@ankhorage/infra 5.1.2 → 5.1.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @ankhorage/infra
 
+## 5.1.3
+
+### Patch Changes
+
+- 246e468: Retain compute targets and compute ownership when runtime-owned resources survive `infra destroy`, so production persistence is not orphaned by underlying host deletion. Production composition validation now runs against k3s 0.3.1+ and Kubernetes 0.7.3+, including current workload-template materialization.
+
 ## 5.1.2
 
 ### Patch Changes

package/README.md

@@ -3,7 +3,7 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v5.0.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v5.1.2](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 

package/dist/features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"destroyInfraEnvironmentAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,yCAAyC,CAAC;AAQjD,qGAAqG;AACrG,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,4BAA4B,EACrC,YAAY,EAAE,8BAA8B,GAC3C,OAAO,CAAC,2BAA2B,CAAC,CAyDtC"}
+{"version":3,"file":"destroyInfraEnvironmentAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,yCAAyC,CAAC;AAQjD,qGAAqG;AACrG,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,4BAA4B,EACrC,YAAY,EAAE,8BAA8B,GAC3C,OAAO,CAAC,2BAA2B,CAAC,CAqEtC"}

package/dist/features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.js

@@ -29,20 +29,33 @@ export async function destroyInfraEnvironmentAsync(request, dependencies) {
         outputs.push(...result.value.outputs);
         diagnostics.push(...result.diagnostics);
     }
+    let runtimeRetained = false;
     if (prepared.value.runtimeDesired.targets.length > 0) {
         const runtime = await prepared.value.adapters.runtime.destroyAsync(prepared.value.context, prepared.value.runtimeDesired, destroyRequest);
         if (!runtime.ok)
             return appendInfraFailure(diagnostics, runtime);
+        runtimeRetained = runtime.value.resources.length > 0;
         resources.push(...runtime.value.resources);
         outputs.push(...runtime.value.outputs);
         diagnostics.push(...runtime.diagnostics);
     }
-    const compute = await prepared.value.adapters.compute.destroyAsync(prepared.value.context, destroyRequest);
-    if (!compute.ok)
-        return appendInfraFailure(diagnostics, compute);
-    resources.push(...compute.value.resources);
-    outputs.push(...compute.value.outputs);
-    diagnostics.push(...compute.diagnostics);
+    if (runtimeRetained) {
+        resources.push(...prepared.value.compute.resources);
+        outputs.push(...prepared.value.compute.outputs);
+        diagnostics.push({
+            severity: 'info',
+            code: 'infra-compute-retained-for-runtime',
+            message: 'Compute remains active because runtime-owned resources survived destruction.',
+        });
+    }
+    else {
+        const compute = await prepared.value.adapters.compute.destroyAsync(prepared.value.context, destroyRequest);
+        if (!compute.ok)
+            return appendInfraFailure(diagnostics, compute);
+        resources.push(...compute.value.resources);
+        outputs.push(...compute.value.outputs);
+        diagnostics.push(...compute.diagnostics);
+    }
     const remainingResources = mergeInfraResources(resources);
     const remainingOutputs = mergeInfraOutputs(outputs);
     const ledger = remainingResources.length === 0 && remainingOutputs.length === 0
@@ -50,7 +63,7 @@ export async function destroyInfraEnvironmentAsync(request, dependencies) {
         : createInfraLedger({
             projectId: request.projectId,
             environment: prepared.value.environment.id,
-            targets: [],
+            targets: runtimeRetained ? prepared.value.compute.targets : [],
             resources: remainingResources,
             outputs: remainingOutputs,
         });

package/dist/features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.js.map

