@ankhorage/infra 0.0.0

package/package.json

@@ -0,0 +1,86 @@
+{
+  "name": "@ankhorage/infra",
+  "type": "module",
+  "version": "0.0.0",
+  "description": "Provider-neutral infrastructure generation: turns app manifests, datasets, auth, state, storage, and deployment config into generated infra artifacts, migrations, seeds, APIs, and runtime dependencies.",
+  "homepage": "https://github.com/ankhorage/infra#readme",
+  "bugs": {
+    "url": "https://github.com/ankhorage/infra/issues"
+  },
+  "license": "MIT",
+  "main": "./dist/index.js",
+  "sideEffects": false,
+  "types": "./dist/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ankhorage/infra.git"
+  },
+  "keywords": [
+    "ankhorage",
+    "infra",
+    "infrastructure",
+    "infrastructure-as-code",
+    "code-generation",
+    "app-manifest",
+    "typescript",
+    "bun",
+    "expo",
+    "react-native",
+    "supabase",
+    "postgres",
+    "kubernetes",
+    "minikube",
+    "openapi"
+  ],
+  "dependencies": {
+    "@ankhorage/contracts": "^1.15.0"
+  },
+  "files": [
+    "dist",
+    "src",
+    "package.json",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./metadata": {
+      "types": "./dist/metadata/index.d.ts",
+      "import": "./dist/metadata/index.js",
+      "default": "./dist/metadata/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "rm -rf dist tsconfig.tsbuildinfo && bun x tsc -p tsconfig.json",
+    "changeset": "changeset",
+    "changeset:status": "changeset status --since=origin/main",
+    "docs": "paradox",
+    "knip": "ankhorage-knip",
+    "lint": "ankhorage-eslint . --max-warnings=0",
+    "lint:fix": "ankhorage-eslint . --fix --max-warnings=0",
+    "format": "ankhorage-prettier --write .",
+    "format:check": "ankhorage-prettier --check .",
+    "prepack": "bun run build",
+    "test": "bun test src",
+    "typecheck": "bun x tsc --noEmit -p tsconfig.json",
+    "version-packages": "changeset version"
+  },
+  "devDependencies": {
+    "@ankhorage/devtools": "^1.0.6",
+    "@ankhorage/paradox": "^0.1.10",
+    "@changesets/cli": "^2.31.0",
+    "@types/bun": "^1.3.13",
+    "@types/node": "^25.6.0",
+    "typescript": "^5.9.3"
+  },
+  "packageManager": "bun@1.3.13"
+}

