@ankhorage/infra 7.1.0 → 7.1.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @ankhorage/infra
 
+## 7.1.1
+
+### Patch Changes
+
+- 7440682: Expose the project-scoped credential port constructor from `@ankhorage/infra/project` for downstream host composition without exposing credential storage details.
+
 ## 7.1.0
 
 ### Minor Changes

package/dist/project/index.d.ts

@@ -1,3 +1,4 @@
+export { createProjectInfraCredentialPort } from '../features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort.js';
 export { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';
 export { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';
 export { resolveInfraProjectAsync } from '../features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';

package/dist/project/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kFAAkF,CAAC;AAC7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AACjI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iFAAiF,CAAC;AAC3H,OAAO,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,MAAM,mFAAmF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC;AACnG,YAAY,EACV,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yFAAyF,CAAC;AAC3I,OAAO,EAAE,yBAAyB,EAAE,MAAM,kFAAkF,CAAC;AAC7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AACjI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iFAAiF,CAAC;AAC3H,OAAO,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,MAAM,mFAAmF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC;AACnG,YAAY,EACV,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,0BAA0B,CAAC"}

package/dist/project/index.js

@@ -1,3 +1,4 @@
+export { createProjectInfraCredentialPort } from '../features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort.js';
 export { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';
 export { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';
 export { resolveInfraProjectAsync } from '../features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';

package/dist/project/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kFAAkF,CAAC;AAC7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AACjI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iFAAiF,CAAC;AAC3H,OAAO,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,MAAM,mFAAmF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC","sourcesContent":["export { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';\nexport { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';\nexport { resolveInfraProjectAsync } from '../features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';\nexport { writeInfraGeneratedArtifactsAsync } from '../features/environment-lifecycle/adapters/outbound/writeInfraGeneratedArtifactsAsync.js';\nexport { writeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/writeStoredInfraStateAsync.js';\nexport { createProjectInfraLifecycle } from '../features/environment-lifecycle/composition/createProjectInfraLifecycle.js';\nexport { resolveProjectFile } from '../features/environment-lifecycle/utils/resolveProjectFile.js';\nexport type {\n  CreateProjectInfraLifecycleOptions,\n  InfraArtifactWriteResult,\n  ProjectInfraDestroyRequest,\n  ProjectInfraLifecycle,\n  ProjectInfraOperationRequest,\n  ResolvedInfraProject,\n} from '../types/infraProject.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yFAAyF,CAAC;AAC3I,OAAO,EAAE,yBAAyB,EAAE,MAAM,kFAAkF,CAAC;AAC7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AACjI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iFAAiF,CAAC;AAC3H,OAAO,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,MAAM,mFAAmF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC","sourcesContent":["export { createProjectInfraCredentialPort } from '../features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort.js';\nexport { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';\nexport { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';\nexport { resolveInfraProjectAsync } from '../features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';\nexport { writeInfraGeneratedArtifactsAsync } from '../features/environment-lifecycle/adapters/outbound/writeInfraGeneratedArtifactsAsync.js';\nexport { writeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/writeStoredInfraStateAsync.js';\nexport { createProjectInfraLifecycle } from '../features/environment-lifecycle/composition/createProjectInfraLifecycle.js';\nexport { resolveProjectFile } from '../features/environment-lifecycle/utils/resolveProjectFile.js';\nexport type {\n  CreateProjectInfraLifecycleOptions,\n  InfraArtifactWriteResult,\n  ProjectInfraDestroyRequest,\n  ProjectInfraLifecycle,\n  ProjectInfraOperationRequest,\n  ResolvedInfraProject,\n} from '../types/infraProject.js';\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "7.1.0",
+  "version": "7.1.1",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -121,7 +121,7 @@
     "@ankhorage/minikube": "^0.4.4",
     "@ankhorage/paradox": "^0.1.24",
     "@ankhorage/r2": "^0.2.0",
-    "@ankhorage/supabase": "^0.5.9",
+    "@ankhorage/supabase": "^0.5.10",
     "@ankhorage/supabase-vault": "^0.3.1",
     "@types/bun": "^1.4.1",
     "@types/node": "^25.6.0",

package/src/hetznerK3sProduction.test.ts

@@ -1,4 +1,6 @@
 import type {
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
   InfraLedger,
   InfraManifest,
   InfraResourceIdentity,
@@ -230,9 +232,7 @@ function createDependencies(fixture: ProductionFixture): InfraOrchestrationDepen
         }
       },
     },
-    credentials: {
-      resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
-    },
+    credentials: createCredentialPort(),
     secrets: {
       resolveAsync: () =>
         Promise.resolve({
@@ -245,6 +245,32 @@ function createDependencies(fixture: ProductionFixture): InfraOrchestrationDepen
   };
 }
 
+function createCredentialPort(): InfraCredentialPort {
+  return {
+    findAsync: (reference) => Promise.resolve(findCredential(reference)),
+    resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
+    persistAsync: (reference) =>
+      Promise.resolve({
+        ok: false,
+        diagnostics: [
+          {
+            severity: 'error',
+            code: 'unexpected-credential-persist',
+            message: `Production fixture must not persist credential ${reference.name}.`,
+          },
+        ],
+      }),
+  };
+}
+
+function findCredential(
+  reference: InfraControlPlaneCredentialRef,
+): InfraResult<Readonly<Record<string, string>> | null> {
+  return reference.name === 'SUPABASE_BOOTSTRAP'
+    ? resolveCredential(reference.name)
+    : success(null);
+}
+
 function resolveCredential(name: string): InfraResult<Readonly<Record<string, string>>> {
   if (name === 'HCLOUD_TOKEN') return success({ token: 'phase10-hcloud-token' });
   if (name === 'HETZNER_SSH') {

