@ankhorage/infra 0.4.0 → 0.4.1

package/dist/adapters/minikube/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AAOxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEtD,MAAM,aAAa,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,kCAAkC,CAAC;QACtD,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI;QAC/B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,SAAS;QACT,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,YAAY,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,YAAY,CAAC,KAAK;SACtB;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA4B,EAC5B,OAAwC;IAExC,MAAM,MAAM,GACV,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC;IAE5F,MAAM,UAAU,GAAG,MAAM;SACtB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,IAAI,IAAI,iBAAiB,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateApiInfrastructureArtifacts } from '../../apiArtifacts';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst DEFAULT_NAMESPACE = 'ankh-app';\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const namespace = resolveNamespace(manifest, options);\n\n  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const apiArtifacts = generateApiInfrastructureArtifacts({\n    data: options.appManifest?.data,\n    databaseProvider: manifest.database?.provider,\n  });\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    namespace,\n    extraResources,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...apiArtifacts.warnings,\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...apiArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction resolveNamespace(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions,\n): string {\n  const source =\n    manifest.networking?.domain?.trim() ?? options.namespaceHint?.trim() ?? DEFAULT_NAMESPACE;\n\n  const normalized = source\n    .toLowerCase()\n    .replace(/[^a-z0-9-]/g, '-')\n    .replace(/-+/g, '-')\n    .replace(/^-|-$/g, '');\n\n  const safe = normalized.slice(0, 63).replace(/-+$/g, '');\n  return safe || DEFAULT_NAMESPACE;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AAOxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,iBAAiB,GAAG,UAAU,CAAC;AACrC,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAE3E,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,QAAQ,CAAC;QACxD,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,aAAa,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,kCAAkC,CAAC;QACtD,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI;QAC/B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,SAAS;QACT,iBAAiB;QACjB,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,YAAY,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,YAAY,CAAC,KAAK;SACtB;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,QAA4B;IAC1D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAC7C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACrD,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IACnD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;IAE3D,OAAO,CACL,YAAY,KAAK,UAAU;QAC3B,gBAAgB,KAAK,UAAU;QAC/B,eAAe,KAAK,UAAU;QAC9B,CAAC,eAAe,KAAK,MAAM;YACzB,CAAC,YAAY,KAAK,UAAU,IAAI,gBAAgB,KAAK,UAAU,CAAC,CAAC;QACnE,mBAAmB,KAAK,gBAAgB,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAwB;IAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,wMAAwM,CACzM,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA4B,EAC5B,OAAwC;IAExC,MAAM,MAAM,GACV,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC;IAE5F,MAAM,UAAU,GAAG,MAAM;SACtB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,IAAI,IAAI,iBAAiB,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateApiInfrastructureArtifacts } from '../../apiArtifacts';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst DEFAULT_NAMESPACE = 'ankh-app';\nconst CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const namespace = resolveNamespace(manifest, options);\n  const supabaseProjectId = isSupabaseLocalEnabled(manifest)\n    ? validateCanonicalProjectSlug(options.appManifest?.metadata.slug)\n    : null;\n\n  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const apiArtifacts = generateApiInfrastructureArtifacts({\n    data: options.appManifest?.data,\n    databaseProvider: manifest.database?.provider,\n  });\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    namespace,\n    supabaseProjectId,\n    extraResources,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...apiArtifacts.warnings,\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...apiArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction