JuntaiPlatformFoundationsIaC

JuntaiPlatformFoundationsIaC is published to npm as @zephytiju/platform-foundations-iac. It owns Juntai shared infrastructure and approved foundation services. Its Core package identity remains juntai.platform.substrate for state continuity.

JuntaiPlatformInfrastructure is intentionally only the thin infrastructure Core. It selects immutable package versions, supplies provider and target context, validates the dependency graph, invokes each package, preserves state, and aggregates opaque typed outputs. It does not declare or interpret Kubernetes resources, service releases, contracts, routes, data engines, migrations, or recovery operations.

Owned resources

• Shared namespaces, Gateway API v1.5.1, Envoy Gateway v1.8.3, GatewayClass, and the four platform gateway surfaces. The package validates and partitions the two digest-pinned upstream payloads before Pulumi registration: Gateway API standard owns the exact ten overlaps and Envoy Gateway owns its thirty remaining documents.
• OpenTelemetry Collector gateway v0.153.0 with durable queueing, bounded resources, TLS/authorization references, and no inline secret bytes.
• Official unmodified Casdoor 3.125.0, its workload identity, exact public/private routes, public-API bootstrap Job, and idempotent reconciliation schedule. The gated client_credentials application is deliberately absent.
• Account 2.1.5, including its immutable multi-architecture image, discoverable logical-schema provider and PostgreSQL adapter, platform-supplied composition factory, workload identity, platform route, observability binding, and five co-located Meridian structured resources plus transactional audit evidence.
• Application Metadata 3.2.1 and Blueprint 3.3.1 exact release selections, native provider/runtime composition, and separately projected application-owned reference readers with PostgreSQL 2.4.0 read-only compatibility.
• Deployment-selected data engines only through @zephytiju/[email protected]. KES and Kingbase are rejected.
• Per-service Meridian deployments/configuration for Account, Application Metadata, and Blueprint, with file-backed engine credentials required to be projected into every consuming workload.
• State adoption aliases/imports, protected-by-default resources, and rollback metadata.

No fetched OpenAPI, Protobuf, MCP, CRD, or upstream install document is stored in this repository or npm tarball. Exact GitHub release and OCI manifest coordinates are fetched, SHA-256 verified, compatibility checked, and composed only in memory during Pulumi execution before resource registration. Local and CI execution use the same coordinates and digests; only environment-provided authentication may differ.

Private GitHub release assets use JUNTAI_GITHUB_ARTIFACT_TOKEN (falling back to GH_TOKEN). CI mints a short-lived, contents-read GitHub App installation token from JUNTAI_CI_APP_ID and JUNTAI_CI_APP_PRIVATE_KEY, then exposes it as JUNTAI_GITHUB_ARTIFACT_TOKEN only to verification and preview steps. Private OCI layers use JUNTAI_OCI_ARTIFACT_TOKEN and may fall back to the GitHub token for GHCR. Credentials select authorization only; they never alter artifact coordinates, digests, composition evidence, or Pulumi inputs.

npm package contract

JuntaiPlatformInfrastructure consumes this package as an exact direct dependency in package.json and commits the registry-generated package-lock.json. npm ci is the only installation path. The npm tarball contains the compiled Pulumi entrypoint, TypeScript declarations, package descriptor, contribution, construct lock, service releases, adoption inventory, Gateway ownership inventory, Envoy legacy migration mapping, and operating guidance. It contains no source checkout loader, GitHub archive downloader, or staging path.

GitHub and OCI coordinates in the package contract are reserved for immutable service artifacts that this package owns and verifies during Pulumi execution. They are not a distribution mechanism for first-party IaC package code.

Install the exact release and commit the resulting lockfile:

npm install --save-exact @zephytiju/[email protected]
npm ci

The package requires Core contract ^1.1.0 and provides:

• [email protected]
• [email protected]
• [email protected]
• [email protected]

Domain logical-resource requirements

Version 1.3.0 accepts optional meridian.domains contributions from installed domain IaC packages. Each contribution pins its domain owner, logical namespace, schema-provider releases and fingerprints, and structured/evidence resource requirements. Foundations rejects duplicate resource ownership, foreign namespaces, unpinned providers, and physical engine selection in a domain contribution before registering resources.

Foundations alone maps these requirements to the reviewed structured Engine binding and renders an isolated configuration per contribution. Structured state and audit/lineage share one transaction placement group. The existing MeridianRuntimeCapability adds an optional domainRuntimes map containing the requirement fingerprint and live Pulumi Outputs for each configuration, namespace, and resolved resource-binding map. Consumers verify their own requirement fingerprint and required bindings before starting workloads; they never deserialize Engine settings, copy another service's configuration, or create a physical storage provider. Existing consumers and foundation resource identities remain compatible.

Application Metadata is pinned to 3.2.1, including its image, OpenAPI, source commit, historical v2 logical migration and released 3.1.3 association migration. Sealing and deployment remain with Application Metadata and Vangu.

Peer runtime integration acceptance gate

The peer runtime composition is verified against final installed service wheels and real PostgreSQL/MinIO. See owned-reference runtime composition for the supported producer contract, exact physical checks, namespace projections and acceptance boundaries. Full Lattice lifecycle acceptance is completed by the consuming domain integration.

See the owned-reference configuration contract and compatibility evidence. Runtime and physical fingerprint checks remain unchanged; a supported Meridian compatibility path and real cross-process lifecycle acceptance are required before release.

Development

npm ci --ignore-scripts
npm run check
npm pack --dry-run

See foundation service deployments, adoption and rollback, and package ownership.

Lattice packages can declare release-bound namespaces and typed shared Configuration/Artifact ResourceStore dependencies. See the Foundations composition and rollback handoff.