@ankhorage/infra 4.1.12 → 5.1.0

package/dist/features/environment-lifecycle/composition/createProjectInfraLifecycle.js

@@ -0,0 +1,123 @@
+import { INFRA_PACKAGE_VERSION } from '../../../constants.js';
+import { createInfraCommandServices } from './createInfraCommandServices.js';
+/*** Create the typed project-facing Infra lifecycle backed by canonical use cases and ownership state. */
+export function createProjectInfraLifecycle(options = {}) {
+    const services = createInfraCommandServices(options.services);
+    return {
+        async validateAsync(request) {
+            const prepared = await prepareProjectOperationAsync(request, services);
+            return services.operations.validate(prepared.operation, prepared.dependencies);
+        },
+        async planAsync(request) {
+            const prepared = await prepareProjectOperationAsync(request, services);
+            return services.operations.plan(prepared.operation, prepared.dependencies);
+        },
+        async generateAsync(request) {
+            const prepared = await prepareProjectOperationAsync(request, services);
+            const result = await services.operations.generate(prepared.operation, prepared.dependencies);
+            if (!result.ok)
+                return result;
+            await services.writeArtifacts(request.projectPath, result.value.artifacts, prepared.state?.ledger);
+            await services.writeState(request.projectPath, {
+                schemaVersion: 1,
+                desired: prepared.desired,
+                ledger: result.value.ledger,
+            });
+            return result;
+        },
+        async upAsync(request) {
+            const prepared = await prepareProjectOperationAsync(request, services);
+            const result = await services.operations.up(prepared.operation, prepared.dependencies);
+            if (!result.ok)
+                return result;
+            await services.writeState(request.projectPath, {
+                schemaVersion: 1,
+                desired: prepared.desired,
+                ledger: result.value.ledger,
+            });
+            return result;
+        },
+        async statusAsync(request) {
+            const prepared = await prepareProjectOperationAsync(request, services);
+            return services.operations.status(prepared.operation, prepared.dependencies);
+        },
+        async outputsAsync(request) {
+            const prepared = await prepareProjectOperationAsync(request, services);
+            return services.operations.outputs(prepared.operation);
+        },
+        async downAsync(request) {
+            const prepared = await prepareProjectOperationAsync(request, services);
+            const result = await services.operations.down(prepared.operation, prepared.dependencies);
+            if (!result.ok)
+                return result;
+            await services.writeState(request.projectPath, {
+                schemaVersion: 1,
+                desired: prepared.desired,
+                ledger: result.value.ledger,
+            });
+            return result;
+        },
+        async destroyAsync(request) {
+            const prepared = await prepareProjectOperationAsync(request, services, true);
+            const result = await services.operations.destroy({
+                ...prepared.operation,
+                confirmation: request.confirmation,
+                persistence: request.persistence,
+            }, prepared.dependencies);
+            if (!result.ok)
+                return result;
+            await services.writeArtifacts(request.projectPath, [], prepared.state?.ledger);
+            if (result.value.ledger === null)
+                await services.removeState(request.projectPath, request.environment);
+            else {
+                await services.writeState(request.projectPath, {
+                    schemaVersion: 1,
+                    desired: prepared.desired,
+                    ledger: result.value.ledger,
+                });
+            }
+            return result;
+        },
+    };
+}
+/*** Resolve one explicit project/environment request with its prior ownership state and dependencies. */
+async function prepareProjectOperationAsync(request, services, useStoredDesired = false) {
+    const state = await services.readState(request.projectPath, request.environment);
+    const currentDesired = readEnvironment(request.manifest, request.environment);
+    const desired = useStoredDesired && state !== null ? state.desired : currentDesired;
+    if (desired === undefined) {
+        throw new Error(`Infra environment "${request.environment}" is not configured.`);
+    }
+    const context = {
+        cwd: request.projectPath,
+        env: request.executionEnvironment ?? process.env,
+        version: INFRA_PACKAGE_VERSION,
+        writeStdout: () => undefined,
+        writeStderr: () => undefined,
+    };
+    return {
+        state,
+        desired,
+        operation: {
+            projectId: request.projectId,
+            manifest: replaceEnvironment(request.manifest, request.environment, desired),
+            environment: request.environment,
+            ...(state === null ? {} : { previous: state.ledger, previousDesired: state.desired }),
+            ...(request.signal === undefined ? {} : { signal: request.signal }),
+        },
+        dependencies: services.createDependencies(context),
+    };
+}
+/*** Read one exact environment without inventing a fallback. */
+function readEnvironment(manifest, environment) {
+    if (environment === 'local')
+        return manifest.environments.local;
+    if (environment === 'preview')
+        return manifest.environments.preview;
+    return manifest.environments.production;
+}
+/*** Replace one selected environment while preserving all other manifest state. */
+function replaceEnvironment(manifest, environment, desired) {
+    return { ...manifest, environments: { ...manifest.environments, [environment]: desired } };
+}
+//# sourceMappingURL=createProjectInfraLifecycle.js.map

