@ankhorage/infra 0.4.0 → 0.4.1

package/src/adapters/minikube/base/index.ts

@@ -30,17 +30,18 @@ const SUPABASE_LOCAL_PORT_REFERENCE_PROJECT = 'my-app';
 export function generateMinikubeBaseArtifacts(args: {
   manifest: InfraManifestInput;
   namespace: string;
+  supabaseProjectId: string | null;
   extraResources: string[];
   extraEnvEntries: string[];
 }): GeneratedInfrastructureFile[] {
-  const { manifest, namespace, extraResources, extraEnvEntries } = args;
+  const { manifest, namespace, supabaseProjectId, extraResources, extraEnvEntries } = args;
 
   const root = 'infra/minikube';
   const k8sRoot = `${root}/k8s`;
   const scriptsRoot = `${root}/scripts`;
   const appImageRoot = `${root}/app-image`;
   const defaultAppImage = getDefaultAppImage(namespace);
-  const supabaseLocalPorts = resolveSupabaseLocalPorts(namespace);
+  const supabaseLocalPorts = resolveSupabaseLocalPorts(supabaseProjectId ?? namespace);
 
   const authScope = manifest.auth?.scope ?? 'none';
   const authProvider = manifest.auth?.provider ?? 'none';
@@ -68,6 +69,7 @@ export function generateMinikubeBaseArtifacts(args: {
         authzEngine,
         extraResources,
         supabaseLocalPorts,
+        supabaseProjectId,
         supabaseLocalEnabled,
         profileModel,
       }),
@@ -140,6 +142,7 @@ export function generateMinikubeBaseArtifacts(args: {
       path: `${scriptsRoot}/status.sh`,
       content: getStatusScript({
         defaultNamespace: namespace,
+        supabaseProjectId,
         supabaseLocalEnabled,
         profileModel,
       }),
@@ -148,6 +151,7 @@ export function generateMinikubeBaseArtifacts(args: {
     {
       path: `${scriptsRoot}/supabase-local-env.sh`,
       content: getSupabaseLocalEnvScript({
+        supabaseProjectId,
         supabaseLocalPorts,
         profileModel,
       }),
@@ -168,6 +172,7 @@ function getReadmeMarkdown(args: {
   authzEngine: string;
   extraResources: string[];
   supabaseLocalPorts: SupabaseLocalPorts;
+  supabaseProjectId: string | null;
   supabaseLocalEnabled: boolean;
   profileModel: ResolvedProfileModel;
 }): string {
@@ -179,6 +184,7 @@ function getReadmeMarkdown(args: {
     authzEngine,
     extraResources,
     supabaseLocalPorts,
+    supabaseProjectId,
     supabaseLocalEnabled,
     profileModel,
   } = args;
@@ -245,6 +251,7 @@ ${resourceLines}
 ## Runtime Conventions
 
 - Namespace: \`${namespace}\`
+- Supabase local project identity: \`${supabaseProjectId ?? 'unused'}\`
 - Monitoring requested: \`${monitoringEnabled ? 'true' : 'false'}\`
 - Auth provider: \`${authProvider}\`
 - Authorization engine: \`${authzEngine}\`
@@ -332,6 +339,7 @@ Build flow:
 
 - \`./scripts/up.sh\` calls \`./scripts/build-app-image.sh\` when \`APP_BUILD_ENABLED=true\`.
 - Supabase local project root: \`infra/minikube\`${supabaseLocalEnabled ? '' : ' (unused unless Supabase-backed auth/database/storage is enabled)'}.
+- Supabase local project identity: \`${supabaseProjectId ?? 'unused'}\`; existing local configs with another \`project_id\` must be destroyed and recreated manually.
 - Immutable migrations live in \`supabase/migrations/\` and are applied with \`supabase migration up --local\`.
 ${profileModel.enabled ? '- Generated profile desired-state reconciliation lives in `supabase/generated/auth_profiles.sql` and records checksum state in `ankhorage_internal.generated_schema_state`.\n' : ''}- \`./scripts/supabase-local-env.sh\` can populate Supabase keys in \`.env\` from local \`supabase status -o env\`.
 - \`./scripts/supabase-local-env.sh\` writes \`EXPO_PUBLIC_SUPABASE_URL\` + \`EXPO_PUBLIC_SUPABASE_ANON_KEY\` into \`$APP_SOURCE_DIR/.env.local\` (e.g. \`apps/card/.env.local\`) for local app runs.
@@ -1414,10 +1422,11 @@ $$;`;
 
