@ankhorage/infra 0.4.2 → 1.0.1

package/dist/adapters/minikube/base/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,uBAAuB,EAEvB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAkBlC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAC9C,MAAM,qCAAqC,GAAG,QAAQ,CAAC;AAEvD,MAAM,UAAU,6BAA6B,CAAC,IAM7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAEzF,MAAM,IAAI,GAAG,gBAAgB,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC;IAC9B,MAAM,WAAW,GAAG,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,YAAY,GAAG,GAAG,IAAI,YAAY,CAAC;IACzC,MAAM,eAAe,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,iBAAiB,IAAI,SAAS,CAAC,CAAC;IAErF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC;IACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,MAAM,CAAC;IACnE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,CAAC;IAC/D,MAAM,mBAAmB,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,IAAI,MAAM,CAAC;IACrE,MAAM,eAAe,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,iBAAiB,GAAG,QAAQ,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC;IACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;IACjD,MAAM,oBAAoB,GACxB,YAAY,KAAK,UAAU;QAC3B,gBAAgB,KAAK,UAAU;QAC/B,eAAe,KAAK,IAAI;QACxB,mBAAmB,KAAK,gBAAgB,CAAC;IAE3C,OAAO;QACL;YACE,IAAI,EAAE,GAAG,IAAI,YAAY;YACzB,OAAO,EAAE,iBAAiB,CAAC;gBACzB,SAAS;gBACT,eAAe;gBACf,iBAAiB;gBACjB,YAAY;gBACZ,WAAW;gBACX,cAAc;gBACd,kBAAkB;gBAClB,iBAAiB;gBACjB,oBAAoB;gBACpB,YAAY;aACb,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,IAAI,eAAe;YAC5B,OAAO,EAAE,aAAa,CAAC;gBACrB,SAAS;gBACT,MAAM;gBACN,eAAe;gBACf,eAAe;gBACf,kBAAkB;gBAClB,oBAAoB;aACrB,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,OAAO,iBAAiB;YACjC,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC;SACzC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,eAAe,CAAC;gBACvB,SAAS;gBACT,SAAS;gBACT,YAAY;gBACZ,gBAAgB;gBAChB,mBAAmB;gBACnB,eAAe;gBACf,iBAAiB;gBACjB,MAAM;aACP,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,OAAO,sBAAsB;YACtC,OAAO,EAAE,wBAAwB,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;SAClE;QACD;YACE,IAAI,EAAE,GAAG,OAAO,mBAAmB;YACnC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC;SAC1C;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,wBAAwB,CAAC,cAAc,CAAC;SAClD;QACD;YACE,IAAI,EAAE,GAAG,WAAW,QAAQ;YAC5B,OAAO,EAAE,WAAW,CAAC;gBACnB,gBAAgB,EAAE,SAAS;gBAC3B,eAAe;gBACf,oBAAoB;aACrB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,qBAAqB;YACzC,OAAO,EAAE,sBAAsB,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;YACjF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,kBAAkB;YACtC,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC;YACxC,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,UAAU;YAC9B,OAAO,EAAE,aAAa,EAAE;YACxB,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,YAAY;YAChC,OAAO,EAAE,eAAe,CAAC;gBACvB,gBAAgB,EAAE,SAAS;gBAC3B,iBAAiB;gBACjB,oBAAoB;gBACpB,YAAY;aACb,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,wBAAwB;YAC5C,OAAO,EAAE,yBAAyB,CAAC;gBACjC,iBAAiB;gBACjB,kBAAkB;gBAClB,YAAY;aACb,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,YAAY,aAAa;YAClC,OAAO,EAAE,qBAAqB,EAAE;SACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAW1B;IACC,MAAM,EACJ,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,GACb,GAAG,IAAI,CAAC;IACT,MAAM,aAAa,GAAG;QACpB,gBAAgB;QAChB,oBAAoB;QACpB,qBAAqB;QACrB,kBAAkB;QAClB,GAAG,cAAc;KAClB;SACