@ankhorage/infra 0.4.2 → 1.0.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @ankhorage/infra
 
+## 1.0.1
+
+### Patch Changes
+
+- efa43ed: Write generated Supabase browser env values into the app `.env.local` during Minikube Infra
+  Up so local Expo auth clients receive the gateway URL and anon key.
+
+## 1.0.0
+
+### Major Changes
+
+- 04b6470: Rebuild generated Minikube infrastructure around one app-owned Minikube profile per app slug.
+
+  Generated local infra now uses namespace `app` for the app runtime and namespace `supabase` for Kubernetes-owned Supabase workloads. Host-owned Supabase Compose startup, `supabase-local-env.sh`, shared `minikube` profile fallbacks, and `supabase migration up --local` runtime ownership have been removed. Generated lifecycle scripts now use slug-scoped `up`, `down`, `reset`, `destroy`, `status`, and managed port-forward flows.
+
 ## 0.4.2
 
 ### Patch Changes

package/README.md

@@ -3,7 +3,7 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v0.4.1](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v1.0.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 

package/dist/adapters/minikube/auth/supabase/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAOhE,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CA6E3B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAOhE,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CAiE3B"}

package/dist/adapters/minikube/auth/supabase/index.js

@@ -27,10 +27,6 @@ export function generateSupabaseAuthArtifacts(args) {
                     profileModel,
                 }),
             },
-            {
-                path: `${root}/supabase-auth.secret.yaml`,
-                content: getSupabaseSecret(namespace),
-            },
             {
                 path: `${root}/app-runtime-auth.env.configmap.yaml`,
                 content: getRuntimeAuthEnvConfigMap({
@@ -57,18 +53,10 @@ export function generateSupabaseAuthArtifacts(args) {
         ],
         resources: [
             `${resourceRoot}/supabase-auth.configmap.yaml`,
-            `${resourceRoot}/supabase-auth.secret.yaml`,
             `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,
         ],
-        envEntries: [
-            'SUPABASE_SECRET_SYNC_ENABLED=true',
-            'SUPABASE_URL=',
-            'SUPABASE_ANON_KEY=',
-            'SUPABASE_SERVICE_ROLE_KEY=',
-            'SUPABASE_JWT_SECRET=',
-            'EXPO_PUBLIC_SUPABASE_URL=',
-            'EXPO_PUBLIC_SUPABASE_ANON_KEY=',
-        ],
+        providerLifecycle: [],
+        envEntries: ['EXPO_PUBLIC_SUPABASE_URL=', 'EXPO_PUBLIC_SUPABASE_ANON_KEY='],
         warnings,
     };
 }
@@ -95,22 +83,6 @@ data:
   AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
 `;
 }
-function getSupabaseSecret(namespace) {
-    return `apiVersion: v1
-kind: Secret
-metadata:
-  name: supabase-auth-secrets
-  namespace: ${namespace}
-type: Opaque
-stringData:
-  SUPABASE_URL: ""
-  SUPABASE_ANON_KEY: ""
-  SUPABASE_SERVICE_ROLE_KEY: ""
-  SUPABASE_JWT_SECRET: ""
-  EXPO_PUBLIC_SUPABASE_URL: ""
-  EXPO_PUBLIC_SUPABASE_ANON_KEY: ""
-`;
-}
 function getRuntimeAuthEnvConfigMap(args) {
     const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
     return `apiVersion: v1
@@ -161,7 +133,7 @@ This file documents the runtime conventions generated by the minikube Supabase a
 ## Generated Kubernetes Objects
 
 - \`ConfigMap/supabase-auth-config\`: high-level auth metadata.
-- \`Secret/supabase-auth-secrets\`: Supabase keys and public runtime keys.
+- \`Secret/supabase-public-runtime\`: browser-safe Supabase URL and anon key material, generated by \`scripts/up.sh\` after local Supabase secrets exist.
 - \`ConfigMap/app-runtime-auth-env\`: auth runtime feature flags and authz metadata.
 
 ## App Runtime Convention
@@ -169,7 +141,12 @@ This file documents the runtime conventions generated by the minikube Supabase a
 Your app runtime deployment should import both:
 
 - \`app-runtime-auth-env\` (configMap)
-- \`supabase-auth-secrets\` (secret)
+- \`supabase-public-runtime\` (secret)
+
+For local Expo/Metro development, \`scripts/up.sh\` also writes the same browser-safe
+\`EXPO_PUBLIC_SUPABASE_URL\` and \`EXPO_PUBLIC_SUPABASE_ANON_KEY\` values to
+\`\${APP_SOURCE_DIR}/.env.local\`, preserving unrelated entries. Restart Expo after
+Infra Up so those public values are embedded into the client bundle.
 
 Example deployment fragment:
 
@@ -178,7 +155,7 @@ envFrom:
   - configMapRef:
       name: app-runtime-auth-env
   - secretRef:
-      name: supabase-auth-secrets
+      name: supabase-public-runtime
 \`\`\`
 
 The generated base deployment at \`k8s/app/deployment.yaml\` already includes this wiring
@@ -200,18 +177,16 @@ with \`optional: true\` for auth sources.
 - \`AUTH_PROFILE_PRIMARY_KEY\`
 - \`AUTH_PROFILE_CREATE_STRATEGY\`
 - \`AUTH_PROFILE_UPDATE_STRATEGY\`
-- \`SUPABASE_SECRET_SYNC_ENABLED\`
 - \`SUPABASE_URL\`
 - \`SUPABASE_ANON_KEY\`
-- \`SUPABASE_SERVICE_ROLE_KEY\`
-- \`SUPABASE_JWT_SECRET\`
 - \`EXPO_PUBLIC_SUPABASE_URL\`
 - \`EXPO_PUBLIC_SUPABASE_ANON_KEY\`
 ${profileSection}
-## Secret Sync
+## Runtime Secrets
 
-When \`SUPABASE_SECRET_SYNC_ENABLED=true\`, \`scripts/up.sh\` will create/update
-\`Secret/supabase-auth-secrets\` from the loaded environment values.
+When Supabase is enabled, \`scripts/up.sh\` creates/updates \`Secret/supabase-public-runtime\`
+with browser-safe values for the app namespace and mirrors the Expo public values into the
+app \`.env.local\`. Privileged Supabase runtime secrets remain in the \`supabase\` namespace.
 `;
 }
 const DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];

