@ankhorage/infra 0.3.7 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ankhorage/infra
 
+## 0.4.1
+
+### Patch Changes
+
+- f48b53f: Preserve app-specific Supabase local project identity while keeping the canonical Minikube workdir.
+
+## 0.4.0
+
+### Minor Changes
+
+- dd7c668: Compose the canonical secret-store adapter from `infra.secretStore.provider`, generate the released Supabase Vault migration through the existing local Supabase lifecycle, and validate OAuth credential references before infrastructure generation.
+
 ## 0.3.7
 
 ### Patch Changes

package/README.md

@@ -3,7 +3,7 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v0.3.6](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v0.4.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 
@@ -56,3 +56,4 @@ bunx @ankhorage/infra
 - [Module relationships](././paradox/diagrams/module-relationships.mmd)
 - [Export graph](././paradox/diagrams/export-graph.mmd)
 - [ankhorage-infra sequence](././paradox/diagrams/sequences/ankhorage-infra.mmd)
+- [createInfraSecretStoreAdapter sequence](././paradox/diagrams/sequences/create-infra-secret-store-adapter.mmd)

package/dist/adapters/minikube/base/index.d.ts

@@ -3,6 +3,7 @@ import type { InfraManifestInput } from '../../../types';
 export declare function generateMinikubeBaseArtifacts(args: {
     manifest: InfraManifestInput;
     namespace: string;
+    supabaseProjectId: string | null;
     extraResources: string[];
     extraEnvEntries: string[];
 }): GeneratedInfrastructureFile[];

package/dist/adapters/minikube/base/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AA4BzD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,2BAA2B,EAAE,CAyHhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AA4BzD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,2BAA2B,EAAE,CAiIhC"}

package/dist/adapters/minikube/base/index.js

@@ -4,22 +4,26 @@ const SUPABASE_LOCAL_PORT_BUCKET_SIZE = 10;
 const SUPABASE_LOCAL_PORT_BUCKET_COUNT = 1000;
 const SUPABASE_LOCAL_PORT_REFERENCE_PROJECT = 'my-app';
 export function generateMinikubeBaseArtifacts(args) {
-    const { manifest, namespace, extraResources, extraEnvEntries } = args;
+    const { manifest, namespace, supabaseProjectId, extraResources, extraEnvEntries } = args;
     const root = 'infra/minikube';
     const k8sRoot = `${root}/k8s`;
     const scriptsRoot = `${root}/scripts`;
     const appImageRoot = `${root}/app-image`;
     const defaultAppImage = getDefaultAppImage(namespace);
-    const supabaseLocalPorts = resolveSupabaseLocalPorts(namespace);
+    const supabaseLocalPorts = resolveSupabaseLocalPorts(supabaseProjectId ?? namespace);
     const authScope = manifest.auth?.scope ?? 'none';
     const authProvider = manifest.auth?.provider ?? 'none';