@@ -1 +1 @@
-{"version":3,"file":"destroyInfraEnvironmentAsync.js","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAqC,EACrC,YAA4C;IAE5C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,cAAc,GAAwB;QAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC1C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IACF,MAAM,MAAM,GAAG,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,WAAW,GAAsB,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAChE,QAAQ,CAAC,KAAK,CAAC,OAAO,EACtB,QAAQ,CAAC,KAAK,CAAC,cAAc,EAC7B,cAAc,CACf,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjE,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAChE,QAAQ,CAAC,KAAK,CAAC,OAAO,EACtB,cAAc,CACf,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjE,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GACV,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC9D,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,iBAAiB,CAAC;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;YAC1C,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;IACT,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE;QAC7D,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,sBAAsB,CAC7B,OAA4B,EAC5B,QAAuC;IAEvC,IACE,OAAO,CAAC,YAAY,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACpD,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EACxD,CAAC;QACD,OAAO,cAAc,CACnB,qCAAqC,EACrC,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CACzD,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACxC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;QAC5C,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,OAAO;QACZ,CAAC,CAAC,cAAc,CACZ,gCAAgC,EAChC,sFAAsF,CACvF;QACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACjD,CAAC;AAED,uEAAuE;AACvE,SAAS,cAAc,CAAC,IAAY,EAAE,OAAe;IACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC","sourcesContent":["import type {\n  InfraDestroyRequest,\n  InfraDiagnostic,\n  InfraOutput,\n  InfraOwnedResource,\n  InfraResult,\n} from '@ankhorage/contracts/infra';\n\nimport type {\n  InfraDestroyOperationRequest,\n  InfraDestroyOperationResult,\n  InfraOrchestrationDependencies,\n} from '../../../../types/infraOrchestration.js';\nimport { appendInfraFailure } from '../../utils/appendInfraFailure.js';\nimport { createInfraLedger } from '../../utils/createInfraLedger.js';\nimport { infraIdentityKey } from '../../utils/infraIdentityKey.js';\nimport { mergeInfraOutputs } from '../../utils/mergeInfraOutputs.js';\nimport { mergeInfraResources } from '../../utils/mergeInfraResources.js';\nimport { prepareInfraOperationAsync } from './prepareInfraOperationAsync.js';\n\n/*** Destroy exact owned resources in reverse dependency order behind explicit scope confirmation. */\nexport async function destroyInfraEnvironmentAsync(\n  request: InfraDestroyOperationRequest,\n  dependencies: InfraOrchestrationDependencies,\n): Promise<InfraDestroyOperationResult> {\n  const prepared = await prepareInfraOperationAsync(request, 'destroy', dependencies);\n  if (!prepared.ok) return prepared;\n  const destroyRequest: InfraDestroyRequest = {\n    projectId: request.projectId,\n    environment: prepared.value.environment.id,\n    confirmation: request.confirmation,\n    persistence: request.persistence,\n  };\n  const safety = validateDestroyRequest(destroyRequest, request.previous?.resources ?? []);\n  if (!safety.ok) return safety;\n  const diagnostics: InfraDiagnostic[] = [...prepared.diagnostics];\n  const resources: InfraOwnedResource[] = [];\n  const outputs: InfraOutput[] = [];\n  for (const service of [...prepared.value.adapters.services].reverse()) {\n    const result = await service.destroyAsync(prepared.value.context, destroyRequest);\n    if (!result.ok) return appendInfraFailure(diagnostics, result);\n    resources.push(...result.value.resources);\n    outputs.push(...result.value.outputs);\n    diagnostics.push(...result.diagnostics);\n  }\n  if (prepared.value.runtimeDesired.targets.length > 0) {\n    const runtime = await prepared.value.adapters.runtime.destroyAsync(\n      prepared.value.context,\n      prepared.value.runtimeDesired,\n      destroyRequest,\n    );\n    if (!runtime.ok) return appendInfraFailure(diagnostics, runtime);\n    resources.push(...runtime.value.resources);\n    outputs.push(...runtime.value.outputs);\n    diagnostics.push(...runtime.diagnostics);\n  }\n  const compute = await prepared.value.adapters.compute.destroyAsync(\n    prepared.value.context,\n    destroyRequest,\n  );\n  if (!compute.ok) return appendInfraFailure(diagnostics, compute);\n  resources.push(...compute.value.resources);\n  outputs.push(...compute.value.outputs);\n  diagnostics.push(...compute.diagnostics);\n  const remainingResources = mergeInfraResources(resources);\n  const remainingOutputs = mergeInfraOutputs(outputs);\n  const ledger =\n    remainingResources.length === 0 && remainingOutputs.length === 0\n      ? null\n      : createInfraLedger({\n          projectId: request.projectId,\n          environment: prepared.value.environment.id,\n          targets: [],\n          resources: remainingResources,\n          outputs: remainingOutputs,\n        });\n  return {\n    ok: true,\n    value: { environment: prepared.value.environment.id, ledger },\n    diagnostics,\n  };\n}\n\n/*** Refuse cross-project confirmation and unowned persistent deletion before any mutation. */\nfunction validateDestroyRequest(\n  request: InfraDestroyRequest,\n  previous: readonly InfraOwnedResource[],\n): InfraResult<null> {\n  if (\n    request.confirmation.projectId !== request.projectId ||\n    request.confirmation.environment !== request.environment\n  ) {\n    return destroyFailure(\n      'infra-destroy-confirmation-mismatch',\n      'Infra destroy confirmation must exactly match the selected project and environment.',\n    );\n  }\n  if (request.persistence.policy === 'retain') {\n    return { ok: true, value: null, diagnostics: [] };\n  }\n  const owned = new Set(previous.map(({ identity }) => infraIdentityKey(identity)));\n  const invalid = request.persistence.confirmedResources.some(\n    (identity) =>\n      identity.projectId !== request.projectId ||\n      identity.environment !== request.environment ||\n      !owned.has(infraIdentityKey(identity)),\n  );\n  return invalid\n    ? destroyFailure(\n        'infra-destroy-resource-unowned',\n        'Persistent deletion confirmation contains a resource outside the stored Infra scope.',\n      )\n    : { ok: true, value: null, diagnostics: [] };\n}\n\n/*** Create one stable non-provider-specific destroy safety failure. */\nfunction destroyFailure(code: string, message: string): InfraResult<never> {\n  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };\n}\n"]}
