@ankhorage/infra 4.1.12 → 5.0.0

package/dist/features/environment-lifecycle/domain/orderInfraPlanActions.js

@@ -0,0 +1,54 @@
+/*** Order plan actions dependency-first and reject duplicate owners or dependency cycles. */
+export function orderInfraPlanActions(actions) {
+    const byOwner = new Map(actions.map((action) => [identityKey(action.owner), action]));
+    if (byOwner.size !== actions.length)
+        return invalidPlan('duplicate resource actions');
+    const ordered = [];
+    const complete = new Set();
+    const active = new Set();
+    for (const action of actions) {
+        const result = visitAction(action, byOwner, ordered, complete, active);
+        if (!result.ok)
+            return result;
+    }
+    return { ok: true, value: ordered, diagnostics: [] };
+}
+/*** Visit one plan node and its in-plan dependencies exactly once. */
+function visitAction(action, byOwner, ordered, complete, active) {
+    const key = identityKey(action.owner);
+    if (complete.has(key))
+        return { ok: true, value: null, diagnostics: [] };
+    if (active.has(key))
+        return invalidPlan('a dependency cycle');
+    active.add(key);
+    for (const dependency of action.dependsOn) {
+        const dependencyAction = byOwner.get(identityKey(dependency));
+        if (dependencyAction === undefined)
+            continue;
+        const result = visitAction(dependencyAction, byOwner, ordered, complete, active);
+        if (!result.ok)
+            return result;
+    }
+    active.delete(key);
+    complete.add(key);
+    ordered.push(action);
+    return { ok: true, value: null, diagnostics: [] };
+}
+/*** Create a collision-safe key for one provider-owned resource identity. */
+function identityKey(identity) {
+    return `${identity.projectId}\0${identity.environment}\0${identity.adapter}\0${identity.resourceId}`;
+}
+/*** Reject an invalid aggregated plan without exposing provider internals. */
+function invalidPlan(detail) {
+    return {
+        ok: false,
+        diagnostics: [
+            {
+                severity: 'error',
+                code: 'infra-plan-invalid',
+                message: `The aggregated infrastructure plan contains ${detail}.`,
+            },
+        ],
+    };
+}
+//# sourceMappingURL=orderInfraPlanActions.js.map

package/dist/features/environment-lifecycle/domain/orderInfraPlanActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orderInfraPlanActions.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/domain/orderInfraPlanActions.ts"],"names":[],"mappings":"AAMA,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CACnC,OAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC,4BAA4B,CAAC,CAAC;IACtF,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAClB,MAAuB,EACvB,OAA6C,EAC7C,OAA0B,EAC1B,QAAqB,EACrB,MAAmB;IAEnB,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACzE,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,IAAI,gBAAgB,KAAK,SAAS;YAAE,SAAS;QAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,QAA+B;IAClD,OAAO,GAAG,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;AACvG,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,WAAW,EAAE;YACX;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,+CAA+C,MAAM,GAAG;aAClE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  InfraPlanAction,\n  InfraResourceIdentity,\n  InfraResult,\n} from '@ankhorage/contracts/infra';\n\n/*** Order plan actions dependency-first and reject duplicate owners or dependency cycles. */\nexport function orderInfraPlanActions(\n  actions: readonly InfraPlanAction[],\n): InfraResult<readonly InfraPlanAction[]> {\n  const byOwner = new Map(actions.map((action) => [identityKey(action.owner), action]));\n  if (byOwner.size !== actions.length) return invalidPlan('duplicate resource actions');\n  const ordered: InfraPlanAction[] = [];\n  const complete = new Set<string>();\n  const active = new Set<string>();\n  for (const action of actions) {\n    const result = visitAction(action, byOwner, ordered, complete, active);\n    if (!result.ok) return result;\n  }\n  return { ok: true, value: ordered, diagnostics: [] };\n}\n\n/*** Visit one plan node and its in-plan dependencies exactly once. */\nfunction visitAction(\n  action: InfraPlanAction,\n  byOwner: ReadonlyMap<string, InfraPlanAction>,\n  ordered: InfraPlanAction[],\n  complete: Set<string>,\n  active: Set<string>,\n): InfraResult<null> {\n  const key = identityKey(action.owner);\n  if (complete.has(key)) return { ok: true, value: null, diagnostics: [] };\n  if (active.has(key)) return invalidPlan('a dependency cycle');\n  active.add(key);\n  for (const dependency of action.dependsOn) {\n    const dependencyAction = byOwner.get(identityKey(dependency));\n    if (dependencyAction === undefined) continue;\n    const result = visitAction(dependencyAction, byOwner, ordered, complete, active);\n    if (!result.ok) return result;\n  }\n  active.delete(key);\n  complete.add(key);\n  ordered.push(action);\n  return { ok: true, value: null, diagnostics: [] };\n}\n\n/*** Create a collision-safe key for one provider-owned resource identity. */\nfunction identityKey(identity: InfraResourceIdentity): string {\n  return `${identity.projectId}\\0${identity.environment}\\0${identity.adapter}\\0${identity.resourceId}`;\n}\n\n/*** Reject an invalid aggregated plan without exposing provider internals. */\nfunction invalidPlan(detail: string): InfraResult<never> {\n  return {\n    ok: false,\n    diagnostics: [\n      {\n        severity: 'error',\n        code: 'infra-plan-invalid',\n        message: `The aggregated infrastructure plan contains ${detail}.`,\n      },\n    ],\n  };\n}\n"]}

package/dist/features/environment-lifecycle/domain/resolveInfraEnvironment.d.ts

@@ -0,0 +1,5 @@
+import type { InfraResult } from '@ankhorage/contracts/infra';
+import type { InfraEnvironmentResolutionRequest, ResolvedInfraEnvironment } from '../../../types/infraOrchestration.js';
+/*** Resolve one explicitly configured environment while keeping local as the only safe default. */
+export declare function resolveInfraEnvironment(request: InfraEnvironmentResolutionRequest): InfraResult<ResolvedInfraEnvironment>;
+//# sourceMappingURL=resolveInfraEnvironment.d.ts.map

