'ssh-host';
+    readonly host: string;
+    readonly port: number;
+    readonly user: string;
+    readonly credential: InfraControlPlaneCredentialRef;
+    /** Expected host key supplied by the compute owner; runtimes must verify host authenticity. */
+    readonly hostKeyFingerprint: string;
+});
+//# sourceMappingURL=infraTargets.d.ts.map

package/dist/types/infraTargets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infraTargets.d.ts","sourceRoot":"","sources":["../../src/types/infraTargets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAErE,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC;CAC1C,GAAG,CACA;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,8BAA8B,CAAC;IACpD,+FAA+F;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,CACJ,CAAC"}

package/dist/types/infraTargets.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=infraTargets.js.map

package/dist/types/infraTargets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infraTargets.js","sourceRoot":"","sources":["../../src/types/infraTargets.ts"],"names":[],"mappings":"","sourcesContent":["import type { InfraControlPlaneCredentialRef } from './infraSecrets';\n\n/** Portable runtime target state contains credential identity only, never resolved values. */\nexport type InfraComputeTarget = {\n  readonly id: string;\n  readonly os: 'linux' | 'darwin' | 'windows';\n  readonly architecture: 'amd64' | 'arm64';\n} & (\n  | { readonly kind: 'local-host' }\n  | {\n      readonly kind: 'ssh-host';\n      readonly host: string;\n      readonly port: number;\n      readonly user: string;\n      readonly credential: InfraControlPlaneCredentialRef;\n      /** Expected host key supplied by the compute owner; runtimes must verify host authenticity. */\n      readonly hostKeyFingerprint: string;\n    }\n);\n"]}

package/dist/types/infraWorkload.d.ts

@@ -4,7 +4,7 @@ export interface InfraWorkloadArtifact {
     /** Prebuilt image, optionally pinned by digest. No registry/build provider requirement. */
     readonly image: string;
 }
-export type InfraWorkloadValue = {
+export type InfraWorkloadScalarValue = {
     readonly kind: 'literal';
     readonly value: string;
 } | {
@@ -19,6 +19,11 @@ export type InfraWorkloadValue = {
     readonly resourceId: string;
     readonly output: string;
 };
+export type InfraWorkloadValue = InfraWorkloadScalarValue | {
+    readonly kind: 'template';
+    /** Ordered scalar segments materialized into one value only at the runtime boundary. */
+    readonly segments: readonly InfraWorkloadScalarValue[];
+};
 export interface InfraWorkloadPort {
     readonly name: string;
     readonly port: number;

package/dist/types/infraWorkload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infraWorkload.d.ts","sourceRoot":"","sources":["../../src/types/infraWorkload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;CAAE,GACrE;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC,GAAG,CACA;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CACpE,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,mBAAmB,CAAC;CACpD;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,yBAAyB,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC"}
+{"version":3,"file":"infraWorkload.d.ts","sourceRoot":"","sources":["../../src/types/infraWorkload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;CAAE,GACrE;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF,MAAM,MAAM,kBAAkB,GAC1B,wBAAwB,GACxB;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACxD,CAAC;AAEN,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC,GAAG,CACA;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CACpE,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,mBAAmB,CAAC;CACpD;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,yBAAyB,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC"}