 function getStatusScript(args: {
   defaultNamespace: string;
+  supabaseProjectId: string | null;
   supabaseLocalEnabled: boolean;
   profileModel: ResolvedProfileModel;
 }): string {
-  const { defaultNamespace, supabaseLocalEnabled, profileModel } = args;
+  const { defaultNamespace, supabaseProjectId, supabaseLocalEnabled, profileModel } = args;
   const profileStatusSql = profileModel.enabled ? getSupabaseProfileChecksumSql(profileModel) : '';
   const profileVerificationSql = profileModel.enabled
     ? getSupabaseProfileVerificationSql(profileModel)
@@ -1441,8 +1450,28 @@ AUTH_RUNTIME_MODE="\${AUTH_RUNTIME_MODE:-local}"
 SUPABASE_LOCAL_ENABLED="\${SUPABASE_LOCAL_ENABLED:-${supabaseLocalEnabled ? 'true' : 'false'}}"
 SUPABASE_SECRET_SYNC_ENABLED="\${SUPABASE_SECRET_SYNC_ENABLED:-true}"
 SUPABASE_PROJECT_DIR="\${SUPABASE_PROJECT_DIR:-\${ROOT_DIR}}"
+EXPECTED_SUPABASE_PROJECT_ID="${supabaseProjectId ?? ''}"
 SUPABASE_PROFILE_ENABLED="${profileModel.enabled ? 'true' : 'false'}"
 SUPABASE_PROFILE_RECONCILE_FILE="\${SUPABASE_PROJECT_DIR}/supabase/generated/auth_profiles.sql"
+export EXPECTED_SUPABASE_PROJECT_ID
+
+reject_supabase_project_id_override() {
+  if [[ -n "\${SUPABASE_PROJECT_ID:-}" ]]; then
+    echo "SUPABASE_PROJECT_ID must not be set for generated local Infra scripts."
+    echo "Unset SUPABASE_PROJECT_ID and use supabase/config.toml project_id instead."
+    return 1
+  fi
+
+  unset SUPABASE_PROJECT_ID
+}
+
+require_expected_supabase_project_identity() {
+  if [[ -z "\${EXPECTED_SUPABASE_PROJECT_ID}" ]]; then
+    echo "Cannot run local Supabase infrastructure: expected Supabase project identity is empty."
+    echo "Regenerate Infra with appManifest.metadata.slug for Supabase-backed local services."
+    return 1
+  fi
+}
 
 if ! command -v kubectl >/dev/null 2>&1; then
   echo "kubectl is required but not installed."
@@ -1606,6 +1635,61 @@ run_supabase_sql() {
   return 1
 }
 
+validate_supabase_project_identity() {
+  local config_file="\${SUPABASE_PROJECT_DIR}/supabase/config.toml"
+
+  if [[ -z "\${EXPECTED_SUPABASE_PROJECT_ID}" ]]; then
+    return 0
+  fi
+
+  if [[ ! -f "\${config_file}" ]]; then
+    echo "- local Supabase project identity: config missing at \${config_file}"
+    return 1
+  fi
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "- local Supabase project identity: python3 is required to read \${config_file}"
+    return 1
+  fi
+
+  python3 - "\${config_file}" <<'PY'
+import os
+import re
+import sys
+
+
+def read_top_level_project_id(config_path):
+    key_re = re.compile(r'^\\s*project_id\\s*=\\s*(.*?)\\s*(?:#.*)?$')
+    section_re = re.compile(r'^\\s*\\[[^\\]]+\\]\\s*$')
+
+    with open(config_path, 'r', encoding='utf-8') as f:
+        for line in f:
+            if section_re.match(line):
+                return None
+            match = key_re.match(line)
+            if not match:
+                continue
+            raw = match.group(1).strip()
+            quoted = re.match(r'^["\\']([^"\\']*)["\\']$', raw)
+            return quoted.group(1) if quoted else raw
+
+    return None
+
+
+expected = os.environ['EXPECTED_SUPABASE_PROJECT_ID']
+actual = read_top_level_project_id(sys.argv[1])
+
+if actual == expected:
+    raise SystemExit(0)
+
+found = 'missing' if actual is None else f'"{actual}"'
+print('Supabase project identity mismatch.', file=sys.stderr)
+print(f'Expected "{expected}", found {found}.', file=sys.stderr)
+print('Destroy the invalid local stack and run Infra Up again.', file=sys.stderr)
+raise SystemExit(1)
+PY
+}
+
 check_immutable_migrations_applied() {
   local migrations_dir="\${SUPABASE_PROJECT_DIR}/supabase/migrations"
   local applied_versions
@@ -1640,8 +1724,14 @@ if [[ "\${AUTH_RUNTIME_MODE}" == "local" && "\${SUPABASE_LOCAL_ENABLED}" == "tru
   echo "Local Supabase database checks:"
   status_failed=0
 
