@ankhorage/infra 0.3.7 → 0.4.0

package/dist/adapters/minikube/index.js

@@ -2,6 +2,7 @@ import { generateApiInfrastructureArtifacts } from '../../apiArtifacts';
 import { generateAuthProviderArtifacts } from './auth';
 import { generateAuthorizationArtifacts } from './authz';
 import { generateMinikubeBaseArtifacts } from './base';
+import { generateSecretStoreArtifacts } from './secrets';
 import { generateStorageArtifacts } from './storage';
 const DEFAULT_NAMESPACE = 'ankh-app';
 export function generateMinikubeInfra(manifest, options = {}) {
@@ -19,6 +20,7 @@ export function generateMinikubeInfra(manifest, options = {}) {
         appManifest: options.appManifest,
     });
     const storageArtifacts = generateStorageArtifacts({ manifest, namespace });
+    const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });
     const apiArtifacts = generateApiInfrastructureArtifacts({
         data: options.appManifest?.data,
         databaseProvider: manifest.database?.provider,
@@ -27,11 +29,13 @@ export function generateMinikubeInfra(manifest, options = {}) {
         ...authArtifacts.resources,
         ...authzArtifacts.resources,
         ...storageArtifacts.resources,
+        ...secretStoreArtifacts.resources,
     ]);
     const extraEnvEntries = unique([
         ...authArtifacts.envEntries,
         ...authzArtifacts.envEntries,
         ...storageArtifacts.envEntries,
+        ...secretStoreArtifacts.envEntries,
     ]);
     const baseFiles = generateMinikubeBaseArtifacts({
         manifest,
@@ -44,6 +48,7 @@ export function generateMinikubeInfra(manifest, options = {}) {
         ...authArtifacts.warnings,
         ...authzArtifacts.warnings,
         ...storageArtifacts.warnings,
+        ...secretStoreArtifacts.warnings,
         ...apiArtifacts.warnings,
     ]);
     return {
@@ -52,6 +57,7 @@ export function generateMinikubeInfra(manifest, options = {}) {
             ...authArtifacts.files,
             ...authzArtifacts.files,
             ...storageArtifacts.files,
+            ...secretStoreArtifacts.files,
             ...apiArtifacts.files,
         ],
         warnings,
@@ -73,6 +79,8 @@ function collectProviders(manifest) {
         providers.add(manifest.database.provider);
     if (manifest.storage?.provider)
         providers.add(manifest.storage.provider);
+    if (manifest.secretStore?.provider)
+        providers.add(manifest.secretStore.provider);
     if (manifest.state?.provider)
         providers.add(manifest.state.provider);
     return [...providers].sort();

package/dist/adapters/minikube/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AAOxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEtD,MAAM,aAAa,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,kCAAkC,CAAC;QACtD,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI;QAC/B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,SAAS;QACT,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,YAAY,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,YAAY,CAAC,KAAK;SACtB;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA4B,EAC5B,OAAwC;IAExC,MAAM,MAAM,GACV,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC;IAE5F,MAAM,UAAU,GAAG,MAAM;SACtB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,IAAI,IAAI,iBAAiB,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateApiInfrastructureArtifacts } from '../../apiArtifacts';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { generateMinikubeBaseArtifacts } from './base';\nimport { generateStorageArtifacts } from './storage';\n\nconst DEFAULT_NAMESPACE = 'ankh-app';\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const namespace = resolveNamespace(manifest, options);\n\n  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const apiArtifacts = generateApiInfrastructureArtifacts({\n    data: options.appManifest?.data,\n    databaseProvider: manifest.database?.provider,\n  });\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n  ]);\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    namespace,\n    extraResources,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...apiArtifacts.warnings,\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...apiArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction resolveNamespace(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions,\n): string {\n  const source =\n    manifest.networking?.domain?.trim() ?? options.namespaceHint?.trim() ?? DEFAULT_NAMESPACE;\n\n  const normalized = source\n    .toLowerCase()\n    .replace(/[^a-z0-9-]/g, '-')\n    .replace(/-+/g, '-')\n    .replace(/^-|-$/g, '');\n\n  const safe = normalized.slice(0, 63).replace(/-+$/g, '');\n  return safe || DEFAULT_NAMESPACE;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AAOxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEtD,MAAM,aAAa,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,kCAAkC,CAAC;QACtD,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI;QAC/B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,SAAS;QACT,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,YAAY,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,YAAY,CAAC,KAAK;SACtB;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA4B,EAC5B,OAAwC;IAExC,MAAM,MAAM,GACV,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC;IAE5F,MAAM,UAAU,GAAG,MAAM;SACtB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,IAAI,IAAI,iBAAiB,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateApiInfrastructureArtifacts } from '../../apiArtifacts';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst DEFAULT_NAMESPACE = 'ankh-app';\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const namespace = resolveNamespace(manifest, options);\n\n  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const apiArtifacts = generateApiInfrastructureArtifacts({\n    data: options.appManifest?.data,\n    databaseProvider: manifest.database?.provider,\n  });\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    namespace,\n    extraResources,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...apiArtifacts.warnings,\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...apiArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction resolveNamespace(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions,\n): string {\n  const source =\n    manifest.networking?.domain?.trim() ?? options.namespaceHint?.trim() ?? DEFAULT_NAMESPACE;\n\n  const normalized = source\n    .toLowerCase()\n    .replace(/[^a-z0-9-]/g, '-')\n    .replace(/-+/g, '-')\n    .replace(/^-|-$/g, '');\n\n  const safe = normalized.slice(0, 63).replace(/-+$/g, '');\n  return safe || DEFAULT_NAMESPACE;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}