package/src/hetznerK3sSupabaseR2.test.ts

@@ -1,4 +1,9 @@
-import type { InfraManifest, InfraResult } from '@ankhorage/contracts/infra';
+import type {
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
+  InfraManifest,
+  InfraResult,
+} from '@ankhorage/contracts/infra';
 import {
   createInfraAdapter as createHetznerInfraAdapter,
   type HetznerCloudApi,
@@ -189,9 +194,7 @@ function createDependencies(fixture: ProductionR2Fixture): InfraOrchestrationDep
         }
       },
     },
-    credentials: {
-      resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
-    },
+    credentials: createCredentialPort(),
     secrets: {
       resolveAsync: () =>
         Promise.resolve({
@@ -204,6 +207,32 @@ function createDependencies(fixture: ProductionR2Fixture): InfraOrchestrationDep
   };
 }
 
+function createCredentialPort(): InfraCredentialPort {
+  return {
+    findAsync: (reference) => Promise.resolve(findCredential(reference)),
+    resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
+    persistAsync: (reference) =>
+      Promise.resolve({
+        ok: false,
+        diagnostics: [
+          {
+            severity: 'error',
+            code: 'unexpected-credential-persist',
+            message: `Production fixture must not persist credential ${reference.name}.`,
+          },
+        ],
+      }),
+  };
+}
+
+function findCredential(
+  reference: InfraControlPlaneCredentialRef,
+): InfraResult<Readonly<Record<string, string>> | null> {
+  return reference.name === 'SUPABASE_BOOTSTRAP'
+    ? resolveCredential(reference.name)
+    : success(null);
+}
+
 function resolveCredential(name: string): InfraResult<Readonly<Record<string, string>>> {
   if (name === 'HCLOUD_TOKEN') return success({ token: 'phase10-hcloud-token' });
   if (name === 'HETZNER_SSH') {

package/src/localDockerComposeProviders.integration.test.ts

@@ -1,6 +1,8 @@
-import { createHmac } from 'node:crypto';
+import { createHash } from 'node:crypto';
 
 import type {
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
   InfraLedger,
   InfraManifest,
   InfraResourceIdentity,
@@ -19,16 +21,7 @@ import type { InfraOrchestrationDependencies } from './types/infraOrchestration.
 const projectId = 'infra145-compose-providers';
 const baseUrl = 'http://127.0.0.1:54322';
 const bucket = 'phase9-acceptance';
-const jwtSecret = 'phase9-jwt-secret-that-is-at-least-thirty-two-characters';
-const credentials = {
-  postgresPassword: 'phase9-postgres-password',
-  jwtSecret,
-  anonKey: createJwt('anon'),
-  serviceRoleKey: createJwt('service_role'),
-  realtimeSecretKeyBase: 'r'.repeat(64),
-  realtimeDatabaseEncryptionKey: '0123456789abcdef',
-  pgMetaCryptoKey: 'phase9-meta-crypto-key-that-is-at-least-32-characters',
-} as const;
+const bootstrapCredential = { source: 'control-plane', name: 'SUPABASE_BOOTSTRAP' } as const;
 const manifest = {
   environments: {
     local: {
@@ -59,7 +52,8 @@ const manifest = {
 test.skipIf(process.env.ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E !== '1')(
   'runs Supabase and Cerbos through the provider-neutral Docker Compose lifecycle',
   async () => {
-    const dependencies = createDependencies();
+    const credentialPort = new MemoryCredentialPort();
+    const dependencies = createDependencies(credentialPort);
     let ledger: InfraLedger | undefined;
 
     try {
@@ -72,7 +66,10 @@ test.skipIf(process.env.ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E !== '1')(
         await upInfraEnvironmentAsync({ projectId, manifest }, dependencies),
       );
       ledger = firstLedger;
-      assertProviderNeutralOutputs(firstOutputs);
+      expect(credentialPort.persistCount).toBe(1);
+      const firstCredentials = credentialPort.readRequired();
+      const firstCredentialFingerprint = credentialFingerprint(firstCredentials);
+      assertProviderNeutralOutputs(firstOutputs, firstCredentials);
 
       const status = requireSuccess(
         await statusInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
@@ -98,7 +95,9 @@ test.skipIf(process.env.ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E !== '1')(
         await upInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
       );
       ledger = resumedLedger;
-      assertProviderNeutralOutputs(resumedOutputs);
+      expect(credentialPort.persistCount).toBe(1);
+      expect(credentialFingerprint(credentialPort.readRequired())).toBe(firstCredentialFingerprint);
+      assertProviderNeutralOutputs(resumedOutputs, firstCredentials);
 
       const health = await fetch(`${baseUrl}/auth/v1/health`);
       expect(health.ok).toBe(true);
@@ -123,20 +122,10 @@ test.skipIf(process.env.ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E !== '1')(
   900_000,
 );
 
-function createDependencies(): InfraOrchestrationDependencies {
+function createDependencies(credentials: InfraCredentialPort): InfraOrchestrationDependencies {
   return {
     adapterResolver: createNodeInfraAdapterPackageResolver(),
-    credentials: {
-      resolveAsync: (reference) =>
-        Promise.resolve(
-          reference.name === 'SUPABASE_BOOTSTRAP'
-            ? success(credentials)
-            : failure(
-                'unexpected-control-plane-credential',
-                `Unexpected control-plane credential ${reference.name}.`,
-              ),
-        ),
-    },
+    credentials,
     secrets: {
       resolveAsync: (reference) =>
         Promise.resolve(
@@ -149,6 +138,73 @@ function createDependencies(): InfraOrchestrationDependencies {
   };
 }
 
