@ankhorage/contracts 26.2.0 → 26.2.2

package/dist/infra/isInfraEnvironmentSpec.js.map

@@ -1 +1 @@
-{"version":3,"file":"isInfraEnvironmentSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraEnvironmentSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAQxD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,CACL,kBAAkB,CAAC,KAAK,CAAC;QACzB,sBAAsB,CAAC,KAAK,CAAC;QAC7B,0BAA0B,CAAC,KAAK,CAAC;QACjC,uBAAuB,CAAC,KAAK,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,UAAU,EAAE,qBAAqB;QACjC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS;YACtB,YAAY,CAAC,QAAQ,EAAE;gBACrB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;gBAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;gBACvE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,yBAAyB,CAAC,MAAM,CAAC;aAC9E,CAAC;QACJ,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC;QAC7E,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC;QAC3D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ;gBAC7C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;gBAClD,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC;aAC1E,CAAC;QACJ,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,gBAAgB;gBACrD,MAAM,EAAE,WAAW,CAAC,YAAY;aACjC,CAAC;QACJ,UAAU,EAAE,CAAC,UAAU,EAAE,EAAE,CACzB,UAAU,KAAK,SAAS;YACxB,YAAY,CAAC,UAAU,EAAE;gBACvB,MAAM,EAAE,WAAW,CAAC,YAAY;gBAChC,aAAa,EAAE,CAAC,aAAa,EAAE,EAAE,CAC/B,aAAa,KAAK,SAAS,IAAI,kBAAkB,CAAC,aAAa,CAAC;gBAClE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CACX,GAAG,KAAK,SAAS;oBACjB,YAAY,CAAC,GAAG,EAAE;wBAChB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,cAAc;wBACvC,YAAY,EAAE,gBAAgB;qBAC/B,CAAC;aACL,CAAC;QACJ,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC;KACjC,CAAC,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,0BAA0B,CAAC,KAA2B;IAC7D,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7B,IAAI,UAAU,EAAE,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,CAAC,MAAM,CAAC;AACzE,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACzB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAClB,gBAAgB,CAAC,IAAI,CAAC;YACtB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACrB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC/B,gBAAgB,CAAC,OAAO,CAAC,CAC5B,CACF,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW;QACpC,MAAM,EAAE,qBAAqB;QAC7B,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ,KAAK,SAAS;YACtB,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,oBAAoB;QACjC,cAAc,EAAE,CAAC,cAAc,EAAE,EAAE,CACjC,cAAc,KAAK,SAAS,IAAI,OAAO,cAAc,KAAK,SAAS;KACtE,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,CAAC,QAAiB,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAC5D,OAAO,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,iBAAiB,CAAC,OAAO,CAAC;KACnF,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC,KAAK,EAAE;YACzB,GAAG,MAAM;YACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;YAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,qBAAqB,CAAC,OAAO,CAAC;SACW,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,GAAG,MAAM;QACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY;QACnC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC;KACV,CAAC,CAAC;AACxF,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACzB,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,EAAE,KAAK,UAAU,CACxF,CACF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,uBAAuB,CAAC,KAA2B;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAChE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CACnD,CACF,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED,kGAAkG;AAClG,SAAS,sBAAsB,CAAC,KAA2B;IACzD,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,WAAW;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAC1D,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS;QACnC,SAAS;QACT,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;QAChC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { isSerializableSet } from '../collections';\nimport { INFRA_ADAPTER_CATALOG } from '../infraCatalog';\nimport type {\n  InfraEnvironmentSpec,\n  InfraObjectStorageSpec,\n  InfraS3PersistenceTarget,\n  InfraScheduledDatabaseBackupSpec,\n} from '../types/infraManifest';\nimport type { InfraShape } from '../types/infraValidation';\nimport { infraFields } from './infraFields';\nimport { isInfraAuthSpec } from './isInfraAuthSpec';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraDeploymentSpec } from './isInfraDeploymentSpec';\nimport { isInfraShape } from './isInfraShape';\nimport { isInfraWorkloadSpec } from './isInfraWorkloadSpec';\n\n/*** Validate sibling capabilities and their required relationships within one environment. */\nexport function isInfraEnvironmentSpec(value: unknown): value is InfraEnvironmentSpec {\n  return (\n    isEnvironmentShape(value) &&\n    hasServiceDependencies(value) &&\n    hasNetworkingRelationships(value) &&\n    hasUniquePublishedPorts(value)\n  );\n}\n\n/*** Check all environment field shapes before inspecting canonical dependency metadata. */\nfunction isEnvironmentShape(value: unknown): value is InfraEnvironmentSpec {\n  return isInfraShape(value, {\n    deployment: isInfraDeploymentSpec,\n    database: (database) =>\n      database === undefined ||\n      isInfraShape(database, {\n        provider: (provider) => provider === 'supabase',\n        tier: (tier) => tier === undefined || tier === 'dev' || tier === 'prod',\n        backup: (backup) => backup === undefined || isScheduledDatabaseBackup(backup),\n      }),\n    objectStorage: (storage) => storage === undefined || isObjectStorage(storage),\n    auth: (auth) => auth === undefined || isInfraAuthSpec(auth),\n    authz: (authz) =>\n      authz === undefined ||\n      isInfraShape(authz, {\n        provider: (provider) => provider === 'cerbos',\n        kind: (kind) => kind === 'ABAC' || kind === 'RBAC',\n        policies: (policies) => policies === undefined || isPolicyFiles(policies),\n      }),\n    secretStore: (store) =>\n      store === undefined ||\n      isInfraShape(store, {\n        provider: (provider) => provider === 'supabase-vault',\n        schema: infraFields.optionalText,\n      }),\n    networking: (networking) =>\n      networking === undefined ||\n      isInfraShape(networking, {\n        domain: infraFields.optionalText,\n        publicBaseUrl: (publicBaseUrl) =>\n          publicBaseUrl === undefined || isPublicHttpOrigin(publicBaseUrl),\n        tls: (tls) =>\n          tls === undefined ||\n          isInfraShape(tls, {\n            mode: (mode) => mode === 'acme-http-01',\n            contactEmail: isNonEmptyString,\n          }),\n      }),\n    workloads: (workloads) => workloads === undefined || isWorkloads(workloads),\n  } satisfies InfraShape<InfraEnvironmentSpec>);\n}\n\n/*** Public workload configuration uses one canonical absolute HTTP(S) origin without path state. */\nfunction isPublicHttpOrigin(value: unknown): boolean {\n  if (!isNonEmptyString(value)) return false;\n  try {\n    const url = new URL(value);\n    return (url.protocol === 'http:' || url.protocol === 'https:') && url.origin === value;\n  } catch {\n    return false;\n  }\n}\n\n/*** Automatic TLS requires one matching HTTPS origin and public DNS hostname. */\nfunction hasNetworkingRelationships(value: InfraEnvironmentSpec): boolean {\n  const { networking } = value;\n  if (networking?.tls === undefined) return true;\n  if (networking.domain === undefined || networking.publicBaseUrl === undefined) return false;\n  const url = new URL(networking.publicBaseUrl);\n  return url.protocol === 'https:' && url.hostname === networking.domain;\n}\n\n/*** Validate portable, unique Cerbos policy files without host paths or traversal. */\nfunction isPolicyFiles(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    Object.entries(value).every(\n      ([path, content]) =>\n        isNonEmptyString(path) &&\n        !path.startsWith('/') &&\n        !path.split('/').includes('..') &&\n        isNonEmptyString(content),\n    )\n  );\n}\n\n/*** Validate provider-neutral scheduled database backup intent. */\nfunction isScheduledDatabaseBackup(value: unknown): value is InfraScheduledDatabaseBackupSpec {\n  return isInfraShape(value, {\n    mode: (mode) => mode === 'scheduled',\n    target: isS3PersistenceTarget,\n    intervalHours: (interval) =>\n      interval === undefined ||\n      (typeof interval === 'number' && Number.isInteger(interval) && interval > 0),\n  });\n}\n\n/*** Validate one portable S3-compatible persistence target without resolving credentials. */\nfunction isS3PersistenceTarget(value: unknown): value is InfraS3PersistenceTarget {\n  return isInfraShape(value, {\n    endpoint: isPublicHttpOrigin,\n    region: isNonEmptyString,\n    bucket: isNonEmptyString,\n    credentials: isInfraCredentialRef,\n    forcePathStyle: (forcePathStyle) =>\n      forcePathStyle === undefined || typeof forcePathStyle === 'boolean',\n  });\n}\n\n/*** Object storage can vary independently from database/auth; there is no implicit auto provider. */\nfunction isObjectStorage(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  const common = {\n    provider: (provider: unknown) => provider === value.provider,\n    buckets: (buckets: unknown) => buckets === undefined || isSerializableSet(buckets),\n  };\n  if (value.provider === 'supabase') {\n    return isInfraShape(value, {\n      ...common,\n      provider: (provider) => provider === 'supabase',\n      backend: (backend) => backend === undefined || isS3PersistenceTarget(backend),\n    } satisfies InfraShape<Extract<InfraObjectStorageSpec, { readonly provider: 'supabase' }>>);\n  }\n  return isInfraShape(value, {\n    ...common,\n    provider: (provider) => provider === 'r2',\n    accountId: infraFields.optionalText,\n    credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),\n  } satisfies InfraShape<Extract<InfraObjectStorageSpec, { readonly provider: 'r2' }>>);\n}\n\n/*** Duplicate desired workload identities cannot be reconciled safely. */\nfunction isWorkloads(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    Object.entries(value).every(\n      ([workloadId, workload]) => isInfraWorkloadSpec(workload) && workload.id === workloadId,\n    )\n  );\n}\n\n/*** Prevent two workloads in one environment from claiming the same external listener. */\nfunction hasUniquePublishedPorts(value: InfraEnvironmentSpec): boolean {\n  const ports = Object.values(value.workloads ?? {}).flatMap((workload) =>\n    Object.values(workload.ports ?? {}).flatMap(({ publishedPort }) =>\n      publishedPort === undefined ? [] : [publishedPort],\n    ),\n  );\n  return new Set(ports).size === ports.length;\n}\n\n/*** Check catalog dependencies against selected sibling capabilities and runtime capabilities. */\nfunction hasServiceDependencies(value: InfraEnvironmentSpec): boolean {\n  const selections = [\n    value.database,\n    value.auth,\n    value.authz,\n    value.objectStorage,\n    value.secretStore,\n  ];\n  const runtime = Object.values(INFRA_ADAPTER_CATALOG).find(\n    (entry) => entry.id === value.deployment.runtime.provider,\n  );\n  const capabilities = new Set<string>([\n    'compute',\n    ...(runtime?.capabilities ?? []),\n    ...Object.entries(value)\n      .filter(([, selection]) => selection !== undefined)\n      .map(([capability]) => capability),\n  ]);\n  return Object.values(INFRA_ADAPTER_CATALOG)\n    .filter((entry) => selections.some((selection) => selection?.provider === entry.id))\n    .every((entry) => entry.dependencies.every((dependency) => capabilities.has(dependency)));\n}\n"]}
