@ankhorage/infra 5.1.6 → 7.0.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ankhorage/infra
 
+## 7.0.0
+
+### Major Changes
+
+- 1778b96: Add provider-neutral service preparation before workload materialization and extend trusted control-plane credential hosts with optional lookup and explicit persistence so providers can prepare bootstrap state without runtime-specific coupling. Read-only lifecycle operations remain side-effect free.
+
+## 6.0.0
+
+### Major Changes
+
+- 99a0dbd: Align Infra with Contracts 20 and add production S3 backup/recovery acceptance for the Supabase production slice.
+
 ## 5.1.6
 
 ### Patch Changes

package/README.md

@@ -3,7 +3,7 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v5.1.4](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v6.0.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 

package/dist/features/environment-lifecycle/adapters/outbound/createEnvironmentInfraCredentialPort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createEnvironmentInfraCredentialPort.d.ts","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/adapters/outbound/createEnvironmentInfraCredentialPort.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAe,MAAM,4BAA4B,CAAC;AAKrF,sGAAsG;AACtG,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GACxD,qBAAqB,CAAC,aAAa,CAAC,CAiBtC"}
+{"version":3,"file":"createEnvironmentInfraCredentialPort.d.ts","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/adapters/outbound/createEnvironmentInfraCredentialPort.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,qBAAqB,EAEtB,MAAM,4BAA4B,CAAC;AAKpC,sGAAsG;AACtG,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GACxD,qBAAqB,CAAC,aAAa,CAAC,CA4BtC"}

package/dist/features/environment-lifecycle/adapters/outbound/createEnvironmentInfraCredentialPort.js

@@ -3,23 +3,43 @@ import { normalizeInfraEnvironmentKey } from '../../utils/normalizeInfraEnvironm
 /*** Resolve execution-only control-plane credentials from exact-name or prefixed environment data. */
 export function createEnvironmentInfraCredentialPort(environment) {
     return {
+        findAsync(reference) {
+            return Promise.resolve(findCredential(environment, reference));
+        },
         resolveAsync(reference) {
-            const prefixedName = `ANKH_INFRA_CREDENTIAL_${normalizeInfraEnvironmentKey(reference.name)}`;
-            const rawValue = Reflect.get(environment, reference.name) ?? Reflect.get(environment, prefixedName);
-            if (rawValue === undefined || rawValue.length === 0) {
-                return Promise.resolve(createInfraFailure('infra-control-plane-credential-missing', `Control-plane credential ${reference.name} is unavailable. Set ${reference.name} or ${prefixedName}.`));
+            const found = findCredential(environment, reference);
+            if (!found.ok)
+                return Promise.resolve(found);
+            if (found.value !== null) {
+                return Promise.resolve({ ok: true, value: found.value, diagnostics: found.diagnostics });
             }
-            return Promise.resolve(parseCredentialBundle(reference.name, rawValue));
+            const prefixedName = prefixedCredentialName(reference.name);
+            return Promise.resolve(createInfraFailure('infra-control-plane-credential-missing', `Control-plane credential ${reference.name} is unavailable. Set ${reference.name} or ${prefixedName}.`));
+        },
+        persistAsync(reference) {
+            return Promise.resolve(createInfraFailure('infra-control-plane-credential-persistence-unavailable', `Control-plane credential ${reference.name} cannot be persisted by the environment-only credential source.`));
         },
     };
 }
+/*** Find and parse an optional credential bundle from the environment without treating absence as failure. */
+function findCredential(environment, reference) {
+    const prefixedName = prefixedCredentialName(reference.name);
+    const rawValue = Reflect.get(environment, reference.name) ?? Reflect.get(environment, prefixedName);
+    if (rawValue === undefined || rawValue.length === 0) {
+        return { ok: true, value: null, diagnostics: [] };
+    }
+    return parseCredentialBundle(reference.name, rawValue);
+}
+/*** Build the canonical prefixed environment variable name for one credential reference. */
+function prefixedCredentialName(name) {
+    return `ANKH_INFRA_CREDENTIAL_${normalizeInfraEnvironmentKey(name)}`;
+}
 /*** Parse JSON credential bundles; token variables also support their conventional scalar form. */
 function parseCredentialBundle(name, rawValue) {
     try {
         const parsed = JSON.parse(rawValue);
-        if (isRecord(parsed) && Object.values(parsed).every((value) => typeof value === 'string')) {
+        if (isStringRecord(parsed))
             return { ok: true, value: parsed, diagnostics: [] };
-        }
     }
     catch {
         if (name.endsWith('_TOKEN')) {
@@ -28,8 +48,11 @@ function parseCredentialBundle(name, rawValue) {
     }
     return createInfraFailure('infra-control-plane-credential-invalid', `Control-plane credential ${name} must be a JSON object containing string fields.`);
 }
-/*** Narrow JSON credential bundles. */
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
+/*** Narrow credential bundle values to a string-only record. */
+function isStringRecord(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.values(value).every((entry) => typeof entry === 'string'));
 }
 //# sourceMappingURL=createEnvironmentInfraCredentialPort.js.map

package/dist/features/environment-lifecycle/adapters/outbound/createEnvironmentInfraCredentialPort.js.map

