@ankhorage/infra 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ankhorage
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+<!-- markdownlint-disable MD013 MD033 -->
+<!-- This file is generated by Paradox. Do not edit manually. -->
+
+# INFRA
+
+![license: MIT](././paradox/badges/license.svg) ![npm: v0.0.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+
+Provider-neutral infrastructure generation: turns app manifests, datasets, auth, state, storage, and deployment config into generated infra artifacts, migrations, seeds, APIs, and runtime dependencies.
+
+## Generated documentation
+
+- [Interactive documentation app](././paradox/index.html)
+- [Public API reference](././paradox/exports.md)
+- [Component registry](././paradox/components.md)
+- [Architecture overview](././paradox/diagrams/architecture-overview.mmd)
+- [Module relationships](././paradox/diagrams/module-relationships.mmd)
+- [Export graph](././paradox/diagrams/export-graph.mmd)

package/dist/adapters/minikube/auth/index.d.ts

@@ -0,0 +1,7 @@
+import type { InfraManifestInput } from '../../../types';
+import { type MinikubeAdapterArtifacts } from '../contracts';
+export declare function generateAuthProviderArtifacts(args: {
+    manifest: InfraManifestInput;
+    namespace: string;
+}): MinikubeAdapterArtifacts;
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/minikube/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAGrF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CAe3B"}

package/dist/adapters/minikube/auth/index.js

@@ -0,0 +1,14 @@
+import { emptyMinikubeArtifacts } from '../contracts';
+import { generateSupabaseAuthArtifacts } from './supabase';
+export function generateAuthProviderArtifacts(args) {
+    const { manifest, namespace } = args;
+    const { auth } = manifest;
+    if (!auth) {
+        return emptyMinikubeArtifacts();
+    }
+    if (auth.provider !== 'supabase') {
+        throw new Error(`Unsupported auth provider for minikube adapter: "${auth.provider}". Only "supabase" is currently supported.`);
+    }
+    return generateSupabaseAuthArtifacts({ manifest, namespace });
+}
+//# sourceMappingURL=index.js.map

package/dist/adapters/minikube/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAiC,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,QAAQ,4CAA4C,CAC9G,CAAC;IACJ,CAAC;IAED,OAAO,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../types';\nimport { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';\nimport { generateSupabaseAuthArtifacts } from './supabase';\n\nexport function generateAuthProviderArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n  const { auth } = manifest;\n\n  if (!auth) {\n    return emptyMinikubeArtifacts();\n  }\n\n  if (auth.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported auth provider for minikube adapter: \"${auth.provider}\". Only \"supabase\" is currently supported.`,\n    );\n  }\n\n  return generateSupabaseAuthArtifacts({ manifest, namespace });\n}\n"]}

package/dist/adapters/minikube/auth/supabase/index.d.ts

@@ -0,0 +1,7 @@
+import type { InfraManifestInput } from '../../../../types';
+import type { MinikubeAdapterArtifacts } from '../../contracts';
+export declare function generateSupabaseAuthArtifacts(args: {
+    manifest: InfraManifestInput;
+    namespace: string;
+}): MinikubeAdapterArtifacts;
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/minikube/auth/supabase/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CAiE3B"}