package/dist/adapters/minikube/secrets/index.d.ts

@@ -0,0 +1,7 @@
+import type { InfraManifestInput } from '../../../types';
+import { type MinikubeAdapterArtifacts } from '../contracts';
+export declare function generateSecretStoreArtifacts(args: {
+    readonly manifest: InfraManifestInput;
+    readonly namespace: string;
+}): MinikubeAdapterArtifacts;
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/minikube/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/secrets/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAGrF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GAAG,wBAAwB,CAS3B"}

package/dist/adapters/minikube/secrets/index.js

@@ -0,0 +1,13 @@
+import { SUPABASE_VAULT_SECRET_STORE_PROVIDER } from '@ankhorage/supabase-vault';
+import { emptyMinikubeArtifacts } from '../contracts';
+import { generateSupabaseVaultSecretStoreArtifacts } from './supabase-vault';
+export function generateSecretStoreArtifacts(args) {
+    const provider = args.manifest.secretStore?.provider;
+    if (!provider)
+        return emptyMinikubeArtifacts();
+    if (provider === SUPABASE_VAULT_SECRET_STORE_PROVIDER) {
+        return generateSupabaseVaultSecretStoreArtifacts(args);
+    }
+    throw new Error(`Unsupported secret-store provider for minikube adapter: "${provider}".`);
+}
+//# sourceMappingURL=index.js.map

package/dist/adapters/minikube/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,2BAA2B,CAAC;AAGjF,OAAO,EAAE,sBAAsB,EAAiC,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,yCAAyC,EAAE,MAAM,kBAAkB,CAAC;AAE7E,MAAM,UAAU,4BAA4B,CAAC,IAG5C;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,sBAAsB,EAAE,CAAC;IAE/C,IAAI,QAAQ,KAAK,oCAAoC,EAAE,CAAC;QACtD,OAAO,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4DAA4D,QAAQ,IAAI,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import { SUPABASE_VAULT_SECRET_STORE_PROVIDER } from '@ankhorage/supabase-vault';\n\nimport type { InfraManifestInput } from '../../../types';\nimport { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';\nimport { generateSupabaseVaultSecretStoreArtifacts } from './supabase-vault';\n\nexport function generateSecretStoreArtifacts(args: {\n  readonly manifest: InfraManifestInput;\n  readonly namespace: string;\n}): MinikubeAdapterArtifacts {\n  const provider = args.manifest.secretStore?.provider;\n  if (!provider) return emptyMinikubeArtifacts();\n\n  if (provider === SUPABASE_VAULT_SECRET_STORE_PROVIDER) {\n    return generateSupabaseVaultSecretStoreArtifacts(args);\n  }\n\n  throw new Error(`Unsupported secret-store provider for minikube adapter: \"${provider}\".`);\n}\n"]}

package/dist/adapters/minikube/secrets/supabase-vault/index.d.ts

@@ -0,0 +1,8 @@
+import type { InfraManifestInput } from '../../../../types';
+import type { MinikubeAdapterArtifacts } from '../../contracts';
+export declare const SUPABASE_VAULT_MIGRATION_PATH = "infra/minikube/supabase/migrations/202607120001_ankhorage_supabase_vault.sql";
+export declare function generateSupabaseVaultSecretStoreArtifacts(args: {
+    readonly manifest: InfraManifestInput;
+    readonly namespace: string;
+}): MinikubeAdapterArtifacts;
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/minikube/secrets/supabase-vault/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/secrets/supabase-vault/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,eAAO,MAAM,6BAA6B,iFACsC,CAAC;AAEjF,wBAAgB,yCAAyC,CAAC,IAAI,EAAE;IAC9D,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GAAG,wBAAwB,CAqB3B"}