@@ -1 +1 @@
-{"version":3,"file":"createEnvironmentInfraCredentialPort.js","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/adapters/outbound/createEnvironmentInfraCredentialPort.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAE3F,sGAAsG;AACtG,MAAM,UAAU,oCAAoC,CAClD,WAAyD;IAEzD,OAAO;QACL,YAAY,CAAC,SAAS;YACpB,MAAM,YAAY,GAAG,yBAAyB,4BAA4B,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7F,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACrF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,OAAO,OAAO,CAAC,OAAO,CACpB,kBAAkB,CAChB,wCAAwC,EACxC,4BAA4B,SAAS,CAAC,IAAI,wBAAwB,SAAS,CAAC,IAAI,OAAO,YAAY,GAAG,CACvG,CACF,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,qBAAqB,CAC5B,IAAY,EACZ,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAA0C,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,kBAAkB,CACvB,wCAAwC,EACxC,4BAA4B,IAAI,kDAAkD,CACnF,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import type { InfraExecutionContext, InfraResult } from '@ankhorage/contracts/infra';\n\nimport { createInfraFailure } from '../../utils/createInfraFailure.js';\nimport { normalizeInfraEnvironmentKey } from '../../utils/normalizeInfraEnvironmentKey.js';\n\n/*** Resolve execution-only control-plane credentials from exact-name or prefixed environment data. */\nexport function createEnvironmentInfraCredentialPort(\n  environment: Readonly<Record<string, string | undefined>>,\n): InfraExecutionContext['credentials'] {\n  return {\n    resolveAsync(reference) {\n      const prefixedName = `ANKH_INFRA_CREDENTIAL_${normalizeInfraEnvironmentKey(reference.name)}`;\n      const rawValue =\n        Reflect.get(environment, reference.name) ?? Reflect.get(environment, prefixedName);\n      if (rawValue === undefined || rawValue.length === 0) {\n        return Promise.resolve(\n          createInfraFailure(\n            'infra-control-plane-credential-missing',\n            `Control-plane credential ${reference.name} is unavailable. Set ${reference.name} or ${prefixedName}.`,\n          ),\n        );\n      }\n      return Promise.resolve(parseCredentialBundle(reference.name, rawValue));\n    },\n  };\n}\n\n/*** Parse JSON credential bundles; token variables also support their conventional scalar form. */\nfunction parseCredentialBundle(\n  name: string,\n  rawValue: string,\n): InfraResult<Readonly<Record<string, string>>> {\n  try {\n    const parsed: unknown = JSON.parse(rawValue);\n    if (isRecord(parsed) && Object.values(parsed).every((value) => typeof value === 'string')) {\n      return { ok: true, value: parsed as Readonly<Record<string, string>>, diagnostics: [] };\n    }\n  } catch {\n    if (name.endsWith('_TOKEN')) {\n      return { ok: true, value: { token: rawValue, apiToken: rawValue }, diagnostics: [] };\n    }\n  }\n  return createInfraFailure(\n    'infra-control-plane-credential-invalid',\n    `Control-plane credential ${name} must be a JSON object containing string fields.`,\n  );\n}\n\n/*** Narrow JSON credential bundles. */\nfunction isRecord(value: unknown): value is Readonly<Record<string, unknown>> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n"]}
+{"version":3,"file":"createEnvironmentInfraCredentialPort.js","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/adapters/outbound/createEnvironmentInfraCredentialPort.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAE3F,sGAAsG;AACtG,MAAM,UAAU,oCAAoC,CAClD,WAAyD;IAEzD,OAAO;QACL,SAAS,CAAC,SAAS;YACjB,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,YAAY,CAAC,SAAS;YACpB,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,YAAY,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC5D,OAAO,OAAO,CAAC,OAAO,CACpB,kBAAkB,CAChB,wCAAwC,EACxC,4BAA4B,SAAS,CAAC,IAAI,wBAAwB,SAAS,CAAC,IAAI,OAAO,YAAY,GAAG,CACvG,CACF,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,SAAS;YACpB,OAAO,OAAO,CAAC,OAAO,CACpB,kBAAkB,CAChB,wDAAwD,EACxD,4BAA4B,SAAS,CAAC,IAAI,iEAAiE,CAC5G,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,SAAS,cAAc,CACrB,WAAyD,EACzD,SAAyC;IAEzC,MAAM,YAAY,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,qBAAqB,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,4FAA4F;AAC5F,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,yBAAyB,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,mGAAmG;AACnG,SAAS,qBAAqB,CAC5B,IAAY,EACZ,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,kBAAkB,CACvB,wCAAwC,EACxC,4BAA4B,IAAI,kDAAkD,CACnF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  InfraControlPlaneCredentialRef,\n  InfraExecutionContext,\n  InfraResult,\n} from '@ankhorage/contracts/infra';\n\nimport { createInfraFailure } from '../../utils/createInfraFailure.js';\nimport { normalizeInfraEnvironmentKey } from '../../utils/normalizeInfraEnvironmentKey.js';\n\n/*** Resolve execution-only control-plane credentials from exact-name or prefixed environment data. */\nexport function createEnvironmentInfraCredentialPort(\n  environment: Readonly<Record<string, string | undefined>>,\n): InfraExecutionContext['credentials'] {\n  return {\n    findAsync(reference) {\n      return Promise.resolve(findCredential(environment, reference));\n    },\n    resolveAsync(reference) {\n      const found = findCredential(environment, reference);\n      if (!found.ok) return Promise.resolve(found);\n      if (found.value !== null) {\n        return Promise.resolve({ ok: true, value: found.value, diagnostics: found.diagnostics });\n      }\n      const prefixedName = prefixedCredentialName(reference.name);\n      return Promise.resolve(\n        createInfraFailure(\n          'infra-control-plane-credential-missing',\n          `Control-plane credential ${reference.name} is unavailable. Set ${reference.name} or ${prefixedName}.`,\n        ),\n      );\n    },\n    persistAsync(reference) {\n      return Promise.resolve(\n        createInfraFailure(\n          'infra-control-plane-credential-persistence-unavailable',\n          `Control-plane credential ${reference.name} cannot be persisted by the environment-only credential source.`,\n        ),\n      );\n    },\n  };\n}\n\n/*** Find and parse an optional credential bundle from the environment without treating absence as failure. */\nfunction findCredential(\n  environment: Readonly<Record<string, string | undefined>>,\n  reference: InfraControlPlaneCredentialRef,\n): InfraResult<Readonly<Record<string, string>> | null> {\n  const prefixedName = prefixedCredentialName(reference.name);\n  const rawValue =\n    Reflect.get(environment, reference.name) ?? Reflect.get(environment, prefixedName);\n  if (rawValue === undefined || rawValue.length === 0) {\n    return { ok: true, value: null, diagnostics: [] };\n  }\n  return parseCredentialBundle(reference.name, rawValue);\n}\n\n/*** Build the canonical prefixed environment variable name for one credential reference. */\nfunction prefixedCredentialName(name: string): string {\n  return `ANKH_INFRA_CREDENTIAL_${normalizeInfraEnvironmentKey(name)}`;\n}\n\n/*** Parse JSON credential bundles; token variables also support their conventional scalar form. */\nfunction parseCredentialBundle(\n  name: string,\n  rawValue: string,\n): InfraResult<Readonly<Record<string, string>>> {\n  try {\n    const parsed: unknown = JSON.parse(rawValue);\n    if (isStringRecord(parsed)) return { ok: true, value: parsed, diagnostics: [] };\n  } catch {\n    if (name.endsWith('_TOKEN')) {\n      return { ok: true, value: { token: rawValue, apiToken: rawValue }, diagnostics: [] };\n    }\n  }\n  return createInfraFailure(\n    'infra-control-plane-credential-invalid',\n    `Control-plane credential ${name} must be a JSON object containing string fields.`,\n  );\n}\n\n/*** Narrow credential bundle values to a string-only record. */\nfunction isStringRecord(value: unknown): value is Readonly<Record<string, string>> {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    !Array.isArray(value) &&\n    Object.values(value).every((entry) => typeof entry === 'string')\n  );\n}\n"]}

package/dist/features/environment-lifecycle/application/use-cases/prepareInfraServicesAsync.d.ts

@@ -0,0 +1,4 @@
+import type { InfraExecutionContext, InfraResult, InfraServiceAdapter } from '@ankhorage/contracts/infra';
+/*** Run optional mutating service preparation before runtime workload materialization. */
+export declare function prepareInfraServicesAsync(context: InfraExecutionContext, services: readonly InfraServiceAdapter[]): Promise<InfraResult<null>>;
+//# sourceMappingURL=prepareInfraServicesAsync.d.ts.map

package/dist/features/environment-lifecycle/application/use-cases/prepareInfraServicesAsync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepareInfraServicesAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/application/use-cases/prepareInfraServicesAsync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,qBAAqB,EACrB,WAAW,EACX,mBAAmB,EACpB,MAAM,4BAA4B,CAAC;AAIpC,0FAA0F;AAC1F,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,EAAE,SAAS,mBAAmB,EAAE,GACvC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAS5B"}

package/dist/features/environment-lifecycle/application/use-cases/prepareInfraServicesAsync.js

@@ -0,0 +1,15 @@
+import { appendInfraFailure } from '../../utils/appendInfraFailure.js';
+/*** Run optional mutating service preparation before runtime workload materialization. */
+export async function prepareInfraServicesAsync(context, services) {
+    const diagnostics = [];
+    for (const service of services) {
+        if (service.prepareAsync === undefined)
+            continue;
+        const prepared = await service.prepareAsync(context);
+        if (!prepared.ok)
+            return appendInfraFailure(diagnostics, prepared);
+        diagnostics.push(...prepared.diagnostics);
+    }
+    return { ok: true, value: null, diagnostics };
+}
+//# sourceMappingURL=prepareInfraServicesAsync.js.map

package/dist/features/environment-lifecycle/application/use-cases/prepareInfraServicesAsync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepareInfraServicesAsync.js","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/application/use-cases/prepareInfraServicesAsync.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAEvE,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA8B,EAC9B,QAAwC;IAExC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,SAAS;QACjD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnE,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAChD,CAAC","sourcesContent":["import type {\n  InfraDiagnostic,\n  InfraExecutionContext,\n  InfraResult,\n  InfraServiceAdapter,\n} from '@ankhorage/contracts/infra';\n\nimport { appendInfraFailure } from '../../utils/appendInfraFailure.js';\n\n/*** Run optional mutating service preparation before runtime workload materialization. */\nexport async function prepareInfraServicesAsync(\n  context: InfraExecutionContext,\n  services: readonly InfraServiceAdapter[],\n): Promise<InfraResult<null>> {\n  const diagnostics: InfraDiagnostic[] = [];\n  for (const service of services) {\n    if (service.prepareAsync === undefined) continue;\n    const prepared = await service.prepareAsync(context);\n    if (!prepared.ok) return appendInfraFailure(diagnostics, prepared);\n    diagnostics.push(...prepared.diagnostics);\n  }\n  return { ok: true, value: null, diagnostics };\n}\n"]}

package/dist/features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.d.ts

@@ -1,4 +1,4 @@
 import type { InfraOrchestrationDependencies, InfraUpOperationResult, InfraUpRequest } from '../../../../types/infraOrchestration.js';
-/*** Validate and reconcile compute, contributed workloads, runtime and services in dependency order. */
+/*** Validate and reconcile compute, service preparation, workloads, runtime and services in order. */
 export declare function upInfraEnvironmentAsync(request: InfraUpRequest, dependencies: InfraOrchestrationDependencies): Promise<InfraUpOperationResult>;
 //# sourceMappingURL=upInfraEnvironmentAsync.d.ts.map

package/dist/features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upInfraEnvironmentAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,8BAA8B,EAC9B,sBAAsB,EACtB,cAAc,EACf,MAAM,yCAAyC,CAAC;AAUjD,wGAAwG;AACxG,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,8BAA8B,GAC3C,OAAO,CAAC,sBAAsB,CAAC,CA0EjC"}
+{"version":3,"file":"upInfraEnvironmentAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,8BAA8B,EAC9B,sBAAsB,EACtB,cAAc,EACf,MAAM,yCAAyC,CAAC;AAWjD,sGAAsG;AACtG,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,8BAA8B,GAC3C,OAAO,CAAC,sBAAsB,CAAC,CA6EjC"}

