@ankhorage/infra 7.1.0 → 7.1.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ankhorage/infra
 
+## 7.1.2
+
+### Patch Changes
+
+- e707284: Render standalone Infra help from the canonical provider manifest through the shared Ankh CLI help runtime.
+
+## 7.1.1
+
+### Patch Changes
+
+- 7440682: Expose the project-scoped credential port constructor from `@ankhorage/infra/project` for downstream host composition without exposing credential storage details.
+
 ## 7.1.0
 
 ### Minor Changes

package/dist/cli/runInfraCliAsync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runInfraCliAsync.d.ts","sourceRoot":"","sources":["../../src/cli/runInfraCliAsync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAO9B,iGAAiG;AACjG,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAkBhC;AAED,UAAU,eAAe;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACnD"}
+{"version":3,"file":"runInfraCliAsync.d.ts","sourceRoot":"","sources":["../../src/cli/runInfraCliAsync.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAO9B,iGAAiG;AACjG,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAwBhC;AAED,UAAU,eAAe;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACnD"}

package/dist/cli/runInfraCliAsync.js

@@ -1,6 +1,8 @@
+import { isHelpToken, renderProviderHelp } from '@ankhorage/ankh';
+import { INFRA_PACKAGE_DESCRIPTION } from '../constants.js';
 import { createDefaultInfraCommandContext } from './createDefaultInfraCommandContext.js';
+import { createInfraRuntimeProvider } from './createInfraRuntimeProvider.js';
 import { findInfraCommand } from './findInfraCommand.js';
-import { renderInfraRootHelp } from './renderInfraRootHelp.js';
 import { renderUnknownInfraCommand } from './renderUnknownInfraCommand.js';
 import { runInfraCommandAsync } from './runInfraCommandAsync.js';
 /*** Dispatch the standalone executable arguments through the canonical Infra command surface. */
@@ -9,7 +11,11 @@ export async function runInfraCliAsync(argv, options = {}) {
     const runCommand = options.runCommandImpl ?? runInfraCommandAsync;
     const [firstToken, ...restTokens] = argv;
     if (firstToken === undefined || isHelpToken(firstToken)) {
-        context.writeStdout(renderInfraRootHelp(context.version));
+        context.writeStdout(renderProviderHelp({
+            commandPrefix: ['ankhorage-infra'],
+            description: INFRA_PACKAGE_DESCRIPTION,
+            manifest: createInfraRuntimeProvider(),
+        }));
         return { exitCode: 0 };
     }
     if (isVersionToken(firstToken)) {
@@ -23,10 +29,6 @@ export async function runInfraCliAsync(argv, options = {}) {
     }
     return runCommand({ argv: restTokens, command, context }, { services: options.services });
 }
-/*** Recognize standalone help tokens. */
-function isHelpToken(value) {
-    return value === '--help' || value === '-h' || value === 'help';
-}
 /*** Recognize standalone version tokens. */
 function isVersionToken(value) {
     return value === '--version' || value === '-v' || value === 'version';

