@ankhorage/infra 7.0.0 → 7.1.1

package/dist/types/infraCli.d.ts

@@ -2,6 +2,7 @@ import type { AnkhCapabilityId } from '@ankhorage/contracts/cli';
 import type { AppEnvironmentId } from '@ankhorage/contracts/environments';
 import type { InfraEnvironmentSpec } from '@ankhorage/contracts/infra';
 import type { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';
+import type { removeStoredInfraCredentialsAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraCredentialsAsync.js';
 import type { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';
 import type { writeInfraGeneratedArtifactsAsync } from '../features/environment-lifecycle/adapters/outbound/writeInfraGeneratedArtifactsAsync.js';
 import type { writeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/writeStoredInfraStateAsync.js';
@@ -60,6 +61,10 @@ export interface InfraLifecycleOperations {
     readonly down: typeof downInfraEnvironmentAsync;
     readonly destroy: typeof destroyInfraEnvironmentAsync;
 }
+interface InfraDependencyScope {
+    readonly projectPath: string;
+    readonly environment: AppEnvironmentId;
+}
 export interface InfraCommandServices {
     readonly resolveProject: (options: {
         readonly cwd: string;
@@ -68,9 +73,10 @@ export interface InfraCommandServices {
     readonly readState: typeof readStoredInfraStateAsync;
     readonly writeState: typeof writeStoredInfraStateAsync;
     readonly removeState: typeof removeStoredInfraStateAsync;
+    readonly removeCredentials: typeof removeStoredInfraCredentialsAsync;
     readonly writeArtifacts: typeof writeInfraGeneratedArtifactsAsync;
     readonly operations: InfraLifecycleOperations;
-    readonly createDependencies: (context: InfraCommandContext) => InfraOrchestrationDependencies;
+    readonly createDependencies: (context: InfraCommandContext, scope: InfraDependencyScope) => InfraOrchestrationDependencies;
 }
 export interface RunInfraCommandOptions {
     readonly services?: Partial<InfraCommandServices>;

package/dist/types/infraCli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infraCli.d.ts","sourceRoot":"","sources":["../../src/types/infraCli.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kFAAkF,CAAC;AAClI,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AACtI,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAClJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mFAAmF,CAAC;AACpI,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,yFAAyF,CAAC;AAC5I,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sFAAsF,CAAC;AACtI,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0FAA0F,CAAC;AAC9I,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uFAAuF,CAAC;AACxI,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sFAAsF,CAAC;AACtI,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wFAAwF,CAAC;AAC1I,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oFAAoF,CAAC;AAClI,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0FAA0F,CAAC;AAC9I,OAAO,KAAK,EACV,qBAAqB,EACrB,8BAA8B,EAC9B,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,KAAK,gBAAgB,GACnB,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAEtF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;CAC1C;AAED,KAAK,0BAA0B,GAAG,CAChC,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,oBAAoB,KAC3B,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,0BAA0B,CAAC;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,OAAO,6BAA6B,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,OAAO,yBAAyB,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,OAAO,6BAA6B,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,OAAO,uBAAuB,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,OAAO,2BAA2B,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,OAAO,0BAA0B,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,OAAO,yBAAyB,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,OAAO,4BAA4B,CAAC;CACvD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,yBAAyB,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,OAAO,0BAA0B,CAAC;IACvD,QAAQ,CAAC,WAAW,EAAE,OAAO,2BAA2B,CAAC;IACzD,QAAQ,CAAC,cAAc,EAAE,OAAO,iCAAiC,CAAC;IAClE,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,8BAA8B,CAAC;CAC/F;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACnD;AAED,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,sBAAsB,KAC7B,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,8BAA8B,CAAC;CACvD"}
+{"version":3,"file":"infraCli.d.ts","sourceRoot":"","sources":["../../src/types/infraCli.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kFAAkF,CAAC;AAClI,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAClJ,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AACtI,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAClJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mFAAmF,CAAC;AACpI,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,yFAAyF,CAAC;AAC5I,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sFAAsF,CAAC;AACtI,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0FAA0F,CAAC;AAC9I,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uFAAuF,CAAC;AACxI,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sFAAsF,CAAC;AACtI,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wFAAwF,CAAC;AAC1I,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oFAAoF,CAAC;AAClI,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0FAA0F,CAAC;AAC9I,OAAO,KAAK,EACV,qBAAqB,EACrB,8BAA8B,EAC9B,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,KAAK,gBAAgB,GACnB,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAEtF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;CAC1C;AAED,KAAK,0BAA0B,GAAG,CAChC,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,oBAAoB,KAC3B,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,0BAA0B,CAAC;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,OAAO,6BAA6B,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,OAAO,yBAAyB,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,OAAO,6BAA6B,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,OAAO,uBAAuB,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,OAAO,2BAA2B,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,OAAO,0BAA0B,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,OAAO,yBAAyB,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,OAAO,4BAA4B,CAAC;CACvD;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;CACxC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,yBAAyB,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,OAAO,0BAA0B,CAAC;IACvD,QAAQ,CAAC,WAAW,EAAE,OAAO,2BAA2B,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,iCAAiC,CAAC;IACrE,QAAQ,CAAC,cAAc,EAAE,OAAO,iCAAiC,CAAC;IAClE,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,oBAAoB,KACxB,8BAA8B,CAAC;CACrC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACnD;AAED,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,sBAAsB,KAC7B,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,8BAA8B,CAAC;CACvD"}