+{"version":3,"file":"isInfraEnvironmentSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraEnvironmentSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAQ3D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,CACL,kBAAkB,CAAC,KAAK,CAAC;QACzB,sBAAsB,CAAC,KAAK,CAAC;QAC7B,0BAA0B,CAAC,KAAK,CAAC;QACjC,uBAAuB,CAAC,KAAK,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,UAAU,EAAE,qBAAqB;QACjC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS;YACtB,YAAY,CAAC,QAAQ,EAAE;gBACrB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;gBAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;gBACvE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,yBAAyB,CAAC,MAAM,CAAC;aAC9E,CAAC;QACJ,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC;QAC7E,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC;QAC3D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ;gBAC7C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;gBAClD,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC;aAC1E,CAAC;QACJ,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,KAAK,KAAK,SAAS;YACnB,YAAY,CAAC,KAAK,EAAE;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,gBAAgB;gBACrD,MAAM,EAAE,WAAW,CAAC,YAAY;aACjC,CAAC;QACJ,UAAU,EAAE,CAAC,UAAU,EAAE,EAAE,CACzB,UAAU,KAAK,SAAS;YACxB,YAAY,CAAC,UAAU,EAAE;gBACvB,MAAM,EAAE,WAAW,CAAC,YAAY;gBAChC,aAAa,EAAE,CAAC,aAAa,EAAE,EAAE,CAC/B,aAAa,KAAK,SAAS,IAAI,kBAAkB,CAAC,aAAa,CAAC;gBAClE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CACX,GAAG,KAAK,SAAS;oBACjB,YAAY,CAAC,GAAG,EAAE;wBAChB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,cAAc;wBACvC,YAAY,EAAE,gBAAgB;qBAC/B,CAAC;aACL,CAAC;QACJ,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC;KACjC,CAAC,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,0BAA0B,CAAC,KAA2B;IAC7D,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7B,IAAI,UAAU,EAAE,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,CAAC,MAAM,CAAC;AACzE,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACzB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAClB,gBAAgB,CAAC,IAAI,CAAC;YACtB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACrB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC/B,gBAAgB,CAAC,OAAO,CAAC,CAC5B,CACF,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW;QACpC,MAAM,EAAE,qBAAqB;QAC7B,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ,KAAK,SAAS;YACtB,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,oBAAoB;QACjC,cAAc,EAAE,CAAC,cAAc,EAAE,EAAE,CACjC,cAAc,KAAK,SAAS,IAAI,OAAO,cAAc,KAAK,SAAS;KACtE,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,CAAC,QAAiB,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAC5D,OAAO,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,iBAAiB,CAAC,OAAO,CAAC;KACnF,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC,KAAK,EAAE;YACzB,GAAG,MAAM;YACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU;YAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,qBAAqB,CAAC,OAAO,CAAC;SACW,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,GAAG,MAAM;QACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY;QACnC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC;KACV,CAAC,CAAC;AACxF,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACzB,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,EAAE,KAAK,UAAU,CACxF,CACF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,uBAAuB,CAAC,KAA2B;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAChE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CACnD,CACF,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED,kGAAkG;AAClG,SAAS,sBAAsB,CAAC,KAA2B;IACzD,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,WAAW;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAC1D,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS;QACnC,SAAS;QACT,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;QAChC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { isSerializableSet } from '../collections.js';\nimport { INFRA_ADAPTER_CATALOG } from '../infraCatalog.js';\nimport type {\n  InfraEnvironmentSpec,\n  InfraObjectStorageSpec,\n  InfraS3PersistenceTarget,\n  InfraScheduledDatabaseBackupSpec,\n} from '../types/infraManifest.js';\nimport type { InfraShape } from '../types/infraValidation.js';\nimport { infraFields } from './infraFields.js';\nimport { isInfraAuthSpec } from './isInfraAuthSpec.js';\nimport { isInfraCredentialRef } from './isInfraCredentialRef.js';\nimport { isInfraDeploymentSpec } from './isInfraDeploymentSpec.js';\nimport { isInfraShape } from './isInfraShape.js';\nimport { isInfraWorkloadSpec } from './isInfraWorkloadSpec.js';\n\n/*** Validate sibling capabilities and their required relationships within one environment. */\nexport function isInfraEnvironmentSpec(value: unknown): value is InfraEnvironmentSpec {\n  return (\n    isEnvironmentShape(value) &&\n    hasServiceDependencies(value) &&\n    hasNetworkingRelationships(value) &&\n    hasUniquePublishedPorts(value)\n  );\n}\n\n/*** Check all environment field shapes before inspecting canonical dependency metadata. */\nfunction isEnvironmentShape(value: unknown): value is InfraEnvironmentSpec {\n  return isInfraShape(value, {\n    deployment: isInfraDeploymentSpec,\n    database: (database) =>\n      database === undefined ||\n      isInfraShape(database, {\n        provider: (provider) => provider === 'supabase',\n        tier: (tier) => tier === undefined || tier === 'dev' || tier === 'prod',\n        backup: (backup) => backup === undefined || isScheduledDatabaseBackup(backup),\n      }),\n    objectStorage: (storage) => storage === undefined || isObjectStorage(storage),\n    auth: (auth) => auth === undefined || isInfraAuthSpec(auth),\n    authz: (authz) =>\n      authz === undefined ||\n      isInfraShape(authz, {\n        provider: (provider) => provider === 'cerbos',\n        kind: (kind) => kind === 'ABAC' || kind === 'RBAC',\n        policies: (policies) => policies === undefined || isPolicyFiles(policies),\n      }),\n    secretStore: (store) =>\n      store === undefined ||\n      isInfraShape(store, {\n        provider: (provider) => provider === 'supabase-vault',\n        schema: infraFields.optionalText,\n      }),\n    networking: (networking) =>\n      networking === undefined ||\n      isInfraShape(networking, {\n        domain: infraFields.optionalText,\n        publicBaseUrl: (publicBaseUrl) =>\n          publicBaseUrl === undefined || isPublicHttpOrigin(publicBaseUrl),\n        tls: (tls) =>\n          tls === undefined ||\n          isInfraShape(tls, {\n            mode: (mode) => mode === 'acme-http-01',\n            contactEmail: isNonEmptyString,\n          }),\n      }),\n    workloads: (workloads) => workloads === undefined || isWorkloads(workloads),\n  } satisfies InfraShape<InfraEnvironmentSpec>);\n}\n\n/*** Public workload configuration uses one canonical absolute HTTP(S) origin without path state. */\nfunction isPublicHttpOrigin(value: unknown): boolean {\n  if (!isNonEmptyString(value)) return false;\n  try {\n    const url = new URL(value);\n    return (url.protocol === 'http:' || url.protocol === 'https:') && url.origin === value;\n  } catch {\n    return false;\n  }\n}\n\n/*** Automatic TLS requires one matching HTTPS origin and public DNS hostname. */\nfunction hasNetworkingRelationships(value: InfraEnvironmentSpec): boolean {\n  const { networking } = value;\n  if (networking?.tls === undefined) return true;\n  if (networking.domain === undefined || networking.publicBaseUrl === undefined) return false;\n  const url = new URL(networking.publicBaseUrl);\n  return url.protocol === 'https:' && url.hostname === networking.domain;\n}\n\n/*** Validate portable, unique Cerbos policy files without host paths or traversal. */\nfunction isPolicyFiles(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    Object.entries(value).every(\n      ([path, content]) =>\n        isNonEmptyString(path) &&\n        !path.startsWith('/') &&\n        !path.split('/').includes('..') &&\n        isNonEmptyString(content),\n    )\n  );\n}\n\n/*** Validate provider-neutral scheduled database backup intent. */\nfunction isScheduledDatabaseBackup(value: unknown): value is InfraScheduledDatabaseBackupSpec {\n  return isInfraShape(value, {\n    mode: (mode) => mode === 'scheduled',\n    target: isS3PersistenceTarget,\n    intervalHours: (interval) =>\n      interval === undefined ||\n      (typeof interval === 'number' && Number.isInteger(interval) && interval > 0),\n  });\n}\n\n/*** Validate one portable S3-compatible persistence target without resolving credentials. */\nfunction isS3PersistenceTarget(value: unknown): value is InfraS3PersistenceTarget {\n  return isInfraShape(value, {\n    endpoint: isPublicHttpOrigin,\n    region: isNonEmptyString,\n    bucket: isNonEmptyString,\n    credentials: isInfraCredentialRef,\n    forcePathStyle: (forcePathStyle) =>\n      forcePathStyle === undefined || typeof forcePathStyle === 'boolean',\n  });\n}\n\n/*** Object storage can vary independently from database/auth; there is no implicit auto provider. */\nfunction isObjectStorage(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  const common = {\n    provider: (provider: unknown) => provider === value.provider,\n    buckets: (buckets: unknown) => buckets === undefined || isSerializableSet(buckets),\n  };\n  if (value.provider === 'supabase') {\n    return isInfraShape(value, {\n      ...common,\n      provider: (provider) => provider === 'supabase',\n      backend: (backend) => backend === undefined || isS3PersistenceTarget(backend),\n    } satisfies InfraShape<Extract<InfraObjectStorageSpec, { readonly provider: 'supabase' }>>);\n  }\n  return isInfraShape(value, {\n    ...common,\n    provider: (provider) => provider === 'r2',\n    accountId: infraFields.optionalText,\n    credentials: (credentials) => credentials === undefined || isInfraCredentialRef(credentials),\n  } satisfies InfraShape<Extract<InfraObjectStorageSpec, { readonly provider: 'r2' }>>);\n}\n\n/*** Duplicate desired workload identities cannot be reconciled safely. */\nfunction isWorkloads(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    Object.entries(value).every(\n      ([workloadId, workload]) => isInfraWorkloadSpec(workload) && workload.id === workloadId,\n    )\n  );\n}\n\n/*** Prevent two workloads in one environment from claiming the same external listener. */\nfunction hasUniquePublishedPorts(value: InfraEnvironmentSpec): boolean {\n  const ports = Object.values(value.workloads ?? {}).flatMap((workload) =>\n    Object.values(workload.ports ?? {}).flatMap(({ publishedPort }) =>\n      publishedPort === undefined ? [] : [publishedPort],\n    ),\n  );\n  return new Set(ports).size === ports.length;\n}\n\n/*** Check catalog dependencies against selected sibling capabilities and runtime capabilities. */\nfunction hasServiceDependencies(value: InfraEnvironmentSpec): boolean {\n  const selections = [\n    value.database,\n    value.auth,\n    value.authz,\n    value.objectStorage,\n    value.secretStore,\n  ];\n  const runtime = Object.values(INFRA_ADAPTER_CATALOG).find(\n    (entry) => entry.id === value.deployment.runtime.provider,\n  );\n  const capabilities = new Set<string>([\n    'compute',\n    ...(runtime?.capabilities ?? []),\n    ...Object.entries(value)\n      .filter(([, selection]) => selection !== undefined)\n      .map(([capability]) => capability),\n  ]);\n  return Object.values(INFRA_ADAPTER_CATALOG)\n    .filter((entry) => selections.some((selection) => selection?.provider === entry.id))\n    .every((entry) => entry.dependencies.every((dependency) => capabilities.has(dependency)));\n}\n"]}

