@ankhorage/infra 4.1.12 → 5.0.0

package/src/infraOperations.test.ts

@@ -0,0 +1,386 @@
+import type {
+  InfraAdapterDescriptor,
+  InfraComputeAdapter,
+  InfraEnvironmentSpec,
+  InfraOwnedResource,
+  InfraPlanAction,
+  InfraResourceIdentity,
+  InfraResourceStatus,
+  InfraResult,
+  InfraRuntimeAdapter,
+  InfraServiceAdapter,
+  InfraWorkloadSpec,
+} from '@ankhorage/contracts/infra';
+import { INFRA_ADAPTER_CATALOG } from '@ankhorage/contracts/infra';
+import { describe, expect, it } from 'bun:test';
+
+import type { InfraAdapterPackageResolver } from './features/environment-lifecycle/application/ports/outbound/infraAdapterPackage';
+import { destroyInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync';
+import { downInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/downInfraEnvironmentAsync';
+import { generateInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/generateInfraEnvironmentAsync';
+import { getInfraEnvironmentOutputs } from './features/environment-lifecycle/application/use-cases/getInfraEnvironmentOutputs';
+import { planInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/planInfraEnvironmentAsync';
+import { statusInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/statusInfraEnvironmentAsync';
+import { validateInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/validateInfraEnvironmentAsync';
+import type { InfraOrchestrationDependencies } from './types/infraOrchestration';
+
+const desired = {
+  deployment: { compute: { provider: 'local' }, runtime: { provider: 'docker-compose' } },
+  database: { provider: 'supabase' },
+  secretStore: { provider: 'supabase-vault' },
+} as const satisfies InfraEnvironmentSpec;
+const manifest = { environments: { local: desired }, modules: [] } as const;
+const computeOwner = owner('local', 'host');
+const runtimeOwner = owner('docker-compose', 'runtime');
+const databaseOwner = owner('supabase', 'database');
+const vaultOwner = owner('supabase-vault', 'vault');
+
+describe('provider-neutral lifecycle operations', () => {
+  it('validates and plans without calling a mutating adapter method', async () => {
+    const calls: string[] = [];
+    const dependencies = createDependencies(calls);
+    const validation = await validateInfraEnvironmentAsync(
+      { projectId: 'sample', manifest },
+      dependencies,
+    );
+    const plan = await planInfraEnvironmentAsync({ projectId: 'sample', manifest }, dependencies);
+
+    expect(validation).toMatchObject({ ok: true, value: { environment: 'local' } });
+    expect(plan.ok).toBe(true);
+    if (!plan.ok) throw new Error('Expected plan.');
+    expect(plan.value.actions.map(({ owner: actionOwner }) => actionOwner.resourceId)).toEqual([
+      'host',
+      'runtime',
+      'database',
+      'vault',
+    ]);
+    expect(calls).toContain('local.inspect');
+    expect(calls.some((call) => call.endsWith('.ensure'))).toBe(false);
+    expect(calls.some((call) => call.endsWith('.reconcile'))).toBe(false);
+    expect(calls.some((call) => call.endsWith('.destroy'))).toBe(false);
+  });
+
+  it('plans fresh remote compute and a deferred runtime without inventing an SSH target', async () => {
+    const calls: string[] = [];
+    const remoteManifest = {
+      environments: {
+        local: desired,
+        production: {
+          deployment: {
+            compute: { provider: 'hetzner', location: 'nbg1' },
+            runtime: { provider: 'k3s', topology: { servers: 1, agents: 0 } },
+          },
+        },
+      },
+      modules: [],
+    } as const;
+    const result = await planInfraEnvironmentAsync(
+      { projectId: 'sample', manifest: remoteManifest, environment: 'production' },
+      createDependencies(calls),
+    );
+    expect(result.ok).toBe(true);
+    if (!result.ok) throw new Error('Expected remote plan.');
+    expect(result.value.actions.map(({ owner: actionOwner }) => actionOwner.adapter)).toEqual([
+      'hetzner',
+      'k3s',
+    ]);
+    expect(result.value.actions[1]?.detail).toContain('deferred');
+    expect(calls).not.toContain('k3s.validate');
+    expect(calls).not.toContain('k3s.plan');
+  });
+