package/dist/adapters/minikube/auth/supabase/index.js

@@ -0,0 +1,213 @@
+export function generateSupabaseAuthArtifacts(args) {
+    const { manifest, namespace } = args;
+    const root = 'infra/minikube/k8s/auth/supabase';
+    const resourceRoot = 'auth/supabase';
+    const docsRoot = 'infra/minikube/auth';
+    const scope = manifest.auth?.scope ?? 'global';
+    const authzEngine = manifest.auth?.authorization.engine ?? 'native';
+    const authzKind = manifest.auth?.authorization.kind ?? 'RBAC';
+    const authFieldModel = resolveAuthFieldModel(manifest);
+    const warnings = [];
+    if (scope !== 'global') {
+        warnings.push(`Auth scope "${scope}" is not fully modeled yet for Supabase. Baseline resources assume global auth.`);
+    }
+    return {
+        files: [
+            {
+                path: `${root}/supabase-auth.configmap.yaml`,
+                content: getSupabaseConfigMap({
+                    namespace,
+                    scope,
+                    authzEngine,
+                    authzKind,
+                    authFieldModel,
+                }),
+            },
+            {
+                path: `${root}/supabase-auth.secret.yaml`,
+                content: getSupabaseSecret(namespace),
+            },
+            {
+                path: `${root}/app-runtime-auth.env.configmap.yaml`,
+                content: getRuntimeAuthEnvConfigMap({
+                    namespace,
+                    scope,
+                    authzEngine,
+                    authzKind,
+                    authFieldModel,
+                }),
+            },
+            {
+                path: `${docsRoot}/supabase-runtime-wiring.md`,
+                content: getSupabaseRuntimeWiringGuide(),
+            },
+        ],
+        resources: [
+            `${resourceRoot}/supabase-auth.configmap.yaml`,
+            `${resourceRoot}/supabase-auth.secret.yaml`,
+            `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,
+        ],
+        envEntries: [
+            'SUPABASE_SECRET_SYNC_ENABLED=true',
+            'SUPABASE_URL=',
+            'SUPABASE_ANON_KEY=',
+            'SUPABASE_SERVICE_ROLE_KEY=',
+            'SUPABASE_JWT_SECRET=',
+            'EXPO_PUBLIC_SUPABASE_URL=',
+            'EXPO_PUBLIC_SUPABASE_ANON_KEY=',
+        ],
+        warnings,
+    };
+}
+function getSupabaseConfigMap(args) {
+    const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;
+    return `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: supabase-auth-config
+  namespace: ${namespace}
+data:
+  AUTH_PROVIDER: "supabase"
+  AUTH_SCOPE: "${scope}"
+  AUTHZ_ENGINE: "${authzEngine}"
+  AUTHZ_KIND: "${authzKind}"
+  AUTH_SIGN_IN_IDENTIFIERS: "${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}"
+  AUTH_SIGN_UP_REQUIRED_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}"
+  AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
+  AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
+  AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
+`;
+}
+function getSupabaseSecret(namespace) {
+    return `apiVersion: v1
+kind: Secret
+metadata:
+  name: supabase-auth-secrets
+  namespace: ${namespace}
+type: Opaque
+stringData:
+  SUPABASE_URL: ""
+  SUPABASE_ANON_KEY: ""
+  SUPABASE_SERVICE_ROLE_KEY: ""
+  SUPABASE_JWT_SECRET: ""
+  EXPO_PUBLIC_SUPABASE_URL: ""
+  EXPO_PUBLIC_SUPABASE_ANON_KEY: ""
+`;
+}
+function getRuntimeAuthEnvConfigMap(args) {
+    const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;
+    return `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: app-runtime-auth-env
+  namespace: ${namespace}
+data:
+  AUTH_REQUIRED: "true"
+  AUTH_PROVIDER: "supabase"
+  AUTH_SCOPE: "${scope}"
+  AUTHZ_ENGINE: "${authzEngine}"
+  AUTHZ_KIND: "${authzKind}"