package/dist/infra/isInfraManifest.d.ts

@@ -1,4 +1,4 @@
-import type { InfraManifest } from '../types/infraManifest';
+import type { InfraManifest } from '../types/infraManifest.js';
 /*** Validate standalone infrastructure without AppManifest, Deploy or provider package side effects. */
 export declare function isInfraManifest(value: unknown): value is InfraManifest;
 //# sourceMappingURL=isInfraManifest.d.ts.map

package/dist/infra/isInfraManifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isInfraManifest.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraManifest.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAmB,MAAM,wBAAwB,CAAC;AAK7E,wGAAwG;AACxG,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAMtE"}
+{"version":3,"file":"isInfraManifest.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraManifest.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAmB,MAAM,2BAA2B,CAAC;AAKhF,wGAAwG;AACxG,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAMtE"}

package/dist/infra/isInfraManifest.js

@@ -1,9 +1,9 @@
 import { isRecord } from '@ankhorage/utility/object';
-import { isApiDefinitionRegistry } from '../data/isApiDefinitionRegistry';
-import { APP_ENVIRONMENT_IDS } from '../environments';
-import { isSerializableValue } from '../serializable';
-import { isInfraEnvironmentSpec } from './isInfraEnvironmentSpec';
-import { isInfraShape } from './isInfraShape';
+import { isApiDefinitionRegistry } from '../data/isApiDefinitionRegistry.js';
+import { APP_ENVIRONMENT_IDS } from '../environments.js';
+import { isSerializableValue } from '../serializable.js';
+import { isInfraEnvironmentSpec } from './isInfraEnvironmentSpec.js';
+import { isInfraShape } from './isInfraShape.js';
 /*** Validate standalone infrastructure without AppManifest, Deploy or provider package side effects. */
 export function isInfraManifest(value) {
     return isInfraShape(value, {

package/dist/infra/isInfraManifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"isInfraManifest.js","sourceRoot":"","sources":["../../src/infra/isInfraManifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,wGAAwG;AACxG,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,cAAc;QAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,uBAAuB,CAAC,IAAI,CAAC;QACnE,OAAO,EAAE,gBAAgB;KACU,CAAC,CAAC;AACzC,CAAC;AAED,sGAAsG;AACtG,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAChC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,CACrB,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC;QAC5C,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACrE,CAAC;AAED,2CAA2C;AAC3C,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,CAAC;KACxE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\n\nimport { isApiDefinitionRegistry } from '../data/isApiDefinitionRegistry';\nimport { APP_ENVIRONMENT_IDS } from '../environments';\nimport { isSerializableValue } from '../serializable';\nimport type { InfraManifest, InfraModuleSpec } from '../types/infraManifest';\nimport type { InfraShape } from '../types/infraValidation';\nimport { isInfraEnvironmentSpec } from './isInfraEnvironmentSpec';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Validate standalone infrastructure without AppManifest, Deploy or provider package side effects. */\nexport function isInfraManifest(value: unknown): value is InfraManifest {\n  return isInfraShape(value, {\n    environments: isEnvironments,\n    apis: (apis) => apis === undefined || isApiDefinitionRegistry(apis),\n    modules: isModuleRegistry,\n  } satisfies InfraShape<InfraManifest>);\n}\n\n/*** Local is required; preview and production are optional but never inferred from arbitrary keys. */\nfunction isEnvironments(value: unknown): boolean {\n  if (!isRecord(value) || !isInfraEnvironmentSpec(value.local)) return false;\n  return Object.entries(value).every(\n    ([key, environment]) =>\n      APP_ENVIRONMENT_IDS.some((id) => id === key) &&\n      ((environment === undefined && key !== 'local') || isInfraEnvironmentSpec(environment)),\n  );\n}\n\n/*** Validate installed module identity and optional serializable module-owned configuration. */\nfunction isModuleRegistry(value: unknown): boolean {\n  return isRecord(value) && Object.values(value).every(isModuleSpec);\n}\n\n/*** Validate one module registry entry. */\nfunction isModuleSpec(value: unknown): value is InfraModuleSpec {\n  return isInfraShape(value, {\n    config: (config) => config === undefined || isSerializableValue(config),\n  });\n}\n"]}
+{"version":3,"file":"isInfraManifest.js","sourceRoot":"","sources":["../../src/infra/isInfraManifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,wGAAwG;AACxG,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,cAAc;QAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,uBAAuB,CAAC,IAAI,CAAC;QACnE,OAAO,EAAE,gBAAgB;KACU,CAAC,CAAC;AACzC,CAAC;AAED,sGAAsG;AACtG,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAChC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,CACrB,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC;QAC5C,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACrE,CAAC;AAED,2CAA2C;AAC3C,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,CAAC;KACxE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\n\nimport { isApiDefinitionRegistry } from '../data/isApiDefinitionRegistry.js';\nimport { APP_ENVIRONMENT_IDS } from '../environments.js';\nimport { isSerializableValue } from '../serializable.js';\nimport type { InfraManifest, InfraModuleSpec } from '../types/infraManifest.js';\nimport type { InfraShape } from '../types/infraValidation.js';\nimport { isInfraEnvironmentSpec } from './isInfraEnvironmentSpec.js';\nimport { isInfraShape } from './isInfraShape.js';\n\n/*** Validate standalone infrastructure without AppManifest, Deploy or provider package side effects. */\nexport function isInfraManifest(value: unknown): value is InfraManifest {\n  return isInfraShape(value, {\n    environments: isEnvironments,\n    apis: (apis) => apis === undefined || isApiDefinitionRegistry(apis),\n    modules: isModuleRegistry,\n  } satisfies InfraShape<InfraManifest>);\n}\n\n/*** Local is required; preview and production are optional but never inferred from arbitrary keys. */\nfunction isEnvironments(value: unknown): boolean {\n  if (!isRecord(value) || !isInfraEnvironmentSpec(value.local)) return false;\n  return Object.entries(value).every(\n    ([key, environment]) =>\n      APP_ENVIRONMENT_IDS.some((id) => id === key) &&\n      ((environment === undefined && key !== 'local') || isInfraEnvironmentSpec(environment)),\n  );\n}\n\n/*** Validate installed module identity and optional serializable module-owned configuration. */\nfunction isModuleRegistry(value: unknown): boolean {\n  return isRecord(value) && Object.values(value).every(isModuleSpec);\n}\n\n/*** Validate one module registry entry. */\nfunction isModuleSpec(value: unknown): value is InfraModuleSpec {\n  return isInfraShape(value, {\n    config: (config) => config === undefined || isSerializableValue(config),\n  });\n}\n"]}

package/dist/infra/isInfraWorkloadHealth.js

@@ -1,6 +1,6 @@
 import { isRecord } from '@ankhorage/utility/object';
-import { infraFields } from './infraFields';
-import { isInfraShape } from './isInfraShape';
+import { infraFields } from './infraFields.js';
+import { isInfraShape } from './isInfraShape.js';
 /*** Validate runtime-neutral readiness probes and bounded numeric parameters. */
 export function isInfraWorkloadHealth(value) {
     if (!isRecord(value))

package/dist/infra/isInfraWorkloadHealth.js.map

@@ -1 +1 @@
-{"version":3,"file":"isInfraWorkloadHealth.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadHealth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG;QACb,eAAe,EAAE,WAAW,CAAC,uBAAuB;QACpD,cAAc,EAAE,WAAW,CAAC,uBAAuB;QACnD,gBAAgB,EAAE,WAAW,CAAC,uBAAuB;KACtD,CAAC;IACF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,GAAG,MAAM;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM;gBAC/B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;aACjE,CAAC,CAAC;QACL,KAAK,KAAK;YACR,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,GAAG,MAAM;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK;gBAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;aACvB,CAAC,CAAC;QACL,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,GAAG,MAAM;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS;gBAClC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CACnB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aAC/E,CAAC,CAAC;QACL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\n\nimport { infraFields } from './infraFields';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Validate runtime-neutral readiness probes and bounded numeric parameters. */\nexport function isInfraWorkloadHealth(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  const timing = {\n    intervalSeconds: infraFields.optionalPositiveInteger,\n    timeoutSeconds: infraFields.optionalPositiveInteger,\n    failureThreshold: infraFields.optionalPositiveInteger,\n  };\n  switch (value.kind) {\n    case 'http':\n      return isInfraShape(value, {\n        ...timing,\n        kind: (kind) => kind === 'http',\n        port: infraFields.port,\n        path: (path) => typeof path === 'string' && path.startsWith('/'),\n      });\n    case 'tcp':\n      return isInfraShape(value, {\n        ...timing,\n        kind: (kind) => kind === 'tcp',\n        port: infraFields.port,\n      });\n    case 'command':\n      return isInfraShape(value, {\n        ...timing,\n        kind: (kind) => kind === 'command',\n        command: (command) =>\n          Array.isArray(command) && command.length > 0 && infraFields.strings(command),\n      });\n    default:\n      return false;\n  }\n}\n"]}
+{"version":3,"file":"isInfraWorkloadHealth.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadHealth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG;QACb,eAAe,EAAE,WAAW,CAAC,uBAAuB;QACpD,cAAc,EAAE,WAAW,CAAC,uBAAuB;QACnD,gBAAgB,EAAE,WAAW,CAAC,uBAAuB;KACtD,CAAC;IACF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,GAAG,MAAM;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM;gBAC/B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;aACjE,CAAC,CAAC;QACL,KAAK,KAAK;YACR,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,GAAG,MAAM;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK;gBAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;aACvB,CAAC,CAAC;QACL,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,GAAG,MAAM;gBACT,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS;gBAClC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CACnB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aAC/E,CAAC,CAAC;QACL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\n\nimport { infraFields } from './infraFields.js';\nimport { isInfraShape } from './isInfraShape.js';\n\n/*** Validate runtime-neutral readiness probes and bounded numeric parameters. */\nexport function isInfraWorkloadHealth(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  const timing = {\n    intervalSeconds: infraFields.optionalPositiveInteger,\n    timeoutSeconds: infraFields.optionalPositiveInteger,\n    failureThreshold: infraFields.optionalPositiveInteger,\n  };\n  switch (value.kind) {\n    case 'http':\n      return isInfraShape(value, {\n        ...timing,\n        kind: (kind) => kind === 'http',\n        port: infraFields.port,\n        path: (path) => typeof path === 'string' && path.startsWith('/'),\n      });\n    case 'tcp':\n      return isInfraShape(value, {\n        ...timing,\n        kind: (kind) => kind === 'tcp',\n        port: infraFields.port,\n      });\n    case 'command':\n      return isInfraShape(value, {\n        ...timing,\n        kind: (kind) => kind === 'command',\n        command: (command) =>\n          Array.isArray(command) && command.length > 0 && infraFields.strings(command),\n      });\n    default:\n      return false;\n  }\n}\n"]}