+{"version":3,"file":"destroyInfraEnvironmentAsync.js","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAqC,EACrC,YAA4C;IAE5C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,cAAc,GAAwB;QAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC1C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IACF,MAAM,MAAM,GAAG,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,WAAW,GAAsB,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAChE,QAAQ,CAAC,KAAK,CAAC,OAAO,EACtB,QAAQ,CAAC,KAAK,CAAC,cAAc,EAC7B,cAAc,CACf,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QACrD,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChD,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,oCAAoC;YAC1C,OAAO,EAAE,8EAA8E;SACxF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAChE,QAAQ,CAAC,KAAK,CAAC,OAAO,EACtB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjE,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GACV,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC9D,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,iBAAiB,CAAC;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;YAC1C,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC9D,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;IACT,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE;QAC7D,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,sBAAsB,CAC7B,OAA4B,EAC5B,QAAuC;IAEvC,IACE,OAAO,CAAC,YAAY,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACpD,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EACxD,CAAC;QACD,OAAO,cAAc,CACnB,qCAAqC,EACrC,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CACzD,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACxC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;QAC5C,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,OAAO;QACZ,CAAC,CAAC,cAAc,CACZ,gCAAgC,EAChC,sFAAsF,CACvF;QACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACjD,CAAC;AAED,uEAAuE;AACvE,SAAS,cAAc,CAAC,IAAY,EAAE,OAAe;IACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC","sourcesContent":["import type {\n  InfraDestroyRequest,\n  InfraDiagnostic,\n  InfraOutput,\n  InfraOwnedResource,\n  InfraResult,\n} from '@ankhorage/contracts/infra';\n\nimport type {\n  InfraDestroyOperationRequest,\n  InfraDestroyOperationResult,\n  InfraOrchestrationDependencies,\n} from '../../../../types/infraOrchestration.js';\nimport { appendInfraFailure } from '../../utils/appendInfraFailure.js';\nimport { createInfraLedger } from '../../utils/createInfraLedger.js';\nimport { infraIdentityKey } from '../../utils/infraIdentityKey.js';\nimport { mergeInfraOutputs } from '../../utils/mergeInfraOutputs.js';\nimport { mergeInfraResources } from '../../utils/mergeInfraResources.js';\nimport { prepareInfraOperationAsync } from './prepareInfraOperationAsync.js';\n\n/*** Destroy exact owned resources in reverse dependency order behind explicit scope confirmation. */\nexport async function destroyInfraEnvironmentAsync(\n  request: InfraDestroyOperationRequest,\n  dependencies: InfraOrchestrationDependencies,\n): Promise<InfraDestroyOperationResult> {\n  const prepared = await prepareInfraOperationAsync(request, 'destroy', dependencies);\n  if (!prepared.ok) return prepared;\n  const destroyRequest: InfraDestroyRequest = {\n    projectId: request.projectId,\n    environment: prepared.value.environment.id,\n    confirmation: request.confirmation,\n    persistence: request.persistence,\n  };\n  const safety = validateDestroyRequest(destroyRequest, request.previous?.resources ?? []);\n  if (!safety.ok) return safety;\n  const diagnostics: InfraDiagnostic[] = [...prepared.diagnostics];\n  const resources: InfraOwnedResource[] = [];\n  const outputs: InfraOutput[] = [];\n  for (const service of [...prepared.value.adapters.services].reverse()) {\n    const result = await service.destroyAsync(prepared.value.context, destroyRequest);\n    if (!result.ok) return appendInfraFailure(diagnostics, result);\n    resources.push(...result.value.resources);\n    outputs.push(...result.value.outputs);\n    diagnostics.push(...result.diagnostics);\n  }\n  let runtimeRetained = false;\n  if (prepared.value.runtimeDesired.targets.length > 0) {\n    const runtime = await prepared.value.adapters.runtime.destroyAsync(\n      prepared.value.context,\n      prepared.value.runtimeDesired,\n      destroyRequest,\n    );\n    if (!runtime.ok) return appendInfraFailure(diagnostics, runtime);\n    runtimeRetained = runtime.value.resources.length > 0;\n    resources.push(...runtime.value.resources);\n    outputs.push(...runtime.value.outputs);\n    diagnostics.push(...runtime.diagnostics);\n  }\n  if (runtimeRetained) {\n    resources.push(...prepared.value.compute.resources);\n    outputs.push(...prepared.value.compute.outputs);\n    diagnostics.push({\n      severity: 'info',\n      code: 'infra-compute-retained-for-runtime',\n      message: 'Compute remains active because runtime-owned resources survived destruction.',\n    });\n  } else {\n    const compute = await prepared.value.adapters.compute.destroyAsync(\n      prepared.value.context,\n      destroyRequest,\n    );\n    if (!compute.ok) return appendInfraFailure(diagnostics, compute);\n    resources.push(...compute.value.resources);\n    outputs.push(...compute.value.outputs);\n    diagnostics.push(...compute.diagnostics);\n  }\n  const remainingResources = mergeInfraResources(resources);\n  const remainingOutputs = mergeInfraOutputs(outputs);\n  const ledger =\n    remainingResources.length === 0 && remainingOutputs.length === 0\n      ? null\n      : createInfraLedger({\n          projectId: request.projectId,\n          environment: prepared.value.environment.id,\n          targets: runtimeRetained ? prepared.value.compute.targets : [],\n          resources: remainingResources,\n          outputs: remainingOutputs,\n        });\n  return {\n    ok: true,\n    value: { environment: prepared.value.environment.id, ledger },\n    diagnostics,\n  };\n}\n\n/*** Refuse cross-project confirmation and unowned persistent deletion before any mutation. */\nfunction validateDestroyRequest(\n  request: InfraDestroyRequest,\n  previous: readonly InfraOwnedResource[],\n): InfraResult<null> {\n  if (\n    request.confirmation.projectId !== request.projectId ||\n    request.confirmation.environment !== request.environment\n  ) {\n    return destroyFailure(\n      'infra-destroy-confirmation-mismatch',\n      'Infra destroy confirmation must exactly match the selected project and environment.',\n    );\n  }\n  if (request.persistence.policy === 'retain') {\n    return { ok: true, value: null, diagnostics: [] };\n  }\n  const owned = new Set(previous.map(({ identity }) => infraIdentityKey(identity)));\n  const invalid = request.persistence.confirmedResources.some(\n    (identity) =>\n      identity.projectId !== request.projectId ||\n      identity.environment !== request.environment ||\n      !owned.has(infraIdentityKey(identity)),\n  );\n  return invalid\n    ? destroyFailure(\n        'infra-destroy-resource-unowned',\n        'Persistent deletion confirmation contains a resource outside the stored Infra scope.',\n      )\n    : { ok: true, value: null, diagnostics: [] };\n}\n\n/*** Create one stable non-provider-specific destroy safety failure. */\nfunction destroyFailure(code: string, message: string): InfraResult<never> {\n  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "5.1.2",
+  "version": "5.1.3",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -100,6 +100,7 @@
     "prepack": "bun run build",
     "test": "bun test src",
     "test:e2e": "ANKH_INFRA_COMPOSITION_E2E=1 bun test src/infraComposition.integration.test.ts",
+    "test:e2e:docker-compose-providers": "ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E=1 bun test src/localDockerComposeProviders.integration.test.ts",
     "test:e2e:minikube-supabase": "ANKH_INFRA_MINIKUBE_SUPABASE_E2E=1 bun test src/localMinikubeSupabase.integration.test.ts",
     "typecheck": "bun x tsc --noEmit -p tsconfig.json",
     "check-types": "bun run typecheck",
@@ -111,14 +112,14 @@
     "@ankhorage/ankh": "^0.8.11",
     "@ankhorage/cerbos": "^0.2.0",
     "@ankhorage/devtools": "^1.14.0",
-    "@ankhorage/docker-compose": "^0.4.0",
+    "@ankhorage/docker-compose": "^0.5.3",
     "@ankhorage/hetzner": "^0.3.0",
-    "@ankhorage/k3s": "^0.3.0",
+    "@ankhorage/k3s": "^0.3.1",
     "@ankhorage/local": "^0.3.0",
     "@ankhorage/minikube": "^0.4.1",
     "@ankhorage/paradox": "^0.1.24",
     "@ankhorage/r2": "^0.2.0",
-    "@ankhorage/supabase": "^0.4.5",
+    "@ankhorage/supabase": "^0.4.7",
     "@ankhorage/supabase-vault": "^0.3.1",
     "@types/bun": "^1.4.1",
     "@types/node": "^25.6.0",