package/dist/features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.js

@@ -4,9 +4,10 @@ import { createInfraExecutionContext } from '../../utils/createInfraExecutionCon
 import { createInfraLedger } from '../../utils/createInfraLedger.js';
 import { mergeInfraOutputs } from '../../utils/mergeInfraOutputs.js';
 import { collectInfraWorkloadsAsync } from './collectInfraWorkloadsAsync.js';
+import { prepareInfraServicesAsync } from './prepareInfraServicesAsync.js';
 import { resolveInfraAdaptersAsync } from './resolveInfraAdaptersAsync.js';
 import { validateInfraAdaptersAsync } from './validateInfraAdaptersAsync.js';
-/*** Validate and reconcile compute, contributed workloads, runtime and services in dependency order. */
+/*** Validate and reconcile compute, service preparation, workloads, runtime and services in order. */
 export async function upInfraEnvironmentAsync(request, dependencies) {
     const environment = resolveInfraEnvironment({
         manifest: request.manifest,
@@ -25,14 +26,18 @@ export async function upInfraEnvironmentAsync(request, dependencies) {
     if (!validation.ok)
         return appendInfraFailure(diagnostics, validation);
     diagnostics.push(...validation.diagnostics);
-    const workloads = await collectInfraWorkloadsAsync(context, adapters.value.services);
-    if (!workloads.ok)
-        return appendInfraFailure(diagnostics, workloads);
-    diagnostics.push(...workloads.diagnostics);
     const compute = await adapters.value.compute.ensureAsync(context, environment.value.desired.deployment.compute);
     if (!compute.ok)
         return appendInfraFailure(diagnostics, compute);
     diagnostics.push(...compute.diagnostics);
+    const preparation = await prepareInfraServicesAsync(context, adapters.value.services);
+    if (!preparation.ok)
+        return appendInfraFailure(diagnostics, preparation);
+    diagnostics.push(...preparation.diagnostics);
+    const workloads = await collectInfraWorkloadsAsync(context, adapters.value.services);
+    if (!workloads.ok)
+        return appendInfraFailure(diagnostics, workloads);
+    diagnostics.push(...workloads.diagnostics);
     const runtimeDesired = {
         selection: environment.value.desired.deployment.runtime,
         targets: compute.value.targets,

package/dist/features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.js.map

