@ankhorage/infra 4.1.12 → 5.1.0

package/src/environmentLifecycle.test.ts

@@ -0,0 +1,193 @@
+import type {
+  InfraAdapterDescriptor,
+  InfraComputeAdapter,
+  InfraEnvironmentSpec,
+  InfraResult,
+  InfraRuntimeAdapter,
+  InfraServiceAdapter,
+} from '@ankhorage/contracts/infra';
+import { INFRA_ADAPTER_CATALOG } from '@ankhorage/contracts/infra';
+import { describe, expect, it } from 'bun:test';
+
+import type { InfraAdapterPackageResolver } from './features/environment-lifecycle/application/ports/outbound/infraAdapterPackage';
+import { resolveInfraAdaptersAsync } from './features/environment-lifecycle/application/use-cases/resolveInfraAdaptersAsync';
+import { resolveInfraEnvironment } from './features/environment-lifecycle/domain/resolveInfraEnvironment';
+
+const local = {
+  deployment: { compute: { provider: 'local' }, runtime: { provider: 'docker-compose' } },
+  database: { provider: 'supabase' },
+  auth: { provider: 'supabase' },
+  authz: { provider: 'cerbos', kind: 'ABAC' },
+} as const satisfies InfraEnvironmentSpec;
+const manifest = { environments: { local, preview: local }, modules: [] } as const;
+
+describe('environment safety', () => {
+  it('defaults only to local and requires explicit destroy selection', () => {
+    expect(resolveInfraEnvironment({ manifest, operation: 'up' })).toMatchObject({
+      ok: true,
+      value: { id: 'local' },
+    });
+    expect(resolveInfraEnvironment({ manifest, operation: 'destroy' })).toMatchObject({
+      ok: false,
+      diagnostics: [{ code: 'infra-environment-required' }],
+    });
+  });
+
+  it('accepts configured explicit environments and rejects unknown or absent ones', () => {
+    expect(
+      resolveInfraEnvironment({ manifest, operation: 'up', environment: 'preview' }),
+    ).toMatchObject({ ok: true, value: { id: 'preview' } });
+    expect(
+      resolveInfraEnvironment({ manifest, operation: 'status', environment: 'production' }),
+    ).toMatchObject({ ok: false, diagnostics: [{ code: 'infra-environment-unconfigured' }] });
+    expect(
+      resolveInfraEnvironment({ manifest, operation: 'status', environment: 'staging' }),
+    ).toMatchObject({ ok: false, diagnostics: [{ code: 'infra-environment-invalid' }] });
+  });
+});
+
+describe('selected adapter resolution', () => {
+  it('loads only selected packages and deduplicates the Supabase platform', async () => {
+    const requested: string[] = [];
+    const resolver = createResolver(requested);
+    const result = await resolveInfraAdaptersAsync(local, resolver);
+
+    expect(result.ok).toBe(true);
+    expect(requested).toEqual([
+      '@ankhorage/local',
+      '@ankhorage/docker-compose',
+      '@ankhorage/supabase',
+      '@ankhorage/cerbos',
+    ]);
+    if (!result.ok) throw new Error('Expected adapters.');
+    expect(result.value.services.map(({ descriptor }) => descriptor.id)).toEqual([
+      'supabase',
+      'cerbos',
+    ]);
+  });
+
+  it('fails closed for unavailable and malformed selected packages', async () => {
+    const missing = await resolveInfraAdaptersAsync(local, {
+      loadAsync: () => Promise.reject(new Error('missing')),
+    });
+    expect(missing.ok).toBe(false);
+    expect(
+      missing.diagnostics.every(({ code }) => code === 'infra-adapter-package-unavailable'),
+    ).toBe(true);
+
+    const malformed = await resolveInfraAdaptersAsync(local, {
+      loadAsync: () => Promise.resolve({ createInfraAdapter: () => ({}) }),
+    });
+    expect(malformed.ok).toBe(false);
+    expect(malformed.diagnostics.every(({ code }) => code === 'infra-adapter-module-invalid')).toBe(
+      true,
+    );
+  });
+
+  it('rejects a factory that throws or returns another valid adapter identity', async () => {
+    const throwing = await resolveInfraAdaptersAsync(local, {
+      loadAsync(packageName) {
+        const descriptor = descriptorForPackage(packageName);