package/dist/features/environment-lifecycle/domain/resolveInfraEnvironment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveInfraEnvironment.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/domain/resolveInfraEnvironment.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,KAAK,EACV,iCAAiC,EACjC,wBAAwB,EACzB,MAAM,sCAAsC,CAAC;AAE9C,mGAAmG;AACnG,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iCAAiC,GACzC,WAAW,CAAC,wBAAwB,CAAC,CAyBvC"}

package/dist/features/environment-lifecycle/domain/resolveInfraEnvironment.js

@@ -0,0 +1,39 @@
+import { APP_ENVIRONMENT_IDS } from '@ankhorage/contracts/environments';
+/*** Resolve one explicitly configured environment while keeping local as the only safe default. */
+export function resolveInfraEnvironment(request) {
+    if (request.operation === 'destroy' && request.environment === undefined) {
+        return failure('infra-environment-required', 'Infra destroy requires an explicit --environment selection.');
+    }
+    const environment = request.environment ?? 'local';
+    if (!isAppEnvironmentId(environment)) {
+        return failure('infra-environment-invalid', `Unknown Infra environment "${environment}". Expected local, preview, or production.`);
+    }
+    const desired = getEnvironment(request.manifest, environment);
+    return desired === undefined
+        ? failure('infra-environment-unconfigured', `Infra environment "${environment}" is not configured.`)
+        : {
+            ok: true,
+            value: { id: environment, desired, manifest: request.manifest },
+            diagnostics: [],
+        };
+}
+/*** Read a closed environment key without an open object-injection boundary. */
+function getEnvironment(manifest, environment) {
+    switch (environment) {
+        case 'local':
+            return manifest.environments.local;
+        case 'preview':
+            return manifest.environments.preview;
+        case 'production':
+            return manifest.environments.production;
+    }
+}
+/*** Narrow a CLI environment string through the canonical Contracts vocabulary. */
+function isAppEnvironmentId(value) {
+    return APP_ENVIRONMENT_IDS.some((environment) => environment === value);
+}
+/*** Create a stable environment-resolution diagnostic. */
+function failure(code, message) {
+    return { ok: false, diagnostics: [{ severity: 'error', code, message }] };
+}
+//# sourceMappingURL=resolveInfraEnvironment.js.map

package/dist/features/environment-lifecycle/domain/resolveInfraEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveInfraEnvironment.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/domain/resolveInfraEnvironment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAyB,MAAM,mCAAmC,CAAC;AAQ/F,mGAAmG;AACnG,MAAM,UAAU,uBAAuB,CACrC,OAA0C;IAE1C,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACzE,OAAO,OAAO,CACZ,4BAA4B,EAC5B,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC;IACnD,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO,OAAO,CACZ,2BAA2B,EAC3B,8BAA8B,WAAW,4CAA4C,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9D,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,OAAO,CACL,gCAAgC,EAChC,sBAAsB,WAAW,sBAAsB,CACxD;QACH,CAAC,CAAC;YACE,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC/D,WAAW,EAAE,EAAE;SAChB,CAAC;AACR,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CACrB,QAAuD,EACvD,WAA6B;IAE7B,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC;QACrC,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC;QACvC,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,0DAA0D;AAC1D,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC","sourcesContent":["import { APP_ENVIRONMENT_IDS, type AppEnvironmentId } from '@ankhorage/contracts/environments';\nimport type { InfraResult } from '@ankhorage/contracts/infra';\n\nimport type {\n  InfraEnvironmentResolutionRequest,\n  ResolvedInfraEnvironment,\n} from '../../../types/infraOrchestration.js';\n\n/*** Resolve one explicitly configured environment while keeping local as the only safe default. */\nexport function resolveInfraEnvironment(\n  request: InfraEnvironmentResolutionRequest,\n): InfraResult<ResolvedInfraEnvironment> {\n  if (request.operation === 'destroy' && request.environment === undefined) {\n    return failure(\n      'infra-environment-required',\n      'Infra destroy requires an explicit --environment selection.',\n    );\n  }\n  const environment = request.environment ?? 'local';\n  if (!isAppEnvironmentId(environment)) {\n    return failure(\n      'infra-environment-invalid',\n      `Unknown Infra environment \"${environment}\". Expected local, preview, or production.`,\n    );\n  }\n  const desired = getEnvironment(request.manifest, environment);\n  return desired === undefined\n    ? failure(\n        'infra-environment-unconfigured',\n        `Infra environment \"${environment}\" is not configured.`,\n      )\n    : {\n        ok: true,\n        value: { id: environment, desired, manifest: request.manifest },\n        diagnostics: [],\n      };\n}\n\n/*** Read a closed environment key without an open object-injection boundary. */\nfunction getEnvironment(\n  manifest: InfraEnvironmentResolutionRequest['manifest'],\n  environment: AppEnvironmentId,\n) {\n  switch (environment) {\n    case 'local':\n      return manifest.environments.local;\n    case 'preview':\n      return manifest.environments.preview;\n    case 'production':\n      return manifest.environments.production;\n  }\n}\n\n/*** Narrow a CLI environment string through the canonical Contracts vocabulary. */\nfunction isAppEnvironmentId(value: string): value is AppEnvironmentId {\n  return APP_ENVIRONMENT_IDS.some((environment) => environment === value);\n}\n\n/*** Create a stable environment-resolution diagnostic. */\nfunction failure(code: string, message: string): InfraResult<never> {\n  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };\n}\n"]}

package/dist/features/environment-lifecycle/utils/appendInfraFailure.d.ts

@@ -0,0 +1,7 @@
+import type { InfraDiagnostic, InfraResult } from '@ankhorage/contracts/infra';
+/*** Preserve earlier safe diagnostics when a later lifecycle stage fails. */
+export declare function appendInfraFailure(previous: readonly InfraDiagnostic[], failure: {
+    readonly ok: false;
+    readonly diagnostics: readonly InfraDiagnostic[];
+}): InfraResult<never>;
+//# sourceMappingURL=appendInfraFailure.d.ts.map

package/dist/features/environment-lifecycle/utils/appendInfraFailure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appendInfraFailure.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/appendInfraFailure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE/E,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GAChF,WAAW,CAAC,KAAK,CAAC,CAEpB"}