package/dist/features/environment-lifecycle/composition/createProjectInfraLifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createProjectInfraLifecycle.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/composition/createProjectInfraLifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAO9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,0GAA0G;AAC1G,MAAM,UAAU,2BAA2B,CACzC,UAA8C,EAAE;IAEhD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QACjF,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,cAAc,CAC3B,OAAO,CAAC,WAAW,EACnB,MAAM,CAAC,KAAK,CAAC,SAAS,EACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CACvB,CAAC;YACF,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC7C,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC7C,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO;YACvB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO;YACxB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC7C,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO;YACxB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAC9C;gBACE,GAAG,QAAQ,CAAC,SAAS;gBACrB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,EACD,QAAQ,CAAC,YAAY,CACtB,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/E,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI;gBAC9B,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;iBAClE,CAAC;gBACJ,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;oBAC7C,aAAa,EAAE,CAAC;oBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,yGAAyG;AACzG,KAAK,UAAU,4BAA4B,CACzC,OAAqC,EACrC,QAAuD,EACvD,gBAAgB,GAAG,KAAK;IAExB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,gBAAgB,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;IACpF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,WAAW,sBAAsB,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,OAAO,CAAC,WAAW;QACxB,GAAG,EAAE,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG;QAChD,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS;QAC5B,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS;KAC7B,CAAC;IACF,OAAO;QACL,KAAK;QACL,OAAO;QACP,SAAS,EAAE;YACT,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC;YAC5E,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SACpE;QACD,YAAY,EAAE,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,eAAe,CACtB,QAAuB,EACvB,WAAwD;IAExD,IAAI,WAAW,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC;IAChE,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC;IACpE,OAAO,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC;AAC1C,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CACzB,QAAuB,EACvB,WAAwD,EACxD,OAA6B;IAE7B,OAAO,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;AAC7F,CAAC","sourcesContent":["import type { InfraEnvironmentSpec, InfraManifest } from '@ankhorage/contracts/infra';\n\nimport { INFRA_PACKAGE_VERSION } from '../../../constants.js';\nimport type { InfraOperationRequest, InfraStoredState } from '../../../types/infraOrchestration.js';\nimport type {\n  CreateProjectInfraLifecycleOptions,\n  ProjectInfraLifecycle,\n  ProjectInfraOperationRequest,\n} from '../../../types/infraProject.js';\nimport { createInfraCommandServices } from './createInfraCommandServices.js';\n\n/*** Create the typed project-facing Infra lifecycle backed by canonical use cases and ownership state. */\nexport function createProjectInfraLifecycle(\n  options: CreateProjectInfraLifecycleOptions = {},\n): ProjectInfraLifecycle {\n  const services = createInfraCommandServices(options.services);\n  return {\n    async validateAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.validate(prepared.operation, prepared.dependencies);\n    },\n    async planAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.plan(prepared.operation, prepared.dependencies);\n    },\n    async generateAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      const result = await services.operations.generate(prepared.operation, prepared.dependencies);\n      if (!result.ok) return result;\n      await services.writeArtifacts(\n        request.projectPath,\n        result.value.artifacts,\n        prepared.state?.ledger,\n      );\n      await services.writeState(request.projectPath, {\n        schemaVersion: 1,\n        desired: prepared.desired,\n        ledger: result.value.ledger,\n      });\n      return result;\n    },\n    async upAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      const result = await services.operations.up(prepared.operation, prepared.dependencies);\n      if (!result.ok) return result;\n      await services.writeState(request.projectPath, {\n        schemaVersion: 1,\n        desired: prepared.desired,\n        ledger: result.value.ledger,\n      });\n      return result;\n    },\n    async statusAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.status(prepared.operation, prepared.dependencies);\n    },\n    async outputsAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.outputs(prepared.operation);\n    },\n    async downAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      const result = await services.operations.down(prepared.operation, prepared.dependencies);\n      if (!result.ok) return result;\n      await services.writeState(request.projectPath, {\n        schemaVersion: 1,\n        desired: prepared.desired,\n        ledger: result.value.ledger,\n      });\n      return result;\n    },\n    async destroyAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services, true);\n      const result = await services.operations.destroy(\n        {\n          ...prepared.operation,\n          confirmation: request.confirmation,\n          persistence: request.persistence,\n        },\n        prepared.dependencies,\n      );\n      if (!result.ok) return result;\n      await services.writeArtifacts(request.projectPath, [], prepared.state?.ledger);\n      if (result.value.ledger === null)\n        await services.removeState(request.projectPath, request.environment);\n      else {\n        await services.writeState(request.projectPath, {\n          schemaVersion: 1,\n          desired: prepared.desired,\n          ledger: result.value.ledger,\n        });\n      }\n      return result;\n    },\n  };\n}\n\ninterface PreparedProjectOperation {\n  readonly operation: InfraOperationRequest;\n  readonly desired: InfraEnvironmentSpec;\n  readonly state: InfraStoredState | null;\n  readonly dependencies: ReturnType<\n    ReturnType<typeof createInfraCommandServices>['createDependencies']\n  >;\n}\n\n/*** Resolve one explicit project/environment request with its prior ownership state and dependencies. */\nasync function prepareProjectOperationAsync(\n  request: ProjectInfraOperationRequest,\n  services: ReturnType<typeof createInfraCommandServices>,\n  useStoredDesired = false,\n): Promise<PreparedProjectOperation> {\n  const state = await services.readState(request.projectPath, request.environment);\n  const currentDesired = readEnvironment(request.manifest, request.environment);\n  const desired = useStoredDesired && state !== null ? state.desired : currentDesired;\n  if (desired === undefined) {\n    throw new Error(`Infra environment \"${request.environment}\" is not configured.`);\n  }\n  const context = {\n    cwd: request.projectPath,\n    env: request.executionEnvironment ?? process.env,\n    version: INFRA_PACKAGE_VERSION,\n    writeStdout: () => undefined,\n    writeStderr: () => undefined,\n  };\n  return {\n    state,\n    desired,\n    operation: {\n      projectId: request.projectId,\n      manifest: replaceEnvironment(request.manifest, request.environment, desired),\n      environment: request.environment,\n      ...(state === null ? {} : { previous: state.ledger, previousDesired: state.desired }),\n      ...(request.signal === undefined ? {} : { signal: request.signal }),\n    },\n    dependencies: services.createDependencies(context),\n  };\n}\n\n/*** Read one exact environment without inventing a fallback. */\nfunction readEnvironment(\n  manifest: InfraManifest,\n  environment: ProjectInfraOperationRequest['environment'],\n): InfraEnvironmentSpec | undefined {\n  if (environment === 'local') return manifest.environments.local;\n  if (environment === 'preview') return manifest.environments.preview;\n  return manifest.environments.production;\n}\n\n/*** Replace one selected environment while preserving all other manifest state. */\nfunction replaceEnvironment(\n  manifest: InfraManifest,\n  environment: ProjectInfraOperationRequest['environment'],\n  desired: InfraEnvironmentSpec,\n): InfraManifest {\n  return { ...manifest, environments: { ...manifest.environments, [environment]: desired } };\n}\n"]}

package/dist/features/environment-lifecycle/domain/orderInfraPlanActions.d.ts

@@ -0,0 +1,4 @@
+import type { InfraPlanAction, InfraResult } from '@ankhorage/contracts/infra';
+/*** Order plan actions dependency-first and reject duplicate owners or dependency cycles. */
+export declare function orderInfraPlanActions(actions: readonly InfraPlanAction[]): InfraResult<readonly InfraPlanAction[]>;
+//# sourceMappingURL=orderInfraPlanActions.d.ts.map