package/dist/types/infraCli.js.map

@@ -1 +1 @@
-{"version":3,"file":"infraCli.js","sourceRoot":"","sources":["../../src/types/infraCli.ts"],"names":[],"mappings":"","sourcesContent":["import type { AnkhCapabilityId } from '@ankhorage/contracts/cli';\nimport type { AppEnvironmentId } from '@ankhorage/contracts/environments';\nimport type { InfraEnvironmentSpec } from '@ankhorage/contracts/infra';\n\nimport type { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';\nimport type { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';\nimport type { writeInfraGeneratedArtifactsAsync } from '../features/environment-lifecycle/adapters/outbound/writeInfraGeneratedArtifactsAsync.js';\nimport type { writeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/writeStoredInfraStateAsync.js';\nimport type { destroyInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.js';\nimport type { downInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/downInfraEnvironmentAsync.js';\nimport type { generateInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/generateInfraEnvironmentAsync.js';\nimport type { getInfraEnvironmentOutputs } from '../features/environment-lifecycle/application/use-cases/getInfraEnvironmentOutputs.js';\nimport type { planInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/planInfraEnvironmentAsync.js';\nimport type { statusInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/statusInfraEnvironmentAsync.js';\nimport type { upInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.js';\nimport type { validateInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/validateInfraEnvironmentAsync.js';\nimport type {\n  InfraOperationRequest,\n  InfraOrchestrationDependencies,\n  InfraStoredState,\n} from './infraOrchestration.js';\nimport type { ResolvedInfraProject } from './infraProject.js';\n\ntype InfraCommandName =\n  'validate' | 'plan' | 'generate' | 'up' | 'status' | 'outputs' | 'down' | 'destroy';\n\nexport interface InfraCommandContext {\n  readonly cwd: string;\n  readonly env: Readonly<Record<string, string | undefined>>;\n  readonly version: string;\n  writeStdout(text: string): void;\n  writeStderr(text: string): void;\n}\n\nexport interface InfraCommandRunResult {\n  readonly exitCode: number;\n}\n\nexport interface ParsedInfraArguments {\n  readonly projectId?: string;\n  readonly environment?: AppEnvironmentId;\n  readonly format: 'human' | 'json' | 'env';\n  readonly confirmation?: string;\n  readonly deleteResources: readonly string[];\n}\n\nexport interface InfraCommandRunRequest {\n  readonly context: InfraCommandContext;\n  readonly arguments: ParsedInfraArguments;\n}\n\ntype InfraCommandImplementation = (\n  request: InfraCommandRunRequest,\n  services: InfraCommandServices,\n) => Promise<InfraCommandRunResult>;\n\nexport interface InfraCommandDefinition {\n  readonly capability: AnkhCapabilityId;\n  readonly path: readonly [InfraCommandName];\n  readonly standaloneName: InfraCommandName;\n  readonly summary: string;\n  readonly run: InfraCommandImplementation;\n}\n\nexport interface InfraCommandInvocation {\n  readonly argv: readonly string[];\n  readonly command: InfraCommandDefinition;\n  readonly context: InfraCommandContext;\n}\n\nexport interface InfraLifecycleOperations {\n  readonly validate: typeof validateInfraEnvironmentAsync;\n  readonly plan: typeof planInfraEnvironmentAsync;\n  readonly generate: typeof generateInfraEnvironmentAsync;\n  readonly up: typeof upInfraEnvironmentAsync;\n  readonly status: typeof statusInfraEnvironmentAsync;\n  readonly outputs: typeof getInfraEnvironmentOutputs;\n  readonly down: typeof downInfraEnvironmentAsync;\n  readonly destroy: typeof destroyInfraEnvironmentAsync;\n}\n\nexport interface InfraCommandServices {\n  readonly resolveProject: (options: {\n    readonly cwd: string;\n    readonly projectId?: string;\n  }) => Promise<ResolvedInfraProject>;\n  readonly readState: typeof readStoredInfraStateAsync;\n  readonly writeState: typeof writeStoredInfraStateAsync;\n  readonly removeState: typeof removeStoredInfraStateAsync;\n  readonly writeArtifacts: typeof writeInfraGeneratedArtifactsAsync;\n  readonly operations: InfraLifecycleOperations;\n  readonly createDependencies: (context: InfraCommandContext) => InfraOrchestrationDependencies;\n}\n\nexport interface RunInfraCommandOptions {\n  readonly services?: Partial<InfraCommandServices>;\n}\n\nexport interface CreateInfraRuntimeProviderOptions {\n  readonly runCommandImpl?: RunInfraCommandImpl;\n  readonly services?: Partial<InfraCommandServices>;\n}\n\nexport type RunInfraCommandImpl = (\n  request: InfraCommandInvocation,\n  options?: RunInfraCommandOptions,\n) => Promise<InfraCommandRunResult>;\n\nexport interface PreparedInfraCommandOperation {\n  readonly project: ResolvedInfraProject;\n  readonly state: InfraStoredState | null;\n  readonly desired: InfraEnvironmentSpec;\n  readonly operation: InfraOperationRequest;\n  readonly dependencies: InfraOrchestrationDependencies;\n}\n"]}