package/dist/infra/isInfraWorkloadSpec.d.ts

@@ -1,4 +1,4 @@
-import type { InfraWorkloadSpec } from '../types/infraWorkload';
+import type { InfraWorkloadSpec } from '../types/infraWorkload.js';
 /*** Validate the portable desired workload; runtime-specific fields and plaintext secret objects fail. */
 export declare function isInfraWorkloadSpec(value: unknown): value is InfraWorkloadSpec;
 //# sourceMappingURL=isInfraWorkloadSpec.d.ts.map

package/dist/infra/isInfraWorkloadSpec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isInfraWorkloadSpec.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadSpec.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAMhE,0GAA0G;AAC1G,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CA8B9E"}
+{"version":3,"file":"isInfraWorkloadSpec.d.ts","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadSpec.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAMnE,0GAA0G;AAC1G,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CA8B9E"}

package/dist/infra/isInfraWorkloadSpec.js

@@ -1,11 +1,11 @@
 import { isStringArray } from '@ankhorage/utility/array';
 import { isRecord } from '@ankhorage/utility/object';
 import { isNonEmptyString } from '@ankhorage/utility/string';
-import { isSerializableSet } from '../collections';
-import { infraFields } from './infraFields';
-import { isInfraShape } from './isInfraShape';
-import { isInfraWorkloadHealth } from './isInfraWorkloadHealth';
-import { isInfraWorkloadValue } from './isInfraWorkloadValue';
+import { isSerializableSet } from '../collections.js';
+import { infraFields } from './infraFields.js';
+import { isInfraShape } from './isInfraShape.js';
+import { isInfraWorkloadHealth } from './isInfraWorkloadHealth.js';
+import { isInfraWorkloadValue } from './isInfraWorkloadValue.js';
 /*** Validate the portable desired workload; runtime-specific fields and plaintext secret objects fail. */
 export function isInfraWorkloadSpec(value) {
     if (!isInfraShape(value, {

package/dist/infra/isInfraWorkloadSpec.js.map

@@ -1 +1 @@
-{"version":3,"file":"isInfraWorkloadSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,0GAA0G;AAC1G,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IACE,CAAC,YAAY,CAAC,KAAK,EAAE;QACnB,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,YAAY,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACvF,OAAO,EAAE,WAAW,CAAC,eAAe;QACpC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC;QACzD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC;QAC9D,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAC3B,WAAW,KAAK,SAAS;YACzB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACnF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC;QACzD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,qBAAqB,CAAC,MAAM,CAAC;QACzE,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CACvB,SAAS,KAAK,SAAS;YACvB,YAAY,CAAC,SAAS,EAAE;gBACtB,SAAS,EAAE,WAAW,CAAC,uBAAuB;gBAC9C,SAAS,EAAE,WAAW,CAAC,uBAAuB;aAC/C,CAAC;QACJ,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAC5E,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,QAAQ;QAC5E,QAAQ,EAAE,WAAW,CAAC,0BAA0B;QAChD,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,iBAAiB,CAAC,SAAS,CAAC;KAC1C,CAAC,EAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CACtF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK;QAC1F,aAAa,EAAE,WAAW,CAAC,YAAY;KACxC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,sBAAsB,CAAC,QAAiB;IAC/C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,CACL,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;QAC5C,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ;gBAC7B,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS;oBAC9B,CAAC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACzB,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAC3F,CACF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IACE,CAAC,OAAO,CAAC,KAAK,CACZ,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CACvF,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrD,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,CAAC;AACxD,CAAC;AAED,wGAAwG;AACxG,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,EAAE,EAAE,gBAAgB;QACpB,SAAS,EAAE,sBAAsB;QACjC,OAAO,EAAE,WAAW,CAAC,eAAe;QACpC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;QACtD,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,mBAAmB;KACtF,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACjC,CAAC;AACJ,CAAC","sourcesContent":["import { isStringArray } from '@ankhorage/utility/array';\nimport { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { isSerializableSet } from '../collections';\nimport type { InfraShape } from '../types/infraValidation';\nimport type { InfraWorkloadSpec } from '../types/infraWorkload';\nimport { infraFields } from './infraFields';\nimport { isInfraShape } from './isInfraShape';\nimport { isInfraWorkloadHealth } from './isInfraWorkloadHealth';\nimport { isInfraWorkloadValue } from './isInfraWorkloadValue';\n\n/*** Validate the portable desired workload; runtime-specific fields and plaintext secret objects fail. */\nexport function isInfraWorkloadSpec(value: unknown): value is InfraWorkloadSpec {\n  if (\n    !isInfraShape(value, {\n      id: isNonEmptyString,\n      artifact: (artifact) =>\n        isInfraShape(artifact, { kind: (kind) => kind === 'image', image: isNonEmptyString }),\n      command: infraFields.optionalStrings,\n      args: (args) => args === undefined || isStringArray(args),\n      ports: (ports) => ports === undefined || isPortRegistry(ports),\n      environment: (environment) =>\n        environment === undefined ||\n        (isRecord(environment) && Object.values(environment).every(isInfraWorkloadValue)),\n      files: (files) => files === undefined || isFileMap(files),\n      health: (health) => health === undefined || isInfraWorkloadHealth(health),\n      resources: (resources) =>\n        resources === undefined ||\n        isInfraShape(resources, {\n          cpuMillis: infraFields.optionalPositiveInteger,\n          memoryMiB: infraFields.optionalPositiveInteger,\n        }),\n      persistence: (volumes) => volumes === undefined || isVolumeRegistry(volumes),\n      exposure: (exposure) =>\n        exposure === undefined || exposure === 'internal' || exposure === 'public',\n      replicas: infraFields.optionalNonnegativeInteger,\n      dependsOn: (dependsOn) => dependsOn === undefined || isSerializableSet(dependsOn),\n    } satisfies InfraShape<InfraWorkloadSpec>)\n  ) {\n    return false;\n  }\n  return hasValidPublishedPorts(value);\n}\n\n/*** Validate named transport ports keyed by their stable authored name. */\nfunction isPortRegistry(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    Object.entries(value).every(([name, port]) => isNonEmptyString(name) && isPort(port))\n  );\n}\n\n/*** Named transport ports stay independent from runtime resource types. */\nfunction isPort(value: unknown): boolean {\n  return isInfraShape(value, {\n    port: infraFields.port,\n    protocol: (protocol) => protocol === undefined || protocol === 'tcp' || protocol === 'udp',\n    publishedPort: infraFields.optionalPort,\n  });\n}\n\n/*** Require fixed external listeners to belong to one public workload replica. */\nfunction hasValidPublishedPorts(workload: unknown): boolean {\n  if (!isRecord(workload)) return false;\n  const ports = isRecord(workload.ports) ? Object.values(workload.ports) : [];\n  const published = ports.flatMap((port) => {\n    if (!isRecord(port) || typeof port.publishedPort !== 'number') return [];\n    return [port.publishedPort];\n  });\n  return (\n    new Set(published).size === published.length &&\n    (published.length === 0 ||\n      (workload.exposure === 'public' &&\n        (workload.replicas === undefined ||\n          (typeof workload.replicas === 'number' && workload.replicas <= 1))))\n  );\n}\n\n/*** Validate portable config/policy files keyed by their absolute container path. */\nfunction isFileMap(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    Object.entries(value).every(\n      ([filePath, content]) => isAbsoluteWorkloadPath(filePath) && isInfraWorkloadValue(content),\n    )\n  );\n}\n\n/*** Validate persistence volumes by stable ID and keep mount paths unique within one workload. */\nfunction isVolumeRegistry(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  const entries = Object.entries(value);\n  if (\n    !entries.every(\n      ([volumeId, volume]) => isVolume(volume) && isRecord(volume) && volume.id === volumeId,\n    )\n  ) {\n    return false;\n  }\n  const mountPaths = Object.values(value).map((volume) =>\n    isRecord(volume) ? volume.mountPath : undefined,\n  );\n  return new Set(mountPaths).size === mountPaths.length;\n}\n\n/*** Persistence has explicit ownership-local identity, optional initialization and retention policy. */\nfunction isVolume(value: unknown): boolean {\n  return isInfraShape(value, {\n    id: isNonEmptyString,\n    mountPath: isAbsoluteWorkloadPath,\n    sizeGiB: infraFields.positiveInteger,\n    seed: (seed) => seed === undefined || seed === 'image',\n    retention: (retention) => retention === 'retain' || retention === 'delete-on-destroy',\n  });\n}\n\n/*** Workload paths are absolute container paths, never relative host traversal. */\nfunction isAbsoluteWorkloadPath(value: unknown): boolean {\n  return (\n    typeof value === 'string' &&\n    value.startsWith('/') &&\n    value.length > 1 &&\n    !value.split('/').includes('..')\n  );\n}\n"]}
+{"version":3,"file":"isInfraWorkloadSpec.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGtD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,0GAA0G;AAC1G,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IACE,CAAC,YAAY,CAAC,KAAK,EAAE;QACnB,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,YAAY,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACvF,OAAO,EAAE,WAAW,CAAC,eAAe;QACpC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC;QACzD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC;QAC9D,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAC3B,WAAW,KAAK,SAAS;YACzB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACnF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC;QACzD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,qBAAqB,CAAC,MAAM,CAAC;QACzE,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CACvB,SAAS,KAAK,SAAS;YACvB,YAAY,CAAC,SAAS,EAAE;gBACtB,SAAS,EAAE,WAAW,CAAC,uBAAuB;gBAC9C,SAAS,EAAE,WAAW,CAAC,uBAAuB;aAC/C,CAAC;QACJ,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAC5E,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,QAAQ;QAC5E,QAAQ,EAAE,WAAW,CAAC,0BAA0B;QAChD,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,iBAAiB,CAAC,SAAS,CAAC;KAC1C,CAAC,EAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CACtF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK;QAC1F,aAAa,EAAE,WAAW,CAAC,YAAY;KACxC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,sBAAsB,CAAC,QAAiB;IAC/C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,CACL,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;QAC5C,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ;gBAC7B,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS;oBAC9B,CAAC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACzB,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAC3F,CACF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IACE,CAAC,OAAO,CAAC,KAAK,CACZ,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CACvF,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrD,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,CAAC;AACxD,CAAC;AAED,wGAAwG;AACxG,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,EAAE,EAAE,gBAAgB;QACpB,SAAS,EAAE,sBAAsB;QACjC,OAAO,EAAE,WAAW,CAAC,eAAe;QACpC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;QACtD,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,mBAAmB;KACtF,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACjC,CAAC;AACJ,CAAC","sourcesContent":["import { isStringArray } from '@ankhorage/utility/array';\nimport { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { isSerializableSet } from '../collections.js';\nimport type { InfraShape } from '../types/infraValidation.js';\nimport type { InfraWorkloadSpec } from '../types/infraWorkload.js';\nimport { infraFields } from './infraFields.js';\nimport { isInfraShape } from './isInfraShape.js';\nimport { isInfraWorkloadHealth } from './isInfraWorkloadHealth.js';\nimport { isInfraWorkloadValue } from './isInfraWorkloadValue.js';\n\n/*** Validate the portable desired workload; runtime-specific fields and plaintext secret objects fail. */\nexport function isInfraWorkloadSpec(value: unknown): value is InfraWorkloadSpec {\n  if (\n    !isInfraShape(value, {\n      id: isNonEmptyString,\n      artifact: (artifact) =>\n        isInfraShape(artifact, { kind: (kind) => kind === 'image', image: isNonEmptyString }),\n      command: infraFields.optionalStrings,\n      args: (args) => args === undefined || isStringArray(args),\n      ports: (ports) => ports === undefined || isPortRegistry(ports),\n      environment: (environment) =>\n        environment === undefined ||\n        (isRecord(environment) && Object.values(environment).every(isInfraWorkloadValue)),\n      files: (files) => files === undefined || isFileMap(files),\n      health: (health) => health === undefined || isInfraWorkloadHealth(health),\n      resources: (resources) =>\n        resources === undefined ||\n        isInfraShape(resources, {\n          cpuMillis: infraFields.optionalPositiveInteger,\n          memoryMiB: infraFields.optionalPositiveInteger,\n        }),\n      persistence: (volumes) => volumes === undefined || isVolumeRegistry(volumes),\n      exposure: (exposure) =>\n        exposure === undefined || exposure === 'internal' || exposure === 'public',\n      replicas: infraFields.optionalNonnegativeInteger,\n      dependsOn: (dependsOn) => dependsOn === undefined || isSerializableSet(dependsOn),\n    } satisfies InfraShape<InfraWorkloadSpec>)\n  ) {\n    return false;\n  }\n  return hasValidPublishedPorts(value);\n}\n\n/*** Validate named transport ports keyed by their stable authored name. */\nfunction isPortRegistry(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    Object.entries(value).every(([name, port]) => isNonEmptyString(name) && isPort(port))\n  );\n}\n\n/*** Named transport ports stay independent from runtime resource types. */\nfunction isPort(value: unknown): boolean {\n  return isInfraShape(value, {\n    port: infraFields.port,\n    protocol: (protocol) => protocol === undefined || protocol === 'tcp' || protocol === 'udp',\n    publishedPort: infraFields.optionalPort,\n  });\n}\n\n/*** Require fixed external listeners to belong to one public workload replica. */\nfunction hasValidPublishedPorts(workload: unknown): boolean {\n  if (!isRecord(workload)) return false;\n  const ports = isRecord(workload.ports) ? Object.values(workload.ports) : [];\n  const published = ports.flatMap((port) => {\n    if (!isRecord(port) || typeof port.publishedPort !== 'number') return [];\n    return [port.publishedPort];\n  });\n  return (\n    new Set(published).size === published.length &&\n    (published.length === 0 ||\n      (workload.exposure === 'public' &&\n        (workload.replicas === undefined ||\n          (typeof workload.replicas === 'number' && workload.replicas <= 1))))\n  );\n}\n\n/*** Validate portable config/policy files keyed by their absolute container path. */\nfunction isFileMap(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    Object.entries(value).every(\n      ([filePath, content]) => isAbsoluteWorkloadPath(filePath) && isInfraWorkloadValue(content),\n    )\n  );\n}\n\n/*** Validate persistence volumes by stable ID and keep mount paths unique within one workload. */\nfunction isVolumeRegistry(value: unknown): boolean {\n  if (!isRecord(value)) return false;\n  const entries = Object.entries(value);\n  if (\n    !entries.every(\n      ([volumeId, volume]) => isVolume(volume) && isRecord(volume) && volume.id === volumeId,\n    )\n  ) {\n    return false;\n  }\n  const mountPaths = Object.values(value).map((volume) =>\n    isRecord(volume) ? volume.mountPath : undefined,\n  );\n  return new Set(mountPaths).size === mountPaths.length;\n}\n\n/*** Persistence has explicit ownership-local identity, optional initialization and retention policy. */\nfunction isVolume(value: unknown): boolean {\n  return isInfraShape(value, {\n    id: isNonEmptyString,\n    mountPath: isAbsoluteWorkloadPath,\n    sizeGiB: infraFields.positiveInteger,\n    seed: (seed) => seed === undefined || seed === 'image',\n    retention: (retention) => retention === 'retain' || retention === 'delete-on-destroy',\n  });\n}\n\n/*** Workload paths are absolute container paths, never relative host traversal. */\nfunction isAbsoluteWorkloadPath(value: unknown): boolean {\n  return (\n    typeof value === 'string' &&\n    value.startsWith('/') &&\n    value.length > 1 &&\n    !value.split('/').includes('..')\n  );\n}\n"]}