package/dist/features/environment-lifecycle/utils/appendInfraFailure.js

@@ -0,0 +1,5 @@
+/*** Preserve earlier safe diagnostics when a later lifecycle stage fails. */
+export function appendInfraFailure(previous, failure) {
+    return { ok: false, diagnostics: [...previous, ...failure.diagnostics] };
+}
+//# sourceMappingURL=appendInfraFailure.js.map

package/dist/features/environment-lifecycle/utils/appendInfraFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appendInfraFailure.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/appendInfraFailure.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAChC,QAAoC,EACpC,OAAiF;IAEjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;AAC3E,CAAC","sourcesContent":["import type { InfraDiagnostic, InfraResult } from '@ankhorage/contracts/infra';\n\n/*** Preserve earlier safe diagnostics when a later lifecycle stage fails. */\nexport function appendInfraFailure(\n  previous: readonly InfraDiagnostic[],\n  failure: { readonly ok: false; readonly diagnostics: readonly InfraDiagnostic[] },\n): InfraResult<never> {\n  return { ok: false, diagnostics: [...previous, ...failure.diagnostics] };\n}\n"]}

package/dist/features/environment-lifecycle/utils/createInfraExecutionContext.d.ts

@@ -0,0 +1,5 @@
+import type { InfraExecutionContext } from '@ankhorage/contracts/infra';
+import type { InfraOperationRequest, InfraOrchestrationDependencies, ResolvedInfraEnvironment } from '../../../types/infraOrchestration.js';
+/*** Create one execution context without copying resolved secret values into serializable state. */
+export declare function createInfraExecutionContext(request: InfraOperationRequest, environment: ResolvedInfraEnvironment, dependencies: InfraOrchestrationDependencies): InfraExecutionContext;
+//# sourceMappingURL=createInfraExecutionContext.d.ts.map

package/dist/features/environment-lifecycle/utils/createInfraExecutionContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraExecutionContext.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraExecutionContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EACV,qBAAqB,EACrB,8BAA8B,EAC9B,wBAAwB,EACzB,MAAM,sCAAsC,CAAC;AAE9C,oGAAoG;AACpG,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,qBAAqB,EAC9B,WAAW,EAAE,wBAAwB,EACrC,YAAY,EAAE,8BAA8B,GAC3C,qBAAqB,CAUvB"}

package/dist/features/environment-lifecycle/utils/createInfraExecutionContext.js

@@ -0,0 +1,13 @@
+/*** Create one execution context without copying resolved secret values into serializable state. */
+export function createInfraExecutionContext(request, environment, dependencies) {
+    return {
+        projectId: request.projectId,
+        environment: environment.id,
+        desired: environment.desired,
+        ...(request.previous === undefined ? {} : { previous: request.previous }),
+        ...(request.signal === undefined ? {} : { signal: request.signal }),
+        credentials: dependencies.credentials,
+        secrets: dependencies.secrets,
+    };
+}
+//# sourceMappingURL=createInfraExecutionContext.js.map

package/dist/features/environment-lifecycle/utils/createInfraExecutionContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraExecutionContext.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraExecutionContext.ts"],"names":[],"mappings":"AAQA,oGAAoG;AACpG,MAAM,UAAU,2BAA2B,CACzC,OAA8B,EAC9B,WAAqC,EACrC,YAA4C;IAE5C,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,WAAW,CAAC,EAAE;QAC3B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,OAAO,EAAE,YAAY,CAAC,OAAO;KAC9B,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraExecutionContext } from '@ankhorage/contracts/infra';\n\nimport type {\n  InfraOperationRequest,\n  InfraOrchestrationDependencies,\n  ResolvedInfraEnvironment,\n} from '../../../types/infraOrchestration.js';\n\n/*** Create one execution context without copying resolved secret values into serializable state. */\nexport function createInfraExecutionContext(\n  request: InfraOperationRequest,\n  environment: ResolvedInfraEnvironment,\n  dependencies: InfraOrchestrationDependencies,\n): InfraExecutionContext {\n  return {\n    projectId: request.projectId,\n    environment: environment.id,\n    desired: environment.desired,\n    ...(request.previous === undefined ? {} : { previous: request.previous }),\n    ...(request.signal === undefined ? {} : { signal: request.signal }),\n    credentials: dependencies.credentials,\n    secrets: dependencies.secrets,\n  };\n}\n"]}

package/dist/features/environment-lifecycle/utils/createInfraFailure.d.ts

@@ -0,0 +1,4 @@
+import type { InfraResult } from '@ankhorage/contracts/infra';
+/*** Create one sanitized provider-neutral Infra failure. */
+export declare function createInfraFailure(code: string, message: string): InfraResult<never>;
+//# sourceMappingURL=createInfraFailure.d.ts.map

package/dist/features/environment-lifecycle/utils/createInfraFailure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraFailure.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraFailure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAEpF"}

package/dist/features/environment-lifecycle/utils/createInfraFailure.js

@@ -0,0 +1,5 @@
+/*** Create one sanitized provider-neutral Infra failure. */
+export function createInfraFailure(code, message) {
+    return { ok: false, diagnostics: [{ severity: 'error', code, message }] };
+}
+//# sourceMappingURL=createInfraFailure.js.map

package/dist/features/environment-lifecycle/utils/createInfraFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraFailure.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraFailure.ts"],"names":[],"mappings":"AAEA,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAe;IAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC","sourcesContent":["import type { InfraResult } from '@ankhorage/contracts/infra';\n\n/*** Create one sanitized provider-neutral Infra failure. */\nexport function createInfraFailure(code: string, message: string): InfraResult<never> {\n  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };\n}\n"]}

package/dist/features/environment-lifecycle/utils/createInfraLedger.d.ts

@@ -0,0 +1,12 @@
+import type { InfraComputeTarget, InfraGeneratedArtifact, InfraLedger, InfraOutput, InfraOwnedResource } from '@ankhorage/contracts/infra';
+/*** Create deterministic serializable lifecycle state without resolved credential or secret values. */
+export declare function createInfraLedger(input: {
+    readonly projectId: string;
+    readonly environment: InfraLedger['environment'];
+    readonly targets: readonly InfraComputeTarget[];
+    readonly resources: readonly InfraOwnedResource[];
+    readonly outputs: readonly InfraOutput[];
+    readonly artifacts?: readonly InfraGeneratedArtifact[];
+    readonly previous?: InfraLedger;
+}): InfraLedger;
+//# sourceMappingURL=createInfraLedger.d.ts.map