+{"version":3,"file":"infraCli.js","sourceRoot":"","sources":["../../src/types/infraCli.ts"],"names":[],"mappings":"","sourcesContent":["import type { AnkhCapabilityId } from '@ankhorage/contracts/cli';\nimport type { AppEnvironmentId } from '@ankhorage/contracts/environments';\nimport type { InfraEnvironmentSpec } from '@ankhorage/contracts/infra';\n\nimport type { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';\nimport type { removeStoredInfraCredentialsAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraCredentialsAsync.js';\nimport type { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';\nimport type { writeInfraGeneratedArtifactsAsync } from '../features/environment-lifecycle/adapters/outbound/writeInfraGeneratedArtifactsAsync.js';\nimport type { writeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/writeStoredInfraStateAsync.js';\nimport type { destroyInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.js';\nimport type { downInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/downInfraEnvironmentAsync.js';\nimport type { generateInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/generateInfraEnvironmentAsync.js';\nimport type { getInfraEnvironmentOutputs } from '../features/environment-lifecycle/application/use-cases/getInfraEnvironmentOutputs.js';\nimport type { planInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/planInfraEnvironmentAsync.js';\nimport type { statusInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/statusInfraEnvironmentAsync.js';\nimport type { upInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.js';\nimport type { validateInfraEnvironmentAsync } from '../features/environment-lifecycle/application/use-cases/validateInfraEnvironmentAsync.js';\nimport type {\n  InfraOperationRequest,\n  InfraOrchestrationDependencies,\n  InfraStoredState,\n} from './infraOrchestration.js';\nimport type { ResolvedInfraProject } from './infraProject.js';\n\ntype InfraCommandName =\n  'validate' | 'plan' | 'generate' | 'up' | 'status' | 'outputs' | 'down' | 'destroy';\n\nexport interface InfraCommandContext {\n  readonly cwd: string;\n  readonly env: Readonly<Record<string, string | undefined>>;\n  readonly version: string;\n  writeStdout(text: string): void;\n  writeStderr(text: string): void;\n}\n\nexport interface InfraCommandRunResult {\n  readonly exitCode: number;\n}\n\nexport interface ParsedInfraArguments {\n  readonly projectId?: string;\n  readonly environment?: AppEnvironmentId;\n  readonly format: 'human' | 'json' | 'env';\n  readonly confirmation?: string;\n  readonly deleteResources: readonly string[];\n}\n\nexport interface InfraCommandRunRequest {\n  readonly context: InfraCommandContext;\n  readonly arguments: ParsedInfraArguments;\n}\n\ntype InfraCommandImplementation = (\n  request: InfraCommandRunRequest,\n  services: InfraCommandServices,\n) => Promise<InfraCommandRunResult>;\n\nexport interface InfraCommandDefinition {\n  readonly capability: AnkhCapabilityId;\n  readonly path: readonly [InfraCommandName];\n  readonly standaloneName: InfraCommandName;\n  readonly summary: string;\n  readonly run: InfraCommandImplementation;\n}\n\nexport interface InfraCommandInvocation {\n  readonly argv: readonly string[];\n  readonly command: InfraCommandDefinition;\n  readonly context: InfraCommandContext;\n}\n\nexport interface InfraLifecycleOperations {\n  readonly validate: typeof validateInfraEnvironmentAsync;\n  readonly plan: typeof planInfraEnvironmentAsync;\n  readonly generate: typeof generateInfraEnvironmentAsync;\n  readonly up: typeof upInfraEnvironmentAsync;\n  readonly status: typeof statusInfraEnvironmentAsync;\n  readonly outputs: typeof getInfraEnvironmentOutputs;\n  readonly down: typeof downInfraEnvironmentAsync;\n  readonly destroy: typeof destroyInfraEnvironmentAsync;\n}\n\ninterface InfraDependencyScope {\n  readonly projectPath: string;\n  readonly environment: AppEnvironmentId;\n}\n\nexport interface InfraCommandServices {\n  readonly resolveProject: (options: {\n    readonly cwd: string;\n    readonly projectId?: string;\n  }) => Promise<ResolvedInfraProject>;\n  readonly readState: typeof readStoredInfraStateAsync;\n  readonly writeState: typeof writeStoredInfraStateAsync;\n  readonly removeState: typeof removeStoredInfraStateAsync;\n  readonly removeCredentials: typeof removeStoredInfraCredentialsAsync;\n  readonly writeArtifacts: typeof writeInfraGeneratedArtifactsAsync;\n  readonly operations: InfraLifecycleOperations;\n  readonly createDependencies: (\n    context: InfraCommandContext,\n    scope: InfraDependencyScope,\n  ) => InfraOrchestrationDependencies;\n}\n\nexport interface RunInfraCommandOptions {\n  readonly services?: Partial<InfraCommandServices>;\n}\n\nexport interface CreateInfraRuntimeProviderOptions {\n  readonly runCommandImpl?: RunInfraCommandImpl;\n  readonly services?: Partial<InfraCommandServices>;\n}\n\nexport type RunInfraCommandImpl = (\n  request: InfraCommandInvocation,\n  options?: RunInfraCommandOptions,\n) => Promise<InfraCommandRunResult>;\n\nexport interface PreparedInfraCommandOperation {\n  readonly project: ResolvedInfraProject;\n  readonly state: InfraStoredState | null;\n  readonly desired: InfraEnvironmentSpec;\n  readonly operation: InfraOperationRequest;\n  readonly dependencies: InfraOrchestrationDependencies;\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "7.0.0",
+  "version": "7.1.1",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -35,7 +35,8 @@
     "openapi"
   ],
   "dependencies": {
-    "@ankhorage/contracts": "^21.0.0"
+    "@ankhorage/contracts": "^21.0.0",
+    "@ankhorage/utility": "^1.2.0"
   },
   "files": [
     "dist",
@@ -120,7 +121,7 @@
     "@ankhorage/minikube": "^0.4.4",
     "@ankhorage/paradox": "^0.1.24",
     "@ankhorage/r2": "^0.2.0",
-    "@ankhorage/supabase": "^0.5.9",
+    "@ankhorage/supabase": "^0.5.10",
     "@ankhorage/supabase-vault": "^0.3.1",
     "@types/bun": "^1.4.1",
     "@types/node": "^25.6.0",