package/dist/adapters/minikube/auth/supabase/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gCAAgC,EAEhC,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AAEnB,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAErC,MAAM,IAAI,GAAG,kCAAkC,CAAC;IAChD,MAAM,YAAY,GAAG,eAAe,CAAC;IACrC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,MAAM,aAAa,GAAG,mCAAmC,CAAC;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,QAAQ,CAAC;IACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,MAAM,CAAC;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,eAAe,KAAK,iFAAiF,CACtG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,oBAAoB,CAAC;oBAC5B,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,4BAA4B;gBACzC,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC;aACtC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sCAAsC;gBACnD,OAAO,EAAE,0BAA0B,CAAC;oBAClC,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD,GAAG,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,GAAG,aAAa,oBAAoB;wBAC1C,OAAO,EAAE,gCAAgC,CAAC,YAAY,CAAC;qBACxD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,IAAI,EAAE,GAAG,QAAQ,6BAA6B;gBAC9C,OAAO,EAAE,6BAA6B,CAAC,YAAY,CAAC;aACrD;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,4BAA4B;YAC3C,GAAG,YAAY,sCAAsC;SACtD;QACD,UAAU,EAAE;YACV,mCAAmC;YACnC,eAAe;YACf,oBAAoB;YACpB,4BAA4B;YAC5B,sBAAsB;YACtB,2BAA2B;YAC3B,gCAAgC;SACjC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAO7B;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;iBAGP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;CAC7D,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO;;;;eAIM,SAAS;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAAC,IAOnC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;;iBAIP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;;;CAG7D,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,YAAkC;IACvE,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO;QACzC,CAAC,CAAC;;;;WAIK,YAAY,CAAC,KAAK,2BAA2B,YAAY,CAAC,KAAK;;;;;;;;;CASzE;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqDP,cAAc;;;;;CAKf,CAAC;AACF,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9C,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC9D,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAS5C,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAClC,2BAA2B,CAC5B,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IACnF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;QACvE,OAAO;QACP,WAAW;QACX,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,YAAY;QACZ,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAqC,EACrC,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\nimport {\n  getSupabaseProfileReconciliation,\n  type ResolvedProfileModel,\n  resolveSupabaseProfileModel,\n} from './profile';\n\nexport function generateSupabaseAuthArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n\n  const root = 'infra/minikube/k8s/auth/supabase';\n  const resourceRoot = 'auth/supabase';\n  const docsRoot = 'infra/minikube/auth';\n  const generatedRoot = 'infra/minikube/supabase/generated';\n  const scope = manifest.auth?.scope ?? 'global';\n  const authzEngine = manifest.auth?.authorization?.engine ?? 'native';\n  const authzKind = manifest.auth?.authorization?.kind ?? 'RBAC';\n  const authFieldModel = resolveAuthFieldModel(manifest);\n  const profileModel = resolveSupabaseProfileModel(manifest);\n\n  const warnings: string[] = [];\n  if (scope !== 'global') {\n    warnings.push(\n      `Auth scope \"${scope}\" is not fully modeled yet for Supabase. Baseline resources assume global auth.`,\n    );\n  }\n\n  return {\n    files: [\n      {\n        path: `${root}/supabase-auth.configmap.yaml`,\n        content: getSupabaseConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      {\n        path: `${root}/supabase-auth.secret.yaml`,\n        content: getSupabaseSecret(namespace),\n      },\n      {\n        path: `${root}/app-runtime-auth.env.configmap.yaml`,\n        content: getRuntimeAuthEnvConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      ...(profileModel.enabled\n        ? [\n            {\n              path: `${generatedRoot}/auth_profiles.sql`,\n              content: getSupabaseProfileReconciliation(profileModel),\n            },\n          ]\n        : []),\n      {\n        path: `${docsRoot}/supabase-runtime-wiring.md`,\n        content: getSupabaseRuntimeWiringGuide(profileModel),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/supabase-auth.configmap.yaml`,\n      `${resourceRoot}/supabase-auth.secret.yaml`,\n      `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,\n    ],\n    envEntries: [\n      'SUPABASE_SECRET_SYNC_ENABLED=true',\n      'SUPABASE_URL=',\n      'SUPABASE_ANON_KEY=',\n      'SUPABASE_SERVICE_ROLE_KEY=',\n      'SUPABASE_JWT_SECRET=',\n      'EXPO_PUBLIC_SUPABASE_URL=',\n      'EXPO_PUBLIC_SUPABASE_ANON_KEY=',\n    ],\n    warnings,\n  };\n}\n\nfunction getSupabaseConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-auth-config\n  namespace: ${namespace}\ndata:\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n`;\n}\n\nfunction getSupabaseSecret(namespace: string) {\n  return `apiVersion: v1\nkind: Secret\nmetadata:\n  name: supabase-auth-secrets\n  namespace: ${namespace}\ntype: Opaque\nstringData:\n  SUPABASE_URL: \"\"\n  SUPABASE_ANON_KEY: \"\"\n  SUPABASE_SERVICE_ROLE_KEY: \"\"\n  SUPABASE_JWT_SECRET: \"\"\n  EXPO_PUBLIC_SUPABASE_URL: \"\"\n  EXPO_PUBLIC_SUPABASE_ANON_KEY: \"\"\n`;\n}\n\nfunction getRuntimeAuthEnvConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-runtime-auth-env\n  namespace: ${namespace}\ndata:\n  AUTH_REQUIRED: \"true\"\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n  AUTH_TOKEN_HEADER: \"Authorization\"\n  AUTH_TOKEN_PREFIX: \"Bearer\"\n`;\n}\n\nfunction getSupabaseRuntimeWiringGuide(profileModel: ResolvedProfileModel) {\n  const profileSection = profileModel.enabled\n    ? `\n## App Profile Table\n\nIdentity remains provider-owned in \\`auth.users\\`. App-facing profile data is generated in\n\\`public.${profileModel.table}\\` and linked through \\`${profileModel.table}.id -> auth.users.id\\`.\n\nThe generated profile reconciliation:\n\n- creates the profile table\n- enables row-level security\n- allows signed-in users to read and update their own profile row\n- drops stale Ankhorage-managed profile columns that are no longer configured\n- creates a trigger for new auth users when \\`AUTH_PROFILE_CREATE_STRATEGY=trigger\\`\n`\n    : '';\n\n  return `# Supabase Runtime Wiring\n\nThis file documents the runtime conventions generated by the minikube Supabase adapter.\n\n## Generated Kubernetes Objects\n\n- \\`ConfigMap/supabase-auth-config\\`: high-level auth metadata.\n- \\`Secret/supabase-auth-secrets\\`: Supabase keys and public runtime keys.\n- \\`ConfigMap/app-runtime-auth-env\\`: auth runtime feature flags and authz metadata.\n\n## App Runtime Convention\n\nYour app runtime deployment should import both:\n\n- \\`app-runtime-auth-env\\` (configMap)\n- \\`supabase-auth-secrets\\` (secret)\n\nExample deployment fragment:\n\n\\`\\`\\`yaml\nenvFrom:\n  - configMapRef:\n      name: app-runtime-auth-env\n  - secretRef:\n      name: supabase-auth-secrets\n\\`\\`\\`\n\nThe generated base deployment at \\`k8s/app/deployment.yaml\\` already includes this wiring\nwith \\`optional: true\\` for auth sources.\n\n## Expected Environment Variables\n\n- \\`AUTH_REQUIRED\\`\n- \\`AUTH_PROVIDER\\`\n- \\`AUTH_SCOPE\\`\n- \\`AUTHZ_ENGINE\\`\n- \\`AUTHZ_KIND\\`\n- \\`AUTH_SIGN_IN_IDENTIFIERS\\`\n- \\`AUTH_SIGN_UP_REQUIRED_FIELDS\\`\n- \\`AUTH_SIGN_UP_OPTIONAL_FIELDS\\`\n- \\`AUTH_SIGN_UP_POLICY\\`\n- \\`AUTH_PROFILE_FIELDS\\`\n- \\`AUTH_PROFILE_TABLE\\`\n- \\`AUTH_PROFILE_PRIMARY_KEY\\`\n- \\`AUTH_PROFILE_CREATE_STRATEGY\\`\n- \\`AUTH_PROFILE_UPDATE_STRATEGY\\`\n- \\`SUPABASE_SECRET_SYNC_ENABLED\\`\n- \\`SUPABASE_URL\\`\n- \\`SUPABASE_ANON_KEY\\`\n- \\`SUPABASE_SERVICE_ROLE_KEY\\`\n- \\`SUPABASE_JWT_SECRET\\`\n- \\`EXPO_PUBLIC_SUPABASE_URL\\`\n- \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\`\n${profileSection}\n## Secret Sync\n\nWhen \\`SUPABASE_SECRET_SYNC_ENABLED=true\\`, \\`scripts/up.sh\\` will create/update\n\\`Secret/supabase-auth-secrets\\` from the loaded environment values.\n`;\n}\n\nconst DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];\nconst DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];\nconst DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];\nconst DEFAULT_SIGN_UP_POLICY = 'autoSignIn';\ninterface ResolvedAuthFieldModel {\n  signInIdentifiersCsv: string;\n  signUpRequiredFieldsCsv: string;\n  signUpOptionalFieldsCsv: string;\n  signUpPolicy: string;\n  profileFieldsCsv: string;\n}\n\nfunction resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {\n  const signInIdentifiers = normalizeFieldList(\n    manifest.auth?.signIn?.identifiers,\n    DEFAULT_SIGN_IN_IDENTIFIERS,\n  );\n  const signUpRequiredFields = normalizeFieldList(\n    manifest.auth?.signUp?.requiredFields,\n    DEFAULT_SIGN_UP_REQUIRED_FIELDS,\n  );\n  const signUpOptionalFields = normalizeFieldList(\n    manifest.auth?.signUp?.optionalFields,\n    DEFAULT_SIGN_UP_OPTIONAL_FIELDS,\n  ).filter((field) => !signUpRequiredFields.includes(field));\n  const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;\n  const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, [\n    'email',\n    'firstName',\n    'lastName',\n  ]);\n\n  return {\n    signInIdentifiersCsv: signInIdentifiers.join(','),\n    signUpRequiredFieldsCsv: signUpRequiredFields.join(','),\n    signUpOptionalFieldsCsv: signUpOptionalFields.join(','),\n    signUpPolicy,\n    profileFieldsCsv: profileFields.join(','),\n  };\n}\n\nfunction normalizeFieldList(\n  values: readonly string[] | undefined,\n  fallback: readonly string[],\n): string[] {\n  const source = values ?? fallback;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized || next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  if (next.length > 0) {\n    return next;\n  }\n\n  return [...fallback];\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gCAAgC,EAEhC,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AAEnB,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAErC,MAAM,IAAI,GAAG,kCAAkC,CAAC;IAChD,MAAM,YAAY,GAAG,eAAe,CAAC;IACrC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,MAAM,aAAa,GAAG,mCAAmC,CAAC;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,QAAQ,CAAC;IACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,MAAM,CAAC;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,eAAe,KAAK,iFAAiF,CACtG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,oBAAoB,CAAC;oBAC5B,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sCAAsC;gBACnD,OAAO,EAAE,0BAA0B,CAAC;oBAClC,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD,GAAG,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,GAAG,aAAa,oBAAoB;wBAC1C,OAAO,EAAE,gCAAgC,CAAC,YAAY,CAAC;qBACxD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,IAAI,EAAE,GAAG,QAAQ,6BAA6B;gBAC9C,OAAO,EAAE,6BAA6B,CAAC,YAAY,CAAC;aACrD;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,sCAAsC;SACtD;QACD,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,CAAC,2BAA2B,EAAE,gCAAgC,CAAC;QAC3E,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAO7B;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;iBAGP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;CAC7D,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAAC,IAOnC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;;iBAIP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;;;CAG7D,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,YAAkC;IACvE,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO;QACzC,CAAC,CAAC;;;;WAIK,YAAY,CAAC,KAAK,2BAA2B,YAAY,CAAC,KAAK;;;;;;;;;CASzE;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuDP,cAAc;;;;;;CAMf,CAAC;AACF,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9C,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC9D,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAS5C,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAClC,2BAA2B,CAC5B,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IACnF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;QACvE,OAAO;QACP,WAAW;QACX,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,YAAY;QACZ,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAqC,EACrC,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\nimport {\n  getSupabaseProfileReconciliation,\n  type ResolvedProfileModel,\n  resolveSupabaseProfileModel,\n} from './profile';\n\nexport function generateSupabaseAuthArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n\n  const root = 'infra/minikube/k8s/auth/supabase';\n  const resourceRoot = 'auth/supabase';\n  const docsRoot = 'infra/minikube/auth';\n  const generatedRoot = 'infra/minikube/supabase/generated';\n  const scope = manifest.auth?.scope ?? 'global';\n  const authzEngine = manifest.auth?.authorization?.engine ?? 'native';\n  const authzKind = manifest.auth?.authorization?.kind ?? 'RBAC';\n  const authFieldModel = resolveAuthFieldModel(manifest);\n  const profileModel = resolveSupabaseProfileModel(manifest);\n\n  const warnings: string[] = [];\n  if (scope !== 'global') {\n    warnings.push(\n      `Auth scope \"${scope}\" is not fully modeled yet for Supabase. Baseline resources assume global auth.`,\n    );\n  }\n\n  return {\n    files: [\n      {\n        path: `${root}/supabase-auth.configmap.yaml`,\n        content: getSupabaseConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      {\n        path: `${root}/app-runtime-auth.env.configmap.yaml`,\n        content: getRuntimeAuthEnvConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      ...(profileModel.enabled\n        ? [\n            {\n              path: `${generatedRoot}/auth_profiles.sql`,\n              content: getSupabaseProfileReconciliation(profileModel),\n            },\n          ]\n        : []),\n      {\n        path: `${docsRoot}/supabase-runtime-wiring.md`,\n        content: getSupabaseRuntimeWiringGuide(profileModel),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/supabase-auth.configmap.yaml`,\n      `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,\n    ],\n    providerLifecycle: [],\n    envEntries: ['EXPO_PUBLIC_SUPABASE_URL=', 'EXPO_PUBLIC_SUPABASE_ANON_KEY='],\n    warnings,\n  };\n}\n\nfunction getSupabaseConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-auth-config\n  namespace: ${namespace}\ndata:\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n`;\n}\n\nfunction getRuntimeAuthEnvConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-runtime-auth-env\n  namespace: ${namespace}\ndata:\n  AUTH_REQUIRED: \"true\"\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n  AUTH_TOKEN_HEADER: \"Authorization\"\n  AUTH_TOKEN_PREFIX: \"Bearer\"\n`;\n}\n\nfunction getSupabaseRuntimeWiringGuide(profileModel: ResolvedProfileModel) {\n  const profileSection = profileModel.enabled\n    ? `\n## App Profile Table\n\nIdentity remains provider-owned in \\`auth.users\\`. App-facing profile data is generated in\n\\`public.${profileModel.table}\\` and linked through \\`${profileModel.table}.id -> auth.users.id\\`.\n\nThe generated profile reconciliation:\n\n- creates the profile table\n- enables row-level security\n- allows signed-in users to read and update their own profile row\n- drops stale Ankhorage-managed profile columns that are no longer configured\n- creates a trigger for new auth users when \\`AUTH_PROFILE_CREATE_STRATEGY=trigger\\`\n`\n    : '';\n\n  return `# Supabase Runtime Wiring\n\nThis file documents the runtime conventions generated by the minikube Supabase adapter.\n\n## Generated Kubernetes Objects\n\n- \\`ConfigMap/supabase-auth-config\\`: high-level auth metadata.\n- \\`Secret/supabase-public-runtime\\`: browser-safe Supabase URL and anon key material, generated by \\`scripts/up.sh\\` after local Supabase secrets exist.\n- \\`ConfigMap/app-runtime-auth-env\\`: auth runtime feature flags and authz metadata.\n\n## App Runtime Convention\n\nYour app runtime deployment should import both:\n\n- \\`app-runtime-auth-env\\` (configMap)\n- \\`supabase-public-runtime\\` (secret)\n\nFor local Expo/Metro development, \\`scripts/up.sh\\` also writes the same browser-safe\n\\`EXPO_PUBLIC_SUPABASE_URL\\` and \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\` values to\n\\`\\${APP_SOURCE_DIR}/.env.local\\`, preserving unrelated entries. Restart Expo after\nInfra Up so those public values are embedded into the client bundle.\n\nExample deployment fragment:\n\n\\`\\`\\`yaml\nenvFrom:\n  - configMapRef:\n      name: app-runtime-auth-env\n  - secretRef:\n      name: supabase-public-runtime\n\\`\\`\\`\n\nThe generated base deployment at \\`k8s/app/deployment.yaml\\` already includes this wiring\nwith \\`optional: true\\` for auth sources.\n\n## Expected Environment Variables\n\n- \\`AUTH_REQUIRED\\`\n- \\`AUTH_PROVIDER\\`\n- \\`AUTH_SCOPE\\`\n- \\`AUTHZ_ENGINE\\`\n- \\`AUTHZ_KIND\\`\n- \\`AUTH_SIGN_IN_IDENTIFIERS\\`\n- \\`AUTH_SIGN_UP_REQUIRED_FIELDS\\`\n- \\`AUTH_SIGN_UP_OPTIONAL_FIELDS\\`\n- \\`AUTH_SIGN_UP_POLICY\\`\n- \\`AUTH_PROFILE_FIELDS\\`\n- \\`AUTH_PROFILE_TABLE\\`\n- \\`AUTH_PROFILE_PRIMARY_KEY\\`\n- \\`AUTH_PROFILE_CREATE_STRATEGY\\`\n- \\`AUTH_PROFILE_UPDATE_STRATEGY\\`\n- \\`SUPABASE_URL\\`\n- \\`SUPABASE_ANON_KEY\\`\n- \\`EXPO_PUBLIC_SUPABASE_URL\\`\n- \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\`\n${profileSection}\n## Runtime Secrets\n\nWhen Supabase is enabled, \\`scripts/up.sh\\` creates/updates \\`Secret/supabase-public-runtime\\`\nwith browser-safe values for the app namespace and mirrors the Expo public values into the\napp \\`.env.local\\`. Privileged Supabase runtime secrets remain in the \\`supabase\\` namespace.\n`;\n}\n\nconst DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];\nconst DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];\nconst DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];\nconst DEFAULT_SIGN_UP_POLICY = 'autoSignIn';\ninterface ResolvedAuthFieldModel {\n  signInIdentifiersCsv: string;\n  signUpRequiredFieldsCsv: string;\n  signUpOptionalFieldsCsv: string;\n  signUpPolicy: string;\n  profileFieldsCsv: string;\n}\n\nfunction resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {\n  const signInIdentifiers = normalizeFieldList(\n    manifest.auth?.signIn?.identifiers,\n    DEFAULT_SIGN_IN_IDENTIFIERS,\n  );\n  const signUpRequiredFields = normalizeFieldList(\n    manifest.auth?.signUp?.requiredFields,\n    DEFAULT_SIGN_UP_REQUIRED_FIELDS,\n  );\n  const signUpOptionalFields = normalizeFieldList(\n    manifest.auth?.signUp?.optionalFields,\n    DEFAULT_SIGN_UP_OPTIONAL_FIELDS,\n  ).filter((field) => !signUpRequiredFields.includes(field));\n  const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;\n  const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, [\n    'email',\n    'firstName',\n    'lastName',\n  ]);\n\n  return {\n    signInIdentifiersCsv: signInIdentifiers.join(','),\n    signUpRequiredFieldsCsv: signUpRequiredFields.join(','),\n    signUpOptionalFieldsCsv: signUpOptionalFields.join(','),\n    signUpPolicy,\n    profileFieldsCsv: profileFields.join(','),\n  };\n}\n\nfunction normalizeFieldList(\n  values: readonly string[] | undefined,\n  fallback: readonly string[],\n): string[] {\n  const source = values ?? fallback;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized || next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  if (next.length > 0) {\n    return next;\n  }\n\n  return [...fallback];\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}