+  it('generates review artifacts without reconciliation and preserves safe state', async () => {
+    const calls: string[] = [];
+    const result = await generateInfraEnvironmentAsync(
+      { projectId: 'sample', manifest, previous: ledger() },
+      createDependencies(calls),
+    );
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) throw new Error('Expected generation.');
+    expect(result.value.artifacts).toEqual([
+      { owner: runtimeOwner, path: 'infra/compose.yaml', content: 'services: {}\n' },
+    ]);
+    expect(result.value.ledger.outputs).toEqual(ledger().outputs);
+    expect(calls).toContain('docker-compose.generate');
+    expect(calls.some((call) => call.endsWith('.ensure'))).toBe(false);
+  });
+
+  it('aggregates canonical status and returns only serialized ledger outputs', async () => {
+    const calls: string[] = [];
+    const status = await statusInfraEnvironmentAsync(
+      { projectId: 'sample', manifest, previous: ledger() },
+      createDependencies(calls),
+    );
+    const outputs = getInfraEnvironmentOutputs({
+      projectId: 'sample',
+      manifest,
+      previous: ledger(),
+    });
+
+    expect(status).toMatchObject({ ok: true, value: { state: 'degraded' } });
+    expect(outputs).toMatchObject({
+      ok: true,
+      value: {
+        outputs: [
+          { visibility: 'public', value: 'https://example.test' },
+          { visibility: 'secret', reference: { source: 'secret-store' } },
+        ],
+      },
+    });
+    expect(JSON.stringify(outputs)).not.toContain('resolved-secret');
+  });
+
+  it('suspends optional services in reverse dependency order before runtime', async () => {
+    const calls: string[] = [];
+    const result = await downInfraEnvironmentAsync(
+      { projectId: 'sample', manifest, previous: ledger() },
+      createDependencies(calls),
+    );
+
+    expect(result.ok).toBe(true);
+    expect(calls.filter((call) => call.endsWith('.suspend'))).toEqual([
+      'supabase-vault.suspend',
+      'supabase.suspend',
+      'docker-compose.suspend',
+    ]);
+    if (!result.ok) throw new Error('Expected down.');
+    expect(result.value.ledger.resources).toHaveLength(4);
+  });
+
+  it('refuses mismatched destroy confirmation and destroys in reverse dependency order', async () => {
+    const rejectedCalls: string[] = [];
+    const rejected = await destroyInfraEnvironmentAsync(
+      {
+        projectId: 'sample',
+        manifest,
+        environment: 'local',
+        previous: ledger(),
+        confirmation: { projectId: 'other', environment: 'local' },
+        persistence: { policy: 'retain' },
+      },
+      createDependencies(rejectedCalls),
+    );
+    expect(rejected).toMatchObject({
+      ok: false,
+      diagnostics: [{ code: 'infra-destroy-confirmation-mismatch' }],
+    });
+    expect(rejectedCalls.some((call) => call.endsWith('.destroy'))).toBe(false);
+
+    const calls: string[] = [];
+    const result = await destroyInfraEnvironmentAsync(
+      {
+        projectId: 'sample',
+        manifest,
+        environment: 'local',
+        previous: ledger(),
+        confirmation: { projectId: 'sample', environment: 'local' },
+        persistence: { policy: 'retain' },
+      },
+      createDependencies(calls),
+    );
+    expect(result.ok).toBe(true);
+    expect(calls.filter((call) => call.endsWith('.destroy'))).toEqual([
+      'supabase-vault.destroy',
+      'supabase.destroy',
+      'docker-compose.destroy',
+      'local.destroy',
+    ]);
+  });
+});
+
+function createDependencies(calls: string[]): InfraOrchestrationDependencies {
+  return {
+    adapterResolver: createResolver(calls),
+    credentials: { resolveAsync: () => Promise.resolve(success({})) },
+    secrets: { resolveAsync: () => Promise.resolve(success('resolved-secret')) },
+  };
+}
+
+function createResolver(calls: string[]): InfraAdapterPackageResolver {
+  return {
+    loadAsync(packageName) {
+      const descriptor = descriptorForPackage(packageName);
+      return Promise.resolve({
+        infraAdapterDescriptor: descriptor,
+        createInfraAdapter: () => createAdapter(descriptor, calls),
+      });