package/src/cli/commands/destroy.ts

@@ -35,6 +35,7 @@ export const destroy = {
     await services.writeArtifacts(operation.project.projectPath, [], operation.state?.ledger);
     if (result.value.ledger === null) {
       await services.removeState(operation.project.projectPath, environment);
+      await services.removeCredentials(operation.project.projectPath, environment);
     } else {
       await services.writeState(operation.project.projectPath, {
         schemaVersion: 1,

package/src/cli/utils/prepareInfraCommandOperationAsync.ts

@@ -37,7 +37,10 @@ export async function prepareInfraCommandOperationAsync(
       ...(request.arguments.environment === undefined ? {} : { environment }),
       ...(state === null ? {} : { previous: state.ledger, previousDesired: state.desired }),
     },
-    dependencies: services.createDependencies(request.context),
+    dependencies: services.createDependencies(request.context, {
+      projectPath: project.projectPath,
+      environment,
+    }),
   };
 }
 

package/src/features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort.ts

@@ -0,0 +1,182 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+import type { AppEnvironmentId } from '@ankhorage/contracts/environments';
+import type {
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
+  InfraResult,
+} from '@ankhorage/contracts/infra';
+import { isRecord, isRecordOf } from '@ankhorage/utility/object';
+
+import { createInfraFailure } from '../../utils/createInfraFailure.js';
+import { normalizeInfraEnvironmentKey } from '../../utils/normalizeInfraEnvironmentKey.js';
+import { resolveInfraEnvironmentStateDirectory } from '../../utils/resolveInfraEnvironmentStateDirectory.js';
+import { createEnvironmentInfraCredentialPort } from './createEnvironmentInfraCredentialPort.js';
+
+/*** Resolve explicit environment overrides before durable project-local bootstrap credentials. */
+export function createProjectInfraCredentialPort(
+  options: ProjectInfraCredentialPortOptions,
+): InfraCredentialPort {
+  const environmentPort = createEnvironmentInfraCredentialPort(options.processEnvironment);
+  return {
+    findAsync: (reference) => findProjectCredentialAsync(options, environmentPort, reference),
+    async resolveAsync(reference) {
+      const found = await findProjectCredentialAsync(options, environmentPort, reference);
+      if (!found.ok) return found;
+      if (found.value !== null) {
+        return { ok: true, value: found.value, diagnostics: found.diagnostics };
+      }
+      return missingCredential(reference.name);
+    },
+    async persistAsync(reference, values) {
+      if (!isStringRecord(values)) {
+        return createInfraFailure(
+          'infra-control-plane-credential-invalid',
+          `Control-plane credential ${reference.name} must contain only string fields.`,
+        );
+      }
+      return writeStoredCredentialAsync(options, reference, values);
+    },
+  };
+}
+
+interface ProjectInfraCredentialPortOptions {
+  readonly projectPath: string;
+  readonly environment: AppEnvironmentId;
+  readonly processEnvironment: Readonly<Record<string, string | undefined>>;
+}
+
+interface StoredCredentialBundle {
+  readonly schemaVersion: 1;
+  readonly name: string;
+  readonly values: Readonly<Record<string, string>>;
+}
+
+/*** Resolve environment precedence before falling through to project-local state. */
+async function findProjectCredentialAsync(
+  options: ProjectInfraCredentialPortOptions,
+  environmentPort: InfraCredentialPort,
+  reference: InfraControlPlaneCredentialRef,
+): Promise<InfraResult<Readonly<Record<string, string>> | null>> {
+  const overridden = await environmentPort.findAsync(reference);
+  if (!overridden.ok || overridden.value !== null) return overridden;
+  return readStoredCredentialAsync(options, reference);
+}
+
+/*** Read one exact credential bundle without enumerating or exposing sibling credentials. */
+async function readStoredCredentialAsync(
+  options: ProjectInfraCredentialPortOptions,
+  reference: InfraControlPlaneCredentialRef,
+): Promise<InfraResult<Readonly<Record<string, string>> | null>> {
+  const credentialPath = resolveCredentialPath(options, reference.name);
+  try {
+    const parsed: unknown = JSON.parse(await fs.readFile(credentialPath, 'utf8'));
+    if (!isStoredCredentialBundle(parsed) || parsed.name !== reference.name) {