package/dist/adapters/minikube/secrets/supabase-vault/index.js

@@ -0,0 +1,74 @@
+import { SUPABASE_VAULT_MIGRATION_SQL, SUPABASE_VAULT_SECRET_STORE_PROVIDER, } from '@ankhorage/supabase-vault';
+export const SUPABASE_VAULT_MIGRATION_PATH = 'infra/minikube/supabase/migrations/202607120001_ankhorage_supabase_vault.sql';
+export function generateSupabaseVaultSecretStoreArtifacts(args) {
+    validateOAuthSecretReferences(args.manifest);
+    return {
+        files: [
+            {
+                path: SUPABASE_VAULT_MIGRATION_PATH,
+                content: `${SUPABASE_VAULT_MIGRATION_SQL.trim()}\n`,
+            },
+            {
+                path: 'infra/minikube/secrets/supabase-vault.md',
+                content: getRuntimeGuide(args.namespace),
+            },
+        ],
+        resources: [],
+        envEntries: [
+            `SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`,
+            'SUPABASE_LOCAL_ENABLED=true',
+        ],
+        warnings: [],
+    };
+}
+function validateOAuthSecretReferences(manifest) {
+    const oauth = manifest.auth?.oauth;
+    if (!oauth?.enabled)
+        return;
+    const enabledProviders = oauth.providers.filter((provider) => provider.enabled !== false);
+    if (enabledProviders.length === 0) {
+        throw new Error('OAuth is enabled but no OAuth provider is enabled.');
+    }
+    for (const provider of enabledProviders) {
+        if (!provider.credentialsRef?.trim()) {
+            throw new Error(`OAuth provider "${provider.id}" is enabled but does not define credentialsRef.`);
+        }
+    }
+}
+function getRuntimeGuide(namespace) {
+    return `# Supabase Vault secret store
+
+This project selects the provider-neutral secret-store backend through:
+
+\`\`\`text
+infra.secretStore.provider = ${SUPABASE_VAULT_SECRET_STORE_PROVIDER}
+\`\`\`
+
+The immutable migration at:
+
+\`\`\`text
+${SUPABASE_VAULT_MIGRATION_PATH}
+\`\`\`
+
+is applied by the existing local Supabase migration lifecycle during \`scripts/up.sh\`.
+
+## Security boundary
+
+- Secret values are stored only through Supabase Vault.
+- Public manifests contain logical references such as \`auth/oauth/google\`, never values.
+- Project and environment scope are supplied by trusted server code.
+- The browser may receive secret metadata, but must never receive resolved values or Vault IDs.
+- Bootstrap database access must come from trusted process environment or workload identity.
+- Do not expose service-role keys, provider secrets, or resolved payloads through
+  \`NEXT_PUBLIC_*\`, \`EXPO_PUBLIC_*\`, generated YAML, tracked JSON, or app bundles.
+
+## Trusted adapter composition
+
+Use \`createInfraSecretStoreAdapter\` from \`@ankhorage/infra\` in server-only code and pass
+a trusted Supabase Vault SQL client. The app manifest chooses the provider; privileged connection
+configuration does not belong in the manifest.
+
+Generated Kubernetes namespace: \`${namespace}\`.
+`;
+}
+//# sourceMappingURL=index.js.map