package/dist/cli/runInfraCliAsync.js.map

@@ -1 +1 @@
-{"version":3,"file":"runInfraCliAsync.js","sourceRoot":"","sources":["../../src/cli/runInfraCliAsync.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAuB,EACvB,UAA2B,EAAE;IAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gCAAgC,EAAE,CAAC;IACtE,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,IAAI,oBAAoB,CAAC;IAClE,MAAM,CAAC,UAAU,EAAE,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,WAAW,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC5F,CAAC;AAQD,yCAAyC;AACzC,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;AAClE,CAAC;AAED,4CAA4C;AAC5C,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;AACxE,CAAC","sourcesContent":["import type {\n  InfraCommandContext,\n  InfraCommandRunResult,\n  InfraCommandServices,\n  RunInfraCommandImpl,\n} from '../types/infraCli.js';\nimport { createDefaultInfraCommandContext } from './createDefaultInfraCommandContext.js';\nimport { findInfraCommand } from './findInfraCommand.js';\nimport { renderInfraRootHelp } from './renderInfraRootHelp.js';\nimport { renderUnknownInfraCommand } from './renderUnknownInfraCommand.js';\nimport { runInfraCommandAsync } from './runInfraCommandAsync.js';\n\n/*** Dispatch the standalone executable arguments through the canonical Infra command surface. */\nexport async function runInfraCliAsync(\n  argv: readonly string[],\n  options: InfraCliOptions = {},\n): Promise<InfraCommandRunResult> {\n  const context = options.context ?? createDefaultInfraCommandContext();\n  const runCommand = options.runCommandImpl ?? runInfraCommandAsync;\n  const [firstToken, ...restTokens] = argv;\n  if (firstToken === undefined || isHelpToken(firstToken)) {\n    context.writeStdout(renderInfraRootHelp(context.version));\n    return { exitCode: 0 };\n  }\n  if (isVersionToken(firstToken)) {\n    context.writeStdout(`${context.version}\\n`);\n    return { exitCode: 0 };\n  }\n  const command = findInfraCommand(firstToken);\n  if (command === null) {\n    context.writeStderr(renderUnknownInfraCommand(firstToken));\n    return { exitCode: 1 };\n  }\n  return runCommand({ argv: restTokens, command, context }, { services: options.services });\n}\n\ninterface InfraCliOptions {\n  readonly context?: InfraCommandContext;\n  readonly runCommandImpl?: RunInfraCommandImpl;\n  readonly services?: Partial<InfraCommandServices>;\n}\n\n/*** Recognize standalone help tokens. */\nfunction isHelpToken(value: string): boolean {\n  return value === '--help' || value === '-h' || value === 'help';\n}\n\n/*** Recognize standalone version tokens. */\nfunction isVersionToken(value: string): boolean {\n  return value === '--version' || value === '-v' || value === 'version';\n}\n"]}
+{"version":3,"file":"runInfraCliAsync.js","sourceRoot":"","sources":["../../src/cli/runInfraCliAsync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAO5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAuB,EACvB,UAA2B,EAAE;IAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gCAAgC,EAAE,CAAC;IACtE,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,IAAI,oBAAoB,CAAC;IAClE,MAAM,CAAC,UAAU,EAAE,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,WAAW,CACjB,kBAAkB,CAAC;YACjB,aAAa,EAAE,CAAC,iBAAiB,CAAC;YAClC,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,0BAA0B,EAAE;SACvC,CAAC,CACH,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,WAAW,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC5F,CAAC;AAQD,4CAA4C;AAC5C,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;AACxE,CAAC","sourcesContent":["import { isHelpToken, renderProviderHelp } from '@ankhorage/ankh';\n\nimport { INFRA_PACKAGE_DESCRIPTION } from '../constants.js';\nimport type {\n  InfraCommandContext,\n  InfraCommandRunResult,\n  InfraCommandServices,\n  RunInfraCommandImpl,\n} from '../types/infraCli.js';\nimport { createDefaultInfraCommandContext } from './createDefaultInfraCommandContext.js';\nimport { createInfraRuntimeProvider } from './createInfraRuntimeProvider.js';\nimport { findInfraCommand } from './findInfraCommand.js';\nimport { renderUnknownInfraCommand } from './renderUnknownInfraCommand.js';\nimport { runInfraCommandAsync } from './runInfraCommandAsync.js';\n\n/*** Dispatch the standalone executable arguments through the canonical Infra command surface. */\nexport async function runInfraCliAsync(\n  argv: readonly string[],\n  options: InfraCliOptions = {},\n): Promise<InfraCommandRunResult> {\n  const context = options.context ?? createDefaultInfraCommandContext();\n  const runCommand = options.runCommandImpl ?? runInfraCommandAsync;\n  const [firstToken, ...restTokens] = argv;\n  if (firstToken === undefined || isHelpToken(firstToken)) {\n    context.writeStdout(\n      renderProviderHelp({\n        commandPrefix: ['ankhorage-infra'],\n        description: INFRA_PACKAGE_DESCRIPTION,\n        manifest: createInfraRuntimeProvider(),\n      }),\n    );\n    return { exitCode: 0 };\n  }\n  if (isVersionToken(firstToken)) {\n    context.writeStdout(`${context.version}\\n`);\n    return { exitCode: 0 };\n  }\n  const command = findInfraCommand(firstToken);\n  if (command === null) {\n    context.writeStderr(renderUnknownInfraCommand(firstToken));\n    return { exitCode: 1 };\n  }\n  return runCommand({ argv: restTokens, command, context }, { services: options.services });\n}\n\ninterface InfraCliOptions {\n  readonly context?: InfraCommandContext;\n  readonly runCommandImpl?: RunInfraCommandImpl;\n  readonly services?: Partial<InfraCommandServices>;\n}\n\n/*** Recognize standalone version tokens. */\nfunction isVersionToken(value: string): boolean {\n  return value === '--version' || value === '-v' || value === 'version';\n}\n"]}

package/dist/constants.d.ts

@@ -1,5 +1,6 @@
 export declare const INFRA_PACKAGE_NAME: string;
 export declare const INFRA_PACKAGE_VERSION: string;
+export declare const INFRA_PACKAGE_DESCRIPTION: string;
 export declare const INFRA_COMMAND_CATEGORY: "infra";
 export declare const INFRA_CAPABILITIES: readonly ["infra.validate", "infra.plan", "infra.generate", "infra.up", "infra.status", "infra.outputs", "infra.down", "infra.destroy"];
 export declare const INFRA_PACKAGE_METADATA: {