+      return invalidCredentialStore(reference.name);
+    }
+    return { ok: true, value: parsed.values, diagnostics: [] };
+  } catch (error) {
+    if (isMissingFile(error)) return { ok: true, value: null, diagnostics: [] };
+    if (error instanceof SyntaxError) return invalidCredentialStore(reference.name);
+    return createInfraFailure(
+      'infra-control-plane-credential-store-read-failed',
+      `Control-plane credential ${reference.name} could not be read from project state.`,
+    );
+  }
+}
+
+/*** Persist one opaque bundle atomically with restrictive local-host permissions. */
+async function writeStoredCredentialAsync(
+  options: ProjectInfraCredentialPortOptions,
+  reference: InfraControlPlaneCredentialRef,
+  values: Readonly<Record<string, string>>,
+): Promise<InfraResult<null>> {
+  const credentialPath = resolveCredentialPath(options, reference.name);
+  const directory = path.dirname(credentialPath);
+  const temporaryPath = `${credentialPath}.${process.pid}.${randomUUID()}.tmp`;
+  const stored: StoredCredentialBundle = { schemaVersion: 1, name: reference.name, values };
+  try {
+    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    await restrictPermissionsAsync(directory, 0o700);
+    await fs.writeFile(temporaryPath, `${JSON.stringify(stored, null, 2)}\n`, {
+      encoding: 'utf8',
+      mode: 0o600,
+      flag: 'wx',
+    });
+    await fs.rename(temporaryPath, credentialPath);
+    await restrictPermissionsAsync(credentialPath, 0o600);
+    return { ok: true, value: null, diagnostics: [] };
+  } catch {
+    await removeTemporaryCredentialAsync(temporaryPath);
+    return createInfraFailure(
+      'infra-control-plane-credential-store-write-failed',
+      `Control-plane credential ${reference.name} could not be persisted to project state.`,
+    );
+  }
+}
+
+/*** Remove an abandoned unique temporary credential file without masking the original write failure. */
+async function removeTemporaryCredentialAsync(temporaryPath: string): Promise<void> {
+  try {
+    await fs.rm(temporaryPath, { force: true });
+  } catch {
+    return;
+  }
+}
+
+/*** Resolve one credential to an opaque hash-named file inside its project/environment scope. */
+function resolveCredentialPath(options: ProjectInfraCredentialPortOptions, name: string): string {
+  const digest = createHash('sha256').update(name).digest('hex');
+  return path.join(
+    resolveInfraEnvironmentStateDirectory(options.projectPath, options.environment),
+    'credentials',
+    `${digest}.json`,
+  );
+}
+
+/*** Apply owner-only permissions where the host platform supports POSIX file modes. */
+async function restrictPermissionsAsync(targetPath: string, mode: number): Promise<void> {
+  if (process.platform !== 'win32') await fs.chmod(targetPath, mode);
+}
+
+/*** Create the canonical missing-credential diagnostic after every trusted source was checked. */
+function missingCredential(name: string): InfraResult<never> {
+  const prefixedName = `ANKH_INFRA_CREDENTIAL_${normalizeInfraEnvironmentKey(name)}`;
+  return createInfraFailure(
+    'infra-control-plane-credential-missing',
+    `Control-plane credential ${name} is unavailable. Set ${name} or ${prefixedName}.`,
+  );
+}
+
+/*** Reject malformed persisted state without exposing or replacing any stored value. */
+function invalidCredentialStore(name: string): InfraResult<never> {
+  return createInfraFailure(
+    'infra-control-plane-credential-store-invalid',
+    `Stored control-plane credential ${name} has an invalid project-state shape.`,
+  );
+}
+
+/*** Recognize the private stored credential record. */
+function isStoredCredentialBundle(value: unknown): value is StoredCredentialBundle {
+  if (!isRecord(value)) return false;
+  return (
+    value.schemaVersion === 1 && typeof value.name === 'string' && isStringRecord(value.values)
+  );
+}
+
+/*** Recognize string-only opaque provider credential bundles. */
+function isStringRecord(value: unknown): value is Readonly<Record<string, string>> {
+  return isRecordOf(value, isString);
+}
+
+/*** Narrow one unknown value to a string. */
+function isString(value: unknown): value is string {
+  return typeof value === 'string';
+}
+
+/*** Recognize only the filesystem's absent-file failure. */
+function isMissingFile(error: unknown): boolean {
+  return isRecord(error) && error.code === 'ENOENT';
+}