package/dist/features/environment-lifecycle/domain/orderInfraPlanActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orderInfraPlanActions.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/domain/orderInfraPlanActions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EAEf,WAAW,EACZ,MAAM,4BAA4B,CAAC;AAEpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,eAAe,EAAE,GAClC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAWzC"}

package/dist/features/environment-lifecycle/domain/orderInfraPlanActions.js

@@ -0,0 +1,54 @@
+/*** Order plan actions dependency-first and reject duplicate owners or dependency cycles. */
+export function orderInfraPlanActions(actions) {
+    const byOwner = new Map(actions.map((action) => [identityKey(action.owner), action]));
+    if (byOwner.size !== actions.length)
+        return invalidPlan('duplicate resource actions');
+    const ordered = [];
+    const complete = new Set();
+    const active = new Set();
+    for (const action of actions) {
+        const result = visitAction(action, byOwner, ordered, complete, active);
+        if (!result.ok)
+            return result;
+    }
+    return { ok: true, value: ordered, diagnostics: [] };
+}
+/*** Visit one plan node and its in-plan dependencies exactly once. */
+function visitAction(action, byOwner, ordered, complete, active) {
+    const key = identityKey(action.owner);
+    if (complete.has(key))
+        return { ok: true, value: null, diagnostics: [] };
+    if (active.has(key))
+        return invalidPlan('a dependency cycle');
+    active.add(key);
+    for (const dependency of action.dependsOn) {
+        const dependencyAction = byOwner.get(identityKey(dependency));
+        if (dependencyAction === undefined)
+            continue;
+        const result = visitAction(dependencyAction, byOwner, ordered, complete, active);
+        if (!result.ok)
+            return result;
+    }
+    active.delete(key);
+    complete.add(key);
+    ordered.push(action);
+    return { ok: true, value: null, diagnostics: [] };
+}
+/*** Create a collision-safe key for one provider-owned resource identity. */
+function identityKey(identity) {
+    return `${identity.projectId}\0${identity.environment}\0${identity.adapter}\0${identity.resourceId}`;
+}
+/*** Reject an invalid aggregated plan without exposing provider internals. */
+function invalidPlan(detail) {
+    return {
+        ok: false,
+        diagnostics: [
+            {
+                severity: 'error',
+                code: 'infra-plan-invalid',
+                message: `The aggregated infrastructure plan contains ${detail}.`,
+            },
+        ],
+    };
+}
+//# sourceMappingURL=orderInfraPlanActions.js.map

package/dist/features/environment-lifecycle/domain/orderInfraPlanActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orderInfraPlanActions.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/domain/orderInfraPlanActions.ts"],"names":[],"mappings":"AAMA,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CACnC,OAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC,4BAA4B,CAAC,CAAC;IACtF,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAClB,MAAuB,EACvB,OAA6C,EAC7C,OAA0B,EAC1B,QAAqB,EACrB,MAAmB;IAEnB,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACzE,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,IAAI,gBAAgB,KAAK,SAAS;YAAE,SAAS;QAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,QAA+B;IAClD,OAAO,GAAG,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;AACvG,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,WAAW,EAAE;YACX;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,+CAA+C,MAAM,GAAG;aAClE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  InfraPlanAction,\n  InfraResourceIdentity,\n  InfraResult,\n} from '@ankhorage/contracts/infra';\n\n/*** Order plan actions dependency-first and reject duplicate owners or dependency cycles. */\nexport function orderInfraPlanActions(\n  actions: readonly InfraPlanAction[],\n): InfraResult<readonly InfraPlanAction[]> {\n  const byOwner = new Map(actions.map((action) => [identityKey(action.owner), action]));\n  if (byOwner.size !== actions.length) return invalidPlan('duplicate resource actions');\n  const ordered: InfraPlanAction[] = [];\n  const complete = new Set<string>();\n  const active = new Set<string>();\n  for (const action of actions) {\n    const result = visitAction(action, byOwner, ordered, complete, active);\n    if (!result.ok) return result;\n  }\n  return { ok: true, value: ordered, diagnostics: [] };\n}\n\n/*** Visit one plan node and its in-plan dependencies exactly once. */\nfunction visitAction(\n  action: InfraPlanAction,\n  byOwner: ReadonlyMap<string, InfraPlanAction>,\n  ordered: InfraPlanAction[],\n  complete: Set<string>,\n  active: Set<string>,\n): InfraResult<null> {\n  const key = identityKey(action.owner);\n  if (complete.has(key)) return { ok: true, value: null, diagnostics: [] };\n  if (active.has(key)) return invalidPlan('a dependency cycle');\n  active.add(key);\n  for (const dependency of action.dependsOn) {\n    const dependencyAction = byOwner.get(identityKey(dependency));\n    if (dependencyAction === undefined) continue;\n    const result = visitAction(dependencyAction, byOwner, ordered, complete, active);\n    if (!result.ok) return result;\n  }\n  active.delete(key);\n  complete.add(key);\n  ordered.push(action);\n  return { ok: true, value: null, diagnostics: [] };\n}\n\n/*** Create a collision-safe key for one provider-owned resource identity. */\nfunction identityKey(identity: InfraResourceIdentity): string {\n  return `${identity.projectId}\\0${identity.environment}\\0${identity.adapter}\\0${identity.resourceId}`;\n}\n\n/*** Reject an invalid aggregated plan without exposing provider internals. */\nfunction invalidPlan(detail: string): InfraResult<never> {\n  return {\n    ok: false,\n    diagnostics: [\n      {\n        severity: 'error',\n        code: 'infra-plan-invalid',\n        message: `The aggregated infrastructure plan contains ${detail}.`,\n      },\n    ],\n  };\n}\n"]}

package/dist/features/environment-lifecycle/domain/resolveInfraEnvironment.d.ts

@@ -0,0 +1,5 @@
+import type { InfraResult } from '@ankhorage/contracts/infra';
+import type { InfraEnvironmentResolutionRequest, ResolvedInfraEnvironment } from '../../../types/infraOrchestration.js';
+/*** Resolve one explicitly configured environment while keeping local as the only safe default. */
+export declare function resolveInfraEnvironment(request: InfraEnvironmentResolutionRequest): InfraResult<ResolvedInfraEnvironment>;
+//# sourceMappingURL=resolveInfraEnvironment.d.ts.map