isSupabaseLocalEnabled(manifest: InfraManifestInput): boolean {\n  const authProvider = manifest.auth?.provider;\n  const databaseProvider = manifest.database?.provider;\n  const storageProvider = manifest.storage?.provider;\n  const secretStoreProvider = manifest.secretStore?.provider;\n\n  return (\n    authProvider === 'supabase' ||\n    databaseProvider === 'supabase' ||\n    storageProvider === 'supabase' ||\n    (storageProvider === 'auto' &&\n      (authProvider === 'supabase' || databaseProvider === 'supabase')) ||\n    secretStoreProvider === 'supabase-vault'\n  );\n}\n\nfunction validateCanonicalProjectSlug(slug: string | undefined): string {\n  if (!slug) {\n    throw new Error(\n      'Cannot generate local Supabase infrastructure: appManifest.metadata.slug is required.',\n    );\n  }\n\n  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {\n    throw new Error(\n      'Cannot generate local Supabase infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',\n    );\n  }\n\n  return slug;\n}\n\nfunction resolveNamespace(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions,\n): string {\n  const source =\n    manifest.networking?.domain?.trim() ?? options.namespaceHint?.trim() ?? DEFAULT_NAMESPACE;\n\n  const normalized = source\n    .toLowerCase()\n    .replace(/[^a-z0-9-]/g, '-')\n    .replace(/-+/g, '-')\n    .replace(/^-|-$/g, '');\n\n  const safe = normalized.slice(0, 63).replace(/-+$/g, '');\n  return safe || DEFAULT_NAMESPACE;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {

package/src/adapters/minikube/base/index.test.ts

@@ -1,3 +1,8 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
 import { describe, expect, test } from 'bun:test';
 
 import type { InfraManifestInput } from '../../../types';
@@ -43,6 +48,159 @@ describe('generateMinikubeBaseArtifacts Supabase local ports', () => {
     );
   });
 
+  test('uses app project identity for Supabase ports independently from namespace', () => {
+    const scannerEnv = getGeneratedFileContent(
+      'local-example-test',
+      'infra/minikube/.env.example',
+      {},
+      'scanner',
+    );
+    const scannerNamespace = getGeneratedFileContent(
+      'local-example-test',
+      'infra/minikube/k8s/namespace.yaml',
+      {},
+      'scanner',
+    );
+    const chessEnv = getGeneratedFileContent(
+      'local-example-test',
+      'infra/minikube/.env.example',
+      {},
+      'chess',
+    );
+
+    expect(scannerNamespace).toContain('name: local-example-test');
+    expect(scannerEnv).toContain('SUPABASE_LOCAL_PORT_BASE=64020');
+    expect(chessEnv).toContain('SUPABASE_LOCAL_PORT_BASE=62200');
+    expect(scannerEnv).not.toContain('SUPABASE_LOCAL_PORT_BASE=62200');
+  });
+
+  test('generates canonical Supabase project identity checks', () => {
+    const script = getGeneratedFileContent(
+      'scanner',
+      'infra/minikube/scripts/supabase-local-env.sh',
+    );
+    const status = getGeneratedFileContent('scanner', 'infra/minikube/scripts/status.sh');
+
+    expect(script).toContain('EXPECTED_SUPABASE_PROJECT_ID="scanner"');
+    expect(script).toContain('write_supabase_project_identity_for_new_config');
+    expect(script).toContain('validate_supabase_project_identity');
+    expect(script).toContain('project_id = "{expected}"');
+    expect(script).toContain(
+      'The existing local Supabase project belongs to a different identity.',
+    );
+    expect(script).toContain(
+      'Destroy the invalid local stack and its project-owned resources, then run Infra Up again.',
+    );
+    expect(script).toContain(
+      'supabase --workdir "${SUPABASE_PROJECT_DIR}" init --yes >/dev/null\n  write_supabase_project_identity_for_new_config',
+    );
+    expect(script).toContain('validate_supabase_project_identity\nconfigure_supabase_local_ports');
+    expect(script).toContain(
+      'validate_supabase_project_identity\n  assert_supabase_local_ports_available',
+    );
+    expect(script).toContain('validate_supabase_project_identity\nrun_checked_command');
+    expect(script).not.toContain('basename "${APP_SOURCE_DIR}"');
+    expect(script).not.toContain('_minikube');
+
+    expect(status).toContain('EXPECTED_SUPABASE_PROJECT_ID="scanner"');
+    expect(status).toContain('reject_supabase_project_id_override');
+    expect(status).toContain('validate_supabase_project_identity');
+    expect(status).toContain('Supabase project identity mismatch.');
+    expect(status).toContain('Destroy the invalid local stack and run Infra Up again.');