+  AUTH_SIGN_IN_IDENTIFIERS: "${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}"
+  AUTH_SIGN_UP_REQUIRED_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}"
+  AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
+  AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
+  AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
+  AUTH_TOKEN_HEADER: "Authorization"
+  AUTH_TOKEN_PREFIX: "Bearer"
+`;
+}
+function getSupabaseRuntimeWiringGuide() {
+    return `# Supabase Runtime Wiring
+
+This file documents the runtime conventions generated by the minikube Supabase adapter.
+
+## Generated Kubernetes Objects
+
+- \`ConfigMap/supabase-auth-config\`: high-level auth metadata.
+- \`Secret/supabase-auth-secrets\`: Supabase keys and public runtime keys.
+- \`ConfigMap/app-runtime-auth-env\`: auth runtime feature flags and authz metadata.
+
+## App Runtime Convention
+
+Your app runtime deployment should import both:
+
+- \`app-runtime-auth-env\` (configMap)
+- \`supabase-auth-secrets\` (secret)
+
+Example deployment fragment:
+
+\`\`\`yaml
+envFrom:
+  - configMapRef:
+      name: app-runtime-auth-env
+  - secretRef:
+      name: supabase-auth-secrets
+\`\`\`
+
+The generated base deployment at \`k8s/app/deployment.yaml\` already includes this wiring
+with \`optional: true\` for auth sources.
+
+## Expected Environment Variables
+
+- \`AUTH_REQUIRED\`
+- \`AUTH_PROVIDER\`
+- \`AUTH_SCOPE\`
+- \`AUTHZ_ENGINE\`
+- \`AUTHZ_KIND\`
+- \`AUTH_SIGN_IN_IDENTIFIERS\`
+- \`AUTH_SIGN_UP_REQUIRED_FIELDS\`
+- \`AUTH_SIGN_UP_OPTIONAL_FIELDS\`
+- \`AUTH_SIGN_UP_POLICY\`
+- \`AUTH_PROFILE_FIELDS\`
+- \`SUPABASE_SECRET_SYNC_ENABLED\`
+- \`SUPABASE_URL\`
+- \`SUPABASE_ANON_KEY\`
+- \`SUPABASE_SERVICE_ROLE_KEY\`
+- \`SUPABASE_JWT_SECRET\`
+- \`EXPO_PUBLIC_SUPABASE_URL\`
+- \`EXPO_PUBLIC_SUPABASE_ANON_KEY\`
+
+## Secret Sync
+
+When \`SUPABASE_SECRET_SYNC_ENABLED=true\`, \`scripts/up.sh\` will create/update
+\`Secret/supabase-auth-secrets\` from the loaded environment values.
+`;
+}
+const DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];
+const DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];
+const DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];
+const DEFAULT_SIGN_UP_POLICY = 'autoSignIn';
+const DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];
+function resolveAuthFieldModel(manifest) {
+    const signInIdentifiers = normalizeFieldList(manifest.auth?.signIn?.identifiers, DEFAULT_SIGN_IN_IDENTIFIERS);
+    const signUpRequiredFields = normalizeFieldList(manifest.auth?.signUp?.requiredFields, DEFAULT_SIGN_UP_REQUIRED_FIELDS);
+    const signUpOptionalFields = normalizeFieldList(manifest.auth?.signUp?.optionalFields, DEFAULT_SIGN_UP_OPTIONAL_FIELDS).filter((field) => !signUpRequiredFields.includes(field));
+    const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;
+    const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, DEFAULT_PROFILE_FIELDS);
+    return {
+        signInIdentifiersCsv: signInIdentifiers.join(','),
+        signUpRequiredFieldsCsv: signUpRequiredFields.join(','),
+        signUpOptionalFieldsCsv: signUpOptionalFields.join(','),
+        signUpPolicy,
+        profileFieldsCsv: profileFields.join(','),
+    };
+}
+function normalizeFieldList(values, fallback) {
+    const source = values ?? fallback;
+    const next = [];
+    for (const value of source) {
+        const normalized = value.trim();
+        if (!normalized || next.includes(normalized)) {
+            continue;
+        }
+        next.push(normalized);
+    }
+    if (next.length > 0) {
+        return next;
+    }
+    return [...fallback];
+}
+function escapeYamlDoubleQuoted(value) {
+    return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
+}
+//# sourceMappingURL=index.js.map