package/dist/adapters/minikube/auth/supabase/profile.d.ts

@@ -1,5 +1,4 @@
 import type { InfraManifestInput } from '../../../../types';
-export declare const MANAGED_PROFILE_COLUMNS: readonly ["email", "display_name", "first_name", "last_name", "avatar_url", "username", "phone"];
 interface ProfileColumnSpec {
     readonly field: string;
     readonly column: string;

package/dist/adapters/minikube/auth/supabase/profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/profile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAU5D,eAAO,MAAM,uBAAuB,kGAQ1B,CAAC;AAEX,UAAU,iBAAiB;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,oBAAoB,CA2B9F;AAED,wBAAgB,gCAAgC,CAAC,YAAY,EAAE,oBAAoB,GAAG,MAAM,CAoT3F"}
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/profile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAoB5D,UAAU,iBAAiB;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,oBAAoB,CA2B9F;AAED,wBAAgB,gCAAgC,CAAC,YAAY,EAAE,oBAAoB,GAAG,MAAM,CAoT3F"}

package/dist/adapters/minikube/auth/supabase/profile.js

@@ -6,7 +6,7 @@ const DEFAULT_PROFILE_UPDATE_STRATEGY = 'api';
 const PROFILE_POLICY_VERSION = 1;
 const PROFILE_RECONCILER_VERSION = 1;
 const PROFILE_ARTIFACT_KEY = 'auth.profile';
-export const MANAGED_PROFILE_COLUMNS = [
+const MANAGED_PROFILE_COLUMNS = [
     'email',
     'display_name',
     'first_name',