@@ -1 +1 @@
-{"version":3,"file":"upInfraEnvironmentAsync.js","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAuB,EACvB,YAA4C;IAE5C,MAAM,WAAW,GAAG,uBAAuB,CAAC;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IACxC,MAAM,WAAW,GAAsB,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAC9C,WAAW,CAAC,KAAK,CAAC,OAAO,EACzB,YAAY,CAAC,eAAe,CAC7B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACnE,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,2BAA2B,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACvE,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrF,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACrE,WAAW,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CACtD,OAAO,EACP,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAC7C,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjE,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO;QACvD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;QAC/E,gBAAgB,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;KAC5F,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC9F,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACrF,WAAW,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjE,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE;QAC9E,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO;QACxB,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACnE,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG;QAChB,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS;QAC1B,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS;QAC1B,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS;KAC5B,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAC/B,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,QAAQ,CAAC,KAAK,CAAC,OAAO,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE;QACjC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS;QACT,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE;YACjC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,SAAS;YACT,OAAO;YACP,MAAM;SACP;QACD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,sBAAsB,CACnC,OAA8B,EAC9B,QAAwC,EACxC,cAAsC;IAOtC,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC;AAClE,CAAC","sourcesContent":["import type {\n  InfraDiagnostic,\n  InfraExecutionContext,\n  InfraOutput,\n  InfraOwnedResource,\n  InfraResult,\n  InfraServiceAdapter,\n} from '@ankhorage/contracts/infra';\n\nimport type {\n  InfraOrchestrationDependencies,\n  InfraUpOperationResult,\n  InfraUpRequest,\n} from '../../../../types/infraOrchestration.js';\nimport { resolveInfraEnvironment } from '../../domain/resolveInfraEnvironment.js';\nimport { appendInfraFailure } from '../../utils/appendInfraFailure.js';\nimport { createInfraExecutionContext } from '../../utils/createInfraExecutionContext.js';\nimport { createInfraLedger } from '../../utils/createInfraLedger.js';\nimport { mergeInfraOutputs } from '../../utils/mergeInfraOutputs.js';\nimport { collectInfraWorkloadsAsync } from './collectInfraWorkloadsAsync.js';\nimport { resolveInfraAdaptersAsync } from './resolveInfraAdaptersAsync.js';\nimport { validateInfraAdaptersAsync } from './validateInfraAdaptersAsync.js';\n\n/*** Validate and reconcile compute, contributed workloads, runtime and services in dependency order. */\nexport async function upInfraEnvironmentAsync(\n  request: InfraUpRequest,\n  dependencies: InfraOrchestrationDependencies,\n): Promise<InfraUpOperationResult> {\n  const environment = resolveInfraEnvironment({\n    manifest: request.manifest,\n    environment: request.environment,\n    operation: 'up',\n  });\n  if (!environment.ok) return environment;\n  const diagnostics: InfraDiagnostic[] = [...environment.diagnostics];\n  const adapters = await resolveInfraAdaptersAsync(\n    environment.value.desired,\n    dependencies.adapterResolver,\n  );\n  if (!adapters.ok) return appendInfraFailure(diagnostics, adapters);\n  diagnostics.push(...adapters.diagnostics);\n  const context = createInfraExecutionContext(request, environment.value, dependencies);\n  const validation = await validateInfraAdaptersAsync(context, adapters.value);\n  if (!validation.ok) return appendInfraFailure(diagnostics, validation);\n  diagnostics.push(...validation.diagnostics);\n  const workloads = await collectInfraWorkloadsAsync(context, adapters.value.services);\n  if (!workloads.ok) return appendInfraFailure(diagnostics, workloads);\n  diagnostics.push(...workloads.diagnostics);\n  const compute = await adapters.value.compute.ensureAsync(\n    context,\n    environment.value.desired.deployment.compute,\n  );\n  if (!compute.ok) return appendInfraFailure(diagnostics, compute);\n  diagnostics.push(...compute.diagnostics);\n  const runtimeDesired = {\n    selection: environment.value.desired.deployment.runtime,\n    targets: compute.value.targets,\n    workloads: [...(environment.value.desired.workloads ?? []), ...workloads.value],\n    availableOutputs: mergeInfraOutputs(request.previous?.outputs ?? [], compute.value.outputs),\n  };\n  const runtimeValidation = await adapters.value.runtime.validateAsync(context, runtimeDesired);\n  if (!runtimeValidation.ok) return appendInfraFailure(diagnostics, runtimeValidation);\n  diagnostics.push(...runtimeValidation.diagnostics);\n  const runtime = await adapters.value.runtime.ensureAsync(context, runtimeDesired);\n  if (!runtime.ok) return appendInfraFailure(diagnostics, runtime);\n  diagnostics.push(...runtime.diagnostics);\n  const services = await reconcileServicesAsync(context, adapters.value.services, [\n    ...compute.value.outputs,\n    ...runtime.value.outputs,\n  ]);\n  if (!services.ok) return appendInfraFailure(diagnostics, services);\n  diagnostics.push(...services.diagnostics);\n  const resources = [\n    ...compute.value.resources,\n    ...runtime.value.resources,\n    ...services.value.resources,\n  ];\n  const outputs = mergeInfraOutputs(\n    compute.value.outputs,\n    runtime.value.outputs,\n    services.value.outputs,\n  );\n  const ledger = createInfraLedger({\n    projectId: request.projectId,\n    environment: environment.value.id,\n    targets: compute.value.targets,\n    resources,\n    outputs,\n    previous: request.previous,\n  });\n  return {\n    ok: true,\n    value: {\n      environment: environment.value.id,\n      targets: compute.value.targets,\n      resources,\n      outputs,\n      ledger,\n    },\n    diagnostics,\n  };\n}\n\n/*** Reconcile service-owned external state after its runtime workloads expose outputs. */\nasync function reconcileServicesAsync(\n  context: InfraExecutionContext,\n  services: readonly InfraServiceAdapter[],\n  runtimeOutputs: readonly InfraOutput[],\n): Promise<\n  InfraResult<{\n    readonly resources: readonly InfraOwnedResource[];\n    readonly outputs: readonly InfraOutput[];\n  }>\n> {\n  const resources: InfraOwnedResource[] = [];\n  const outputs: InfraOutput[] = [];\n  const diagnostics: InfraDiagnostic[] = [];\n  for (const service of services) {\n    const result = await service.reconcileAsync(context, runtimeOutputs);\n    if (!result.ok) return appendInfraFailure(diagnostics, result);\n    resources.push(...result.value.resources);\n    outputs.push(...result.value.outputs);\n    diagnostics.push(...result.diagnostics);\n  }\n  return { ok: true, value: { resources, outputs }, diagnostics };\n}\n"]}
+{"version":3,"file":"upInfraEnvironmentAsync.js","sourceRoot":"","sources":["../../../../../src/features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAuB,EACvB,YAA4C;IAE5C,MAAM,WAAW,GAAG,uBAAuB,CAAC;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IACxC,MAAM,WAAW,GAAsB,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAC9C,WAAW,CAAC,KAAK,CAAC,OAAO,EACzB,YAAY,CAAC,eAAe,CAC7B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACnE,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,2BAA2B,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACvE,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CACtD,OAAO,EACP,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAC7C,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjE,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtF,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACzE,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrF,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACrE,WAAW,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO;QACvD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;QAC/E,gBAAgB,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;KAC5F,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC9F,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACrF,WAAW,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjE,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE;QAC9E,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO;QACxB,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACnE,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG;QAChB,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS;QAC1B,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS;QAC1B,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS;KAC5B,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAC/B,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,QAAQ,CAAC,KAAK,CAAC,OAAO,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE;QACjC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS;QACT,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE;YACjC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,SAAS;YACT,OAAO;YACP,MAAM;SACP;QACD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,sBAAsB,CACnC,OAA8B,EAC9B,QAAwC,EACxC,cAAsC;IAOtC,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC;AAClE,CAAC","sourcesContent":["import type {\n  InfraDiagnostic,\n  InfraExecutionContext,\n  InfraOutput,\n  InfraOwnedResource,\n  InfraResult,\n  InfraServiceAdapter,\n} from '@ankhorage/contracts/infra';\n\nimport type {\n  InfraOrchestrationDependencies,\n  InfraUpOperationResult,\n  InfraUpRequest,\n} from '../../../../types/infraOrchestration.js';\nimport { resolveInfraEnvironment } from '../../domain/resolveInfraEnvironment.js';\nimport { appendInfraFailure } from '../../utils/appendInfraFailure.js';\nimport { createInfraExecutionContext } from '../../utils/createInfraExecutionContext.js';\nimport { createInfraLedger } from '../../utils/createInfraLedger.js';\nimport { mergeInfraOutputs } from '../../utils/mergeInfraOutputs.js';\nimport { collectInfraWorkloadsAsync } from './collectInfraWorkloadsAsync.js';\nimport { prepareInfraServicesAsync } from './prepareInfraServicesAsync.js';\nimport { resolveInfraAdaptersAsync } from './resolveInfraAdaptersAsync.js';\nimport { validateInfraAdaptersAsync } from './validateInfraAdaptersAsync.js';\n\n/*** Validate and reconcile compute, service preparation, workloads, runtime and services in order. */\nexport async function upInfraEnvironmentAsync(\n  request: InfraUpRequest,\n  dependencies: InfraOrchestrationDependencies,\n): Promise<InfraUpOperationResult> {\n  const environment = resolveInfraEnvironment({\n    manifest: request.manifest,\n    environment: request.environment,\n    operation: 'up',\n  });\n  if (!environment.ok) return environment;\n  const diagnostics: InfraDiagnostic[] = [...environment.diagnostics];\n  const adapters = await resolveInfraAdaptersAsync(\n    environment.value.desired,\n    dependencies.adapterResolver,\n  );\n  if (!adapters.ok) return appendInfraFailure(diagnostics, adapters);\n  diagnostics.push(...adapters.diagnostics);\n  const context = createInfraExecutionContext(request, environment.value, dependencies);\n  const validation = await validateInfraAdaptersAsync(context, adapters.value);\n  if (!validation.ok) return appendInfraFailure(diagnostics, validation);\n  diagnostics.push(...validation.diagnostics);\n  const compute = await adapters.value.compute.ensureAsync(\n    context,\n    environment.value.desired.deployment.compute,\n  );\n  if (!compute.ok) return appendInfraFailure(diagnostics, compute);\n  diagnostics.push(...compute.diagnostics);\n  const preparation = await prepareInfraServicesAsync(context, adapters.value.services);\n  if (!preparation.ok) return appendInfraFailure(diagnostics, preparation);\n  diagnostics.push(...preparation.diagnostics);\n  const workloads = await collectInfraWorkloadsAsync(context, adapters.value.services);\n  if (!workloads.ok) return appendInfraFailure(diagnostics, workloads);\n  diagnostics.push(...workloads.diagnostics);\n  const runtimeDesired = {\n    selection: environment.value.desired.deployment.runtime,\n    targets: compute.value.targets,\n    workloads: [...(environment.value.desired.workloads ?? []), ...workloads.value],\n    availableOutputs: mergeInfraOutputs(request.previous?.outputs ?? [], compute.value.outputs),\n  };\n  const runtimeValidation = await adapters.value.runtime.validateAsync(context, runtimeDesired);\n  if (!runtimeValidation.ok) return appendInfraFailure(diagnostics, runtimeValidation);\n  diagnostics.push(...runtimeValidation.diagnostics);\n  const runtime = await adapters.value.runtime.ensureAsync(context, runtimeDesired);\n  if (!runtime.ok) return appendInfraFailure(diagnostics, runtime);\n  diagnostics.push(...runtime.diagnostics);\n  const services = await reconcileServicesAsync(context, adapters.value.services, [\n    ...compute.value.outputs,\n    ...runtime.value.outputs,\n  ]);\n  if (!services.ok) return appendInfraFailure(diagnostics, services);\n  diagnostics.push(...services.diagnostics);\n  const resources = [\n    ...compute.value.resources,\n    ...runtime.value.resources,\n    ...services.value.resources,\n  ];\n  const outputs = mergeInfraOutputs(\n    compute.value.outputs,\n    runtime.value.outputs,\n    services.value.outputs,\n  );\n  const ledger = createInfraLedger({\n    projectId: request.projectId,\n    environment: environment.value.id,\n    targets: compute.value.targets,\n    resources,\n    outputs,\n    previous: request.previous,\n  });\n  return {\n    ok: true,\n    value: {\n      environment: environment.value.id,\n      targets: compute.value.targets,\n      resources,\n      outputs,\n      ledger,\n    },\n    diagnostics,\n  };\n}\n\n/*** Reconcile service-owned external state after its runtime workloads expose outputs. */\nasync function reconcileServicesAsync(\n  context: InfraExecutionContext,\n  services: readonly InfraServiceAdapter[],\n  runtimeOutputs: readonly InfraOutput[],\n): Promise<\n  InfraResult<{\n    readonly resources: readonly InfraOwnedResource[];\n    readonly outputs: readonly InfraOutput[];\n  }>\n> {\n  const resources: InfraOwnedResource[] = [];\n  const outputs: InfraOutput[] = [];\n  const diagnostics: InfraDiagnostic[] = [];\n  for (const service of services) {\n    const result = await service.reconcileAsync(context, runtimeOutputs);\n    if (!result.ok) return appendInfraFailure(diagnostics, result);\n    resources.push(...result.value.resources);\n    outputs.push(...result.value.outputs);\n    diagnostics.push(...result.diagnostics);\n  }\n  return { ok: true, value: { resources, outputs }, diagnostics };\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "5.1.6",
+  "version": "7.0.0",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -35,7 +35,7 @@
     "openapi"
   ],
   "dependencies": {
-    "@ankhorage/contracts": "^19.4.0"
+    "@ankhorage/contracts": "^21.0.0"
   },
   "files": [
     "dist",
@@ -102,6 +102,7 @@
     "test:e2e": "ANKH_INFRA_COMPOSITION_E2E=1 bun test src/infraComposition.integration.test.ts",
     "test:e2e:docker-compose-providers": "ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E=1 bun test src/localDockerComposeProviders.integration.test.ts",
     "test:e2e:minikube-supabase": "ANKH_INFRA_MINIKUBE_SUPABASE_E2E=1 bun test src/localMinikubeSupabase.integration.test.ts",
+    "test:e2e:minikube-supabase-recovery": "ANKH_INFRA_MINIKUBE_SUPABASE_RECOVERY_E2E=1 bun test src/localMinikubeSupabaseRecovery.integration.test.ts",
     "typecheck": "bun x tsc --noEmit -p tsconfig.json",
     "check-types": "bun run typecheck",
     "version-packages": "ankhorage-changeset version",
@@ -116,10 +117,10 @@
     "@ankhorage/hetzner": "^0.3.0",
     "@ankhorage/k3s": "^0.4.1",
     "@ankhorage/local": "^0.3.0",
-    "@ankhorage/minikube": "^0.4.2",
+    "@ankhorage/minikube": "^0.4.4",
     "@ankhorage/paradox": "^0.1.24",
     "@ankhorage/r2": "^0.2.0",
-    "@ankhorage/supabase": "^0.5.5",
+    "@ankhorage/supabase": "^0.5.9",
     "@ankhorage/supabase-vault": "^0.3.1",
     "@types/bun": "^1.4.1",
     "@types/node": "^25.6.0",