package/dist/types/infraWorkload.js.map

@@ -1 +1 @@
-{"version":3,"file":"infraWorkload.js","sourceRoot":"","sources":["../../src/types/infraWorkload.ts"],"names":[],"mappings":"","sourcesContent":["import type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';\n\nexport interface InfraWorkloadArtifact {\n  readonly kind: 'image';\n  /** Prebuilt image, optionally pinned by digest. No registry/build provider requirement. */\n  readonly image: string;\n}\n\nexport type InfraWorkloadValue =\n  | { readonly kind: 'literal'; readonly value: string }\n  | { readonly kind: 'secret'; readonly reference: InfraSecretReference }\n  | {\n      readonly kind: 'credential';\n      readonly reference: InfraControlPlaneCredentialRef;\n      readonly key: string;\n    }\n  | { readonly kind: 'output'; readonly resourceId: string; readonly output: string };\n\nexport interface InfraWorkloadPort {\n  readonly name: string;\n  readonly port: number;\n  readonly protocol?: 'tcp' | 'udp';\n}\n\nexport type InfraWorkloadHealthSpec = {\n  readonly intervalSeconds?: number;\n  readonly timeoutSeconds?: number;\n  readonly failureThreshold?: number;\n} & (\n  | { readonly kind: 'http'; readonly port: number; readonly path: string }\n  | { readonly kind: 'tcp'; readonly port: number }\n  | { readonly kind: 'command'; readonly command: readonly string[] }\n);\n\nexport interface InfraWorkloadResourceSpec {\n  readonly cpuMillis?: number;\n  readonly memoryMiB?: number;\n}\n\nexport interface InfraWorkloadVolumeSpec {\n  readonly id: string;\n  readonly mountPath: string;\n  readonly sizeGiB: number;\n  /** Persistence survives down and is retained by default on destroy. */\n  readonly retention: 'retain' | 'delete-on-destroy';\n}\n\n/** Portable config/policy files; secret values are materialized by the runtime. */\nexport interface InfraWorkloadFileSpec {\n  readonly path: string;\n  readonly content: InfraWorkloadValue;\n}\n\nexport interface InfraWorkloadSpec {\n  readonly id: string;\n  readonly artifact: InfraWorkloadArtifact;\n  readonly command?: readonly string[];\n  readonly args?: readonly string[];\n  readonly ports?: readonly InfraWorkloadPort[];\n  readonly environment?: Readonly<Record<string, InfraWorkloadValue>>;\n  readonly files?: readonly InfraWorkloadFileSpec[];\n  readonly health?: InfraWorkloadHealthSpec;\n  readonly resources?: InfraWorkloadResourceSpec;\n  readonly persistence?: readonly InfraWorkloadVolumeSpec[];\n  readonly exposure?: 'internal' | 'public';\n  readonly replicas?: number;\n  /** IDs in the composed desired-state graph; the orchestrator validates missing/cyclic edges. */\n  readonly dependsOn?: readonly string[];\n}\n"]}
+{"version":3,"file":"infraWorkload.js","sourceRoot":"","sources":["../../src/types/infraWorkload.ts"],"names":[],"mappings":"","sourcesContent":["import type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';\n\nexport interface InfraWorkloadArtifact {\n  readonly kind: 'image';\n  /** Prebuilt image, optionally pinned by digest. No registry/build provider requirement. */\n  readonly image: string;\n}\n\nexport type InfraWorkloadScalarValue =\n  | { readonly kind: 'literal'; readonly value: string }\n  | { readonly kind: 'secret'; readonly reference: InfraSecretReference }\n  | {\n      readonly kind: 'credential';\n      readonly reference: InfraControlPlaneCredentialRef;\n      readonly key: string;\n    }\n  | { readonly kind: 'output'; readonly resourceId: string; readonly output: string };\n\nexport type InfraWorkloadValue =\n  | InfraWorkloadScalarValue\n  | {\n      readonly kind: 'template';\n      /** Ordered scalar segments materialized into one value only at the runtime boundary. */\n      readonly segments: readonly InfraWorkloadScalarValue[];\n    };\n\nexport interface InfraWorkloadPort {\n  readonly name: string;\n  readonly port: number;\n  readonly protocol?: 'tcp' | 'udp';\n}\n\nexport type InfraWorkloadHealthSpec = {\n  readonly intervalSeconds?: number;\n  readonly timeoutSeconds?: number;\n  readonly failureThreshold?: number;\n} & (\n  | { readonly kind: 'http'; readonly port: number; readonly path: string }\n  | { readonly kind: 'tcp'; readonly port: number }\n  | { readonly kind: 'command'; readonly command: readonly string[] }\n);\n\nexport interface InfraWorkloadResourceSpec {\n  readonly cpuMillis?: number;\n  readonly memoryMiB?: number;\n}\n\nexport interface InfraWorkloadVolumeSpec {\n  readonly id: string;\n  readonly mountPath: string;\n  readonly sizeGiB: number;\n  /** Persistence survives down and is retained by default on destroy. */\n  readonly retention: 'retain' | 'delete-on-destroy';\n}\n\n/** Portable config/policy files; secret values are materialized by the runtime. */\nexport interface InfraWorkloadFileSpec {\n  readonly path: string;\n  readonly content: InfraWorkloadValue;\n}\n\nexport interface InfraWorkloadSpec {\n  readonly id: string;\n  readonly artifact: InfraWorkloadArtifact;\n  readonly command?: readonly string[];\n  readonly args?: readonly string[];\n  readonly ports?: readonly InfraWorkloadPort[];\n  readonly environment?: Readonly<Record<string, InfraWorkloadValue>>;\n  readonly files?: readonly InfraWorkloadFileSpec[];\n  readonly health?: InfraWorkloadHealthSpec;\n  readonly resources?: InfraWorkloadResourceSpec;\n  readonly persistence?: readonly InfraWorkloadVolumeSpec[];\n  readonly exposure?: 'internal' | 'public';\n  readonly replicas?: number;\n  /** IDs in the composed desired-state graph; the orchestrator validates missing/cyclic edges. */\n  readonly dependsOn?: readonly string[];\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/contracts",
-  "version": "17.0.0",
+  "version": "19.0.0",
   "main": "./dist/index.js",
   "ankh": {
     "category": "contracts",