+        return Promise.resolve({
+          infraAdapterDescriptor: descriptor,
+          createInfraAdapter: () => {
+            throw new Error('secret provider detail');
+          },
+        });
+      },
+    });
+    expect(throwing.ok).toBe(false);
+    expect(throwing.diagnostics[0]).toMatchObject({ code: 'infra-local-adapter-invalid' });
+    expect(throwing.diagnostics[0]?.message).not.toContain('secret provider detail');
+
+    const mismatched = await resolveInfraAdaptersAsync(local, {
+      loadAsync(packageName) {
+        const descriptor = descriptorForPackage(packageName);
+        return Promise.resolve({
+          infraAdapterDescriptor: descriptor,
+          createInfraAdapter: () =>
+            descriptor.id === 'local'
+              ? createComputeAdapter(INFRA_ADAPTER_CATALOG.hetzner)
+              : createAdapter(descriptor),
+        });
+      },
+    });
+    expect(mismatched.ok).toBe(false);
+    expect(mismatched.diagnostics[0]).toMatchObject({ code: 'infra-local-adapter-invalid' });
+  });
+});
+
+function createResolver(requested: string[]): InfraAdapterPackageResolver {
+  return {
+    loadAsync(packageName) {
+      requested.push(packageName);
+      const descriptor = descriptorForPackage(packageName);
+      return Promise.resolve({
+        infraAdapterDescriptor: descriptor,
+        createInfraAdapter: () => createAdapter(descriptor),
+      });
+    },
+  };
+}
+
+function descriptorForPackage(packageName: string): InfraAdapterDescriptor {
+  const descriptor = Object.values(INFRA_ADAPTER_CATALOG).find(
+    ({ package: candidate }) => candidate === packageName,
+  );
+  if (descriptor === undefined) throw new Error('Unexpected package.');
+  return descriptor;
+}
+
+function createAdapter(descriptor: InfraAdapterDescriptor): unknown {
+  if (descriptor.kind === 'compute') return createComputeAdapter(descriptor);
+  if (descriptor.kind === 'runtime') return createRuntimeAdapter(descriptor);
+  return createServiceAdapter(descriptor);
+}
+
+function createComputeAdapter(descriptor: InfraAdapterDescriptor): InfraComputeAdapter {
+  return {
+    descriptor: descriptor as InfraComputeAdapter['descriptor'],
+    validateAsync: successNull,
+    inspectAsync: () => Promise.resolve(success({ resources: [], outputs: [], targets: [] })),
+    planAsync: successEmpty,
+    ensureAsync: () => Promise.resolve(success({ resources: [], outputs: [], targets: [] })),
+    statusAsync: successEmpty,
+    destroyAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+  };
+}
+
+function createRuntimeAdapter(descriptor: InfraAdapterDescriptor): InfraRuntimeAdapter {
+  return {
+    descriptor: descriptor as InfraRuntimeAdapter['descriptor'],
+    validateAsync: successNull,
+    planAsync: successEmpty,
+    ensureAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+    statusAsync: successEmpty,
+    suspendAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+    destroyAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+  };
+}
+
+function createServiceAdapter(descriptor: InfraAdapterDescriptor): InfraServiceAdapter {
+  return {
+    descriptor: descriptor as InfraServiceAdapter['descriptor'],
+    validateAsync: successNull,
+    planAsync: successEmpty,
+    desiredWorkloadsAsync: successEmpty,
+    reconcileAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+    statusAsync: successEmpty,
+    destroyAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+  };
+}
+
+function successNull(): Promise<InfraResult<null>> {
+  return Promise.resolve(success(null));
+}
+
+function successEmpty<T>(): Promise<InfraResult<readonly T[]>> {
+  return Promise.resolve(success([]));
+}
+
+function success<T>(value: T): InfraResult<T> {
+  return { ok: true, value, diagnostics: [] };
+}

package/src/features/environment-lifecycle/adapters/outbound/createEnvironmentInfraCredentialPort.ts