package/dist/features/environment-lifecycle/utils/createInfraLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraLedger.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraLedger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAEpC,uGAAuG;AACvG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;CACjC,GAAG,WAAW,CAYd"}

package/dist/features/environment-lifecycle/utils/createInfraLedger.js

@@ -0,0 +1,14 @@
+/*** Create deterministic serializable lifecycle state without resolved credential or secret values. */
+export function createInfraLedger(input) {
+    const artifacts = input.artifacts?.map(({ owner, path }) => ({ owner, path })) ?? input.previous?.artifacts ?? [];
+    return {
+        schemaVersion: 1,
+        projectId: input.projectId,
+        environment: input.environment,
+        targets: input.targets,
+        resources: input.resources,
+        outputs: input.outputs,
+        artifacts,
+    };
+}
+//# sourceMappingURL=createInfraLedger.js.map

package/dist/features/environment-lifecycle/utils/createInfraLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraLedger.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraLedger.ts"],"names":[],"mappings":"AAQA,uGAAuG;AACvG,MAAM,UAAU,iBAAiB,CAAC,KAQjC;IACC,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC;IAClG,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;KACV,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  InfraComputeTarget,\n  InfraGeneratedArtifact,\n  InfraLedger,\n  InfraOutput,\n  InfraOwnedResource,\n} from '@ankhorage/contracts/infra';\n\n/*** Create deterministic serializable lifecycle state without resolved credential or secret values. */\nexport function createInfraLedger(input: {\n  readonly projectId: string;\n  readonly environment: InfraLedger['environment'];\n  readonly targets: readonly InfraComputeTarget[];\n  readonly resources: readonly InfraOwnedResource[];\n  readonly outputs: readonly InfraOutput[];\n  readonly artifacts?: readonly InfraGeneratedArtifact[];\n  readonly previous?: InfraLedger;\n}): InfraLedger {\n  const artifacts =\n    input.artifacts?.map(({ owner, path }) => ({ owner, path })) ?? input.previous?.artifacts ?? [];\n  return {\n    schemaVersion: 1,\n    projectId: input.projectId,\n    environment: input.environment,\n    targets: input.targets,\n    resources: input.resources,\n    outputs: input.outputs,\n    artifacts,\n  };\n}\n"]}

package/dist/features/environment-lifecycle/utils/infraIdentityKey.d.ts

@@ -0,0 +1,4 @@
+import type { InfraResourceIdentity } from '@ankhorage/contracts/infra';
+/*** Create a stable collision-safe key for an Infra-owned resource. */
+export declare function infraIdentityKey(identity: InfraResourceIdentity): string;
+//# sourceMappingURL=infraIdentityKey.d.ts.map

package/dist/features/environment-lifecycle/utils/infraIdentityKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infraIdentityKey.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/infraIdentityKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,CAExE"}

package/dist/features/environment-lifecycle/utils/infraIdentityKey.js

@@ -0,0 +1,5 @@
+/*** Create a stable collision-safe key for an Infra-owned resource. */
+export function infraIdentityKey(identity) {
+    return `${identity.projectId}\0${identity.environment}\0${identity.adapter}\0${identity.resourceId}`;
+}
+//# sourceMappingURL=infraIdentityKey.js.map

package/dist/features/environment-lifecycle/utils/infraIdentityKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infraIdentityKey.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/infraIdentityKey.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,QAA+B;IAC9D,OAAO,GAAG,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;AACvG,CAAC","sourcesContent":["import type { InfraResourceIdentity } from '@ankhorage/contracts/infra';\n\n/*** Create a stable collision-safe key for an Infra-owned resource. */\nexport function infraIdentityKey(identity: InfraResourceIdentity): string {\n  return `${identity.projectId}\\0${identity.environment}\\0${identity.adapter}\\0${identity.resourceId}`;\n}\n"]}

package/dist/features/environment-lifecycle/utils/isInfraStoredState.d.ts

@@ -0,0 +1,4 @@
+import type { InfraStoredState } from '../../../types/infraOrchestration.js';
+/*** Validate persisted ownership state before any provider receives it. */
+export declare function isInfraStoredState(value: unknown): value is InfraStoredState;
+//# sourceMappingURL=isInfraStoredState.d.ts.map

package/dist/features/environment-lifecycle/utils/isInfraStoredState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraStoredState.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/isInfraStoredState.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAO5E"}