+    },
+  };
+}
+
+function createAdapter(descriptor: InfraAdapterDescriptor, calls: string[]): unknown {
+  if (descriptor.kind === 'compute') return createCompute(descriptor, calls);
+  if (descriptor.kind === 'runtime') return createRuntime(descriptor, calls);
+  return createService(descriptor, calls);
+}
+
+function createCompute(descriptor: InfraAdapterDescriptor, calls: string[]): InfraComputeAdapter {
+  const selectedOwner = descriptor.id === 'hetzner' ? owner('hetzner', 'server') : computeOwner;
+  return {
+    descriptor: descriptor as InfraComputeAdapter['descriptor'],
+    validateAsync: () => recordedAsync(calls, `${descriptor.id}.validate`, null),
+    inspectAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.inspect`, {
+        targets:
+          descriptor.id === 'hetzner'
+            ? []
+            : [{ id: 'local', kind: 'local-host', os: 'linux', architecture: 'amd64' }],
+        resources: [resource(selectedOwner)],
+        outputs: [],
+      }),
+    planAsync: () => recordedAsync(calls, `${descriptor.id}.plan`, [action(selectedOwner, [])]),
+    ensureAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.ensure`, { targets: [], resources: [], outputs: [] }),
+    statusAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.status`, [status(selectedOwner, 'ready')]),
+    destroyAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.destroy`, { resources: [], outputs: [] }),
+  };
+}
+
+function createRuntime(descriptor: InfraAdapterDescriptor, calls: string[]): InfraRuntimeAdapter {
+  return {
+    descriptor: descriptor as InfraRuntimeAdapter['descriptor'],
+    validateAsync: () => recordedAsync(calls, `${descriptor.id}.validate`, null),
+    planAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.plan`, [action(runtimeOwner, [computeOwner])]),
+    ensureAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.ensure`, { resources: [], outputs: [] }),
+    statusAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.status`, [status(runtimeOwner, 'degraded')]),
+    suspendAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.suspend`, {
+        resources: [resource(runtimeOwner)],
+        outputs: [],
+      }),
+    destroyAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.destroy`, { resources: [], outputs: [] }),
+    generateAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.generate`, [
+        { owner: runtimeOwner, path: 'infra/compose.yaml', content: 'services: {}\n' },
+      ]),
+  };
+}
+
+function createService(descriptor: InfraAdapterDescriptor, calls: string[]): InfraServiceAdapter {
+  const serviceOwner = descriptor.id === 'supabase' ? databaseOwner : vaultOwner;
+  const dependencies = descriptor.id === 'supabase' ? [runtimeOwner] : [databaseOwner];
+  return {
+    descriptor: descriptor as InfraServiceAdapter['descriptor'],
+    validateAsync: () => recordedAsync(calls, `${descriptor.id}.validate`, null),
+    planAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.plan`, [action(serviceOwner, dependencies)]),
+    desiredWorkloadsAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.workloads`, [workload(descriptor.id)]),
+    reconcileAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.reconcile`, { resources: [], outputs: [] }),
+    statusAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.status`, [status(serviceOwner, 'ready')]),
+    suspendAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.suspend`, {
+        resources: [resource(serviceOwner, true)],
+        outputs: [],
+      }),
+    destroyAsync: () =>
+      recordedAsync(calls, `${descriptor.id}.destroy`, {
+        resources: [resource(serviceOwner, true)],
+        outputs: [],
+      }),
+  };
+}
+
+function ledger() {
+  return {
+    schemaVersion: 1,
+    projectId: 'sample',
+    environment: 'local',
+    targets: [{ id: 'local', kind: 'local-host', os: 'linux', architecture: 'amd64' }],
+    resources: [
+      resource(computeOwner),
+      resource(runtimeOwner),
+      resource(databaseOwner, true),
+      resource(vaultOwner, true),
+    ],
+    outputs: [
+      {
+        owner: runtimeOwner,
+        name: 'url',