@@ -0,0 +1,52 @@
+import type { InfraExecutionContext, InfraResult } from '@ankhorage/contracts/infra';
+
+import { createInfraFailure } from '../../utils/createInfraFailure.js';
+import { normalizeInfraEnvironmentKey } from '../../utils/normalizeInfraEnvironmentKey.js';
+
+/*** Resolve execution-only control-plane credentials from exact-name or prefixed environment data. */
+export function createEnvironmentInfraCredentialPort(
+  environment: Readonly<Record<string, string | undefined>>,
+): InfraExecutionContext['credentials'] {
+  return {
+    resolveAsync(reference) {
+      const prefixedName = `ANKH_INFRA_CREDENTIAL_${normalizeInfraEnvironmentKey(reference.name)}`;
+      const rawValue =
+        Reflect.get(environment, reference.name) ?? Reflect.get(environment, prefixedName);
+      if (rawValue === undefined || rawValue.length === 0) {
+        return Promise.resolve(
+          createInfraFailure(
+            'infra-control-plane-credential-missing',
+            `Control-plane credential ${reference.name} is unavailable. Set ${reference.name} or ${prefixedName}.`,
+          ),
+        );
+      }
+      return Promise.resolve(parseCredentialBundle(reference.name, rawValue));
+    },
+  };
+}
+
+/*** Parse JSON credential bundles; token variables also support their conventional scalar form. */
+function parseCredentialBundle(
+  name: string,
+  rawValue: string,
+): InfraResult<Readonly<Record<string, string>>> {
+  try {
+    const parsed: unknown = JSON.parse(rawValue);
+    if (isRecord(parsed) && Object.values(parsed).every((value) => typeof value === 'string')) {
+      return { ok: true, value: parsed as Readonly<Record<string, string>>, diagnostics: [] };
+    }
+  } catch {
+    if (name.endsWith('_TOKEN')) {
+      return { ok: true, value: { token: rawValue, apiToken: rawValue }, diagnostics: [] };
+    }
+  }
+  return createInfraFailure(
+    'infra-control-plane-credential-invalid',
+    `Control-plane credential ${name} must be a JSON object containing string fields.`,
+  );
+}
+
+/*** Narrow JSON credential bundles. */
+function isRecord(value: unknown): value is Readonly<Record<string, unknown>> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/src/features/environment-lifecycle/adapters/outbound/createEnvironmentInfraSecretPort.ts

@@ -0,0 +1,32 @@
+import type { InfraExecutionContext } from '@ankhorage/contracts/infra';
+
+import { createInfraFailure } from '../../utils/createInfraFailure.js';
+import { normalizeInfraEnvironmentKey } from '../../utils/normalizeInfraEnvironmentKey.js';
+
+/*** Resolve explicitly addressed secret values from environment data without serializing them. */
+export function createEnvironmentInfraSecretPort(
+  environment: Readonly<Record<string, string | undefined>>,
+): InfraExecutionContext['secrets'] {
+  return {
+    resolveAsync(reference) {
+      const variable = [
+        'ANKH_INFRA_SECRET',
+        reference.projectId,
+        reference.environment,
+        reference.ref,
+        reference.key,
+      ]
+        .map(normalizeInfraEnvironmentKey)
+        .join('_');
+      const value: unknown = Reflect.get(environment, variable);
+      return Promise.resolve(
+        typeof value !== 'string' || value.length === 0
+          ? createInfraFailure(
+              'infra-secret-unavailable',
+              `Secret reference ${reference.ref}/${reference.key} is unavailable. Set ${variable}.`,
+            )
+          : { ok: true, value, diagnostics: [] },
+      );
+    },
+  };
+}

package/src/features/environment-lifecycle/adapters/outbound/createNodeInfraAdapterPackageResolver.ts