package/dist/adapters/minikube/auth/supabase/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAErC,MAAM,IAAI,GAAG,kCAAkC,CAAC;IAChD,MAAM,YAAY,GAAG,eAAe,CAAC;IACrC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,IAAI,QAAQ,CAAC;IACpE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,IAAI,MAAM,CAAC;IAC9D,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,eAAe,KAAK,iFAAiF,CACtG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,oBAAoB,CAAC;oBAC5B,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;iBACf,CAAC;aACH;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,4BAA4B;gBACzC,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC;aACtC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sCAAsC;gBACnD,OAAO,EAAE,0BAA0B,CAAC;oBAClC,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;iBACf,CAAC;aACH;YACD;gBACE,IAAI,EAAE,GAAG,QAAQ,6BAA6B;gBAC9C,OAAO,EAAE,6BAA6B,EAAE;aACzC;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,4BAA4B;YAC3C,GAAG,YAAY,sCAAsC;SACtD;QACD,UAAU,EAAE;YACV,mCAAmC;YACnC,eAAe;YACf,oBAAoB;YACpB,4BAA4B;YAC5B,sBAAsB;YACtB,2BAA2B;YAC3B,gCAAgC;SACjC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAM7B;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAE1E,OAAO;;;;eAIM,SAAS;;;iBAGP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;CAChF,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO;;;;eAIM,SAAS;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAAC,IAMnC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAE1E,OAAO;;;;eAIM,SAAS;;;;iBAIP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;;;CAGhF,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B;IACpC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDR,CAAC;AACF,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9C,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC9D,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAC5C,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAUlE,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAClC,2BAA2B,CAC5B,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IACnF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEjG,OAAO;QACL,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,YAAY;QACZ,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAqC,EACrC,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\n\nexport function generateSupabaseAuthArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n\n  const root = 'infra/minikube/k8s/auth/supabase';\n  const resourceRoot = 'auth/supabase';\n  const docsRoot = 'infra/minikube/auth';\n  const scope = manifest.auth?.scope ?? 'global';\n  const authzEngine = manifest.auth?.authorization.engine ?? 'native';\n  const authzKind = manifest.auth?.authorization.kind ?? 'RBAC';\n  const authFieldModel = resolveAuthFieldModel(manifest);\n\n  const warnings: string[] = [];\n  if (scope !== 'global') {\n    warnings.push(\n      `Auth scope \"${scope}\" is not fully modeled yet for Supabase. Baseline resources assume global auth.`,\n    );\n  }\n\n  return {\n    files: [\n      {\n        path: `${root}/supabase-auth.configmap.yaml`,\n        content: getSupabaseConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n        }),\n      },\n      {\n        path: `${root}/supabase-auth.secret.yaml`,\n        content: getSupabaseSecret(namespace),\n      },\n      {\n        path: `${root}/app-runtime-auth.env.configmap.yaml`,\n        content: getRuntimeAuthEnvConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n        }),\n      },\n      {\n        path: `${docsRoot}/supabase-runtime-wiring.md`,\n        content: getSupabaseRuntimeWiringGuide(),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/supabase-auth.configmap.yaml`,\n      `${resourceRoot}/supabase-auth.secret.yaml`,\n      `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,\n    ],\n    envEntries: [\n      'SUPABASE_SECRET_SYNC_ENABLED=true',\n      'SUPABASE_URL=',\n      'SUPABASE_ANON_KEY=',\n      'SUPABASE_SERVICE_ROLE_KEY=',\n      'SUPABASE_JWT_SECRET=',\n      'EXPO_PUBLIC_SUPABASE_URL=',\n      'EXPO_PUBLIC_SUPABASE_ANON_KEY=',\n    ],\n    warnings,\n  };\n}\n\nfunction getSupabaseConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-auth-config\n  namespace: ${namespace}\ndata:\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n`;\n}\n\nfunction getSupabaseSecret(namespace: string) {\n  return `apiVersion: v1\nkind: Secret\nmetadata:\n  name: supabase-auth-secrets\n  namespace: ${namespace}\ntype: Opaque\nstringData:\n  SUPABASE_URL: \"\"\n  SUPABASE_ANON_KEY: \"\"\n  SUPABASE_SERVICE_ROLE_KEY: \"\"\n  SUPABASE_JWT_SECRET: \"\"\n  EXPO_PUBLIC_SUPABASE_URL: \"\"\n  EXPO_PUBLIC_SUPABASE_ANON_KEY: \"\"\n`;\n}\n\nfunction getRuntimeAuthEnvConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-runtime-auth-env\n  namespace: ${namespace}\ndata:\n  AUTH_REQUIRED: \"true\"\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_TOKEN_HEADER: \"Authorization\"\n  AUTH_TOKEN_PREFIX: \"Bearer\"\n`;\n}\n\nfunction getSupabaseRuntimeWiringGuide() {\n  return `# Supabase Runtime Wiring\n\nThis file documents the runtime conventions generated by the minikube Supabase adapter.