+class MemoryCredentialPort implements InfraCredentialPort {
+  private values: Readonly<Record<string, string>> | null = null;
+  persistCount = 0;
+
+  findAsync(
+    reference: InfraControlPlaneCredentialRef,
+  ): Promise<InfraResult<Readonly<Record<string, string>> | null>> {
+    if (reference.name !== bootstrapCredential.name) return Promise.resolve(success(null));
+    return Promise.resolve(success(this.values === null ? null : { ...this.values }));
+  }
+
+  resolveAsync(
+    reference: InfraControlPlaneCredentialRef,
+  ): Promise<InfraResult<Readonly<Record<string, string>>>> {
+    if (reference.name === bootstrapCredential.name && this.values !== null) {
+      return Promise.resolve(success({ ...this.values }));
+    }
+    return Promise.resolve(
+      failure(
+        'unexpected-control-plane-credential',
+        `Unexpected or missing control-plane credential ${reference.name}.`,
+      ),
+    );
+  }
+
+  persistAsync(
+    reference: InfraControlPlaneCredentialRef,
+    values: Readonly<Record<string, string>>,
+  ): Promise<InfraResult<null>> {
+    if (reference.name !== bootstrapCredential.name) {
+      return Promise.resolve(
+        failure(
+          'unexpected-control-plane-credential',
+          `Unexpected control-plane credential ${reference.name}.`,
+        ),
+      );
+    }
+    this.values = { ...values };
+    this.persistCount += 1;
+    return Promise.resolve(success(null));
+  }
+
+  readRequired(): Readonly<Record<string, string>> {
+    if (this.values === null) throw new Error('Expected generated Supabase bootstrap credentials.');
+    return { ...this.values };
+  }
+}
+
+function credentialFingerprint(values: Readonly<Record<string, string>>): string {
+  const canonical = Object.entries(values)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, value]) => `${key}\u0000${value}`)
+    .join('\u0001');
+  return createHash('sha256').update(canonical).digest('hex');
+}
+
+function privilegedCredentialValues(values: Readonly<Record<string, string>>): readonly string[] {
+  const { anonKey: _anonKey, ...privileged } = values;
+  return Object.values(privileged);
+}
+
+function readAnonKey(values: Readonly<Record<string, string>>): string {
+  const { anonKey } = values;
+  if (anonKey === undefined) throw new Error('Expected generated Supabase anonKey.');
+  return anonKey;
+}
+
 function createDestroyRequest(
   previous: InfraLedger,
   confirmedResources: readonly InfraResourceIdentity[],
@@ -167,14 +223,14 @@ function persistentIdentities(ledger: InfraLedger): readonly InfraResourceIdenti
   return ledger.resources.filter(({ persistent }) => persistent).map(({ identity }) => identity);
 }
 
-function assertProviderNeutralOutputs(outputs: InfraLedger['outputs']): void {
+function assertProviderNeutralOutputs(
+  outputs: InfraLedger['outputs'],
+  credentials: Readonly<Record<string, string>>,
+): void {
   const serialized = JSON.stringify(outputs);
-  expect(serialized).not.toContain(credentials.serviceRoleKey);
-  expect(serialized).not.toContain(credentials.postgresPassword);
-  expect(serialized).not.toContain(credentials.jwtSecret);
-  expect(serialized).not.toContain(credentials.realtimeSecretKeyBase);
-  expect(serialized).not.toContain(credentials.realtimeDatabaseEncryptionKey);
-  expect(serialized).not.toContain(credentials.pgMetaCryptoKey);
+  for (const secret of privilegedCredentialValues(credentials)) {
+    expect(serialized).not.toContain(secret);
+  }
   expect(serialized.toLowerCase()).not.toContain('kubernetes');
   expect(serialized.toLowerCase()).not.toContain('minikube');
   expect(
@@ -190,7 +246,7 @@ function assertProviderNeutralOutputs(outputs: InfraLedger['outputs']): void {
       ({ owner, environmentVariable, value }) =>
         owner.adapter === 'supabase' &&
         environmentVariable === 'EXPO_PUBLIC_SUPABASE_ANON_KEY' &&
-        value === credentials.anonKey,
+        value === readAnonKey(credentials),
     ),
   ).toBe(true);
   expect(
@@ -209,23 +265,6 @@ function assertProviderNeutralOutputs(outputs: InfraLedger['outputs']): void {
   ).toBe(true);
 }
 
-function createJwt(role: 'anon' | 'service_role'): string {
-  const encodedHeader = encodeJwtPart({ alg: 'HS256', typ: 'JWT' });
-  const encodedPayload = encodeJwtPart({
-    role,
-    iss: 'supabase',
-    iat: 1_700_000_000,
-    exp: 4_102_444_800,
-  });
-  const unsigned = `${encodedHeader}.${encodedPayload}`;
-  const signature = createHmac('sha256', jwtSecret).update(unsigned).digest('base64url');
-  return `${unsigned}.${signature}`;
-}
-
-function encodeJwtPart(value: Readonly<Record<string, string | number>>): string {
-  return Buffer.from(JSON.stringify(value)).toString('base64url');
-}
-
 function requireSuccess<T>(result: InfraResult<T>): T {
   if (!result.ok) throw new Error(result.diagnostics.map(({ message }) => message).join(' '));
   return result.value;