-  if require_supabase_cli_capabilities; then
-    if supabase --workdir "\${SUPABASE_PROJECT_DIR}" status >/dev/null 2>&1; then
+  if ! require_expected_supabase_project_identity; then
+    status_failed=1
+  elif ! reject_supabase_project_id_override; then
+    status_failed=1
+  elif require_supabase_cli_capabilities; then
+    if ! validate_supabase_project_identity; then
+      status_failed=1
+    elif supabase --workdir "\${SUPABASE_PROJECT_DIR}" status >/dev/null 2>&1; then
       STATUS_ENV="$(supabase --workdir "\${SUPABASE_PROJECT_DIR}" status -o env)"
       SUPABASE_DB_URL="$(read_env_value "\${STATUS_ENV}" DB_URL)"
       if [[ -z "\${SUPABASE_DB_URL}" ]]; then
@@ -1713,10 +1803,11 @@ fi
 }
 
 function getSupabaseLocalEnvScript(args: {
+  supabaseProjectId: string | null;
   supabaseLocalPorts: SupabaseLocalPorts;
   profileModel: ResolvedProfileModel;
 }): string {
-  const { supabaseLocalPorts, profileModel } = args;
+  const { supabaseProjectId, supabaseLocalPorts, profileModel } = args;
   const profileStatusSql = profileModel.enabled ? getSupabaseProfileChecksumSql(profileModel) : '';
   const profileVerificationSql = profileModel.enabled
     ? getSupabaseProfileVerificationSql(profileModel)
@@ -1739,9 +1830,29 @@ fi
 
 APP_SOURCE_DIR="\${APP_SOURCE_DIR:-$(cd "\${ROOT_DIR}/../.." && pwd)}"
 SUPABASE_PROJECT_DIR="\${SUPABASE_PROJECT_DIR:-\${ROOT_DIR}}"
+EXPECTED_SUPABASE_PROJECT_ID="${supabaseProjectId ?? ''}"
 APP_SUPABASE_ENV_FILE="\${APP_SUPABASE_ENV_FILE:-\${APP_SOURCE_DIR}/.env.local}"
 SUPABASE_PROFILE_ENABLED="${profileModel.enabled ? 'true' : 'false'}"
 SUPABASE_PROFILE_RECONCILE_FILE="\${SUPABASE_PROJECT_DIR}/supabase/generated/auth_profiles.sql"
+export EXPECTED_SUPABASE_PROJECT_ID
+
+reject_supabase_project_id_override() {
+  if [[ -n "\${SUPABASE_PROJECT_ID:-}" ]]; then
+    echo "SUPABASE_PROJECT_ID must not be set for generated local Infra scripts."
+    echo "Unset SUPABASE_PROJECT_ID and use supabase/config.toml project_id instead."
+    exit 1
+  fi
+
+  unset SUPABASE_PROJECT_ID
+}
+
+require_expected_supabase_project_identity() {
+  if [[ -z "\${EXPECTED_SUPABASE_PROJECT_ID}" ]]; then
+    echo "Cannot run local Supabase infrastructure: expected Supabase project identity is empty."
+    echo "Regenerate Infra with appManifest.metadata.slug for Supabase-backed local services."
+    exit 1
+  fi
+}
 