package/dist/features/environment-lifecycle/domain/resolveInfraEnvironment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveInfraEnvironment.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/domain/resolveInfraEnvironment.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,KAAK,EACV,iCAAiC,EACjC,wBAAwB,EACzB,MAAM,sCAAsC,CAAC;AAE9C,mGAAmG;AACnG,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iCAAiC,GACzC,WAAW,CAAC,wBAAwB,CAAC,CAyBvC"}

package/dist/features/environment-lifecycle/domain/resolveInfraEnvironment.js

@@ -0,0 +1,39 @@
+import { APP_ENVIRONMENT_IDS } from '@ankhorage/contracts/environments';
+/*** Resolve one explicitly configured environment while keeping local as the only safe default. */
+export function resolveInfraEnvironment(request) {
+    if (request.operation === 'destroy' && request.environment === undefined) {
+        return failure('infra-environment-required', 'Infra destroy requires an explicit --environment selection.');
+    }
+    const environment = request.environment ?? 'local';
+    if (!isAppEnvironmentId(environment)) {
+        return failure('infra-environment-invalid', `Unknown Infra environment "${environment}". Expected local, preview, or production.`);
+    }
+    const desired = getEnvironment(request.manifest, environment);
+    return desired === undefined
+        ? failure('infra-environment-unconfigured', `Infra environment "${environment}" is not configured.`)
+        : {
+            ok: true,
+            value: { id: environment, desired, manifest: request.manifest },
+            diagnostics: [],
+        };
+}
+/*** Read a closed environment key without an open object-injection boundary. */
+function getEnvironment(manifest, environment) {
+    switch (environment) {
+        case 'local':
+            return manifest.environments.local;
+        case 'preview':
+            return manifest.environments.preview;
+        case 'production':
+            return manifest.environments.production;
+    }
+}
+/*** Narrow a CLI environment string through the canonical Contracts vocabulary. */
+function isAppEnvironmentId(value) {
+    return APP_ENVIRONMENT_IDS.some((environment) => environment === value);
+}
+/*** Create a stable environment-resolution diagnostic. */
+function failure(code, message) {
+    return { ok: false, diagnostics: [{ severity: 'error', code, message }] };
+}
+//# sourceMappingURL=resolveInfraEnvironment.js.map

package/dist/features/environment-lifecycle/domain/resolveInfraEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveInfraEnvironment.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/domain/resolveInfraEnvironment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAyB,MAAM,mCAAmC,CAAC;AAQ/F,mGAAmG;AACnG,MAAM,UAAU,uBAAuB,CACrC,OAA0C;IAE1C,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACzE,OAAO,OAAO,CACZ,4BAA4B,EAC5B,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC;IACnD,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO,OAAO,CACZ,2BAA2B,EAC3B,8BAA8B,WAAW,4CAA4C,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9D,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,OAAO,CACL,gCAAgC,EAChC,sBAAsB,WAAW,sBAAsB,CACxD;QACH,CAAC,CAAC;YACE,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC/D,WAAW,EAAE,EAAE;SAChB,CAAC;AACR,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CACrB,QAAuD,EACvD,WAA6B;IAE7B,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC;QACrC,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC;QACvC,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,0DAA0D;AAC1D,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC","sourcesContent":["import { APP_ENVIRONMENT_IDS, type AppEnvironmentId } from '@ankhorage/contracts/environments';\nimport type { InfraResult } from '@ankhorage/contracts/infra';\n\nimport type {\n  InfraEnvironmentResolutionRequest,\n  ResolvedInfraEnvironment,\n} from '../../../types/infraOrchestration.js';\n\n/*** Resolve one explicitly configured environment while keeping local as the only safe default. */\nexport function resolveInfraEnvironment(\n  request: InfraEnvironmentResolutionRequest,\n): InfraResult<ResolvedInfraEnvironment> {\n  if (request.operation === 'destroy' && request.environment === undefined) {\n    return failure(\n      'infra-environment-required',\n      'Infra destroy requires an explicit --environment selection.',\n    );\n  }\n  const environment = request.environment ?? 'local';\n  if (!isAppEnvironmentId(environment)) {\n    return failure(\n      'infra-environment-invalid',\n      `Unknown Infra environment \"${environment}\". Expected local, preview, or production.`,\n    );\n  }\n  const desired = getEnvironment(request.manifest, environment);\n  return desired === undefined\n    ? failure(\n        'infra-environment-unconfigured',\n        `Infra environment \"${environment}\" is not configured.`,\n      )\n    : {\n        ok: true,\n        value: { id: environment, desired, manifest: request.manifest },\n        diagnostics: [],\n      };\n}\n\n/*** Read a closed environment key without an open object-injection boundary. */\nfunction getEnvironment(\n  manifest: InfraEnvironmentResolutionRequest['manifest'],\n  environment: AppEnvironmentId,\n) {\n  switch (environment) {\n    case 'local':\n      return manifest.environments.local;\n    case 'preview':\n      return manifest.environments.preview;\n    case 'production':\n      return manifest.environments.production;\n  }\n}\n\n/*** Narrow a CLI environment string through the canonical Contracts vocabulary. */\nfunction isAppEnvironmentId(value: string): value is AppEnvironmentId {\n  return APP_ENVIRONMENT_IDS.some((environment) => environment === value);\n}\n\n/*** Create a stable environment-resolution diagnostic. */\nfunction failure(code: string, message: string): InfraResult<never> {\n  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };\n}\n"]}

package/dist/features/environment-lifecycle/utils/appendInfraFailure.d.ts

@@ -0,0 +1,7 @@
+import type { InfraDiagnostic, InfraResult } from '@ankhorage/contracts/infra';
+/*** Preserve earlier safe diagnostics when a later lifecycle stage fails. */
+export declare function appendInfraFailure(previous: readonly InfraDiagnostic[], failure: {
+    readonly ok: false;
+    readonly diagnostics: readonly InfraDiagnostic[];
+}): InfraResult<never>;
+//# sourceMappingURL=appendInfraFailure.d.ts.map

package/dist/features/environment-lifecycle/utils/appendInfraFailure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appendInfraFailure.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/appendInfraFailure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE/E,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GAChF,WAAW,CAAC,KAAK,CAAC,CAEpB"}

package/dist/features/environment-lifecycle/utils/appendInfraFailure.js

@@ -0,0 +1,5 @@
+/*** Preserve earlier safe diagnostics when a later lifecycle stage fails. */
+export function appendInfraFailure(previous, failure) {
+    return { ok: false, diagnostics: [...previous, ...failure.diagnostics] };
+}
+//# sourceMappingURL=appendInfraFailure.js.map

package/dist/features/environment-lifecycle/utils/appendInfraFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appendInfraFailure.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/appendInfraFailure.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAChC,QAAoC,EACpC,OAAiF;IAEjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;AAC3E,CAAC","sourcesContent":["import type { InfraDiagnostic, InfraResult } from '@ankhorage/contracts/infra';\n\n/*** Preserve earlier safe diagnostics when a later lifecycle stage fails. */\nexport function appendInfraFailure(\n  previous: readonly InfraDiagnostic[],\n  failure: { readonly ok: false; readonly diagnostics: readonly InfraDiagnostic[] },\n): InfraResult<never> {\n  return { ok: false, diagnostics: [...previous, ...failure.diagnostics] };\n}\n"]}

package/dist/features/environment-lifecycle/utils/createInfraExecutionContext.d.ts