package/src/features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.ts

@@ -43,6 +43,7 @@ export async function destroyInfraEnvironmentAsync(
     outputs.push(...result.value.outputs);
     diagnostics.push(...result.diagnostics);
   }
+  let runtimeRetained = false;
   if (prepared.value.runtimeDesired.targets.length > 0) {
     const runtime = await prepared.value.adapters.runtime.destroyAsync(
       prepared.value.context,
@@ -50,18 +51,29 @@ export async function destroyInfraEnvironmentAsync(
       destroyRequest,
     );
     if (!runtime.ok) return appendInfraFailure(diagnostics, runtime);
+    runtimeRetained = runtime.value.resources.length > 0;
     resources.push(...runtime.value.resources);
     outputs.push(...runtime.value.outputs);
     diagnostics.push(...runtime.diagnostics);
   }
-  const compute = await prepared.value.adapters.compute.destroyAsync(
-    prepared.value.context,
-    destroyRequest,
-  );
-  if (!compute.ok) return appendInfraFailure(diagnostics, compute);
-  resources.push(...compute.value.resources);
-  outputs.push(...compute.value.outputs);
-  diagnostics.push(...compute.diagnostics);
+  if (runtimeRetained) {
+    resources.push(...prepared.value.compute.resources);
+    outputs.push(...prepared.value.compute.outputs);
+    diagnostics.push({
+      severity: 'info',
+      code: 'infra-compute-retained-for-runtime',
+      message: 'Compute remains active because runtime-owned resources survived destruction.',
+    });
+  } else {
+    const compute = await prepared.value.adapters.compute.destroyAsync(
+      prepared.value.context,
+      destroyRequest,
+    );
+    if (!compute.ok) return appendInfraFailure(diagnostics, compute);
+    resources.push(...compute.value.resources);
+    outputs.push(...compute.value.outputs);
+    diagnostics.push(...compute.diagnostics);
+  }
   const remainingResources = mergeInfraResources(resources);
   const remainingOutputs = mergeInfraOutputs(outputs);
   const ledger =
@@ -70,7 +82,7 @@ export async function destroyInfraEnvironmentAsync(
       : createInfraLedger({
           projectId: request.projectId,
           environment: prepared.value.environment.id,
-          targets: [],
+          targets: runtimeRetained ? prepared.value.compute.targets : [],
           resources: remainingResources,
           outputs: remainingOutputs,
         });