package/dist/adapters/minikube/secrets/supabase-vault/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/secrets/supabase-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AAKnC,MAAM,CAAC,MAAM,6BAA6B,GACxC,8EAA8E,CAAC;AAEjF,MAAM,UAAU,yCAAyC,CAAC,IAGzD;IACC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7C,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,GAAG,4BAA4B,CAAC,IAAI,EAAE,IAAI;aACpD;YACD;gBACE,IAAI,EAAE,0CAA0C;gBAChD,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;aACzC;SACF;QACD,SAAS,EAAE,EAAE;QACb,UAAU,EAAE;YACV,yBAAyB,oCAAoC,EAAE;YAC/D,6BAA6B;SAC9B;QACD,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA4B;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO;IAE5B,MAAM,gBAAgB,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC1F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,kDAAkD,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO;;;;;+BAKsB,oCAAoC;;;;;;EAMjE,6BAA6B;;;;;;;;;;;;;;;;;;;;;oCAqBK,SAAS;CAC5C,CAAC;AACF,CAAC","sourcesContent":["import {\n  SUPABASE_VAULT_MIGRATION_SQL,\n  SUPABASE_VAULT_SECRET_STORE_PROVIDER,\n} from '@ankhorage/supabase-vault';\n\nimport type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\n\nexport const SUPABASE_VAULT_MIGRATION_PATH =\n  'infra/minikube/supabase/migrations/202607120001_ankhorage_supabase_vault.sql';\n\nexport function generateSupabaseVaultSecretStoreArtifacts(args: {\n  readonly manifest: InfraManifestInput;\n  readonly namespace: string;\n}): MinikubeAdapterArtifacts {\n  validateOAuthSecretReferences(args.manifest);\n\n  return {\n    files: [\n      {\n        path: SUPABASE_VAULT_MIGRATION_PATH,\n        content: `${SUPABASE_VAULT_MIGRATION_SQL.trim()}\\n`,\n      },\n      {\n        path: 'infra/minikube/secrets/supabase-vault.md',\n        content: getRuntimeGuide(args.namespace),\n      },\n    ],\n    resources: [],\n    envEntries: [\n      `SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`,\n      'SUPABASE_LOCAL_ENABLED=true',\n    ],\n    warnings: [],\n  };\n}\n\nfunction validateOAuthSecretReferences(manifest: InfraManifestInput): void {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return;\n\n  const enabledProviders = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (enabledProviders.length === 0) {\n    throw new Error('OAuth is enabled but no OAuth provider is enabled.');\n  }\n\n  for (const provider of enabledProviders) {\n    if (!provider.credentialsRef?.trim()) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" is enabled but does not define credentialsRef.`,\n      );\n    }\n  }\n}\n\nfunction getRuntimeGuide(namespace: string): string {\n  return `# Supabase Vault secret store\n\nThis project selects the provider-neutral secret-store backend through:\n\n\\`\\`\\`text\ninfra.secretStore.provider = ${SUPABASE_VAULT_SECRET_STORE_PROVIDER}\n\\`\\`\\`\n\nThe immutable migration at:\n\n\\`\\`\\`text\n${SUPABASE_VAULT_MIGRATION_PATH}\n\\`\\`\\`\n\nis applied by the existing local Supabase migration lifecycle during \\`scripts/up.sh\\`.\n\n## Security boundary\n\n- Secret values are stored only through Supabase Vault.\n- Public manifests contain logical references such as \\`auth/oauth/google\\`, never values.\n- Project and environment scope are supplied by trusted server code.\n- The browser may receive secret metadata, but must never receive resolved values or Vault IDs.\n- Bootstrap database access must come from trusted process environment or workload identity.\n- Do not expose service-role keys, provider secrets, or resolved payloads through\n  \\`NEXT_PUBLIC_*\\`, \\`EXPO_PUBLIC_*\\`, generated YAML, tracked JSON, or app bundles.\n\n## Trusted adapter composition\n\nUse \\`createInfraSecretStoreAdapter\\` from \\`@ankhorage/infra\\` in server-only code and pass\na trusted Supabase Vault SQL client. The app manifest chooses the provider; privileged connection\nconfiguration does not belong in the manifest.\n\nGenerated Kubernetes namespace: \\`${namespace}\\`.\n`;\n}\n"]}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import type { InfraGenerationInput, InfraManifestInput, InfrastructureGenerationOptions, InfrastructureGenerationResult } from './types';
 export type { ApiInfrastructureArtifacts } from './apiArtifacts';
 export { generateApiInfrastructureArtifacts } from './apiArtifacts';
+export { createInfraSecretStoreAdapter, type CreateInfraSecretStoreAdapterInput, type InfraSecretStoreProviders, } from './secretStore';