@@ -0,0 +1,10 @@
+import type { InfraAdapterPackageResolver } from '../../application/ports/outbound/infraAdapterPackage.js';
+
+/*** Load only a catalog-selected package through the host module resolver. */
+export function createNodeInfraAdapterPackageResolver(): InfraAdapterPackageResolver {
+  return {
+    loadAsync(packageName) {
+      return import(packageName);
+    },
+  };
+}

package/src/features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.ts

@@ -0,0 +1,34 @@
+import type { AppEnvironmentId } from '@ankhorage/contracts/environments';
+import { promises as fs } from 'fs';
+
+import type { InfraStoredState } from '../../../../types/infraOrchestration.js';
+import { isInfraStoredState } from '../../utils/isInfraStoredState.js';
+import { resolveInfraStatePath } from '../../utils/resolveInfraStatePath.js';
+
+/*** Read exact environment state; malformed ownership state fails closed rather than disappearing. */
+export async function readStoredInfraStateAsync(
+  projectPath: string,
+  environment: AppEnvironmentId,
+): Promise<InfraStoredState | null> {
+  const statePath = resolveInfraStatePath(projectPath, environment);
+  try {
+    const parsed: unknown = JSON.parse(await fs.readFile(statePath, 'utf8'));
+    if (!isInfraStoredState(parsed)) {
+      throw new Error(`Stored Infra state has an invalid shape: ${statePath}`);
+    }
+    return parsed;
+  } catch (error) {
+    if (isMissingFile(error)) return null;
+    throw error;
+  }
+}
+
+/*** Recognize only the filesystem's absent-file failure. */
+function isMissingFile(error: unknown): boolean {
+  return isRecord(error) && error.code === 'ENOENT';
+}
+
+/*** Narrow filesystem error values. */
+function isRecord(value: unknown): value is Readonly<Record<string, unknown>> {
+  return typeof value === 'object' && value !== null;
+}

package/src/features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.ts

@@ -0,0 +1,12 @@
+import type { AppEnvironmentId } from '@ankhorage/contracts/environments';
+import { promises as fs } from 'fs';
+
+import { resolveInfraStatePath } from '../../utils/resolveInfraStatePath.js';
+
+/*** Remove only the exact selected environment state after a complete destroy. */
+export async function removeStoredInfraStateAsync(
+  projectPath: string,
+  environment: AppEnvironmentId,
+): Promise<void> {
+  await fs.rm(resolveInfraStatePath(projectPath, environment), { force: true });
+}

package/src/{project.ts → features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.ts}

@@ -2,16 +2,10 @@ import { type AppManifest, isAppManifest } from '@ankhorage/contracts';
 import { promises as fs } from 'fs';
 import path from 'path';
 
-export interface ResolvedInfraProject {
-  readonly appsRoot: string;
-  readonly manifest: AppManifest;
-  readonly manifestPath: string;
-  readonly projectId: string;
-  readonly projectPath: string;
-  readonly workspaceRoot: string;
-}
+import type { ResolvedInfraProject } from '../../../../types/infraProject.js';
 
-export async function resolveInfraProject(options: {
+/*** Resolve one manifest-backed Infra project from the workspace and optional project selector. */
+export async function resolveInfraProjectAsync(options: {
   readonly cwd: string;
   readonly projectId?: string;
 }): Promise<ResolvedInfraProject> {
@@ -37,7 +31,7 @@ export async function resolveInfraProject(options: {
   }
 
   const manifestPath = path.join(projectPath, 'ankh.config.json');
-  const manifest = await readProjectManifest({ manifestPath, projectId });
+  const manifest = await readProjectManifest(manifestPath);
 
   return {
     appsRoot,
@@ -60,54 +54,25 @@ function resolveProjectPath(appsRoot: string, projectId: string): string {
   return projectPath;
 }
 