+        visibility: 'public',
+        value: 'https://example.test',
+        environmentVariable: 'EXAMPLE_URL',
+      },
+      {
+        owner: vaultOwner,
+        name: 'credential',
+        visibility: 'secret',
+        reference: {
+          source: 'secret-store',
+          projectId: 'sample',
+          environment: 'local',
+          ref: 'example',
+          key: 'password',
+        },
+      },
+    ],
+    artifacts: [],
+  } as const;
+}
+
+function owner(adapter: InfraAdapterDescriptor['id'], resourceId: string): InfraResourceIdentity {
+  return { projectId: 'sample', environment: 'local', adapter, resourceId };
+}
+
+function resource(identity: InfraResourceIdentity, persistent = false): InfraOwnedResource {
+  return {
+    identity,
+    persistent,
+    retention: persistent ? 'retain' : 'delete-on-destroy',
+    dependsOn: [],
+  };
+}
+
+function action(
+  actionOwner: InfraResourceIdentity,
+  dependsOn: readonly InfraResourceIdentity[],
+): InfraPlanAction {
+  return {
+    owner: actionOwner,
+    operation: 'create',
+    impact: 'none',
+    detail: `Create ${actionOwner.resourceId}.`,
+    dependsOn,
+  };
+}
+
+function status(
+  statusOwner: InfraResourceIdentity,
+  state: InfraResourceStatus['state'],
+): InfraResourceStatus {
+  return { owner: statusOwner, state };
+}
+
+function workload(id: string): InfraWorkloadSpec {
+  return { id, artifact: { kind: 'image', image: `example/${id}:1` } };
+}
+
+function descriptorForPackage(packageName: string): InfraAdapterDescriptor {
+  const descriptor = Object.values(INFRA_ADAPTER_CATALOG).find(
+    ({ package: candidate }) => candidate === packageName,
+  );
+  if (descriptor === undefined) throw new Error('Unexpected package.');
+  return descriptor;
+}
+
+function recorded<T>(calls: string[], call: string, value: T): InfraResult<T> {
+  calls.push(call);
+  return success(value);
+}
+
+function recordedAsync<T>(calls: string[], call: string, value: T): Promise<InfraResult<T>> {
+  return Promise.resolve(recorded(calls, call, value));
+}
+
+function success<T>(value: T): InfraResult<T> {
+  return { ok: true, value, diagnostics: [] };
+}

package/src/infraUp.test.ts

@@ -0,0 +1,260 @@
+import type {
+  InfraAdapterDescriptor,
+  InfraComputeAdapter,
+  InfraDiagnostic,
+  InfraEnvironmentSpec,
+  InfraOutput,
+  InfraResult,
+  InfraRuntimeAdapter,
+  InfraRuntimeDesiredState,
+  InfraServiceAdapter,
+  InfraWorkloadSpec,
+} from '@ankhorage/contracts/infra';
+import { INFRA_ADAPTER_CATALOG } from '@ankhorage/contracts/infra';
+import { describe, expect, it } from 'bun:test';
+
+import type { InfraAdapterPackageResolver } from './features/environment-lifecycle/application/ports/outbound/infraAdapterPackage';
+import { upInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync';
+import type { InfraOrchestrationDependencies } from './types/infraOrchestration';
+
+const environment = {
+  deployment: { compute: { provider: 'local' }, runtime: { provider: 'docker-compose' } },
+  database: { provider: 'supabase' },
+  auth: { provider: 'supabase' },
+  authz: { provider: 'cerbos', kind: 'ABAC' },
+  workloads: [workload('app')],
+} as const satisfies InfraEnvironmentSpec;
+const manifest = { environments: { local: environment }, modules: [] } as const;
+
+describe('environment up orchestration', () => {
+  it('validates before mutation and reconciles compute, runtime and deduplicated services', async () => {
+    const calls: string[] = [];
+    const observedRuntimeDesired: InfraRuntimeDesiredState[] = [];
+    const observedServiceOutputs: InfraOutput[][] = [];
+    const dependencies = createDependencies(calls, observedRuntimeDesired, observedServiceOutputs);
+    const result = await upInfraEnvironmentAsync({ projectId: 'sample', manifest }, dependencies);
+
+    expect(result.ok).toBe(true);
+    expect(calls).toEqual([
+      'local.validate',
+      'supabase.validate',
+      'cerbos.validate',
+      'supabase.workloads',
+      'cerbos.workloads',
+      'local.ensure',
+      'docker-compose.validate',
+      'docker-compose.ensure',
+      'supabase.reconcile',