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;SAC5B,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyCP,aAAa;;;;;;;;;;;iBAWE,SAAS;uCACa,iBAAiB,IAAI,QAAQ;4BACxC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;qBAC3C,YAAY;4BACL,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sDAmDe,kBAAkB,CAAC,IAAI;qDACxB,kBAAkB,CAAC,GAAG;oDACvB,kBAAkB,CAAC,EAAE;wDACjB,kBAAkB,CAAC,MAAM;0DACvB,kBAAkB,CAAC,QAAQ;2DAC1B,kBAAkB,CAAC,SAAS;wDAC/B,kBAAkB,CAAC,MAAM;;;;;;iBAMhE,kBAAkB,CAAC,IAAI;4BACZ,kBAAkB,CAAC,GAAG;oBAC9B,kBAAkB,CAAC,EAAE;+BACV,kBAAkB,CAAC,MAAM;iCACvB,kBAAkB,CAAC,QAAQ;kCAC1B,kBAAkB,CAAC,SAAS;2BACnC,kBAAkB,CAAC,MAAM;;;;;;;;;;;;;;;mDAeD,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mEAAmE;uCAC3G,iBAAiB,IAAI,QAAQ;;EAElE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,+KAA+K,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;qCAcxK,eAAe;;;;;;;CAOnD,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAOtB;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAEzF,MAAM,WAAW,GAAG;QAClB,kCAAkC;QAClC,kBAAkB,SAAS,EAAE;QAC7B,2BAA2B;QAC3B,wBAAwB;QACxB,wBAAwB;QACxB,iBAAiB;QACjB,qCAAqC;QACrC,uEAAuE;QACvE,uBAAuB;QACvB,4BAA4B,kBAAkB,CAAC,IAAI,EAAE;QACrD,8BAA8B,kBAAkB,CAAC,MAAM,EAAE;QACzD,2BAA2B,kBAAkB,CAAC,GAAG,EAAE;QACnD,0BAA0B,kBAAkB,CAAC,EAAE,EAAE;QACjD,8BAA8B,kBAAkB,CAAC,MAAM,EAAE;QACzD,gCAAgC,kBAAkB,CAAC,QAAQ,EAAE;QAC7D,iCAAiC,kBAAkB,CAAC,SAAS,EAAE;QAC/D,aAAa,eAAe,EAAE;QAC9B,qCAAqC;QACrC,gCAAgC;QAChC,iCAAiC;QACjC,+BAA+B;QAC/B,yBAAyB;QACzB,mCAAmC;QACnC,iCAAiC;QACjC,gBAAgB;QAChB,gCAAgC;QAChC,EAAE;QACF,gDAAgD;QAChD,6BAA6B;QAC7B,sCAAsC;QACtC,iCAAiC;QACjC,iCAAiC;QACjC,8BAA8B;QAC9B,EAAE;QACF,kCAAkC;QAClC,cAAc,MAAM,EAAE;QACtB,EAAE;QACF,iCAAiC;KAClC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,OAAO;;;UAGC,SAAS;;;CAGlB,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IASxB;IACC,MAAM,EACJ,SAAS,EACT,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,MAAM,GACP,GAAG,IAAI,CAAC;IAET,MAAM,YAAY,GAAG,eAAe;QAClC,CAAC,CAAC,wBAAwB,eAAe,CAAC,QAAQ;sBAChC,sBAAsB,CAAC,eAAe,CAAC,UAAU,CAAC;6BAC3C,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC;CACjF;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;eAIM,SAAS;;;yBAGC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;iBAC5C,SAAS;oBACN,YAAY;wBACR,gBAAgB;4BACZ,mBAAmB;EAC7C,YAAY,sBAAsB,MAAM;CACzC,CAAC;AACF,CAAC;AAED,SAAS,8BAA8B,CACrC,QAA4B;IAE5B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IAChC,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,aAAa;SACd,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,uBAAuB,GAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU,CAAC;QAEvF,IAAI,CAAC,uBAAuB;YAAE,OAAO,IAAI,CAAC;QAE1C,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,aAAa;SACd,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,UAA6B;IACrD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,wBAAwB,CAAC,cAAwB;IACxD,MAAM,SAAS,GAAG;QAChB,gBAAgB;QAChB,oBAAoB;QACpB,qBAAqB;QACrB,kBAAkB;QAClB,GAAG,cAAc;KAClB,CAAC;IACF,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAElE,OAAO;;;EAGP,aAAa;CACd,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAoD;IACpF,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAE5C,OAAO;;;;eAIM,SAAS;;;;;;;;;;;;;;;mBAeL,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BjC,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,OAAO;;;;eAIM,SAAS;;;;;;;;;;;CAWvB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