-function createFallbackManifest(projectId: string): AppManifest {
-  return {
-    metadata: {
-      name: projectId,
-      slug: projectId,
-      version: '0.0.0',
-      category: 'developer_tools',
-      themeId: 'default',
-    },
-    themes: [],
-    activeThemeId: 'default',
-    infra: { modules: [] },
-    navigator: {
-      type: 'stack',
-      routes: [{ name: 'index', screenId: 'index' }],
-    },
-    screens: {},
-    settings: {
-      localization: {
-        defaultLocale: 'en',
-        locales: ['en'],
-      },
-    },
-  };
-}
-
-async function readProjectManifest(args: {
-  readonly manifestPath: string;
-  readonly projectId: string;
-}): Promise<AppManifest> {
-  if (!(await pathExists(args.manifestPath))) {
-    return createFallbackManifest(args.projectId);
+async function readProjectManifest(manifestPath: string): Promise<AppManifest> {
+  if (!(await pathExists(manifestPath))) {
+    throw new Error(`Project manifest not found: ${manifestPath}`);
   }
 
-  const rawManifest = await fs.readFile(args.manifestPath, 'utf8');
+  const rawManifest = await fs.readFile(manifestPath, 'utf8');
   let parsed: unknown;
 
   try {
     parsed = JSON.parse(rawManifest);
   } catch (error) {
     throw new Error(
-      `Project manifest is not valid JSON: ${args.manifestPath}: ${getErrorMessage(error)}`,
+      `Project manifest is not valid JSON: ${manifestPath}: ${getErrorMessage(error)}`,
       { cause: error },
     );
   }
 
   if (!isAppManifest(parsed)) {
-    throw new Error(`Project manifest has an invalid shape: ${args.manifestPath}`);
+    throw new Error(`Project manifest has an invalid shape: ${manifestPath}`);
   }
 
   return parsed;

package/src/features/environment-lifecycle/adapters/outbound/writeInfraGeneratedArtifactsAsync.ts

@@ -0,0 +1,34 @@
+import type { InfraGeneratedArtifact, InfraLedger } from '@ankhorage/contracts/infra';
+import { promises as fs } from 'fs';
+import path from 'path';
+
+import type { InfraArtifactWriteResult } from '../../../../types/infraProject.js';
+import { resolveProjectFile } from '../../utils/resolveProjectFile.js';
+
+/*** Write validated generated artifacts and remove only stale paths from the prior ledger. */
+export async function writeInfraGeneratedArtifactsAsync(
+  projectPath: string,
+  artifacts: readonly InfraGeneratedArtifact[],
+  previous: InfraLedger | undefined,
+): Promise<InfraArtifactWriteResult> {
+  const nextPaths = new Set<string>();
+  const validated = artifacts.map((artifact) => {
+    if (nextPaths.has(artifact.path)) {
+      throw new Error(`Duplicate generated Infra artifact path: ${artifact.path}`);
+    }
+    nextPaths.add(artifact.path);
+    return { artifact, outputPath: resolveProjectFile(projectPath, artifact.path) };
+  });
+  for (const { artifact, outputPath } of validated) {
+    await fs.mkdir(path.dirname(outputPath), { recursive: true });
+    await fs.writeFile(outputPath, artifact.content, 'utf8');
+    if (artifact.executable === true) await fs.chmod(outputPath, 0o755);
+  }
+  const stalePaths = (previous?.artifacts ?? [])
+    .map(({ path: artifactPath }) => artifactPath)
+    .filter((artifactPath) => !nextPaths.has(artifactPath));
+  for (const stalePath of stalePaths) {
+    await fs.rm(resolveProjectFile(projectPath, stalePath), { force: true });
+  }
+  return { written: validated.length, removed: stalePaths.length };
+}

package/src/features/environment-lifecycle/adapters/outbound/writeStoredInfraStateAsync.ts