package/src/hetznerK3sProduction.test.ts

@@ -0,0 +1,485 @@
+import type {
+  InfraLedger,
+  InfraManifest,
+  InfraResourceIdentity,
+  InfraResult,
+} from '@ankhorage/contracts/infra';
+import {
+  createInfraAdapter as createHetznerInfraAdapter,
+  type HetznerCloudApi,
+  type HetznerCloudObservation,
+  type HetznerDesiredCompute,
+  type HetznerHostKeyProbe,
+  type HetznerProjectIdentity,
+  type HetznerResourceId,
+  infraAdapterDescriptor as hetznerInfraAdapterDescriptor,
+} from '@ankhorage/hetzner';
+import {
+  createInfraAdapter as createK3sInfraAdapter,
+  infraAdapterDescriptor as k3sInfraAdapterDescriptor,
+  type K3sClusterObservation,
+  type K3sClusterSpec,
+  type K3sControlPlane,
+  type K3sNodeAccess,
+} from '@ankhorage/k3s';
+import {
+  createInfraAdapter as createSupabaseInfraAdapter,
+  infraAdapterDescriptor as supabaseInfraAdapterDescriptor,
+  type SupabaseControlPlane,
+  type SupabaseControlPlaneRequest,
+} from '@ankhorage/supabase';
+import { expect, test } from 'bun:test';
+
+import { destroyInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.js';
+import { downInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/downInfraEnvironmentAsync.js';
+import { planInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/planInfraEnvironmentAsync.js';
+import { statusInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/statusInfraEnvironmentAsync.js';
+import { upInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.js';
+import type { InfraOrchestrationDependencies } from './types/infraOrchestration.js';
+
+const projectId = 'infra145-production';
+const publicBaseUrl = 'https://api.production.example.test';
+const domain = 'api.production.example.test';
+
+const manifest = {
+  environments: {
+    local: {
+      deployment: {
+        compute: { provider: 'local' },
+        runtime: { provider: 'docker-compose' },
+      },
+    },
+    production: {
+      deployment: {
+        compute: { provider: 'hetzner', location: 'fsn1', serverType: 'cx23' },
+        runtime: { provider: 'k3s', topology: { servers: 1, agents: 0 } },
+      },
+      database: { provider: 'supabase', tier: 'prod' },
+      auth: { provider: 'supabase' },
+      networking: { domain, publicBaseUrl },
+    },
+  },
+  modules: [],
+} as const satisfies InfraManifest;
+
+test('composes Hetzner, k3s, Kubernetes and Supabase while retaining compute for production data', async () => {
+  const fixture = new ProductionFixture();
+  const dependencies = createDependencies(fixture);
+
+  const initialPlan = requireSuccess(
+    await planInfraEnvironmentAsync(
+      { projectId, manifest, environment: 'production' },
+      dependencies,
+    ),
+  );
+  expect(initialPlan.actions.some(({ operation }) => operation === 'create')).toBe(true);
+
+  const firstUp = requireSuccess(
+    await upInfraEnvironmentAsync({ projectId, manifest, environment: 'production' }, dependencies),
+  );
+  const firstLedger: InfraLedger = firstUp.ledger;
+  expect(firstUp.targets).toEqual([
+    {
+      id: 'server',
+      kind: 'ssh-host',
+      os: 'linux',
+      architecture: 'amd64',
+      host: '203.0.113.10',
+      port: 22,
+      user: 'root',
+      credential: { source: 'control-plane', name: 'HETZNER_SSH' },
+      hostKeyFingerprint: 'SHA256:phase10-host',
+    },
+  ]);
+  expect(fixture.k3s.lastAccess).toHaveLength(1);
+  const [access] = fixture.k3s.lastAccess;
+  expect(access?.transport.kind).toBe('ssh');
+  expect(access?.transport.kind === 'ssh' && access.transport.host).toBe('203.0.113.10');
+  expect(JSON.stringify(firstUp)).not.toContain('phase10-private-key');
+  expect(JSON.stringify(firstUp)).not.toContain('phase10-service-role-key');
+  expect(fixture.kubernetes.serializedResources()).toContain(`"host":"${domain}"`);
+  expect(fixture.kubernetes.serializedResources()).toContain('PersistentVolumeClaim');
+  expect(firstUp.resources.some(({ persistent }) => persistent)).toBe(true);
+  const urlOutput = firstUp.outputs.find(({ name }) => name === 'url');
+  expect(urlOutput?.value).toBe(publicBaseUrl);
+  expect(urlOutput?.visibility).toBe('public');
+
+  const status = requireSuccess(
+    await statusInfraEnvironmentAsync(
+      { projectId, manifest, environment: 'production', previous: firstLedger },
+      dependencies,
+    ),
+  );
+  expect(status.state).toBe('ready');
+
+  const converged = requireSuccess(
+    await planInfraEnvironmentAsync(
+      { projectId, manifest, environment: 'production', previous: firstLedger },
+      dependencies,
+    ),
+  );
+  expect(converged.actions.every(({ operation }) => operation === 'noop')).toBe(true);
+
+  const identitiesBeforeRestart = resourceIdentities(firstUp.resources);
+  const down = requireSuccess(
+    await downInfraEnvironmentAsync(
+      { projectId, manifest, environment: 'production', previous: firstLedger },
+      dependencies,
+    ),
+  );
+  const { ledger: downLedger } = down;
+  expect(fixture.k3s.state).toBe('stopped');
+
+  const resumed = requireSuccess(
+    await upInfraEnvironmentAsync(
+      { projectId, manifest, environment: 'production', previous: downLedger },
+      dependencies,
+    ),
+  );
+  const { ledger: resumedLedger } = resumed;
+  expect(fixture.k3s.state).toBe('ready');
+  expect(resourceIdentities(resumed.resources)).toEqual(identitiesBeforeRestart);
+
+  const retained = requireSuccess(
+    await destroyInfraEnvironmentAsync(
+      {
+        projectId,
+        manifest,
+        environment: 'production',
+        previous: resumedLedger,
+        confirmation: { projectId, environment: 'production' },
