@ankhorage/infra 5.1.4 → 5.1.6

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ankhorage/infra
 
+## 5.1.6
+
+### Patch Changes
+
+- 57da4cf: Prove the released Hetzner, k3s, Supabase and R2 composition with independent object-storage ownership and privileged output isolation.
+
+## 5.1.5
+
+### Patch Changes
+
+- 7da18cd: Make project Infra destroy idempotent when no stored ownership state exists, avoiding provider resolution for never-provisioned or already-destroyed environments.
+
 ## 5.1.4
 
 ### Patch Changes

package/README.md

@@ -3,7 +3,7 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v5.1.2](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v5.1.4](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 

package/dist/features/environment-lifecycle/composition/createProjectInfraLifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createProjectInfraLifecycle.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/composition/createProjectInfraLifecycle.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,kCAAkC,EAClC,qBAAqB,EAEtB,MAAM,gCAAgC,CAAC;AAGxC,0GAA0G;AAC1G,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,kCAAuC,GAC/C,qBAAqB,CAiFvB"}
+{"version":3,"file":"createProjectInfraLifecycle.d.ts","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/composition/createProjectInfraLifecycle.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,kCAAkC,EAClC,qBAAqB,EAEtB,MAAM,gCAAgC,CAAC;AAGxC,0GAA0G;AAC1G,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,kCAAuC,GAC/C,qBAAqB,CAyFvB"}

package/dist/features/environment-lifecycle/composition/createProjectInfraLifecycle.js

@@ -58,7 +58,15 @@ export function createProjectInfraLifecycle(options = {}) {
             return result;
         },
         async destroyAsync(request) {
-            const prepared = await prepareProjectOperationAsync(request, services, true);
+            const state = await services.readState(request.projectPath, request.environment);
+            if (state === null) {
+                return {
+                    ok: true,
+                    value: { environment: request.environment, ledger: null },
+                    diagnostics: [],
+                };
+            }
+            const prepared = await prepareProjectOperationAsync(request, services, true, state);
             const result = await services.operations.destroy({
                 ...prepared.operation,
                 confirmation: request.confirmation,
@@ -81,8 +89,8 @@ export function createProjectInfraLifecycle(options = {}) {
     };
 }
 /*** Resolve one explicit project/environment request with its prior ownership state and dependencies. */
-async function prepareProjectOperationAsync(request, services, useStoredDesired = false) {
-    const state = await services.readState(request.projectPath, request.environment);
+async function prepareProjectOperationAsync(request, services, useStoredDesired = false, knownState) {
+    const state = knownState ?? (await services.readState(request.projectPath, request.environment));
     const currentDesired = readEnvironment(request.manifest, request.environment);
     const desired = useStoredDesired && state !== null ? state.desired : currentDesired;
     if (desired === undefined) {