package/dist/adapters/minikube/auth/supabase/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,2BAA2B,GAAG,YAAY,CAAC;AACjD,MAAM,+BAA+B,GAAG,SAAS,CAAC;AAClD,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAC9C,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAE5C,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,cAAc;IACd,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,UAAU;IACV,OAAO;CACC,CAAC;AAmBX,MAAM,UAAU,2BAA2B,CAAC,QAA4B;IACtE,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,IAAI,2BAA2B,CAAC;IACrF,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,IAAI,+BAA+B,CAAC;IACjG,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,IAAI,+BAA+B,CAAC;IACjG,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,0BAA0B,CAAC;YACzB,KAAK;YACL,UAAU;YACV,cAAc;YACd,cAAc;YACd,OAAO;SACR,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,cAAc;QACd,cAAc;QACd,OAAO;QACP,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,YAAkC;IACjF,MAAM,KAAK,GAAG,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,eAAe,CAAC,cAAc,YAAY,CAAC,KAAK,OAAO,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,eAAe,CAAC,wBAAwB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACvF,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO;SACtC,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CACT,sBAAsB,KAAK,6BAA6B,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,CAC9G;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,MAAM,CAC9D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAC3C;SACE,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,KAAK,0BAA0B,eAAe,CAAC,MAAM,CAAC,GAAG,CAC5F;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SACjF,GAAG,CAAC,eAAe,CAAC;SACpB,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAC/F,IAAI,CACL,CAAC;IACF,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO;SAC3C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAC5C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;IACJ,MAAM,cAAc,GAAG,CAAC,GAAG,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpF,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,MAAM,cAAc,GAClB,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,KAAK,oBAAoB;QAC9F,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GACd,YAAY,CAAC,cAAc,KAAK,SAAS;QACvC,CAAC,CAAC;oCAC4B,YAAY;;;;;;;uBAOzB,KAAK,KAAK,aAAa;YAClC,YAAY;;MAElB,cAAc;;;;;;oCAMgB,YAAY;oCACZ,YAAY;oCACZ,YAAY;;yBAEvB,WAAW;iBACnB,WAAW;;yCAEa,YAAY;CACpD;QACK,CAAC,CAAC;yBACiB,WAAW;iCACH,YAAY;CAC5C,CAAC;IAEA,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;4BAyBmB,oBAAoB;;;;;;sDAMM,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;6LACmG,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;oCAK7L,KAAK;;;;;;qBAMpB,KAAK;qBACL,KAAK;qBACL,KAAK;EACxB,YAAY;qBACO,KAAK;EACxB,yBAAyB;;;;;;;iCAOM,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;uCAM9B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;4CAM/B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;+BAMjD,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;yBAG1C,KAAK;uBACP,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,OAAO,CAAC;;;;;;;;;;iCAUnC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;uCAO9B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;yCAWlC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;4CAgBjC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;iCAM/C,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;uCAQ9B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;yBAelD,KAAK;uBACP,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,qBAAqB,CAAC;;;;;;;;;;;;4BAYtD,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;4BAYpC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;;4BAapC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;qBAW3C,KAAK;;6BAEG,KAAK;+BACH,KAAK;EAClC,cAAc;;wBAEQ,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC,cAAc,KAAK;gBAC9E,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC;cACrD,KAAK;;;;;wBAKK,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC,cAAc,KAAK;gBAC9E,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC;cACrD,KAAK;;;;;EAKjB,UAAU;;;;;;;;KAQP,oBAAoB;KACpB,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;KACpC,YAAY,CAAC,gBAAgB;;;;;;;;;;CAUjC,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAC/E,KAAK,aAAa;YAChB,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,0HAA0H;aAC7H,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,uFAAuF;aAC1F,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,qFAAqF;aACxF,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,uFAAuF;aAC1F,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,qCAAqC;aACnD,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAC/E;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED,SAAS,0BAA0B,CAAC,IAMnC;IACC,MAAM,KAAK,GAAG;QACZ,WAAW,EAAE,oBAAoB;QACjC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,aAAa,EAAE,sBAAsB;QACrC,iBAAiB,EAAE,0BAA0B;KAC9C,CAAC;IAEF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAyB;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,wBAAwB,yBAAyB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC/B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAkD,CAAC;QACxF,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAkD,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAqC;IAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,sBAAsB,CAAC;IAChD,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,gKAAgK,CACjK,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,8CAA8C,OAAO,sDAAsD,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import { createHash } from 'node:crypto';\n\nimport type { InfraManifestInput } from '../../../../types';\n\nconst DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];\nconst DEFAULT_PROFILE_PRIMARY_KEY = 'authUserId';\nconst DEFAULT_PROFILE_CREATE_STRATEGY = 'trigger';\nconst DEFAULT_PROFILE_UPDATE_STRATEGY = 'api';\nconst PROFILE_POLICY_VERSION = 1;\nconst PROFILE_RECONCILER_VERSION = 1;\nconst PROFILE_ARTIFACT_KEY = 'auth.profile';\n\nexport const MANAGED_PROFILE_COLUMNS = [\n  'email',\n  'display_name',\n  'first_name',\n  'last_name',\n  'avatar_url',\n  'username',\n  'phone',\n] as const;\n\ninterface ProfileColumnSpec {\n  readonly field: string;\n  readonly column: string;\n  readonly sqlType: string;\n  readonly fromNewUser: string;\n}\n\nexport interface ResolvedProfileModel {\n  readonly enabled: boolean;\n  readonly table: string;\n  readonly primaryKey: string;\n  readonly createStrategy: string;\n  readonly updateStrategy: string;\n  readonly columns: readonly ProfileColumnSpec[];\n  readonly desiredStateHash: string;\n}\n\nexport function resolveSupabaseProfileModel(manifest: InfraManifestInput): ResolvedProfileModel {\n  const table = normalizeIdentifier(manifest.auth?.profile?.table ?? '');\n  const fields = normalizeFieldList(manifest.auth?.profile?.fields);\n  const primaryKey = manifest.auth?.profile?.primaryKey ?? DEFAULT_PROFILE_PRIMARY_KEY;\n  const createStrategy = manifest.auth?.profile?.createStrategy ?? DEFAULT_PROFILE_CREATE_STRATEGY;\n  const updateStrategy = manifest.auth?.profile?.updateStrategy ?? DEFAULT_PROFILE_UPDATE_STRATEGY;\n  const columns = resolveProfileColumns(fields);\n\n  const hash = table\n    ? getProfileDesiredStateHash({\n        table,\n        primaryKey,\n        createStrategy,\n        updateStrategy,\n        columns,\n      })\n    : '';\n\n  return {\n    enabled: table.length > 0,\n    table,\n    primaryKey,\n    createStrategy,\n    updateStrategy,\n    columns,\n    desiredStateHash: hash,\n  };\n}\n\nexport function getSupabaseProfileReconciliation(profileModel: ResolvedProfileModel): string {\n  const table = quoteIdentifier(profileModel.table);\n  const functionName = quoteIdentifier(`handle_new_${profileModel.table}_user`);\n  const triggerName = quoteIdentifier(`on_auth_user_created_${profileModel.table}`);\n  const configuredColumns = new Set(profileModel.columns.map((column) => column.column));\n  const addColumnSql = profileModel.columns\n    .map(\n      (column) =>\n        `alter table public.${table} add column if not exists ${quoteIdentifier(column.column)} ${column.sqlType};`,\n    )\n    .join('\\n');\n  const dropStaleManagedColumnSql = MANAGED_PROFILE_COLUMNS.filter(\n    (column) => !configuredColumns.has(column),\n  )\n    .map(\n      (column) => `alter table public.${table} drop column if exists ${quoteIdentifier(column)};`,\n    )\n    .join('\\n');\n  const insertColumns = ['id', ...profileModel.columns.map((column) => column.column)]\n    .map(quoteIdentifier)\n    .join(', ');\n  const insertValues = ['new.id', ...profileModel.columns.map((column) => column.fromNewUser)].join(\n    ', ',\n  );\n  const updateAssignments = profileModel.columns\n    .filter((column) => column.field === 'email')\n    .map(\n      (column) => `${quoteIdentifier(column.column)} = excluded.${quoteIdentifier(column.column)}`,\n    );\n  const conflictUpdate = [...updateAssignments, 'updated_at = now()'].join(',\\n    ');\n  const updateGrantColumns = profileModel.columns.map((column) => quoteIdentifier(column.column));\n  const updateGrantSql =\n    updateGrantColumns.length > 0\n      ? `grant update (${updateGrantColumns.join(', ')}) on table public.${table} to authenticated;`\n      : '';\n  const triggerSql =\n    profileModel.createStrategy === 'trigger'\n      ? `\ncreate or replace function public.${functionName}()\nreturns trigger\nlanguage plpgsql\nsecurity definer\nset search_path = pg_catalog, pg_temp\nas $$\nbegin\n  insert into public.${table} (${insertColumns})\n  values (${insertValues})\n  on conflict (id) do update set\n    ${conflictUpdate};\n\n  return new;\nend;\n$$;\n\nrevoke execute on function public.${functionName}() from PUBLIC;\nrevoke execute on function public.${functionName}() from anon;\nrevoke execute on function public.${functionName}() from authenticated;\n\ndrop trigger if exists ${triggerName} on auth.users;\ncreate trigger ${triggerName}\n  after insert on auth.users\n  for each row execute function public.${functionName}();\n`\n      : `\ndrop trigger if exists ${triggerName} on auth.users;\ndrop function if exists public.${functionName}();\n`;\n\n  return `-- Generated by @ankhorage/infra from manifest.auth.profile.\n-- Desired-state reconciliation for local Supabase; not a migration-history entry.\n\nbegin;\n\ncreate schema if not exists ankhorage_internal;\n\ncreate table if not exists ankhorage_internal.generated_schema_state (\n  artifact_key text primary key,\n  table_name text,\n  content_hash text not null,\n  applied_at timestamptz not null\n);\n\nalter table ankhorage_internal.generated_schema_state\n  add column if not exists table_name text;\n\ndo $$\ndeclare\n  previous_table_name text;\n  has_previous_state boolean;\nbegin\n  select table_name, true\n    into previous_table_name, has_previous_state\n    from ankhorage_internal.generated_schema_state\n    where artifact_key = '${PROFILE_ARTIFACT_KEY}';\n\n  if has_previous_state and previous_table_name is null then\n    raise exception 'existing auth.profile generated state is missing table identity; reset local Supabase or add an explicit cleanup migration before applying generated profile reconciliation';\n  end if;\n\n  if has_previous_state and previous_table_name <> '${escapeSqlLiteral(profileModel.table)}' then\n    raise exception 'profile.table changed from % to %; reset local Supabase or add an explicit cleanup migration before applying generated profile reconciliation', previous_table_name, '${escapeSqlLiteral(profileModel.table)}';\n  end if;\nend;\n$$;\n\ncreate table if not exists public.${table} (\n  id uuid primary key references auth.users(id) on delete cascade,\n  created_at timestamptz not null default now(),\n  updated_at timestamptz not null default now()\n);\n\nalter table public.${table} add column if not exists id uuid;\nalter table public.${table} add column if not exists created_at timestamptz not null default now();\nalter table public.${table} add column if not exists updated_at timestamptz not null default now();\n${addColumnSql}\nalter table public.${table} drop column if exists role;\n${dropStaleManagedColumnSql}\n\ndo $$\nbegin\n  if exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and c.contype = 'p'\n      and c.conkey <> array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n  ) then\n    raise exception 'profile table public.${escapeSqlLiteral(profileModel.table)} has a primary key that is not exactly id';\n  end if;\n\n  if not exists (\n    select 1\n    from pg_constraint\n    where conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and contype = 'p'\n  ) then\n    alter table public.${table}\n      add constraint ${quoteIdentifier(`${profileModel.table}_pkey`)} primary key (id);\n  end if;\nend;\n$$;\n\ndo $$\nbegin\n  if exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and c.contype = 'f'\n      and c.confrelid = 'auth.users'::regclass\n      and c.conkey && array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n      and (\n        c.confdeltype <> 'c'\n        or c.conkey <> array[\n          (\n            select a.attnum\n            from pg_attribute a\n            where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n              and a.attname = 'id'\n              and not a.attisdropped\n          )\n        ]::smallint[]\n        or c.confkey <> array[\n          (\n            select a.attnum\n            from pg_attribute a\n            where a.attrelid = 'auth.users'::regclass\n              and a.attname = 'id'\n              and not a.attisdropped\n          )\n        ]::smallint[]\n      )\n  ) then\n    raise exception 'profile table public.${escapeSqlLiteral(profileModel.table)} has an auth.users foreign key that is not exactly id -> auth.users(id) on delete cascade';\n  end if;\n\n  if not exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and c.confrelid = 'auth.users'::regclass\n      and c.contype = 'f'\n      and c.confdeltype = 'c'\n      and c.conkey = array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n      and c.confkey = array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'auth.users'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n  ) then\n    alter table public.${table}\n      add constraint ${quoteIdentifier(`${profileModel.table}_id_auth_users_fkey`)}\n      foreign key (id) references auth.users(id) on delete cascade;\n  end if;\nend;\n$$;\n\ndo $$\nbegin\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'\n      and c.column_name = 'id'\n      and c.udt_name = 'uuid'\n      and c.is_nullable = 'NO'\n  ) then\n    raise exception 'profile id column must be uuid not null';\n  end if;\n\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'\n      and c.column_name = 'created_at'\n      and c.data_type = 'timestamp with time zone'\n      and c.is_nullable = 'NO'\n      and c.column_default = 'now()'\n  ) then\n    raise exception 'profile created_at column must be timestamptz not null default now()';\n  end if;\n\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'\n      and c.column_name = 'updated_at'\n      and c.data_type = 'timestamp with time zone'\n      and c.is_nullable = 'NO'\n      and c.column_default = 'now()'\n  ) then\n    raise exception 'profile updated_at column must be timestamptz not null default now()';\n  end if;\nend;\n$$;\n\nalter table public.${table} enable row level security;\n\nrevoke all on table public.${table} from anon, authenticated;\ngrant select on table public.${table} to authenticated;\n${updateGrantSql}\n\ndrop policy if exists ${quoteIdentifier(`${profileModel.table}_select_own`)} on public.${table};\ncreate policy ${quoteIdentifier(`${profileModel.table}_select_own`)}\n  on public.${table}\n  for select\n  to authenticated\n  using ((select auth.uid()) = id);\n\ndrop policy if exists ${quoteIdentifier(`${profileModel.table}_update_own`)} on public.${table};\ncreate policy ${quoteIdentifier(`${profileModel.table}_update_own`)}\n  on public.${table}\n  for update\n  to authenticated\n  using ((select auth.uid()) = id)\n  with check ((select auth.uid()) = id);\n${triggerSql}\ninsert into ankhorage_internal.generated_schema_state (\n  artifact_key,\n  table_name,\n  content_hash,\n  applied_at\n)\nvalues (\n  '${PROFILE_ARTIFACT_KEY}',\n  '${escapeSqlLiteral(profileModel.table)}',\n  '${profileModel.desiredStateHash}',\n  now()\n)\non conflict (artifact_key)\ndo update set\n  table_name = excluded.table_name,\n  content_hash = excluded.content_hash,\n  applied_at = excluded.applied_at;\n\ncommit;\n`;\n}\n\nfunction mapProfileFieldToColumn(field: string): ProfileColumnSpec | null {\n  switch (field) {\n    case 'email':\n      return { field, column: 'email', sqlType: 'text', fromNewUser: 'new.email' };\n    case 'displayName':\n      return {\n        field,\n        column: 'display_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'displayName', new.raw_user_meta_data->>'display_name', split_part(new.email, '@', 1))\",\n      };\n    case 'firstName':\n      return {\n        field,\n        column: 'first_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'firstName', new.raw_user_meta_data->>'first_name')\",\n      };\n    case 'lastName':\n      return {\n        field,\n        column: 'last_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'lastName', new.raw_user_meta_data->>'last_name')\",\n      };\n    case 'avatarUrl':\n      return {\n        field,\n        column: 'avatar_url',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'avatarUrl', new.raw_user_meta_data->>'avatar_url')\",\n      };\n    case 'username':\n      return {\n        field,\n        column: 'username',\n        sqlType: 'text',\n        fromNewUser: \"new.raw_user_meta_data->>'username'\",\n      };\n    case 'phone':\n      return { field, column: 'phone', sqlType: 'text', fromNewUser: 'new.phone' };\n    default:\n      return null;\n  }\n}\n\nfunction quoteIdentifier(value: string): string {\n  return `\"${value.replaceAll('\"', '\"\"')}\"`;\n}\n\nfunction getProfileDesiredStateHash(args: {\n  readonly table: string;\n  readonly primaryKey: string;\n  readonly createStrategy: string;\n  readonly updateStrategy: string;\n  readonly columns: readonly ProfileColumnSpec[];\n}): string {\n  const state = {\n    artifactKey: PROFILE_ARTIFACT_KEY,\n    table: args.table,\n    primaryKey: args.primaryKey,\n    createStrategy: args.createStrategy,\n    updateStrategy: args.updateStrategy,\n    managedColumns: args.columns.map((column) => ({\n      field: column.field,\n      column: column.column,\n      sqlType: column.sqlType,\n    })),\n    policyVersion: PROFILE_POLICY_VERSION,\n    reconcilerVersion: PROFILE_RECONCILER_VERSION,\n  };\n\n  return createHash('sha256').update(JSON.stringify(state)).digest('hex');\n}\n\nfunction resolveProfileColumns(fields: readonly string[]): ProfileColumnSpec[] {\n  const columns = new Map<string, ProfileColumnSpec>();\n\n  for (const field of fields) {\n    const column = mapProfileFieldToColumn(field);\n    if (!column) {\n      throw new Error(\n        `Unsupported Supabase profile field \"${field}\". Supported fields: ${getSupportedProfileFields().join(', ')}.`,\n      );\n    }\n\n    if (columns.has(column.column)) {\n      continue;\n    }\n    columns.set(column.column, column);\n  }\n\n  return [...columns.values()].sort(\n    (left, right) =>\n      MANAGED_PROFILE_COLUMNS.indexOf(left.column as (typeof MANAGED_PROFILE_COLUMNS)[number]) -\n      MANAGED_PROFILE_COLUMNS.indexOf(right.column as (typeof MANAGED_PROFILE_COLUMNS)[number]),\n  );\n}\n\nfunction normalizeFieldList(values: readonly string[] | undefined): string[] {\n  const source = values ?? DEFAULT_PROFILE_FIELDS;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized) {\n      throw new Error('Invalid Supabase profile field \"\". Profile fields must be non-empty.');\n    }\n\n    if (next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  return next;\n}\n\nfunction getSupportedProfileFields(): string[] {\n  return ['email', 'displayName', 'firstName', 'lastName', 'avatarUrl', 'username', 'phone'];\n}\n\nfunction normalizeIdentifier(value: string): string {\n  const trimmed = value.trim();\n  if (!trimmed) return '';\n\n  if (trimmed === 'users') {\n    throw new Error(\n      'Invalid Supabase profile table identifier \"users\". public.users is reserved for identity conflict detection; use a dedicated profile table such as \"profiles\".',\n    );\n  }\n\n  if (!/^[a-z_][a-z0-9_]*$/.test(trimmed)) {\n    throw new Error(\n      `Invalid Supabase profile table identifier \"${trimmed}\". Use snake_case letters, numbers, and underscores.