     const authzEngine = manifest.auth?.authorization?.engine ?? 'none';
     const databaseProvider = manifest.database?.provider ?? 'none';
+    const secretStoreProvider = manifest.secretStore?.provider ?? 'none';
     const storageMetadata = resolveAppInfraStorageMetadata(manifest);
     const profileModel = resolveSupabaseProfileModel(manifest);
     const monitoringEnabled = manifest.deployment?.monitoring === true;
     const domain = manifest.networking?.domain ?? '';
-    const supabaseLocalEnabled = authProvider === 'supabase' || databaseProvider === 'supabase' || storageMetadata !== null;
+    const supabaseLocalEnabled = authProvider === 'supabase' ||
+        databaseProvider === 'supabase' ||
+        storageMetadata !== null ||
+        secretStoreProvider === 'supabase-vault';
     return [
         {
             path: `${root}/README.md`,
@@ -31,6 +35,7 @@ export function generateMinikubeBaseArtifacts(args) {
                 authzEngine,
                 extraResources,
                 supabaseLocalPorts,
+                supabaseProjectId,
                 supabaseLocalEnabled,
                 profileModel,
             }),
@@ -57,6 +62,7 @@ export function generateMinikubeBaseArtifacts(args) {
                 authScope,
                 authProvider,
                 databaseProvider,
+                secretStoreProvider,
                 storageMetadata,
                 monitoringEnabled,
                 domain,
@@ -102,6 +108,7 @@ export function generateMinikubeBaseArtifacts(args) {
             path: `${scriptsRoot}/status.sh`,
             content: getStatusScript({
                 defaultNamespace: namespace,
+                supabaseProjectId,
                 supabaseLocalEnabled,
                 profileModel,
             }),
@@ -110,6 +117,7 @@ export function generateMinikubeBaseArtifacts(args) {
         {
             path: `${scriptsRoot}/supabase-local-env.sh`,
             content: getSupabaseLocalEnvScript({
+                supabaseProjectId,
                 supabaseLocalPorts,
                 profileModel,
             }),
@@ -122,7 +130,7 @@ export function generateMinikubeBaseArtifacts(args) {
     ];
 }
 function getReadmeMarkdown(args) {
-    const { namespace, defaultAppImage, monitoringEnabled, authProvider, authzEngine, extraResources, supabaseLocalPorts, supabaseLocalEnabled, profileModel, } = args;
+    const { namespace, defaultAppImage, monitoringEnabled, authProvider, authzEngine, extraResources, supabaseLocalPorts, supabaseProjectId, supabaseLocalEnabled, profileModel, } = args;
     const resourceLines = [
         'namespace.yaml',
         'app.configmap.yaml',
@@ -185,6 +193,7 @@ ${resourceLines}
 ## Runtime Conventions
 