package/dist/features/environment-lifecycle/utils/isInfraStoredState.js

@@ -0,0 +1,103 @@
+import { APP_ENVIRONMENT_IDS } from '@ankhorage/contracts/environments';
+import { INFRA_ADAPTER_CATALOG, isInfraEnvironmentSpec, } from '@ankhorage/contracts/infra';
+/*** Validate persisted ownership state before any provider receives it. */
+export function isInfraStoredState(value) {
+    return (isRecord(value) &&
+        value.schemaVersion === 1 &&
+        isInfraEnvironmentSpec(value.desired) &&
+        isInfraLedger(value.ledger));
+}
+/*** Validate the canonical ledger's serializable outer boundary. */
+function isInfraLedger(value) {
+    if (isRecord(value) &&
+        value.schemaVersion === 1 &&
+        typeof value.projectId === 'string' &&
+        typeof value.environment === 'string' &&
+        APP_ENVIRONMENT_IDS.some((environment) => environment === value.environment) &&
+        Array.isArray(value.targets) &&
+        Array.isArray(value.resources) &&
+        Array.isArray(value.outputs) &&
+        Array.isArray(value.artifacts)) {
+        const { environment, projectId } = value;
+        return (value.targets.every(isComputeTarget) &&
+            value.resources.every((resource) => isOwnedResource(resource, projectId, environment)) &&
+            value.outputs.every((output) => isOutput(output, projectId, environment)) &&
+            value.artifacts.every((artifact) => isArtifactIdentity(artifact, projectId, environment)));
+    }
+    return false;
+}
+/*** Validate portable compute targets without accepting resolved credential payloads. */
+function isComputeTarget(value) {
+    if (!isRecord(value) ||
+        typeof value.id !== 'string' ||
+        !['linux', 'darwin', 'windows'].includes(String(value.os)) ||
+        !['amd64', 'arm64'].includes(String(value.architecture))) {
+        return false;
+    }
+    if (value.kind === 'local-host')
+        return true;
+    return (value.kind === 'ssh-host' &&
+        typeof value.host === 'string' &&
+        typeof value.port === 'number' &&
+        typeof value.user === 'string' &&
+        typeof value.hostKeyFingerprint === 'string' &&
+        isControlPlaneReference(value.credential));
+}
+/*** Validate one exact resource plus its dependency identities. */
+function isOwnedResource(value, projectId, environment) {
+    return (isRecord(value) &&
+        isScopedIdentity(value.identity, projectId, environment) &&
+        typeof value.persistent === 'boolean' &&
+        (value.retention === 'retain' || value.retention === 'delete-on-destroy') &&
+        Array.isArray(value.dependsOn) &&
+        value.dependsOn.every((identity) => isScopedIdentity(identity, projectId, environment)));
+}
+/*** Enforce the public-value versus secret-reference output union at rest. */
+function isOutput(value, projectId, environment) {
+    if (!isRecord(value) ||
+        !isScopedIdentity(value.owner, projectId, environment) ||
+        typeof value.name !== 'string') {
+        return false;
+    }
+    if (value.visibility === 'public') {
+        return (['string', 'number', 'boolean'].includes(typeof value.value) &&
+            value.reference === undefined &&
+            (value.environmentVariable === undefined || typeof value.environmentVariable === 'string'));
+    }
+    return (value.visibility === 'secret' &&
+        value.value === undefined &&
+        value.environmentVariable === undefined &&
+        isSecretReference(value.reference, projectId, environment));
+}
+/*** Validate one generated-artifact ledger identity without accepting file content. */
+function isArtifactIdentity(value, projectId, environment) {
+    return (isRecord(value) &&
+        isScopedIdentity(value.owner, projectId, environment) &&
+        typeof value.path === 'string');
+}
+/*** Validate scope, adapter catalog identity, and resource ID. */
+function isScopedIdentity(value, projectId, environment) {
+    return (isRecord(value) &&
+        value.projectId === projectId &&
+        value.environment === environment &&
+        Object.values(INFRA_ADAPTER_CATALOG).some(({ id }) => id === value.adapter) &&
+        typeof value.resourceId === 'string');
+}
+/*** Validate an unresolved control-plane credential identity. */
+function isControlPlaneReference(value) {
+    return isRecord(value) && value.source === 'control-plane' && typeof value.name === 'string';
+}
+/*** Validate an unresolved secret reference scoped to this exact ledger. */
+function isSecretReference(value, projectId, environment) {
+    return (isRecord(value) &&
+        value.source === 'secret-store' &&
+        value.projectId === projectId &&
+        value.environment === environment &&
+        typeof value.ref === 'string' &&
+        typeof value.key === 'string');
+}
+/*** Narrow parsed values. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+//# sourceMappingURL=isInfraStoredState.js.map