package/dist/features/environment-lifecycle/composition/createProjectInfraLifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"createProjectInfraLifecycle.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/composition/createProjectInfraLifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAO9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,0GAA0G;AAC1G,MAAM,UAAU,2BAA2B,CACzC,UAA8C,EAAE;IAEhD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QACjF,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,cAAc,CAC3B,OAAO,CAAC,WAAW,EACnB,MAAM,CAAC,KAAK,CAAC,SAAS,EACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CACvB,CAAC;YACF,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC7C,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC7C,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO;YACvB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO;YACxB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC7C,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO;YACxB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAC9C;gBACE,GAAG,QAAQ,CAAC,SAAS;gBACrB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,EACD,QAAQ,CAAC,YAAY,CACtB,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/E,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI;gBAC9B,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;iBAClE,CAAC;gBACJ,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;oBAC7C,aAAa,EAAE,CAAC;oBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,yGAAyG;AACzG,KAAK,UAAU,4BAA4B,CACzC,OAAqC,EACrC,QAAuD,EACvD,gBAAgB,GAAG,KAAK;IAExB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,gBAAgB,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;IACpF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,WAAW,sBAAsB,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,OAAO,CAAC,WAAW;QACxB,GAAG,EAAE,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG;QAChD,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS;QAC5B,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS;KAC7B,CAAC;IACF,OAAO;QACL,KAAK;QACL,OAAO;QACP,SAAS,EAAE;YACT,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC;YAC5E,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SACpE;QACD,YAAY,EAAE,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,eAAe,CACtB,QAAuB,EACvB,WAAwD;IAExD,IAAI,WAAW,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC;IAChE,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC;IACpE,OAAO,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC;AAC1C,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CACzB,QAAuB,EACvB,WAAwD,EACxD,OAA6B;IAE7B,OAAO,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;AAC7F,CAAC","sourcesContent":["import type { InfraEnvironmentSpec, InfraManifest } from '@ankhorage/contracts/infra';\n\nimport { INFRA_PACKAGE_VERSION } from '../../../constants.js';\nimport type { InfraOperationRequest, InfraStoredState } from '../../../types/infraOrchestration.js';\nimport type {\n  CreateProjectInfraLifecycleOptions,\n  ProjectInfraLifecycle,\n  ProjectInfraOperationRequest,\n} from '../../../types/infraProject.js';\nimport { createInfraCommandServices } from './createInfraCommandServices.js';\n\n/*** Create the typed project-facing Infra lifecycle backed by canonical use cases and ownership state. */\nexport function createProjectInfraLifecycle(\n  options: CreateProjectInfraLifecycleOptions = {},\n): ProjectInfraLifecycle {\n  const services = createInfraCommandServices(options.services);\n  return {\n    async validateAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.validate(prepared.operation, prepared.dependencies);\n    },\n    async planAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.plan(prepared.operation, prepared.dependencies);\n    },\n    async generateAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      const result = await services.operations.generate(prepared.operation, prepared.dependencies);\n      if (!result.ok) return result;\n      await services.writeArtifacts(\n        request.projectPath,\n        result.value.artifacts,\n        prepared.state?.ledger,\n      );\n      await services.writeState(request.projectPath, {\n        schemaVersion: 1,\n        desired: prepared.desired,\n        ledger: result.value.ledger,\n      });\n      return result;\n    },\n    async upAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      const result = await services.operations.up(prepared.operation, prepared.dependencies);\n      if (!result.ok) return result;\n      await services.writeState(request.projectPath, {\n        schemaVersion: 1,\n        desired: prepared.desired,\n        ledger: result.value.ledger,\n      });\n      return result;\n    },\n    async statusAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.status(prepared.operation, prepared.dependencies);\n    },\n    async outputsAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.outputs(prepared.operation);\n    },\n    async downAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      const result = await services.operations.down(prepared.operation, prepared.dependencies);\n      if (!result.ok) return result;\n      await services.writeState(request.projectPath, {\n        schemaVersion: 1,\n        desired: prepared.desired,\n        ledger: result.value.ledger,\n      });\n      return result;\n    },\n    async destroyAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services, true);\n      const result = await services.operations.destroy(\n        {\n          ...prepared.operation,\n          confirmation: request.confirmation,\n          persistence: request.persistence,\n        },\n        prepared.dependencies,\n      );\n      if (!result.ok) return result;\n      await services.writeArtifacts(request.projectPath, [], prepared.state?.ledger);\n      if (result.value.ledger === null)\n        await services.removeState(request.projectPath, request.environment);\n      else {\n        await services.writeState(request.projectPath, {\n          schemaVersion: 1,\n          desired: prepared.desired,\n          ledger: result.value.ledger,\n        });\n      }\n      return result;\n    },\n  };\n}\n\ninterface PreparedProjectOperation {\n  readonly operation: InfraOperationRequest;\n  readonly desired: InfraEnvironmentSpec;\n  readonly state: InfraStoredState | null;\n  readonly dependencies: ReturnType<\n    ReturnType<typeof createInfraCommandServices>['createDependencies']\n  >;\n}\n\n/*** Resolve one explicit project/environment request with its prior ownership state and dependencies. */\nasync function prepareProjectOperationAsync(\n  request: ProjectInfraOperationRequest,\n  services: ReturnType<typeof createInfraCommandServices>,\n  useStoredDesired = false,\n): Promise<PreparedProjectOperation> {\n  const state = await services.readState(request.projectPath, request.environment);\n  const currentDesired = readEnvironment(request.manifest, request.environment);\n  const desired = useStoredDesired && state !