@@ -0,0 +1,21 @@
+import { promises as fs } from 'fs';
+import path from 'path';
+
+import type { InfraStoredState } from '../../../../types/infraOrchestration.js';
+import { isInfraStoredState } from '../../utils/isInfraStoredState.js';
+import { resolveInfraStatePath } from '../../utils/resolveInfraStatePath.js';
+
+/*** Persist serializable desired identity plus a secret-safe canonical ledger atomically. */
+export async function writeStoredInfraStateAsync(
+  projectPath: string,
+  state: InfraStoredState,
+): Promise<void> {
+  if (!isInfraStoredState(state)) {
+    throw new Error('Refusing to persist invalid or cross-scoped Infra ownership state.');
+  }
+  const statePath = resolveInfraStatePath(projectPath, state.ledger.environment);
+  const temporaryPath = `${statePath}.tmp`;
+  await fs.mkdir(path.dirname(statePath), { recursive: true });
+  await fs.writeFile(temporaryPath, `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+  await fs.rename(temporaryPath, statePath);
+}

package/src/features/environment-lifecycle/application/ports/outbound/infraAdapterPackage.ts

@@ -0,0 +1,10 @@
+import type { InfraAdapterDescriptor } from '@ankhorage/contracts/infra';
+
+export interface InfraAdapterPackageResolver {
+  loadAsync(packageName: string): Promise<unknown>;
+}
+
+export interface InfraAdapterPackageModule {
+  readonly infraAdapterDescriptor: InfraAdapterDescriptor;
+  readonly createInfraAdapter: () => unknown;
+}

package/src/features/environment-lifecycle/application/use-cases/collectInfraWorkloadsAsync.ts

@@ -0,0 +1,25 @@
+import type {
+  InfraDiagnostic,
+  InfraExecutionContext,
+  InfraResult,
+  InfraServiceAdapter,
+  InfraWorkloadSpec,
+} from '@ankhorage/contracts/infra';
+
+import { appendInfraFailure } from '../../utils/appendInfraFailure.js';
+
+/*** Collect each service workload graph once in deterministic adapter order. */
+export async function collectInfraWorkloadsAsync(
+  context: InfraExecutionContext,
+  services: readonly InfraServiceAdapter[],
+): Promise<InfraResult<readonly InfraWorkloadSpec[]>> {
+  const workloads: InfraWorkloadSpec[] = [];
+  const diagnostics: InfraDiagnostic[] = [];
+  for (const service of services) {
+    const desired = await service.desiredWorkloadsAsync(context);
+    if (!desired.ok) return appendInfraFailure(diagnostics, desired);
+    workloads.push(...desired.value);
+    diagnostics.push(...desired.diagnostics);
+  }
+  return { ok: true, value: workloads, diagnostics };
+}