@@ -0,0 +1,5 @@
+import type { InfraExecutionContext } from '@ankhorage/contracts/infra';
+import type { InfraOperationRequest, InfraOrchestrationDependencies, ResolvedInfraEnvironment } from '../../../types/infraOrchestration.js';
+/*** Create one execution context without copying resolved secret values into serializable state. */
+export declare function createInfraExecutionContext(request: InfraOperationRequest, environment: ResolvedInfraEnvironment, dependencies: InfraOrchestrationDependencies): InfraExecutionContext;
+//# sourceMappingURL=createInfraExecutionContext.d.ts.map

package/dist/features/environment-lifecycle/utils/createInfraExecutionContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraExecutionContext.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraExecutionContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EACV,qBAAqB,EACrB,8BAA8B,EAC9B,wBAAwB,EACzB,MAAM,sCAAsC,CAAC;AAE9C,oGAAoG;AACpG,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,qBAAqB,EAC9B,WAAW,EAAE,wBAAwB,EACrC,YAAY,EAAE,8BAA8B,GAC3C,qBAAqB,CAUvB"}

package/dist/features/environment-lifecycle/utils/createInfraExecutionContext.js

@@ -0,0 +1,13 @@
+/*** Create one execution context without copying resolved secret values into serializable state. */
+export function createInfraExecutionContext(request, environment, dependencies) {
+    return {
+        projectId: request.projectId,
+        environment: environment.id,
+        desired: environment.desired,
+        ...(request.previous === undefined ? {} : { previous: request.previous }),
+        ...(request.signal === undefined ? {} : { signal: request.signal }),
+        credentials: dependencies.credentials,
+        secrets: dependencies.secrets,
+    };
+}
+//# sourceMappingURL=createInfraExecutionContext.js.map

package/dist/features/environment-lifecycle/utils/createInfraExecutionContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraExecutionContext.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraExecutionContext.ts"],"names":[],"mappings":"AAQA,oGAAoG;AACpG,MAAM,UAAU,2BAA2B,CACzC,OAA8B,EAC9B,WAAqC,EACrC,YAA4C;IAE5C,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,WAAW,CAAC,EAAE;QAC3B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,OAAO,EAAE,YAAY,CAAC,OAAO;KAC9B,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraExecutionContext } from '@ankhorage/contracts/infra';\n\nimport type {\n  InfraOperationRequest,\n  InfraOrchestrationDependencies,\n  ResolvedInfraEnvironment,\n} from '../../../types/infraOrchestration.js';\n\n/*** Create one execution context without copying resolved secret values into serializable state. */\nexport function createInfraExecutionContext(\n  request: InfraOperationRequest,\n  environment: ResolvedInfraEnvironment,\n  dependencies: InfraOrchestrationDependencies,\n): InfraExecutionContext {\n  return {\n    projectId: request.projectId,\n    environment: environment.id,\n    desired: environment.desired,\n    ...(request.previous === undefined ? {} : { previous: request.previous }),\n    ...(request.signal === undefined ? {} : { signal: request.signal }),\n    credentials: dependencies.credentials,\n    secrets: dependencies.secrets,\n  };\n}\n"]}

package/dist/features/environment-lifecycle/utils/createInfraFailure.d.ts

@@ -0,0 +1,4 @@
+import type { InfraResult } from '@ankhorage/contracts/infra';
+/*** Create one sanitized provider-neutral Infra failure. */
+export declare function createInfraFailure(code: string, message: string): InfraResult<never>;
+//# sourceMappingURL=createInfraFailure.d.ts.map

package/dist/features/environment-lifecycle/utils/createInfraFailure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraFailure.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraFailure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAEpF"}

package/dist/features/environment-lifecycle/utils/createInfraFailure.js

@@ -0,0 +1,5 @@
+/*** Create one sanitized provider-neutral Infra failure. */
+export function createInfraFailure(code, message) {
+    return { ok: false, diagnostics: [{ severity: 'error', code, message }] };
+}
+//# sourceMappingURL=createInfraFailure.js.map

package/dist/features/environment-lifecycle/utils/createInfraFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraFailure.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraFailure.ts"],"names":[],"mappings":"AAEA,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAe;IAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC","sourcesContent":["import type { InfraResult } from '@ankhorage/contracts/infra';\n\n/*** Create one sanitized provider-neutral Infra failure. */\nexport function createInfraFailure(code: string, message: string): InfraResult<never> {\n  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };\n}\n"]}

package/dist/features/environment-lifecycle/utils/createInfraLedger.d.ts

@@ -0,0 +1,12 @@
+import type { InfraComputeTarget, InfraGeneratedArtifact, InfraLedger, InfraOutput, InfraOwnedResource } from '@ankhorage/contracts/infra';
+/*** Create deterministic serializable lifecycle state without resolved credential or secret values. */
+export declare function createInfraLedger(input: {
+    readonly projectId: string;
+    readonly environment: InfraLedger['environment'];
+    readonly targets: readonly InfraComputeTarget[];
+    readonly resources: readonly InfraOwnedResource[];
+    readonly outputs: readonly InfraOutput[];
+    readonly artifacts?: readonly InfraGeneratedArtifact[];
+    readonly previous?: InfraLedger;
+}): InfraLedger;
+//# sourceMappingURL=createInfraLedger.d.ts.map

package/dist/features/environment-lifecycle/utils/createInfraLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraLedger.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraLedger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAEpC,uGAAuG;AACvG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;CACjC,GAAG,WAAW,CAYd"}