package/src/features/environment-lifecycle/adapters/outbound/removeStoredInfraCredentialsAsync.ts

@@ -0,0 +1,18 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+import type { AppEnvironmentId } from '@ankhorage/contracts/environments';
+
+import { resolveInfraEnvironmentStateDirectory } from '../../utils/resolveInfraEnvironmentStateDirectory.js';
+
+/*** Remove only persisted generated credential state for one explicit project environment. */
+export async function removeStoredInfraCredentialsAsync(
+  projectPath: string,
+  environment: AppEnvironmentId,
+): Promise<void> {
+  const credentialDirectory = path.join(
+    resolveInfraEnvironmentStateDirectory(projectPath, environment),
+    'credentials',
+  );
+  await fs.rm(credentialDirectory, { recursive: true, force: true });
+}

package/src/features/environment-lifecycle/composition/createInfraCommandServices.ts

@@ -1,8 +1,9 @@
 import type { InfraCommandServices } from '../../../types/infraCli.js';
-import { createEnvironmentInfraCredentialPort } from '../adapters/outbound/createEnvironmentInfraCredentialPort.js';
 import { createEnvironmentInfraSecretPort } from '../adapters/outbound/createEnvironmentInfraSecretPort.js';
 import { createNodeInfraAdapterPackageResolver } from '../adapters/outbound/createNodeInfraAdapterPackageResolver.js';
+import { createProjectInfraCredentialPort } from '../adapters/outbound/createProjectInfraCredentialPort.js';
 import { readStoredInfraStateAsync } from '../adapters/outbound/readStoredInfraStateAsync.js';
+import { removeStoredInfraCredentialsAsync } from '../adapters/outbound/removeStoredInfraCredentialsAsync.js';
 import { removeStoredInfraStateAsync } from '../adapters/outbound/removeStoredInfraStateAsync.js';
 import { resolveInfraProjectAsync } from '../adapters/outbound/resolveInfraProjectAsync.js';
 import { writeInfraGeneratedArtifactsAsync } from '../adapters/outbound/writeInfraGeneratedArtifactsAsync.js';
@@ -25,6 +26,7 @@ export function createInfraCommandServices(
     readState: overrides.readState ?? readStoredInfraStateAsync,
     writeState: overrides.writeState ?? writeStoredInfraStateAsync,
     removeState: overrides.removeState ?? removeStoredInfraStateAsync,
+    removeCredentials: overrides.removeCredentials ?? removeStoredInfraCredentialsAsync,
     writeArtifacts: overrides.writeArtifacts ?? writeInfraGeneratedArtifactsAsync,
     operations: overrides.operations ?? {
       validate: validateInfraEnvironmentAsync,
@@ -38,9 +40,13 @@ export function createInfraCommandServices(
     },
     createDependencies:
       overrides.createDependencies ??
-      ((context) => ({
+      ((context, scope) => ({
         adapterResolver: createNodeInfraAdapterPackageResolver(),
-        credentials: createEnvironmentInfraCredentialPort(context.env),
+        credentials: createProjectInfraCredentialPort({
+          projectPath: scope.projectPath,
+          environment: scope.environment,
+          processEnvironment: context.env,
+        }),
         secrets: createEnvironmentInfraSecretPort(context.env),
       })),
   };