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,kBAAkB,QAAmB,CAAC;AACnD,eAAO,MAAM,qBAAqB,QAAsB,CAAC;AACzD,eAAO,MAAM,sBAAsB,SAAiD,CAAC;AACrF,eAAO,MAAM,kBAAkB,yIASiB,CAAC;AAEjD,eAAO,MAAM,sBAAsB;;;;CAIK,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,kBAAkB,QAAmB,CAAC;AACnD,eAAO,MAAM,qBAAqB,QAAsB,CAAC;AACzD,eAAO,MAAM,yBAAyB,QAA0B,CAAC;AACjE,eAAO,MAAM,sBAAsB,SAAiD,CAAC;AACrF,eAAO,MAAM,kBAAkB,yIASiB,CAAC;AAEjD,eAAO,MAAM,sBAAsB;;;;CAIK,CAAC"}

package/dist/constants.js

@@ -1,6 +1,7 @@
 import packageJson from '../package.json';
 export const INFRA_PACKAGE_NAME = packageJson.name;
 export const INFRA_PACKAGE_VERSION = packageJson.version;
+export const INFRA_PACKAGE_DESCRIPTION = packageJson.description;
 export const INFRA_COMMAND_CATEGORY = 'infra';
 export const INFRA_CAPABILITIES = [
     'infra.validate',

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAMA,OAAO,WAAW,MAAM,iBAAiB,CAAC;AAE1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAA8C,CAAC;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,gBAAgB;IAChB,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,cAAc;IACd,eAAe;IACf,YAAY;IACZ,eAAe;CAC+B,CAAC;AAEjD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,sBAAsB;IAChC,QAAQ,EAAE,qBAAqB;IAC/B,YAAY,EAAE,kBAAkB;CACM,CAAC","sourcesContent":["import type {\n  AnkhCapabilityId,\n  AnkhCommandCategory,\n  AnkhPackageMetadata,\n} from '@ankhorage/contracts/cli';\n\nimport packageJson from '../package.json';\n\nexport const INFRA_PACKAGE_NAME = packageJson.name;\nexport const INFRA_PACKAGE_VERSION = packageJson.version;\nexport const INFRA_COMMAND_CATEGORY = 'infra' as const satisfies AnkhCommandCategory;\nexport const INFRA_CAPABILITIES = [\n  'infra.validate',\n  'infra.plan',\n  'infra.generate',\n  'infra.up',\n  'infra.status',\n  'infra.outputs',\n  'infra.down',\n  'infra.destroy',\n] as const satisfies readonly AnkhCapabilityId[];\n\nexport const INFRA_PACKAGE_METADATA = {\n  category: INFRA_COMMAND_CATEGORY,\n  provider: './dist/cli/index.js',\n  capabilities: INFRA_CAPABILITIES,\n} as const satisfies AnkhPackageMetadata;\n"]}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAMA,OAAO,WAAW,MAAM,iBAAiB,CAAC;AAE1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,CAAC;AACzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC,WAAW,CAAC;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAA8C,CAAC;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,gBAAgB;IAChB,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,cAAc;IACd,eAAe;IACf,YAAY;IACZ,eAAe;CAC+B,CAAC;AAEjD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,sBAAsB;IAChC,QAAQ,EAAE,qBAAqB;IAC/B,YAAY,EAAE,kBAAkB;CACM,CAAC","sourcesContent":["import type {\n  AnkhCapabilityId,\n  AnkhCommandCategory,\n  AnkhPackageMetadata,\n} from '@ankhorage/contracts/cli';\n\nimport packageJson from '../package.json';\n\nexport const INFRA_PACKAGE_NAME = packageJson.name;\nexport const INFRA_PACKAGE_VERSION = packageJson.version;\nexport const INFRA_PACKAGE_DESCRIPTION = packageJson.description;\nexport const INFRA_COMMAND_CATEGORY = 'infra' as const satisfies AnkhCommandCategory;\nexport const INFRA_CAPABILITIES = [\n  'infra.validate',\n  'infra.plan',\n  'infra.generate',\n  'infra.up',\n  'infra.status',\n  'infra.outputs',\n  'infra.down',\n  'infra.destroy',\n] as const satisfies readonly AnkhCapabilityId[];\n\nexport const INFRA_PACKAGE_METADATA = {\n  category: INFRA_COMMAND_CATEGORY,\n  provider: './dist/cli/index.js',\n  capabilities: INFRA_CAPABILITIES,\n} as const satisfies AnkhPackageMetadata;\n"]}

package/dist/project/index.d.ts

@@ -1,3 +1,4 @@
+export { createProjectInfraCredentialPort } from '../features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort.js';
 export { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';
 export { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';
 export { resolveInfraProjectAsync } from '../features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';