package/dist/features/environment-lifecycle/utils/isInfraStoredState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraStoredState.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/isInfraStoredState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACL,qBAAqB,EAErB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAIpC,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;QACrC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,KAAc;IACnC,IACE,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,mBAAmB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC;QAC5E,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAC9B,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QACzC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;YACpC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YACtF,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YACzE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,KAAc;IACrC,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,UAAU;QACzB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ;QAC5C,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,SAAS,eAAe,CAAC,KAAc,EAAE,SAAiB,EAAE,WAAmB;IAC7E,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC;QACxD,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS;QACrC,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,mBAAmB,CAAC;QACzE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9B,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CACxF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,KAAc,EAAE,SAAiB,EAAE,WAAmB;IACtE,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC;QACtD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAC9B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CACL,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC;YAC5D,KAAK,CAAC,SAAS,KAAK,SAAS;YAC7B,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,CACL,KAAK,CAAC,UAAU,KAAK,QAAQ;QAC7B,KAAK,CAAC,KAAK,KAAK,SAAS;QACzB,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACvC,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,kBAAkB,CAAC,KAAc,EAAE,SAAiB,EAAE,WAAmB;IAChF,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC;QACrD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAC/B,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,SAAS,gBAAgB,CAAC,KAAc,EAAE,SAAiB,EAAE,WAAmB;IAC9E,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC;QAC3E,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CACrC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC/F,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,KAAc,EAAE,SAAiB,EAAE,WAAmB;IAC/E,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,MAAM,KAAK,cAAc;QAC/B,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAC9B,CAAC;AACJ,CAAC;AAED,6BAA6B;AAC7B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC","sourcesContent":["import { APP_ENVIRONMENT_IDS } from '@ankhorage/contracts/environments';\nimport {\n  INFRA_ADAPTER_CATALOG,\n  type InfraLedger,\n  isInfraEnvironmentSpec,\n} from '@ankhorage/contracts/infra';\n\nimport type { InfraStoredState } from '../../../types/infraOrchestration.js';\n\n/*** Validate persisted ownership state before any provider receives it. */\nexport function isInfraStoredState(value: unknown): value is InfraStoredState {\n  return (\n    isRecord(value) &&\n    value.schemaVersion === 1 &&\n    isInfraEnvironmentSpec(value.desired) &&\n    isInfraLedger(value.ledger)\n  );\n}\n\n/*** Validate the canonical ledger's serializable outer boundary. */\nfunction isInfraLedger(value: unknown): value is InfraLedger {\n  if (\n    isRecord(value) &&\n    value.schemaVersion === 1 &&\n    typeof value.projectId === 'string' &&\n    typeof value.environment === 'string' &&\n    APP_ENVIRONMENT_IDS.some((environment) => environment === value.environment) &&\n    Array.isArray(value.targets) &&\n    Array.isArray(value.resources) &&\n    Array.isArray(value.outputs) &&\n    Array.isArray(value.artifacts)\n  ) {\n    const { environment, projectId } = value;\n    return (\n      value.targets.every(isComputeTarget) &&\n      value.resources.every((resource) => isOwnedResource(resource, projectId, environment)) &&\n      value.outputs.every((output) => isOutput(output, projectId, environment)) &&\n      value.artifacts.every((artifact) => isArtifactIdentity(artifact, projectId, environment))\n    );\n  }\n  return false;\n}\n\n/*** Validate portable compute targets without accepting resolved credential payloads. */\nfunction isComputeTarget(value: unknown): boolean {\n  if (\n    !isRecord(value) ||\n    typeof value.id !== 'string' ||\n    !['linux', 'darwin', 'windows'].includes(String(value.os)) ||\n    !['amd64', 'arm64'].includes(String(value.architecture))\n  ) {\n    return false;\n  }\n  if (value.kind === 'local-host') return true;\n  return (\n    value.kind === 'ssh-host' &&\n    typeof value.host === 'string' &&\n    typeof value.port === 'number' &&\n    typeof value.user === 'string' &&\n    typeof value.hostKeyFingerprint === 'string' &&\n    isControlPlaneReference(value.credential)\n  );\n}\n\n/*** Validate one exact resource plus its dependency identities. */\nfunction isOwnedResource(value: unknown, projectId: string, environment: string): boolean {\n  return (\n    isRecord(value) &&\n    isScopedIdentity(value.identity, projectId, environment) &&\n    typeof value.persistent === 'boolean' &&\n    (value.retention === 'retain' || value.retention === 'delete-on-destroy') &&\n    Array.isArray(value.dependsOn) &&\n    value.dependsOn.every((identity) => isScopedIdentity(identity, projectId, environment))\n  );\n}\n\n/*** Enforce the public-value versus secret-reference output union at rest. */\nfunction isOutput(value: unknown, projectId: string, environment: string): boolean {\n  if (\n    !isRecord(value) ||\n    !isScopedIdentity(value.owner, projectId, environment) ||\n    typeof value.name !== 'string'\n  ) {\n    return false;\n  }\n  if (value.visibility === 'public') {\n    return (\n      ['string', 'number', 'boolean'].includes(typeof value.value) &&\n      value.reference === undefined &&\n      (value.environmentVariable === undefined || typeof value.environmentVariable === 'string')\n    );\n  }\n  return (\n    value.visibility === 'secret' &&\n    value.value === undefined &&\n    value.environmentVariable === undefined &&\n    isSecretReference(value.reference, projectId, environment)\n  );\n}\n\n/*** Validate one generated-artifact ledger identity without accepting file content. */\nfunction isArtifactIdentity(value: unknown, projectId: string, environment: string): boolean {\n  return (\n    isRecord(value) &&\n    isScopedIdentity(value.owner, projectId, environment) &&\n    typeof value.path === 'string'\n  );\n}\n\n/*** Validate scope, adapter catalog identity, and resource ID. */\nfunction isScopedIdentity(value: unknown, projectId: string, environment: string): boolean {\n  return (\n    isRecord(value) &&\n    value.projectId === projectId &&\n    value.environment === environment &&\n    Object.values(INFRA_ADAPTER_CATALOG).some(({ id }) => id === value.adapter) &&\n    typeof value.resourceId === 'string'\n  );\n}\n\n/*** Validate an unresolved control-plane credential identity. */\nfunction isControlPlaneReference(value: unknown): boolean {\n  return isRecord(value) && value.source === 'control-plane' && typeof value.name === 'string';\n}\n\n/*** Validate an unresolved secret reference scoped to this exact ledger. */\nfunction isSecretReference(value: unknown, projectId: string, environment: string): boolean {\n  return (\n    isRecord(value) &&\n    value.source === 'secret-store' &&\n    value.projectId === projectId &&\n    value.environment === environment &&\n    typeof value.ref === 'string' &&\n    typeof value.key === 'string'\n  );\n}\n\n/*** Narrow parsed values. */\nfunction isRecord(value: unknown): value is Readonly<Record<string, unknown>> {\n  return typeof value === 'object' && value !== null;\n}\n"]}

package/dist/features/environment-lifecycle/utils/mergeInfraOutputs.d.ts

@@ -0,0 +1,4 @@
+import type { InfraOutput } from '@ankhorage/contracts/infra';
+/*** Merge output identities while preferring the last adapter result for each owner and name. */
+export declare function mergeInfraOutputs(...groups: readonly (readonly InfraOutput[])[]): readonly InfraOutput[];
+//# sourceMappingURL=mergeInfraOutputs.d.ts.map

package/dist/features/environment-lifecycle/utils/mergeInfraOutputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeInfraOutputs.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/mergeInfraOutputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAI9D,iGAAiG;AACjG,wBAAgB,iBAAiB,CAC/B,GAAG,MAAM,EAAE,SAAS,CAAC,SAAS,WAAW,EAAE,CAAC,EAAE,GAC7C,SAAS,WAAW,EAAE,CAMxB"}

package/dist/features/environment-lifecycle/utils/mergeInfraOutputs.js

@@ -0,0 +1,10 @@
+import { infraIdentityKey } from './infraIdentityKey.js';
+/*** Merge output identities while preferring the last adapter result for each owner and name. */
+export function mergeInfraOutputs(...groups) {
+    const outputs = new Map();
+    for (const output of groups.flat()) {
+        outputs.set(`${infraIdentityKey(output.owner)}\0${output.name}`, output);
+    }
+    return [...outputs.values()];
+}
+//# sourceMappingURL=mergeInfraOutputs.js.map

package/dist/features/environment-lifecycle/utils/mergeInfraOutputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeInfraOutputs.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/mergeInfraOutputs.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAC/B,GAAG,MAA2C;IAE9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["import type { InfraOutput } from '@ankhorage/contracts/infra';\n\nimport { infraIdentityKey } from './infraIdentityKey.js';\n\n/*** Merge output identities while preferring the last adapter result for each owner and name. */\nexport function mergeInfraOutputs(\n  ...groups: readonly (readonly InfraOutput[])[]\n): readonly InfraOutput[] {\n  const outputs = new Map<string, InfraOutput>();\n  for (const output of groups.flat()) {\n    outputs.set(`${infraIdentityKey(output.owner)}\\0${output.name}`, output);\n  }\n  return [...outputs.values()];\n}\n"]}

package/dist/features/environment-lifecycle/utils/mergeInfraResources.d.ts

@@ -0,0 +1,4 @@
+import type { InfraOwnedResource } from '@ankhorage/contracts/infra';
+/*** Merge resource identities while preferring the last adapter result for each owner. */
+export declare function mergeInfraResources(...groups: readonly (readonly InfraOwnedResource[])[]): readonly InfraOwnedResource[];
+//# sourceMappingURL=mergeInfraResources.d.ts.map