`,\n    );\n  }\n\n  return trimmed;\n}\n\nfunction escapeSqlLiteral(value: string): string {\n  return value.replaceAll(\"'\", \"''\");\n}\n"]}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,2BAA2B,GAAG,YAAY,CAAC;AACjD,MAAM,+BAA+B,GAAG,SAAS,CAAC;AAClD,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAC9C,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAE5C,MAAM,uBAAuB,GAAG;IAC9B,OAAO;IACP,cAAc;IACd,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,UAAU;IACV,OAAO;CACC,CAAC;AAmBX,MAAM,UAAU,2BAA2B,CAAC,QAA4B;IACtE,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,IAAI,2BAA2B,CAAC;IACrF,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,IAAI,+BAA+B,CAAC;IACjG,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,IAAI,+BAA+B,CAAC;IACjG,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,0BAA0B,CAAC;YACzB,KAAK;YACL,UAAU;YACV,cAAc;YACd,cAAc;YACd,OAAO;SACR,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,cAAc;QACd,cAAc;QACd,OAAO;QACP,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,YAAkC;IACjF,MAAM,KAAK,GAAG,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,eAAe,CAAC,cAAc,YAAY,CAAC,KAAK,OAAO,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,eAAe,CAAC,wBAAwB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACvF,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO;SACtC,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CACT,sBAAsB,KAAK,6BAA6B,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,CAC9G;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,MAAM,CAC9D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAC3C;SACE,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,KAAK,0BAA0B,eAAe,CAAC,MAAM,CAAC,GAAG,CAC5F;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SACjF,GAAG,CAAC,eAAe,CAAC;SACpB,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAC/F,IAAI,CACL,CAAC;IACF,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO;SAC3C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAC5C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;IACJ,MAAM,cAAc,GAAG,CAAC,GAAG,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpF,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,MAAM,cAAc,GAClB,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,KAAK,oBAAoB;QAC9F,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GACd,YAAY,CAAC,cAAc,KAAK,SAAS;QACvC,CAAC,CAAC;oCAC4B,YAAY;;;;;;;uBAOzB,KAAK,KAAK,aAAa;YAClC,YAAY;;MAElB,cAAc;;;;;;oCAMgB,YAAY;oCACZ,YAAY;oCACZ,YAAY;;yBAEvB,WAAW;iBACnB,WAAW;;yCAEa,YAAY;CACpD;QACK,CAAC,CAAC;yBACiB,WAAW;iCACH,YAAY;CAC5C,CAAC;IAEA,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;4BAyBmB,oBAAoB;;;;;;sDAMM,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;6LACmG,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;oCAK7L,KAAK;;;;;;qBAMpB,KAAK;qBACL,KAAK;qBACL,KAAK;EACxB,YAAY;qBACO,KAAK;EACxB,yBAAyB;;;;;;;iCAOM,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;uCAM9B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;4CAM/B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;+BAMjD,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;yBAG1C,KAAK;uBACP,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,OAAO,CAAC;;;;;;;;;;iCAUnC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;uCAO9B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;yCAWlC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;4CAgBjC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;iCAM/C,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;uCAQ9B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;yBAelD,KAAK;uBACP,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,qBAAqB,CAAC;;;;;;;;;;;;4BAYtD,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;4BAYpC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;;4BAapC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;qBAW3C,KAAK;;6BAEG,KAAK;+BACH,KAAK;EAClC,cAAc;;wBAEQ,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC,cAAc,KAAK;gBAC9E,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC;cACrD,KAAK;;;;;wBAKK,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC,cAAc,KAAK;gBAC9E,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC;cACrD,KAAK;;;;;EAKjB,UAAU;;;;;;;;KAQP,oBAAoB;KACpB,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;KACpC,YAAY,CAAC,gBAAgB;;;;;;;;;;CAUjC,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAC/E,KAAK,aAAa;YAChB,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,0HAA0H;aAC7H,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,uFAAuF;aAC1F,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,qFAAqF;aACxF,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,uFAAuF;aAC1F,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,qCAAqC;aACnD,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAC/E;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED,SAAS,0BAA0B,CAAC,IAMnC;IACC,MAAM,KAAK,GAAG;QACZ,WAAW,EAAE,oBAAoB;QACjC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,aAAa,EAAE,sBAAsB;QACrC,iBAAiB,EAAE,0BAA0B;KAC9C,CAAC;IAEF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAyB;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,wBAAwB,yBAAyB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC/B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAkD,CAAC;QACxF,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAkD,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAqC;IAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,sBAAsB,CAAC;IAChD,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,gKAAgK,CACjK,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,8CAA8C,OAAO,sDAAsD,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import { createHash } from 'node:crypto';\n\nimport type { InfraManifestInput } from '../../../../types';\n\nconst DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];\nconst DEFAULT_PROFILE_PRIMARY_KEY = 'authUserId';\nconst DEFAULT_PROFILE_CREATE_STRATEGY = 'trigger';\nconst DEFAULT_PROFILE_UPDATE_STRATEGY = 'api';\nconst PROFILE_POLICY_VERSION = 1;\nconst PROFILE_RECONCILER_VERSION = 1;\nconst PROFILE_ARTIFACT_KEY = 'auth.profile';\n\nconst MANAGED_PROFILE_COLUMNS = [\n  'email',\n  'display_name',\n  'first_name',\n  'last_name',\n  'avatar_url',\n  'username',\n  'phone',\n] as const;\n\ninterface ProfileColumnSpec {\n  readonly field: string;\n  readonly column: string;\n  readonly sqlType: string;\n  readonly fromNewUser: string;\n}\n\nexport interface ResolvedProfileModel {\n  readonly enabled: boolean;\n  readonly table: string;\n  readonly primaryKey: string;\n  readonly createStrategy: string;\n  readonly updateStrategy: string;\n  readonly columns: readonly ProfileColumnSpec[];\n  readonly desiredStateHash: string;\n}\n\nexport function resolveSupabaseProfileModel(manifest: InfraManifestInput): ResolvedProfileModel {\n  const table = normalizeIdentifier(manifest.auth?.profile?.table ?? '');\n  const fields = normalizeFieldList(manifest.auth?.profile?.fields);\n  const primaryKey = manifest.auth?.profile?.primaryKey ?? DEFAULT_PROFILE_PRIMARY_KEY;\n  const createStrategy = manifest.auth?.profile?.createStrategy ?? DEFAULT_PROFILE_CREATE_STRATEGY;\n  const updateStrategy = manifest.auth?.profile?.updateStrategy ?? DEFAULT_PROFILE_UPDATE_STRATEGY;\n  const columns = resolveProfileColumns(fields);\n\n  const hash = table\n    ? getProfileDesiredStateHash({\n        table,\n        primaryKey,\n        createStrategy,\n        updateStrategy,\n        columns,\n      })\n    : '';\n\n  return {\n    enabled: table.length > 0,\n    table,\n    primaryKey,\n    createStrategy,\n    updateStrategy,\n    columns,\n    desiredStateHash: hash,\n  };\n}\n\nexport function getSupabaseProfileReconciliation(profileModel: ResolvedProfileModel): string {\n  const table = quoteIdentifier(profileModel.table);\n  const functionName = quoteIdentifier(`handle_new_${profileModel.table}_user`);\n  const triggerName = quoteIdentifier(`on_auth_user_created_${profileModel.table}`);\n  const configuredColumns = new Set(profileModel.columns.map((column) => column.column));\n  const addColumnSql = profileModel.columns\n    .map(\n      (column) =>\n        `alter table public.${table} add column if not exists ${quoteIdentifier(column.column)} ${column.sqlType};`,\n    )\n    .join('\\n');\n  const dropStaleManagedColumnSql = MANAGED_PROFILE_COLUMNS.filter(\n    (column) => !configuredColumns.has(column),\n  )\n    .map(\n      (column) => `alter table public.${table} drop column if exists ${quoteIdentifier(column)};`,\n    )\n    .join('\\n');\n  const insertColumns = ['id', ...profileModel.columns.map((column) => column.column)]\n    .map(quoteIdentifier)\n    .join(', ');\n  const insertValues = ['new.id', ...profileModel.columns.map((column) => column.fromNewUser)].join(\n    ', ',\n  );\n  const updateAssignments = profileModel.columns\n    .filter((column) => column.field === 'email')\n    .map(\n      (column) => `${quoteIdentifier(column.column)} = excluded.${quoteIdentifier(column.column)}`,\n    );\n  const conflictUpdate = [...updateAssignments, 'updated_at = now()'].join(',\\n    ');\n  const updateGrantColumns = profileModel.columns.map((column) => quoteIdentifier(column.column));\n  const updateGrantSql =\n    updateGrantColumns.length > 0\n      ? `grant update (${updateGrantColumns.join(', ')}) on table public.${table} to authenticated;`\n      : '';\n  const triggerSql =\n    profileModel.createStrategy === 'trigger'\n      ? `\ncreate or replace function public.${functionName}()\nreturns trigger\nlanguage plpgsql\nsecurity definer\nset search_path = pg_catalog, pg_temp\nas $$\nbegin\n  insert into public.${table} (${insertColumns})\n  values (${insertValues})\n  on conflict (id) do update set\n    ${conflictUpdate};\n\n  return new;\nend;\n$$;\n\nrevoke execute on function public.${functionName}() from PUBLIC;\nrevoke execute on function public.${functionName}() from anon;\nrevoke execute on function public.${functionName}() from authenticated;\n\ndrop trigger if exists ${triggerName} on auth.users;\ncreate trigger ${triggerName}\n  after insert on auth.users\n  for each row execute function public.${functionName}();\n`\n      : `\ndrop trigger if exists ${triggerName} on auth.users;\ndrop function if exists public.${functionName}();\n`;\n\n  return `-- Generated by @ankhorage/infra from manifest.auth.profile.\n-- Desired-state reconciliation for local Supabase; not a migration-history entry.\n\nbegin;\n\ncreate schema if not exists ankhorage_internal;\n\ncreate table if not exists ankhorage_internal.generated_schema_state (\n  artifact_key text primary key,\n  table_name text,\n  content_hash text not null,\n  applied_at timestamptz not null\n);\n\nalter table ankhorage_internal.generated_schema_state\n  add column if not exists table_name text;\n\ndo $$\ndeclare\n  previous_table_name text;\n  has_previous_state boolean;\nbegin\n  select table_name, true\n    into previous_table_name, has_previous_state\n    from ankhorage_internal.generated_schema_state\n    where artifact_key = '${PROFILE_ARTIFACT_KEY}';\n\n  if has_previous_state and previous_table_name is null then\n    raise exception 'existing auth.profile generated state is missing table identity; reset local Supabase or add an explicit cleanup migration before applying generated profile reconciliation';\n  end if;\n\n  if has_previous_state and previous_table_name <> '${escapeSqlLiteral(profileModel.table)}' then\n    raise exception 'profile.table changed from % to %; reset local Supabase or add an explicit cleanup migration before applying generated profile reconciliation', previous_table_name, '${escapeSqlLiteral(profileModel.table)}';\n  end if;\nend;\n$$;\n\ncreate table if not exists public.${table} (\n  id uuid primary key references auth.users(id) on delete cascade,\n  created_at timestamptz not null default now(),\n  updated_at timestamptz not null default now()\n);\n\nalter table public.${table} add column if not exists id uuid;\nalter table public.${table} add column if not exists created_at timestamptz not null default now();\nalter table public.${table} add column if not exists updated_at timestamptz not null default now();\n${addColumnSql}\nalter table public.${table} drop column if exists role;\n${dropStaleManagedColumnSql}\n\ndo $$\nbegin\n  if exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and c.contype = 'p'\n      and c.conkey <> array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n  ) then\n    raise exception 'profile table public.${escapeSqlLiteral(profileModel.table)} has a primary key that is not exactly id';\n  end if;\n\n  if not exists (\n    select 1\n    from pg_constraint\n    where conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and contype = 'p'\n  ) then\n    alter table public.${table}\n      add constraint ${quoteIdentifier(`${profileModel.table}_pkey`)} primary key (id);\n  end if;\nend;\n$$;\n\ndo $$\nbegin\n  if exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and c.contype = 'f'\n      and c.confrelid = 'auth.users'::regclass\n      and c.conkey && array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n      and (\n        c.confdeltype <> 'c'\n        or c.conkey <> array[\n          (\n            select a.attnum\n            from pg_attribute a\n            where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n              and a.attname = 'id'\n              and not a.attisdropped\n          )\n        ]::smallint[]\n        or c.confkey <> array[\n          (\n            select a.attnum\n            from pg_attribute a\n            where a.attrelid = 'auth.users'::regclass\n              and a.attname = 'id'\n              and not a.attisdropped\n          )\n        ]::smallint[]\n      )\n  ) then\n    raise exception 'profile table public.${escapeSqlLiteral(profileModel.table)} has an auth.users foreign key that is not exactly id -> auth.users(id) on delete cascade';\n  end if;\n\n  if not exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and c.confrelid = 'auth.users'::regclass\n      and c.contype = 'f'\n      and c.confdeltype = 'c'\n      and c.conkey = array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n      and c.confkey = array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'auth.users'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n  ) then\n    alter table public.${table}\n      add constraint ${quoteIdentifier(`${profileModel.table}_id_auth_users_fkey`)}\n      foreign key (id) references auth.users(id) on delete cascade;\n  end if;\nend;\n$$;\n\ndo $$\nbegin\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'\n      and c.column_name = 'id'\n      and c.udt_name = 'uuid'\n      and c.is_nullable = 'NO'\n  ) then\n    raise exception 'profile id column must be uuid not null';\n  end if;\n\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'\n      and c.column_name = 'created_at'\n      and c.data_type = 'timestamp with time zone'\n      and c.is_nullable = 'NO'\n      and c.column_default = 'now()'\n  ) then\n    raise exception 'profile created_at column must be timestamptz not null default now()';\n  end if;\n\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'\n      and c.column_name = 'updated_at'\n      and c.data_type = 'timestamp with time zone'\n      and c.is_nullable = 'NO'\n      and c.column_default = 'now()'\n  ) then\n    raise exception 'profile updated_at column must be timestamptz not null default now()';\n  end if;\nend;\n$$;\n\nalter table public.${table} enable row level security;\n\nrevoke all on table public.${table} from anon, authenticated;\ngrant select on table public.${table} to authenticated;\n${updateGrantSql}\n\ndrop policy if exists ${quoteIdentifier(`${profileModel.table}_select_own`)} on public.${table};\ncreate policy ${quoteIdentifier(`${profileModel.table}_select_own`)}\n  on public.${table}\n  for select\n  to authenticated\n  using ((select auth.uid()) = id);\n\ndrop policy if exists ${quoteIdentifier(`${profileModel.table}_update_own`)} on public.${table};\ncreate policy ${quoteIdentifier(`${profileModel.table}_update_own`)}\n  on public.${table}\n  for update\n  to authenticated\n  using ((select auth.uid()) = id)\n  with check ((select auth.uid()) = id);\n${triggerSql}\ninsert into ankhorage_internal.generated_schema_state (\n  artifact_key,\n  table_name,\n  content_hash,\n  applied_at\n)\nvalues (\n  '${PROFILE_ARTIFACT_KEY}',\n  '${escapeSqlLiteral(profileModel.table)}',\n  '${profileModel.desiredStateHash}',\n  now()\n)\non conflict (artifact_key)\ndo update set\n  table_name = excluded.table_name,\n  content_hash = excluded.content_hash,\n  applied_at = excluded.applied_at;\n\ncommit;\n`;\n}\n\nfunction mapProfileFieldToColumn(field: string): ProfileColumnSpec | null {\n  switch (field) {\n    case 'email':\n      return { field, column: 'email', sqlType: 'text', fromNewUser: 'new.email' };\n    case 'displayName':\n      return {\n        field,\n        column: 'display_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'displayName', new.raw_user_meta_data->>'display_name', split_part(new.email, '@', 1))\",\n      };\n    case 'firstName':\n      return {\n        field,\n        column: 'first_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'firstName', new.raw_user_meta_data->>'first_name')\",\n      };\n    case 'lastName':\n      return {\n        field,\n        column: 'last_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'lastName', new.raw_user_meta_data->>'last_name')\",\n      };\n    case 'avatarUrl':\n      return {\n        field,\n        column: 'avatar_url',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'avatarUrl', new.raw_user_meta_data->>'avatar_url')\",\n      };\n    case 'username':\n      return {\n        field,\n        column: 'username',\n        sqlType: 'text',\n        fromNewUser: \"new.raw_user_meta_data->>'username'\",\n      };\n    case 'phone':\n      return { field, column: 'phone', sqlType: 'text', fromNewUser: 'new.phone' };\n    default:\n      return null;\n  }\n}\n\nfunction quoteIdentifier(value: string): string {\n  return `\"${value.replaceAll('\"', '\"\"')}\"`;\n}\n\nfunction getProfileDesiredStateHash(args: {\n  readonly table: string;\n  readonly primaryKey: string;\n  readonly createStrategy: string;\n  readonly updateStrategy: string;\n  readonly columns: readonly ProfileColumnSpec[];\n}): string {\n  const state = {\n    artifactKey: PROFILE_ARTIFACT_KEY,\n    table: args.table,\n    primaryKey: args.primaryKey,\n    createStrategy: args.createStrategy,\n    updateStrategy: args.updateStrategy,\n    managedColumns: args.columns.map((column) => ({\n      field: column.field,\n      column: column.column,\n      sqlType: column.sqlType,\n    })),\n    policyVersion: PROFILE_POLICY_VERSION,\n    reconcilerVersion: PROFILE_RECONCILER_VERSION,\n  };\n\n  return createHash('sha256').update(JSON.stringify(state)).digest('hex');\n}\n\nfunction resolveProfileColumns(fields: readonly string[]): ProfileColumnSpec[] {\n  const columns = new Map<string, ProfileColumnSpec>();\n\n  for (const field of fields) {\n    const column = mapProfileFieldToColumn(field);\n    if (!column) {\n      throw new Error(\n        `Unsupported Supabase profile field \"${field}\". Supported fields: ${getSupportedProfileFields().join(', ')}.`,\n      );\n    }\n\n    if (columns.has(column.column)) {\n      continue;\n    }\n    columns.set(column.column, column);\n  }\n\n  return [...columns.values()].sort(\n    (left, right) =>\n      MANAGED_PROFILE_COLUMNS.indexOf(left.column as (typeof MANAGED_PROFILE_COLUMNS)[number]) -\n      MANAGED_PROFILE_COLUMNS.indexOf(right.column as (typeof MANAGED_PROFILE_COLUMNS)[number]),\n  );\n}\n\nfunction normalizeFieldList(values: readonly string[] | undefined): string[] {\n  const source = values ?? DEFAULT_PROFILE_FIELDS;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized) {\n      throw new Error('Invalid Supabase profile field \"\". Profile fields must be non-empty.');\n    }\n\n    if (next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  return next;\n}\n\nfunction getSupportedProfileFields(): string[] {\n  return ['email', 'displayName', 'firstName', 'lastName', 'avatarUrl', 'username', 'phone'];\n}\n\nfunction normalizeIdentifier(value: string): string {\n  const trimmed = value.trim();\n  if (!trimmed) return '';\n\n  if (trimmed === 'users') {\n    throw new Error(\n      'Invalid Supabase profile table identifier \"users\". public.users is reserved for identity conflict detection; use a dedicated profile table such as \"profiles\".',\n    );\n  }\n\n  if (!/^[a-z_][a-z0-9_]*$/.test(trimmed)) {\n    throw new Error(\n      `Invalid Supabase profile table identifier \"${trimmed}\". Use snake_case letters, numbers, and underscores.`,\n    );\n  }\n\n  return trimmed;\n}\n\nfunction escapeSqlLiteral(value: string): string {\n  return value.replaceAll(\"'\", \"''\");\n}\n"]}