,IAIpB;IACC,MAAM,EAAE,gBAAgB,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAEzE,OAAO;;;;;;;;;;;;;;;;;gCAiBuB,gBAAgB;;;;2BAIrB,eAAe;;;;;;;;;;qDAUW,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiN3F,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,IAG/B;IACC,MAAM,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAEnD,OAAO;;;;;;;;;;;;;;gCAcuB,gBAAgB;;;;2BAIrB,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDzC,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;;;;;;;;;;;;;;;;;;;;CAoBR,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,gBAAwB;IACpD,OAAO;;;;;;;;;;;;;gCAauB,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;CAwB/C,CAAC;AACF,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;;;;;;;;;;;;;;;;CAgBR,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,YAAkC;IACvE,OAAO;;;;;;;;;;;;;;;;;;6BAkBoB,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;sGACqC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;uBAGnH,gBAAgB,CAAC,YAAY,CAAC,gBAAgB,CAAC;6FACuB,gBAAgB,CAAC,YAAY,CAAC,gBAAgB,CAAC;;;IAGxI,CAAC;AACL,CAAC;AAED,SAAS,kCAAkC;IACzC,OAAO;;;;;;;;;;;;;;;;;;;IAmBL,CAAC;AACL,CAAC;AAED,SAAS,iCAAiC,CAAC,YAAkC;IAC3E,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,eAAe,CAAC,uBAAuB,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC5D,MAAM,2BAA2B,GAAG,eAAe,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,wBAAwB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,gBAAgB,CAAC,cAAc,YAAY,CAAC,KAAK,OAAO,CAAC,CAAC;IAC/E,MAAM,YAAY,GAChB,YAAY,CAAC,cAAc,KAAK,SAAS;QACvC,CAAC,CAAC;;;;;;;;;wBASgB,WAAW;;;;;;;0BAOT,YAAY;;;UAG5B;QACJ,CAAC,CAAC;;;;;;;wBAOgB,WAAW;;;;UAIzB,CAAC;IAET,OAAO;;oCAE2B,KAAK;0CACC,eAAe;uCAClB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAyJ1B,YAAY;;;;;;;;;;;;;;;;;;;;;yBAqBZ,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;+BA0BN,YAAY,OAAO,YAAY;;;;;;;;;;;;;;;;;;;;;;;qCAuBzB,gBAAgB;;;;;;;;;;;;;;;;;;qCAkBhB,2BAA2B;;;;;;;;;;;;EAY9D,YAAY;;QAEN,YAAY,CAAC,cAAc;;;;;;2BAMR,YAAY;;;;;;;;;;;;;;2BAcZ,YAAY;;;;;;;;;;;;IAYnC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,IAKxB;IACC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACzF,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,sBAAsB,GAAG,YAAY,CAAC,OAAO;QACjD,CAAC,CAAC,iCAAiC,CAAC,YAAY,CAAC;QACjD,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;gCAauB,gBAAgB;;qDAEK,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;gCAG5D,iBAAiB,IAAI,EAAE;4BAC3B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwSjE,gBAAgB;;;;EAIhB,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;EAwBtB,kCAAkC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;CAwBrC,CAAC;AACF,CAAC;AAED,SAAS,yBAAyB,CAAC,IAIlC;IACC,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACrE,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,sBAAsB,GAAG,YAAY,CAAC,OAAO;QACjD,CAAC,CAAC,iCAAiC,CAAC,YAAY,CAAC;QACjD,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;gCAiBuB,iBAAiB,IAAI,EAAE;;4BAE3B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;yDAsBV,kBAAkB,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0gB9E,gBAAgB;;;;EAIhB,sBAAsB;;;;;;;;;;;;;;;;;;;;;EAqBtB,kCAAkC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+ErC,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO,QAAQ,SAAS,MAAM,CAAC;AACjC,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB;IAClD,MAAM,IAAI,GACR,wBAAwB;QACxB,8