package/dist/project/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kFAAkF,CAAC;AAC7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AACjI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iFAAiF,CAAC;AAC3H,OAAO,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,MAAM,mFAAmF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC;AACnG,YAAY,EACV,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yFAAyF,CAAC;AAC3I,OAAO,EAAE,yBAAyB,EAAE,MAAM,kFAAkF,CAAC;AAC7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AACjI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iFAAiF,CAAC;AAC3H,OAAO,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,MAAM,mFAAmF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC;AACnG,YAAY,EACV,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,0BAA0B,CAAC"}

package/dist/project/index.js

@@ -1,3 +1,4 @@
+export { createProjectInfraCredentialPort } from '../features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort.js';
 export { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';
 export { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';
 export { resolveInfraProjectAsync } from '../features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';

package/dist/project/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kFAAkF,CAAC;AAC7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AACjI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iFAAiF,CAAC;AAC3H,OAAO,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,MAAM,mFAAmF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC","sourcesContent":["export { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';\nexport { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';\nexport { resolveInfraProjectAsync } from '../features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';\nexport { writeInfraGeneratedArtifactsAsync } from '../features/environment-lifecycle/adapters/outbound/writeInfraGeneratedArtifactsAsync.js';\nexport { writeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/writeStoredInfraStateAsync.js';\nexport { createProjectInfraLifecycle } from '../features/environment-lifecycle/composition/createProjectInfraLifecycle.js';\nexport { resolveProjectFile } from '../features/environment-lifecycle/utils/resolveProjectFile.js';\nexport type {\n  CreateProjectInfraLifecycleOptions,\n  InfraArtifactWriteResult,\n  ProjectInfraDestroyRequest,\n  ProjectInfraLifecycle,\n  ProjectInfraOperationRequest,\n  ResolvedInfraProject,\n} from '../types/infraProject.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yFAAyF,CAAC;AAC3I,OAAO,EAAE,yBAAyB,EAAE,MAAM,kFAAkF,CAAC;AAC7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AACjI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iFAAiF,CAAC;AAC3H,OAAO,EAAE,iCAAiC,EAAE,MAAM,0FAA0F,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,MAAM,mFAAmF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC","sourcesContent":["export { createProjectInfraCredentialPort } from '../features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort.js';\nexport { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';\nexport { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';\nexport { resolveInfraProjectAsync } from '../features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';\nexport { writeInfraGeneratedArtifactsAsync } from '../features/environment-lifecycle/adapters/outbound/writeInfraGeneratedArtifactsAsync.js';\nexport { writeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/writeStoredInfraStateAsync.js';\nexport { createProjectInfraLifecycle } from '../features/environment-lifecycle/composition/createProjectInfraLifecycle.js';\nexport { resolveProjectFile } from '../features/environment-lifecycle/utils/resolveProjectFile.js';\nexport type {\n  CreateProjectInfraLifecycleOptions,\n  InfraArtifactWriteResult,\n  ProjectInfraDestroyRequest,\n  ProjectInfraLifecycle,\n  ProjectInfraOperationRequest,\n  ResolvedInfraProject,\n} from '../types/infraProject.js';\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "7.1.0",
+  "version": "7.1.2",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -35,6 +35,7 @@
     "openapi"
   ],
   "dependencies": {
+    "@ankhorage/ankh": "^0.9.1",
     "@ankhorage/contracts": "^21.0.0",
     "@ankhorage/utility": "^1.2.0"
   },
@@ -111,9 +112,8 @@
     "knip:test": "bun run knip:check"
   },
   "devDependencies": {
-    "@ankhorage/ankh": "^0.8.11",
     "@ankhorage/cerbos": "^0.2.0",
-    "@ankhorage/devtools": "^1.14.0",
+    "@ankhorage/devtools": "^1.15.3",
     "@ankhorage/docker-compose": "^0.5.3",
     "@ankhorage/hetzner": "^0.3.0",
     "@ankhorage/k3s": "^0.4.1",
@@ -121,7 +121,7 @@
     "@ankhorage/minikube": "^0.4.4",
     "@ankhorage/paradox": "^0.1.24",
     "@ankhorage/r2": "^0.2.0",
-    "@ankhorage/supabase": "^0.5.9",
+    "@ankhorage/supabase": "^0.5.10",
     "@ankhorage/supabase-vault": "^0.3.1",
     "@types/bun": "^1.4.1",
     "@types/node": "^25.6.0",

package/src/cli/cli.test.ts

@@ -1,15 +1,31 @@
+import { renderProviderHelp } from '@ankhorage/ankh';
 import { describe, expect, test } from 'bun:test';
 