 export type { GeneratedFile, GeneratedInfrastructureFile, GeneratedPackageDependency, InfraDiagnostic, InfraGenerationInput, InfraGenerationOptions, InfraGenerationResult, InfraManifestInput, InfrastructureGenerationMeta, InfrastructureGenerationOptions, InfrastructureGenerationResult, PackageDependency, } from './types';
 export declare function generateInfra(input: InfraGenerationInput): InfrastructureGenerationResult;
 export declare function generateInfrastructure(manifest: InfraManifestInput, options?: InfrastructureGenerationOptions): InfrastructureGenerationResult;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kCAAkC,EAAE,MAAM,gBAAgB,CAAC;AACpE,YAAY,EACV,aAAa,EACb,2BAA2B,EAC3B,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAEjB,wBAAgB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,8BAA8B,CAEzF;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAUhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kCAAkC,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,aAAa,EACb,2BAA2B,EAC3B,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAEjB,wBAAgB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,8BAA8B,CAEzF;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAUhC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 import { generateMinikubeInfra } from './adapters/minikube';
 export { generateApiInfrastructureArtifacts } from './apiArtifacts';
+export { createInfraSecretStoreAdapter, } from './secretStore';
 export function generateInfra(input) {
     return generateInfrastructure(input.manifest, input.options ?? {});
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAS5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,gBAAgB,CAAC;AAgBpE,MAAM,UAAU,aAAa,CAAC,KAA2B;IACvD,OAAO,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC","sourcesContent":["import { generateMinikubeInfra } from './adapters/minikube';\nimport type {\n  InfraGenerationInput,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from './types';\n\nexport type { ApiInfrastructureArtifacts } from './apiArtifacts';\nexport { generateApiInfrastructureArtifacts } from './apiArtifacts';\nexport type {\n  GeneratedFile,\n  GeneratedInfrastructureFile,\n  GeneratedPackageDependency,\n  InfraDiagnostic,\n  InfraGenerationInput,\n  InfraGenerationOptions,\n  InfraGenerationResult,\n  InfraManifestInput,\n  InfrastructureGenerationMeta,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n  PackageDependency,\n} from './types';\n\nexport function generateInfra(input: InfraGenerationInput): InfrastructureGenerationResult {\n  return generateInfrastructure(input.manifest, input.options ?? {});\n}\n\nexport function generateInfrastructure(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (!manifest.deployment) {\n    throw new Error('Deployment configuration is missing.');\n  }\n\n  if (manifest.deployment.target !== 'minikube') {\n    throw new Error(`Unsupported deployment target: ${manifest.deployment.target}`);\n  }\n\n  return generateMinikubeInfra(manifest, options);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAS5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,6BAA6B,GAG9B,MAAM,eAAe,CAAC;AAgBvB,MAAM,UAAU,aAAa,CAAC,KAA2B;IACvD,OAAO,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC","sourcesContent":["import { generateMinikubeInfra } from './adapters/minikube';\nimport type {\n  InfraGenerationInput,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from './types';\n\nexport type { ApiInfrastructureArtifacts } from './apiArtifacts';\nexport { generateApiInfrastructureArtifacts } from './apiArtifacts';\nexport {\n  createInfraSecretStoreAdapter,\n  type CreateInfraSecretStoreAdapterInput,\n  type InfraSecretStoreProviders,\n} from './secretStore';\nexport type {\n  GeneratedFile,\n  GeneratedInfrastructureFile,\n  GeneratedPackageDependency,\n  InfraDiagnostic,\n  InfraGenerationInput,\n  InfraGenerationOptions,\n  InfraGenerationResult,\n  InfraManifestInput,\n  InfrastructureGenerationMeta,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n  PackageDependency,\n} from './types';\n\nexport function generateInfra(input: InfraGenerationInput): InfrastructureGenerationResult {\n  return generateInfrastructure(input.manifest, input.options ?? {});\n}\n\nexport function generateInfrastructure(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (!manifest.deployment) {\n    throw new Error('Deployment configuration is missing.');\n  }\n\n  if (manifest.deployment.target !== 'minikube') {\n    throw new Error(`Unsupported deployment target: ${manifest.deployment.target}`);\n  }\n\n  return generateMinikubeInfra(manifest, options);\n}\n"]}