package/src/environmentCredentialPort.test.ts

@@ -0,0 +1,62 @@
+import type { InfraControlPlaneCredentialRef } from '@ankhorage/contracts/infra';
+import { expect, it } from 'bun:test';
+
+import { createEnvironmentInfraCredentialPort } from './features/environment-lifecycle/adapters/outbound/createEnvironmentInfraCredentialPort';
+
+const bundleReference = {
+  source: 'control-plane',
+  name: 'FIXTURE_BOOTSTRAP',
+} as const satisfies InfraControlPlaneCredentialRef;
+const tokenReference = {
+  source: 'control-plane',
+  name: 'FIXTURE_TOKEN',
+} as const satisfies InfraControlPlaneCredentialRef;
+
+it('finds exact and prefixed environment credentials without mutating state', async () => {
+  const port = createEnvironmentInfraCredentialPort({
+    FIXTURE_BOOTSTRAP: JSON.stringify({ username: 'fixture', password: 'secret' }),
+    ANKH_INFRA_CREDENTIAL_FIXTURE_TOKEN: 'token-value',
+  });
+
+  expect(await port.findAsync(bundleReference)).toEqual({
+    ok: true,
+    value: { username: 'fixture', password: 'secret' },
+    diagnostics: [],
+  });
+  expect(await port.findAsync(tokenReference)).toEqual({
+    ok: true,
+    value: { token: 'token-value', apiToken: 'token-value' },
+    diagnostics: [],
+  });
+});
+
+it('distinguishes optional lookup from strict resolution', async () => {
+  const port = createEnvironmentInfraCredentialPort({});
+
+  expect(await port.findAsync(bundleReference)).toEqual({ ok: true, value: null, diagnostics: [] });
+  const resolved = await port.resolveAsync(bundleReference);
+  expect(resolved.ok).toBe(false);
+  expect(resolved.diagnostics).toEqual([
+    {
+      severity: 'error',
+      code: 'infra-control-plane-credential-missing',
+      message:
+        'Control-plane credential FIXTURE_BOOTSTRAP is unavailable. Set FIXTURE_BOOTSTRAP or ANKH_INFRA_CREDENTIAL_FIXTURE_BOOTSTRAP.',
+    },
+  ]);
+});
+
+it('fails closed when an environment-only source is asked to persist credentials', async () => {
+  const port = createEnvironmentInfraCredentialPort({});
+  const persisted = await port.persistAsync(bundleReference, { value: 'secret' });
+
+  expect(persisted.ok).toBe(false);
+  expect(persisted.diagnostics).toEqual([
+    {
+      severity: 'error',
+      code: 'infra-control-plane-credential-persistence-unavailable',
+      message:
+        'Control-plane credential FIXTURE_BOOTSTRAP cannot be persisted by the environment-only credential source.',
+    },
+  ]);
+});

package/src/features/environment-lifecycle/adapters/outbound/createEnvironmentInfraCredentialPort.ts

@@ -1,4 +1,8 @@
-import type { InfraExecutionContext, InfraResult } from '@ankhorage/contracts/infra';
+import type {
+  InfraControlPlaneCredentialRef,
+  InfraExecutionContext,
+  InfraResult,
+} from '@ankhorage/contracts/infra';
 
 import { createInfraFailure } from '../../utils/createInfraFailure.js';
 import { normalizeInfraEnvironmentKey } from '../../utils/normalizeInfraEnvironmentKey.js';
@@ -8,23 +12,53 @@ export function createEnvironmentInfraCredentialPort(
   environment: Readonly<Record<string, string | undefined>>,
 ): InfraExecutionContext['credentials'] {
   return {
+    findAsync(reference) {
+      return Promise.resolve(findCredential(environment, reference));
+    },
     resolveAsync(reference) {
-      const prefixedName = `ANKH_INFRA_CREDENTIAL_${normalizeInfraEnvironmentKey(reference.name)}`;
-      const rawValue =
-        Reflect.get(environment, reference.name) ?? Reflect.get(environment, prefixedName);
-      if (rawValue === undefined || rawValue.length === 0) {
-        return Promise.resolve(
-          createInfraFailure(
-            'infra-control-plane-credential-missing',
-            `Control-plane credential ${reference.name} is unavailable. Set ${reference.name} or ${prefixedName}.`,
-          ),
-        );
+      const found = findCredential(environment, reference);
+      if (!found.ok) return Promise.resolve(found);
+      if (found.value !== null) {
+        return Promise.resolve({ ok: true, value: found.value, diagnostics: found.diagnostics });
       }
-      return Promise.resolve(parseCredentialBundle(reference.name, rawValue));
+      const prefixedName = prefixedCredentialName(reference.name);
+      return Promise.resolve(
+        createInfraFailure(
+          'infra-control-plane-credential-missing',
+          `Control-plane credential ${reference.name} is unavailable. Set ${reference.name} or ${prefixedName}.`,
+        ),
+      );
+    },
+    persistAsync(reference) {
+      return Promise.resolve(
+        createInfraFailure(
+          'infra-control-plane-credential-persistence-unavailable',
+          `Control-plane credential ${reference.name} cannot be persisted by the environment-only credential source.`,
+        ),
+      );
     },
   };
 }
 
+/*** Find and parse an optional credential bundle from the environment without treating absence as failure. */
+function findCredential(
+  environment: Readonly<Record<string, string | undefined>>,
+  reference: InfraControlPlaneCredentialRef,
+): InfraResult<Readonly<Record<string, string>> | null> {
+  const prefixedName = prefixedCredentialName(reference.name);
+  const rawValue =
+    Reflect.get(environment, reference.name) ?? Reflect.get(environment, prefixedName);
+  if (rawValue === undefined || rawValue.length === 0) {
+    return { ok: true, value: null, diagnostics: [] };
+  }
+  return parseCredentialBundle(reference.name, rawValue);
+}
+
+/*** Build the canonical prefixed environment variable name for one credential reference. */
+function prefixedCredentialName(name: string): string {
+  return `ANKH_INFRA_CREDENTIAL_${normalizeInfraEnvironmentKey(name)}`;
+}
+
 /*** Parse JSON credential bundles; token variables also support their conventional scalar form. */
 function parseCredentialBundle(
   name: string,
@@ -32,9 +66,7 @@ function parseCredentialBundle(
 ): InfraResult<Readonly<Record<string, string>>> {
   try {
     const parsed: unknown = JSON.parse(rawValue);
-    if (isRecord(parsed) && Object.values(parsed).every((value) => typeof value === 'string')) {
-      return { ok: true, value: parsed as Readonly<Record<string, string>>, diagnostics: [] };
-    }
+    if (isStringRecord(parsed)) return { ok: true, value: parsed, diagnostics: [] };
   } catch {
     if (name.endsWith('_TOKEN')) {
       return { ok: true, value: { token: rawValue, apiToken: rawValue }, diagnostics: [] };
@@ -46,7 +78,12 @@ function parseCredentialBundle(
   );
 }
 
-/*** Narrow JSON credential bundles. */
-function isRecord(value: unknown): value is Readonly<Record<string, unknown>> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
+/*** Narrow credential bundle values to a string-only record. */
+function isStringRecord(value: unknown): value is Readonly<Record<string, string>> {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.values(value).every((entry) => typeof entry === 'string')
+  );
 }

package/src/features/environment-lifecycle/application/use-cases/prepareInfraServicesAsync.ts

@@ -0,0 +1,23 @@
+import type {
+  InfraDiagnostic,
+  InfraExecutionContext,
+  InfraResult,
+  InfraServiceAdapter,
+} from '@ankhorage/contracts/infra';
+
+import { appendInfraFailure } from '../../utils/appendInfraFailure.js';
+
+/*** Run optional mutating service preparation before runtime workload materialization. */
+export async function prepareInfraServicesAsync(
+  context: InfraExecutionContext,
+  services: readonly InfraServiceAdapter[],
+): Promise<InfraResult<null>> {
+  const diagnostics: InfraDiagnostic[] = [];
+  for (const service of services) {
+    if (service.prepareAsync === undefined) continue;
+    const prepared = await service.prepareAsync(context);
+    if (!prepared.ok) return appendInfraFailure(diagnostics, prepared);
+    diagnostics.push(...prepared.diagnostics);
+  }
+  return { ok: true, value: null, diagnostics };
+}

package/src/features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.ts

@@ -18,10 +18,11 @@ import { createInfraExecutionContext } from '../../utils/createInfraExecutionCon
 import { createInfraLedger } from '../../utils/createInfraLedger.js';
 import { mergeInfraOutputs } from '../../utils/mergeInfraOutputs.js';
 import { collectInfraWorkloadsAsync } from './collectInfraWorkloadsAsync.js';
+import { prepareInfraServicesAsync } from './prepareInfraServicesAsync.js';
 import { resolveInfraAdaptersAsync } from './resolveInfraAdaptersAsync.js';
 import { validateInfraAdaptersAsync } from './validateInfraAdaptersAsync.js';
 