== null ? state.desired : currentDesired;\n  if (desired === undefined) {\n    throw new Error(`Infra environment \"${request.environment}\" is not configured.`);\n  }\n  const context = {\n    cwd: request.projectPath,\n    env: request.executionEnvironment ?? process.env,\n    version: INFRA_PACKAGE_VERSION,\n    writeStdout: () => undefined,\n    writeStderr: () => undefined,\n  };\n  return {\n    state,\n    desired,\n    operation: {\n      projectId: request.projectId,\n      manifest: replaceEnvironment(request.manifest, request.environment, desired),\n      environment: request.environment,\n      ...(state === null ? {} : { previous: state.ledger, previousDesired: state.desired }),\n      ...(request.signal === undefined ? {} : { signal: request.signal }),\n    },\n    dependencies: services.createDependencies(context),\n  };\n}\n\n/*** Read one exact environment without inventing a fallback. */\nfunction readEnvironment(\n  manifest: InfraManifest,\n  environment: ProjectInfraOperationRequest['environment'],\n): InfraEnvironmentSpec | undefined {\n  if (environment === 'local') return manifest.environments.local;\n  if (environment === 'preview') return manifest.environments.preview;\n  return manifest.environments.production;\n}\n\n/*** Replace one selected environment while preserving all other manifest state. */\nfunction replaceEnvironment(\n  manifest: InfraManifest,\n  environment: ProjectInfraOperationRequest['environment'],\n  desired: InfraEnvironmentSpec,\n): InfraManifest {\n  return { ...manifest, environments: { ...manifest.environments, [environment]: desired } };\n}\n"]}
+{"version":3,"file":"createProjectInfraLifecycle.js","sourceRoot":"","sources":["../../../../src/features/environment-lifecycle/composition/createProjectInfraLifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAO9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,0GAA0G;AAC1G,MAAM,UAAU,2BAA2B,CACzC,UAA8C,EAAE;IAEhD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QACjF,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,cAAc,CAC3B,OAAO,CAAC,WAAW,EACnB,MAAM,CAAC,KAAK,CAAC,SAAS,EACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CACvB,CAAC;YACF,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC7C,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC7C,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO;YACvB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO;YACxB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC7C,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO;YACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACjF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;oBACzD,WAAW,EAAE,EAAE;iBAChB,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAC9C;gBACE,GAAG,QAAQ,CAAC,SAAS;gBACrB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,EACD,QAAQ,CAAC,YAAY,CACtB,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,MAAM,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/E,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI;gBAC9B,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;iBAClE,CAAC;gBACJ,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;oBAC7C,aAAa,EAAE,CAAC;oBAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,yGAAyG;AACzG,KAAK,UAAU,4BAA4B,CACzC,OAAqC,EACrC,QAAuD,EACvD,gBAAgB,GAAG,KAAK,EACxB,UAA6B;IAE7B,MAAM,KAAK,GAAG,UAAU,IAAI,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACjG,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,gBAAgB,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;IACpF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,WAAW,sBAAsB,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,OAAO,CAAC,WAAW;QACxB,GAAG,EAAE,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG;QAChD,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS;QAC5B,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS;KAC7B,CAAC;IACF,OAAO;QACL,KAAK;QACL,OAAO;QACP,SAAS,EAAE;YACT,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC;YAC5E,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SACpE;QACD,YAAY,EAAE,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,eAAe,CACtB,QAAuB,EACvB,WAAwD;IAExD,IAAI,WAAW,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC;IAChE,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC;IACpE,OAAO,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC;AAC1C,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CACzB,QAAuB,EACvB,WAAwD,EACxD,OAA6B;IAE7B,OAAO,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;AAC7F,CAAC","sourcesContent":["import type { InfraEnvironmentSpec, InfraManifest } from '@ankhorage/contracts/infra';\n\nimport { INFRA_PACKAGE_VERSION } from '../../../constants.js';\nimport type { InfraOperationRequest, InfraStoredState } from '../../../types/infraOrchestration.js';\nimport type {\n  CreateProjectInfraLifecycleOptions,\n  ProjectInfraLifecycle,\n  ProjectInfraOperationRequest,\n} from '../../../types/infraProject.js';\nimport { createInfraCommandServices } from './createInfraCommandServices.js';\n\n/*** Create the typed project-facing Infra lifecycle backed by canonical use cases and ownership state. */\nexport function createProjectInfraLifecycle(\n  options: CreateProjectInfraLifecycleOptions = {},\n): ProjectInfraLifecycle {\n  const services = createInfraCommandServices(options.services);\n  return {\n    async validateAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.validate(prepared.operation, prepared.dependencies);\n    },\n    async planAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.plan(prepared.operation, prepared.dependencies);\n    },\n    async generateAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      const result = await services.operations.generate(prepared.operation, prepared.dependencies);\n      if (!result.ok) return result;\n      await services.writeArtifacts(\n        request.projectPath,\n        result.value.artifacts,\n        prepared.state?.ledger,\n      );\n      await services.writeState(request.projectPath, {\n        schemaVersion: 1,\n        desired: prepared.desired,\n        ledger: result.value.ledger,\n      });\n      return result;\n    },\n    async upAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      const result = await services.operations.up(prepared.operation, prepared.dependencies);\n      if (!result.ok) return result;\n      await services.writeState(request.projectPath, {\n        schemaVersion: 1,\n        desired: prepared.desired,\n        ledger: result.value.ledger,\n      });\n      return result;\n    },\n    async statusAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.status(prepared.operation, prepared.dependencies);\n    },\n    async outputsAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      return services.operations.outputs(prepared.operation);\n    },\n    async downAsync(request) {\n      const prepared = await prepareProjectOperationAsync(request, services);\n      const result = await services.operations.down(prepared.operation, prepared.dependencies);\n      if (!result.ok) return result;\n      await services.writeState(request.projectPath, {\n        schemaVersion: 1,\n        desired: prepared.desired,\n        ledger: result.value.ledger,\n      });\n      return result;\n    },\n    async destroyAsync(request) {\n      const state = await services.readState(request.projectPath, request.environment);\n      if (state === null) {\n        return {\n          ok: true,\n          value: { environment: request.environment, ledger: null },\n          diagnostics: [],\n        };\n      }\n      const prepared = await prepareProjectOperationAsync(request, services, true, state);\n      const result = await services.operations.destroy(\n        {\n          ...prepared.operation,\n          confirmation: request.confirmation,\n          persistence: request.persistence,\n        },\n        prepared.dependencies,\n      );\n      if (!result.ok) return result;\n      await services.writeArtifacts(request.projectPath, [], prepared.state?.ledger);\n      if (result.value.ledger === null)\n        await services.removeState(request.projectPath, request.environment);\n      else {\n        await services.writeState(request.projectPath, {\n          schemaVersion: 1,\n          desired: prepared.desired,\n          ledger: result.value.ledger,\n        });\n      }\n      return result;\n    },\n  };\n}\n\ninterface PreparedProjectOperation {\n  readonly operation: InfraOperationRequest;\n  readonly desired: InfraEnvironmentSpec;\n  readonly state: InfraStoredState | null;\n  readonly dependencies: ReturnType<\n    ReturnType<typeof createInfraCommandServices>['createDependencies']\n  >;\n}\n\n/*** Resolve one explicit project/environment request with its prior ownership state and dependencies. */\nasync function prepareProjectOperationAsync(\n  request: ProjectInfraOperationRequest,\n  services: ReturnType<typeof createInfraCommandServices>,\n  useStoredDesired = false,\n  knownState?: InfraStoredState,\n): Promise<PreparedProjectOperation> {\n  const state = knownState ?? (await services.readState(request.projectPath, request.environment));\n  const currentDesired = readEnvironment(request.manifest, request.environment);\n  const desired = useStoredDesired && state !== null ? state.desired : currentDesired;\n  if (desired === undefined) {\n    throw new Error(`Infra environment \"${request.environment}\" is not configured.`);\n  }\n  const context = {\n    cwd: request.projectPath,\n    env: request.executionEnvironment ?? process.env,\n    version: INFRA_PACKAGE_VERSION,\n    writeStdout: () => undefined,\n    writeStderr: () => undefined,\n  };\n  return {\n    state,\n    desired,\n    operation: {\n      projectId: request.projectId,\n      manifest: replaceEnvironment(request.manifest, request.environment, desired),\n      environment: request.environment,\n      ...(state === null ? {} : { previous: state.ledger, previousDesired: state.desired }),\n      ...(request.signal === undefined ? {} : { signal: request.signal }),\n    },\n    dependencies: services.createDependencies(context),\n  };\n}\n\n/*** Read one exact environment without inventing a fallback. */\nfunction readEnvironment(\n  manifest: InfraManifest,\n  environment: ProjectInfraOperationRequest['environment'],\n): InfraEnvironmentSpec | undefined {\n  if (environment === 'local') return manifest.environments.local;\n  if (environment === 'preview') return manifest.environments.preview;\n  return manifest.environments.production;\n}\n\n/*** Replace one selected environment while preserving all other manifest state. */\nfunction replaceEnvironment(\n  manifest: InfraManifest,\n  environment: ProjectInfraOperationRequest['environment'],\n  desired: InfraEnvironmentSpec,\n): InfraManifest {\n  return { ...manifest, environments: { ...manifest.environments, [environment]: desired } };\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "5.1.4",
+  "version": "5.1.6",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -35,7 +35,7 @@
     "openapi"
   ],
   "dependencies": {
-    "@ankhorage/contracts": "^19.3.0"
+    "@ankhorage/contracts": "^19.4.0"
   },
   "files": [
     "dist",
@@ -114,12 +114,12 @@
     "@ankhorage/devtools": "^1.14.0",
     "@ankhorage/docker-compose": "^0.5.3",
     "@ankhorage/hetzner": "^0.3.0",
-    "@ankhorage/k3s": "^0.4.0",
+    "@ankhorage/k3s": "^0.4.1",
     "@ankhorage/local": "^0.3.0",
-    "@ankhorage/minikube": "^0.4.1",
+    "@ankhorage/minikube": "^0.4.2",
     "@ankhorage/paradox": "^0.1.24",
     "@ankhorage/r2": "^0.2.0",
-    "@ankhorage/supabase": "^0.4.7",
+    "@ankhorage/supabase": "^0.5.5",
     "@ankhorage/supabase-vault": "^0.3.1",
     "@types/bun": "^1.4.1",
     "@types/node": "^25.6.0",