package/dist/infra/isInfraWorkloadValue.js

@@ -1,8 +1,8 @@
 import { isRecord } from '@ankhorage/utility/object';
 import { isNonEmptyString } from '@ankhorage/utility/string';
-import { APP_ENVIRONMENT_IDS } from '../environments';
-import { isInfraCredentialRef } from './isInfraCredentialRef';
-import { isInfraShape } from './isInfraShape';
+import { APP_ENVIRONMENT_IDS } from '../environments.js';
+import { isInfraCredentialRef } from './isInfraCredentialRef.js';
+import { isInfraShape } from './isInfraShape.js';
 /*** Workload values explicitly distinguish public literals, output dependencies and secret references. */
 export function isInfraWorkloadValue(value) {
     return (isInfraWorkloadScalarValue(value) ||

package/dist/infra/isInfraWorkloadValue.js.map

@@ -1 +1 @@
-{"version":3,"file":"isInfraWorkloadValue.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,CACL,0BAA0B,CAAC,KAAK,CAAC;QACjC,YAAY,CAAC,KAAK,EAAE;YAClB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU;YACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvB,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACnB,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC;SAC7C,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,SAAS,0BAA0B,CAAC,KAAc;IAChD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS;gBAClC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;aAC5C,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;QACL,KAAK,YAAY;YACf,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,YAAY;gBACrC,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,gBAAgB;aACtB,CAAC,CAAC;QACL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,cAAc;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC;QAClF,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;KACtB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { APP_ENVIRONMENT_IDS } from '../environments';\nimport type { InfraWorkloadScalarValue } from '../types/infraWorkload';\nimport { isInfraCredentialRef } from './isInfraCredentialRef';\nimport { isInfraShape } from './isInfraShape';\n\n/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */\nexport function isInfraWorkloadValue(value: unknown): boolean {\n  return (\n    isInfraWorkloadScalarValue(value) ||\n    isInfraShape(value, {\n      kind: (kind) => kind === 'template',\n      segments: (segments) =>\n        Array.isArray(segments) &&\n        segments.length > 0 &&\n        segments.every(isInfraWorkloadScalarValue),\n    })\n  );\n}\n\n/*** Validate one non-composite workload value segment. */\nfunction isInfraWorkloadScalarValue(value: unknown): value is InfraWorkloadScalarValue {\n  if (!isRecord(value)) return false;\n  switch (value.kind) {\n    case 'literal':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'literal',\n        value: (field) => typeof field === 'string',\n      });\n    case 'output':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'output',\n        resourceId: isNonEmptyString,\n        output: isNonEmptyString,\n      });\n    case 'secret':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'secret',\n        reference: isSecretReference,\n      });\n    case 'credential':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'credential',\n        reference: isInfraCredentialRef,\n        key: isNonEmptyString,\n      });\n    default:\n      return false;\n  }\n}\n\n/*** Managed secret references contain identity only, never privileged payloads. */\nfunction isSecretReference(value: unknown): boolean {\n  return isInfraShape(value, {\n    source: (source) => source === 'secret-store',\n    projectId: isNonEmptyString,\n    environment: (environment) => APP_ENVIRONMENT_IDS.some((id) => id === environment),\n    ref: isNonEmptyString,\n    key: isNonEmptyString,\n  });\n}\n"]}
+{"version":3,"file":"isInfraWorkloadValue.js","sourceRoot":"","sources":["../../src/infra/isInfraWorkloadValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,CACL,0BAA0B,CAAC,KAAK,CAAC;QACjC,YAAY,CAAC,KAAK,EAAE;YAClB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU;YACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvB,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACnB,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC;SAC7C,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,SAAS,0BAA0B,CAAC,KAAc;IAChD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS;gBAClC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;aAC5C,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACjC,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;QACL,KAAK,YAAY;YACf,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,YAAY;gBACrC,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,gBAAgB;aACtB,CAAC,CAAC;QACL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,cAAc;QAC7C,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC;QAClF,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;KACtB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { isRecord } from '@ankhorage/utility/object';\nimport { isNonEmptyString } from '@ankhorage/utility/string';\n\nimport { APP_ENVIRONMENT_IDS } from '../environments.js';\nimport type { InfraWorkloadScalarValue } from '../types/infraWorkload.js';\nimport { isInfraCredentialRef } from './isInfraCredentialRef.js';\nimport { isInfraShape } from './isInfraShape.js';\n\n/*** Workload values explicitly distinguish public literals, output dependencies and secret references. */\nexport function isInfraWorkloadValue(value: unknown): boolean {\n  return (\n    isInfraWorkloadScalarValue(value) ||\n    isInfraShape(value, {\n      kind: (kind) => kind === 'template',\n      segments: (segments) =>\n        Array.isArray(segments) &&\n        segments.length > 0 &&\n        segments.every(isInfraWorkloadScalarValue),\n    })\n  );\n}\n\n/*** Validate one non-composite workload value segment. */\nfunction isInfraWorkloadScalarValue(value: unknown): value is InfraWorkloadScalarValue {\n  if (!isRecord(value)) return false;\n  switch (value.kind) {\n    case 'literal':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'literal',\n        value: (field) => typeof field === 'string',\n      });\n    case 'output':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'output',\n        resourceId: isNonEmptyString,\n        output: isNonEmptyString,\n      });\n    case 'secret':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'secret',\n        reference: isSecretReference,\n      });\n    case 'credential':\n      return isInfraShape(value, {\n        kind: (kind) => kind === 'credential',\n        reference: isInfraCredentialRef,\n        key: isNonEmptyString,\n      });\n    default:\n      return false;\n  }\n}\n\n/*** Managed secret references contain identity only, never privileged payloads. */\nfunction isSecretReference(value: unknown): boolean {\n  return isInfraShape(value, {\n    source: (source) => source === 'secret-store',\n    projectId: isNonEmptyString,\n    environment: (environment) => APP_ENVIRONMENT_IDS.some((id) => id === environment),\n    ref: isNonEmptyString,\n    key: isNonEmptyString,\n  });\n}\n"]}

package/dist/infra/parseInfraManifest.d.ts

@@ -1,5 +1,5 @@
-import type { InfraResult } from '../types/infraLifecycle';
-import type { InfraManifest } from '../types/infraManifest';
+import type { InfraResult } from '../types/infraLifecycle.js';
+import type { InfraManifest } from '../types/infraManifest.js';
 /** Parse unknown infrastructure input; package availability and credentials are separate validation stages. */
 export declare function parseInfraManifest(value: unknown): InfraResult<InfraManifest>;
 //# sourceMappingURL=parseInfraManifest.d.ts.map