+        persistence: { policy: 'retain' },
+      },
+      dependencies,
+    ),
+  );
+  expect(retained.ledger).not.toBeNull();
+  expect(retained.ledger?.targets).toEqual(firstUp.targets);
+  expect(retained.ledger?.resources.some(({ persistent }) => persistent)).toBe(true);
+  expect(fixture.hetzner.destroyed).toEqual([]);
+  expect(fixture.k3s.calls).not.toContain('destroy');
+});
+
+class ProductionFixture {
+  readonly hetzner = new FakeHetznerCloudApi();
+  readonly hostKeyProbe = new FakeHostKeyProbe();
+  readonly k3s = new FakeK3sControlPlane();
+  readonly kubernetes = this.k3s.api;
+  readonly supabase = new FakeSupabaseControlPlane();
+}
+
+function createDependencies(fixture: ProductionFixture): InfraOrchestrationDependencies {
+  return {
+    adapterResolver: {
+      loadAsync: (packageName) => {
+        switch (packageName) {
+          case hetznerInfraAdapterDescriptor.package:
+            return Promise.resolve({
+              infraAdapterDescriptor: hetznerInfraAdapterDescriptor,
+              createInfraAdapter: () =>
+                createHetznerInfraAdapter({
+                  api: fixture.hetzner,
+                  hostKeyProbe: fixture.hostKeyProbe,
+                }),
+            });
+          case k3sInfraAdapterDescriptor.package:
+            return Promise.resolve({
+              infraAdapterDescriptor: k3sInfraAdapterDescriptor,
+              createInfraAdapter: () => createK3sInfraAdapter({ controlPlane: fixture.k3s }),
+            });
+          case supabaseInfraAdapterDescriptor.package:
+            return Promise.resolve({
+              infraAdapterDescriptor: supabaseInfraAdapterDescriptor,
+              createInfraAdapter: () =>
+                createSupabaseInfraAdapter({ controlPlane: fixture.supabase }),
+            });
+          default:
+            return Promise.reject(new Error(`Unexpected adapter package: ${packageName}`));
+        }
+      },
+    },
+    credentials: {
+      resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
+    },
+    secrets: {
+      resolveAsync: () =>
+        Promise.resolve({
+          ok: false,
+          diagnostics: [
+            { severity: 'error', code: 'unexpected-secret', message: 'No secret is expected.' },
+          ],
+        }),
+    },
+  };
+}
+
+function resolveCredential(name: string): InfraResult<Readonly<Record<string, string>>> {
+  if (name === 'HCLOUD_TOKEN') return success({ token: 'phase10-hcloud-token' });
+  if (name === 'HETZNER_SSH') {
+    return success({
+      publicKey: 'ssh-ed25519 AAAA phase10',
+      privateKey: 'phase10-private-key',
+    });
+  }
+  if (name === 'SUPABASE_BOOTSTRAP') {
+    return success({
+      postgresPassword: 'phase10-postgres-password',
+      jwtSecret: 'phase10-jwt-secret-0123456789abcdef',
+      anonKey: 'phase10-anon-key',
+      serviceRoleKey: 'phase10-service-role-key',
+      realtimeSecretKeyBase:
+        'phase10-realtime-secret-key-base-0123456789abcdefghijklmnopqrstuvwxyz',
+      realtimeDatabaseEncryptionKey: '1234567890abcdef',
+      pgMetaCryptoKey: 'phase10-pg-meta-crypto-key-0123456789abcdef',
+    });
+  }
+  return {
+    ok: false,
+    diagnostics: [
+      {
+        severity: 'error',
+        code: 'unexpected-credential',
+        message: `Unexpected credential reference: ${name}`,
+      },
+    ],
+  };
+}
+
+class FakeHetznerCloudApi implements HetznerCloudApi {
+  observation: HetznerCloudObservation = { resources: [] };
+  readonly destroyed: HetznerResourceId[] = [];
+
+  validateAsync(): Promise<InfraResult<null>> {
+    return Promise.resolve(success(null));
+  }
+
+  inspectAsync(): Promise<InfraResult<HetznerCloudObservation>> {
+    return Promise.resolve(success(this.observation));
+  }
+
+  reconcileAsync(
+    _token: string,
+    desired: HetznerDesiredCompute,
+  ): Promise<InfraResult<HetznerCloudObservation>> {
+    this.observation = {
+      resources: [desired.network, desired.firewall, desired.sshKey, desired.server].map(
+        (resource, index) => ({
+          resourceId: resource.owner.identity.resourceId as HetznerResourceId,
+          externalId: String(index + 1),
+          configurationHash: resource.configurationHash,
+          state: 'ready' as const,
+          ...(resource.owner.identity.resourceId === 'server'
+            ? { publicIpv4: '203.0.113.10', architecture: 'amd64' as const }
+            : {}),
+        }),
+      ),
+    };
+    return Promise.resolve(success(this.observation));
+  }
+
+  destroyAsync(
+    _token: string,
+    _identity: HetznerProjectIdentity,
+    resourceIds: readonly HetznerResourceId[],
+  ): Promise<InfraResult<HetznerCloudObservation>> {
+    this.destroyed.push(...resourceIds);
+    this.observation = {
+      resources: this.observation.resources.filter(
+        ({ resourceId }) => !resourceIds.includes(resourceId),
+      ),
+    };
+    return Promise.resolve(success(this.observation));
+  }
+}
+
+class FakeHostKeyProbe implements HetznerHostKeyProbe {
+  fingerprintAsync(): Promise<InfraResult<string>> {
+    return Promise.resolve(success('SHA256:phase10-host'));
+  }
+}
+
+type KubernetesApi = NonNullable<K3sClusterObservation['api']>;
+type KubernetesOwnershipQuery = Parameters<KubernetesApi['listOwnedAsync']>[0];
+type KubernetesResource = Awaited<ReturnType<KubernetesApi['listOwnedAsync']>>[number];
+type KubernetesResourceReference = Parameters<KubernetesApi['deleteAsync']>[0];
+type KubernetesResourceObservation = Awaited<ReturnType<KubernetesApi['observeAsync']>>;
+
+class FakeK3sControlPlane implements K3sControlPlane {
+  readonly api = new FakeKubernetesApi();