package/src/features/environment-lifecycle/composition/createProjectInfraLifecycle.ts

@@ -70,7 +70,15 @@ export function createProjectInfraLifecycle(
       return result;
     },
     async destroyAsync(request) {
-      const prepared = await prepareProjectOperationAsync(request, services, true);
+      const state = await services.readState(request.projectPath, request.environment);
+      if (state === null) {
+        return {
+          ok: true,
+          value: { environment: request.environment, ledger: null },
+          diagnostics: [],
+        };
+      }
+      const prepared = await prepareProjectOperationAsync(request, services, true, state);
       const result = await services.operations.destroy(
         {
           ...prepared.operation,
@@ -109,8 +117,9 @@ async function prepareProjectOperationAsync(
   request: ProjectInfraOperationRequest,
   services: ReturnType<typeof createInfraCommandServices>,
   useStoredDesired = false,
+  knownState?: InfraStoredState,
 ): Promise<PreparedProjectOperation> {
-  const state = await services.readState(request.projectPath, request.environment);
+  const state = knownState ?? (await services.readState(request.projectPath, request.environment));
   const currentDesired = readEnvironment(request.manifest, request.environment);
   const desired = useStoredDesired && state !== null ? state.desired : currentDesired;
   if (desired === undefined) {

package/src/hetznerK3sProduction.test.ts

@@ -108,6 +108,8 @@ test('composes Hetzner, k3s, Kubernetes and Supabase while retaining compute for
   expect(JSON.stringify(firstUp)).not.toContain('phase10-service-role-key');
   expect(fixture.kubernetes.serializedResources()).toContain(`"host":"${domain}"`);
   expect(fixture.kubernetes.serializedResources()).toContain('PersistentVolumeClaim');
+  expect(fixture.kubernetes.serializedResources()).toContain('/etc/postgresql-custom');
+  expect(fixture.kubernetes.serializedResources()).toContain('.ankhorage-image-seeded');
   expect(firstUp.resources.some(({ persistent }) => persistent)).toBe(true);
   const urlOutput = firstUp.outputs.find(({ name }) => name === 'url');
   expect(urlOutput?.value).toBe(publicBaseUrl);