package/dist/secretStore.d.ts

@@ -0,0 +1,19 @@
+import type { SecretStoreAdapter } from '@ankhorage/contracts/secrets';
+import { type SupabaseVaultAdapterOptions } from '@ankhorage/supabase-vault';
+import type { InfraManifestInput } from './types';
+export interface InfraSecretStoreProviders {
+    readonly supabaseVault?: SupabaseVaultAdapterOptions;
+}
+export interface CreateInfraSecretStoreAdapterInput {
+    readonly manifest: Pick<InfraManifestInput, 'secretStore'>;
+    readonly providers: InfraSecretStoreProviders;
+}
+/**
+ * Creates the configured server-only secret-store adapter.
+ *
+ * Bootstrap credentials and trusted clients belong in `providers`; they must never be read from
+ * the public app manifest. A missing `infra.secretStore` returns `null` because apps without
+ * secret-backed features do not require a secret store.
+ */
+export declare function createInfraSecretStoreAdapter(input: CreateInfraSecretStoreAdapterInput): SecretStoreAdapter | null;
+//# sourceMappingURL=secretStore.d.ts.map

package/dist/secretStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretStore.d.ts","sourceRoot":"","sources":["../src/secretStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,2BAA2B,CAAC;CACtD;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,kCAAkC,GACxC,kBAAkB,GAAG,IAAI,CAgB3B"}

package/dist/secretStore.js

@@ -0,0 +1,22 @@
+import { createSupabaseVaultAdapter, SUPABASE_VAULT_SECRET_STORE_PROVIDER, } from '@ankhorage/supabase-vault';
+/**
+ * Creates the configured server-only secret-store adapter.
+ *
+ * Bootstrap credentials and trusted clients belong in `providers`; they must never be read from
+ * the public app manifest. A missing `infra.secretStore` returns `null` because apps without
+ * secret-backed features do not require a secret store.
+ */
+export function createInfraSecretStoreAdapter(input) {
+    const provider = input.manifest.secretStore?.provider;
+    if (!provider)
+        return null;
+    if (provider === SUPABASE_VAULT_SECRET_STORE_PROVIDER) {
+        const options = input.providers.supabaseVault;
+        if (!options) {
+            throw new Error('Secret-store provider "supabase-vault" requires trusted Supabase Vault adapter options.');
+        }
+        return createSupabaseVaultAdapter(options);
+    }
+    throw new Error(`Unsupported secret-store provider: "${provider}".`);
+}
+//# sourceMappingURL=secretStore.js.map

package/dist/secretStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretStore.js","sourceRoot":"","sources":["../src/secretStore.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,oCAAoC,GAErC,MAAM,2BAA2B,CAAC;AAanC;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAyC;IAEzC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,QAAQ,KAAK,oCAAoC,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,IAAI,CAAC,CAAC;AACvE,CAAC","sourcesContent":["import type { SecretStoreAdapter } from '@ankhorage/contracts/secrets';\nimport {\n  createSupabaseVaultAdapter,\n  SUPABASE_VAULT_SECRET_STORE_PROVIDER,\n  type SupabaseVaultAdapterOptions,\n} from '@ankhorage/supabase-vault';\n\nimport type { InfraManifestInput } from './types';\n\nexport interface InfraSecretStoreProviders {\n  readonly supabaseVault?: SupabaseVaultAdapterOptions;\n}\n\nexport interface CreateInfraSecretStoreAdapterInput {\n  readonly manifest: Pick<InfraManifestInput, 'secretStore'>;\n  readonly providers: InfraSecretStoreProviders;\n}\n\n/**\n * Creates the configured server-only secret-store adapter.\n *\n * Bootstrap credentials and trusted clients belong in `providers`; they must never be read from\n * the public app manifest. A missing `infra.secretStore` returns `null` because apps without\n * secret-backed features do not require a secret store.\n */\nexport function createInfraSecretStoreAdapter(\n  input: CreateInfraSecretStoreAdapterInput,\n): SecretStoreAdapter | null {\n  const provider = input.manifest.secretStore?.provider;\n  if (!provider) return null;\n\n  if (provider === SUPABASE_VAULT_SECRET_STORE_PROVIDER) {\n    const options = input.providers.supabaseVault;\n    if (!options) {\n      throw new Error(\n        'Secret-store provider \"supabase-vault\" requires trusted Supabase Vault adapter options.',\n      );\n    }\n\n    return createSupabaseVaultAdapter(options);\n  }\n\n  throw new Error(`Unsupported secret-store provider: \"${provider}\".`);\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "0.3.7",
+  "version": "0.4.0",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -28,12 +28,15 @@
     "react-native",
     "supabase",
     "postgres",
+    "vault",
+    "secret-store",
     "kubernetes",
     "minikube",
     "openapi"
   ],
   "dependencies": {
-    "@ankhorage/contracts": "^2.0.0"
+    "@ankhorage/contracts": "^2.1.0",
+    "@ankhorage/supabase-vault": "^0.2.0"
   },
   "files": [
     "dist",
@@ -72,7 +75,8 @@
       "infra.generate",
       "infra.status",
       "infra.up",
-      "infra.down"
+      "infra.down",
+      "infra.secret-store"
     ]
   },
   "publishConfig": {