package/dist/adapters/minikube/authz/cerbos/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/authz/cerbos/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAkC,MAAM,sBAAsB,CAAC;AAGxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC,GAAG,wBAAwB,CAmC3B;AA2GD,KAAK,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC,GAAG;IACjF,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;CAC9B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/authz/cerbos/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAkC,MAAM,sBAAsB,CAAC;AAGxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAA6B,MAAM,iBAAiB,CAAC;AAI3F,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC,GAAG,wBAAwB,CAuD3B;AA2GD,KAAK,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC,GAAG;IACjF,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;CAC9B,CAAC"}

package/dist/adapters/minikube/authz/cerbos/index.js

@@ -1,9 +1,28 @@
 import { resolveAuthFlow } from '@ankhorage/contracts/auth';
+const CERBOS_NAMESPACE = 'cerbos';
 export function generateCerbosAuthzArtifacts(args) {
-    const { manifest, namespace, appManifest } = args;
+    const { manifest, appManifest } = args;
+    const namespace = CERBOS_NAMESPACE;
     const root = 'infra/minikube/k8s/authz/cerbos';
     const resourceRoot = 'authz/cerbos';
     const intent = buildCerbosPolicyIntent({ manifest, appManifest });
+    const endpointUrl = `http://cerbos.${namespace}.svc.cluster.local:3592`;
+    const lifecycle = {
+        id: 'cerbos',
+        namespace,
+        endpoints: [{ name: 'http', url: endpointUrl }],
+        readinessChecks: [
+            {
+                label: 'cerbos',
+                namespace,
+                resource: 'deployment/cerbos',
+                timeoutSeconds: 180,
+            },
+        ],
+        migrationCommands: [],
+        reconciliationCommands: [],
+        statusChecks: [],
+    };
     return {
         files: [
             {
@@ -29,7 +48,8 @@ export function generateCerbosAuthzArtifacts(args) {
             `${resourceRoot}/cerbos.deployment.yaml`,
             `${resourceRoot}/cerbos.service.yaml`,
         ],
-        envEntries: ['CERBOS_URL=http://cerbos:3592'],
+        providerLifecycle: [lifecycle],
+        envEntries: [`CERBOS_URL=${endpointUrl}`],
         warnings: [],
     };
 }