package/src/infra/isInfraEnvironmentSpec.ts

@@ -42,11 +42,27 @@ function isEnvironmentShape(value: unknown): value is InfraEnvironmentSpec {
         schema: infraFields.optionalText,
       }),
     networking: (networking) =>
-      networking === undefined || isInfraShape(networking, { domain: infraFields.optionalText }),
+      networking === undefined ||
+      isInfraShape(networking, {
+        domain: infraFields.optionalText,
+        publicBaseUrl: (publicBaseUrl) =>
+          publicBaseUrl === undefined || isPublicHttpOrigin(publicBaseUrl),
+      }),
     workloads: (workloads) => workloads === undefined || isWorkloads(workloads),
   } satisfies InfraShape<InfraEnvironmentSpec>);
 }
 
+/*** Public workload configuration uses one canonical absolute HTTP(S) origin without path state. */
+function isPublicHttpOrigin(value: unknown): boolean {
+  if (!isNonEmptyString(value)) return false;
+  try {
+    const url = new URL(value);
+    return (url.protocol === 'http:' || url.protocol === 'https:') && url.origin === value;
+  } catch {
+    return false;
+  }
+}
+
 /*** Validate portable, unique Cerbos policy files without host paths or traversal. */
 function isPolicyFiles(value: unknown): boolean {
   return (

package/src/infra/isInfraWorkloadValue.ts

@@ -2,11 +2,26 @@ import { isRecord } from '@ankhorage/utility/object';
 import { isNonEmptyString } from '@ankhorage/utility/string';
 
 import { APP_ENVIRONMENT_IDS } from '../environments';
+import type { InfraWorkloadScalarValue } from '../types/infraWorkload';
 import { isInfraCredentialRef } from './isInfraCredentialRef';
 import { isInfraShape } from './isInfraShape';
 
 /*** Workload values explicitly distinguish public literals, output dependencies and secret references. */
 export function isInfraWorkloadValue(value: unknown): boolean {
+  return (
+    isInfraWorkloadScalarValue(value) ||
+    isInfraShape(value, {
+      kind: (kind) => kind === 'template',
+      segments: (segments) =>
+        Array.isArray(segments) &&
+        segments.length > 0 &&
+        segments.every(isInfraWorkloadScalarValue),
+    })
+  );
+}
+
+/*** Validate one non-composite workload value segment. */
+function isInfraWorkloadScalarValue(value: unknown): value is InfraWorkloadScalarValue {
   if (!isRecord(value)) return false;
   switch (value.kind) {
     case 'literal':