package/src/adapters/minikube/README.md

@@ -0,0 +1,73 @@
+# Minikube Adapter
+
+Generates local Kubernetes artifacts under `infra/minikube/*` from `InfraManifest`.
+
+## Structure
+
+- `base/`: namespace, app runtime, kustomization, helper scripts.
+- `auth/`: auth provider artifacts (implemented: `supabase`).
+- `authz/`: authorization engine artifacts (implemented: `cerbos`; `native` warning-only/no resources; `opa` unsupported).
+
+Cerbos policy generation uses app manifest intent (navigator routes/screens + authFlow) when provided by caller.
+
+## Runtime Scripts
+
+- `scripts/up.sh`: starts minikube (if needed) and applies all generated manifests.
+- `scripts/build-app-image.sh`: exports Expo web build from app source and builds Docker image.
+- `scripts/port-forward.sh`: forwards `service/app-runtime` to local HTTP (default `127.0.0.1:18080`).
+- `scripts/status.sh`: validates kube context/API reachability and shows namespace resources.
+- `scripts/down.sh`: deletes generated manifests from the cluster.
+- `scripts/supabase-local-env.sh`: reads `supabase status -o env` and writes Supabase keys into `infra/minikube/.env`.
+
+Build prerequisites for `build-app-image.sh`:
+
+- `bun` / `bunx`
+- `docker`
+
+## App Image Behavior
+
+- Default app image: `ankh/<namespace>:dev` (for example `ankh/shop:dev`).
+- By default `up.sh` triggers `build-app-image.sh` (`APP_BUILD_ENABLED=true`) before apply.
+- `build-app-image.sh` runs `bunx expo export --platform web`, then builds via `app-image/Dockerfile`.
+- `up.sh` syncs runtime image using `APP_IMAGE_SYNC_STRATEGY`:
+  - `docker-load` (default): loads existing local Docker image into Minikube.
+  - `minikube-build`: builds exported web artifacts directly into Minikube image store.
+  - `none`: skips local image sync.
+- Project deletion removes the exact generated `APP_IMAGE` from Minikube and host Docker on a best-effort basis.
+- Generated image cleanup defaults can be overridden in `infra/minikube/.env`:
+  - `APP_IMAGE_CLEANUP_ON_DOWN=false`: disables generated app image cleanup.
+  - `APP_IMAGE_CLEANUP_MINIKUBE=false`: keeps the Minikube image cache entry.
+  - `APP_IMAGE_CLEANUP_DOCKER=false`: keeps the host Docker image.
+- Cleanup removes only the exact `APP_IMAGE`; it does not run global Docker image or network pruning.
+- Private registries are supported via optional `.env` keys:
+  - `APP_BUILD_ENABLED`
+  - `APP_SOURCE_DIR`
+  - `SUPABASE_PROJECT_DIR`
+  - `APP_WEB_EXPORT_DIR`
+  - `APP_IMAGE_SYNC_STRATEGY`
+  - `AUTH_RUNTIME_MODE`
+  - `APP_PORT_FORWARD_LOCAL_PORT`
+  - `APP_PORT_FORWARD_REMOTE_PORT`
+  - `SUPABASE_SECRET_SYNC_ENABLED`
+  - `APP_IMAGE_PULL_SECRET_NAME`
+  - `APP_IMAGE_PULL_SECRET_SERVER`
+  - `APP_IMAGE_PULL_SECRET_USERNAME`
+  - `APP_IMAGE_PULL_SECRET_PASSWORD`
+  - `APP_IMAGE_PULL_SECRET_EMAIL`
+
+When pull-secret values are provided, `up.sh` creates/updates the secret and patches
+`deployment/app-runtime` with `imagePullSecrets`.
+
+When `SUPABASE_SECRET_SYNC_ENABLED=true` and required Supabase keys are present,
+`up.sh` creates/updates `secret/supabase-auth-secrets` from env values.
+
+When `AUTH_RUNTIME_MODE=local` (default) and Supabase keys are missing, `up.sh`
+auto-runs `scripts/supabase-local-env.sh`, reloads `.env`, and retries secret sync.
+If `supabase/config.toml` is missing in `SUPABASE_PROJECT_DIR`, the helper now runs
+`supabase init --yes` automatically before starting local Supabase.
+
+## Practical Selector Rule
+
+When building config UI or pickers, only show currently supported values from adapter-owned support lists
+(`DEPLOYMENT_TARGETS`, `DATABASE_PROVIDERS`, `AUTH_PROVIDERS`, `AUTH_SCOPES`, `AUTHZ_ENGINES`).
+Do not show planned values until an adapter path exists in this folder.

package/src/adapters/minikube/auth/index.ts

@@ -0,0 +1,23 @@
+import type { InfraManifestInput } from '../../../types';
+import { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';
+import { generateSupabaseAuthArtifacts } from './supabase';
+
+export function generateAuthProviderArtifacts(args: {
+  manifest: InfraManifestInput;
+  namespace: string;
+}): MinikubeAdapterArtifacts {
+  const { manifest, namespace } = args;
+  const { auth } = manifest;
+
+  if (!auth) {
+    return emptyMinikubeArtifacts();
+  }
+
+  if (auth.provider !== 'supabase') {
+    throw new Error(
+      `Unsupported auth provider for minikube adapter: "${auth.provider}". Only "supabase" is currently supported.`,
+    );
+  }
+
+  return generateSupabaseAuthArtifacts({ manifest, namespace });
+}