package/src/hetznerK3sSupabaseR2.test.ts

@@ -0,0 +1,482 @@
+import type { InfraManifest, InfraResult } from '@ankhorage/contracts/infra';
+import {
+  createInfraAdapter as createHetznerInfraAdapter,
+  type HetznerCloudApi,
+  type HetznerCloudObservation,
+  type HetznerDesiredCompute,
+  type HetznerHostKeyProbe,
+  type HetznerProjectIdentity,
+  type HetznerResourceId,
+  infraAdapterDescriptor as hetznerInfraAdapterDescriptor,
+} from '@ankhorage/hetzner';
+import {
+  createInfraAdapter as createK3sInfraAdapter,
+  infraAdapterDescriptor as k3sInfraAdapterDescriptor,
+  type K3sClusterObservation,
+  type K3sClusterSpec,
+  type K3sControlPlane,
+  type K3sNodeAccess,
+} from '@ankhorage/k3s';
+import {
+  createInfraAdapter as createR2InfraAdapter,
+  infraAdapterDescriptor as r2InfraAdapterDescriptor,
+  type R2BucketControlPlane,
+  type R2BucketObservation,
+  type R2CloudRequest,
+} from '@ankhorage/r2';
+import {
+  createInfraAdapter as createSupabaseInfraAdapter,
+  infraAdapterDescriptor as supabaseInfraAdapterDescriptor,
+  type SupabaseControlPlane,
+  type SupabaseControlPlaneRequest,
+} from '@ankhorage/supabase';
+import { expect, test } from 'bun:test';
+
+import { planInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/planInfraEnvironmentAsync.js';
+import { statusInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/statusInfraEnvironmentAsync.js';
+import { upInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.js';
+import type { InfraOrchestrationDependencies } from './types/infraOrchestration.js';
+
+const projectId = 'infra163-production-r2';
+const publicBaseUrl = 'https://api.r2-production.example.test';
+const domain = 'api.r2-production.example.test';
+const r2AccountId = 'phase10-r2-account';
+const r2Bucket = 'media';
+
+const manifest = {
+  environments: {
+    production: {
+      deployment: {
+        compute: { provider: 'hetzner', location: 'fsn1', serverType: 'cx23' },
+        runtime: { provider: 'k3s', topology: { servers: 1, agents: 0 } },
+      },
+      database: { provider: 'supabase', tier: 'prod' },
+      auth: { provider: 'supabase' },
+      objectStorage: { provider: 'r2', accountId: r2AccountId, buckets: [r2Bucket] },
+      networking: {
+        domain,
+        publicBaseUrl,
+        tls: { mode: 'acme-http-01', contactEmail: 'infra@example.test' },
+      },
+    },
+  },
+  modules: [],
+} as const satisfies InfraManifest;
+
+test('composes Hetzner, k3s, Supabase database/auth and independent R2 object storage', async () => {
+  const fixture = new ProductionR2Fixture();
+  const dependencies = createDependencies(fixture);
+
+  const initialPlan = requireSuccess(
+    await planInfraEnvironmentAsync(
+      { projectId, manifest, environment: 'production' },
+      dependencies,
+    ),
+  );
+  const initialOwners = new Set(initialPlan.actions.map(({ owner }) => owner.adapter));
+  expect(initialOwners.has('supabase')).toBe(true);
+  expect(initialOwners.has('r2')).toBe(true);
+  expect(initialPlan.actions.some(({ operation }) => operation === 'create')).toBe(true);
+
+  const firstUp = requireSuccess(
+    await upInfraEnvironmentAsync({ projectId, manifest, environment: 'production' }, dependencies),
+  );
+  const serializedWorkloads = fixture.kubernetes.serializedResources();
+  expect(serializedWorkloads).toContain('supabase-db');
+  expect(serializedWorkloads).toContain('supabase-auth');
+  expect(serializedWorkloads).toContain('supabase-gateway');
+  expect(serializedWorkloads).not.toContain('supabase-storage');
+  expect(serializedWorkloads).not.toContain('supabase-imgproxy');
+  expect(serializedWorkloads).not.toContain('/storage/v1/');
+  expect(fixture.supabase.created).toEqual([]);
+  expect(fixture.r2.created).toEqual([r2Bucket]);
+
+  expect(
+    firstUp.resources.some(
+      ({ identity }) => identity.adapter === 'r2' && identity.resourceId === `bucket/${r2Bucket}`,
+    ),
+  ).toBe(true);
+  expect(
+    firstUp.resources.some(
+      ({ identity }) =>
+        identity.adapter === 'supabase' && identity.resourceId.startsWith('bucket/'),
+    ),
+  ).toBe(false);
+
+  const r2Outputs = firstUp.outputs.filter(({ owner }) => owner.adapter === 'r2');
+  expect(r2Outputs.map(({ name }) => name)).toEqual(['bucket', 'accountId', 's3Endpoint']);
+  expect(r2Outputs.every(({ visibility }) => visibility === 'public')).toBe(true);
+  expect(r2Outputs.map(({ value }) => value)).toEqual([
+    r2Bucket,
+    r2AccountId,
+    `https://${r2AccountId}.r2.cloudflarestorage.com`,
+  ]);
+
+  const serializedOutputs = JSON.stringify(firstUp.outputs);
+  expect(serializedOutputs).not.toContain('phase10-r2-api-token');
+  expect(serializedOutputs).not.toContain('phase10-private-key');
+  expect(serializedOutputs).not.toContain('phase10-postgres-password');
+  expect(serializedOutputs).not.toContain('phase10-jwt-secret');
+  expect(serializedOutputs).not.toContain('phase10-service-role-key');
+
+  const status = requireSuccess(
+    await statusInfraEnvironmentAsync(
+      { projectId, manifest, environment: 'production', previous: firstUp.ledger },
+      dependencies,
+    ),
+  );
+  expect(status.state).toBe('ready');
+
+  const converged = requireSuccess(
+    await planInfraEnvironmentAsync(
+      { projectId, manifest, environment: 'production', previous: firstUp.ledger },
+      dependencies,
+    ),
+  );
+  expect(converged.actions.every(({ operation }) => operation === 'noop')).toBe(true);
+
+  const secondUp = requireSuccess(
+    await upInfraEnvironmentAsync(
+      { projectId, manifest, environment: 'production', previous: firstUp.ledger },
+      dependencies,
+    ),
+  );
+  expect(fixture.r2.created).toEqual([r2Bucket]);