package/src/adapters/minikube/base/index.ts

@@ -46,12 +46,16 @@ export function generateMinikubeBaseArtifacts(args: {
   const authProvider = manifest.auth?.provider ?? 'none';
   const authzEngine = manifest.auth?.authorization?.engine ?? 'none';
   const databaseProvider = manifest.database?.provider ?? 'none';
+  const secretStoreProvider = manifest.secretStore?.provider ?? 'none';
   const storageMetadata = resolveAppInfraStorageMetadata(manifest);
   const profileModel = resolveSupabaseProfileModel(manifest);
   const monitoringEnabled = manifest.deployment?.monitoring === true;
   const domain = manifest.networking?.domain ?? '';
   const supabaseLocalEnabled =
-    authProvider === 'supabase' || databaseProvider === 'supabase' || storageMetadata !== null;
+    authProvider === 'supabase' ||
+    databaseProvider === 'supabase' ||
+    storageMetadata !== null ||
+    secretStoreProvider === 'supabase-vault';
 
   return [
     {
@@ -90,6 +94,7 @@ export function generateMinikubeBaseArtifacts(args: {
         authScope,
         authProvider,
         databaseProvider,
+        secretStoreProvider,
         storageMetadata,
         monitoringEnabled,
         domain,
@@ -427,6 +432,7 @@ function getAppConfigMap(args: {
   authScope: string;
   authProvider: string;
   databaseProvider: string;
+  secretStoreProvider: string;
   storageMetadata: AppInfraStorageMetadata | null;
   monitoringEnabled: boolean;
   domain: string;
@@ -436,6 +442,7 @@ function getAppConfigMap(args: {
     authScope,
     authProvider,
     databaseProvider,
+    secretStoreProvider,
     storageMetadata,
     monitoringEnabled,
     domain,
@@ -459,6 +466,7 @@ data:
   AUTH_SCOPE: "${authScope}"
   AUTH_PROVIDER: "${authProvider}"
   DATABASE_PROVIDER: "${databaseProvider}"
+  SECRET_STORE_PROVIDER: "${secretStoreProvider}"
 ${storageLines}  NETWORK_DOMAIN: "${domain}"
 `;
 }

package/src/adapters/minikube/index.ts

@@ -8,6 +8,7 @@ import type {
 import { generateAuthProviderArtifacts } from './auth';
 import { generateAuthorizationArtifacts } from './authz';
 import { generateMinikubeBaseArtifacts } from './base';
+import { generateSecretStoreArtifacts } from './secrets';
 import { generateStorageArtifacts } from './storage';
 
 const DEFAULT_NAMESPACE = 'ankh-app';
@@ -37,6 +38,7 @@ export function generateMinikubeInfra(
     appManifest: options.appManifest,
   });
   const storageArtifacts = generateStorageArtifacts({ manifest, namespace });
+  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });
   const apiArtifacts = generateApiInfrastructureArtifacts({
     data: options.appManifest?.data,
     databaseProvider: manifest.database?.provider,
@@ -46,11 +48,13 @@ export function generateMinikubeInfra(
     ...authArtifacts.resources,
     ...authzArtifacts.resources,
     ...storageArtifacts.resources,
+    ...secretStoreArtifacts.resources,
   ]);
   const extraEnvEntries = unique([
     ...authArtifacts.envEntries,
     ...authzArtifacts.envEntries,
     ...storageArtifacts.envEntries,
+    ...secretStoreArtifacts.envEntries,
   ]);
 
   const baseFiles = generateMinikubeBaseArtifacts({
@@ -65,6 +69,7 @@ export function generateMinikubeInfra(
     ...authArtifacts.warnings,
     ...authzArtifacts.warnings,
     ...storageArtifacts.warnings,
+    ...secretStoreArtifacts.warnings,
     ...apiArtifacts.warnings,
   ]);
 