package/src/adapters/minikube/auth/supabase/index.ts

@@ -0,0 +1,269 @@
+import type { InfraManifestInput } from '../../../../types';
+import type { MinikubeAdapterArtifacts } from '../../contracts';
+
+export function generateSupabaseAuthArtifacts(args: {
+  manifest: InfraManifestInput;
+  namespace: string;
+}): MinikubeAdapterArtifacts {
+  const { manifest, namespace } = args;
+
+  const root = 'infra/minikube/k8s/auth/supabase';
+  const resourceRoot = 'auth/supabase';
+  const docsRoot = 'infra/minikube/auth';
+  const scope = manifest.auth?.scope ?? 'global';
+  const authzEngine = manifest.auth?.authorization.engine ?? 'native';
+  const authzKind = manifest.auth?.authorization.kind ?? 'RBAC';
+  const authFieldModel = resolveAuthFieldModel(manifest);
+
+  const warnings: string[] = [];
+  if (scope !== 'global') {
+    warnings.push(
+      `Auth scope "${scope}" is not fully modeled yet for Supabase. Baseline resources assume global auth.`,
+    );
+  }
+
+  return {
+    files: [
+      {
+        path: `${root}/supabase-auth.configmap.yaml`,
+        content: getSupabaseConfigMap({
+          namespace,
+          scope,
+          authzEngine,
+          authzKind,
+          authFieldModel,
+        }),
+      },
+      {
+        path: `${root}/supabase-auth.secret.yaml`,
+        content: getSupabaseSecret(namespace),
+      },
+      {
+        path: `${root}/app-runtime-auth.env.configmap.yaml`,
+        content: getRuntimeAuthEnvConfigMap({
+          namespace,
+          scope,
+          authzEngine,
+          authzKind,
+          authFieldModel,
+        }),
+      },
+      {
+        path: `${docsRoot}/supabase-runtime-wiring.md`,
+        content: getSupabaseRuntimeWiringGuide(),
+      },
+    ],
+    resources: [
+      `${resourceRoot}/supabase-auth.configmap.yaml`,
+      `${resourceRoot}/supabase-auth.secret.yaml`,
+      `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,
+    ],
+    envEntries: [
+      'SUPABASE_SECRET_SYNC_ENABLED=true',
+      'SUPABASE_URL=',
+      'SUPABASE_ANON_KEY=',
+      'SUPABASE_SERVICE_ROLE_KEY=',
+      'SUPABASE_JWT_SECRET=',
+      'EXPO_PUBLIC_SUPABASE_URL=',
+      'EXPO_PUBLIC_SUPABASE_ANON_KEY=',
+    ],
+    warnings,
+  };
+}
+
+function getSupabaseConfigMap(args: {
+  namespace: string;
+  scope: string;
+  authzEngine: string;
+  authzKind: string;
+  authFieldModel: ResolvedAuthFieldModel;
+}) {
+  const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;
+
+  return `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: supabase-auth-config
+  namespace: ${namespace}
+data:
+  AUTH_PROVIDER: "supabase"
+  AUTH_SCOPE: "${scope}"
+  AUTHZ_ENGINE: "${authzEngine}"
+  AUTHZ_KIND: "${authzKind}"
+  AUTH_SIGN_IN_IDENTIFIERS: "${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}"
+  AUTH_SIGN_UP_REQUIRED_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}"
+  AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
+  AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
+  AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
+`;
+}
+
+function getSupabaseSecret(namespace: string) {
+  return `apiVersion: v1
+kind: Secret
+metadata:
+  name: supabase-auth-secrets
+  namespace: ${namespace}
+type: Opaque
+stringData:
+  SUPABASE_URL: ""
+  SUPABASE_ANON_KEY: ""
+  SUPABASE_SERVICE_ROLE_KEY: ""
+  SUPABASE_JWT_SECRET: ""
+  EXPO_PUBLIC_SUPABASE_URL: ""
+  EXPO_PUBLIC_SUPABASE_ANON_KEY: ""
+`;
+}
+
+function getRuntimeAuthEnvConfigMap(args: {
+  namespace: string;
+  scope: string;
+  authzEngine: string;
+  authzKind: string;
+  authFieldModel: ResolvedAuthFieldModel;
+}) {
+  const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;
+
+  return `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: app-runtime-auth-env
+  namespace: ${namespace}
+data:
+  AUTH_REQUIRED: "true"
+  AUTH_PROVIDER: "supabase"
+  AUTH_SCOPE: "${scope}"
+  AUTHZ_ENGINE: "${authzEngine}"
+  AUTHZ_KIND: "${authzKind}"
+  AUTH_SIGN_IN_IDENTIFIERS: "${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}"