+import { INFRA_PACKAGE_DESCRIPTION } from '../constants.js';
 import { createCapturedCommandContext } from '../testSupport.js';
+import { createInfraRuntimeProvider } from './createInfraRuntimeProvider.js';
 import { runInfraCliAsync } from './runInfraCliAsync.js';
 
 describe('standalone Infra CLI', () => {
-  test('prints help/version and dispatches all commands through the shared runner', async () => {
-    const help = createCapturedCommandContext('/workspace', '9.9.9');
+  test('renders every help alias from the canonical provider manifest', async () => {
+    const expectedHelp = renderProviderHelp({
+      commandPrefix: ['ankhorage-infra'],
+      description: INFRA_PACKAGE_DESCRIPTION,
+      manifest: createInfraRuntimeProvider(),
+    });
+
+    for (const argv of [[], ['-h'], ['--help'], ['help']] as const) {
+      const captured = createCapturedCommandContext('/workspace', '9.9.9');
+      const result = await runInfraCliAsync(argv, { context: captured.context });
+
+      expect(result).toEqual({ exitCode: 0 });
+      expect(captured.stdout.value).toBe(expectedHelp);
+      expect(captured.stderr.value).toBe('');
+    }
+  });
+
+  test('prints version and dispatches all commands through the shared runner', async () => {
     const version = createCapturedCommandContext('/workspace', '9.9.9');
-    expect((await runInfraCliAsync([], { context: help.context })).exitCode).toBe(0);
-    expect(help.stdout.value).toContain('ankhorage-infra <command>');
-    expect(help.stdout.value).toContain('destroy');
     expect((await runInfraCliAsync(['--version'], { context: version.context })).exitCode).toBe(0);
     expect(version.stdout.value).toBe('9.9.9\n');
 

package/src/cli/runInfraCliAsync.ts

@@ -1,3 +1,6 @@
+import { isHelpToken, renderProviderHelp } from '@ankhorage/ankh';
+
+import { INFRA_PACKAGE_DESCRIPTION } from '../constants.js';
 import type {
   InfraCommandContext,
   InfraCommandRunResult,
@@ -5,8 +8,8 @@ import type {
   RunInfraCommandImpl,
 } from '../types/infraCli.js';
 import { createDefaultInfraCommandContext } from './createDefaultInfraCommandContext.js';
+import { createInfraRuntimeProvider } from './createInfraRuntimeProvider.js';
 import { findInfraCommand } from './findInfraCommand.js';
-import { renderInfraRootHelp } from './renderInfraRootHelp.js';
 import { renderUnknownInfraCommand } from './renderUnknownInfraCommand.js';
 import { runInfraCommandAsync } from './runInfraCommandAsync.js';
 
@@ -19,7 +22,13 @@ export async function runInfraCliAsync(
   const runCommand = options.runCommandImpl ?? runInfraCommandAsync;
   const [firstToken, ...restTokens] = argv;
   if (firstToken === undefined || isHelpToken(firstToken)) {
-    context.writeStdout(renderInfraRootHelp(context.version));
+    context.writeStdout(
+      renderProviderHelp({
+        commandPrefix: ['ankhorage-infra'],
+        description: INFRA_PACKAGE_DESCRIPTION,
+        manifest: createInfraRuntimeProvider(),
+      }),
+    );
     return { exitCode: 0 };
   }
   if (isVersionToken(firstToken)) {
@@ -40,11 +49,6 @@ interface InfraCliOptions {
   readonly services?: Partial<InfraCommandServices>;
 }
 
-/*** Recognize standalone help tokens. */
-function isHelpToken(value: string): boolean {
-  return value === '--help' || value === '-h' || value === 'help';
-}
-
 /*** Recognize standalone version tokens. */
 function isVersionToken(value: string): boolean {
   return value === '--version' || value === '-v' || value === 'version';

package/src/commands.test.ts

@@ -1,12 +1,14 @@
+import { renderProviderHelp } from '@ankhorage/ankh';
 import type { AppManifest } from '@ankhorage/contracts';
 import type { InfraEnvironmentSpec, InfraLedger, InfraResult } from '@ankhorage/contracts/infra';
 import { describe, expect, test } from 'bun:test';
 