-/*** Validate and reconcile compute, contributed workloads, runtime and services in dependency order. */
+/*** Validate and reconcile compute, service preparation, workloads, runtime and services in order. */
 export async function upInfraEnvironmentAsync(
   request: InfraUpRequest,
   dependencies: InfraOrchestrationDependencies,
@@ -43,15 +44,18 @@ export async function upInfraEnvironmentAsync(
   const validation = await validateInfraAdaptersAsync(context, adapters.value);
   if (!validation.ok) return appendInfraFailure(diagnostics, validation);
   diagnostics.push(...validation.diagnostics);
-  const workloads = await collectInfraWorkloadsAsync(context, adapters.value.services);
-  if (!workloads.ok) return appendInfraFailure(diagnostics, workloads);
-  diagnostics.push(...workloads.diagnostics);
   const compute = await adapters.value.compute.ensureAsync(
     context,
     environment.value.desired.deployment.compute,
   );
   if (!compute.ok) return appendInfraFailure(diagnostics, compute);
   diagnostics.push(...compute.diagnostics);
+  const preparation = await prepareInfraServicesAsync(context, adapters.value.services);
+  if (!preparation.ok) return appendInfraFailure(diagnostics, preparation);
+  diagnostics.push(...preparation.diagnostics);
+  const workloads = await collectInfraWorkloadsAsync(context, adapters.value.services);
+  if (!workloads.ok) return appendInfraFailure(diagnostics, workloads);
+  diagnostics.push(...workloads.diagnostics);
   const runtimeDesired = {
     selection: environment.value.desired.deployment.runtime,
     targets: compute.value.targets,

package/src/hetznerK3sProduction.test.ts

@@ -40,6 +40,13 @@ import type { InfraOrchestrationDependencies } from './types/infraOrchestration.
 const projectId = 'infra145-production';
 const publicBaseUrl = 'https://api.production.example.test';
 const domain = 'api.production.example.test';
+const persistenceTarget = {
+  endpoint: 'https://s3.production.example.test',
+  region: 'eu-central-1',
+  bucket: 'infra145-database-backups',
+  credentials: { source: 'control-plane', name: 'S3_PERSISTENCE' },
+  forcePathStyle: true,
+} as const;
 
 const manifest = {
   environments: {
@@ -54,8 +61,17 @@ const manifest = {
         compute: { provider: 'hetzner', location: 'fsn1', serverType: 'cx23' },
         runtime: { provider: 'k3s', topology: { servers: 1, agents: 0 } },
       },
-      database: { provider: 'supabase', tier: 'prod' },
+      database: {
+        provider: 'supabase',
+        tier: 'prod',
+        backup: { mode: 'scheduled', target: persistenceTarget, intervalHours: 24 },
+      },
       auth: { provider: 'supabase' },
+      objectStorage: {
+        provider: 'supabase',
+        buckets: ['media'],
+        backend: { ...persistenceTarget, bucket: 'infra145-storage' },
+      },
       networking: {
         domain,
         publicBaseUrl,
@@ -106,10 +122,15 @@ test('composes Hetzner, k3s, Kubernetes and Supabase while retaining compute for
   expect(access?.transport.kind === 'ssh' && access.transport.host).toBe('203.0.113.10');
   expect(JSON.stringify(firstUp)).not.toContain('phase10-private-key');
   expect(JSON.stringify(firstUp)).not.toContain('phase10-service-role-key');
+  expect(JSON.stringify(firstUp)).not.toContain('phase10-s3-secret-key');
   expect(fixture.kubernetes.serializedResources()).toContain(`"host":"${domain}"`);
   expect(fixture.kubernetes.serializedResources()).toContain('PersistentVolumeClaim');
   expect(fixture.kubernetes.serializedResources()).toContain('/etc/postgresql-custom');
   expect(fixture.kubernetes.serializedResources()).toContain('.ankhorage-image-seeded');
+  expect(fixture.kubernetes.serializedResources()).toContain('supabase-db-backup');
+  expect(
+    fixture.kubernetes.resources.filter(({ kind }) => kind === 'PersistentVolumeClaim'),
+  ).toHaveLength(2);
   expect(firstUp.resources.some(({ persistent }) => persistent)).toBe(true);
   const urlOutput = firstUp.outputs.find(({ name }) => name === 'url');
   expect(urlOutput?.value).toBe(publicBaseUrl);
@@ -232,6 +253,9 @@ function resolveCredential(name: string): InfraResult<Readonly<Record<string, st
       privateKey: 'phase10-private-key',
     });
   }
+  if (name === 'S3_PERSISTENCE') {
+    return success({ accessKeyId: 'phase10-s3-access', secretAccessKey: 'phase10-s3-secret-key' });
+  }
   if (name === 'SUPABASE_BOOTSTRAP') {
     return success({
       postgresPassword: 'phase10-postgres-password',

package/src/infraUp.test.ts

@@ -27,7 +27,7 @@ const environment = {
 const manifest = { environments: { local: environment }, modules: [] } as const;
 
 describe('environment up orchestration', () => {
-  it('validates before mutation and reconciles compute, runtime and deduplicated services', async () => {
+  it('validates before mutation and prepares services before workload materialization', async () => {
     const calls: string[] = [];
     const observedRuntimeDesired: InfraRuntimeDesiredState[] = [];
     const observedServiceOutputs: InfraOutput[][] = [];
@@ -39,9 +39,11 @@ describe('environment up orchestration', () => {
       'local.validate',
       'supabase.validate',
       'cerbos.validate',
+      'local.ensure',
+      'supabase.prepare',
+      'cerbos.prepare',
       'supabase.workloads',
       'cerbos.workloads',
-      'local.ensure',
       'docker-compose.validate',
       'docker-compose.ensure',
       'supabase.reconcile',
@@ -81,6 +83,27 @@ describe('environment up orchestration', () => {
     expect(calls).toEqual(['local.validate', 'supabase.validate']);
   });
 
+  it('stops before workload materialization when service preparation fails', async () => {
+    const calls: string[] = [];
+    const dependencies = createDependencies(calls, [], [], 'supabase.prepare');
+    const result = await upInfraEnvironmentAsync({ projectId: 'sample', manifest }, dependencies);
+
+    expect(result.ok).toBe(false);
+    expect(result.diagnostics.map(({ code }) => code)).toEqual([
+      'compute-warning',
+      'fixture-failure',
+    ]);
+    expect(calls).toEqual([
+      'local.validate',
+      'supabase.validate',
+      'cerbos.validate',
+      'local.ensure',
+      'supabase.prepare',
+    ]);
+    expect(calls).not.toContain('supabase.workloads');
+    expect(calls).not.toContain('docker-compose.ensure');
+  });
+
   it('does not reconcile services after a runtime failure', async () => {
     const calls: string[] = [];
     const dependencies = createDependencies(calls, [], [], 'docker-compose.ensure');
@@ -100,7 +123,11 @@ function createDependencies(
 ): InfraOrchestrationDependencies {
   return {
     adapterResolver: createResolver(calls, runtimeDesired, serviceOutputs, failure),
-    credentials: { resolveAsync: () => Promise.resolve(success({})) },
+    credentials: {
+      findAsync: () => Promise.resolve(success(null)),
+      resolveAsync: () => Promise.resolve(success({})),
+      persistAsync: () => Promise.resolve(success(null)),
+    },
     secrets: { resolveAsync: () => Promise.resolve(success('secret')) },
   };
 }
@@ -199,6 +226,7 @@ function createService(
     descriptor: descriptor as InfraServiceAdapter['descriptor'],
     validateAsync: () => recordAsync(calls, `${descriptor.id}.validate`, failure, null),
     planAsync: () => Promise.resolve(success([])),
+    prepareAsync: () => recordAsync(calls, `${descriptor.id}.prepare`, failure, null),
     desiredWorkloadsAsync: () =>
       recordAsync(calls, `${descriptor.id}.workloads`, failure, [workload(descriptor.id)]),
     reconcileAsync: (_context, outputs) => {