\n\n## Generated Kubernetes Objects\n\n- \\`ConfigMap/supabase-auth-config\\`: high-level auth metadata.\n- \\`Secret/supabase-auth-secrets\\`: Supabase keys and public runtime keys.\n- \\`ConfigMap/app-runtime-auth-env\\`: auth runtime feature flags and authz metadata.\n\n## App Runtime Convention\n\nYour app runtime deployment should import both:\n\n- \\`app-runtime-auth-env\\` (configMap)\n- \\`supabase-auth-secrets\\` (secret)\n\nExample deployment fragment:\n\n\\`\\`\\`yaml\nenvFrom:\n  - configMapRef:\n      name: app-runtime-auth-env\n  - secretRef:\n      name: supabase-auth-secrets\n\\`\\`\\`\n\nThe generated base deployment at \\`k8s/app/deployment.yaml\\` already includes this wiring\nwith \\`optional: true\\` for auth sources.\n\n## Expected Environment Variables\n\n- \\`AUTH_REQUIRED\\`\n- \\`AUTH_PROVIDER\\`\n- \\`AUTH_SCOPE\\`\n- \\`AUTHZ_ENGINE\\`\n- \\`AUTHZ_KIND\\`\n- \\`AUTH_SIGN_IN_IDENTIFIERS\\`\n- \\`AUTH_SIGN_UP_REQUIRED_FIELDS\\`\n- \\`AUTH_SIGN_UP_OPTIONAL_FIELDS\\`\n- \\`AUTH_SIGN_UP_POLICY\\`\n- \\`AUTH_PROFILE_FIELDS\\`\n- \\`SUPABASE_SECRET_SYNC_ENABLED\\`\n- \\`SUPABASE_URL\\`\n- \\`SUPABASE_ANON_KEY\\`\n- \\`SUPABASE_SERVICE_ROLE_KEY\\`\n- \\`SUPABASE_JWT_SECRET\\`\n- \\`EXPO_PUBLIC_SUPABASE_URL\\`\n- \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\`\n\n## Secret Sync\n\nWhen \\`SUPABASE_SECRET_SYNC_ENABLED=true\\`, \\`scripts/up.sh\\` will create/update\n\\`Secret/supabase-auth-secrets\\` from the loaded environment values.\n`;\n}\n\nconst DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];\nconst DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];\nconst DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];\nconst DEFAULT_SIGN_UP_POLICY = 'autoSignIn';\nconst DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];\n\ninterface ResolvedAuthFieldModel {\n  signInIdentifiersCsv: string;\n  signUpRequiredFieldsCsv: string;\n  signUpOptionalFieldsCsv: string;\n  signUpPolicy: string;\n  profileFieldsCsv: string;\n}\n\nfunction resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {\n  const signInIdentifiers = normalizeFieldList(\n    manifest.auth?.signIn?.identifiers,\n    DEFAULT_SIGN_IN_IDENTIFIERS,\n  );\n  const signUpRequiredFields = normalizeFieldList(\n    manifest.auth?.signUp?.requiredFields,\n    DEFAULT_SIGN_UP_REQUIRED_FIELDS,\n  );\n  const signUpOptionalFields = normalizeFieldList(\n    manifest.auth?.signUp?.optionalFields,\n    DEFAULT_SIGN_UP_OPTIONAL_FIELDS,\n  ).filter((field) => !signUpRequiredFields.includes(field));\n  const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;\n  const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, DEFAULT_PROFILE_FIELDS);\n\n  return {\n    signInIdentifiersCsv: signInIdentifiers.join(','),\n    signUpRequiredFieldsCsv: signUpRequiredFields.join(','),\n    signUpOptionalFieldsCsv: signUpOptionalFields.join(','),\n    signUpPolicy,\n    profileFieldsCsv: profileFields.join(','),\n  };\n}\n\nfunction normalizeFieldList(\n  values: readonly string[] | undefined,\n  fallback: readonly string[],\n): string[] {\n  const source = values ?? fallback;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized || next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  if (next.length > 0) {\n    return next;\n  }\n\n  return [...fallback];\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}

package/dist/adapters/minikube/authz/cerbos/index.d.ts

@@ -0,0 +1,9 @@
+import type { AppManifest } from '@ankhorage/contracts';
+import type { InfraManifestInput } from '../../../../types';
+import type { MinikubeAdapterArtifacts } from '../../contracts';
+export declare function generateCerbosAuthzArtifacts(args: {
+    manifest: InfraManifestInput;
+    namespace: string;
+    appManifest?: Pick<AppManifest, 'metadata' | 'navigator' | 'screens' | 'settings'>;
+}): MinikubeAdapterArtifacts;
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/minikube/authz/cerbos/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/authz/cerbos/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAkC,MAAM,sBAAsB,CAAC;AAExF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;CACpF,GAAG,wBAAwB,CAmC3B"}