package/src/localK3sSupabase.test.ts

@@ -1,5 +1,9 @@
+import { createHash } from 'node:crypto';
+
 import type {
   InfraComputeTarget,
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
   InfraLedger,
   InfraManifest,
   InfraResourceIdentity,
@@ -38,6 +42,7 @@ import type { InfraOrchestrationDependencies } from './types/infraOrchestration.
 const projectId = 'infra164-local-k3s-supabase';
 const publicBaseUrl = 'http://127.0.0.1:54321';
 const bucket = 'infra164-bucket';
+const bootstrapCredential = { source: 'control-plane', name: 'SUPABASE_BOOTSTRAP' } as const;
 const target: Extract<InfraComputeTarget, { kind: 'local-host' }> = {
   id: 'local',
   kind: 'local-host',
@@ -73,6 +78,10 @@ test('runs local k3s and Supabase through the portable compute lifecycle', async
     await upInfraEnvironmentAsync({ projectId, manifest }, dependencies),
   );
   const firstLedger: InfraLedger = firstUp.ledger;
+  expect(fixture.credentials.persistCount).toBe(1);
+  const firstCredentials = fixture.credentials.readRequired();
+  const firstCredentialFingerprint = credentialFingerprint(firstCredentials);
+  assertPrivilegedValuesAbsent(firstUp, firstCredentials);
   expect(firstUp.targets).toEqual([target]);
   expect([...new Set(fixture.loadedPackages)].sort()).toEqual(
     [
@@ -88,8 +97,6 @@ test('runs local k3s and Supabase through the portable compute lifecycle', async
   expect(fixture.kubernetes.serializedResources()).toContain('/etc/postgresql-custom');
   expect(fixture.kubernetes.serializedResources()).toContain('.ankhorage-image-seeded');
   expect(fixture.supabase.buckets.has(bucket)).toBe(true);
-  expect(JSON.stringify(firstUp)).not.toContain('infra164-service-role-key');
-  expect(JSON.stringify(firstUp)).not.toContain('infra164-postgres-password');
 
   const outputs = requireSuccess(
     getInfraEnvironmentOutputs({
@@ -144,6 +151,11 @@ test('runs local k3s and Supabase through the portable compute lifecycle', async
   expect(fixture.k3s.state).toBe('ready');
   expect(resumed.targets).toEqual([target]);
   expect(resourceIdentities(resumed.resources)).toEqual(identitiesBeforeRestart);
+  expect(fixture.credentials.persistCount).toBe(1);
+  expect(credentialFingerprint(fixture.credentials.readRequired())).toBe(
+    firstCredentialFingerprint,
+  );
+  assertPrivilegedValuesAbsent(resumed, firstCredentials);
 
   const destroyed = requireSuccess(
     await destroyInfraEnvironmentAsync(
@@ -171,6 +183,7 @@ class LocalK3sFixture {
   readonly k3s = new FakeK3sControlPlane();
   readonly kubernetes = this.k3s.api;
   readonly supabase = new FakeSupabaseControlPlane();
+  readonly credentials = new MemoryCredentialPort();
   readonly loadedPackages: string[] = [];
 }
 
@@ -201,9 +214,7 @@ function createDependencies(fixture: LocalK3sFixture): InfraOrchestrationDepende
         }
       },
     },
-    credentials: {
-      resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
-    },
+    credentials: fixture.credentials,
     secrets: {
       resolveAsync: () =>
         Promise.resolve({
@@ -216,29 +227,72 @@ function createDependencies(fixture: LocalK3sFixture): InfraOrchestrationDepende
   };
 }
 
-function resolveCredential(name: string): InfraResult<Readonly<Record<string, string>>> {
-  if (name === 'SUPABASE_BOOTSTRAP') {
-    return success({
-      postgresPassword: 'infra164-postgres-password',
-      jwtSecret: 'infra164-jwt-secret-0123456789abcdef',
-      anonKey: 'infra164-anon-key',
-      serviceRoleKey: 'infra164-service-role-key',
-      realtimeSecretKeyBase:
-        'infra164-realtime-secret-key-base-0123456789abcdefghijklmnopqrstuvwxyz',
-      realtimeDatabaseEncryptionKey: '1234567890abcdef',
-      pgMetaCryptoKey: 'infra164-pg-meta-crypto-key-0123456789abcdef',
-    });
+class MemoryCredentialPort implements InfraCredentialPort {
+  private values: Readonly<Record<string, string>> | null = null;
+  persistCount = 0;
+
+  findAsync(
+    reference: InfraControlPlaneCredentialRef,
+  ): Promise<InfraResult<Readonly<Record<string, string>> | null>> {
+    if (reference.name !== bootstrapCredential.name) return Promise.resolve(success(null));
+    return Promise.resolve(success(this.values === null ? null : { ...this.values }));
+  }
+
+  resolveAsync(
+    reference: InfraControlPlaneCredentialRef,
+  ): Promise<InfraResult<Readonly<Record<string, string>>>> {
+    if (reference.name === bootstrapCredential.name && this.values !== null) {
+      return Promise.resolve(success({ ...this.values }));
+    }
+    return Promise.resolve(
+      failure(
+        'unexpected-credential',
+        `Unexpected or missing credential reference: ${reference.name}`,
+      ),
+    );
+  }
+
+  persistAsync(
+    reference: InfraControlPlaneCredentialRef,
+    values: Readonly<Record<string, string>>,
+  ): Promise<InfraResult<null>> {
+    if (reference.name !== bootstrapCredential.name) {
+      return Promise.resolve(
+        failure('unexpected-credential', `Unexpected credential reference: ${reference.name}`),
+      );
+    }
+    this.values = { ...values };
+    this.persistCount += 1;
+    return Promise.resolve(success(null));
+  }
+
+  readRequired(): Readonly<Record<string, string>> {
+    if (this.values === null) throw new Error('Expected generated Supabase bootstrap credentials.');
+    return { ...this.values };
+  }
+}
+
+function credentialFingerprint(values: Readonly<Record<string, string>>): string {
+  const canonical = Object.entries(values)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, value]) => `${key}\u0000${value}`)
+    .join('\u0001');
+  return createHash('sha256').update(canonical).digest('hex');
+}
+
+function privilegedCredentialValues(values: Readonly<Record<string, string>>): readonly string[] {
+  const { anonKey: _anonKey, ...privileged } = values;
+  return Object.values(privileged);
+}
+
+function assertPrivilegedValuesAbsent(
+  value: unknown,
+  credentials: Readonly<Record<string, string>>,
+): void {
+  const serialized = JSON.stringify(value);
+  for (const secret of privilegedCredentialValues(credentials)) {
+    expect(serialized).not.toContain(secret);
   }
-  return {
-    ok: false,
-    diagnostics: [
-      {
-        severity: 'error',
-        code: 'unexpected-credential',
-        message: `Unexpected credential reference: ${name}`,
-      },
-    ],
-  };
 }
 