package/src/features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.ts

@@ -0,0 +1,119 @@
+import type {
+  InfraDestroyRequest,
+  InfraDiagnostic,
+  InfraOutput,
+  InfraOwnedResource,
+  InfraResult,
+} from '@ankhorage/contracts/infra';
+
+import type {
+  InfraDestroyOperationRequest,
+  InfraDestroyOperationResult,
+  InfraOrchestrationDependencies,
+} from '../../../../types/infraOrchestration.js';
+import { appendInfraFailure } from '../../utils/appendInfraFailure.js';
+import { createInfraLedger } from '../../utils/createInfraLedger.js';
+import { infraIdentityKey } from '../../utils/infraIdentityKey.js';
+import { mergeInfraOutputs } from '../../utils/mergeInfraOutputs.js';
+import { mergeInfraResources } from '../../utils/mergeInfraResources.js';
+import { prepareInfraOperationAsync } from './prepareInfraOperationAsync.js';
+
+/*** Destroy exact owned resources in reverse dependency order behind explicit scope confirmation. */
+export async function destroyInfraEnvironmentAsync(
+  request: InfraDestroyOperationRequest,
+  dependencies: InfraOrchestrationDependencies,
+): Promise<InfraDestroyOperationResult> {
+  const prepared = await prepareInfraOperationAsync(request, 'destroy', dependencies);
+  if (!prepared.ok) return prepared;
+  const destroyRequest: InfraDestroyRequest = {
+    projectId: request.projectId,
+    environment: prepared.value.environment.id,
+    confirmation: request.confirmation,
+    persistence: request.persistence,
+  };
+  const safety = validateDestroyRequest(destroyRequest, request.previous?.resources ?? []);
+  if (!safety.ok) return safety;
+  const diagnostics: InfraDiagnostic[] = [...prepared.diagnostics];
+  const resources: InfraOwnedResource[] = [];
+  const outputs: InfraOutput[] = [];
+  for (const service of [...prepared.value.adapters.services].reverse()) {
+    const result = await service.destroyAsync(prepared.value.context, destroyRequest);
+    if (!result.ok) return appendInfraFailure(diagnostics, result);
+    resources.push(...result.value.resources);
+    outputs.push(...result.value.outputs);
+    diagnostics.push(...result.diagnostics);
+  }
+  if (prepared.value.runtimeDesired.targets.length > 0) {
+    const runtime = await prepared.value.adapters.runtime.destroyAsync(
+      prepared.value.context,
+      prepared.value.runtimeDesired,
+      destroyRequest,
+    );
+    if (!runtime.ok) return appendInfraFailure(diagnostics, runtime);
+    resources.push(...runtime.value.resources);
+    outputs.push(...runtime.value.outputs);
+    diagnostics.push(...runtime.diagnostics);
+  }
+  const compute = await prepared.value.adapters.compute.destroyAsync(
+    prepared.value.context,
+    destroyRequest,
+  );
+  if (!compute.ok) return appendInfraFailure(diagnostics, compute);
+  resources.push(...compute.value.resources);
+  outputs.push(...compute.value.outputs);
+  diagnostics.push(...compute.diagnostics);
+  const remainingResources = mergeInfraResources(resources);
+  const remainingOutputs = mergeInfraOutputs(outputs);
+  const ledger =
+    remainingResources.length === 0 && remainingOutputs.length === 0
+      ? null
+      : createInfraLedger({
+          projectId: request.projectId,
+          environment: prepared.value.environment.id,
+          targets: [],
+          resources: remainingResources,
+          outputs: remainingOutputs,
+        });
+  return {
+    ok: true,
+    value: { environment: prepared.value.environment.id, ledger },
+    diagnostics,
+  };
+}
+
+/*** Refuse cross-project confirmation and unowned persistent deletion before any mutation. */
+function validateDestroyRequest(
+  request: InfraDestroyRequest,
+  previous: readonly InfraOwnedResource[],
+): InfraResult<null> {
+  if (
+    request.confirmation.projectId !== request.projectId ||
+    request.confirmation.environment !== request.environment
+  ) {
+    return destroyFailure(
+      'infra-destroy-confirmation-mismatch',
+      'Infra destroy confirmation must exactly match the selected project and environment.',
+    );
+  }
+  if (request.persistence.policy === 'retain') {
+    return { ok: true, value: null, diagnostics: [] };
+  }
+  const owned = new Set(previous.map(({ identity }) => infraIdentityKey(identity)));
+  const invalid = request.persistence.confirmedResources.some(
+    (identity) =>
+      identity.projectId !== request.projectId ||
+      identity.environment !== request.environment ||
+      !owned.has(infraIdentityKey(identity)),
+  );
+  return invalid
+    ? destroyFailure(
+        'infra-destroy-resource-unowned',
+        'Persistent deletion confirmation contains a resource outside the stored Infra scope.',
+      )
+    : { ok: true, value: null, diagnostics: [] };
+}
+
+/*** Create one stable non-provider-specific destroy safety failure. */
+function destroyFailure(code: string, message: string): InfraResult<never> {
+  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };
+}