 SUPABASE_LOCAL_PORT_BASE="\${SUPABASE_LOCAL_PORT_BASE:-${supabaseLocalPorts.base}}"
 SUPABASE_LOCAL_SHADOW_PORT="\${SUPABASE_LOCAL_SHADOW_PORT:-\${SUPABASE_LOCAL_PORT_BASE}}"
@@ -1787,6 +1898,11 @@ require_supabase_cli_capabilities() {
     exit 1
   fi
 
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "python3 is required to reconcile supabase/config.toml before local Supabase startup."
+    exit 1
+  fi
+
   local version
   version="$(supabase --version | awk '{print $NF}')"
   if ! version_ge "\${version}" "2.106.0"; then
@@ -1848,6 +1964,8 @@ run_checked_sql_file() {
     psql "\${SUPABASE_DB_URL}" -v ON_ERROR_STOP=1 -q -f "\${sql_file}"
 }
 
+require_expected_supabase_project_identity
+reject_supabase_project_id_override
 require_supabase_cli_capabilities
 
 if [[ ! -d "\${SUPABASE_PROJECT_DIR}" ]]; then
@@ -1858,18 +1976,6 @@ fi
 configure_supabase_local_ports() {
   local config_file="\${SUPABASE_PROJECT_DIR}/supabase/config.toml"
 
-  if ! command -v python3 >/dev/null 2>&1; then
-    echo "python3 is required to patch supabase/config.toml with generated local port defaults."
-    echo "Install python3 (recommended) or manually edit \${config_file} ports:"
-    echo "- [api] port = \${SUPABASE_LOCAL_API_PORT}"
-    echo "- [db] port = \${SUPABASE_LOCAL_DB_PORT}"
-    echo "- [db] shadow_port = \${SUPABASE_LOCAL_SHADOW_PORT}"
-    echo "- [studio] port = \${SUPABASE_LOCAL_STUDIO_PORT}"
-    echo "- [inbucket] port = \${SUPABASE_LOCAL_INBUCKET_PORT}"
-    echo "- [analytics] port = \${SUPABASE_LOCAL_ANALYTICS_PORT}"
-    exit 1
-  fi
-
   python3 - "\${config_file}" <<'PY'
 import os
 import re
@@ -1973,8 +2079,114 @@ if __name__ == "__main__":
 PY
 }
 