 class FakeLocalHostProbe implements LocalHostProbe {
@@ -446,3 +500,7 @@ function requireSuccess<T>(result: InfraResult<T>): T {
 function success<T>(value: T): InfraResult<T> {
   return { ok: true, value, diagnostics: [] };
 }
+
+function failure(code: string, message: string): InfraResult<never> {
+  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };
+}

package/src/localMinikubeSupabase.integration.test.ts

@@ -1,4 +1,7 @@
-import { createHmac } from 'node:crypto';
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 
 import type {
   InfraLedger,
@@ -8,13 +11,8 @@ import type {
 } from '@ankhorage/contracts/infra';
 import { expect, test } from 'bun:test';
 
-import { createNodeInfraAdapterPackageResolver } from './features/environment-lifecycle/adapters/outbound/createNodeInfraAdapterPackageResolver.js';
-import { destroyInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/destroyInfraEnvironmentAsync.js';
-import { downInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/downInfraEnvironmentAsync.js';
-import { planInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/planInfraEnvironmentAsync.js';
-import { statusInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/statusInfraEnvironmentAsync.js';
-import { upInfraEnvironmentAsync } from './features/environment-lifecycle/application/use-cases/upInfraEnvironmentAsync.js';
-import type { InfraOrchestrationDependencies } from './types/infraOrchestration.js';
+import { createProjectInfraCredentialPort } from './features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort.js';
+import { createProjectInfraLifecycle } from './project/index.js';
 
 const projectId = 'infra145-minikube-supabase';
 const acceptanceNamespace = `${projectId}-local`;
@@ -23,15 +21,9 @@ const bucket = 'phase8-acceptance';
 const staleOwnedConfigMap = 'phase8-stale-owned';
 const unrelatedConfigMap = 'phase8-unrelated';
 const staleOwnedResourceId = 'stale:phase8-owned';
-const jwtSecret = 'phase8-jwt-secret-that-is-at-least-thirty-two-characters';
-const credentials = {
-  postgresPassword: 'phase8-postgres-password',
-  jwtSecret,
-  anonKey: createJwt('anon'),
-  serviceRoleKey: createJwt('service_role'),
-  realtimeSecretKeyBase: 'r'.repeat(64),
-  realtimeDatabaseEncryptionKey: '0123456789abcdef',
-  pgMetaCryptoKey: 'phase8-meta-crypto-key-that-is-at-least-32-characters',
+const bootstrapCredential = {
+  source: 'control-plane',
+  name: 'SUPABASE_BOOTSTRAP',
 } as const;
 const manifest = {
   environments: {
@@ -56,52 +48,60 @@ const manifest = {
 } as const satisfies InfraManifest;
 
 test.skipIf(process.env.ANKH_INFRA_MINIKUBE_SUPABASE_E2E !== '1')(
-  'runs local Minikube and Supabase through the provider-neutral lifecycle',
+  'bootstraps fresh local Minikube and Supabase through the project lifecycle',
   async () => {
-    const dependencies = createDependencies();
+    const projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'ankh-infra170-minikube-'));
+    const isolatedProjectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'ankh-infra170-isolated-'));
+    const request = createOperationRequest(projectPath);
     let ledger: InfraLedger | undefined;
+    let destroyed = false;
 
     try {
-      const initialPlan = requireSuccess(
-        await planInfraEnvironmentAsync({ projectId, manifest }, dependencies),
-      );
+      const firstLifecycle = createProjectInfraLifecycle();
+      const initialPlan = requireSuccess(await firstLifecycle.planAsync(request));
       expect(initialPlan.actions.some(({ operation }) => operation === 'create')).toBe(true);
 
-      const { ledger: firstLedger, outputs: firstOutputs } = requireSuccess(
-        await upInfraEnvironmentAsync({ projectId, manifest }, dependencies),
-      );
-      ledger = firstLedger;
-      assertSafePublicOutputs(firstOutputs);
+      const firstUp = requireSuccess(await firstLifecycle.upAsync(request));
+      ({ ledger } = firstUp);
+      const firstCredentials = await resolveBootstrapCredentialsAsync(projectPath);
+      const firstFingerprint = credentialFingerprint(firstCredentials);
+      assertSafePublicOutputs(firstUp.outputs, firstCredentials);
+      assertSecretFree(firstUp, firstCredentials);
+      await assertStoredStateSecretFreeAsync(projectPath, firstCredentials);
+      await assertCredentialFilePermissionsAsync(projectPath);
       expect(
-        firstOutputs.some(
+        firstUp.outputs.some(
           ({ owner, name, value }) =>
             owner.adapter === 'minikube' && name === 'localUrl' && value === baseUrl,
         ),
       ).toBe(true);
       expect(
-        firstOutputs.some(
+        firstUp.outputs.some(
           ({ environmentVariable, value }) =>
             environmentVariable === 'EXPO_PUBLIC_SUPABASE_URL' && value === baseUrl,
         ),
       ).toBe(true);
-      expect(firstOutputs.some(({ name, value }) => name === 'bucket' && value === bucket)).toBe(
+      expect(firstUp.outputs.some(({ name, value }) => name === 'bucket' && value === bucket)).toBe(
         true,
       );
 