package/src/infra-types.test.ts

@@ -5,12 +5,15 @@ import type {
   InfraAdapterDescriptor,
   InfraAuthSpec,
   InfraAuthzSpec,
+  InfraComputeAdapter,
+  InfraComputeSnapshot,
   InfraControlPlaneCredentialRef,
   InfraDeploymentSpec,
   InfraDestroyRequest,
   InfraManifest,
   InfraObjectStorageSpec,
   InfraOutput,
+  InfraResult,
   InfraRuntimeAdapter,
   InfraRuntimeDesiredState,
   InfraRuntimeProviderId,
@@ -108,3 +111,14 @@ it('requires runtime desired state for every target-dependent lifecycle operatio
 
   expect(lifecycleBoundary).toEqual([true, true, true]);
 });
+
+it('requires read-only compute discovery separately from mutating ensure', () => {
+  type Adapter = InfraComputeAdapter<'local'>;
+
+  const computeBoundary: readonly [
+    Assignable<Awaited<ReturnType<Adapter['inspectAsync']>>, InfraResult<InfraComputeSnapshot>>,
+    Assignable<Awaited<ReturnType<Adapter['ensureAsync']>>, InfraResult<InfraComputeSnapshot>>,
+  ] = [true, true];
+
+  expect(computeBoundary).toEqual([true, true]);
+});

package/src/infra-workload.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from 'bun:test';
 
 import { isAppManifest } from './appManifest';
 import {
+  type InfraLedger,
   type InfraWorkloadSpec,
   isInfraDeploymentSpec,
   isInfraEnvironmentSpec,
@@ -31,6 +32,18 @@ const workload = {
       key: 'POSTGRES_PASSWORD',
     },
     DB_HOST: { kind: 'output', resourceId: 'database', output: 'host' },
+    DB_URL: {
+      kind: 'template',
+      segments: [
+        { kind: 'literal', value: 'postgresql://postgres:' },
+        {
+          kind: 'credential',
+          reference: { source: 'control-plane', name: 'SUPABASE_BOOTSTRAP' },
+          key: 'POSTGRES_PASSWORD',
+        },
+        { kind: 'literal', value: '@database:5432/postgres' },
+      ],
+    },
   },
   files: [{ path: '/etc/backend/config.json', content: { kind: 'literal', value: '{}' } }],
   health: { kind: 'http', port: 8080, path: '/health', intervalSeconds: 5 },
@@ -95,10 +108,27 @@ const invalidWorkloads = [
       },
     },
   },
+  { environment: { DATABASE_URL: { kind: 'template', segments: [] } } },
+  {
+    environment: {
+      DATABASE_URL: {
+        kind: 'template',
+        segments: [{ kind: 'template', segments: [{ kind: 'literal', value: 'nested' }] }],
+      },
+    },
+  },
+  {
+    environment: {
+      DATABASE_URL: {
+        kind: 'template',
+        segments: [{ kind: 'credential', reference: { source: 'control-plane', name: 'DB' } }],
+      },
+    },
+  },
 ];
 
 describe('runtime-neutral workload boundary', () => {
-  it('accepts prebuilt images, dependency outputs, config files and secret references on every runtime', () => {
+  it('accepts prebuilt images, composed values, outputs, files and secrets on every runtime', () => {
     expect(isInfraWorkloadSpec(JSON.parse(JSON.stringify(workload)))).toBe(true);
     for (const provider of ['minikube', 'k3s', 'docker-compose']) {
       expect(
@@ -186,6 +216,47 @@ describe('control-plane credential separation', () => {
   });
 });
 
+describe('stateless lifecycle ledger', () => {
+  it('serializes portable targets and safe outputs without resolved credentials', () => {
+    const ledger = {
+      schemaVersion: 1,
+      projectId: 'example',
+      environment: 'production',
+      targets: [
+        {
+          kind: 'ssh-host',
+          id: 'server-0',
+          os: 'linux',
+          architecture: 'amd64',
+          host: '203.0.113.10',
+          port: 22,
+          user: 'root',
+          credential: { source: 'control-plane', name: 'HETZNER_SSH' },
+          hostKeyFingerprint: 'SHA256:verified',
+        },
+      ],
+      resources: [],
+      outputs: [
+        {
+          owner: {
+            projectId: 'example',
+            environment: 'production',
+            adapter: 'hetzner',
+            resourceId: 'server-0',
+          },
+          name: 'publicIpv4',
+          visibility: 'public',
+          value: '203.0.113.10',
+        },
+      ],
+      artifacts: [],
+    } as const satisfies InfraLedger;
+
+    expect(JSON.parse(JSON.stringify(ledger))).toEqual(ledger);
+    expect(JSON.stringify(ledger)).not.toContain('privateKey');
+  });
+});
+
 describe('application state boundary', () => {
   const manifest = {
     metadata: {