package/dist/features/environment-lifecycle/utils/mergeInfraResources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeInfraResources.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/mergeInfraResources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIrE,0FAA0F;AAC1F,wBAAgB,mBAAmB,CACjC,GAAG,MAAM,EAAE,SAAS,CAAC,SAAS,kBAAkB,EAAE,CAAC,EAAE,GACpD,SAAS,kBAAkB,EAAE,CAM/B"}

package/dist/features/environment-lifecycle/utils/mergeInfraResources.js

@@ -0,0 +1,10 @@
+import { infraIdentityKey } from './infraIdentityKey.js';
+/*** Merge resource identities while preferring the last adapter result for each owner. */
+export function mergeInfraResources(...groups) {
+    const resources = new Map();
+    for (const resource of groups.flat()) {
+        resources.set(infraIdentityKey(resource.identity), resource);
+    }
+    return [...resources.values()];
+}
+//# sourceMappingURL=mergeInfraResources.js.map

package/dist/features/environment-lifecycle/utils/mergeInfraResources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeInfraResources.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/mergeInfraResources.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,0FAA0F;AAC1F,MAAM,UAAU,mBAAmB,CACjC,GAAG,MAAkD;IAErD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACjC,CAAC","sourcesContent":["import type { InfraOwnedResource } from '@ankhorage/contracts/infra';\n\nimport { infraIdentityKey } from './infraIdentityKey.js';\n\n/*** Merge resource identities while preferring the last adapter result for each owner. */\nexport function mergeInfraResources(\n  ...groups: readonly (readonly InfraOwnedResource[])[]\n): readonly InfraOwnedResource[] {\n  const resources = new Map<string, InfraOwnedResource>();\n  for (const resource of groups.flat()) {\n    resources.set(infraIdentityKey(resource.identity), resource);\n  }\n  return [...resources.values()];\n}\n"]}

package/dist/features/environment-lifecycle/utils/normalizeInfraEnvironmentKey.d.ts

@@ -0,0 +1,3 @@
+/*** Convert arbitrary credential and secret identifiers into stable environment-variable segments. */
+export declare function normalizeInfraEnvironmentKey(value: string): string;
+//# sourceMappingURL=normalizeInfraEnvironmentKey.d.ts.map

package/dist/features/environment-lifecycle/utils/normalizeInfraEnvironmentKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizeInfraEnvironmentKey.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/normalizeInfraEnvironmentKey.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlE"}

package/dist/features/environment-lifecycle/utils/normalizeInfraEnvironmentKey.js

@@ -0,0 +1,8 @@
+/*** Convert arbitrary credential and secret identifiers into stable environment-variable segments. */
+export function normalizeInfraEnvironmentKey(value) {
+    return value
+        .replaceAll(/[^A-Za-z0-9]+/gu, '_')
+        .replaceAll(/^_+|_+$/gu, '')
+        .toUpperCase();
+}
+//# sourceMappingURL=normalizeInfraEnvironmentKey.js.map

package/dist/features/environment-lifecycle/utils/normalizeInfraEnvironmentKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizeInfraEnvironmentKey.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/normalizeInfraEnvironmentKey.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,OAAO,KAAK;SACT,UAAU,CAAC,iBAAiB,EAAE,GAAG,CAAC;SAClC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE,CAAC;AACnB,CAAC","sourcesContent":["/*** Convert arbitrary credential and secret identifiers into stable environment-variable segments. */\nexport function normalizeInfraEnvironmentKey(value: string): string {\n  return value\n    .replaceAll(/[^A-Za-z0-9]+/gu, '_')\n    .replaceAll(/^_+|_+$/gu, '')\n    .toUpperCase();\n}\n"]}

package/dist/features/environment-lifecycle/utils/resolveInfraStatePath.d.ts

@@ -0,0 +1,4 @@
+import { type AppEnvironmentId } from '@ankhorage/contracts/environments';
+/*** Build an exact state-file path from a closed canonical environment identifier. */
+export declare function resolveInfraStatePath(projectPath: string, environment: AppEnvironmentId): string;
+//# sourceMappingURL=resolveInfraStatePath.d.ts.map

package/dist/features/environment-lifecycle/utils/resolveInfraStatePath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveInfraStatePath.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/resolveInfraStatePath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAK/F,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAKhG"}

package/dist/features/environment-lifecycle/utils/resolveInfraStatePath.js

@@ -0,0 +1,11 @@
+import { APP_ENVIRONMENT_IDS } from '@ankhorage/contracts/environments';
+import path from 'path';
+const INFRA_STATE_ROOT = '.ankh/infra';
+/*** Build an exact state-file path from a closed canonical environment identifier. */
+export function resolveInfraStatePath(projectPath, environment) {
+    if (!APP_ENVIRONMENT_IDS.includes(environment)) {
+        throw new Error(`Invalid Infra state environment: ${environment}`);
+    }
+    return path.join(projectPath, INFRA_STATE_ROOT, environment, 'state.json');
+}
+//# sourceMappingURL=resolveInfraStatePath.js.map

package/dist/features/environment-lifecycle/utils/resolveInfraStatePath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveInfraStatePath.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/resolveInfraStatePath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAyB,MAAM,mCAAmC,CAAC;AAC/F,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,WAA6B;IACtF,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import { APP_ENVIRONMENT_IDS, type AppEnvironmentId } from '@ankhorage/contracts/environments';\nimport path from 'path';\n\nconst INFRA_STATE_ROOT = '.ankh/infra';\n\n/*** Build an exact state-file path from a closed canonical environment identifier. */\nexport function resolveInfraStatePath(projectPath: string, environment: AppEnvironmentId): string {\n  if (!APP_ENVIRONMENT_IDS.includes(environment)) {\n    throw new Error(`Invalid Infra state environment: ${environment}`);\n  }\n  return path.join(projectPath, INFRA_STATE_ROOT, environment, 'state.json');\n}\n"]}

package/dist/features/environment-lifecycle/utils/resolveProjectFile.d.ts

@@ -0,0 +1,3 @@
+/*** Resolve one generated path inside the project while protecting Infra state and traversal. */
+export declare function resolveProjectFile(projectPath: string, filePath: string): string;
+//# sourceMappingURL=resolveProjectFile.d.ts.map