package/dist/adapters/minikube/authz/cerbos/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/authz/cerbos/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAK5D,MAAM,UAAU,4BAA4B,CAAC,IAI5C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAElD,MAAM,IAAI,GAAG,iCAAiC,CAAC;IAC/C,MAAM,YAAY,GAAG,cAAc,CAAC;IACpC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAElE,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,wBAAwB;gBACrC,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC;aACvC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,wBAAwB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;aACzD;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,yBAAyB;gBACtC,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC;aACxC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sBAAsB;gBACnC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;aACrC;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,wBAAwB;YACvC,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,yBAAyB;YACxC,GAAG,YAAY,sBAAsB;SACtC;QACD,UAAU,EAAE,CAAC,+BAA+B,CAAC;QAC7C,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO;;;;eAIM,SAAS;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAuD;IACvF,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,OAAO;SAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/C,OAAO,KAAK,KAAK,CAAC,GAAG;EACzB,QAAQ,EAAE,CAAC;IACT,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;eAIM,SAAS;;EAEtB,eAAe;CAChB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,OAAO;;;;eAIM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCvB,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO;;;;eAIM,SAAS;;;;;;;;CAQvB,CAAC;AACF,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACxF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,eAAe;IACf,SAAS;IACT,WAAW;IACX,cAAc;IACd,eAAe;CAChB,CAAC,CAAC;AA2BH,SAAS,sBAAsB,CAAC,MAA0B;IACxD,MAAM,OAAO,GAAwB;QACnC;YACE,GAAG,EAAE,0BAA0B;YAC/B,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;SAC9B;KACF,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,4BAA4B;YACjC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,6BAA6B;YAClC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAEjG,OAAO;;;;;EAKP,WAAW,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;CACtD,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7B,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;YACrC,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC;SACnE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;;;;;EAKP,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACjC,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3B,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;YACrC,aAAa,EAAE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;SACrE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,aAAa,EAAE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC;SACxE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;;;;;EAKP,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACjC,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,IAAoE;IACtF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/C,MAAM,KAAK,GAAG;QACZ,cAAc,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QACvC,wBAAwB;QACxB,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;KACpC,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB,EAAE,MAAgB;IAC7D,OAAO,yBAAyB,SAAS,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,OAAO;SACX,OAAO,EAAE;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAGhC;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC;IAEjD,MAAM,MAAM,GAAG,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC7B,KAAK;YACL,SAAS;YACT,WAAW;YACX,WAAW;YACX,iBAAiB;SAClB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,WAAW;YAAE,SAAS;QACtC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,iBAAiB,GACrB,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QAElD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;SAC7B,IAAI,EAAE,CAAC;IACV,MAAM,gBAAgB,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;SACrD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,WAAW,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;SAC7B,IAAI,EAAE,CAAC;IAEV,OAAO;QACL,SAAS;QACT,YAAY,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE;QACxC,eAAe,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE;QAC9C,aAAa;QACb,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAwB;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAErD,MAAM,IAAI,GAAG,CAAC,OAAsB,EAAE,EAAE;QACtC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;gBAClE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;aAC/C,CAAC,CAAC;YAEH,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,SAAS,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,MAAkC;IACzD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,IAMtB;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAEzE,IACE,KAAK,CAAC,IAAI,KAAK,eAAe;QAC9B,KAAK,CAAC,IAAI,KAAK,eAAe;QAC9B,KAAK,CAAC,IAAI,KAAK,qBAAqB,EACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAmB,EAAE,UAAuB;IAC1D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAAC,SAA6B;IAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AAClD,CAAC","sourcesContent":["import type { AppManifest, NavigatorSpec, RouteDefinition } from '@ankhorage/contracts';\nimport { resolveAuthFlow } from '@ankhorage/contracts/auth';\n\nimport type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\n\nexport function generateCerbosAuthzArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n  appManifest?: CerbosAppManifest;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace, appManifest } = args;\n\n  const root = 'infra/minikube/k8s/authz/cerbos';\n  const resourceRoot = 'authz/cerbos';\n  const intent = buildCerbosPolicyIntent({ manifest, appManifest });\n\n  return {\n    files: [\n      {\n        path: `${root}/cerbos.configmap.yaml`,\n        content: getCerbosConfigMap(namespace),\n      },\n      {\n        path: `${root}/cerbos.policy.configmap.yaml`,\n        content: getCerbosPolicyConfigMap({ namespace, intent }),\n      },\n      {\n        path: `${root}/cerbos.deployment.yaml`,\n        content: getCerbosDeployment(namespace),\n      },\n      {\n        path: `${root}/cerbos.service.yaml`,\n        content: getCerbosService(namespace),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/cerbos.configmap.yaml`,\n      `${resourceRoot}/cerbos.policy.configmap.yaml`,\n      `${resourceRoot}/cerbos.deployment.yaml`,\n      `${resourceRoot}/cerbos.service.yaml`,\n    ],\n    envEntries: ['CERBOS_URL=http://cerbos:3592'],\n    warnings: [],\n  };\n}\n\nfunction getCerbosConfigMap(namespace: string) {\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: cerbos-config\n  namespace: ${namespace}\ndata:\n  config.yaml: |\n    server:\n      httpListenAddr: \":3592\"\n    storage:\n      driver: \"disk\"\n      disk:\n        directory: /policies\n`;\n}\n\nfunction getCerbosPolicyConfigMap(args: { namespace: string; intent: CerbosPolicyIntent }) {\n  const { namespace, intent } = args;\n  const entries = getCerbosPolicyEntries(intent);\n  const renderedEntries = entries\n    .map((entry) => {\n      const indented = indentLines(entry.content, 4);\n      return `  ${entry.key}: |\n${indented}`;\n    })\n    .join('\\n');\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: cerbos-policy\n  namespace: ${namespace}\ndata:\n${renderedEntries}\n`;\n}\n\nfunction getCerbosDeployment(namespace: string) {\n  return `apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: cerbos\n  namespace: ${namespace}\n  labels:\n    app.kubernetes.io/name: cerbos\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: cerbos\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: cerbos\n    spec:\n      containers:\n        - name: cerbos\n          image: ghcr.io/cerbos/cerbos:0.40.0\n          args:\n            - server\n            - --config=/config/config.yaml\n          ports:\n            - containerPort: 3592\n          volumeMounts:\n            - name: cerbos-config\n              mountPath: /config\n            - name: cerbos-policy\n              mountPath: /policies\n      volumes:\n        - name: cerbos-config\n          configMap:\n            name: cerbos-config\n        - name: cerbos-policy\n          configMap:\n            name: cerbos-policy\n`;\n}\n\nfunction getCerbosService(namespace: string) {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: cerbos\n  namespace: ${namespace}\nspec:\n  selector:\n    app.kubernetes.io/name: cerbos\n  ports:\n    - name: http\n      port: 3592\n      targetPort: 3592\n`;\n}\n\nconst PUBLIC_GUARD_HINTS = new Set(['public', 'guest', 'anonymous', 'unauthenticated']);\nconst AUTH_GUARD_HINTS = new Set([\n  'auth',\n  'authenticated',\n  'private',\n  'protected',\n  'requiresauth',\n  'requires-auth',\n]);\n\ntype CerbosAppManifest = Pick<AppManifest, 'metadata' | 'navigator' | 'screens'> & {\n  infra?: AppManifest['infra'];\n};\n\ntype AuthScope = NonNullable<InfraManifestInput['auth']>['scope'] | 'none';\n\ninterface CerbosRouteIntent {\n  name: string;\n  guards: string[];\n  screenId?: string;\n}\n\ninterface CerbosPolicyIntent {\n  authScope: AuthScope;\n  publicRoutes: string[];\n  protectedRoutes: string[];\n  publicScreens: string[];\n  protectedScreens: string[];\n}\n\ninterface CerbosPolicyEntry {\n  key: string;\n  content: string;\n}\n\nfunction getCerbosPolicyEntries(intent: CerbosPolicyIntent): CerbosPolicyEntry[] {\n  const entries: CerbosPolicyEntry[] = [\n    {\n      key: 'app.resource_policy.yaml',\n      content: getAppPolicy(intent),\n    },\n  ];\n\n  if (intent.publicRoutes.length > 0 || intent.protectedRoutes.length > 0) {\n    entries.push({\n      key: 'route.resource_policy.yaml',\n      content: getRoutePolicy(intent),\n    });\n  }\n\n  if (intent.publicScreens.length > 0 || intent.protectedScreens.length > 0) {\n    entries.push({\n      key: 'screen.resource_policy.yaml',\n      content: getScreenPolicy(intent),\n    });\n  }\n\n  return entries;\n}\n\nfunction getAppPolicy(intent: CerbosPolicyIntent): string {\n  const roles = intent.authScope === 'global' ? ['authenticated'] : ['anonymous', 'authenticated'];\n\n  return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n  version: \"default\"\n  resource: \"app\"\n  rules:\n${indentLines(renderRule({ actions: ['*'], roles }), 4)}\n`;\n}\n\nfunction getRoutePolicy(intent: CerbosPolicyIntent): string {\n  const rules: string[] = [];\n\n  if (intent.publicRoutes.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'navigate'],\n        roles: ['anonymous', 'authenticated'],\n        conditionExpr: getInConditionExpr('route', intent.publicRoutes),\n      }),\n    );\n  }\n\n  if (intent.protectedRoutes.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'navigate'],\n        roles: ['authenticated'],\n        conditionExpr: getInConditionExpr('route', intent.protectedRoutes),\n      }),\n    );\n  }\n\n  return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n  version: \"default\"\n  resource: \"route\"\n  rules:\n${indentLines(rules.join('\\n'), 4)}\n`;\n}\n\nfunction getScreenPolicy(intent: CerbosPolicyIntent): string {\n  const rules: string[] = [];\n\n  if (intent.publicScreens.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'render'],\n        roles: ['anonymous', 'authenticated'],\n        conditionExpr: getInConditionExpr('screen_id', intent.publicScreens),\n      }),\n    );\n  }\n\n  if (intent.protectedScreens.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'render'],\n        roles: ['authenticated'],\n        conditionExpr: getInConditionExpr('screen_id', intent.protectedScreens),\n      }),\n    );\n  }\n\n  return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n  version: \"default\"\n  resource: \"screen\"\n  rules:\n${indentLines(rules.join('\\n'), 4)}\n`;\n}\n\nfunction renderRule(args: { actions: string[]; roles: string[]; conditionExpr?: string }): string {\n  const { actions, roles, conditionExpr } = args;\n\n  const lines = [\n    `- actions: ${JSON.stringify(actions)}`,\n    '  effect: EFFECT_ALLOW',\n    `  roles: ${JSON.stringify(roles)}`,\n  ];\n\n  if (conditionExpr) {\n    lines.push('  condition:');\n    lines.push('    match:');\n    lines.push(`      expr: ${JSON.stringify(conditionExpr)}`);\n  }\n\n  return lines.join('\\n');\n}\n\nfunction getInConditionExpr(attribute: string, values: string[]): string {\n  return `request.resource.attr.${attribute} in ${JSON.stringify(values)}`;\n}\n\nfunction indentLines(content: string, spaces: number): string {\n  const prefix = ' '.repeat(spaces);\n  return content\n    .trimEnd()\n    .split('\\n')\n    .map((line) => `${prefix}${line}`)\n    .join('\\n');\n}\n\nfunction buildCerbosPolicyIntent(args: {\n  manifest: InfraManifestInput;\n  appManifest?: CerbosAppManifest;\n}): CerbosPolicyIntent {\n  const { manifest, appManifest } = args;\n  const authScope = manifest.auth?.scope ?? 'none';\n\n  const routes = appManifest?.navigator ? flattenNavigatorRoutes(appManifest.navigator) : [];\n  const flow = resolveAuthFlow(appManifest?.infra?.auth?.flow);\n  const { signInRoute } = flow;\n  const { signUpRoute } = flow;\n  const { unauthorizedRoute } = flow;\n\n  const publicRouteSet = new Set<string>();\n  const protectedRouteSet = new Set<string>();\n\n  for (const route of routes) {\n    const isPublic = isPublicRoute({\n      route,\n      authScope,\n      signInRoute,\n      signUpRoute,\n      unauthorizedRoute,\n    });\n\n    if (isPublic) {\n      publicRouteSet.add(route.name);\n    } else {\n      protectedRouteSet.add(route.name);\n    }\n  }\n\n  const screenVisibility = new Map<string, 'public' | 'protected'>();\n  for (const route of routes) {\n    if (!route.screenId) continue;\n    const isPublic = publicRouteSet.has(route.name);\n\n    const current = screenVisibility.get(route.screenId);\n    if (current === 'protected') continue;\n    screenVisibility.set(route.screenId, isPublic ? 'public' : 'protected');\n  }\n\n  if (appManifest?.screens) {\n    const defaultVisibility: 'public' | 'protected' =\n      authScope === 'global' ? 'protected' : 'public';\n\n    for (const screenId of Object.keys(appManifest.screens)) {\n      if (!screenVisibility.has(screenId)) {\n        screenVisibility.set(screenId, defaultVisibility);\n      }\n    }\n  }\n\n  const publicScreens = [...screenVisibility.entries()]\n    .filter(([, visibility]) => visibility === 'public')\n    .map(([screenId]) => screenId)\n    .sort();\n  const protectedScreens = [...screenVisibility.entries()]\n    .filter(([, visibility]) => visibility === 'protected')\n    .map(([screenId]) => screenId)\n    .sort();\n\n  return {\n    authScope,\n    publicRoutes: [...publicRouteSet].sort(),\n    protectedRoutes: [...protectedRouteSet].sort(),\n    publicScreens,\n    protectedScreens,\n  };\n}\n\nfunction flattenNavigatorRoutes(navigator: NavigatorSpec): CerbosRouteIntent[] {\n  const deduped = new Map<string, CerbosRouteIntent>();\n\n  const walk = (current: NavigatorSpec) => {\n    for (const route of current.routes) {\n      const normalizedGuards = normalizeGuards(route.guards);\n      const existing = deduped.get(route.name);\n      deduped.set(route.name, {\n        name: route.name,\n        guards: unique([...(existing?.guards ?? []), ...normalizedGuards]),\n        screenId: route.screenId ?? existing?.screenId,\n      });\n\n      if (route.navigator) {\n        walk(route.navigator);\n      }\n    }\n  };\n\n  walk(navigator);\n  return [...deduped.values()];\n}\n\nfunction normalizeGuards(guards?: RouteDefinition['guards']): string[] {\n  return (guards ?? []).map((guard) => guard.trim().toLowerCase()).filter(Boolean);\n}\n\nfunction isPublicRoute(args: {\n  route: CerbosRouteIntent;\n  authScope: AuthScope;\n  signInRoute?: string;\n  signUpRoute?: string;\n  unauthorizedRoute?: string;\n}): boolean {\n  const { route, authScope, signInRoute, signUpRoute, unauthorizedRoute } = args;\n  const guardSet = new Set(route.guards);\n  const signInRouteName = authFlowPathToRouteName(signInRoute);\n  const signUpRouteName = authFlowPathToRouteName(signUpRoute);\n  const unauthorizedRouteName = authFlowPathToRouteName(unauthorizedRoute);\n\n  if (\n    route.name === signInRouteName ||\n    route.name === signUpRouteName ||\n    route.name === unauthorizedRouteName\n  ) {\n    return true;\n  }\n\n  if (hasAny(guardSet, PUBLIC_GUARD_HINTS)) {\n    return true;\n  }\n\n  if (hasAny(guardSet, AUTH_GUARD_HINTS)) {\n    return false;\n  }\n\n  switch (authScope) {\n    case 'none':\n      return true;\n    case 'global':\n    default:\n      return false;\n  }\n}\n\nfunction hasAny(values: Set<string>, candidates: Set<string>): boolean {\n  for (const candidate of candidates) {\n    if (values.has(candidate)) return true;\n  }\n  return false;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n\nfunction authFlowPathToRouteName(routePath: string | undefined): string | undefined {\n  if (!routePath) {\n    return undefined;\n  }\n\n  const normalized = routePath.trim().replace(/^\\/+/, '').replace(/\\/+$/, '');\n  return normalized === '' ? 