package/dist/infra/parseInfraManifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parseInfraManifest.d.ts","sourceRoot":"","sources":["../../src/infra/parseInfraManifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG5D,+GAA+G;AAC/G,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAAC,aAAa,CAAC,CAc7E"}
+{"version":3,"file":"parseInfraManifest.d.ts","sourceRoot":"","sources":["../../src/infra/parseInfraManifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAG/D,+GAA+G;AAC/G,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAAC,aAAa,CAAC,CAc7E"}

package/dist/infra/parseInfraManifest.js

@@ -1,4 +1,4 @@
-import { isInfraManifest } from './isInfraManifest';
+import { isInfraManifest } from './isInfraManifest.js';
 /** Parse unknown infrastructure input; package availability and credentials are separate validation stages. */
 export function parseInfraManifest(value) {
     return isInfraManifest(value)

package/dist/infra/parseInfraManifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"parseInfraManifest.js","sourceRoot":"","sources":["../../src/infra/parseInfraManifest.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,+GAA+G;AAC/G,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,eAAe,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE;QACtC,CAAC,CAAC;YACE,EAAE,EAAE,KAAK;YACT,WAAW,EAAE;gBACX;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EACL,gHAAgH;iBACnH;aACF;SACF,CAAC;AACR,CAAC","sourcesContent":["import type { InfraResult } from '../types/infraLifecycle';\nimport type { InfraManifest } from '../types/infraManifest';\nimport { isInfraManifest } from './isInfraManifest';\n\n/** Parse unknown infrastructure input; package availability and credentials are separate validation stages. */\nexport function parseInfraManifest(value: unknown): InfraResult<InfraManifest> {\n  return isInfraManifest(value)\n    ? { ok: true, value, diagnostics: [] }\n    : {\n        ok: false,\n        diagnostics: [\n          {\n            severity: 'error',\n            code: 'invalid_manifest',\n            message:\n              'Expected canonical Infra environments with supported provider configuration and compute/runtime compatibility.',\n          },\n        ],\n      };\n}\n"]}
+{"version":3,"file":"parseInfraManifest.js","sourceRoot":"","sources":["../../src/infra/parseInfraManifest.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,+GAA+G;AAC/G,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,eAAe,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE;QACtC,CAAC,CAAC;YACE,EAAE,EAAE,KAAK;YACT,WAAW,EAAE;gBACX;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EACL,gHAAgH;iBACnH;aACF;SACF,CAAC;AACR,CAAC","sourcesContent":["import type { InfraResult } from '../types/infraLifecycle.js';\nimport type { InfraManifest } from '../types/infraManifest.js';\nimport { isInfraManifest } from './isInfraManifest.js';\n\n/** Parse unknown infrastructure input; package availability and credentials are separate validation stages. */\nexport function parseInfraManifest(value: unknown): InfraResult<InfraManifest> {\n  return isInfraManifest(value)\n    ? { ok: true, value, diagnostics: [] }\n    : {\n        ok: false,\n        diagnostics: [\n          {\n            severity: 'error',\n            code: 'invalid_manifest',\n            message:\n              'Expected canonical Infra environments with supported provider configuration and compute/runtime compatibility.',\n          },\n        ],\n      };\n}\n"]}

package/dist/infra/validateInfraAdapterSelection.d.ts

@@ -1,6 +1,6 @@
-import type { InfraAdapterDescriptor } from '../types/infraAdapters';
-import type { InfraResult } from '../types/infraLifecycle';
-import type { InfraEnvironmentSpec } from '../types/infraManifest';
+import type { InfraAdapterDescriptor } from '../types/infraAdapters.js';
+import type { InfraResult } from '../types/infraLifecycle.js';
+import type { InfraEnvironmentSpec } from '../types/infraManifest.js';
 /** Validate supplied installed descriptors without imports or filesystem access; only selected packages matter. */
 export declare function validateInfraAdapterSelection(environment: InfraEnvironmentSpec, installed: readonly unknown[]): InfraResult<readonly InfraAdapterDescriptor[]>;
 //# sourceMappingURL=validateInfraAdapterSelection.d.ts.map

package/dist/infra/validateInfraAdapterSelection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateInfraAdapterSelection.d.ts","sourceRoot":"","sources":["../../src/infra/validateInfraAdapterSelection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGnE,mHAAmH;AACnH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,oBAAoB,EACjC,SAAS,EAAE,SAAS,OAAO,EAAE,GAC5B,WAAW,CAAC,SAAS,sBAAsB,EAAE,CAAC,CA+BhD"}
+{"version":3,"file":"validateInfraAdapterSelection.d.ts","sourceRoot":"","sources":["../../src/infra/validateInfraAdapterSelection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGtE,mHAAmH;AACnH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,oBAAoB,EACjC,SAAS,EAAE,SAAS,OAAO,EAAE,GAC5B,WAAW,CAAC,SAAS,sBAAsB,EAAE,CAAC,CA+BhD"}

package/dist/infra/validateInfraAdapterSelection.js

@@ -1,5 +1,5 @@
-import { INFRA_ADAPTER_CATALOG } from '../infraCatalog';
-import { isInfraAdapterDescriptor } from './isInfraAdapterDescriptor';
+import { INFRA_ADAPTER_CATALOG } from '../infraCatalog.js';
+import { isInfraAdapterDescriptor } from './isInfraAdapterDescriptor.js';
 /** Validate supplied installed descriptors without imports or filesystem access; only selected packages matter. */
 export function validateInfraAdapterSelection(environment, installed) {
     const ids = new Set([

package/dist/infra/validateInfraAdapterSelection.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateInfraAdapterSelection.js","sourceRoot":"","sources":["../../src/infra/validateInfraAdapterSelection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAIxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,mHAAmH;AACnH,MAAM,UAAU,6BAA6B,CAC3C,WAAiC,EACjC,SAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;QAClB,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ;QACvC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ;QACvC,WAAW,CAAC,QAAQ,EAAE,QAAQ;QAC9B,WAAW,CAAC,aAAa,EAAE,QAAQ;QACnC,WAAW,CAAC,IAAI,EAAE,QAAQ;QAC1B,WAAW,CAAC,KAAK,EAAE,QAAQ;QAC3B,WAAW,CAAC,WAAW,EAAE,QAAQ;KAClC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC/D,MAAM,WAAW,GAA+B,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACzE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,oBAAoB,KAAK,CAAC,EAAE,mCAAmC,KAAK,CAAC,OAAO,iDAAiD,KAAK,CAAC,aAAa,WAAW,OAAO,CAAC,MAAM,GAAG;iBACtL;aACF,CAAC;IACR,CAAC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;QAC5B,CAAC,CAAC;YACE,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACjE,WAAW;SACZ,CAAC;AACR,CAAC","sourcesContent":["import { INFRA_ADAPTER_CATALOG } from '../infraCatalog';\nimport type { InfraAdapterDescriptor } from '../types/infraAdapters';\nimport type { InfraDiagnostic, InfraResult } from '../types/infraLifecycle';\nimport type { InfraEnvironmentSpec } from '../types/infraManifest';\nimport { isInfraAdapterDescriptor } from './isInfraAdapterDescriptor';\n\n/** Validate supplied installed descriptors without imports or filesystem access; only selected packages matter. */\nexport function validateInfraAdapterSelection(\n  environment: InfraEnvironmentSpec,\n  installed: readonly unknown[],\n): InfraResult<readonly InfraAdapterDescriptor[]> {\n  const ids = new Set([\n    environment.deployment.compute.provider,\n    environment.deployment.runtime.provider,\n    environment.database?.provider,\n    environment.objectStorage?.provider,\n    environment.auth?.provider,\n    environment.authz?.provider,\n    environment.secretStore?.provider,\n  ]);\n  const selected = Object.values(INFRA_ADAPTER_CATALOG).filter((entry) => ids.has(entry.id));\n  const descriptors = installed.filter(isInfraAdapterDescriptor);\n  const diagnostics: readonly InfraDiagnostic[] = selected.flatMap((entry) => {\n    const matches = descriptors.filter((descriptor) => descriptor.id === entry.id);\n    return matches.length === 1\n      ? []\n      : [\n          {\n            severity: 'error',\n            code: 'adapter_unavailable',\n            message: `Selected adapter ${entry.id} requires exactly one installed ${entry.package} descriptor matching Contracts config version ${entry.configVersion}; found ${matches.length}.`,\n          },\n        ];\n  });\n  return diagnostics.length > 0\n    ? { ok: false, diagnostics }\n    : {\n        ok: true,\n        value: descriptors.filter((descriptor) => ids.has(descriptor.id)),\n        diagnostics,\n      };\n}\n"]}
+{"version":3,"file":"validateInfraAdapterSelection.js","sourceRoot":"","sources":["../../src/infra/validateInfraAdapterSelection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,mHAAmH;AACnH,MAAM,UAAU,6BAA6B,CAC3C,WAAiC,EACjC,SAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;QAClB,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ;QACvC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ;QACvC,WAAW,CAAC,QAAQ,EAAE,QAAQ;QAC9B,WAAW,CAAC,aAAa,EAAE,QAAQ;QACnC,WAAW,CAAC,IAAI,EAAE,QAAQ;QAC1B,WAAW,CAAC,KAAK,EAAE,QAAQ;QAC3B,WAAW,CAAC,WAAW,EAAE,QAAQ;KAClC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC/D,MAAM,WAAW,GAA+B,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACzE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,oBAAoB,KAAK,CAAC,EAAE,mCAAmC,KAAK,CAAC,OAAO,iDAAiD,KAAK,CAAC,aAAa,WAAW,OAAO,CAAC,MAAM,GAAG;iBACtL;aACF,CAAC;IACR,CAAC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;QAC5B,CAAC,CAAC;YACE,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACjE,WAAW;SACZ,CAAC;AACR,CAAC","sourcesContent":["import { INFRA_ADAPTER_CATALOG } from '../infraCatalog.js';\nimport type { InfraAdapterDescriptor } from '../types/infraAdapters.js';\nimport type { InfraDiagnostic, InfraResult } from '../types/infraLifecycle.js';\nimport type { InfraEnvironmentSpec } from '../types/infraManifest.js';\nimport { isInfraAdapterDescriptor } from './isInfraAdapterDescriptor.js';\n\n/** Validate supplied installed descriptors without imports or filesystem access; only selected packages matter. */\nexport function validateInfraAdapterSelection(\n  environment: InfraEnvironmentSpec,\n  installed: readonly unknown[],\n): InfraResult<readonly InfraAdapterDescriptor[]> {\n  const ids = new Set([\n    environment.deployment.compute.provider,\n    environment.deployment.runtime.provider,\n    environment.database?.provider,\n    environment.objectStorage?.provider,\n    environment.auth?.provider,\n    environment.authz?.provider,\n    environment.secretStore?.provider,\n  ]);\n  const selected = Object.values(INFRA_ADAPTER_CATALOG).filter((entry) => ids.has(entry.id));\n  const descriptors = installed.filter(isInfraAdapterDescriptor);\n  const diagnostics: readonly InfraDiagnostic[] = selected.flatMap((entry) => {\n    const matches = descriptors.filter((descriptor) => descriptor.id === entry.id);\n    return matches.length === 1\n      ? []\n      : [\n          {\n            severity: 'error',\n            code: 'adapter_unavailable',\n            message: `Selected adapter ${entry.id} requires exactly one installed ${entry.package} descriptor matching Contracts config version ${entry.configVersion}; found ${matches.length}.`,\n          },\n        ];\n  });\n  return diagnostics.length > 0\n    ? { ok: false, diagnostics }\n    : {\n        ok: true,\n        value: descriptors.filter((descriptor) => ids.has(descriptor.id)),\n        diagnostics,\n      };\n}\n"]}