package/src/infra.test.ts

@@ -26,7 +26,7 @@ const production = {
   objectStorage: { provider: 'r2', buckets: ['media'] },
   authz: { provider: 'cerbos', kind: 'ABAC' },
   secretStore: { provider: 'supabase-vault' },
-  networking: { domain: 'api.example.ch' },
+  networking: { domain: 'api.example.ch', publicBaseUrl: 'https://api.example.ch' },
 } as const satisfies InfraEnvironmentSpec;
 
 describe('standalone Infra environments', () => {
@@ -165,6 +165,9 @@ describe('sibling service configuration', () => {
     { secretStore: { provider: 'unknown' } },
     { secretStore: { provider: 'supabase-vault' } },
     { networking: { domain: 'example.ch', cdn: true } },
+    { networking: { publicBaseUrl: 'ftp://api.example.ch' } },
+    { networking: { publicBaseUrl: 'https://api.example.ch/auth/v1' } },
+    { networking: { publicBaseUrl: 'https://api.example.ch/' } },
   ])('rejects unsupported service selection: %j', (selection) => {
     expect(isInfraEnvironmentSpec({ ...local, ...selection })).toBe(false);
   });

package/src/infra.ts

@@ -12,4 +12,5 @@ export type * from './types/infraAdapters';
 export type * from './types/infraLifecycle';
 export type * from './types/infraManifest';
 export type * from './types/infraSecrets';
+export type * from './types/infraTargets';
 export type * from './types/infraWorkload';

package/src/types/infraAdapters.ts

@@ -19,6 +19,7 @@ import type {
   InfraRuntimeSelection,
 } from './infraManifest';
 import type { InfraControlPlaneCredentialRef, InfraSecretReference } from './infraSecrets';
+import type { InfraComputeTarget } from './infraTargets';
 import type { InfraWorkloadSpec } from './infraWorkload';
 
 /** Package exports must match this exact catalog entry; optional operations are advertised explicitly. */
@@ -28,23 +29,6 @@ export type InfraAdapterDescriptor<P extends InfraAdapterId = InfraAdapterId> =
   };
 }[P];
 
-export type InfraComputeTarget = {
-  readonly id: string;
-  readonly os: 'linux' | 'darwin' | 'windows';
-  readonly architecture: 'amd64' | 'arm64';
-} & (
-  | { readonly kind: 'local-host' }
-  | {
-      readonly kind: 'ssh-host';
-      readonly host: string;
-      readonly port: number;
-      readonly user: string;
-      readonly credential: InfraControlPlaneCredentialRef;
-      /** Expected host key supplied by the compute owner; runtimes must verify host authenticity. */
-      readonly hostKeyFingerprint: string;
-    }
-);
-
 /** Trusted execution-only ports. Implementations must not serialize resolved credential values. */
 export interface InfraExecutionContext {
   readonly projectId: string;
@@ -67,6 +51,11 @@ export interface InfraReconcileResult {
   readonly outputs: readonly InfraOutput[];
 }
 