+      'cerbos.reconcile',
+    ]);
+    expect(observedRuntimeDesired).toHaveLength(2);
+    expect(observedRuntimeDesired[0]?.workloads.map(({ id }) => id)).toEqual([
+      'app',
+      'supabase',
+      'cerbos',
+    ]);
+    expect(observedRuntimeDesired[0]?.targets).toEqual([
+      { id: 'local', kind: 'local-host', os: 'linux', architecture: 'amd64' },
+    ]);
+    expect(observedServiceOutputs).toHaveLength(2);
+    expect(observedServiceOutputs[0]?.map(({ name }) => name)).toEqual([
+      'computeEndpoint',
+      'runtimeEndpoint',
+    ]);
+    if (!result.ok) throw new Error('Expected successful up.');
+    expect(result.value.environment).toBe('local');
+    expect(result.value.outputs.map(({ name }) => name)).toEqual([
+      'computeEndpoint',
+      'runtimeEndpoint',
+      'supabaseOutput',
+      'cerbosOutput',
+    ]);
+    expect(result.diagnostics.map(({ code }) => code)).toEqual(['compute-warning']);
+  });
+
+  it('stops before mutation when service validation fails', async () => {
+    const calls: string[] = [];
+    const dependencies = createDependencies(calls, [], [], 'supabase.validate');
+    const result = await upInfraEnvironmentAsync({ projectId: 'sample', manifest }, dependencies);
+
+    expect(result).toMatchObject({ ok: false, diagnostics: [{ code: 'fixture-failure' }] });
+    expect(calls).toEqual(['local.validate', 'supabase.validate']);
+  });
+
+  it('does not reconcile services after a runtime failure', async () => {
+    const calls: string[] = [];
+    const dependencies = createDependencies(calls, [], [], 'docker-compose.ensure');
+    const result = await upInfraEnvironmentAsync({ projectId: 'sample', manifest }, dependencies);
+
+    expect(result.ok).toBe(false);
+    expect(calls.at(-1)).toBe('docker-compose.ensure');
+    expect(calls).not.toContain('supabase.reconcile');
+  });
+});
+
+function createDependencies(
+  calls: string[],
+  runtimeDesired: InfraRuntimeDesiredState[],
+  serviceOutputs: InfraOutput[][],
+  failure?: string,
+): InfraOrchestrationDependencies {
+  return {
+    adapterResolver: createResolver(calls, runtimeDesired, serviceOutputs, failure),
+    credentials: { resolveAsync: () => Promise.resolve(success({})) },
+    secrets: { resolveAsync: () => Promise.resolve(success('secret')) },
+  };
+}
+
+function createResolver(
+  calls: string[],
+  runtimeDesired: InfraRuntimeDesiredState[],
+  serviceOutputs: InfraOutput[][],
+  failure?: string,
+): InfraAdapterPackageResolver {
+  return {
+    loadAsync(packageName) {
+      const descriptor = descriptorForPackage(packageName);
+      return Promise.resolve({
+        infraAdapterDescriptor: descriptor,
+        createInfraAdapter: () =>
+          createAdapter(descriptor, calls, runtimeDesired, serviceOutputs, failure),
+      });
+    },
+  };
+}
+
+function createAdapter(
+  descriptor: InfraAdapterDescriptor,
+  calls: string[],
+  runtimeDesired: InfraRuntimeDesiredState[],
+  serviceOutputs: InfraOutput[][],
+  failure?: string,
+): unknown {
+  if (descriptor.kind === 'compute') return createCompute(descriptor, calls, failure);
+  if (descriptor.kind === 'runtime')
+    return createRuntime(descriptor, calls, runtimeDesired, failure);
+  return createService(descriptor, calls, serviceOutputs, failure);
+}
+
+function createCompute(
+  descriptor: InfraAdapterDescriptor,
+  calls: string[],
+  failure?: string,
+): InfraComputeAdapter {
+  return {
+    descriptor: descriptor as InfraComputeAdapter['descriptor'],
+    validateAsync: () => recordAsync(calls, `${descriptor.id}.validate`, failure, null),
+    inspectAsync: () => Promise.resolve(success({ resources: [], outputs: [], targets: [] })),
+    planAsync: () => Promise.resolve(success([])),
+    ensureAsync: () => {
+      const recorded = record(calls, `${descriptor.id}.ensure`, failure, {
+        resources: [],
+        outputs: [publicOutput('local', 'compute', 'computeEndpoint')],
+        targets: [{ id: 'local', kind: 'local-host', os: 'linux', architecture: 'amd64' } as const],
+      });
+      return Promise.resolve(
+        recorded.ok ? { ...recorded, diagnostics: [diagnostic('compute-warning')] } : recorded,