 import { INFRA_COMMANDS } from './cli/constants.js';
+import { createInfraRuntimeProvider } from './cli/createInfraRuntimeProvider.js';
 import { createProviderCommandDescriptors } from './cli/createProviderCommandDescriptors.js';
 import { findInfraCommand } from './cli/findInfraCommand.js';
-import { renderInfraRootHelp } from './cli/renderInfraRootHelp.js';
 import { runInfraCommandAsync } from './cli/runInfraCommandAsync.js';
+import { INFRA_PACKAGE_DESCRIPTION } from './constants.js';
 import { createAppManifest, createCapturedCommandContext } from './testSupport.js';
 import type { InfraCommandServices, InfraLifecycleOperations } from './types/infraCli.js';
 import type { InfraDestroyOperationRequest } from './types/infraOrchestration.js';
@@ -16,7 +18,11 @@ describe('canonical Infra commands', () => {
     const names = ['validate', 'plan', 'generate', 'up', 'status', 'outputs', 'down', 'destroy'];
     expect(INFRA_COMMANDS.map(({ standaloneName }) => standaloneName)).toEqual(names);
     expect(createProviderCommandDescriptors().map(({ path }) => path.join(' '))).toEqual(names);
-    const help = renderInfraRootHelp('9.9.9');
+    const help = renderProviderHelp({
+      commandPrefix: ['ankhorage-infra'],
+      description: INFRA_PACKAGE_DESCRIPTION,
+      manifest: createInfraRuntimeProvider(),
+    });
     for (const name of names) expect(help).toContain(name);
     expect(help).not.toContain('port-forward');
     expect(help).not.toContain('reset');

package/src/constants.ts

@@ -8,6 +8,7 @@ import packageJson from '../package.json';
 
 export const INFRA_PACKAGE_NAME = packageJson.name;
 export const INFRA_PACKAGE_VERSION = packageJson.version;
+export const INFRA_PACKAGE_DESCRIPTION = packageJson.description;
 export const INFRA_COMMAND_CATEGORY = 'infra' as const satisfies AnkhCommandCategory;
 export const INFRA_CAPABILITIES = [
   'infra.validate',

package/src/hetznerK3sProduction.test.ts

@@ -1,4 +1,6 @@
 import type {
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
   InfraLedger,
   InfraManifest,
   InfraResourceIdentity,
@@ -230,9 +232,7 @@ function createDependencies(fixture: ProductionFixture): InfraOrchestrationDepen
         }
       },
     },
-    credentials: {
-      resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
-    },
+    credentials: createCredentialPort(),
     secrets: {
       resolveAsync: () =>
         Promise.resolve({
@@ -245,6 +245,32 @@ function createDependencies(fixture: ProductionFixture): InfraOrchestrationDepen
   };
 }
 
+function createCredentialPort(): InfraCredentialPort {
+  return {
+    findAsync: (reference) => Promise.resolve(findCredential(reference)),
+    resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
+    persistAsync: (reference) =>
+      Promise.resolve({
+        ok: false,
+        diagnostics: [
+          {
+            severity: 'error',
+            code: 'unexpected-credential-persist',
+            message: `Production fixture must not persist credential ${reference.name}.`,
+          },
+        ],
+      }),
+  };
+}
+
+function findCredential(
+  reference: InfraControlPlaneCredentialRef,
+): InfraResult<Readonly<Record<string, string>> | null> {
+  return reference.name === 'SUPABASE_BOOTSTRAP'
+    ? resolveCredential(reference.name)
+    : success(null);
+}
+
 function resolveCredential(name: string): InfraResult<Readonly<Record<string, string>>> {
   if (name === 'HCLOUD_TOKEN') return success({ token: 'phase10-hcloud-token' });
   if (name === 'HETZNER_SSH') {

package/src/hetznerK3sSupabaseR2.test.ts

@@ -1,4 +1,9 @@
-import type { InfraManifest, InfraResult } from '@ankhorage/contracts/infra';
+import type {
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
+  InfraManifest,
+  InfraResult,
+} from '@ankhorage/contracts/infra';
 import {
   createInfraAdapter as createHetznerInfraAdapter,
   type HetznerCloudApi,
@@ -189,9 +194,7 @@ function createDependencies(fixture: ProductionR2Fixture): InfraOrchestrationDep
         }
       },
     },
-    credentials: {
-      resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
-    },
+    credentials: createCredentialPort(),
     secrets: {
       resolveAsync: () =>
         Promise.resolve({
@@ -204,6 +207,32 @@ function createDependencies(fixture: ProductionR2Fixture): InfraOrchestrationDep
   };
 }
 
+function createCredentialPort(): InfraCredentialPort {
+  return {
+    findAsync: (reference) => Promise.resolve(findCredential(reference)),
+    resolveAsync: ({ name }) => Promise.resolve(resolveCredential(name)),
+    persistAsync: (reference) =>
+      Promise.resolve({
+        ok: false,
+        diagnostics: [
+          {
+            severity: 'error',
+            code: 'unexpected-credential-persist',
+            message: `Production fixture must not persist credential ${reference.name}.`,
+          },
+        ],
+      }),
+  };
+}
+
+function findCredential(
+  reference: InfraControlPlaneCredentialRef,
+): InfraResult<Readonly<Record<string, string>> | null> {
+  return reference.name === 'SUPABASE_BOOTSTRAP'
+    ? resolveCredential(reference.name)
+    : success(null);
+}
+
 function resolveCredential(name: string): InfraResult<Readonly<Record<string, string>>> {
   if (name === 'HCLOUD_TOKEN') return success({ token: 'phase10-hcloud-token' });
   if (name === 'HETZNER_SSH') {