BAA8B,CAAC,SAAS,CAAC,GAAG,+BAA+B,CAAC;IAE9E,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,IAAI,GAAG,CAAC;QACb,EAAE,EAAE,IAAI,GAAG,CAAC;QACZ,MAAM,EAAE,IAAI,GAAG,CAAC;QAChB,QAAQ,EAAE,IAAI,GAAG,CAAC;QAClB,SAAS,EAAE,IAAI,GAAG,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,SAAiB;IACvD,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC,qCAAqC,CAAC,CAAC;IAClG,OAAO,CAAC,SAAS,GAAG,gCAAgC,CAAC,GAAG,gCAAgC,CAAC;AAC3F,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,gCAAgC,CAAC;IAC7E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IAChD,OAAO,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;AAC9F,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import type { GeneratedInfrastructureFile } from '../../../types';\nimport type { InfraManifestInput } from '../../../types';\nimport {\n  MANAGED_PROFILE_COLUMNS,\n  type ResolvedProfileModel,\n  resolveSupabaseProfileModel,\n} from '../auth/supabase/profile';\n\ninterface SupabaseLocalPorts {\n  base: number;\n  shadow: number;\n  api: number;\n  db: number;\n  studio: number;\n  inbucket: number;\n  analytics: number;\n}\n\ninterface AppInfraStorageMetadata {\n  provider: 'supabase';\n  bucketsCsv: string;\n  defaultBucket: string;\n}\n\nconst SUPABASE_LOCAL_PORT_BASE = 55320;\nconst SUPABASE_LOCAL_PORT_BUCKET_SIZE = 10;\nconst SUPABASE_LOCAL_PORT_BUCKET_COUNT = 1000;\nconst SUPABASE_LOCAL_PORT_REFERENCE_PROJECT = 'my-app';\n\nexport function generateMinikubeBaseArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n  supabaseProjectId: string | null;\n  extraResources: string[];\n  extraEnvEntries: string[];\n}): GeneratedInfrastructureFile[] {\n  const { manifest, namespace, supabaseProjectId, extraResources, extraEnvEntries } = args;\n\n  const root = 'infra/minikube';\n  const k8sRoot = `${root}/k8s`;\n  const scriptsRoot = `${root}/scripts`;\n  const appImageRoot = `${root}/app-image`;\n  const defaultAppImage = getDefaultAppImage(namespace);\n  const supabaseLocalPorts = resolveSupabaseLocalPorts(supabaseProjectId ?? namespace);\n\n  const authScope = manifest.auth?.scope ?? 'none';\n  const authProvider = manifest.auth?.provider ?? 'none';\n  const authzEngine = manifest.auth?.authorization?.engine ?? 'none';\n  const databaseProvider = manifest.database?.provider ?? 'none';\n  const secretStoreProvider = manifest.secretStore?.provider ?? 'none';\n  const storageMetadata = resolveAppInfraStorageMetadata(manifest);\n  const profileModel = resolveSupabaseProfileModel(manifest);\n  const monitoringEnabled = manifest.deployment?.monitoring === true;\n  const domain = manifest.networking?.domain ?? '';\n  const supabaseLocalEnabled =\n    authProvider === 'supabase' ||\n    databaseProvider === 'supabase' ||\n    storageMetadata !== null ||\n    secretStoreProvider === 'supabase-vault';\n\n  return [\n    {\n      path: `${root}/README.md`,\n      content: getReadmeMarkdown({\n        namespace,\n        defaultAppImage,\n        monitoringEnabled,\n        authProvider,\n        authzEngine,\n        extraResources,\n        supabaseLocalPorts,\n        supabaseProjectId,\n        supabaseLocalEnabled,\n        profileModel,\n      }),\n    },\n    {\n      path: `${root}/.env.example`,\n      content: getEnvExample({\n        namespace,\n        domain,\n        extraEnvEntries,\n        defaultAppImage,\n        