-      const status = requireSuccess(
-        await statusInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
-      );
+      const secondLifecycle = createProjectInfraLifecycle();
+      const status = requireSuccess(await secondLifecycle.statusAsync(request));
       expect(status.state).toBe('ready');
 
-      const convergedPlan = requireSuccess(
-        await planInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
-      );
+      const convergedPlan = requireSuccess(await secondLifecycle.planAsync(request));
       expect(convergedPlan.actions.every(({ operation }) => operation === 'noop')).toBe(true);
+      assertSecretFree(convergedPlan, firstCredentials);
 
-      await createStaleOwnershipFixturesAsync();
-      const stalePlan = requireSuccess(
-        await planInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
+      const secondUp = requireSuccess(await secondLifecycle.upAsync(request));
+      ({ ledger } = secondUp);
+      expect(credentialFingerprint(await resolveBootstrapCredentialsAsync(projectPath))).toBe(
+        firstFingerprint,
       );
+      expect(resourceIdentities(secondUp.resources)).toEqual(resourceIdentities(firstUp.resources));
+
+      await createStaleOwnershipFixturesAsync();
+      const stalePlan = requireSuccess(await secondLifecycle.planAsync(request));
       expect(
         stalePlan.actions.some(
           ({ operation, owner }) =>
@@ -109,10 +109,8 @@ test.skipIf(process.env.ANKH_INFRA_MINIKUBE_SUPABASE_E2E !== '1')(
         ),
       ).toBe(true);
 
-      const { ledger: prunedLedger } = requireSuccess(
-        await upInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
-      );
-      ledger = prunedLedger;
+      const pruned = requireSuccess(await secondLifecycle.upAsync(request));
+      ({ ledger } = pruned);
       expect(await configMapExistsAsync(staleOwnedConfigMap)).toBe(false);
       expect(await configMapExistsAsync(unrelatedConfigMap)).toBe(true);
       await runKubectlAsync([
@@ -124,35 +122,53 @@ test.skipIf(process.env.ANKH_INFRA_MINIKUBE_SUPABASE_E2E !== '1')(
         '--ignore-not-found=true',
       ]);
 
-      const { ledger: downLedger } = requireSuccess(
-        await downInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
+      const down = requireSuccess(await secondLifecycle.downAsync(request));
+      ({ ledger } = down);
+      expect(credentialFingerprint(await resolveBootstrapCredentialsAsync(projectPath))).toBe(
+        firstFingerprint,
       );
-      ledger = downLedger;
 
-      const { ledger: resumedLedger, outputs: resumedOutputs } = requireSuccess(
-        await upInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
+      const resumedLifecycle = createProjectInfraLifecycle();
+      const resumed = requireSuccess(await resumedLifecycle.upAsync(request));
+      ({ ledger } = resumed);
+      expect(credentialFingerprint(await resolveBootstrapCredentialsAsync(projectPath))).toBe(
+        firstFingerprint,
       );
-      ledger = resumedLedger;
-      assertSafePublicOutputs(resumedOutputs);
+      assertSafePublicOutputs(resumed.outputs, firstCredentials);
+      assertSecretFree(resumed, firstCredentials);
+      await assertStoredStateSecretFreeAsync(projectPath, firstCredentials);
 
       const health = await fetch(`${baseUrl}/auth/v1/health`);
       expect(health.ok).toBe(true);
 
-      const destroyed = requireSuccess(
-        await destroyInfraEnvironmentAsync(
-          createDestroyRequest(ledger, persistentIdentities(ledger)),
-          dependencies,
-        ),
+      const isolatedPort = createProjectInfraCredentialPort({
+        projectPath: isolatedProjectPath,
+        environment: 'local',
+        processEnvironment: {},
+      });
+      expect(await isolatedPort.persistAsync(bootstrapCredential, firstCredentials)).toMatchObject({
+        ok: true,
+      });
+      const isolatedFingerprint = credentialFingerprint(
+        requireSuccess(await isolatedPort.resolveAsync(bootstrapCredential)),
       );
-      ledger = destroyed.ledger ?? undefined;
-      expect(destroyed.ledger).toBeNull();
+
+      const destroyResult = requireSuccess(
+        await resumedLifecycle.destroyAsync(createDestroyRequest(projectPath, ledger)),
+      );
+      ledger = undefined;
+      destroyed = true;
+      expect(destroyResult.ledger).toBeNull();
+      expect(await findBootstrapCredentialsAsync(projectPath)).toBeNull();
+      expect(
+        credentialFingerprint(requireSuccess(await isolatedPort.resolveAsync(bootstrapCredential))),
+      ).toBe(isolatedFingerprint);
     } finally {
-      if (ledger !== undefined) {
-        await destroyInfraEnvironmentAsync(
-          createDestroyRequest(ledger, persistentIdentities(ledger)),
-          dependencies,
-        );
+      if (!destroyed && ledger !== undefined) {
+        await createProjectInfraLifecycle().destroyAsync(createDestroyRequest(projectPath, ledger));
       }
+      await fs.rm(projectPath, { recursive: true, force: true });
+      await fs.rm(isolatedProjectPath, { recursive: true, force: true });
     }
   },
   900_000,
@@ -227,43 +243,24 @@ async function runKubectlAsync(args: readonly string[]): Promise<string> {
   return stdout.trim();
 }
 