+  AUTH_SIGN_UP_REQUIRED_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}"
+  AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
+  AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
+  AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
+  AUTH_TOKEN_HEADER: "Authorization"
+  AUTH_TOKEN_PREFIX: "Bearer"
+`;
+}
+
+function getSupabaseRuntimeWiringGuide() {
+  return `# Supabase Runtime Wiring
+
+This file documents the runtime conventions generated by the minikube Supabase adapter.
+
+## Generated Kubernetes Objects
+
+- \`ConfigMap/supabase-auth-config\`: high-level auth metadata.
+- \`Secret/supabase-auth-secrets\`: Supabase keys and public runtime keys.
+- \`ConfigMap/app-runtime-auth-env\`: auth runtime feature flags and authz metadata.
+
+## App Runtime Convention
+
+Your app runtime deployment should import both:
+
+- \`app-runtime-auth-env\` (configMap)
+- \`supabase-auth-secrets\` (secret)
+
+Example deployment fragment:
+
+\`\`\`yaml
+envFrom:
+  - configMapRef:
+      name: app-runtime-auth-env
+  - secretRef:
+      name: supabase-auth-secrets
+\`\`\`
+
+The generated base deployment at \`k8s/app/deployment.yaml\` already includes this wiring
+with \`optional: true\` for auth sources.
+
+## Expected Environment Variables
+
+- \`AUTH_REQUIRED\`
+- \`AUTH_PROVIDER\`
+- \`AUTH_SCOPE\`
+- \`AUTHZ_ENGINE\`
+- \`AUTHZ_KIND\`
+- \`AUTH_SIGN_IN_IDENTIFIERS\`
+- \`AUTH_SIGN_UP_REQUIRED_FIELDS\`
+- \`AUTH_SIGN_UP_OPTIONAL_FIELDS\`
+- \`AUTH_SIGN_UP_POLICY\`
+- \`AUTH_PROFILE_FIELDS\`
+- \`SUPABASE_SECRET_SYNC_ENABLED\`
+- \`SUPABASE_URL\`
+- \`SUPABASE_ANON_KEY\`
+- \`SUPABASE_SERVICE_ROLE_KEY\`
+- \`SUPABASE_JWT_SECRET\`
+- \`EXPO_PUBLIC_SUPABASE_URL\`
+- \`EXPO_PUBLIC_SUPABASE_ANON_KEY\`
+
+## Secret Sync
+
+When \`SUPABASE_SECRET_SYNC_ENABLED=true\`, \`scripts/up.sh\` will create/update
+\`Secret/supabase-auth-secrets\` from the loaded environment values.
+`;
+}
+
+const DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];
+const DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];
+const DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];
+const DEFAULT_SIGN_UP_POLICY = 'autoSignIn';
+const DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];
+
+interface ResolvedAuthFieldModel {
+  signInIdentifiersCsv: string;
+  signUpRequiredFieldsCsv: string;
+  signUpOptionalFieldsCsv: string;
+  signUpPolicy: string;
+  profileFieldsCsv: string;
+}
+
+function resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {
+  const signInIdentifiers = normalizeFieldList(
+    manifest.auth?.signIn?.identifiers,
+    DEFAULT_SIGN_IN_IDENTIFIERS,
+  );
+  const signUpRequiredFields = normalizeFieldList(
+    manifest.auth?.signUp?.requiredFields,
+    DEFAULT_SIGN_UP_REQUIRED_FIELDS,
+  );
+  const signUpOptionalFields = normalizeFieldList(
+    manifest.auth?.signUp?.optionalFields,
+    DEFAULT_SIGN_UP_OPTIONAL_FIELDS,
+  ).filter((field) => !signUpRequiredFields.includes(field));
+  const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;
+  const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, DEFAULT_PROFILE_FIELDS);
+
+  return {
+    signInIdentifiersCsv: signInIdentifiers.join(','),
+    signUpRequiredFieldsCsv: signUpRequiredFields.join(','),
+    signUpOptionalFieldsCsv: signUpOptionalFields.join(','),
+    signUpPolicy,
+    profileFieldsCsv: profileFields.join(','),
+  };
+}
+
+function normalizeFieldList(
+  values: readonly string[] | undefined,
+  fallback: readonly string[],
+): string[] {
+  const source = values ?? fallback;
+  const next: string[] = [];
+
+  for (const value of source) {
+    const normalized = value.trim();
+    if (!normalized || next.includes(normalized)) {
+      continue;
+    }
+    next.push(normalized);
+  }
+
+  if (next.length > 0) {
+    return next;
+  }
+
+  return [...fallback];
+}
+
+function escapeYamlDoubleQuoted(value: string): string {
+  return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
+}