@@ -74,6 +79,7 @@ export function generateMinikubeInfra(
       ...authArtifacts.files,
       ...authzArtifacts.files,
       ...storageArtifacts.files,
+      ...secretStoreArtifacts.files,
       ...apiArtifacts.files,
     ],
     warnings,
@@ -94,6 +100,7 @@ function collectProviders(manifest: InfraManifestInput): string[] {
   }
   if (manifest.database?.provider) providers.add(manifest.database.provider);
   if (manifest.storage?.provider) providers.add(manifest.storage.provider);
+  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);
   if (manifest.state?.provider) providers.add(manifest.state.provider);
 
   return [...providers].sort();

package/src/adapters/minikube/secrets/index.test.ts

@@ -0,0 +1,103 @@
+import { SUPABASE_VAULT_MIGRATION_SQL } from '@ankhorage/supabase-vault';
+import { describe, expect, test } from 'bun:test';
+
+import { generateInfrastructure } from '../../../index';
+import type { InfraManifestInput } from '../../../types';
+import { SUPABASE_VAULT_MIGRATION_PATH } from './supabase-vault';
+
+function createManifest(overrides: Partial<InfraManifestInput> = {}): InfraManifestInput {
+  return {
+    deployment: {
+      target: 'minikube',
+      monitoring: false,
+    },
+    secretStore: {
+      provider: 'supabase-vault',
+    },
+    plugins: [],
+    ...overrides,
+  };
+}
+
+describe('minikube secret-store generation', () => {
+  test('generates the released Supabase Vault migration through the existing lifecycle', () => {
+    const result = generateInfrastructure(createManifest());
+    const migration = result.files.find((file) => file.path === SUPABASE_VAULT_MIGRATION_PATH);
+    const envExample = result.files.find((file) => file.path === 'infra/minikube/.env.example');
+    const upScript = result.files.find((file) => file.path === 'infra/minikube/scripts/up.sh');
+
+    expect(migration?.content).toBe(`${SUPABASE_VAULT_MIGRATION_SQL.trim()}\n`);
+    expect(envExample?.content).toContain('SECRET_STORE_PROVIDER=supabase-vault');
+    expect(envExample?.content).toContain('SUPABASE_LOCAL_ENABLED=true');
+    expect(upScript?.content).toContain('SUPABASE_LOCAL_ENABLED="${SUPABASE_LOCAL_ENABLED:-true}"');
+    expect(result.meta.providers).toContain('supabase-vault');
+  });
+
+  test('requires credentialsRef for every enabled OAuth provider', () => {
+    expect(() =>
+      generateInfrastructure(
+        createManifest({
+          auth: {
+            scope: 'global',
+            provider: 'supabase',
+            signIn: {
+              identifiers: ['email'],
+            },
+            oauth: {
+              enabled: true,
+              callbackRoute: '/auth/callback',
+              providers: [
+                {
+                  id: 'google',
+                  enabled: true,
+                },
+              ],
+            },
+          },
+        }),
+      ),
+    ).toThrow('does not define credentialsRef');
+  });
+
+  test('accepts provider-neutral OAuth secret references without serializing values', () => {
+    const result = generateInfrastructure(
+      createManifest({
+        auth: {
+          scope: 'global',
+          provider: 'supabase',
+          signIn: {
+            identifiers: ['email'],
+          },
+          oauth: {
+            enabled: true,
+            callbackRoute: '/auth/callback',
+            providers: [
+              {
+                id: 'google',
+                enabled: true,
+                credentialsRef: 'auth/oauth/google',
+              },
+            ],
+          },
+        },
+      }),
+    );
+
+    const serialized = JSON.stringify(result.files);
+    expect(serialized).toContain('auth/oauth/google');
+    expect(serialized).not.toContain('clientSecret');
+    expect(serialized).not.toContain('privateKey');
+  });
+
+  test('rejects unknown secret-store providers', () => {
+    expect(() =>
+      generateInfrastructure(
+        createManifest({
+          secretStore: {
+            provider: 'aws-secrets-manager',
+          },
+        }),
+      ),
+    ).toThrow('Unsupported secret-store provider for minikube adapter');
+  });
+});

package/src/adapters/minikube/secrets/index.ts

@@ -0,0 +1,19 @@
+import { SUPABASE_VAULT_SECRET_STORE_PROVIDER } from '@ankhorage/supabase-vault';
+
+import type { InfraManifestInput } from '../../../types';
+import { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';
+import { generateSupabaseVaultSecretStoreArtifacts } from './supabase-vault';
+
+export function generateSecretStoreArtifacts(args: {
+  readonly manifest: InfraManifestInput;
+  readonly namespace: string;
+}): MinikubeAdapterArtifacts {
+  const provider = args.manifest.secretStore?.provider;
+  if (!provider) return emptyMinikubeArtifacts();
+
+  if (provider === SUPABASE_VAULT_SECRET_STORE_PROVIDER) {
+    return generateSupabaseVaultSecretStoreArtifacts(args);
+  }
+
+  throw new Error(`Unsupported secret-store provider for minikube adapter: "${provider}".`);
+}