package/src/localMinikubeSupabaseRecovery.integration.test.ts

@@ -0,0 +1,527 @@
+import { createHmac } from 'node:crypto';
+
+import type {
+  InfraLedger,
+  InfraManifest,
+  InfraResourceIdentity,
+  InfraResult,
+} from '@ankhorage/contracts/infra';
+import { expect, test } from 'bun:test';
+
+import { createNodeInfraAdapterPackageResolver } from './features/environment-lifecycle/adapters/outbound/createNodeInfraAdapterPackageResolver.js';
+import { destroyInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.js';
+import { upInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.js';
+import type { InfraOrchestrationDependencies } from './types/infraOrchestration.js';
+
+const projectId = 'infra145-minikube-supabase-recovery';
+const profile = projectId;
+const namespace = `${projectId}-local`;
+const baseUrl = 'http://127.0.0.1:54322';
+const logicalBucket = 'phase10-objects';
+const physicalBucket = 'phase10-persistence';
+const minioContainer = 'infra145-minio-recovery';
+const minioHostEndpoint = 'http://127.0.0.1:19000';
+const minioPodEndpoint = 'http://host.minikube.internal:19000';
+const minioImage = 'quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z';
+const s3AccessKey = 'phase10-access';
+const s3SecretKey = 'phase10-secret-key';
+const databaseMarker = 'database-survived-from-s3-backup';
+const objectMarker = 'storage-object-survived-off-cluster';
+const jwtSecret = 'phase10-jwt-secret-that-is-at-least-thirty-two-characters';
+const serviceRoleKey = createJwt('service_role');
+const persistenceTarget = {
+  endpoint: minioPodEndpoint,
+  region: 'us-east-1',
+  bucket: physicalBucket,
+  credentials: { source: 'control-plane', name: 'S3_PERSISTENCE' },
+  forcePathStyle: true,
+} as const;
+const manifest = {
+  environments: {
+    local: {
+      deployment: {
+        compute: { provider: 'local' },
+        runtime: {
+          provider: 'minikube',
+          profile,
+          driver: 'docker',
+          cpus: 2,
+          memoryMiB: 5_120,
+        },
+      },
+      database: {
+        provider: 'supabase',
+        tier: 'prod',
+        backup: { mode: 'scheduled', target: persistenceTarget, intervalHours: 24 },
+      },
+      auth: { provider: 'supabase' },
+      objectStorage: {
+        provider: 'supabase',
+        buckets: [logicalBucket],
+        backend: persistenceTarget,
+      },
+      networking: { publicBaseUrl: baseUrl },
+    },
+  },
+  modules: [],
+} as const satisfies InfraManifest;
+
+test.skipIf(process.env.ANKH_INFRA_MINIKUBE_SUPABASE_RECOVERY_E2E !== '1')(
+  'recovers a fresh Minikube Supabase database while S3-backed Storage remains off-cluster',
+  async () => {
+    await stopMinioAsync();
+    await startMinioAsync();
+    try {
+      const dependencies = createDependencies();
+      const firstUp = requireSuccess(
+        await upInfraEnvironmentAsync({ projectId, manifest }, dependencies),
+      );
+      await writeDatabaseMarkerAsync();
+      await uploadStorageObjectAsync();
+      await forceFreshBackupAsync();
+      expect(await readLatestBackupPointerAsync()).toMatch(/^database\/\d{8}T\d{6}Z$/);
+
+      const destroyed = requireSuccess(
+        await destroyInfraEnvironmentAsync(
+          createDestroyRequest(firstUp.ledger, clusterPersistentIdentities(firstUp.ledger)),
+          dependencies,
+        ),
+      );
+      expectRetainedStorageBucket(destroyed.ledger);
+
+      const recovered = requireSuccess(
+        await upInfraEnvironmentAsync({ projectId, manifest }, dependencies),
+      );
+      expect(await readDatabaseMarkerAsync()).toBe(databaseMarker);
+      expect(await downloadStorageObjectAsync()).toBe(objectMarker);
+
+      const finalDestroy = requireSuccess(
+        await destroyInfraEnvironmentAsync(
+          createDestroyRequest(recovered.ledger, clusterPersistentIdentities(recovered.ledger)),
+          dependencies,
+        ),
+      );
+      expectRetainedStorageBucket(finalDestroy.ledger);
+    } catch (error) {
+      const diagnostics = await collectFailureDiagnosticsAsync();
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`${message}\nRecovery diagnostics: ${diagnostics}`, { cause: error });
+    } finally {
+      await runAllowFailureAsync(['minikube', 'delete', '-p', profile]);
+      await stopMinioAsync();
+    }
+  },
+  1_200_000,
+);
+
+async function startMinioAsync(): Promise<void> {
+  await runAsync(
+    [
+      'docker',
+      'run',
+      '--detach',
+      '--rm',
+      '--name',
+      minioContainer,
+      '--publish',
+      '19000:9000',
+      '--env',
+      `MINIO_ROOT_USER=${s3AccessKey}`,
+      '--env',
+      `MINIO_ROOT_PASSWORD=${s3SecretKey}`,
+      minioImage,
+      'server',
+      '/data',
+      '--address',
+      ':9000',
+    ],
+    'start MinIO',
+  );
+  await waitForMinioAsync();
+  await runAsync(
+    [
+      'curl',
+      '--fail',
+      '--silent',
+      '--show-error',
+      '--request',
+      'PUT',
+      '--aws-sigv4',
+      'aws:amz:us-east-1:s3',
+      '--user',
+      `${s3AccessKey}:${s3SecretKey}`,
+      `${minioHostEndpoint}/${physicalBucket}`,
+    ],
+    'create MinIO bucket',
+  );
+}
+
+async function waitForMinioAsync(): Promise<void> {
+  for (const _attempt of Array.from({ length: 60 }, (_, index) => index)) {
+    const response = await fetch(`${minioHostEndpoint}/minio/health/live`).catch(() => undefined);
+    if (response?.ok === true) return;
+    await Bun.sleep(500);
+  }
+  throw new Error('MinIO did not become ready.');
+}
+
+async function stopMinioAsync(): Promise<void> {
+  await runAllowFailureAsync(['docker', 'rm', '--force', minioContainer]);
+}
+
+async function writeDatabaseMarkerAsync(): Promise<void> {
+  const pod = await findPodAsync('supabase-db-', 'supabase-db-backup-');
+  await runAsync(
+    [
+      'kubectl',
+      'exec',
+      '--namespace',
+      namespace,
+      pod,
+      '--',
+      'psql',
+      '-U',
+      'postgres',
+      '-d',
+      'postgres',
+      '-v',
+      'ON_ERROR_STOP=1',
+      '-c',
+      `CREATE TABLE public.phase10_recovery_marker(value text NOT NULL); INSERT INTO public.phase10_recovery_marker(value) VALUES ('${databaseMarker}');`,
+    ],
+    'write database recovery marker',
+  );
+}
+
+async function readDatabaseMarkerAsync(): Promise<string> {
+  const pod = await findPodAsync('supabase-db-', 'supabase-db-backup-');
+  return runAsync(
+    [
+      'kubectl',
+      'exec',
+      '--namespace',
+      namespace,
+      pod,
+      '--',
+      'psql',
+      '-U',
+      'postgres',
+      '-d',
+      'postgres',
+      '-Atc',
+      'SELECT value FROM public.phase10_recovery_marker LIMIT 1;',
+    ],
+    'read database recovery marker',
+  );
+}
+
+async function uploadStorageObjectAsync(): Promise<void> {
+  const response = await fetch(`${baseUrl}/storage/v1/object/${logicalBucket}/recovery.txt`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${serviceRoleKey}`,
+      apikey: serviceRoleKey,
+      'Content-Type': 'text/plain',
+    },
+    body: objectMarker,
+  });
+  if (!response.ok) throw new Error(`Storage upload failed with HTTP ${response.status}.`);
+}
+
+async function downloadStorageObjectAsync(): Promise<string> {
+  const response = await fetch(`${baseUrl}/storage/v1/object/${logicalBucket}/recovery.txt`, {
+    headers: { Authorization: `Bearer ${serviceRoleKey}`, apikey: serviceRoleKey },
+  });
+  if (!response.ok) throw new Error(`Storage download failed with HTTP ${response.status}.`);
+  return response.text();
+}
+
+async function forceFreshBackupAsync(): Promise<void> {
+  await runAsync(
+    ['kubectl', 'rollout', 'restart', 'deployment/supabase-db-backup', '--namespace', namespace],
+    'restart database backup workload',
+  );
+  await runAsync(
+    [
+      'kubectl',
+      'rollout',
+      'status',
+      'deployment/supabase-db-backup',
+      '--namespace',
+      namespace,
+      '--timeout=180s',
+    ],
+    'wait for database backup workload',
+  );
+}
+
+async function readLatestBackupPointerAsync(): Promise<string> {
+  return runAsync(
+    [
+      'curl',
+      '--fail',
+      '--silent',
+      '--show-error',
+      '--aws-sigv4',
+      'aws:amz:us-east-1:s3',
+      '--user',
+      `${s3AccessKey}:${s3SecretKey}`,
+      `${minioHostEndpoint}/${physicalBucket}/database/latest`,
+    ],
+    'read latest database backup pointer',
+  );
+}
+
+async function findPodAsync(prefix: string, excludedPrefix?: string): Promise<string> {
+  const names = (
+    await runAsync(
+      [
+        'kubectl',
+        'get',
+        'pods',
+        '--namespace',
+        namespace,
+        '-o',
+        'jsonpath={.items[*].metadata.name}',
+      ],
+      'list Supabase pods',
+    )
+  ).split(' ');
+  const name = names.find(
+    (candidate) => candidate.startsWith(prefix) && !candidate.startsWith(excludedPrefix ?? '\0'),
+  );
+  if (name === undefined) throw new Error(`No pod matched ${prefix}.`);
+  return name;
+}
+
+async function collectFailureDiagnosticsAsync(): Promise<string> {
+  const [
+    auth,
+    storageStatus,
+    buckets,
+    databaseState,
+    databaseLogs,
+    previousDatabaseLogs,
+    dataRestoreState,
+    dataRestoreLogs,
+    previousDataRestoreLogs,
+  ] = await Promise.all([
+    readEndpointDiagnosticAsync('/auth/v1/health', false),
+    readEndpointDiagnosticAsync('/storage/v1/status', false),
+    readEndpointDiagnosticAsync('/storage/v1/bucket', true),
+    readDatabaseStateAsync(),
+    readDatabaseLogsAsync(false),
+    readDatabaseLogsAsync(true),
+    readDataRestoreStateAsync(),
+    readDataRestoreLogsAsync(false),
+    readDataRestoreLogsAsync(true),
+  ]);
+  return [
+    auth,
+    storageStatus,
+    buckets,
+    databaseState,
+    databaseLogs,
+    previousDatabaseLogs,
+    dataRestoreState,
+    dataRestoreLogs,
+    previousDataRestoreLogs,
+  ].join(' | ');
+}
+
+async function readDatabaseStateAsync(): Promise<string> {
+  const pod = await findPodAsync('supabase-db-', 'supabase-db-backup-').catch(() => undefined);
+  if (pod === undefined) return 'database-state=unavailable';
+  const state = await runAsync(
+    [
+      'kubectl',
+      'get',
+      'pod',
+      pod,
+      '--namespace',
+      namespace,
+      '-o',
+      'jsonpath={.status.containerStatuses[?(@.name=="supabase-db")].restartCount}',
+    ],
+    'read database restart state',
+  ).catch((error: unknown) => (error instanceof Error ? error.message : String(error)));
+  return `database-restarts=${redactDiagnosticText(state)}`;
+}
+
+async function readDatabaseLogsAsync(previous: boolean): Promise<string> {
+  const pod = await findPodAsync('supabase-db-', 'supabase-db-backup-').catch(() => undefined);
+  const label = previous ? 'database-previous-logs' : 'database-logs';
+  if (pod === undefined) return `${label}=unavailable`;
+  const logs = await runAsync(
+    [
+      'kubectl',
+      'logs',
+      '--namespace',
+      namespace,
+      pod,
+      '--container',
+      'supabase-db',
+      ...(previous ? ['--previous'] : []),
+      '--tail=240',
+    ],
+    `read ${label}`,
+  ).catch((error: unknown) => (error instanceof Error ? error.message : String(error)));
+  return `${label}=${redactDiagnosticText(logs).slice(-6_000)}`;
+}
+
+async function readDataRestoreStateAsync(): Promise<string> {
+  const pod = await findPodAsync('supabase-db-data-restore-').catch(() => undefined);
+  if (pod === undefined) return 'data-restore-state=unavailable';
+  const state = await runAsync(
+    [
+      'kubectl',
+      'get',
+      'pod',
+      pod,
+      '--namespace',
+      namespace,
+      '-o',
+      'jsonpath={.status.containerStatuses[?(@.name=="supabase-db-data-restore")].restartCount}',
+    ],
+    'read data restore restart state',
+  ).catch((error: unknown) => (error instanceof Error ? error.message : String(error)));
+  return `data-restore-restarts=${redactDiagnosticText(state)}`;
+}
+
+async function readDataRestoreLogsAsync(previous: boolean): Promise<string> {
+  const pod = await findPodAsync('supabase-db-data-restore-').catch(() => undefined);
+  const label = previous ? 'data-restore-previous-logs' : 'data-restore-logs';
+  if (pod === undefined) return `${label}=unavailable`;
+  const logs = await runAsync(
+    [
+      'kubectl',
+      'logs',
+      '--namespace',
+      namespace,
+      pod,
+      '--container',
+      'supabase-db-data-restore',
+      ...(previous ? ['--previous'] : []),
+      '--tail=240',
+    ],
+    `read ${label}`,
+  ).catch((error: unknown) => (error instanceof Error ? error.message : String(error)));
+  return `${label}=${redactDiagnosticText(logs).slice(-6_000)}`;
+}
+
+async function readEndpointDiagnosticAsync(path: string, authenticated: boolean): Promise<string> {
+  const response = await fetch(`${baseUrl}${path}`, {
+    headers: authenticated
+      ? { Authorization: `Bearer ${serviceRoleKey}`, apikey: serviceRoleKey }
+      : undefined,
+  }).catch(() => undefined);
+  if (response === undefined) return `${path}=unreachable`;
+  const body = redactDiagnosticText((await response.text()).slice(0, 500));
+  return `${path}=${response.status}:${body}`;
+}
+
+function redactDiagnosticText(value: string): string {
+  return value
+    .replaceAll(s3SecretKey, '[redacted]')
+    .replaceAll(serviceRoleKey, '[redacted]')
+    .replaceAll(jwtSecret, '[redacted]');
+}
+
+function createDependencies(): InfraOrchestrationDependencies {
+  return {
+    adapterResolver: createNodeInfraAdapterPackageResolver(),
+    credentials: {
+      resolveAsync: ({ name }) =>
+        Promise.resolve(
+          name === 'SUPABASE_BOOTSTRAP'
+            ? success(supabaseCredentials())
+            : name === 'S3_PERSISTENCE'
+              ? success({ accessKeyId: s3AccessKey, secretAccessKey: s3SecretKey })
+              : failure('unexpected-credential', `Unexpected credential reference: ${name}`),
+        ),
+    },
+    secrets: {
+      resolveAsync: ({ ref, key }) =>
+        Promise.resolve(failure('unexpected-secret', `Unexpected managed secret ${ref}/${key}.`)),
+    },
+  };
+}
+
+function createDestroyRequest(
+  previous: InfraLedger,
+  confirmedResources: readonly InfraResourceIdentity[],
+) {
+  return {
+    projectId,
+    manifest,
+    environment: 'local' as const,
+    previous,
+    confirmation: { projectId, environment: 'local' as const },
+    persistence: { policy: 'delete' as const, confirmedResources },
+  };
+}
+
+function clusterPersistentIdentities(ledger: InfraLedger): readonly InfraResourceIdentity[] {
+  return ledger.resources
+    .filter(({ identity, persistent }) => persistent && identity.adapter !== 'supabase')
+    .map(({ identity }) => identity);
+}
+
+function expectRetainedStorageBucket(ledger: InfraLedger | null): void {
+  expect(
+    ledger?.resources.map(({ identity }) => `${identity.adapter}:${identity.resourceId}`),
+  ).toEqual([`supabase:bucket/${logicalBucket}`]);
+}
+
+function supabaseCredentials() {
+  return {
+    postgresPassword: 'phase10-postgres-password',
+    jwtSecret,
+    anonKey: createJwt('anon'),
+    serviceRoleKey,
+    realtimeSecretKeyBase: 'r'.repeat(64),
+    realtimeDatabaseEncryptionKey: '0123456789abcdef',
+    pgMetaCryptoKey: 'phase10-meta-crypto-key-that-is-at-least-32-characters',
+  } as const;
+}
+
+function createJwt(role: 'anon' | 'service_role'): string {
+  const header = encodeJwtPart({ alg: 'HS256', typ: 'JWT' });
+  const payload = encodeJwtPart({ role, iss: 'supabase', iat: 1_700_000_000, exp: 4_102_444_800 });
+  const unsigned = `${header}.${payload}`;
+  const signature = createHmac('sha256', jwtSecret).update(unsigned).digest('base64url');
+  return `${unsigned}.${signature}`;
+}
+
+function encodeJwtPart(value: Readonly<Record<string, string | number>>): string {
+  return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+
+async function runAsync(command: readonly string[], label: string): Promise<string> {
+  const process = Bun.spawn(command, { stdout: 'pipe', stderr: 'pipe' });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    process.exited,
+    new Response(process.stdout).text(),
+    new Response(process.stderr).text(),
+  ]);
+  if (exitCode !== 0) throw new Error(`${label} failed: ${stderr.trim()}`);
+  return stdout.trim();
+}
+
+async function runAllowFailureAsync(command: readonly string[]): Promise<void> {
+  const process = Bun.spawn(command, { stdout: 'ignore', stderr: 'ignore' });
+  await process.exited;
+}
+
+function requireSuccess<T>(result: InfraResult<T>): T {
+  if (!result.ok) throw new Error(result.diagnostics.map(({ message }) => message).join(' '));
+  return result.value;
+}
+
+function success<T>(value: T): InfraResult<T> {
+  return { ok: true, value, diagnostics: [] };
+}
+
+function failure(code: string, message: string): InfraResult<never> {
+  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };
+}