+write_supabase_project_identity_for_new_config() {
+  local config_file="\${SUPABASE_PROJECT_DIR}/supabase/config.toml"
+
+  require_expected_supabase_project_identity
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "python3 is required to write Supabase project_id in \${config_file}."
+    exit 1
+  fi
+
+  python3 - "\${config_file}" <<'PY'
+import os
+import re
+import sys
+
+
+def write_top_level_project_id(config_path, expected):
+    key_re = re.compile(r'^(\\s*)project_id\\s*=\\s*(.*?)(\\s*(#.*)?)?$')
+    section_re = re.compile(r'^\\s*\\[[^\\]]+\\]\\s*$')
+
+    with open(config_path, 'r', encoding='utf-8') as f:
+        lines = f.readlines()
+
+    section_start = len(lines)
+    for i, line in enumerate(lines):
+        if section_re.match(line):
+            section_start = i
+            break
+
+    for i in range(section_start):
+        match = key_re.match(lines[i])
+        if not match:
+            continue
+        indent = match.group(1) or ''
+        trailing = (match.group(3) or '').rstrip('\\n')
+        lines[i] = f'{indent}project_id = "{expected}"{trailing}\\n'
+        break
+    else:
+        insert_at = section_start
+        lines.insert(insert_at, f'project_id = "{expected}"\\n')
+
+    with open(config_path, 'w', encoding='utf-8') as f:
+        f.writelines(lines)
+
+
+write_top_level_project_id(sys.argv[1], os.environ['EXPECTED_SUPABASE_PROJECT_ID'])
+PY
+}
+
+validate_supabase_project_identity() {
+  local config_file="\${SUPABASE_PROJECT_DIR}/supabase/config.toml"
+
+  require_expected_supabase_project_identity
+
+  if [[ ! -f "\${config_file}" ]]; then
+    echo "Supabase project identity mismatch."
+    printf 'Expected "%s", found missing.\n' "\${EXPECTED_SUPABASE_PROJECT_ID}"
+    echo "The existing local Supabase project belongs to a different identity."
+    echo "Destroy the invalid local stack and its project-owned resources, then run Infra Up again."
+    exit 1
+  fi
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "python3 is required to read Supabase project_id in \${config_file}."
+    exit 1
+  fi
+
+  python3 - "\${config_file}" <<'PY'
+import os
+import re
+import sys
+
+
+def read_top_level_project_id(config_path):
+    key_re = re.compile(r'^\\s*project_id\\s*=\\s*(.*?)\\s*(?:#.*)?$')
+    section_re = re.compile(r'^\\s*\\[[^\\]]+\\]\\s*$')
+
+    with open(config_path, 'r', encoding='utf-8') as f:
+        for line in f:
+            if section_re.match(line):
+                return None
+            match = key_re.match(line)
+            if not match:
+                continue
+            raw = match.group(1).strip()
+            quoted = re.match(r'^["\\']([^"\\']*)["\\']$', raw)
+            return quoted.group(1) if quoted else raw
+
+    return None
+
+
+expected = os.environ['EXPECTED_SUPABASE_PROJECT_ID']
+actual = read_top_level_project_id(sys.argv[1])
+
+if actual == expected:
+    raise SystemExit(0)
+
+found = 'missing' if actual is None else f'"{actual}"'
+print('Supabase project identity mismatch.', file=sys.stderr)
+print(f'Expected "{expected}", found {found}.', file=sys.stderr)
+print('The existing local Supabase project belongs to a different identity.', file=sys.stderr)
+print('Destroy the invalid local stack and its project-owned resources, then run Infra Up again.', file=sys.stderr)
+raise SystemExit(1)
+PY
+}
+
 assert_supabase_local_ports_available() {
-  local project_label="\${ANKH_NAMESPACE:-$(basename "\${APP_SOURCE_DIR}")}"
+  local project_label="\${EXPECTED_SUPABASE_PROJECT_ID}"
 
   ANKH_PROJECT_LABEL="\${project_label}" python3 - <<'PY'
 import os
@@ -2052,8 +2264,10 @@ PY
 if [[ ! -f "\${SUPABASE_PROJECT_DIR}/supabase/config.toml" ]]; then
   echo "No supabase/config.toml found in \${SUPABASE_PROJECT_DIR}. Initializing Supabase project..."
   supabase --workdir "\${SUPABASE_PROJECT_DIR}" init --yes >/dev/null
+  write_supabase_project_identity_for_new_config
 fi
 
+validate_supabase_project_identity
 configure_supabase_local_ports
 
 STATUS_ENV="$(
@@ -2125,6 +2339,7 @@ start_supabase_local_stack() {
 }
 
 if [[ -z "\${STATUS_ENV}" ]]; then
+  validate_supabase_project_identity
   assert_supabase_local_ports_available
   echo "Supabase local stack not detected. Starting with 'supabase start'..."
   start_supabase_local_stack
@@ -2138,6 +2353,7 @@ if [[ -z "\${SUPABASE_DB_URL}" ]]; then
 fi
 
 echo "Applying pending immutable Supabase migrations..."
+validate_supabase_project_identity
 run_checked_command \
   "Immutable Supabase migration application" \
   "" \

package/src/adapters/minikube/index.ts

@@ -12,6 +12,7 @@ import { generateSecretStoreArtifacts } from './secrets';
 import { generateStorageArtifacts } from './storage';
 
 const DEFAULT_NAMESPACE = 'ankh-app';
+const CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
 
 export function generateMinikubeInfra(
   manifest: InfraManifestInput,
@@ -30,6 +31,9 @@ export function generateMinikubeInfra(
   }
 
   const namespace = resolveNamespace(manifest, options);
+  const supabaseProjectId = isSupabaseLocalEnabled(manifest)
+    ? validateCanonicalProjectSlug(options.appManifest?.metadata.slug)
+    : null;
 
   const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });
   const authzArtifacts = generateAuthorizationArtifacts({
@@ -60,6 +64,7 @@ export function generateMinikubeInfra(
   const baseFiles = generateMinikubeBaseArtifacts({
     manifest,
     namespace,
+    supabaseProjectId,
     extraResources,
     extraEnvEntries,
   });
@@ -136,6 +141,38 @@ function collectWarnings(manifest: InfraManifestInput): string[] {
   return warnings;
 }
 