supabaseLocalPorts,\n        supabaseLocalEnabled,\n      }),\n    },\n    {\n      path: `${k8sRoot}/namespace.yaml`,\n      content: getNamespaceManifest(namespace),\n    },\n    {\n      path: `${k8sRoot}/app.configmap.yaml`,\n      content: getAppConfigMap({\n        namespace,\n        authScope,\n        authProvider,\n        databaseProvider,\n        secretStoreProvider,\n        storageMetadata,\n        monitoringEnabled,\n        domain,\n      }),\n    },\n    {\n      path: `${k8sRoot}/app/deployment.yaml`,\n      content: getAppDeploymentManifest({ namespace, defaultAppImage }),\n    },\n    {\n      path: `${k8sRoot}/app/service.yaml`,\n      content: getAppServiceManifest(namespace),\n    },\n    {\n      path: `${k8sRoot}/kustomization.yaml`,\n      content: getKustomizationManifest(extraResources),\n    },\n    {\n      path: `${scriptsRoot}/up.sh`,\n      content: getUpScript({\n        defaultNamespace: namespace,\n        defaultAppImage,\n        supabaseLocalEnabled,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/build-app-image.sh`,\n      content: getBuildAppImageScript({ defaultNamespace: namespace, defaultAppImage }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/port-forward.sh`,\n      content: getPortForwardScript(namespace),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/down.sh`,\n      content: getDownScript(),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/status.sh`,\n      content: getStatusScript({\n        defaultNamespace: namespace,\n        supabaseProjectId,\n        supabaseLocalEnabled,\n        profileModel,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/supabase-local-env.sh`,\n      content: getSupabaseLocalEnvScript({\n        supabaseProjectId,\n        supabaseLocalPorts,\n        profileModel,\n      }),\n      executable: true,\n    },\n    {\n      path: `${appImageRoot}/Dockerfile`,\n      content: getAppImageDockerfile(),\n    },\n  ];\n}\n\nfunction getReadmeMarkdown(args: {\n  namespace: string;\n  defaultAppImage: string;\n  monitoringEnabled: boolean;\n  authProvider: string;\n  authzEngine: string;\n  extraResources: string[];\n  supabaseLocalPorts: SupabaseLocalPorts;\n  supabaseProjectId: string | null;\n  supabaseLocalEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n}): string {\n  const {\n    namespace,\n    defaultAppImage,\n    monitoringEnabled,\n    authProvider,\n    authzEngine,\n    extraResources,\n    supabaseLocalPorts,\n    supabaseProjectId,\n    supabaseLocalEnabled,\n    profileModel,\n  } = args;\n  const resourceLines = [\n    'namespace.yaml',\n    'app.configmap.yaml',\n    'app/deployment.yaml',\n    'app/service.yaml',\n    ...extraResources,\n  ]\n    .map((r) => `- \\`k8s/${r}\\``)\n    .join('\\n');\n\n  return `# Minikube Infra\n\nThis directory is generated from \\`ankh.config.json\\` (infra manifest).