+  expect(secondUp.outputs.filter(({ owner }) => owner.adapter === 'r2')).toEqual(r2Outputs);
+});
+
+class ProductionR2Fixture {
+  readonly hetzner = new FakeHetznerCloudApi();
+  readonly hostKeyProbe = new FakeHostKeyProbe();
+  readonly k3s = new FakeK3sControlPlane();
+  readonly kubernetes = this.k3s.api;
+  readonly supabase = new FakeSupabaseControlPlane();
+  readonly r2 = new FakeR2ControlPlane();
+}
+
+function createDependencies(fixture: ProductionR2Fixture): InfraOrchestrationDependencies {
+  return {
+    adapterResolver: {
+      loadAsync: (packageName) => {
+        switch (packageName) {
+          case hetznerInfraAdapterDescriptor.package:
+            return Promise.resolve({
+              infraAdapterDescriptor: hetznerInfraAdapterDescriptor,
+              createInfraAdapter: () =>
+                createHetznerInfraAdapter({
+                  api: fixture.hetzner,
+                  hostKeyProbe: fixture.hostKeyProbe,
+                }),
+            });
+          case k3sInfraAdapterDescriptor.package:
+            return Promise.resolve({
+              infraAdapterDescriptor: k3sInfraAdapterDescriptor,
+              createInfraAdapter: () => createK3sInfraAdapter({ controlPlane: fixture.k3s }),
+            });
+          case supabaseInfraAdapterDescriptor.package:
+            return Promise.resolve({
+              infraAdapterDescriptor: supabaseInfraAdapterDescriptor,
+              createInfraAdapter: () =>
+                createSupabaseInfraAdapter({ controlPlane: fixture.supabase }),
+            });
+          case r2InfraAdapterDescriptor.package:
+            return Promise.resolve({
+              infraAdapterDescriptor: r2InfraAdapterDescriptor,
+              createInfraAdapter: () => createR2InfraAdapter({ cloud: fixture.r2 }),
+            });
+          default:
+            return Promise.reject(new Error(`Unexpected adapter package: ${packageName}`));
+        }
+      },
+    },
+    credentials: {
+      resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
+    },
+    secrets: {
+      resolveAsync: () =>
+        Promise.resolve({
+          ok: false,
+          diagnostics: [
+            { severity: 'error', code: 'unexpected-secret', message: 'No secret is expected.' },
+          ],
+        }),
+    },
+  };
+}
+
+function resolveCredential(name: string): InfraResult<Readonly<Record<string, string>>> {
+  if (name === 'HCLOUD_TOKEN') return success({ token: 'phase10-hcloud-token' });
+  if (name === 'HETZNER_SSH') {
+    return success({
+      publicKey: 'ssh-ed25519 AAAA phase10',
+      privateKey: 'phase10-private-key',
+    });
+  }
+  if (name === 'SUPABASE_BOOTSTRAP') {
+    return success({
+      postgresPassword: 'phase10-postgres-password',
+      jwtSecret: 'phase10-jwt-secret-0123456789abcdef',
+      anonKey: 'phase10-anon-key',
+      serviceRoleKey: 'phase10-service-role-key',
+      realtimeSecretKeyBase:
+        'phase10-realtime-secret-key-base-0123456789abcdefghijklmnopqrstuvwxyz',
+      realtimeDatabaseEncryptionKey: '1234567890abcdef',
+      pgMetaCryptoKey: 'phase10-pg-meta-crypto-key-0123456789abcdef',
+    });
+  }
+  if (name === 'CLOUDFLARE_R2') return success({ apiToken: 'phase10-r2-api-token' });
+  return {
+    ok: false,
+    diagnostics: [
+      {
+        severity: 'error',
+        code: 'unexpected-credential',
+        message: `Unexpected credential reference: ${name}`,
+      },
+    ],
+  };
+}
+
+class FakeHetznerCloudApi implements HetznerCloudApi {
+  observation: HetznerCloudObservation = { resources: [] };
+
+  validateAsync(): Promise<InfraResult<null>> {
+    return Promise.resolve(success(null));
+  }
+
+  inspectAsync(): Promise<InfraResult<HetznerCloudObservation>> {
+    return Promise.resolve(success(this.observation));
+  }
+
+  reconcileAsync(
+    _token: string,
+    desired: HetznerDesiredCompute,
+  ): Promise<InfraResult<HetznerCloudObservation>> {
+    this.observation = {
+      resources: [desired.network, desired.firewall, desired.sshKey, desired.server].map(
+        (resource, index) => ({
+          resourceId: resource.owner.identity.resourceId as HetznerResourceId,
+          externalId: String(index + 1),
+          configurationHash: resource.configurationHash,
+          state: 'ready' as const,
+          ...(resource.owner.identity.resourceId === 'server'
+            ? { publicIpv4: '203.0.113.10', architecture: 'amd64' as const }
+            : {}),
+        }),
+      ),
+    };
+    return Promise.resolve(success(this.observation));
+  }
+
+  destroyAsync(
+    _token: string,
+    _identity: HetznerProjectIdentity,
+    resourceIds: readonly HetznerResourceId[],
+  ): Promise<InfraResult<HetznerCloudObservation>> {
+    this.observation = {
+      resources: this.observation.resources.filter(
+        ({ resourceId }) => !resourceIds.includes(resourceId),
+      ),
+    };
+    return Promise.resolve(success(this.observation));
+  }
+}
+
+class FakeHostKeyProbe implements HetznerHostKeyProbe {
+  fingerprintAsync(): Promise<InfraResult<string>> {
+    return Promise.resolve(success('SHA256:phase10-host'));
+  }
+}
+
+type KubernetesApi = NonNullable<K3sClusterObservation['api']>;
+type KubernetesOwnershipQuery = Parameters<KubernetesApi['listOwnedAsync']>[0];
+type KubernetesResource = Awaited<ReturnType<KubernetesApi['listOwnedAsync']>>[number];
+type KubernetesResourceReference = Parameters<KubernetesApi['deleteAsync']>[0];
+type KubernetesResourceObservation = Awaited<ReturnType<KubernetesApi['observeAsync']>>;
+
+class FakeK3sControlPlane implements K3sControlPlane {
+  readonly api = new FakeKubernetesApi();
+  lastAccess: readonly K3sNodeAccess[] = [];
+  lastSpec?: K3sClusterSpec;
+  state: K3sClusterObservation['state'] = 'absent';