 - Namespace: \`${namespace}\`
+- Supabase local project identity: \`${supabaseProjectId ?? 'unused'}\`
 - Monitoring requested: \`${monitoringEnabled ? 'true' : 'false'}\`
 - Auth provider: \`${authProvider}\`
 - Authorization engine: \`${authzEngine}\`
@@ -272,6 +281,7 @@ Build flow:
 
 - \`./scripts/up.sh\` calls \`./scripts/build-app-image.sh\` when \`APP_BUILD_ENABLED=true\`.
 - Supabase local project root: \`infra/minikube\`${supabaseLocalEnabled ? '' : ' (unused unless Supabase-backed auth/database/storage is enabled)'}.
+- Supabase local project identity: \`${supabaseProjectId ?? 'unused'}\`; existing local configs with another \`project_id\` must be destroyed and recreated manually.
 - Immutable migrations live in \`supabase/migrations/\` and are applied with \`supabase migration up --local\`.
 ${profileModel.enabled ? '- Generated profile desired-state reconciliation lives in `supabase/generated/auth_profiles.sql` and records checksum state in `ankhorage_internal.generated_schema_state`.\n' : ''}- \`./scripts/supabase-local-env.sh\` can populate Supabase keys in \`.env\` from local \`supabase status -o env\`.
 - \`./scripts/supabase-local-env.sh\` writes \`EXPO_PUBLIC_SUPABASE_URL\` + \`EXPO_PUBLIC_SUPABASE_ANON_KEY\` into \`$APP_SOURCE_DIR/.env.local\` (e.g. \`apps/card/.env.local\`) for local app runs.
@@ -356,7 +366,7 @@ metadata:
 `;
 }
 function getAppConfigMap(args) {
-    const { namespace, authScope, authProvider, databaseProvider, storageMetadata, monitoringEnabled, domain, } = args;
+    const { namespace, authScope, authProvider, databaseProvider, secretStoreProvider, storageMetadata, monitoringEnabled, domain, } = args;
     const storageLines = storageMetadata
         ? `  STORAGE_PROVIDER: "${storageMetadata.provider}"
   STORAGE_BUCKETS: "${escapeYamlDoubleQuoted(storageMetadata.bucketsCsv)}"
@@ -374,6 +384,7 @@ data:
   AUTH_SCOPE: "${authScope}"
   AUTH_PROVIDER: "${authProvider}"
   DATABASE_PROVIDER: "${databaseProvider}"
+  SECRET_STORE_PROVIDER: "${secretStoreProvider}"
 ${storageLines}  NETWORK_DOMAIN: "${domain}"
 `;
 }
@@ -1287,7 +1298,7 @@ end;
 $$;`;
 }
 function getStatusScript(args) {
-    const { defaultNamespace, supabaseLocalEnabled, profileModel } = args;
+    const { defaultNamespace, supabaseProjectId, supabaseLocalEnabled, profileModel } = args;
     const profileStatusSql = profileModel.enabled ? getSupabaseProfileChecksumSql(profileModel) : '';
     const profileVerificationSql = profileModel.enabled
         ? getSupabaseProfileVerificationSql(profileModel)
@@ -1310,8 +1321,28 @@ AUTH_RUNTIME_MODE="\${AUTH_RUNTIME_MODE:-local}"
 SUPABASE_LOCAL_ENABLED="\${SUPABASE_LOCAL_ENABLED:-${supabaseLocalEnabled ? 'true' : 'false'}}"
 SUPABASE_SECRET_SYNC_ENABLED="\${SUPABASE_SECRET_SYNC_ENABLED:-true}"
 SUPABASE_PROJECT_DIR="\${SUPABASE_PROJECT_DIR:-\${ROOT_DIR}}"
+EXPECTED_SUPABASE_PROJECT_ID="${supabaseProjectId ?? ''}"
 SUPABASE_PROFILE_ENABLED="${profileModel.enabled ? 'true' : 'false'}"
 SUPABASE_PROFILE_RECONCILE_FILE="\${SUPABASE_PROJECT_DIR}/supabase/generated/auth_profiles.sql"
+export EXPECTED_SUPABASE_PROJECT_ID
+
+reject_supabase_project_id_override() {
+  if [[ -n "\${SUPABASE_PROJECT_ID:-}" ]]; then
+    echo "SUPABASE_PROJECT_ID must not be set for generated local Infra scripts."
+    echo "Unset SUPABASE_PROJECT_ID and use supabase/config.toml project_id instead."
+    return 1
+  fi
+
+  unset SUPABASE_PROJECT_ID
+}
+
+require_expected_supabase_project_identity() {
+  if [[ -z "\${EXPECTED_SUPABASE_PROJECT_ID}" ]]; then
+    echo "Cannot run local Supabase infrastructure: expected Supabase project identity is empty."
+    echo "Regenerate Infra with appManifest.metadata.slug for Supabase-backed local services."
+    return 1
+  fi
+}
 
 if ! command -v kubectl >/dev/null 2>&1; then
   echo "kubectl is required but not installed."
@@ -1475,6 +1506,61 @@ run_supabase_sql() {
   return 1
 }
 