+    expect(status).not.toContain('write_supabase_project_identity_for_new_config');
+    expect(status).not.toContain('configure_supabase_local_ports');
+    expect(status).not.toContain('_minikube');
+  });
+
+  test('patches only a newly initialized Supabase config to the canonical project identity', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'scanner',
+      existingConfig: null,
+    });
+
+    expect(run.status).toBe(0);
+    expect(readFileSync(run.configPath, 'utf-8')).toContain('project_id = "scanner"');
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).toContain(
+      '--workdir ' + run.root + ' init --yes',
+    );
+  });
+
+  test('rejects an existing Supabase config with a different project identity before lifecycle work', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'scanner',
+      existingConfig: 'project_id = "minikube"\n[api]\nport = 54321\n',
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain('Supabase project identity mismatch.');
+    expect(run.combinedOutput).toContain('Expected "scanner", found "minikube".');
+    expect(run.combinedOutput).toContain(
+      'Destroy the invalid local stack and its project-owned resources, then run Infra Up again.',
+    );
+    expect(readFileSync(run.configPath, 'utf-8')).toContain('project_id = "minikube"');
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('--workdir');
+  });
+
+  test('rejects an existing Supabase config with missing top-level project identity', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'scanner',
+      existingConfig: '[api]\nport = 54321\n',
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain('Expected "scanner", found missing.');
+    expect(readFileSync(run.configPath, 'utf-8')).not.toContain('project_id = "scanner"');
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('--workdir');
+  });
+
+  test('rejects ambient SUPABASE_PROJECT_ID before Supabase CLI operations', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'scanner',
+      existingConfig: 'project_id = "scanner"\n[api]\nport = 54321\n',
+      env: {
+        SUPABASE_PROJECT_ID: 'minikube',
+      },
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain(
+      'SUPABASE_PROJECT_ID must not be set for generated local Infra scripts.',
+    );
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('--workdir');
+  });
+
+  test('rejects empty Supabase project identity before Supabase CLI operations', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'plain',
+      supabaseProjectId: null,
+      existingConfig: null,
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain(
+      'Cannot run local Supabase infrastructure: expected Supabase project identity is empty.',
+    );
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('--workdir');
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('init --yes');
+    expect(() => readFileSync(run.configPath, 'utf-8')).toThrow();
+  });
+
+  test('requires python before Supabase init mutates the workdir', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'scanner',
+      existingConfig: null,
+      withoutPython: true,
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain(
+      'python3 is required to reconcile supabase/config.toml before local Supabase startup.',
+    );
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('--workdir');
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('init --yes');
+    expect(() => readFileSync(run.configPath, 'utf-8')).toThrow();
+  });
+
   test('generates bootstrap logic that retries unhealthy local Supabase startup once', () => {
     const script = getGeneratedFileContent('chess', 'infra/minikube/scripts/supabase-local-env.sh');
 
@@ -67,9 +225,16 @@ describe('generateMinikubeBaseArtifacts Supabase local ports', () => {
     const script = getGeneratedFileContent('chess', 'infra/minikube/scripts/supabase-local-env.sh');
 
     expect(script).toContain('SUPABASE_PROJECT_DIR="${SUPABASE_PROJECT_DIR:-${ROOT_DIR}}"');
+    expect(script).toContain('require_expected_supabase_project_identity');
+    expect(script).toContain(
+      'require_expected_supabase_project_identity\nreject_supabase_project_id_override\nrequire_supabase_cli_capabilities',
+    );
     expect(script).toContain('supabase CLI >= 2.106.0 is required');
     expect(script).toContain('supabase CLI does not support required global --workdir flag');
     expect(script).toContain('supabase CLI does not support required migration up --local command');
+    expect(script).toContain(