package/dist/features/environment-lifecycle/utils/resolveProjectFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveProjectFile.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/resolveProjectFile.ts"],"names":[],"mappings":"AAIA,iGAAiG;AACjG,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgBhF"}

package/dist/features/environment-lifecycle/utils/resolveProjectFile.js

@@ -0,0 +1,19 @@
+import path from 'path';
+const INFRA_STATE_ROOT = '.ankh/infra';
+/*** Resolve one generated path inside the project while protecting Infra state and traversal. */
+export function resolveProjectFile(projectPath, filePath) {
+    if (filePath.length === 0 ||
+        path.isAbsolute(filePath) ||
+        filePath === INFRA_STATE_ROOT ||
+        filePath.startsWith(`${INFRA_STATE_ROOT}/`)) {
+        throw new Error(`Invalid generated Infra artifact path: ${filePath}`);
+    }
+    const rootPath = path.resolve(projectPath);
+    const resolvedPath = path.resolve(rootPath, filePath);
+    const relativePath = path.relative(rootPath, resolvedPath);
+    if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
+        throw new Error(`Invalid generated Infra artifact path outside project root: ${filePath}`);
+    }
+    return resolvedPath;
+}
+//# sourceMappingURL=resolveProjectFile.js.map

package/dist/features/environment-lifecycle/utils/resolveProjectFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveProjectFile.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/resolveProjectFile.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,iGAAiG;AACjG,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,QAAgB;IACtE,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,QAAQ,KAAK,gBAAgB;QAC7B,QAAQ,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC3D,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,+DAA+D,QAAQ,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import path from 'path';\n\nconst INFRA_STATE_ROOT = '.ankh/infra';\n\n/*** Resolve one generated path inside the project while protecting Infra state and traversal. */\nexport function resolveProjectFile(projectPath: string, filePath: string): string {\n  if (\n    filePath.length === 0 ||\n    path.isAbsolute(filePath) ||\n    filePath === INFRA_STATE_ROOT ||\n    filePath.startsWith(`${INFRA_STATE_ROOT}/`)\n  ) {\n    throw new Error(`Invalid generated Infra artifact path: ${filePath}`);\n  }\n  const rootPath = path.resolve(projectPath);\n  const resolvedPath = path.resolve(rootPath, filePath);\n  const relativePath = path.relative(rootPath, resolvedPath);\n  if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {\n    throw new Error(`Invalid generated Infra artifact path outside project root: ${filePath}`);\n  }\n  return resolvedPath;\n}\n"]}

package/dist/features/environment-lifecycle/utils/retainUnchangedAdapterOutputs.d.ts

@@ -0,0 +1,4 @@
+import type { InfraOutput } from '@ankhorage/contracts/infra';
+/*** Keep prior outputs not owned by adapters that returned a replacement snapshot. */
+export declare function retainUnchangedAdapterOutputs(previous: readonly InfraOutput[], replacements: readonly InfraOutput[], replacedAdapters: ReadonlySet<string>): readonly InfraOutput[];
+//# sourceMappingURL=retainUnchangedAdapterOutputs.d.ts.map

package/dist/features/environment-lifecycle/utils/retainUnchangedAdapterOutputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retainUnchangedAdapterOutputs.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/retainUnchangedAdapterOutputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAI9D,sFAAsF;AACtF,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,YAAY,EAAE,SAAS,WAAW,EAAE,EACpC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GACpC,SAAS,WAAW,EAAE,CAKxB"}

package/dist/features/environment-lifecycle/utils/retainUnchangedAdapterOutputs.js

@@ -0,0 +1,6 @@
+import { mergeInfraOutputs } from './mergeInfraOutputs.js';
+/*** Keep prior outputs not owned by adapters that returned a replacement snapshot. */
+export function retainUnchangedAdapterOutputs(previous, replacements, replacedAdapters) {
+    return mergeInfraOutputs(previous.filter(({ owner }) => !replacedAdapters.has(owner.adapter)), replacements);
+}
+//# sourceMappingURL=retainUnchangedAdapterOutputs.js.map

package/dist/features/environment-lifecycle/utils/retainUnchangedAdapterOutputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retainUnchangedAdapterOutputs.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/retainUnchangedAdapterOutputs.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,sFAAsF;AACtF,MAAM,UAAU,6BAA6B,CAC3C,QAAgC,EAChC,YAAoC,EACpC,gBAAqC;IAErC,OAAO,iBAAiB,CACtB,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EACpE,YAAY,CACb,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraOutput } from '@ankhorage/contracts/infra';\n\nimport { mergeInfraOutputs } from './mergeInfraOutputs.js';\n\n/*** Keep prior outputs not owned by adapters that returned a replacement snapshot. */\nexport function retainUnchangedAdapterOutputs(\n  previous: readonly InfraOutput[],\n  replacements: readonly InfraOutput[],\n  replacedAdapters: ReadonlySet<string>,\n): readonly InfraOutput[] {\n  return mergeInfraOutputs(\n    previous.filter(({ owner }) => !replacedAdapters.has(owner.adapter)),\n    replacements,\n  );\n}\n"]}

package/dist/features/environment-lifecycle/utils/retainUnchangedAdapterResources.d.ts

@@ -0,0 +1,4 @@
+import type { InfraOwnedResource } from '@ankhorage/contracts/infra';
+/*** Keep prior resources not owned by adapters that returned a replacement snapshot. */
+export declare function retainUnchangedAdapterResources(previous: readonly InfraOwnedResource[], replacements: readonly InfraOwnedResource[], replacedAdapters: ReadonlySet<string>): readonly InfraOwnedResource[];
+//# sourceMappingURL=retainUnchangedAdapterResources.d.ts.map

package/dist/features/environment-lifecycle/utils/retainUnchangedAdapterResources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retainUnchangedAdapterResources.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/retainUnchangedAdapterResources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIrE,wFAAwF;AACxF,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,SAAS,kBAAkB,EAAE,EACvC,YAAY,EAAE,SAAS,kBAAkB,EAAE,EAC3C,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GACpC,SAAS,kBAAkB,EAAE,CAK/B"}