-function createDependencies(): InfraOrchestrationDependencies {
+function createOperationRequest(projectPath: string) {
   return {
-    adapterResolver: createNodeInfraAdapterPackageResolver(),
-    credentials: {
-      resolveAsync: (reference) =>
-        Promise.resolve(
-          reference.name === 'SUPABASE_BOOTSTRAP'
-            ? success(credentials)
-            : failure(
-                'unexpected-control-plane-credential',
-                `Unexpected control-plane credential ${reference.name}.`,
-              ),
-        ),
-    },
-    secrets: {
-      resolveAsync: (reference) =>
-        Promise.resolve(
-          failure(
-            'unexpected-managed-secret',
-            `Unexpected managed secret ${reference.ref}/${reference.key}.`,
-          ),
-        ),
-    },
+    projectId,
+    projectPath,
+    manifest,
+    environment: 'local' as const,
+    executionEnvironment: {},
   };
 }
 
-function createDestroyRequest(
-  previous: InfraLedger,
-  confirmedResources: readonly InfraResourceIdentity[],
-) {
+function createDestroyRequest(projectPath: string, previous: InfraLedger) {
   return {
-    projectId,
-    manifest,
-    environment: 'local' as const,
-    previous,
+    ...createOperationRequest(projectPath),
     confirmation: { projectId, environment: 'local' as const },
-    persistence: { policy: 'delete' as const, confirmedResources },
+    persistence: {
+      policy: 'delete' as const,
+      confirmedResources: persistentIdentities(previous),
+    },
   };
 }
 
@@ -271,48 +268,104 @@ function persistentIdentities(ledger: InfraLedger): readonly InfraResourceIdenti
   return ledger.resources.filter(({ persistent }) => persistent).map(({ identity }) => identity);
 }
 
-function assertSafePublicOutputs(outputs: InfraLedger['outputs']): void {
+function resourceIdentities(
+  resources: readonly { readonly identity: InfraResourceIdentity }[],
+): readonly string[] {
+  return resources
+    .map(({ identity }) =>
+      [identity.projectId, identity.environment, identity.adapter, identity.resourceId].join(':'),
+    )
+    .sort();
+}
+
+async function resolveBootstrapCredentialsAsync(
+  projectPath: string,
+): Promise<Readonly<Record<string, string>>> {
+  const port = createProjectInfraCredentialPort({
+    projectPath,
+    environment: 'local',
+    processEnvironment: {},
+  });
+  return requireSuccess(await port.resolveAsync(bootstrapCredential));
+}
+
+async function findBootstrapCredentialsAsync(
+  projectPath: string,
+): Promise<Readonly<Record<string, string>> | null> {
+  const port = createProjectInfraCredentialPort({
+    projectPath,
+    environment: 'local',
+    processEnvironment: {},
+  });
+  return requireSuccess(await port.findAsync(bootstrapCredential));
+}
+
+function credentialFingerprint(values: Readonly<Record<string, string>>): string {
+  const canonical = Object.entries(values)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, value]) => `${key}\u0000${value}`)
+    .join('\u0001');
+  return createHash('sha256').update(canonical).digest('hex');
+}
+
+function privilegedCredentialValues(values: Readonly<Record<string, string>>): readonly string[] {
+  const { anonKey: _anonKey, ...privileged } = values;
+  return Object.values(privileged);
+}
+
+function assertSafePublicOutputs(
+  outputs: InfraLedger['outputs'],
+  credentials: Readonly<Record<string, string>>,
+): void {
   const serialized = JSON.stringify(outputs);
-  expect(serialized).not.toContain(credentials.serviceRoleKey);
-  expect(serialized).not.toContain(credentials.postgresPassword);
-  expect(serialized).not.toContain(credentials.jwtSecret);
-  expect(serialized).not.toContain(credentials.realtimeSecretKeyBase);
-  expect(serialized).not.toContain(credentials.realtimeDatabaseEncryptionKey);
-  expect(serialized).not.toContain(credentials.pgMetaCryptoKey);
+  for (const value of privilegedCredentialValues(credentials)) {
+    expect(serialized).not.toContain(value);
+  }
+  const { anonKey } = credentials;
+  if (anonKey === undefined) throw new Error('Expected generated Supabase anonKey.');
   expect(
     outputs.some(
       ({ environmentVariable, value }) =>
-        environmentVariable === 'EXPO_PUBLIC_SUPABASE_ANON_KEY' && value === credentials.anonKey,
+        environmentVariable === 'EXPO_PUBLIC_SUPABASE_ANON_KEY' && value === anonKey,
     ),
   ).toBe(true);
 }
 
-function createJwt(role: 'anon' | 'service_role'): string {
-  const encodedHeader = encodeJwtPart({ alg: 'HS256', typ: 'JWT' });
-  const encodedPayload = encodeJwtPart({
-    role,
-    iss: 'supabase',
-    iat: 1_700_000_000,
-    exp: 4_102_444_800,
-  });
-  const unsigned = `${encodedHeader}.${encodedPayload}`;
-  const signature = createHmac('sha256', jwtSecret).update(unsigned).digest('base64url');
-  return `${unsigned}.${signature}`;
+function assertSecretFree(value: unknown, credentials: Readonly<Record<string, string>>): void {
+  const serialized = JSON.stringify(value);
+  for (const secret of privilegedCredentialValues(credentials)) {
+    expect(serialized).not.toContain(secret);
+  }
 }
 