+      'python3 is required to reconcile supabase/config.toml before local Supabase startup.',
+    );
     expect(script).toContain('psql is required but not installed');
     expect(script).toContain('supabase --workdir "${SUPABASE_PROJECT_DIR}" init --yes');
     expect(script).toContain('supabase --workdir "${SUPABASE_PROJECT_DIR}" migration up --local');
@@ -136,16 +301,62 @@ describe('generateMinikubeBaseArtifacts Supabase local ports', () => {
     );
     expect(status).toContain('generated trigger function execute privilege must be revoked');
   });
+
+  test('does not reject SUPABASE_PROJECT_ID for non-Supabase status checks', () => {
+    const run = runGeneratedStatusScript({
+      manifest: {
+        deployment: {
+          target: 'minikube',
+          monitoring: false,
+        },
+        plugins: [],
+      },
+      supabaseProjectId: null,
+      env: {
+        SUPABASE_PROJECT_ID: 'ambient-project',
+      },
+    });
+
+    expect(run.status).toBe(0);
+    expect(run.combinedOutput).not.toContain(
+      'SUPABASE_PROJECT_ID must not be set for generated local Infra scripts.',
+    );
+    expect(run.kubectlLog).toContain('get all -n plain');
+  });
+
+  test('rejects empty Supabase project identity before local Supabase status checks', () => {
+    const run = runGeneratedStatusScript({
+      manifest: {
+        deployment: {
+          target: 'minikube',
+          monitoring: false,
+        },
+        plugins: [],
+      },
+      supabaseProjectId: null,
+      env: {
+        SUPABASE_LOCAL_ENABLED: 'true',
+      },
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain(
+      'Cannot run local Supabase infrastructure: expected Supabase project identity is empty.',
+    );
+    expect(run.supabaseLog).toBe('');
+  });
 });
 
 function getGeneratedFileContent(
   namespace: string,
   filePath: string,
   overrides: Partial<InfraManifestInput> = {},
+  supabaseProjectId = namespace,
 ): string {
   const artifact = generateMinikubeBaseArtifacts({
     manifest: createInfraManifest(overrides),
     namespace,
+    supabaseProjectId,
     extraResources: [],
     extraEnvEntries: [],
   }).find((file) => file.path === filePath);
@@ -195,3 +406,248 @@ function createInfraManifest(overrides: Partial<InfraManifestInput> = {}): Infra
     },
   };
 }
+
+function runGeneratedSupabaseScript(args: {
+  projectId: string;
+  supabaseProjectId?: string | null;
+  existingConfig: string | null;
+  env?: Record<string, string>;
+  withoutPython?: boolean;
+}): {
+  status: number | null;
+  combinedOutput: string;
+  root: string;
+  configPath: string;
+  supabaseLogPath: string;
+} {
+  const tempRoot = mkdtempSync(join(tmpdir(), 'infra-supabase-identity-'));
+  const root = join(tempRoot, 'infra', 'minikube');
+  const scriptsDir = join(root, 'scripts');
+  const supabaseDir = join(root, 'supabase');
+  const binDir = join(tempRoot, 'bin');
+  const appSourceDir = join(tempRoot, 'app');
+  const scriptPath = join(scriptsDir, 'supabase-local-env.sh');
+  const configPath = join(supabaseDir, 'config.toml');
+  const supabaseLogPath = join(tempRoot, 'supabase.log');
+
+  mkdirSync(scriptsDir, { recursive: true });
+  mkdirSync(binDir, { recursive: true });
+  mkdirSync(appSourceDir, { recursive: true });
+  writeFileSync(join(root, '.env.example'), '');
+  writeFileSync(supabaseLogPath, '');
+
+  if (args.existingConfig !== null) {
+    mkdirSync(supabaseDir, { recursive: true });
+    writeFileSync(configPath, args.existingConfig);
+  }
+
+  const script = getGeneratedFileContent(
+    args.projectId,
+    'infra/minikube/scripts/supabase-local-env.sh',
+    {},
+    args.supabaseProjectId === undefined ? args.projectId : args.supabaseProjectId,
+  );
+  writeFileSync(scriptPath, script);
+  chmodSync(scriptPath, 0o755);
+
+  const supabaseStubPath = join(binDir, 'supabase');
+  writeFileSync(
+    supabaseStubPath,
+    `#!/bin/bash
+set -euo pipefail
+printf '%s\\n' "$*" >> "\${SUPABASE_STUB_LOG}"
+
+if [[ "\${1:-}" == "--version" ]]; then
+  echo "supabase 2.106.0"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "status" && "\${2:-}" == "--help" ]]; then
+  echo "--workdir"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "migration" && "\${2:-}" == "up" && "\${3:-}" == "--help" ]]; then
+  echo "--local"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "--workdir" && "\${3:-}" == "init" && "\${4:-}" == "--yes" ]]; then
+  mkdir -p "\${2}/supabase"