+  readonly calls: string[] = [];
+  lastAccess: readonly K3sNodeAccess[] = [];
+  state: K3sClusterObservation['state'] = 'absent';
+  nodes: K3sClusterObservation['nodes'] = [];
+
+  validateAsync(
+    _spec: K3sClusterSpec,
+    access: readonly K3sNodeAccess[],
+  ): Promise<InfraResult<null>> {
+    this.calls.push('validate');
+    this.lastAccess = access;
+    return Promise.resolve(success(null));
+  }
+
+  inspectAsync(): Promise<InfraResult<K3sClusterObservation>> {
+    this.calls.push('inspect');
+    return Promise.resolve(success(this.observation()));
+  }
+
+  ensureAsync(
+    spec: K3sClusterSpec,
+    access: readonly K3sNodeAccess[],
+  ): Promise<InfraResult<K3sClusterObservation>> {
+    this.calls.push('ensure');
+    this.lastAccess = access;
+    this.state = 'ready';
+    this.nodes = spec.nodes.map(({ id }) => ({
+      id,
+      state: 'ready',
+      configurationMatches: true,
+    }));
+    return Promise.resolve(success(this.observation()));
+  }
+
+  waitUntilReadyAsync(): Promise<InfraResult<K3sClusterObservation>> {
+    this.calls.push('wait');
+    return Promise.resolve(success(this.observation()));
+  }
+
+  loadImagesAsync(
+    _spec: K3sClusterSpec,
+    _access: readonly K3sNodeAccess[],
+    images: readonly string[],
+  ): Promise<InfraResult<null>> {
+    this.calls.push(`images:${images.join(',')}`);
+    return Promise.resolve(success(null));
+  }
+
+  suspendAsync(): Promise<InfraResult<null>> {
+    this.calls.push('suspend');
+    this.state = 'stopped';
+    this.nodes = this.nodes.map((node) => ({ ...node, state: 'stopped' }));
+    return Promise.resolve(success(null));
+  }
+
+  destroyAsync(): Promise<InfraResult<null>> {
+    this.calls.push('destroy');
+    this.state = 'absent';
+    this.nodes = [];
+    return Promise.resolve(success(null));
+  }
+
+  private observation(): K3sClusterObservation {
+    return {
+      state: this.state,
+      configurationMatches: true,
+      nodes: this.nodes,
+      ...(this.state === 'ready' ? { api: this.api } : {}),
+    };
+  }
+}
+
+class FakeKubernetesApi implements KubernetesApi {
+  readonly resources: KubernetesResource[] = [];
+
+  listOwnedAsync(query: KubernetesOwnershipQuery): Promise<readonly KubernetesResource[]> {
+    return Promise.resolve(
+      this.resources.filter(({ metadata }) => includesLabels(metadata.labels, query.labels)),
+    );
+  }
+
+  applyAsync(resource: KubernetesResource): Promise<void> {
+    const index = this.resources.findIndex((candidate) => sameResource(candidate, resource));
+    if (index === -1) this.resources.push(resource);
+    else this.resources.splice(index, 1, resource);
+    return Promise.resolve();
+  }
+
+  deleteAsync(reference: KubernetesResourceReference): Promise<void> {
+    const index = this.resources.findIndex((resource) => sameResource(resource, reference));
+    if (index >= 0) this.resources.splice(index, 1);
+    return Promise.resolve();
+  }
+
+  observeAsync(reference: KubernetesResourceReference): Promise<KubernetesResourceObservation> {
+    return Promise.resolve({
+      state: 'ready',
+      ...(reference.kind === 'Service' ? { publicOutputs: { endpoint: publicBaseUrl } } : {}),
+    });
+  }
+
+  waitUntilReadyAsync(): Promise<KubernetesResourceObservation> {
+    return Promise.resolve({ state: 'ready' });
+  }
+
+  serializedResources(): string {
+    return JSON.stringify(this.resources);
+  }
+}
+
+class FakeSupabaseControlPlane implements SupabaseControlPlane {
+  readonly buckets = new Set<string>();
+
+  healthAsync(_request: SupabaseControlPlaneRequest): Promise<InfraResult<null>> {
+    return Promise.resolve(success(null));
+  }
+
+  listBucketsAsync(_request: SupabaseControlPlaneRequest): Promise<InfraResult<readonly string[]>> {
+    return Promise.resolve(success([...this.buckets]));
+  }
+
+  createBucketAsync(
+    request: SupabaseControlPlaneRequest & { readonly bucket: string },
+  ): Promise<InfraResult<null>> {
+    this.buckets.add(request.bucket);
+    return Promise.resolve(success(null));
+  }
+
+  deleteBucketAsync(
+    request: SupabaseControlPlaneRequest & { readonly bucket: string },
+  ): Promise<InfraResult<null>> {
+    this.buckets.delete(request.bucket);
+    return Promise.resolve(success(null));
+  }
+}
+
+function resourceIdentities(
+  resources: readonly { readonly identity: InfraResourceIdentity }[],
+): readonly string[] {
+  return resources
+    .map(({ identity }) =>
+      [identity.projectId, identity.environment, identity.adapter, identity.resourceId].join(':'),
+    )
+    .sort();
+}
+
+function includesLabels(
+  actual: Readonly<Record<string, string>>,
+  expected: Readonly<Record<string, string>>,
+): boolean {
+  return Object.entries(expected).every(([expectedKey, expectedValue]) =>
+    Object.entries(actual).some(
+      ([actualKey, actualValue]) => actualKey === expectedKey && actualValue === expectedValue,
+    ),
+  );
+}
+
+function sameResource(
+  left: KubernetesResource,
+  right: KubernetesResource | KubernetesResourceReference,
+): boolean {
+  return (
+    left.apiVersion === right.apiVersion &&
+    left.kind === right.kind &&
+    left.metadata.name === ('metadata' in right ? right.metadata.name : right.name) &&
+    left.metadata.namespace === ('metadata' in right ? right.metadata.namespace : right.namespace)
+  );
+}
+
+function requireSuccess<T>(result: InfraResult<T>): T {
+  if (!result.ok) throw new Error(result.diagnostics.map(({ message }) => message).join(' '));
+  return result.value;
+}
+
+function success<T>(value: T): InfraResult<T> {
+  return { ok: true, value, diagnostics: [] };
+}