+function isSupabaseLocalEnabled(manifest: InfraManifestInput): boolean {
+  const authProvider = manifest.auth?.provider;
+  const databaseProvider = manifest.database?.provider;
+  const storageProvider = manifest.storage?.provider;
+  const secretStoreProvider = manifest.secretStore?.provider;
+
+  return (
+    authProvider === 'supabase' ||
+    databaseProvider === 'supabase' ||
+    storageProvider === 'supabase' ||
+    (storageProvider === 'auto' &&
+      (authProvider === 'supabase' || databaseProvider === 'supabase')) ||
+    secretStoreProvider === 'supabase-vault'
+  );
+}
+
+function validateCanonicalProjectSlug(slug: string | undefined): string {
+  if (!slug) {
+    throw new Error(
+      'Cannot generate local Supabase infrastructure: appManifest.metadata.slug is required.',
+    );
+  }
+
+  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {
+    throw new Error(
+      'Cannot generate local Supabase infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',
+    );
+  }
+
+  return slug;
+}
+
 function resolveNamespace(
   manifest: InfraManifestInput,
   options: InfrastructureGenerationOptions,

package/src/adapters/minikube/secrets/index.test.ts

@@ -1,3 +1,4 @@
+import type { AppManifest } from '@ankhorage/contracts';
 import { SUPABASE_VAULT_MIGRATION_SQL } from '@ankhorage/supabase-vault';
 import { describe, expect, test } from 'bun:test';
 
@@ -21,7 +22,9 @@ function createManifest(overrides: Partial<InfraManifestInput> = {}): InfraManif
 
 describe('minikube secret-store generation', () => {
   test('generates the released Supabase Vault migration through the existing lifecycle', () => {
-    const result = generateInfrastructure(createManifest());
+    const result = generateInfrastructure(createManifest(), {
+      appManifest: createAppManifest('vault-app'),
+    });
     const migration = result.files.find((file) => file.path === SUPABASE_VAULT_MIGRATION_PATH);
     const envExample = result.files.find((file) => file.path === 'infra/minikube/.env.example');
     const upScript = result.files.find((file) => file.path === 'infra/minikube/scripts/up.sh');
@@ -55,6 +58,7 @@ describe('minikube secret-store generation', () => {
             },
           },
         }),
+        { appManifest: createAppManifest('vault-app') },
       ),
     ).toThrow('does not define credentialsRef');
   });
@@ -81,6 +85,7 @@ describe('minikube secret-store generation', () => {
           },
         },
       }),
+      { appManifest: createAppManifest('vault-app') },
     );
 
     const serialized = JSON.stringify(result.files);
@@ -101,3 +106,34 @@ describe('minikube secret-store generation', () => {
     ).toThrow('Unsupported secret-store provider for minikube adapter');
   });
 });
+
+function createAppManifest(
+  slug: string,
+): Pick<AppManifest, 'metadata' | 'navigator' | 'screens' | 'settings'> {
+  return {
+    metadata: {
+      name: slug,
+      slug,
+      version: '1.0.0',
+      themeId: 'default',
+    },
+    navigator: {
+      type: 'stack',
+      routes: [],
+    },
+    screens: {},
+    settings: {
+      localization: {
+        defaultLocale: 'en',
+        locales: ['en'],
+      },
+      authFlow: {
+        signInRoute: '/sign-in',
+        signUpRoute: '/sign-up',
+        signOutRoute: '/sign-out',
+        unauthorizedRoute: '/sign-in',
+        postSignInRoute: '/',
+      },
+    },
+  };
+}