'index' : normalized;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/authz/cerbos/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAK5D,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,MAAM,UAAU,4BAA4B,CAAC,IAI5C;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC;IAEnC,MAAM,IAAI,GAAG,iCAAiC,CAAC;IAC/C,MAAM,YAAY,GAAG,cAAc,CAAC;IACpC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAElE,MAAM,WAAW,GAAG,iBAAiB,SAAS,yBAAyB,CAAC;IACxE,MAAM,SAAS,GAA8B;QAC3C,EAAE,EAAE,QAAQ;QACZ,SAAS;QACT,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAC/C,eAAe,EAAE;YACf;gBACE,KAAK,EAAE,QAAQ;gBACf,SAAS;gBACT,QAAQ,EAAE,mBAAmB;gBAC7B,cAAc,EAAE,GAAG;aACpB;SACF;QACD,iBAAiB,EAAE,EAAE;QACrB,sBAAsB,EAAE,EAAE;QAC1B,YAAY,EAAE,EAAE;KACjB,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,wBAAwB;gBACrC,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC;aACvC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,wBAAwB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;aACzD;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,yBAAyB;gBACtC,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC;aACxC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sBAAsB;gBACnC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;aACrC;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,wBAAwB;YACvC,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,yBAAyB;YACxC,GAAG,YAAY,sBAAsB;SACtC;QACD,iBAAiB,EAAE,CAAC,SAAS,CAAC;QAC9B,UAAU,EAAE,CAAC,cAAc,WAAW,EAAE,CAAC;QACzC,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO;;;;eAIM,SAAS;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAuD;IACvF,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,OAAO;SAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/C,OAAO,KAAK,KAAK,CAAC,GAAG;EACzB,QAAQ,EAAE,CAAC;IACT,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;eAIM,SAAS;;EAEtB,eAAe;CAChB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,OAAO;;;;eAIM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCvB,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO;;;;eAIM,SAAS;;;;;;;;CAQvB,CAAC;AACF,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACxF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,eAAe;IACf,SAAS;IACT,WAAW;IACX,cAAc;IACd,eAAe;CAChB,CAAC,CAAC;AA2BH,SAAS,sBAAsB,CAAC,MAA0B;IACxD,MAAM,OAAO,GAAwB;QACnC;YACE,GAAG,EAAE,0BAA0B;YAC/B,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;SAC9B;KACF,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,4BAA4B;YACjC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,6BAA6B;YAClC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAEjG,OAAO;;;;;EAKP,WAAW,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;CACtD,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7B,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;YACrC,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC;SACnE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;;;;;EAKP,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACjC,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3B,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;YACrC,aAAa,EAAE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;SACrE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,aAAa,EAAE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC;SACxE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;;;;;EAKP,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACjC,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,IAAoE;IACtF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/C,MAAM,KAAK,GAAG;QACZ,cAAc,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QACvC,wBAAwB;QACxB,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;KACpC,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB,EAAE,MAAgB;IAC7D,OAAO,yBAAyB,SAAS,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,OAAO;SACX,OAAO,EAAE;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAGhC;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC;IAEjD,MAAM,MAAM,GAAG,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC7B,KAAK;YACL,SAAS;YACT,WAAW;YACX,WAAW;YACX,iBAAiB;SAClB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,WAAW;YAAE,SAAS;QACtC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,iBAAiB,GACrB,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QAElD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;SAC7B,IAAI,EAAE,CAAC;IACV,MAAM,gBAAgB,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;SACrD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,WAAW,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;SAC7B,IAAI,EAAE,CAAC;IAEV,OAAO;QACL,SAAS;QACT,YAAY,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE;QACxC,eAAe,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE;QAC9C,aAAa;QACb,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAwB;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAErD,MAAM,IAAI,GAAG,CAAC,OAAsB,EAAE,EAAE;QACtC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;gBAClE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;aAC/C,CAAC,CAAC;YAEH,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,SAAS,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,MAAkC;IACzD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,IAMtB;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAEzE,IACE,KAAK,CAAC,IAAI,KAAK,eAAe;QAC9B,KAAK,CAAC,IAAI,KAAK,eAAe;QAC9B,KAAK,CAAC,IAAI,KAAK,qBAAqB,EACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAmB,EAAE,UAAuB;IAC1D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAAC,SAA6B;IAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AAClD,CAAC","sourcesContent":["import type { AppManifest, NavigatorSpec, RouteDefinition } from '@ankhorage/contracts';\nimport { resolveAuthFlow } from '@ankhorage/contracts/auth';\n\nimport type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../../contracts';\n\nconst CERBOS_NAMESPACE = 'cerbos';\n\nexport function generateCerbosAuthzArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n  appManifest?: CerbosAppManifest;\n}): MinikubeAdapterArtifacts {\n  const { manifest, appManifest } = args;\n  const namespace = CERBOS_NAMESPACE;\n\n  const root = 'infra/minikube/k8s/authz/cerbos';\n  const resourceRoot = 'authz/cerbos';\n  const intent = buildCerbosPolicyIntent({ manifest, appManifest });\n\n  const endpointUrl = `http://cerbos.${namespace}.svc.cluster.local:3592`;\n  const lifecycle: MinikubeProviderLifecycle = {\n    id: 'cerbos',\n    namespace,\n    endpoints: [{ name: 'http', url: endpointUrl }],\n    readinessChecks: [\n      {\n        label: 'cerbos',\n        namespace,\n        resource: 'deployment/cerbos',\n        timeoutSeconds: 180,\n      },\n    ],\n    migrationCommands: [],\n    reconciliationCommands: [],\n    statusChecks: [],\n  };\n\n  return {\n    files: [\n      {\n        path: `${root}/cerbos.configmap.yaml`,\n        content: getCerbosConfigMap(namespace),\n      },\n      {\n        path: `${root}/cerbos.policy.configmap.yaml`,\n        content: getCerbosPolicyConfigMap({ namespace, intent }),\n      },\n      {\n        path: `${root}/cerbos.deployment.yaml`,\n        content: getCerbosDeployment(namespace),\n      },\n      {\n        path: `${root}/cerbos.service.yaml`,\n        content: getCerbosService(namespace),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/cerbos.configmap.yaml`,\n      `${resourceRoot}/cerbos.policy.configmap.yaml`,\n      `${resourceRoot}/cerbos.deployment.yaml`,\n      `${resourceRoot}/cerbos.service.yaml`,\n    ],\n    providerLifecycle: [lifecycle],\n    envEntries: [`CERBOS_URL=${endpointUrl}`],\n    warnings: [],\n  };\n}\n\nfunction getCerbosConfigMap(namespace: string) {\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: cerbos-config\n  namespace: ${namespace}\ndata:\n  config.yaml: |\n    server:\n      httpListenAddr: \":3592\"\n    storage:\n      driver: \"disk\"\n      disk:\n        directory: /policies\n`;\n}\n\nfunction getCerbosPolicyConfigMap(args: { namespace: string; intent: CerbosPolicyIntent }) {\n  const { namespace, intent } = args;\n  const entries = getCerbosPolicyEntries(intent);\n  const renderedEntries = entries\n    .map((entry) => {\n      const indented = indentLines(entry.content, 4);\n      return `  ${entry.key}: |\n${indented}`;\n    })\n    .join('\\n');\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: cerbos-policy\n  namespace: ${namespace}\ndata:\n${renderedEntries}\n`;\n}\n\nfunction getCerbosDeployment(namespace: string) {\n  return `apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: cerbos\n  namespace: ${namespace}\n  labels:\n    app.kubernetes.io/name: cerbos\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: cerbos\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: cerbos\n    spec:\n      containers:\n        - name: cerbos\n          image: ghcr.io/cerbos/cerbos:0.40.0\n          args:\n            - server\n            - --config=/config/config.yaml\n          ports:\n            - containerPort: 3592\n          volumeMounts:\n            - name: cerbos-config\n              mountPath: /config\n            - name: cerbos-policy\n              mountPath: /policies\n      volumes:\n        - name: cerbos-config\n          configMap:\n            name: cerbos-config\n        - name: cerbos-policy\n          configMap:\n            name: cerbos-policy\n`;\n}\n\nfunction getCerbosService(namespace: string) {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: cerbos\n  namespace: ${namespace}\nspec:\n  selector:\n    app.kubernetes.io/name: cerbos\n  ports:\n    - name: http\n      port: 3592\n      targetPort: 3592\n`;\n}\n\nconst PUBLIC_GUARD_HINTS = new Set(['public', 'guest', 'anonymous', 'unauthenticated']);\nconst AUTH_GUARD_HINTS = new Set([\n  'auth',\n  'authenticated',\n  'private',\n  'protected',\n  'requiresauth',\n  'requires-auth',\n]);\n\ntype CerbosAppManifest = Pick<AppManifest, 'metadata' | 'navigator' | 'screens'> & {\n  infra?: AppManifest['infra'];\n};\n\ntype AuthScope = NonNullable<InfraManifestInput['auth']>['scope'] | 'none';\n\ninterface CerbosRouteIntent {\n  name: string;\n  guards: string[];\n  screenId?: string;\n}\n\ninterface CerbosPolicyIntent {\n  authScope: AuthScope;\n  publicRoutes: string[];\n  protectedRoutes: string[];\n  publicScreens: string[];\n  protectedScreens: string[];\n}\n\ninterface CerbosPolicyEntry {\n  key: string;\n  content: string;\n}\n\nfunction getCerbosPolicyEntries(intent: CerbosPolicyIntent): CerbosPolicyEntry[] {\n  const entries: CerbosPolicyEntry[] = [\n    {\n      key: 'app.resource_policy.yaml',\n      content: getAppPolicy(intent),\n    },\n  ];\n\n  if (intent.publicRoutes.length > 0 || intent.protectedRoutes.length > 0) {\n    entries.push({\n      key: 'route.resource_policy.yaml',\n      content: getRoutePolicy(intent),\n    });\n  }\n\n  if (intent.publicScreens.length > 0 || intent.protectedScreens.length > 0) {\n    entries.push({\n      key: 'screen.resource_policy.yaml',\n      content: getScreenPolicy(intent),\n    });\n  }\n\n  return entries;\n}\n\nfunction getAppPolicy(intent: CerbosPolicyIntent): string {\n  const roles = intent.authScope === 'global' ? ['authenticated'] : ['anonymous', 'authenticated'];\n\n  return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n  version: \"default\"\n  resource: \"app\"\n  rules:\n${indentLines(renderRule({ actions: ['*'], roles }), 4)}\n`;\n}\n\nfunction getRoutePolicy(intent: CerbosPolicyIntent): string {\n  const rules: string[] = [];\n\n  if (intent.publicRoutes.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'navigate'],\n        roles: ['anonymous', 'authenticated'],\n        conditionExpr: getInConditionExpr('route', intent.publicRoutes),\n      }),\n    );\n  }\n\n  if (intent.protectedRoutes.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'navigate'],\n        roles: ['authenticated'],\n        conditionExpr: getInConditionExpr('route', intent.protectedRoutes),\n      }),\n    );\n  }\n\n  return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n  version: \"default\"\n  resource: \"route\"\n  rules:\n${indentLines(rules.join('\\n'), 4)}\n`;\n}\n\nfunction getScreenPolicy(intent: CerbosPolicyIntent): string {\n  const rules: string[] = [];\n\n  if (intent.publicScreens.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'render'],\n        roles: ['anonymous', 'authenticated'],\n        conditionExpr: getInConditionExpr('screen_id', intent.publicScreens),\n      }),\n    );\n  }\n\n  if (intent.protectedScreens.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'render'],\n        roles: ['authenticated'],\n        conditionExpr: getInConditionExpr('screen_id', intent.protectedScreens),\n      }),\n    );\n  }\n\n  return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n  version: \"default\"\n  resource: \"screen\"\n  rules:\n${indentLines(rules.join('\\n'), 4)}\n`;\n}\n\nfunction renderRule(args: { actions: string[]; roles: string[]; conditionExpr?: string }): string {\n  const { actions, roles, conditionExpr } = args;\n\n  const lines = [\n    `- actions: ${JSON.stringify(actions)}`,\n    '  effect: EFFECT_ALLOW',\n    `  roles: ${JSON.stringify(roles)}`,\n  ];\n\n  if (conditionExpr) {\n    lines.push('  condition:');\n    lines.push('    match:');\n    lines.push(`      expr: ${JSON.stringify(conditionExpr)}`);\n  }\n\n  return lines.join('\\n');\n}\n\nfunction getInConditionExpr(attribute: string, values: string[]): string {\n  return `request.resource.attr.${attribute} in ${JSON.stringify(values)}`;\n}\n\nfunction indentLines(content: string, spaces: number): string {\n  const prefix = ' '.repeat(spaces);\n  return content\n    .trimEnd()\n    .split('\\n')\n    .map((line) => `${prefix}${line}`)\n    .join('\\n');\n}\n\nfunction buildCerbosPolicyIntent(args: {\n  manifest: InfraManifestInput;\n  appManifest?: CerbosAppManifest;\n}): CerbosPolicyIntent {\n  const { manifest, appManifest } = args;\n  const authScope = manifest.auth?.scope ?? 'none';\n\n  const routes = appManifest?.navigator ? flattenNavigatorRoutes(appManifest.navigator) : [];\n  const flow = resolveAuthFlow(appManifest?.infra?.auth?.flow);\n  const { signInRoute } = flow;\n  const { signUpRoute } = flow;\n  const { unauthorizedRoute } = flow;\n\n  const publicRouteSet = new Set<string>();\n  const protectedRouteSet = new Set<string>();\n\n  for (const route of routes) {\n    const isPublic = isPublicRoute({\n      route,\n      authScope,\n      signInRoute,\n      signUpRoute,\n      unauthorizedRoute,\n    });\n\n    if (isPublic) {\n      publicRouteSet.add(route.name);\n    } else {\n      protectedRouteSet.add(route.name);\n    }\n  }\n\n  const screenVisibility = new Map<string, 'public' | 'protected'>();\n  for (const route of routes) {\n    if (!route.screenId) continue;\n    const isPublic = publicRouteSet.has(route.name);\n\n    const current = screenVisibility.get(route.screenId);\n    if (current === 'protected') continue;\n    screenVisibility.set(route.screenId, isPublic ? 'public' : 'protected');\n  }\n\n  if (appManifest?.screens) {\n    const defaultVisibility: 'public' | 'protected' =\n      authScope === 'global' ? 'protected' : 'public';\n\n    for (const screenId of Object.keys(appManifest.screens)) {\n      if (!screenVisibility.has(screenId)) {\n        screenVisibility.set(screenId, defaultVisibility);\n      }\n    }\n  }\n\n  const publicScreens = [...screenVisibility.entries()]\n    .filter(([, visibility]) => visibility === 'public')\n    .map(([screenId]) => screenId)\n    .sort();\n  const protectedScreens = [...screenVisibility.entries()]\n    .filter(([, visibility]) => visibility === 'protected')\n    .map(([screenId]) => screenId)\n    .sort();\n\n  return {\n    authScope,\n    publicRoutes: [...publicRouteSet].sort(),\n    protectedRoutes: [...protectedRouteSet].sort(),\n    publicScreens,\n    protectedScreens,\n  };\n}\n\nfunction flattenNavigatorRoutes(navigator: NavigatorSpec): CerbosRouteIntent[] {\n  const deduped = new Map<string, CerbosRouteIntent>();\n\n  const walk = (current: NavigatorSpec) => {\n    for (const route of current.routes) {\n      const normalizedGuards = normalizeGuards(route.guards);\n      const existing = deduped.get(route.name);\n      deduped.set(route.name, {\n        name: route.name,\n        guards: unique([...(existing?.guards ?? []), ...normalizedGuards]),\n        screenId: route.screenId ?? existing?.screenId,\n      });\n\n      if (route.navigator) {\n        walk(route.navigator);\n      }\n    }\n  };\n\n  walk(navigator);\n  return [...deduped.values()];\n}\n\nfunction normalizeGuards(guards?: RouteDefinition['guards']): string[] {\n  return (guards ?? []).map((guard) => guard.trim().toLowerCase()).filter(Boolean);\n}\n\nfunction isPublicRoute(args: {\n  route: CerbosRouteIntent;\n  authScope: AuthScope;\n  signInRoute?: string;\n  signUpRoute?: string;\n  unauthorizedRoute?: string;\n}): boolean {\n  const { route, authScope, signInRoute, signUpRoute, unauthorizedRoute } = args;\n  const guardSet = new Set(route.guards);\n  const signInRouteName = authFlowPathToRouteName(signInRoute);\n  const signUpRouteName = authFlowPathToRouteName(signUpRoute);\n  const unauthorizedRouteName = authFlowPathToRouteName(unauthorizedRoute);\n\n  if (\n    route.name === signInRouteName ||\n    route.name === signUpRouteName ||\n    route.name === unauthorizedRouteName\n  ) {\n    return true;\n  }\n\n  if (hasAny(guardSet, PUBLIC_GUARD_HINTS)) {\n    return true;\n  }\n\n  if (hasAny(guardSet, AUTH_GUARD_HINTS)) {\n    return false;\n  }\n\n  switch (authScope) {\n    case 'none':\n      return true;\n    case 'global':\n    default:\n      return false;\n  }\n}\n\nfunction hasAny(values: Set<string>, candidates: Set<string>): boolean {\n  for (const candidate of candidates) {\n    if (values.has(candidate)) return true;\n  }\n  return false;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n\nfunction authFlowPathToRouteName(routePath: string | undefined): string | undefined {\n  if (!routePath) {\n    return undefined;\n  }\n\n  const normalized = routePath.trim().replace(/^\\/+/, '').replace(/\\/+$/, '');\n  return normalized === '' ? 'index' : normalized;\n}\n"]}

package/dist/adapters/minikube/base/index.d.ts

@@ -1,10 +1,13 @@
 import type { GeneratedInfrastructureFile } from '../../../types';
 import type { InfraManifestInput } from '../../../types';
+import type { MinikubeProviderLifecycle } from '../contracts';
+export declare const APP_NAMESPACE = "app";
 export declare function generateMinikubeBaseArtifacts(args: {
     manifest: InfraManifestInput;
-    namespace: string;
-    supabaseProjectId: string | null;
+    appSlug: string;
     extraResources: string[];
+    providerNamespaces: string[];
+    providerLifecycle: MinikubeProviderLifecycle[];
     extraEnvEntries: string[];
 }): GeneratedInfrastructureFile[];
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/minikube/base/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AA4BzD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,2BAA2B,EAAE,CAiIhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAE9D,eAAO,MAAM,aAAa,QAAQ,CAAC;AAoDnC,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,2BAA2B,EAAE,CAoLhC"}