package/dist/features/environment-lifecycle/utils/createInfraLedger.js

@@ -0,0 +1,14 @@
+/*** Create deterministic serializable lifecycle state without resolved credential or secret values. */
+export function createInfraLedger(input) {
+    const artifacts = input.artifacts?.map(({ owner, path }) => ({ owner, path })) ?? input.previous?.artifacts ?? [];
+    return {
+        schemaVersion: 1,
+        projectId: input.projectId,
+        environment: input.environment,
+        targets: input.targets,
+        resources: input.resources,
+        outputs: input.outputs,
+        artifacts,
+    };
+}
+//# sourceMappingURL=createInfraLedger.js.map

package/dist/features/environment-lifecycle/utils/createInfraLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInfraLedger.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/createInfraLedger.ts"],"names":[],"mappings":"AAQA,uGAAuG;AACvG,MAAM,UAAU,iBAAiB,CAAC,KAQjC;IACC,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC;IAClG,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;KACV,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  InfraComputeTarget,\n  InfraGeneratedArtifact,\n  InfraLedger,\n  InfraOutput,\n  InfraOwnedResource,\n} from '@ankhorage/contracts/infra';\n\n/*** Create deterministic serializable lifecycle state without resolved credential or secret values. */\nexport function createInfraLedger(input: {\n  readonly projectId: string;\n  readonly environment: InfraLedger['environment'];\n  readonly targets: readonly InfraComputeTarget[];\n  readonly resources: readonly InfraOwnedResource[];\n  readonly outputs: readonly InfraOutput[];\n  readonly artifacts?: readonly InfraGeneratedArtifact[];\n  readonly previous?: InfraLedger;\n}): InfraLedger {\n  const artifacts =\n    input.artifacts?.map(({ owner, path }) => ({ owner, path })) ?? input.previous?.artifacts ?? [];\n  return {\n    schemaVersion: 1,\n    projectId: input.projectId,\n    environment: input.environment,\n    targets: input.targets,\n    resources: input.resources,\n    outputs: input.outputs,\n    artifacts,\n  };\n}\n"]}

package/dist/features/environment-lifecycle/utils/infraIdentityKey.d.ts

@@ -0,0 +1,4 @@
+import type { InfraResourceIdentity } from '@ankhorage/contracts/infra';
+/*** Create a stable collision-safe key for an Infra-owned resource. */
+export declare function infraIdentityKey(identity: InfraResourceIdentity): string;
+//# sourceMappingURL=infraIdentityKey.d.ts.map

package/dist/features/environment-lifecycle/utils/infraIdentityKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infraIdentityKey.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/infraIdentityKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,CAExE"}

package/dist/features/environment-lifecycle/utils/infraIdentityKey.js

@@ -0,0 +1,5 @@
+/*** Create a stable collision-safe key for an Infra-owned resource. */
+export function infraIdentityKey(identity) {
+    return `${identity.projectId}\0${identity.environment}\0${identity.adapter}\0${identity.resourceId}`;
+}
+//# sourceMappingURL=infraIdentityKey.js.map

package/dist/features/environment-lifecycle/utils/infraIdentityKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infraIdentityKey.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/infraIdentityKey.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,QAA+B;IAC9D,OAAO,GAAG,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;AACvG,CAAC","sourcesContent":["import type { InfraResourceIdentity } from '@ankhorage/contracts/infra';\n\n/*** Create a stable collision-safe key for an Infra-owned resource. */\nexport function infraIdentityKey(identity: InfraResourceIdentity): string {\n  return `${identity.projectId}\\0${identity.environment}\\0${identity.adapter}\\0${identity.resourceId}`;\n}\n"]}

package/dist/features/environment-lifecycle/utils/isInfraStoredState.d.ts

@@ -0,0 +1,4 @@
+import type { InfraStoredState } from '../../../types/infraOrchestration.js';
+/*** Validate persisted ownership state before any provider receives it. */
+export declare function isInfraStoredState(value: unknown): value is InfraStoredState;
+//# sourceMappingURL=isInfraStoredState.d.ts.map

package/dist/features/environment-lifecycle/utils/isInfraStoredState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraStoredState.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/isInfraStoredState.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAO5E"}