+validate_supabase_project_identity() {
+  local config_file="\${SUPABASE_PROJECT_DIR}/supabase/config.toml"
+
+  if [[ -z "\${EXPECTED_SUPABASE_PROJECT_ID}" ]]; then
+    return 0
+  fi
+
+  if [[ ! -f "\${config_file}" ]]; then
+    echo "- local Supabase project identity: config missing at \${config_file}"
+    return 1
+  fi
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "- local Supabase project identity: python3 is required to read \${config_file}"
+    return 1
+  fi
+
+  python3 - "\${config_file}" <<'PY'
+import os
+import re
+import sys
+
+
+def read_top_level_project_id(config_path):
+    key_re = re.compile(r'^\\s*project_id\\s*=\\s*(.*?)\\s*(?:#.*)?$')
+    section_re = re.compile(r'^\\s*\\[[^\\]]+\\]\\s*$')
+
+    with open(config_path, 'r', encoding='utf-8') as f:
+        for line in f:
+            if section_re.match(line):
+                return None
+            match = key_re.match(line)
+            if not match:
+                continue
+            raw = match.group(1).strip()
+            quoted = re.match(r'^["\\']([^"\\']*)["\\']$', raw)
+            return quoted.group(1) if quoted else raw
+
+    return None
+
+
+expected = os.environ['EXPECTED_SUPABASE_PROJECT_ID']
+actual = read_top_level_project_id(sys.argv[1])
+
+if actual == expected:
+    raise SystemExit(0)
+
+found = 'missing' if actual is None else f'"{actual}"'
+print('Supabase project identity mismatch.', file=sys.stderr)
+print(f'Expected "{expected}", found {found}.', file=sys.stderr)
+print('Destroy the invalid local stack and run Infra Up again.', file=sys.stderr)
+raise SystemExit(1)
+PY
+}
+
 check_immutable_migrations_applied() {
   local migrations_dir="\${SUPABASE_PROJECT_DIR}/supabase/migrations"
   local applied_versions
@@ -1509,8 +1595,14 @@ if [[ "\${AUTH_RUNTIME_MODE}" == "local" && "\${SUPABASE_LOCAL_ENABLED}" == "tru
   echo "Local Supabase database checks:"
   status_failed=0
 
-  if require_supabase_cli_capabilities; then
-    if supabase --workdir "\${SUPABASE_PROJECT_DIR}" status >/dev/null 2>&1; then
+  if ! require_expected_supabase_project_identity; then
+    status_failed=1
+  elif ! reject_supabase_project_id_override; then
+    status_failed=1
+  elif require_supabase_cli_capabilities; then
+    if ! validate_supabase_project_identity; then
+      status_failed=1
+    elif supabase --workdir "\${SUPABASE_PROJECT_DIR}" status >/dev/null 2>&1; then
       STATUS_ENV="$(supabase --workdir "\${SUPABASE_PROJECT_DIR}" status -o env)"
       SUPABASE_DB_URL="$(read_env_value "\${STATUS_ENV}" DB_URL)"
       if [[ -z "\${SUPABASE_DB_URL}" ]]; then
@@ -1581,7 +1673,7 @@ fi
 `;
 }
 function getSupabaseLocalEnvScript(args) {
-    const { supabaseLocalPorts, profileModel } = args;
+    const { supabaseProjectId, supabaseLocalPorts, profileModel } = args;
     const profileStatusSql = profileModel.enabled ? getSupabaseProfileChecksumSql(profileModel) : '';
     const profileVerificationSql = profileModel.enabled
         ? getSupabaseProfileVerificationSql(profileModel)
@@ -1603,9 +1695,29 @@ fi
 
 APP_SOURCE_DIR="\${APP_SOURCE_DIR:-$(cd "\${ROOT_DIR}/../.." && pwd)}"
 SUPABASE_PROJECT_DIR="\${SUPABASE_PROJECT_DIR:-\${ROOT_DIR}}"
+EXPECTED_SUPABASE_PROJECT_ID="${supabaseProjectId ?? ''}"
 APP_SUPABASE_ENV_FILE="\${APP_SUPABASE_ENV_FILE:-\${APP_SOURCE_DIR}/.env.local}"
 SUPABASE_PROFILE_ENABLED="${profileModel.enabled ? 'true' : 'false'}"
 SUPABASE_PROFILE_RECONCILE_FILE="\${SUPABASE_PROJECT_DIR}/supabase/generated/auth_profiles.sql"
+export EXPECTED_SUPABASE_PROJECT_ID
+
+reject_supabase_project_id_override() {
+  if [[ -n "\${SUPABASE_PROJECT_ID:-}" ]]; then
+    echo "SUPABASE_PROJECT_ID must not be set for generated local Infra scripts."
+    echo "Unset SUPABASE_PROJECT_ID and use supabase/config.toml project_id instead."
+    exit 1
+  fi
+
+  unset SUPABASE_PROJECT_ID
+}
+
+require_expected_supabase_project_identity() {
+  if [[ -z "\${EXPECTED_SUPABASE_PROJECT_ID}" ]]; then
+    echo "Cannot run local Supabase infrastructure: expected Supabase project identity is empty."
+    echo "Regenerate Infra with appManifest.metadata.slug for Supabase-backed local services."
+    exit 1
+  fi
+}
 