package/dist/infra.d.ts

@@ -1,17 +1,17 @@
 /** Canonical standalone infrastructure contracts, catalog and side-effect-free validation. */
-export { isInfraAdapterDescriptor } from './infra/isInfraAdapterDescriptor';
-export { isInfraAuthSpec } from './infra/isInfraAuthSpec';
-export { isInfraDeploymentSpec } from './infra/isInfraDeploymentSpec';
-export { isInfraEnvironmentSpec } from './infra/isInfraEnvironmentSpec';
-export { isInfraManifest } from './infra/isInfraManifest';
-export { isInfraWorkloadSpec } from './infra/isInfraWorkloadSpec';
-export { parseInfraManifest } from './infra/parseInfraManifest';
-export { validateInfraAdapterSelection } from './infra/validateInfraAdapterSelection';
-export { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from './infraCatalog';
-export type * from './types/infraAdapters';
-export type * from './types/infraLifecycle';
-export type * from './types/infraManifest';
-export type * from './types/infraSecrets';
-export type * from './types/infraTargets';
-export type * from './types/infraWorkload';
+export { isInfraAdapterDescriptor } from './infra/isInfraAdapterDescriptor.js';
+export { isInfraAuthSpec } from './infra/isInfraAuthSpec.js';
+export { isInfraDeploymentSpec } from './infra/isInfraDeploymentSpec.js';
+export { isInfraEnvironmentSpec } from './infra/isInfraEnvironmentSpec.js';
+export { isInfraManifest } from './infra/isInfraManifest.js';
+export { isInfraWorkloadSpec } from './infra/isInfraWorkloadSpec.js';
+export { parseInfraManifest } from './infra/parseInfraManifest.js';
+export { validateInfraAdapterSelection } from './infra/validateInfraAdapterSelection.js';
+export { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from './infraCatalog.js';
+export type * from './types/infraAdapters.js';
+export type * from './types/infraLifecycle.js';
+export type * from './types/infraManifest.js';
+export type * from './types/infraSecrets.js';
+export type * from './types/infraTargets.js';
+export type * from './types/infraWorkload.js';
 //# sourceMappingURL=infra.d.ts.map

package/dist/infra.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra.d.ts","sourceRoot":"","sources":["../src/infra.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AACpF,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,wBAAwB,CAAC;AAC5C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,uBAAuB,CAAC"}
+{"version":3,"file":"infra.d.ts","sourceRoot":"","sources":["../src/infra.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACvF,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,0BAA0B,CAAC"}

package/dist/infra.js

@@ -1,11 +1,11 @@
 /** Canonical standalone infrastructure contracts, catalog and side-effect-free validation. */
-export { isInfraAdapterDescriptor } from './infra/isInfraAdapterDescriptor';
-export { isInfraAuthSpec } from './infra/isInfraAuthSpec';
-export { isInfraDeploymentSpec } from './infra/isInfraDeploymentSpec';
-export { isInfraEnvironmentSpec } from './infra/isInfraEnvironmentSpec';
-export { isInfraManifest } from './infra/isInfraManifest';
-export { isInfraWorkloadSpec } from './infra/isInfraWorkloadSpec';
-export { parseInfraManifest } from './infra/parseInfraManifest';
-export { validateInfraAdapterSelection } from './infra/validateInfraAdapterSelection';
-export { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from './infraCatalog';
+export { isInfraAdapterDescriptor } from './infra/isInfraAdapterDescriptor.js';
+export { isInfraAuthSpec } from './infra/isInfraAuthSpec.js';
+export { isInfraDeploymentSpec } from './infra/isInfraDeploymentSpec.js';
+export { isInfraEnvironmentSpec } from './infra/isInfraEnvironmentSpec.js';
+export { isInfraManifest } from './infra/isInfraManifest.js';
+export { isInfraWorkloadSpec } from './infra/isInfraWorkloadSpec.js';
+export { parseInfraManifest } from './infra/parseInfraManifest.js';
+export { validateInfraAdapterSelection } from './infra/validateInfraAdapterSelection.js';
+export { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from './infraCatalog.js';
 //# sourceMappingURL=infra.js.map

package/dist/infra.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra.js","sourceRoot":"","sources":["../src/infra.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["/** Canonical standalone infrastructure contracts, catalog and side-effect-free validation. */\nexport { isInfraAdapterDescriptor } from './infra/isInfraAdapterDescriptor';\nexport { isInfraAuthSpec } from './infra/isInfraAuthSpec';\nexport { isInfraDeploymentSpec } from './infra/isInfraDeploymentSpec';\nexport { isInfraEnvironmentSpec } from './infra/isInfraEnvironmentSpec';\nexport { isInfraManifest } from './infra/isInfraManifest';\nexport { isInfraWorkloadSpec } from './infra/isInfraWorkloadSpec';\nexport { parseInfraManifest } from './infra/parseInfraManifest';\nexport { validateInfraAdapterSelection } from './infra/validateInfraAdapterSelection';\nexport { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from './infraCatalog';\nexport type * from './types/infraAdapters';\nexport type * from './types/infraLifecycle';\nexport type * from './types/infraManifest';\nexport type * from './types/infraSecrets';\nexport type * from './types/infraTargets';\nexport type * from './types/infraWorkload';\n"]}
+{"version":3,"file":"infra.js","sourceRoot":"","sources":["../src/infra.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC","sourcesContent":["/** Canonical standalone infrastructure contracts, catalog and side-effect-free validation. */\nexport { isInfraAdapterDescriptor } from './infra/isInfraAdapterDescriptor.js';\nexport { isInfraAuthSpec } from './infra/isInfraAuthSpec.js';\nexport { isInfraDeploymentSpec } from './infra/isInfraDeploymentSpec.js';\nexport { isInfraEnvironmentSpec } from './infra/isInfraEnvironmentSpec.js';\nexport { isInfraManifest } from './infra/isInfraManifest.js';\nexport { isInfraWorkloadSpec } from './infra/isInfraWorkloadSpec.js';\nexport { parseInfraManifest } from './infra/parseInfraManifest.js';\nexport { validateInfraAdapterSelection } from './infra/validateInfraAdapterSelection.js';\nexport { INFRA_ADAPTER_CATALOG, INFRA_RUNTIME_COMPATIBILITY } from './infraCatalog.js';\nexport type * from './types/infraAdapters.js';\nexport type * from './types/infraLifecycle.js';\nexport type * from './types/infraManifest.js';\nexport type * from './types/infraSecrets.js';\nexport type * from './types/infraTargets.js';\nexport type * from './types/infraWorkload.js';\n"]}

package/dist/infraCatalog.d.ts

@@ -8,7 +8,7 @@ export declare const INFRA_RUNTIME_COMPATIBILITY: {
 export declare const INFRA_ADAPTER_CATALOG: {
     readonly local: {
         readonly id: "local";
-        readonly package: "@ankhorage/local";
+        readonly package: "@ankhorage/infra-local";
         readonly kind: "compute";
         readonly configVersion: 1;
         readonly capabilities: readonly ["compute"];
@@ -17,7 +17,7 @@ export declare const INFRA_ADAPTER_CATALOG: {
     };
     readonly hetzner: {
         readonly id: "hetzner";
-        readonly package: "@ankhorage/hetzner";
+        readonly package: "@ankhorage/infra-hetzner";
         readonly kind: "compute";
         readonly configVersion: 1;
         readonly capabilities: readonly ["compute"];
@@ -26,7 +26,7 @@ export declare const INFRA_ADAPTER_CATALOG: {
     };
     readonly minikube: {
         readonly id: "minikube";
-        readonly package: "@ankhorage/minikube";
+        readonly package: "@ankhorage/infra-minikube";
         readonly kind: "runtime";
         readonly configVersion: 1;
         readonly capabilities: readonly ["runtime", "workloads", "networking"];
@@ -35,7 +35,7 @@ export declare const INFRA_ADAPTER_CATALOG: {
     };
     readonly k3s: {
         readonly id: "k3s";
-        readonly package: "@ankhorage/k3s";
+        readonly package: "@ankhorage/infra-k3s";
         readonly kind: "runtime";
         readonly configVersion: 1;
         readonly capabilities: readonly ["runtime", "workloads", "networking"];
@@ -44,7 +44,7 @@ export declare const INFRA_ADAPTER_CATALOG: {
     };
     readonly 'docker-compose': {
         readonly id: "docker-compose";
-        readonly package: "@ankhorage/docker-compose";
+        readonly package: "@ankhorage/infra-docker-compose";
         readonly kind: "runtime";
         readonly configVersion: 1;
         readonly capabilities: readonly ["runtime", "workloads", "networking"];
@@ -53,7 +53,7 @@ export declare const INFRA_ADAPTER_CATALOG: {
     };
     readonly supabase: {
         readonly id: "supabase";
-        readonly package: "@ankhorage/supabase";
+        readonly package: "@ankhorage/infra-supabase";
         readonly kind: "service";
         readonly configVersion: 1;
         readonly capabilities: readonly ["database", "auth", "objectStorage"];
@@ -62,7 +62,7 @@ export declare const INFRA_ADAPTER_CATALOG: {
     };
     readonly cerbos: {
         readonly id: "cerbos";
-        readonly package: "@ankhorage/cerbos";
+        readonly package: "@ankhorage/infra-cerbos";
         readonly kind: "service";
         readonly configVersion: 1;
         readonly capabilities: readonly ["authz"];
@@ -71,7 +71,7 @@ export declare const INFRA_ADAPTER_CATALOG: {
     };
     readonly r2: {
         readonly id: "r2";
-        readonly package: "@ankhorage/r2";
+        readonly package: "@ankhorage/infra-r2";
         readonly kind: "service";
         readonly configVersion: 1;
         readonly capabilities: readonly ["objectStorage"];