\n\n## Requirements\n\n- minikube\n- kubectl\n- docker (when using the default driver)\n- bun (for Expo web export in app image build flow)\n- python3 (for patching generated local Supabase port defaults and checking port availability)\n\n## Quick Start\n\n1. Copy env template:\n   \\`\\`\\`bash\n   cp .env.example .env\n   \\`\\`\\`\n2. Optional: import local Supabase credentials from \\`supabase status\\` output:\n   \\`\\`\\`bash\n   ./scripts/supabase-local-env.sh\n   \\`\\`\\`\n3. Apply baseline infra:\n   \\`\\`\\`bash\n   ./scripts/up.sh\n   \\`\\`\\`\n4. Start app port-forward:\n   \\`\\`\\`bash\n   ./scripts/port-forward.sh\n   \\`\\`\\`\n5. Check status:\n   \\`\\`\\`bash\n   ./scripts/status.sh\n   \\`\\`\\`\n6. Tear down:\n   \\`\\`\\`bash\n   ./scripts/down.sh\n   \\`\\`\\`\n\n## Generated Resources\n\n${resourceLines}\n\n## Generated Helpers\n\n- \\`scripts/build-app-image.sh\\`\n- \\`scripts/port-forward.sh\\`\n- \\`scripts/supabase-local-env.sh\\`\n- \\`app-image/Dockerfile\\`\n\n## Runtime Conventions\n\n- Namespace: \\`${namespace}\\`\n- Supabase local project identity: \\`${supabaseProjectId ?? 'unused'}\\`\n- Monitoring requested: \\`${monitoringEnabled ? 'true' : 'false'}\\`\n- Auth provider: \\`${authProvider}\\`\n- Authorization engine: \\`${authzEngine}\\`\n- Namespace source: \\`infra.networking.domain\\` first, otherwise project slug hint from CLI.\n\n## App Runtime\n\nDefault app runtime manifests are generated:\n\n- \\`k8s/app/deployment.yaml\\`\n- \\`k8s/app/service.yaml\\`\n\nDeployment env wiring includes:\n\n- \\`ConfigMap/app-infra-config\\`\n- \\`ConfigMap/app-runtime-auth-env\\` (optional)\n- \\`ConfigMap/app-runtime-storage-env\\` (optional)\n- \\`Secret/supabase-auth-secrets\\` (optional)\n\nIf \\`auth.provider\\` is \\`supabase\\`, use:\n\n- \\`k8s/auth/supabase/supabase-auth.secret.yaml\\`\n- \\`k8s/auth/supabase/app-runtime-auth.env.configmap.yaml\\`\n- \\`auth/supabase-runtime-wiring.md\\`\n\nThe app deployment should import runtime config sources in this order:\n\n\\`\\`\\`yaml\nenvFrom:\n  - configMapRef:\n      name: app-runtime-auth-env\n  - configMapRef:\n      name: app-runtime-storage-env\n  - secretRef:\n      name: supabase-auth-secrets\n\\`\\`\\`\n\nDefault runtime knobs in \\`.env\\`:\n\n- \\`APP_BUILD_ENABLED\\`\n- \\`APP_SOURCE_DIR\\`\n- \\`APP_WEB_EXPORT_DIR\\`\n- \\`APP_IMAGE\\`\n- \\`APP_IMAGE_SYNC_STRATEGY\\`\n- \\`APP_IMAGE_CLEANUP_ON_DOWN\\`\n- \\`APP_IMAGE_CLEANUP_MINIKUBE\\`\n- \\`APP_IMAGE_CLEANUP_DOCKER\\`\n- \\`AUTH_RUNTIME_MODE\\`\n- \\`APP_PORT_FORWARD_LOCAL_PORT\\`\n- \\`APP_PORT_FORWARD_REMOTE_PORT\\`\n- \\`APP_REPLICAS\\`\n- \\`APP_FORCE_ROLLOUT_RESTART\\`\n- \\`SUPABASE_PROJECT_DIR\\` (optional supabase CLI project path)\n- \\`SUPABASE_LOCAL_PORT_BASE\\` (generated default \\`${supabaseLocalPorts.base}\\`)\n- \\`SUPABASE_LOCAL_API_PORT\\` (generated default \\`${supabaseLocalPorts.api}\\`)\n- \\`SUPABASE_LOCAL_DB_PORT\\` (generated default \\`${supabaseLocalPorts.db}\\`)\n- \\`SUPABASE_LOCAL_STUDIO_PORT\\` (generated default \\`${supabaseLocalPorts.studio}\\`)\n- \\`SUPABASE_LOCAL_INBUCKET_PORT\\` (generated default \\`${supabaseLocalPorts.inbucket}\\`)\n- \\`SUPABASE_LOCAL_ANALYTICS_PORT\\` (generated default \\`${supabaseLocalPorts.analytics}\\`)\n- \\`SUPABASE_LOCAL_SHADOW_PORT\\` (generated default \\`${supabaseLocalPorts.shadow}\\`)\n- \\`APP_IMAGE_PULL_SECRET_NAME\\` + credentials (optional, private registry)\n- \\`SUPABASE_SECRET_SYNC_ENABLED\\`\n\nGenerated app Supabase local defaults:\n\n- Port base: \\`${supabaseLocalPorts.base}\\`\n- API: \\`http://127.0.0.1:${supabaseLocalPorts.api}\\`\n- DB: \\`127.0.0.1:${supabaseLocalPorts.db}\\`\n- Studio: \\`http://127.0.0.1:${supabaseLocalPorts.studio}\\`\n- Inbucket: \\`http://127.0.0.1:${supabaseLocalPorts.inbucket}\\`\n- Analytics: \\`http://127.0.0.1:${supabaseLocalPorts.analytics}\\`\n- Shadow DB: \\`127.0.0.1:${supabaseLocalPorts.shadow}\\`\n\nOverride with:\n\n- \\`SUPABASE_LOCAL_PORT_BASE\\`\n- \\`SUPABASE_LOCAL_API_PORT\\`\n- \\`SUPABASE_LOCAL_DB_PORT\\`\n- \\`SUPABASE_LOCAL_STUDIO_PORT\\`\n- \\`SUPABASE_LOCAL_INBUCKET_PORT\\`\n- \\`SUPABASE_LOCAL_ANALYTICS_PORT\\`\n- \\`SUPABASE_LOCAL_SHADOW_PORT\\`\n\nBuild flow:\n\n- \\`./scripts/up.sh\\` calls \\`./scripts/build-app-image.sh\\` when \\`APP_BUILD_ENABLED=true\\`.