+  printf '%s\\n' 'project_id = "minikube"' '[api]' 'port = 54321' > "\${2}/supabase/config.toml"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "--workdir" && "\${3:-}" == "status" && "\${4:-}" == "-o" && "\${5:-}" == "env" ]]; then
+  cat <<'ENV'
+DB_URL=postgresql://postgres:postgres@127.0.0.1:54322/postgres
+API_URL=http://127.0.0.1:54321
+ANON_KEY=anon
+SERVICE_ROLE_KEY=service
+JWT_SECRET=secret
+ENV
+  exit 0
+fi
+
+if [[ "\${1:-}" == "--workdir" && "\${3:-}" == "status" ]]; then
+  exit 0
+fi
+
+if [[ "\${1:-}" == "--workdir" && "\${3:-}" == "migration" && "\${4:-}" == "up" && "\${5:-}" == "--local" ]]; then
+  exit 0
+fi
+
+echo "unexpected supabase call: $*" >&2
+exit 1
+`,
+  );
+  chmodSync(supabaseStubPath, 0o755);
+
+  const psqlStubPath = join(binDir, 'psql');
+  writeFileSync(
+    psqlStubPath,
+    `#!/bin/bash
+exit 0
+`,
+  );
+  chmodSync(psqlStubPath, 0o755);
+
+  const result = spawnSync('/bin/bash', [scriptPath], {
+    cwd: tempRoot,
+    env: {
+      ...(args.withoutPython ? {} : process.env),
+      PATH: args.withoutPython ? binDir : `${binDir}:${process.env.PATH ?? ''}`,
+      APP_SOURCE_DIR: appSourceDir,
+      SUPABASE_STUB_LOG: supabaseLogPath,
+      ...args.env,
+    },
+    encoding: 'utf-8',
+  });
+
+  return {
+    status: result.status,
+    combinedOutput: `${result.stdout}${result.stderr}`,
+    root,
+    configPath,
+    supabaseLogPath,
+  };
+}
+
+function runGeneratedStatusScript(args: {
+  manifest: InfraManifestInput;
+  supabaseProjectId: string | null;
+  env?: Record<string, string>;
+}): {
+  status: number | null;
+  combinedOutput: string;
+  kubectlLog: string;
+  supabaseLog: string;
+} {
+  const tempRoot = mkdtempSync(join(tmpdir(), 'infra-status-'));
+  const root = join(tempRoot, 'infra', 'minikube');
+  const scriptsDir = join(root, 'scripts');
+  const binDir = join(tempRoot, 'bin');
+  const scriptPath = join(scriptsDir, 'status.sh');
+  const kubectlLogPath = join(tempRoot, 'kubectl.log');
+  const supabaseLogPath = join(tempRoot, 'supabase.log');
+
+  mkdirSync(scriptsDir, { recursive: true });
+  mkdirSync(binDir, { recursive: true });
+  writeFileSync(join(root, '.env.example'), '');
+  writeFileSync(kubectlLogPath, '');
+  writeFileSync(supabaseLogPath, '');
+
+  const artifact = generateMinikubeBaseArtifacts({
+    manifest: args.manifest,
+    namespace: 'plain',
+    supabaseProjectId: args.supabaseProjectId,
+    extraResources: [],
+    extraEnvEntries: [],
+  }).find((file) => file.path === 'infra/minikube/scripts/status.sh');
+
+  if (!artifact) {
+    throw new Error('Expected generated status.sh artifact');
+  }
+
+  writeFileSync(scriptPath, artifact.content);
+  chmodSync(scriptPath, 0o755);
+
+  const kubectlStubPath = join(binDir, 'kubectl');
+  writeFileSync(
+    kubectlStubPath,
+    `#!/bin/bash
+set -euo pipefail
+printf '%s\\n' "$*" >> "\${KUBECTL_STUB_LOG}"
+
+if [[ "\${1:-}" == "config" && "\${2:-}" == "current-context" ]]; then
+  echo "minikube"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "cluster-info" ]]; then
+  echo "Kubernetes control plane is running"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "get" && "\${2:-}" == "namespace" ]]; then
+  exit 0
+fi
+
+if [[ "\${1:-}" == "get" && "\${2:-}" == "all" ]]; then
+  echo "No resources found"
+  exit 0
+fi
+
+echo "unexpected kubectl call: $*" >&2
+exit 1
+`,
+  );
+  chmodSync(kubectlStubPath, 0o755);
+
+  const supabaseStubPath = join(binDir, 'supabase');
+  writeFileSync(
+    supabaseStubPath,
+    `#!/bin/bash
+set -euo pipefail
+printf '%s\\n' "$*" >> "\${SUPABASE_STUB_LOG}"
+
+if [[ "\${1:-}" == "--version" ]]; then
+  echo "supabase 2.106.0"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "status" && "\${2:-}" == "--help" ]]; then
+  echo "--workdir"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "migration" && "\${2:-}" == "up" && "\${3:-}" == "--help" ]]; then
+  echo "--local"
+  exit 0
+fi
+
+echo "unexpected supabase call: $*" >&2
+exit 1
+`,
+  );
+  chmodSync(supabaseStubPath, 0o755);
+
+  const result = spawnSync('/bin/bash', [scriptPath], {
+    cwd: tempRoot,
+    env: {
+      ...process.env,
+      PATH: `${binDir}:${process.env.PATH ?? ''}`,
+      KUBECTL_STUB_LOG: kubectlLogPath,
+      SUPABASE_STUB_LOG: supabaseLogPath,
+      ...args.env,
+    },
+    encoding: 'utf-8',
+  });
+
+  return {
+    status: result.status,
+    combinedOutput: `${result.stdout}${result.stderr}`,
+    kubectlLog: readFileSync(kubectlLogPath, 'utf-8'),
+    supabaseLog: readFileSync(supabaseLogPath, 'utf-8'),
+  };
+}