package/src/localDockerComposeProviders.integration.test.ts

@@ -0,0 +1,240 @@
+import { createHmac } from 'node:crypto';
+
+import type {
+  InfraLedger,
+  InfraManifest,
+  InfraResourceIdentity,
+  InfraResult,
+} from '@ankhorage/contracts/infra';
+import { expect, test } from 'bun:test';
+
+import { createNodeInfraAdapterPackageResolver } from './features/environment-lifecycle/adapters/outbound/createNodeInfraAdapterPackageResolver.js';
+import { destroyInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.js';
+import { downInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/downInfraEnvironmentAsync.js';
+import { planInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/planInfraEnvironmentAsync.js';
+import { statusInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/statusInfraEnvironmentAsync.js';
+import { upInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.js';
+import type { InfraOrchestrationDependencies } from './types/infraOrchestration.js';
+
+const projectId = 'infra145-compose-providers';
+const baseUrl = 'http://127.0.0.1:54322';
+const bucket = 'phase9-acceptance';
+const jwtSecret = 'phase9-jwt-secret-that-is-at-least-thirty-two-characters';
+const credentials = {
+  postgresPassword: 'phase9-postgres-password',
+  jwtSecret,
+  anonKey: createJwt('anon'),
+  serviceRoleKey: createJwt('service_role'),
+  realtimeSecretKeyBase: 'r'.repeat(64),
+  realtimeDatabaseEncryptionKey: '0123456789abcdef',
+  pgMetaCryptoKey: 'phase9-meta-crypto-key-that-is-at-least-32-characters',
+} as const;
+const manifest = {
+  environments: {
+    local: {
+      deployment: {
+        compute: { provider: 'local' },
+        runtime: { provider: 'docker-compose', projectName: projectId },
+      },
+      database: { provider: 'supabase', tier: 'dev' },
+      auth: { provider: 'supabase' },
+      objectStorage: { provider: 'supabase', buckets: [bucket] },
+      authz: {
+        provider: 'cerbos',
+        kind: 'ABAC',
+        policies: [
+          {
+            path: 'phase9.yaml',
+            content:
+              'apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n  version: default\n  resource: phase9\n  rules: []\n',
+          },
+        ],
+      },
+      networking: { publicBaseUrl: baseUrl },
+    },
+  },
+  modules: [],
+} as const satisfies InfraManifest;
+
+test.skipIf(process.env.ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E !== '1')(
+  'runs Supabase and Cerbos through the provider-neutral Docker Compose lifecycle',
+  async () => {
+    const dependencies = createDependencies();
+    let ledger: InfraLedger | undefined;
+
+    try {
+      const initialPlan = requireSuccess(
+        await planInfraEnvironmentAsync({ projectId, manifest }, dependencies),
+      );
+      expect(initialPlan.actions.some(({ operation }) => operation === 'create')).toBe(true);
+
+      const { ledger: firstLedger, outputs: firstOutputs } = requireSuccess(
+        await upInfraEnvironmentAsync({ projectId, manifest }, dependencies),
+      );
+      ledger = firstLedger;
+      assertProviderNeutralOutputs(firstOutputs);
+
+      const status = requireSuccess(
+        await statusInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
+      );
+      expect(status.state).toBe('ready');
+      expect(
+        status.resources
+          .filter(({ owner }) => ['docker-compose', 'supabase', 'cerbos'].includes(owner.adapter))
+          .every(({ state }) => state === 'ready'),
+      ).toBe(true);
+
+      const convergedPlan = requireSuccess(
+        await planInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
+      );
+      expect(convergedPlan.actions.every(({ operation }) => operation === 'noop')).toBe(true);
+
+      const { ledger: downLedger } = requireSuccess(
+        await downInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
+      );
+      ledger = downLedger;
+
+      const { ledger: resumedLedger, outputs: resumedOutputs } = requireSuccess(
+        await upInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
+      );
+      ledger = resumedLedger;
+      assertProviderNeutralOutputs(resumedOutputs);
+
+      const health = await fetch(`${baseUrl}/auth/v1/health`);
+      expect(health.ok).toBe(true);
+
+      const destroyed = requireSuccess(
+        await destroyInfraEnvironmentAsync(
+          createDestroyRequest(ledger, persistentIdentities(ledger)),
+          dependencies,
+        ),
+      );
+      ledger = destroyed.ledger ?? undefined;
+      expect(destroyed.ledger).toBeNull();
+    } finally {
+      if (ledger !== undefined) {
+        await destroyInfraEnvironmentAsync(
+          createDestroyRequest(ledger, persistentIdentities(ledger)),
+          dependencies,
+        );
+      }
+    }
+  },
+  900_000,
+);
+
+function createDependencies(): InfraOrchestrationDependencies {
+  return {
+    adapterResolver: createNodeInfraAdapterPackageResolver(),
+    credentials: {
+      resolveAsync: (reference) =>
+        Promise.resolve(
+          reference.name === 'SUPABASE_BOOTSTRAP'
+            ? success(credentials)
+            : failure(
+                'unexpected-control-plane-credential',
+                `Unexpected control-plane credential ${reference.name}.`,
+              ),
+        ),
+    },
+    secrets: {
+      resolveAsync: (reference) =>
+        Promise.resolve(
+          failure(
+            'unexpected-managed-secret',
+            `Unexpected managed secret ${reference.ref}/${reference.key}.`,
+          ),
+        ),
+    },
+  };
+}
+
+function createDestroyRequest(
+  previous: InfraLedger,
+  confirmedResources: readonly InfraResourceIdentity[],
+) {
+  return {
+    projectId,
+    manifest,
+    environment: 'local' as const,
+    previous,
+    confirmation: { projectId, environment: 'local' as const },
+    persistence: { policy: 'delete' as const, confirmedResources },
+  };
+}
+
+function persistentIdentities(ledger: InfraLedger): readonly InfraResourceIdentity[] {
+  return ledger.resources.filter(({ persistent }) => persistent).map(({ identity }) => identity);
+}
+
+function assertProviderNeutralOutputs(outputs: InfraLedger['outputs']): void {
+  const serialized = JSON.stringify(outputs);
+  expect(serialized).not.toContain(credentials.serviceRoleKey);
+  expect(serialized).not.toContain(credentials.postgresPassword);
+  expect(serialized).not.toContain(credentials.jwtSecret);
+  expect(serialized).not.toContain(credentials.realtimeSecretKeyBase);
+  expect(serialized).not.toContain(credentials.realtimeDatabaseEncryptionKey);
+  expect(serialized).not.toContain(credentials.pgMetaCryptoKey);
+  expect(serialized.toLowerCase()).not.toContain('kubernetes');
+  expect(serialized.toLowerCase()).not.toContain('minikube');
+  expect(
+    outputs.some(
+      ({ owner, environmentVariable, value }) =>
+        owner.adapter === 'supabase' &&
+        environmentVariable === 'EXPO_PUBLIC_SUPABASE_URL' &&
+        value === baseUrl,
+    ),
+  ).toBe(true);
+  expect(
+    outputs.some(
+      ({ owner, environmentVariable, value }) =>
+        owner.adapter === 'supabase' &&
+        environmentVariable === 'EXPO_PUBLIC_SUPABASE_ANON_KEY' &&
+        value === credentials.anonKey,
+    ),
+  ).toBe(true);
+  expect(
+    outputs.some(
+      ({ owner, name, value }) =>
+        owner.adapter === 'supabase' && name === 'bucket' && value === bucket,
+    ),
+  ).toBe(true);
+  expect(
+    outputs.some(
+      ({ owner, environmentVariable, value }) =>
+        owner.adapter === 'cerbos' &&
+        environmentVariable === 'CERBOS_URL' &&
+        value === 'http://cerbos:3592',
+    ),
+  ).toBe(true);
+}
+
+function createJwt(role: 'anon' | 'service_role'): string {
+  const encodedHeader = encodeJwtPart({ alg: 'HS256', typ: 'JWT' });
+  const encodedPayload = encodeJwtPart({
+    role,
+    iss: 'supabase',
+    iat: 1_700_000_000,
+    exp: 4_102_444_800,
+  });
+  const unsigned = `${encodedHeader}.${encodedPayload}`;
+  const signature = createHmac('sha256', jwtSecret).update(unsigned).digest('base64url');
+  return `${unsigned}.${signature}`;
+}
+
+function encodeJwtPart(value: Readonly<Record<string, string | number>>): string {
+  return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+
+function requireSuccess<T>(result: InfraResult<T>): T {
+  if (!result.ok) throw new Error(result.diagnostics.map(({ message }) => message).join(' '));
+  return result.value;
+}
+
+function success<T>(value: T): InfraResult<T> {
+  return { ok: true, value, diagnostics: [] };
+}
+
+function failure(code: string, message: string): InfraResult<never> {
+  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };
+}