+  nodes: K3sClusterObservation['nodes'] = [];
+
+  validateAsync(
+    _spec: K3sClusterSpec,
+    access: readonly K3sNodeAccess[],
+  ): Promise<InfraResult<null>> {
+    this.lastAccess = access;
+    return Promise.resolve(success(null));
+  }
+
+  inspectAsync(): Promise<InfraResult<K3sClusterObservation>> {
+    return Promise.resolve(success(this.observation()));
+  }
+
+  ensureAsync(
+    spec: K3sClusterSpec,
+    access: readonly K3sNodeAccess[],
+  ): Promise<InfraResult<K3sClusterObservation>> {
+    this.lastAccess = access;
+    this.lastSpec = spec;
+    this.state = 'ready';
+    this.nodes = spec.nodes.map(({ id }) => ({
+      id,
+      state: 'ready',
+      configurationMatches: true,
+    }));
+    return Promise.resolve(success(this.observation()));
+  }
+
+  waitUntilReadyAsync(): Promise<InfraResult<K3sClusterObservation>> {
+    return Promise.resolve(success(this.observation()));
+  }
+
+  loadImagesAsync(
+    _spec: K3sClusterSpec,
+    _access: readonly K3sNodeAccess[],
+    _images: readonly string[],
+  ): Promise<InfraResult<null>> {
+    return Promise.resolve(success(null));
+  }
+
+  suspendAsync(): Promise<InfraResult<null>> {
+    this.state = 'stopped';
+    this.nodes = this.nodes.map((node) => ({ ...node, state: 'stopped' }));
+    return Promise.resolve(success(null));
+  }
+
+  destroyAsync(): Promise<InfraResult<null>> {
+    this.state = 'absent';
+    this.nodes = [];
+    return Promise.resolve(success(null));
+  }
+
+  private observation(): K3sClusterObservation {
+    return {
+      state: this.state,
+      configurationMatches: true,
+      nodes: this.nodes,
+      ...(this.state === 'ready' ? { api: this.api } : {}),
+    };
+  }
+}
+
+class FakeKubernetesApi implements KubernetesApi {
+  readonly resources: KubernetesResource[] = [];
+
+  listOwnedAsync(query: KubernetesOwnershipQuery): Promise<readonly KubernetesResource[]> {
+    return Promise.resolve(
+      this.resources.filter(({ metadata }) => includesLabels(metadata.labels, query.labels)),
+    );
+  }
+
+  applyAsync(resource: KubernetesResource): Promise<void> {
+    const index = this.resources.findIndex((candidate) => sameResource(candidate, resource));
+    if (index === -1) this.resources.push(resource);
+    else this.resources.splice(index, 1, resource);
+    return Promise.resolve();
+  }
+
+  deleteAsync(reference: KubernetesResourceReference): Promise<void> {
+    const index = this.resources.findIndex((resource) => sameResource(resource, reference));
+    if (index >= 0) this.resources.splice(index, 1);
+    return Promise.resolve();
+  }
+
+  observeAsync(reference: KubernetesResourceReference): Promise<KubernetesResourceObservation> {
+    return Promise.resolve({
+      state: 'ready',
+      ...(reference.kind === 'Service' ? { publicOutputs: { endpoint: publicBaseUrl } } : {}),
+    });
+  }
+
+  waitUntilReadyAsync(): Promise<KubernetesResourceObservation> {
+    return Promise.resolve({ state: 'ready' });
+  }
+
+  serializedResources(): string {
+    return JSON.stringify(this.resources);
+  }
+}
+
+class FakeSupabaseControlPlane implements SupabaseControlPlane {
+  readonly created: string[] = [];
+
+  healthAsync(_request: SupabaseControlPlaneRequest): Promise<InfraResult<null>> {
+    return Promise.resolve(success(null));
+  }
+
+  listBucketsAsync(_request: SupabaseControlPlaneRequest): Promise<InfraResult<readonly string[]>> {
+    return Promise.resolve(success([]));
+  }
+
+  createBucketAsync(
+    request: SupabaseControlPlaneRequest & { readonly bucket: string },
+  ): Promise<InfraResult<null>> {
+    this.created.push(request.bucket);
+    return Promise.resolve(success(null));
+  }
+
+  deleteBucketAsync(
+    _request: SupabaseControlPlaneRequest & { readonly bucket: string },
+  ): Promise<InfraResult<null>> {
+    return Promise.resolve(success(null));
+  }
+}
+
+class FakeR2ControlPlane implements R2BucketControlPlane {
+  readonly created: string[] = [];
+  private readonly buckets = new Set<string>();
+
+  listBucketsAsync(): Promise<InfraResult<readonly R2BucketObservation[]>> {
+    return Promise.resolve(success([...this.buckets].map((name) => ({ name }))));
+  }
+
+  createBucketAsync(
+    request: R2CloudRequest & { readonly bucket: string },
+  ): Promise<InfraResult<R2BucketObservation>> {
+    this.created.push(request.bucket);
+    this.buckets.add(request.bucket);
+    return Promise.resolve(success({ name: request.bucket }));
+  }
+
+  deleteBucketAsync(
+    request: R2CloudRequest & { readonly bucket: string },
+  ): Promise<InfraResult<null>> {
+    this.buckets.delete(request.bucket);
+    return Promise.resolve(success(null));
+  }
+}
+
+function includesLabels(
+  actual: Readonly<Record<string, string>>,
+  expected: Readonly<Record<string, string>>,
+): boolean {
+  return Object.entries(expected).every(([expectedKey, expectedValue]) =>
+    Object.entries(actual).some(
+      ([actualKey, actualValue]) => actualKey === expectedKey && actualValue === expectedValue,
+    ),
+  );
+}
+
+function sameResource(
+  left: KubernetesResource,
+  right: KubernetesResource | KubernetesResourceReference,
+): boolean {
+  return (
+    left.apiVersion === right.apiVersion &&
+    left.kind === right.kind &&
+    left.metadata.name === ('metadata' in right ? right.metadata.name : right.name) &&
+    left.metadata.namespace === ('metadata' in right ? right.metadata.namespace : right.namespace)
+  );
+}
+
+function requireSuccess<T>(result: InfraResult<T>): T {
+  if (!result.ok) throw new Error(result.diagnostics.map(({ message }) => message).join(' '));
+  return result.value;
+}
+
+function success<T>(value: T): InfraResult<T> {
+  return { ok: true, value, diagnostics: [] };
+}