+/** Current portable compute state resolved without creating, updating or deleting resources. */
+export interface InfraComputeSnapshot extends InfraReconcileResult {
+  readonly targets: readonly InfraComputeTarget[];
+}
+
 export interface InfraComputeAdapter<P extends InfraComputeProviderId = InfraComputeProviderId> {
   readonly descriptor: InfraAdapterDescriptor<P>;
   /** Read-only prerequisites, config and control-plane credential validation. */
@@ -74,6 +63,11 @@ export interface InfraComputeAdapter<P extends InfraComputeProviderId = InfraCom
     context: InfraExecutionContext,
     selection: InfraComputeSelection<P>,
   ): Promise<InfraResult<null>>;
+  /** Read-only discovery for planning and stateless runtime projection. Missing compute is empty. */
+  inspectAsync(
+    context: InfraExecutionContext,
+    selection: InfraComputeSelection<P>,
+  ): Promise<InfraResult<InfraComputeSnapshot>>;
   planAsync(
     context: InfraExecutionContext,
     selection: InfraComputeSelection<P>,
@@ -81,9 +75,7 @@ export interface InfraComputeAdapter<P extends InfraComputeProviderId = InfraCom
   ensureAsync(
     context: InfraExecutionContext,
     selection: InfraComputeSelection<P>,
-  ): Promise<
-    InfraResult<InfraReconcileResult & { readonly targets: readonly InfraComputeTarget[] }>
-  >;
+  ): Promise<InfraResult<InfraComputeSnapshot>>;
   statusAsync(context: InfraExecutionContext): Promise<InfraResult<readonly InfraResourceStatus[]>>;
   destroyAsync(
     context: InfraExecutionContext,

package/src/types/infraLifecycle.ts

@@ -1,6 +1,7 @@
 import type { AppEnvironmentId } from '../environments';
 import type { InfraAdapterId } from './infraManifest';
 import type { InfraSecretReference } from './infraSecrets';
+import type { InfraComputeTarget } from './infraTargets';
 
 /** Identity must be verified before mutation; unowned resources must never be pruned. */
 export interface InfraResourceIdentity {
@@ -89,7 +90,11 @@ export interface InfraLedger {
   readonly schemaVersion: 1;
   readonly projectId: string;
   readonly environment: AppEnvironmentId;
+  /** Last successfully reconciled portable targets required by stateless runtime operations. */
+  readonly targets: readonly InfraComputeTarget[];
   readonly resources: readonly InfraOwnedResource[];
+  /** Last successfully reconciled public values and privileged references; never resolved secrets. */
+  readonly outputs: readonly InfraOutput[];
   readonly artifacts: readonly { readonly owner: InfraResourceIdentity; readonly path: string }[];
 }
 

package/src/types/infraManifest.ts

@@ -118,6 +118,8 @@ export type InfraSecretStoreSpec = {
 export interface InfraNetworkingSpec {
   /** Public DNS name intent, not automatic DNS/CDN vendor provisioning. */
   readonly domain?: string;
+  /** Absolute HTTP(S) origin used by workloads that must know their external URL at startup. */
+  readonly publicBaseUrl?: string;
 }
 
 export interface InfraEnvironmentSpec {

package/src/types/infraTargets.ts

@@ -0,0 +1,19 @@
+import type { InfraControlPlaneCredentialRef } from './infraSecrets';
+
+/** Portable runtime target state contains credential identity only, never resolved values. */
+export type InfraComputeTarget = {
+  readonly id: string;
+  readonly os: 'linux' | 'darwin' | 'windows';
+  readonly architecture: 'amd64' | 'arm64';
+} & (
+  | { readonly kind: 'local-host' }
+  | {
+      readonly kind: 'ssh-host';
+      readonly host: string;
+      readonly port: number;
+      readonly user: string;
+      readonly credential: InfraControlPlaneCredentialRef;
+      /** Expected host key supplied by the compute owner; runtimes must verify host authenticity. */
+      readonly hostKeyFingerprint: string;
+    }
+);

package/src/types/infraWorkload.ts

@@ -6,7 +6,7 @@ export interface InfraWorkloadArtifact {
   readonly image: string;
 }
 
-export type InfraWorkloadValue =
+export type InfraWorkloadScalarValue =
   | { readonly kind: 'literal'; readonly value: string }
   | { readonly kind: 'secret'; readonly reference: InfraSecretReference }
   | {
@@ -16,6 +16,14 @@ export type InfraWorkloadValue =
     }
   | { readonly kind: 'output'; readonly resourceId: string; readonly output: string };
 
+export type InfraWorkloadValue =
+  | InfraWorkloadScalarValue
+  | {
+      readonly kind: 'template';
+      /** Ordered scalar segments materialized into one value only at the runtime boundary. */
+      readonly segments: readonly InfraWorkloadScalarValue[];
+    };
+
 export interface InfraWorkloadPort {
   readonly name: string;
   readonly port: number;