package/src/localDockerComposeProviders.integration.test.ts

@@ -1,6 +1,8 @@
-import { createHmac } from 'node:crypto';
+import { createHash } from 'node:crypto';
 
 import type {
+  InfraControlPlaneCredentialRef,
+  InfraCredentialPort,
   InfraLedger,
   InfraManifest,
   InfraResourceIdentity,
@@ -19,16 +21,7 @@ import type { InfraOrchestrationDependencies } from './types/infraOrchestration.
 const projectId = 'infra145-compose-providers';
 const baseUrl = 'http://127.0.0.1:54322';
 const bucket = 'phase9-acceptance';
-const jwtSecret = 'phase9-jwt-secret-that-is-at-least-thirty-two-characters';
-const credentials = {
-  postgresPassword: 'phase9-postgres-password',
-  jwtSecret,
-  anonKey: createJwt('anon'),
-  serviceRoleKey: createJwt('service_role'),
-  realtimeSecretKeyBase: 'r'.repeat(64),
-  realtimeDatabaseEncryptionKey: '0123456789abcdef',
-  pgMetaCryptoKey: 'phase9-meta-crypto-key-that-is-at-least-32-characters',
-} as const;
+const bootstrapCredential = { source: 'control-plane', name: 'SUPABASE_BOOTSTRAP' } as const;
 const manifest = {
   environments: {
     local: {
@@ -59,7 +52,8 @@ const manifest = {
 test.skipIf(process.env.ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E !== '1')(
   'runs Supabase and Cerbos through the provider-neutral Docker Compose lifecycle',
   async () => {
-    const dependencies = createDependencies();
+    const credentialPort = new MemoryCredentialPort();
+    const dependencies = createDependencies(credentialPort);
     let ledger: InfraLedger | undefined;
 
     try {
@@ -72,7 +66,10 @@ test.skipIf(process.env.ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E !== '1')(
         await upInfraEnvironmentAsync({ projectId, manifest }, dependencies),
       );
       ledger = firstLedger;
-      assertProviderNeutralOutputs(firstOutputs);
+      expect(credentialPort.persistCount).toBe(1);
+      const firstCredentials = credentialPort.readRequired();
+      const firstCredentialFingerprint = credentialFingerprint(firstCredentials);
+      assertProviderNeutralOutputs(firstOutputs, firstCredentials);
 
       const status = requireSuccess(
         await statusInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
@@ -98,7 +95,9 @@ test.skipIf(process.env.ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E !== '1')(
         await upInfraEnvironmentAsync({ projectId, manifest, previous: ledger }, dependencies),
       );
       ledger = resumedLedger;
-      assertProviderNeutralOutputs(resumedOutputs);
+      expect(credentialPort.persistCount).toBe(1);
+      expect(credentialFingerprint(credentialPort.readRequired())).toBe(firstCredentialFingerprint);
+      assertProviderNeutralOutputs(resumedOutputs, firstCredentials);
 
       const health = await fetch(`${baseUrl}/auth/v1/health`);
       expect(health.ok).toBe(true);
@@ -123,20 +122,10 @@ test.skipIf(process.env.ANKH_INFRA_DOCKER_COMPOSE_PROVIDERS_E2E !== '1')(
   900_000,
 );
 
-function createDependencies(): InfraOrchestrationDependencies {
+function createDependencies(credentials: InfraCredentialPort): InfraOrchestrationDependencies {
   return {
     adapterResolver: createNodeInfraAdapterPackageResolver(),
-    credentials: {
-      resolveAsync: (reference) =>
-        Promise.resolve(
-          reference.name === 'SUPABASE_BOOTSTRAP'
-            ? success(credentials)
-            : failure(
-                'unexpected-control-plane-credential',
-                `Unexpected control-plane credential ${reference.name}.`,
-              ),
-        ),
-    },
+    credentials,
     secrets: {
       resolveAsync: (reference) =>
         Promise.resolve(
@@ -149,6 +138,73 @@ function createDependencies(): InfraOrchestrationDependencies {
   };
 }
 