package/src/features/environment-lifecycle/composition/createProjectInfraLifecycle.ts

@@ -1,9 +1,10 @@
-import type { InfraEnvironmentSpec, InfraManifest } from '@ankhorage/contracts/infra';
+import type { InfraEnvironmentSpec, InfraManifest, InfraResult } from '@ankhorage/contracts/infra';
 
 import { INFRA_PACKAGE_VERSION } from '../../../constants.js';
 import type { InfraOperationRequest, InfraStoredState } from '../../../types/infraOrchestration.js';
 import type {
   CreateProjectInfraLifecycleOptions,
+  ProjectInfraDestroyRequest,
   ProjectInfraLifecycle,
   ProjectInfraOperationRequest,
 } from '../../../types/infraProject.js';
@@ -72,6 +73,9 @@ export function createProjectInfraLifecycle(
     async destroyAsync(request) {
       const state = await services.readState(request.projectPath, request.environment);
       if (state === null) {
+        const safety = validateCredentialStateDestroy(request);
+        if (!safety.ok) return safety;
+        await services.removeCredentials(request.projectPath, request.environment);
         return {
           ok: true,
           value: { environment: request.environment, ledger: null },
@@ -89,9 +93,10 @@ export function createProjectInfraLifecycle(
       );
       if (!result.ok) return result;
       await services.writeArtifacts(request.projectPath, [], prepared.state?.ledger);
-      if (result.value.ledger === null)
+      if (result.value.ledger === null) {
         await services.removeState(request.projectPath, request.environment);
-      else {
+        await services.removeCredentials(request.projectPath, request.environment);
+      } else {
         await services.writeState(request.projectPath, {
           schemaVersion: 1,
           desired: prepared.desired,
@@ -142,10 +147,34 @@ async function prepareProjectOperationAsync(
       ...(state === null ? {} : { previous: state.ledger, previousDesired: state.desired }),
       ...(request.signal === undefined ? {} : { signal: request.signal }),
     },
-    dependencies: services.createDependencies(context),
+    dependencies: services.createDependencies(context, {
+      projectPath: request.projectPath,
+      environment: request.environment,
+    }),
   };
 }
 
+/*** Require exact scope confirmation before deleting orphaned project credential state. */
+function validateCredentialStateDestroy(request: ProjectInfraDestroyRequest): InfraResult<null> {
+  if (
+    request.confirmation.projectId !== request.projectId ||
+    request.confirmation.environment !== request.environment
+  ) {
+    return {
+      ok: false,
+      diagnostics: [
+        {
+          severity: 'error',
+          code: 'infra-destroy-confirmation-mismatch',
+          message:
+            'Infra destroy confirmation must exactly match the selected project and environment.',
+        },
+      ],
+    };
+  }
+  return { ok: true, value: null, diagnostics: [] };
+}
+
 /*** Read one exact environment without inventing a fallback. */
 function readEnvironment(
   manifest: InfraManifest,

package/src/features/environment-lifecycle/utils/resolveInfraEnvironmentStateDirectory.ts

@@ -0,0 +1,16 @@
+import type { AppEnvironmentId } from '@ankhorage/contracts/environments';
+import { APP_ENVIRONMENT_IDS } from '@ankhorage/contracts/environments';
+import path from 'path';
+
+/*** Build the canonical project-local state directory for one closed Infra environment. */
+export function resolveInfraEnvironmentStateDirectory(
+  projectPath: string,
+  environment: AppEnvironmentId,
+): string {
+  if (!APP_ENVIRONMENT_IDS.includes(environment)) {
+    throw new Error(`Invalid Infra state environment: ${environment}`);
+  }
+  return path.join(projectPath, INFRA_STATE_ROOT, environment);
+}
+
+const INFRA_STATE_ROOT = '.ankh/infra';

package/src/features/environment-lifecycle/utils/resolveInfraStatePath.ts

@@ -1,12 +1,9 @@
-import { APP_ENVIRONMENT_IDS, type AppEnvironmentId } from '@ankhorage/contracts/environments';
+import type { AppEnvironmentId } from '@ankhorage/contracts/environments';
 import path from 'path';
 