+      );
+    },
+    statusAsync: () => Promise.resolve(success([])),
+    destroyAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+  };
+}
+
+function createRuntime(
+  descriptor: InfraAdapterDescriptor,
+  calls: string[],
+  observed: InfraRuntimeDesiredState[],
+  failure?: string,
+): InfraRuntimeAdapter {
+  return {
+    descriptor: descriptor as InfraRuntimeAdapter['descriptor'],
+    validateAsync: (_context, desired) => {
+      observed.push(desired);
+      return Promise.resolve(record(calls, `${descriptor.id}.validate`, failure, null));
+    },
+    planAsync: () => Promise.resolve(success([])),
+    ensureAsync: (_context, desired) => {
+      observed.push(desired);
+      return Promise.resolve(
+        record(calls, `${descriptor.id}.ensure`, failure, {
+          resources: [],
+          outputs: [publicOutput('docker-compose', 'runtime', 'runtimeEndpoint')],
+        }),
+      );
+    },
+    statusAsync: () => Promise.resolve(success([])),
+    suspendAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+    destroyAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+  };
+}
+
+function createService(
+  descriptor: InfraAdapterDescriptor,
+  calls: string[],
+  observed: InfraOutput[][],
+  failure?: string,
+): InfraServiceAdapter {
+  return {
+    descriptor: descriptor as InfraServiceAdapter['descriptor'],
+    validateAsync: () => recordAsync(calls, `${descriptor.id}.validate`, failure, null),
+    planAsync: () => Promise.resolve(success([])),
+    desiredWorkloadsAsync: () =>
+      recordAsync(calls, `${descriptor.id}.workloads`, failure, [workload(descriptor.id)]),
+    reconcileAsync: (_context, outputs) => {
+      observed.push([...outputs]);
+      return Promise.resolve(
+        record(calls, `${descriptor.id}.reconcile`, failure, {
+          resources: [],
+          outputs: [publicOutput(descriptor.id, descriptor.id, `${descriptor.id}Output`)],
+        }),
+      );
+    },
+    statusAsync: () => Promise.resolve(success([])),
+    destroyAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+  };
+}
+
+function record<T>(calls: string[], call: string, failure: string | undefined, value: T) {
+  calls.push(call);
+  return failure === call
+    ? ({ ok: false, diagnostics: [diagnostic('fixture-failure')] } as const)
+    : success(value);
+}
+
+function recordAsync<T>(calls: string[], call: string, failure: string | undefined, value: T) {
+  return Promise.resolve(record(calls, call, failure, value));
+}
+
+function workload(id: string): InfraWorkloadSpec {
+  return { id, artifact: { kind: 'image', image: `example/${id}:1` } };
+}
+
+function publicOutput(
+  adapter: InfraAdapterDescriptor['id'],
+  resourceId: string,
+  name: string,
+): InfraOutput {
+  return {
+    owner: { projectId: 'sample', environment: 'local', adapter, resourceId },
+    name,
+    visibility: 'public',
+    value: `https://${resourceId}.example.test`,
+  };
+}
+
+function descriptorForPackage(packageName: string): InfraAdapterDescriptor {
+  const descriptor = Object.values(INFRA_ADAPTER_CATALOG).find(
+    ({ package: candidate }) => candidate === packageName,
+  );
+  if (descriptor === undefined) throw new Error('Unexpected package.');
+  return descriptor;
+}
+
+function diagnostic(code: string): InfraDiagnostic {
+  return { severity: 'warning', code, message: code };
+}
+
+function success<T>(value: T): InfraResult<T> {
+  return { ok: true, value, diagnostics: [] };
+}

package/src/metadata/index.ts

@@ -4,4 +4,4 @@ export {
   INFRA_PACKAGE_METADATA,
   INFRA_PACKAGE_NAME,
   INFRA_PACKAGE_VERSION,
-} from '../packageMetadata.js';
+} from '../constants.js';

package/src/package.test.ts

@@ -10,11 +10,13 @@ describe('package metadata', () => {
       provider: './dist/cli/index.js',
       capabilities: [
         'infra.validate',
+        'infra.plan',
         'infra.generate',
-        'infra.status',
         'infra.up',
+        'infra.status',
+        'infra.outputs',
         'infra.down',
-        'infra.secret-store',
+        'infra.destroy',
       ],
     } as const satisfies AnkhPackageMetadata;