\n- Supabase local project root: \\`infra/minikube\\`${supabaseLocalEnabled ? '' : ' (unused unless Supabase-backed auth/database/storage is enabled)'}.\n- Supabase local project identity: \\`${supabaseProjectId ?? 'unused'}\\`; existing local configs with another \\`project_id\\` must be destroyed and recreated manually.\n- Immutable migrations live in \\`supabase/migrations/\\` and are applied with \\`supabase migration up --local\\`.\n${profileModel.enabled ? '- Generated profile desired-state reconciliation lives in `supabase/generated/auth_profiles.sql` and records checksum state in `ankhorage_internal.generated_schema_state`.\\n' : ''}- \\`./scripts/supabase-local-env.sh\\` can populate Supabase keys in \\`.env\\` from local \\`supabase status -o env\\`.\n- \\`./scripts/supabase-local-env.sh\\` writes \\`EXPO_PUBLIC_SUPABASE_URL\\` + \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\` into \\`$APP_SOURCE_DIR/.env.local\\` (e.g. \\`apps/card/.env.local\\`) for local app runs.\n- With \\`AUTH_RUNTIME_MODE=local\\` (default), \\`up.sh\\` runs \\`supabase-local-env.sh\\` before app/Kubernetes startup when Supabase-backed local services are enabled.\n- \\`supabase-local-env.sh\\` checks configured host ports before starting a missing local Supabase stack.\n- \\`build-app-image.sh\\` runs \\`bunx expo export --platform web\\` from app source.\n- \\`app-image/Dockerfile\\` builds an nginx image from exported web artifacts.\n- \\`build-app-image.sh\\` labels the generated Docker image with Ankhorage metadata for diagnostics.\n- \\`up.sh\\` syncs runtime image by strategy:\n  - \\`APP_IMAGE_SYNC_STRATEGY=docker-load\\` (default): load prebuilt local Docker image into Minikube.\n  - \\`APP_IMAGE_SYNC_STRATEGY=minikube-build\\`: build directly into Minikube image store.\n  - \\`APP_IMAGE_SYNC_STRATEGY=none\\`: skip local image sync.\n- \\`up.sh\\` applies image/replica changes and (by default) restarts \\`deployment/app-runtime\\`.\n- If Supabase keys are provided, \\`up.sh\\` syncs \\`Secret/supabase-auth-secrets\\` from env.\n\nDefault generated app image tag: \\`${defaultAppImage}\\`.\n\n## Notes\n\n- Auth/database/authorization resources are generated in adapter modules.\n- Cerbos route/screen policies derive from app navigator + authFlow intent when available.\n- Re-generate infra by saving the manifest or calling the bridge infra endpoint.