package/dist/features/environment-lifecycle/utils/isInfraStoredState.js

@@ -0,0 +1,103 @@
+import { APP_ENVIRONMENT_IDS } from '@ankhorage/contracts/environments';
+import { INFRA_ADAPTER_CATALOG, isInfraEnvironmentSpec, } from '@ankhorage/contracts/infra';
+/*** Validate persisted ownership state before any provider receives it. */
+export function isInfraStoredState(value) {
+    return (isRecord(value) &&
+        value.schemaVersion === 1 &&
+        isInfraEnvironmentSpec(value.desired) &&
+        isInfraLedger(value.ledger));
+}
+/*** Validate the canonical ledger's serializable outer boundary. */
+function isInfraLedger(value) {
+    if (isRecord(value) &&
+        value.schemaVersion === 1 &&
+        typeof value.projectId === 'string' &&
+        typeof value.environment === 'string' &&
+        APP_ENVIRONMENT_IDS.some((environment) => environment === value.environment) &&
+        Array.isArray(value.targets) &&
+        Array.isArray(value.resources) &&
+        Array.isArray(value.outputs) &&
+        Array.isArray(value.artifacts)) {
+        const { environment, projectId } = value;
+        return (value.targets.every(isComputeTarget) &&
+            value.resources.every((resource) => isOwnedResource(resource, projectId, environment)) &&
+            value.outputs.every((output) => isOutput(output, projectId, environment)) &&
+            value.artifacts.every((artifact) => isArtifactIdentity(artifact, projectId, environment)));
+    }
+    return false;
+}
+/*** Validate portable compute targets without accepting resolved credential payloads. */
+function isComputeTarget(value) {
+    if (!isRecord(value) ||
+        typeof value.id !== 'string' ||
+        !['linux', 'darwin', 'windows'].includes(String(value.os)) ||
+        !['amd64', 'arm64'].includes(String(value.architecture))) {
+        return false;
+    }
+    if (value.kind === 'local-host')
+        return true;
+    return (value.kind === 'ssh-host' &&
+        typeof value.host === 'string' &&
+        typeof value.port === 'number' &&
+        typeof value.user === 'string' &&
+        typeof value.hostKeyFingerprint === 'string' &&
+        isControlPlaneReference(value.credential));
+}
+/*** Validate one exact resource plus its dependency identities. */
+function isOwnedResource(value, projectId, environment) {
+    return (isRecord(value) &&
+        isScopedIdentity(value.identity, projectId, environment) &&
+        typeof value.persistent === 'boolean' &&
+        (value.retention === 'retain' || value.retention === 'delete-on-destroy') &&
+        Array.isArray(value.dependsOn) &&
+        value.dependsOn.every((identity) => isScopedIdentity(identity, projectId, environment)));
+}
+/*** Enforce the public-value versus secret-reference output union at rest. */
+function isOutput(value, projectId, environment) {
+    if (!isRecord(value) ||
+        !isScopedIdentity(value.owner, projectId, environment) ||
+        typeof value.name !== 'string') {
+        return false;
+    }
+    if (value.visibility === 'public') {
+        return (['string', 'number', 'boolean'].includes(typeof value.value) &&
+            value.reference === undefined &&
+            (value.environmentVariable === undefined || typeof value.environmentVariable === 'string'));
+    }
+    return (value.visibility === 'secret' &&
+        value.value === undefined &&
+        value.environmentVariable === undefined &&
+        isSecretReference(value.reference, projectId, environment));
+}
+/*** Validate one generated-artifact ledger identity without accepting file content. */
+function isArtifactIdentity(value, projectId, environment) {
+    return (isRecord(value) &&
+        isScopedIdentity(value.owner, projectId, environment) &&
+        typeof value.path === 'string');
+}
+/*** Validate scope, adapter catalog identity, and resource ID. */
+function isScopedIdentity(value, projectId, environment) {
+    return (isRecord(value) &&
+        value.projectId === projectId &&
+        value.environment === environment &&
+        Object.values(INFRA_ADAPTER_CATALOG).some(({ id }) => id === value.adapter) &&
+        typeof value.resourceId === 'string');
+}
+/*** Validate an unresolved control-plane credential identity. */
+function isControlPlaneReference(value) {
+    return isRecord(value) && value.source === 'control-plane' && typeof value.name === 'string';
+}
+/*** Validate an unresolved secret reference scoped to this exact ledger. */
+function isSecretReference(value, projectId, environment) {
+    return (isRecord(value) &&
+        value.source === 'secret-store' &&
+        value.projectId === projectId &&
+        value.environment === environment &&
+        typeof value.ref === 'string' &&
+        typeof value.key === 'string');
+}
+/*** Narrow parsed values. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+//# sourceMappingURL=isInfraStoredState.js.map

package/dist/features/environment-lifecycle/utils/isInfraStoredState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isInfraStoredState.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/isInfraStoredState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACL,qBAAqB,EAErB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAIpC,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;QACrC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,KAAc;IACnC,IACE,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,mBAAmB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC;QAC5E,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAC9B,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QACzC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;YACpC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YACtF,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YACzE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,KAAc;IACrC,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,UAAU;QACzB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ;QAC5C,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,SAAS,eAAe,CAAC,KAAc,EAAE,SAAiB,EAAE,WAAmB;IAC7E,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC;QACxD,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS;QACrC,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,mBAAmB,CAAC;QACzE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9B,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CACxF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,KAAc,EAAE,SAAiB,EAAE,WAAmB;IACtE,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC;QACtD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAC9B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CACL,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC;YAC5D,KAAK,CAAC,SAAS,KAAK,SAAS;YAC7B,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,CACL,KAAK,CAAC,UAAU,KAAK,QAAQ;QAC7B,KAAK,CAAC,KAAK,KAAK,SAAS;QACzB,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACvC,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,kBAAkB,CAAC,KAAc,EAAE,SAAiB,EAAE,WAAmB;IAChF,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC;QACrD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAC/B,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,SAAS,gBAAgB,CAAC,KAAc,EAAE,SAAiB,EAAE,WAAmB;IAC9E,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC;QAC3E,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CACrC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC/F,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,KAAc,EAAE,SAAiB,EAAE,WAAmB;IAC/E,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,MAAM,KAAK,cAAc;QAC/B,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAC9B,CAAC;AACJ,CAAC;AAED,6BAA6B;AAC7B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC","sourcesContent":["import { APP_ENVIRONMENT_IDS } from '@ankhorage/contracts/environments';\nimport {\n  INFRA_ADAPTER_CATALOG,\n  type InfraLedger,\n  isInfraEnvironmentSpec,\n} from '@ankhorage/contracts/infra';\n\nimport type { InfraStoredState } from '../../../types/infraOrchestration.js';\n\n/*** Validate persisted ownership state before any provider receives it. */\nexport function isInfraStoredState(value: unknown): value is InfraStoredState {\n  return (\n    isRecord(value) &&\n    value.schemaVersion === 1 &&\n    isInfraEnvironmentSpec(value.desired) &&\n    isInfraLedger(value.ledger)\n  );\n}\n\n/*** Validate the canonical ledger's serializable outer boundary. */\nfunction isInfraLedger(value: unknown): value is InfraLedger {\n  if (\n    isRecord(value) &&\n    value.schemaVersion === 1 &&\n    typeof value.projectId === 'string' &&\n    typeof value.environment === 'string' &&\n    APP_ENVIRONMENT_IDS.some((environment) => environment === value.environment) &&\n    Array.isArray(value.targets) &&\n    Array.isArray(value.resources) &&\n    Array.isArray(value.outputs) &&\n    Array.isArray(value.artifacts)\n  ) {\n    const { environment, projectId } = value;\n    return (\n      value.targets.every(isComputeTarget) &&\n      value.resources.every((resource) => isOwnedResource(resource, projectId, environment)) &&\n      value.outputs.every((output) => isOutput(output, projectId, environment)) &&\n      value.artifacts.every((artifact) => isArtifactIdentity(artifact, projectId, environment))\n    );\n  }\n  return false;\n}\n\n/*** Validate portable compute targets without accepting resolved credential payloads. */\nfunction isComputeTarget(value: unknown): boolean {\n  if (\n    !isRecord(value) ||\n    typeof value.id !== 'string' ||\n    !['linux', 'darwin', 'windows'].includes(String(value.os)) ||\n    !['amd64', 'arm64'].includes(String(value.architecture))\n  ) {\n    return false;\n  }\n  if (value.kind === 'local-host') return true;\n  return (\n    value.kind === 'ssh-host' &&\n    typeof value.host === 'string' &&\n    typeof value.port === 'number' &&\n    typeof value.user === 'string' &&\n    typeof value.hostKeyFingerprint === 'string' &&\n    isControlPlaneReference(value.credential)\n  );\n}\n\n/*** Validate one exact resource plus its dependency identities. */\nfunction isOwnedResource(value: unknown, projectId: string, environment: string): boolean {\n  return (\n    isRecord(value) &&\n    isScopedIdentity(value.identity, projectId, environment) &&\n    typeof value.persistent === 'boolean' &&\n    (value.retention === 'retain' || value.retention === 'delete-on-destroy') &&\n    Array.isArray(value.dependsOn) &&\n    value.dependsOn.every((identity) => isScopedIdentity(identity, projectId, environment))\n  );\n}\n\n/*** Enforce the public-value versus secret-reference output union at rest. */\nfunction isOutput(value: unknown, projectId: string, environment: string): boolean {\n  if (\n    !isRecord(value) ||\n    !isScopedIdentity(value.owner, projectId, environment) ||\n    typeof value.name !== 'string'\n  ) {\n    return false;\n  }\n  if (value.visibility === 'public') {\n    return (\n      ['string', 'number', 'boolean'].includes(typeof value.value) &&\n      value.reference === undefined &&\n      (value.environmentVariable === undefined || typeof value.environmentVariable === 'string')\n    );\n  }\n  return (\n    value.visibility === 'secret' &&\n    value.value === undefined &&\n    value.environmentVariable === undefined &&\n    isSecretReference(value.reference, projectId, environment)\n  );\n}\n\n/*** Validate one generated-artifact ledger identity without accepting file content. */\nfunction isArtifactIdentity(value: unknown, projectId: string, environment: string): boolean {\n  return (\n    isRecord(value) &&\n    isScopedIdentity(value.owner, projectId, environment) &&\n    typeof value.path === 'string'\n  );\n}\n\n/*** Validate scope, adapter catalog identity, and resource ID. */\nfunction isScopedIdentity(value: unknown, projectId: string, environment: string): boolean {\n  return (\n    isRecord(value) &&\n    value.projectId === projectId &&\n    value.environment === environment &&\n    Object.values(INFRA_ADAPTER_CATALOG).some(({ id }) => id === value.adapter) &&\n    typeof value.resourceId === 'string'\n  );\n}\n\n/*** Validate an unresolved control-plane credential identity. */\nfunction isControlPlaneReference(value: unknown): boolean {\n  return isRecord(value) && value.source === 'control-plane' && typeof value.name === 'string';\n}\n\n/*** Validate an unresolved secret reference scoped to this exact ledger. */\nfunction isSecretReference(value: unknown, projectId: string, environment: string): boolean {\n  return (\n    isRecord(value) &&\n    value.source === 'secret-store' &&\n    value.projectId === projectId &&\n    value.environment === environment &&\n    typeof value.ref === 'string' &&\n    typeof value.key === 'string'\n  );\n}\n\n/*** Narrow parsed values. */\nfunction isRecord(value: unknown): value is Readonly<Record<string, unknown>> {\n  return typeof value === 'object' && value !== null;\n}\n"]}