package/src/prepareInfraServices.test.ts

@@ -0,0 +1,50 @@
+import type {
+  InfraExecutionContext,
+  InfraResult,
+  InfraServiceAdapter,
+} from '@ankhorage/contracts/infra';
+import { INFRA_ADAPTER_CATALOG } from '@ankhorage/contracts/infra';
+import { expect, it } from 'bun:test';
+
+import { prepareInfraServicesAsync } from './features/environment-lifecycle/application/use-cases/prepareInfraServicesAsync';
+
+it('leaves services without preparation unchanged', async () => {
+  const service: InfraServiceAdapter = {
+    descriptor: INFRA_ADAPTER_CATALOG.cerbos,
+    validateAsync: () => success(null),
+    planAsync: () => success([]),
+    desiredWorkloadsAsync: () => success([]),
+    reconcileAsync: () => success({ resources: [], outputs: [] }),
+    statusAsync: () => success([]),
+    destroyAsync: () => success({ resources: [], outputs: [] }),
+  };
+
+  expect(await prepareInfraServicesAsync(createContext(), [service])).toEqual({
+    ok: true,
+    value: null,
+    diagnostics: [],
+  });
+});
+
+function createContext(): InfraExecutionContext {
+  return {
+    projectId: 'fixture',
+    environment: 'local',
+    desired: {
+      deployment: {
+        compute: { provider: 'local' },
+        runtime: { provider: 'docker-compose' },
+      },
+    },
+    credentials: {
+      findAsync: () => success(null),
+      resolveAsync: () => success({}),
+      persistAsync: () => success(null),
+    },
+    secrets: { resolveAsync: () => success('secret') },
+  };
+}
+
+function success<T>(value: T): Promise<InfraResult<T>> {
+  return Promise.resolve({ ok: true, value, diagnostics: [] });
+}