-function encodeJwtPart(value: Readonly<Record<string, string | number>>): string {
-  return Buffer.from(JSON.stringify(value)).toString('base64url');
+async function assertStoredStateSecretFreeAsync(
+  projectPath: string,
+  credentials: Readonly<Record<string, string>>,
+): Promise<void> {
+  const state = await fs.readFile(
+    path.join(projectPath, '.ankh', 'infra', 'local', 'state.json'),
+    'utf8',
+  );
+  for (const secret of privilegedCredentialValues(credentials)) {
+    expect(state).not.toContain(secret);
+  }
+}
+
+async function assertCredentialFilePermissionsAsync(projectPath: string): Promise<void> {
+  if (process.platform === 'win32') return;
+  const digest = createHash('sha256').update(bootstrapCredential.name).digest('hex');
+  const credentialPath = path.join(
+    projectPath,
+    '.ankh',
+    'infra',
+    'local',
+    'credentials',
+    `${digest}.json`,
+  );
+  expect((await fs.stat(credentialPath)).mode & 0o777).toBe(0o600);
 }
 
 function requireSuccess<T>(result: InfraResult<T>): T {
   if (!result.ok) throw new Error(result.diagnostics.map(({ message }) => message).join(' '));
   return result.value;
 }
-
-function success<T>(value: T): InfraResult<T> {
-  return { ok: true, value, diagnostics: [] };
-}
-
-function failure(code: string, message: string): InfraResult<never> {
-  return { ok: false, diagnostics: [{ severity: 'error', code, message }] };
-}

package/src/localMinikubeSupabaseRecovery.integration.test.ts

@@ -1,6 +1,8 @@
 import { createHmac } from 'node:crypto';
 
 import type {
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
   InfraLedger,
   InfraManifest,
   InfraResourceIdentity,
@@ -430,16 +432,7 @@ function redactDiagnosticText(value: string): string {
 function createDependencies(): InfraOrchestrationDependencies {
   return {
     adapterResolver: createNodeInfraAdapterPackageResolver(),
-    credentials: {
-      resolveAsync: ({ name }) =>
-        Promise.resolve(
-          name === 'SUPABASE_BOOTSTRAP'
-            ? success(supabaseCredentials())
-            : name === 'S3_PERSISTENCE'
-              ? success({ accessKeyId: s3AccessKey, secretAccessKey: s3SecretKey })
-              : failure('unexpected-credential', `Unexpected credential reference: ${name}`),
-        ),
-    },
+    credentials: createCredentialPort(),
     secrets: {
       resolveAsync: ({ ref, key }) =>
         Promise.resolve(failure('unexpected-secret', `Unexpected managed secret ${ref}/${key}.`)),
@@ -447,6 +440,40 @@ function createDependencies(): InfraOrchestrationDependencies {
   };
 }
 
+function createCredentialPort(): InfraCredentialPort {
+  return {
+    findAsync: (reference) => Promise.resolve(findCredential(reference)),
+    resolveAsync: (reference) => Promise.resolve(resolveCredential(reference)),
+    persistAsync: (reference) =>
+      Promise.resolve(
+        failure(
+          'unexpected-credential-persist',
+          `Recovery acceptance must not persist credential ${reference.name}.`,
+        ),
+      ),
+  };
+}
+
+function findCredential(
+  reference: InfraControlPlaneCredentialRef,
+): InfraResult<Readonly<Record<string, string>> | null> {
+  if (reference.name === 'SUPABASE_BOOTSTRAP') return success(supabaseCredentials());
+  if (reference.name === 'S3_PERSISTENCE') {
+    return success({ accessKeyId: s3AccessKey, secretAccessKey: s3SecretKey });
+  }
+  return success(null);
+}
+
+function resolveCredential(
+  reference: InfraControlPlaneCredentialRef,
+): InfraResult<Readonly<Record<string, string>>> {
+  if (reference.name === 'SUPABASE_BOOTSTRAP') return success(supabaseCredentials());
+  if (reference.name === 'S3_PERSISTENCE') {
+    return success({ accessKeyId: s3AccessKey, secretAccessKey: s3SecretKey });
+  }
+  return failure('unexpected-credential', `Unexpected credential reference: ${reference.name}`);
+}
+
 function createDestroyRequest(
   previous: InfraLedger,
   confirmedResources: readonly InfraResourceIdentity[],

package/src/project/index.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from 'bun:test';
 
 import {
+  createProjectInfraCredentialPort,
   createProjectInfraLifecycle,
   readStoredInfraStateAsync,
   resolveInfraProjectAsync,
@@ -8,7 +9,8 @@ import {
 } from './index.js';
 
 describe('@ankhorage/infra/project', () => {
-  test('exports project resolution, safe state and artifact owner APIs', () => {
+  test('exports project resolution, credentials, safe state and artifact owner APIs', () => {
+    expect(createProjectInfraCredentialPort).toBeFunction();
     expect(createProjectInfraLifecycle).toBeFunction();
     expect(resolveInfraProjectAsync).toBeFunction();
     expect(readStoredInfraStateAsync).toBeFunction();

package/src/project/index.ts

@@ -1,3 +1,4 @@
+export { createProjectInfraCredentialPort } from '../features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort.js';
 export { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';
 export { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';
 export { resolveInfraProjectAsync } from '../features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';