package/dist/infraCatalog.js

@@ -8,7 +8,7 @@ export const INFRA_RUNTIME_COMPATIBILITY = {
 export const INFRA_ADAPTER_CATALOG = {
     local: {
         id: 'local',
-        package: '@ankhorage/local',
+        package: '@ankhorage/infra-local',
         kind: 'compute',
         configVersion: 1,
         capabilities: ['compute'],
@@ -17,7 +17,7 @@ export const INFRA_ADAPTER_CATALOG = {
     },
     hetzner: {
         id: 'hetzner',
-        package: '@ankhorage/hetzner',
+        package: '@ankhorage/infra-hetzner',
         kind: 'compute',
         configVersion: 1,
         capabilities: ['compute'],
@@ -26,7 +26,7 @@ export const INFRA_ADAPTER_CATALOG = {
     },
     minikube: {
         id: 'minikube',
-        package: '@ankhorage/minikube',
+        package: '@ankhorage/infra-minikube',
         kind: 'runtime',
         configVersion: 1,
         capabilities: ['runtime', 'workloads', 'networking'],
@@ -35,7 +35,7 @@ export const INFRA_ADAPTER_CATALOG = {
     },
     k3s: {
         id: 'k3s',
-        package: '@ankhorage/k3s',
+        package: '@ankhorage/infra-k3s',
         kind: 'runtime',
         configVersion: 1,
         capabilities: ['runtime', 'workloads', 'networking'],
@@ -44,7 +44,7 @@ export const INFRA_ADAPTER_CATALOG = {
     },
     'docker-compose': {
         id: 'docker-compose',
-        package: '@ankhorage/docker-compose',
+        package: '@ankhorage/infra-docker-compose',
         kind: 'runtime',
         configVersion: 1,
         capabilities: ['runtime', 'workloads', 'networking'],
@@ -53,7 +53,7 @@ export const INFRA_ADAPTER_CATALOG = {
     },
     supabase: {
         id: 'supabase',
-        package: '@ankhorage/supabase',
+        package: '@ankhorage/infra-supabase',
         kind: 'service',
         configVersion: 1,
         capabilities: ['database', 'auth', 'objectStorage'],
@@ -62,7 +62,7 @@ export const INFRA_ADAPTER_CATALOG = {
     },
     cerbos: {
         id: 'cerbos',
-        package: '@ankhorage/cerbos',
+        package: '@ankhorage/infra-cerbos',
         kind: 'service',
         configVersion: 1,
         capabilities: ['authz'],
@@ -71,7 +71,7 @@ export const INFRA_ADAPTER_CATALOG = {
     },
     r2: {
         id: 'r2',
-        package: '@ankhorage/r2',
+        package: '@ankhorage/infra-r2',
         kind: 'service',
         configVersion: 1,
         capabilities: ['objectStorage'],

package/dist/infraCatalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"infraCatalog.js","sourceRoot":"","sources":["../src/infraCatalog.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;IACzB,gBAAgB,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;CAC9B,CAAC;AAEX,kGAAkG;AAClG,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE;QACL,EAAE,EAAE,OAAO;QACX,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,CAAC;QACzB,OAAO,EAAE,CAAC,YAAY,CAAC;QACvB,YAAY,EAAE,EAAE;KACjB;IACD,OAAO,EAAE;QACP,EAAE,EAAE,SAAS;QACb,OAAO,EAAE,oBAAoB;QAC7B,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,CAAC;QACzB,OAAO,EAAE,CAAC,UAAU,CAAC;QACrB,YAAY,EAAE,EAAE;KACjB;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC;QACpD,OAAO,EAAE,CAAC,YAAY,CAAC;QACvB,YAAY,EAAE,CAAC,SAAS,CAAC;KAC1B;IACD,GAAG,EAAE;QACH,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC;QACpD,OAAO,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;QACnC,YAAY,EAAE,CAAC,SAAS,CAAC;KAC1B;IACD,gBAAgB,EAAE;QAChB,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC;QACpD,OAAO,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;QACnC,YAAY,EAAE,CAAC,SAAS,CAAC;KAC1B;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC;QACnD,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,CAAC,WAAW,CAAC;KAC5B;IACD,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,mBAAmB;QAC5B,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,OAAO,CAAC;QACvB,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,CAAC,WAAW,CAAC;KAC5B;IACD,EAAE,EAAE;QACF,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,EAAE;KACjB;IACD,gBAAgB,EAAE;QAChB,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,aAAa,CAAC;QAC7B,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,CAAC,UAAU,CAAC;KAC3B;CACO,CAAC","sourcesContent":["/** One compatibility source for manifest types, validation, discovery and configuration UIs. */\nexport const INFRA_RUNTIME_COMPATIBILITY = {\n  minikube: ['local'],\n  k3s: ['local', 'hetzner'],\n  'docker-compose': ['local', 'hetzner'],\n} as const;\n\n/** Canonical package identities. Capabilities describe ownership, not eight mandatory methods. */\nexport const INFRA_ADAPTER_CATALOG = {\n  local: {\n    id: 'local',\n    package: '@ankhorage/local',\n    kind: 'compute',\n    configVersion: 1,\n    capabilities: ['compute'],\n    targets: ['local-host'],\n    dependencies: [],\n  },\n  hetzner: {\n    id: 'hetzner',\n    package: '@ankhorage/hetzner',\n    kind: 'compute',\n    configVersion: 1,\n    capabilities: ['compute'],\n    targets: ['ssh-host'],\n    dependencies: [],\n  },\n  minikube: {\n    id: 'minikube',\n    package: '@ankhorage/minikube',\n    kind: 'runtime',\n    configVersion: 1,\n    capabilities: ['runtime', 'workloads', 'networking'],\n    targets: ['local-host'],\n    dependencies: ['compute'],\n  },\n  k3s: {\n    id: 'k3s',\n    package: '@ankhorage/k3s',\n    kind: 'runtime',\n    configVersion: 1,\n    capabilities: ['runtime', 'workloads', 'networking'],\n    targets: ['local-host', 'ssh-host'],\n    dependencies: ['compute'],\n  },\n  'docker-compose': {\n    id: 'docker-compose',\n    package: '@ankhorage/docker-compose',\n    kind: 'runtime',\n    configVersion: 1,\n    capabilities: ['runtime', 'workloads', 'networking'],\n    targets: ['local-host', 'ssh-host'],\n    dependencies: ['compute'],\n  },\n  supabase: {\n    id: 'supabase',\n    package: '@ankhorage/supabase',\n    kind: 'service',\n    configVersion: 1,\n    capabilities: ['database', 'auth', 'objectStorage'],\n    targets: [],\n    dependencies: ['workloads'],\n  },\n  cerbos: {\n    id: 'cerbos',\n    package: '@ankhorage/cerbos',\n    kind: 'service',\n    configVersion: 1,\n    capabilities: ['authz'],\n    targets: [],\n    dependencies: ['workloads'],\n  },\n  r2: {\n    id: 'r2',\n    package: '@ankhorage/r2',\n    kind: 'service',\n    configVersion: 1,\n    capabilities: ['objectStorage'],\n    targets: [],\n    dependencies: [],\n  },\n  'supabase-vault': {\n    id: 'supabase-vault',\n    package: '@ankhorage/supabase-vault',\n    kind: 'service',\n    configVersion: 1,\n    capabilities: ['secretStore'],\n    targets: [],\n    dependencies: ['database'],\n  },\n} as const;\n"]}
+{"version":3,"file":"infraCatalog.js","sourceRoot":"","sources":["../src/infraCatalog.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;IACzB,gBAAgB,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;CAC9B,CAAC;AAEX,kGAAkG;AAClG,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE;QACL,EAAE,EAAE,OAAO;QACX,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,CAAC;QACzB,OAAO,EAAE,CAAC,YAAY,CAAC;QACvB,YAAY,EAAE,EAAE;KACjB;IACD,OAAO,EAAE;QACP,EAAE,EAAE,SAAS;QACb,OAAO,EAAE,0BAA0B;QACnC,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,CAAC;QACzB,OAAO,EAAE,CAAC,UAAU,CAAC;QACrB,YAAY,EAAE,EAAE;KACjB;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC;QACpD,OAAO,EAAE,CAAC,YAAY,CAAC;QACvB,YAAY,EAAE,CAAC,SAAS,CAAC;KAC1B;IACD,GAAG,EAAE;QACH,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC;QACpD,OAAO,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;QACnC,YAAY,EAAE,CAAC,SAAS,CAAC;KAC1B;IACD,gBAAgB,EAAE;QAChB,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,iCAAiC;QAC1C,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC;QACpD,OAAO,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;QACnC,YAAY,EAAE,CAAC,SAAS,CAAC;KAC1B;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC;QACnD,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,CAAC,WAAW,CAAC;KAC5B;IACD,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,yBAAyB;QAClC,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,OAAO,CAAC;QACvB,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,CAAC,WAAW,CAAC;KAC5B;IACD,EAAE,EAAE;QACF,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,EAAE;KACjB;IACD,gBAAgB,EAAE;QAChB,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,aAAa,CAAC;QAC7B,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,CAAC,UAAU,CAAC;KAC3B;CACO,CAAC","sourcesContent":["/** One compatibility source for manifest types, validation, discovery and configuration UIs. */\nexport const INFRA_RUNTIME_COMPATIBILITY = {\n  minikube: ['local'],\n  k3s: ['local', 'hetzner'],\n  'docker-compose': ['local', 'hetzner'],\n} as const;\n\n/** Canonical package identities. Capabilities describe ownership, not eight mandatory methods. */\nexport const INFRA_ADAPTER_CATALOG = {\n  local: {\n    id: 'local',\n    package: '@ankhorage/infra-local',\n    kind: 'compute',\n    configVersion: 1,\n    capabilities: ['compute'],\n    targets: ['local-host'],\n    dependencies: [],\n  },\n  hetzner: {\n    id: 'hetzner',\n    package: '@ankhorage/infra-hetzner',\n    kind: 'compute',\n    configVersion: 1,\n    capabilities: ['compute'],\n    targets: ['ssh-host'],\n    dependencies: [],\n  },\n  minikube: {\n    id: 'minikube',\n    package: '@ankhorage/infra-minikube',\n    kind: 'runtime',\n    configVersion: 1,\n    capabilities: ['runtime', 'workloads', 'networking'],\n    targets: ['local-host'],\n    dependencies: ['compute'],\n  },\n  k3s: {\n    id: 'k3s',\n    package: '@ankhorage/infra-k3s',\n    kind: 'runtime',\n    configVersion: 1,\n    capabilities: ['runtime', 'workloads', 'networking'],\n    targets: ['local-host', 'ssh-host'],\n    dependencies: ['compute'],\n  },\n  'docker-compose': {\n    id: 'docker-compose',\n    package: '@ankhorage/infra-docker-compose',\n    kind: 'runtime',\n    configVersion: 1,\n    capabilities: ['runtime', 'workloads', 'networking'],\n    targets: ['local-host', 'ssh-host'],\n    dependencies: ['compute'],\n  },\n  supabase: {\n    id: 'supabase',\n    package: '@ankhorage/infra-supabase',\n    kind: 'service',\n    configVersion: 1,\n    capabilities: ['database', 'auth', 'objectStorage'],\n    targets: [],\n    dependencies: ['workloads'],\n  },\n  cerbos: {\n    id: 'cerbos',\n    package: '@ankhorage/infra-cerbos',\n    kind: 'service',\n    configVersion: 1,\n    capabilities: ['authz'],\n    targets: [],\n    dependencies: ['workloads'],\n  },\n  r2: {\n    id: 'r2',\n    package: '@ankhorage/infra-r2',\n    kind: 'service',\n    configVersion: 1,\n    capabilities: ['objectStorage'],\n    targets: [],\n    dependencies: [],\n  },\n  'supabase-vault': {\n    id: 'supabase-vault',\n    package: '@ankhorage/supabase-vault',\n    kind: 'service',\n    configVersion: 1,\n    capabilities: ['secretStore'],\n    targets: [],\n    dependencies: ['database'],\n  },\n} as const;\n"]}