package/dist/features/environment-lifecycle/utils/mergeInfraOutputs.d.ts

@@ -0,0 +1,4 @@
+import type { InfraOutput } from '@ankhorage/contracts/infra';
+/*** Merge output identities while preferring the last adapter result for each owner and name. */
+export declare function mergeInfraOutputs(...groups: readonly (readonly InfraOutput[])[]): readonly InfraOutput[];
+//# sourceMappingURL=mergeInfraOutputs.d.ts.map

package/dist/features/environment-lifecycle/utils/mergeInfraOutputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeInfraOutputs.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/mergeInfraOutputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAI9D,iGAAiG;AACjG,wBAAgB,iBAAiB,CAC/B,GAAG,MAAM,EAAE,SAAS,CAAC,SAAS,WAAW,EAAE,CAAC,EAAE,GAC7C,SAAS,WAAW,EAAE,CAMxB"}

package/dist/features/environment-lifecycle/utils/mergeInfraOutputs.js

@@ -0,0 +1,10 @@
+import { infraIdentityKey } from './infraIdentityKey.js';
+/*** Merge output identities while preferring the last adapter result for each owner and name. */
+export function mergeInfraOutputs(...groups) {
+    const outputs = new Map();
+    for (const output of groups.flat()) {
+        outputs.set(`${infraIdentityKey(output.owner)}\0${output.name}`, output);
+    }
+    return [...outputs.values()];
+}
+//# sourceMappingURL=mergeInfraOutputs.js.map

package/dist/features/environment-lifecycle/utils/mergeInfraOutputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeInfraOutputs.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/mergeInfraOutputs.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAC/B,GAAG,MAA2C;IAE9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["import type { InfraOutput } from '@ankhorage/contracts/infra';\n\nimport { infraIdentityKey } from './infraIdentityKey.js';\n\n/*** Merge output identities while preferring the last adapter result for each owner and name. */\nexport function mergeInfraOutputs(\n  ...groups: readonly (readonly InfraOutput[])[]\n): readonly InfraOutput[] {\n  const outputs = new Map<string, InfraOutput>();\n  for (const output of groups.flat()) {\n    outputs.set(`${infraIdentityKey(output.owner)}\\0${output.name}`, output);\n  }\n  return [...outputs.values()];\n}\n"]}

package/dist/features/environment-lifecycle/utils/mergeInfraResources.d.ts

@@ -0,0 +1,4 @@
+import type { InfraOwnedResource } from '@ankhorage/contracts/infra';
+/*** Merge resource identities while preferring the last adapter result for each owner. */
+export declare function mergeInfraResources(...groups: readonly (readonly InfraOwnedResource[])[]): readonly InfraOwnedResource[];
+//# sourceMappingURL=mergeInfraResources.d.ts.map

package/dist/features/environment-lifecycle/utils/mergeInfraResources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeInfraResources.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/utils/mergeInfraResources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIrE,0FAA0F;AAC1F,wBAAgB,mBAAmB,CACjC,GAAG,MAAM,EAAE,SAAS,CAAC,SAAS,kBAAkB,EAAE,CAAC,EAAE,GACpD,SAAS,kBAAkB,EAAE,CAM/B"}