+class MemoryCredentialPort implements InfraCredentialPort {
+  private values: Readonly<Record<string, string>> | null = null;
+  persistCount = 0;
+
+  findAsync(
+    reference: InfraControlPlaneCredentialRef,
+  ): Promise<InfraResult<Readonly<Record<string, string>> | null>> {
+    if (reference.name !== bootstrapCredential.name) return Promise.resolve(success(null));
+    return Promise.resolve(success(this.values === null ? null : { ...this.values }));
+  }
+
+  resolveAsync(
+    reference: InfraControlPlaneCredentialRef,
+  ): Promise<InfraResult<Readonly<Record<string, string>>>> {
+    if (reference.name === bootstrapCredential.name && this.values !== null) {
+      return Promise.resolve(success({ ...this.values }));
+    }
+    return Promise.resolve(
+      failure(
+        'unexpected-control-plane-credential',
+        `Unexpected or missing control-plane credential ${reference.name}.`,
+      ),
+    );
+  }
+
+  persistAsync(
+    reference: InfraControlPlaneCredentialRef,
+    values: Readonly<Record<string, string>>,
+  ): Promise<InfraResult<null>> {
+    if (reference.name !== bootstrapCredential.name) {
+      return Promise.resolve(
+        failure(
+          'unexpected-control-plane-credential',
+          `Unexpected control-plane credential ${reference.name}.`,
+        ),
+      );
+    }
+    this.values = { ...values };
+    this.persistCount += 1;
+    return Promise.resolve(success(null));
+  }
+
+  readRequired(): Readonly<Record<string, string>> {
+    if (this.values === null) throw new Error('Expected generated Supabase bootstrap credentials.');
+    return { ...this.values };
+  }
+}
+
+function credentialFingerprint(values: Readonly<Record<string, string>>): string {
+  const canonical = Object.entries(values)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, value]) => `${key}\u0000${value}`)
+    .join('\u0001');
+  return createHash('sha256').update(canonical).digest('hex');
+}
+
+function privilegedCredentialValues(values: Readonly<Record<string, string>>): readonly string[] {
+  const { anonKey: _anonKey, ...privileged } = values;
+  return Object.values(privileged);
+}
+
+function readAnonKey(values: Readonly<Record<string, string>>): string {
+  const { anonKey } = values;
+  if (anonKey === undefined) throw new Error('Expected generated Supabase anonKey.');
+  return anonKey;
+}
+
 function createDestroyRequest(
   previous: InfraLedger,
   confirmedResources: readonly InfraResourceIdentity[],
@@ -167,14 +223,14 @@ function persistentIdentities(ledger: InfraLedger): readonly InfraResourceIdenti
   return ledger.resources.filter(({ persistent }) => persistent).map(({ identity }) => identity);
 }
 
-function assertProviderNeutralOutputs(outputs: InfraLedger['outputs']): void {
+function assertProviderNeutralOutputs(
+  outputs: InfraLedger['outputs'],
+  credentials: Readonly<Record<string, string>>,
+): void {
   const serialized = JSON.stringify(outputs);
-  expect(serialized).not.toContain(credentials.serviceRoleKey);
-  expect(serialized).not.toContain(credentials.postgresPassword);
-  expect(serialized).not.toContain(credentials.jwtSecret);
-  expect(serialized).not.toContain(credentials.realtimeSecretKeyBase);
-  expect(serialized).not.toContain(credentials.realtimeDatabaseEncryptionKey);
-  expect(serialized).not.toContain(credentials.pgMetaCryptoKey);
+  for (const secret of privilegedCredentialValues(credentials)) {
+    expect(serialized).not.toContain(secret);
+  }
   expect(serialized.toLowerCase()).not.toContain('kubernetes');
   expect(serialized.toLowerCase()).not.toContain('minikube');
   expect(
@@ -190,7 +246,7 @@ function assertProviderNeutralOutputs(outputs: InfraLedger['outputs']): void {
       ({ owner, environmentVariable, value }) =>
         owner.adapter === 'supabase' &&
         environmentVariable === 'EXPO_PUBLIC_SUPABASE_ANON_KEY' &&
-        value === credentials.anonKey,
+        value === readAnonKey(credentials),
     ),
   ).toBe(true);
   expect(
@@ -209,23 +265,6 @@ function assertProviderNeutralOutputs(outputs: InfraLedger['outputs']): void {
   ).toBe(true);
 }
 
-function createJwt(role: 'anon' | 'service_role'): string {
-  const encodedHeader = encodeJwtPart({ alg: 'HS256', typ: 'JWT' });
-  const encodedPayload = encodeJwtPart({
-    role,
-    iss: 'supabase',
-    iat: 1_700_000_000,
-    exp: 4_102_444_800,
-  });
-  const unsigned = `${encodedHeader}.${encodedPayload}`;
-  const signature = createHmac('sha256', jwtSecret).update(unsigned).digest('base64url');
-  return `${unsigned}.${signature}`;
-}
-
-function encodeJwtPart(value: Readonly<Record<string, string | number>>): string {
-  return Buffer.from(JSON.stringify(value)).toString('base64url');
-}
-
 function requireSuccess<T>(result: InfraResult<T>): T {
   if (!result.ok) throw new Error(result.diagnostics.map(({ message }) => message).join(' '));
   return result.value;