-const INFRA_STATE_ROOT = '.ankh/infra';
+import { resolveInfraEnvironmentStateDirectory } from './resolveInfraEnvironmentStateDirectory.js';
 
 /*** Build an exact state-file path from a closed canonical environment identifier. */
 export function resolveInfraStatePath(projectPath: string, environment: AppEnvironmentId): string {
-  if (!APP_ENVIRONMENT_IDS.includes(environment)) {
-    throw new Error(`Invalid Infra state environment: ${environment}`);
-  }
-  return path.join(projectPath, INFRA_STATE_ROOT, environment, 'state.json');
+  return path.join(resolveInfraEnvironmentStateDirectory(projectPath, environment), 'state.json');
 }

package/src/hetznerK3sProduction.test.ts

@@ -1,4 +1,6 @@
 import type {
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
   InfraLedger,
   InfraManifest,
   InfraResourceIdentity,
@@ -230,9 +232,7 @@ function createDependencies(fixture: ProductionFixture): InfraOrchestrationDepen
         }
       },
     },
-    credentials: {
-      resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
-    },
+    credentials: createCredentialPort(),
     secrets: {
       resolveAsync: () =>
         Promise.resolve({
@@ -245,6 +245,32 @@ function createDependencies(fixture: ProductionFixture): InfraOrchestrationDepen
   };
 }
 
+function createCredentialPort(): InfraCredentialPort {
+  return {
+    findAsync: (reference) => Promise.resolve(findCredential(reference)),
+    resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
+    persistAsync: (reference) =>
+      Promise.resolve({
+        ok: false,
+        diagnostics: [
+          {
+            severity: 'error',
+            code: 'unexpected-credential-persist',
+            message: `Production fixture must not persist credential ${reference.name}.`,
+          },
+        ],
+      }),
+  };
+}
+
+function findCredential(
+  reference: InfraControlPlaneCredentialRef,
+): InfraResult<Readonly<Record<string, string>> | null> {
+  return reference.name === 'SUPABASE_BOOTSTRAP'
+    ? resolveCredential(reference.name)
+    : success(null);
+}
+
 function resolveCredential(name: string): InfraResult<Readonly<Record<string, string>>> {
   if (name === 'HCLOUD_TOKEN') return success({ token: 'phase10-hcloud-token' });
   if (name === 'HETZNER_SSH') {

package/src/hetznerK3sSupabaseR2.test.ts

@@ -1,4 +1,9 @@
-import type { InfraManifest, InfraResult } from '@ankhorage/contracts/infra';
+import type {
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
+  InfraManifest,
+  InfraResult,
+} from '@ankhorage/contracts/infra';
 import {
   createInfraAdapter as createHetznerInfraAdapter,
   type HetznerCloudApi,
@@ -189,9 +194,7 @@ function createDependencies(fixture: ProductionR2Fixture): InfraOrchestrationDep
         }
       },
     },
-    credentials: {
-      resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
-    },
+    credentials: createCredentialPort(),
     secrets: {
       resolveAsync: () =>
         Promise.resolve({
@@ -204,6 +207,32 @@ function createDependencies(fixture: ProductionR2Fixture): InfraOrchestrationDep
   };
 }
 
+function createCredentialPort(): InfraCredentialPort {
+  return {
+    findAsync: (reference) => Promise.resolve(findCredential(reference)),
+    resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
+    persistAsync: (reference) =>
+      Promise.resolve({
+        ok: false,
+        diagnostics: [
+          {
+            severity: 'error',
+            code: 'unexpected-credential-persist',
+            message: `Production fixture must not persist credential ${reference.name}.`,
+          },
+        ],
+      }),
+  };
+}
+
+function findCredential(
+  reference: InfraControlPlaneCredentialRef,
+): InfraResult<Readonly<Record<string, string>> | null> {
+  return reference.name === 'SUPABASE_BOOTSTRAP'
+    ? resolveCredential(reference.name)
+    : success(null);
+}
+
 function resolveCredential(name: string): InfraResult<Readonly<Record<string, string>>> {
   if (name === 'HCLOUD_TOKEN') return success({ token: 'phase10-hcloud-token' });
   if (name === 'HETZNER_SSH') {