 SUPABASE_LOCAL_PORT_BASE="\${SUPABASE_LOCAL_PORT_BASE:-${supabaseLocalPorts.base}}"
 SUPABASE_LOCAL_SHADOW_PORT="\${SUPABASE_LOCAL_SHADOW_PORT:-\${SUPABASE_LOCAL_PORT_BASE}}"
@@ -1651,6 +1763,11 @@ require_supabase_cli_capabilities() {
     exit 1
   fi
 
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "python3 is required to reconcile supabase/config.toml before local Supabase startup."
+    exit 1
+  fi
+
   local version
   version="$(supabase --version | awk '{print $NF}')"
   if ! version_ge "\${version}" "2.106.0"; then
@@ -1712,6 +1829,8 @@ run_checked_sql_file() {
     psql "\${SUPABASE_DB_URL}" -v ON_ERROR_STOP=1 -q -f "\${sql_file}"
 }
 
+require_expected_supabase_project_identity
+reject_supabase_project_id_override
 require_supabase_cli_capabilities
 
 if [[ ! -d "\${SUPABASE_PROJECT_DIR}" ]]; then
@@ -1722,18 +1841,6 @@ fi
 configure_supabase_local_ports() {
   local config_file="\${SUPABASE_PROJECT_DIR}/supabase/config.toml"
 
-  if ! command -v python3 >/dev/null 2>&1; then
-    echo "python3 is required to patch supabase/config.toml with generated local port defaults."
-    echo "Install python3 (recommended) or manually edit \${config_file} ports:"
-    echo "- [api] port = \${SUPABASE_LOCAL_API_PORT}"
-    echo "- [db] port = \${SUPABASE_LOCAL_DB_PORT}"
-    echo "- [db] shadow_port = \${SUPABASE_LOCAL_SHADOW_PORT}"
-    echo "- [studio] port = \${SUPABASE_LOCAL_STUDIO_PORT}"
-    echo "- [inbucket] port = \${SUPABASE_LOCAL_INBUCKET_PORT}"
-    echo "- [analytics] port = \${SUPABASE_LOCAL_ANALYTICS_PORT}"
-    exit 1
-  fi
-
   python3 - "\${config_file}" <<'PY'
 import os
 import re
@@ -1837,8 +1944,114 @@ if __name__ == "__main__":
 PY
 }
 
+write_supabase_project_identity_for_new_config() {
+  local config_file="\${SUPABASE_PROJECT_DIR}/supabase/config.toml"
+
+  require_expected_supabase_project_identity
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "python3 is required to write Supabase project_id in \${config_file}."
+    exit 1
+  fi
+
+  python3 - "\${config_file}" <<'PY'
+import os
+import re
+import sys
+
+
+def write_top_level_project_id(config_path, expected):
+    key_re = re.compile(r'^(\\s*)project_id\\s*=\\s*(.*?)(\\s*(#.*)?)?$')
+    section_re = re.compile(r'^\\s*\\[[^\\]]+\\]\\s*$')
+
+    with open(config_path, 'r', encoding='utf-8') as f:
+        lines = f.readlines()
+
+    section_start = len(lines)
+    for i, line in enumerate(lines):
+        if section_re.match(line):
+            section_start = i
+            break
+
+    for i in range(section_start):
+        match = key_re.match(lines[i])
+        if not match:
+            continue
+        indent = match.group(1) or ''
+        trailing = (match.group(3) or '').rstrip('\\n')
+        lines[i] = f'{indent}project_id = "{expected}"{trailing}\\n'
+        break
+    else:
+        insert_at = section_start
+        lines.insert(insert_at, f'project_id = "{expected}"\\n')
+
+    with open(config_path, 'w', encoding='utf-8') as f:
+        f.writelines(lines)
+
+
+write_top_level_project_id(sys.argv[1], os.environ['EXPECTED_SUPABASE_PROJECT_ID'])
+PY
+}
+
+validate_supabase_project_identity() {
+  local config_file="\${SUPABASE_PROJECT_DIR}/supabase/config.toml"
+
+  require_expected_supabase_project_identity
+
+  if [[ ! -f "\${config_file}" ]]; then
+    echo "Supabase project identity mismatch."
+    printf 'Expected "%s", found missing.\n' "\${EXPECTED_SUPABASE_PROJECT_ID}"
+    echo "The existing local Supabase project belongs to a different identity."
+    echo "Destroy the invalid local stack and its project-owned resources, then run Infra Up again."
+    exit 1
+  fi
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "python3 is required to read Supabase project_id in \${config_file}."
+    exit 1
+  fi
+
+  python3 - "\${config_file}" <<'PY'
+import os
+import re
+import sys
+
+
+def read_top_level_project_id(config_path):
+    key_re = re.compile(r'^\\s*project_id\\s*=\\s*(.*?)\\s*(?:#.*)?$')
+    section_re = re.compile(r'^\\s*\\[[^\\]]+\\]\\s*$')
+
+    with open(config_path, 'r', encoding='utf-8') as f:
+        for line in f:
+            if section_re.match(line):
+                return None
+            match = key_re.match(line)
+            if not match:
+                continue
+            raw = match.group(1).strip()
+            quoted = re.match(r'^["\\']([^"\\']*)["\\']$', raw)
+            return quoted.group(1) if quoted else raw
+
+    return None
+
+
+expected = os.environ['EXPECTED_SUPABASE_PROJECT_ID']
+actual = read_top_level_project_id(sys.argv[1])
+
+if actual == expected:
+    raise SystemExit(0)
+
+found = 'missing' if actual is None else f'"{actual}"'
+print('Supabase project identity mismatch.', file=sys.stderr)
+print(f'Expected "{expected}", found {found}.', file=sys.stderr)
+print('The existing local Supabase project belongs to a different identity.', file=sys.stderr)
+print('Destroy the invalid local stack and its project-owned resources, then run Infra Up again.', file=sys.stderr)
+raise SystemExit(1)
+PY
+}
+
 assert_supabase_local_ports_available() {
-  local project_label="\${ANKH_NAMESPACE:-$(basename "\${APP_SOURCE_DIR}")}"
+  local project_label="\${EXPECTED_SUPABASE_PROJECT_ID}"
 
   ANKH_PROJECT_LABEL="\${project_label}" python3 - <<'PY'
 import os
@@ -1916,8 +2129,10 @@ PY
 if [[ ! -f "\${SUPABASE_PROJECT_DIR}/supabase/config.toml" ]]; then
   echo "No supabase/config.toml found in \${SUPABASE_PROJECT_DIR}. Initializing Supabase project..."
   supabase --workdir "\${SUPABASE_PROJECT_DIR}" init --yes >/dev/null
+  write_supabase_project_identity_for_new_config
 fi
 
+validate_supabase_project_identity
 configure_supabase_local_ports
 
 STATUS_ENV="$(
@@ -1989,6 +2204,7 @@ start_supabase_local_stack() {
 }
 
 if [[ -z "\${STATUS_ENV}" ]]; then
+  validate_supabase_project_identity
   assert_supabase_local_ports_available
   echo "Supabase local stack not detected. Starting with 'supabase start'..."
   start_supabase_local_stack
@@ -2002,6 +2218,7 @@ if [[ -z "\${SUPABASE_DB_URL}" ]]; then
 fi
 
 echo "Applying pending immutable Supabase migrations..."
+validate_supabase_project_identity
 run_checked_command \
   "Immutable Supabase migration application" \
   "" \