\n`;\n}\n\nfunction getEnvExample(args: {\n  namespace: string;\n  domain: string;\n  extraEnvEntries: string[];\n  defaultAppImage: string;\n  supabaseLocalPorts: SupabaseLocalPorts;\n  supabaseLocalEnabled: boolean;\n}): string {\n  const { namespace, domain, extraEnvEntries, defaultAppImage, supabaseLocalPorts } = args;\n\n  const baseEntries = [\n    '# Minikube runtime configuration',\n    `ANKH_NAMESPACE=${namespace}`,\n    'MINIKUBE_PROFILE=minikube',\n    'MINIKUBE_DRIVER=docker',\n    'APP_BUILD_ENABLED=true',\n    'APP_SOURCE_DIR=',\n    'APP_WEB_EXPORT_DIR=.ankh/web-export',\n    '# Canonical Supabase project root. Leave empty to use infra/minikube.',\n    'SUPABASE_PROJECT_DIR=',\n    `SUPABASE_LOCAL_PORT_BASE=${supabaseLocalPorts.base}`,\n    `SUPABASE_LOCAL_SHADOW_PORT=${supabaseLocalPorts.shadow}`,\n    `SUPABASE_LOCAL_API_PORT=${supabaseLocalPorts.api}`,\n    `SUPABASE_LOCAL_DB_PORT=${supabaseLocalPorts.db}`,\n    `SUPABASE_LOCAL_STUDIO_PORT=${supabaseLocalPorts.studio}`,\n    `SUPABASE_LOCAL_INBUCKET_PORT=${supabaseLocalPorts.inbucket}`,\n    `SUPABASE_LOCAL_ANALYTICS_PORT=${supabaseLocalPorts.analytics}`,\n    `APP_IMAGE=${defaultAppImage}`,\n    'APP_IMAGE_SYNC_STRATEGY=docker-load',\n    'APP_IMAGE_CLEANUP_ON_DOWN=true',\n    'APP_IMAGE_CLEANUP_MINIKUBE=true',\n    'APP_IMAGE_CLEANUP_DOCKER=true',\n    'AUTH_RUNTIME_MODE=local',\n    'APP_PORT_FORWARD_LOCAL_PORT=18080',\n    'APP_PORT_FORWARD_REMOTE_PORT=80',\n    'APP_REPLICAS=1',\n    'APP_FORCE_ROLLOUT_RESTART=true',\n    '',\n    '# Optional private registry auth for APP_IMAGE',\n    'APP_IMAGE_PULL_SECRET_NAME=',\n    'APP_IMAGE_PULL_SECRET_SERVER=ghcr.io',\n    'APP_IMAGE_PULL_SECRET_USERNAME=',\n    'APP_IMAGE_PULL_SECRET_PASSWORD=',\n    'APP_IMAGE_PULL_SECRET_EMAIL=',\n    '',\n    '# Optional app networking domain',\n    `APP_DOMAIN=${domain}`,\n    '',\n    '# Adapter-provided runtime keys',\n  ];\n\n  const merged = [...baseEntries, ...extraEnvEntries];\n  const unique: string[] = [];\n  for (const entry of merged) {\n    if (!unique.includes(entry)) unique.push(entry);\n  }\n\n  return `${unique.join('\\n')}\\n`;\n}\n\nfunction getNamespaceManifest(namespace: string): string {\n  return `apiVersion: v1\nkind: Namespace\nmetadata:\n  name: ${namespace}\n  labels:\n    app.kubernetes.io/part-of: ankhorage\n`;\n}\n\nfunction getAppConfigMap(args: {\n  namespace: string;\n  authScope: string;\n  authProvider: string;\n  databaseProvider: string;\n  secretStoreProvider: string;\n  storageMetadata: AppInfraStorageMetadata | null;\n  monitoringEnabled: boolean;\n  domain: string;\n}): string {\n  const {\n    namespace,\n    authScope,\n    authProvider,\n    databaseProvider,\n    secretStoreProvider,\n    storageMetadata,\n    monitoringEnabled,\n    domain,\n  } = args;\n\n  const storageLines = storageMetadata\n    ? `  STORAGE_PROVIDER: \"${storageMetadata.provider}\"\n  STORAGE_BUCKETS: \"${escapeYamlDoubleQuoted(storageMetadata.bucketsCsv)}\"\n  STORAGE_DEFAULT_BUCKET: \"${escapeYamlDoubleQuoted(storageMetadata.defaultBucket)}\"\n`\n    : '';\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-infra-config\n  namespace: ${namespace}\ndata:\n  DEPLOYMENT_TARGET: \"minikube\"\n  MONITORING_ENABLED: \"${monitoringEnabled ? 'true' : 'false'}\"\n  AUTH_SCOPE: \"${authScope}\"\n  AUTH_PROVIDER: \"${authProvider}\"\n  DATABASE_PROVIDER: \"${databaseProvider}\"\n  SECRET_STORE_PROVIDER: \"${secretStoreProvider}\"\n${storageLines}  NETWORK_DOMAIN: \"${domain}\"\n`;\n}\n\nfunction resolveAppInfraStorageMetadata(\n  manifest: InfraManifestInput,\n): AppInfraStorageMetadata | null {\n  const spec = manifest.storage;\n  if (!spec) return null;\n\n  const buckets = normalizeBuckets(spec.buckets);\n  if (buckets.length === 0) return null;\n  const [defaultBucket] = buckets;\n  if (!defaultBucket) return null;\n\n  if (spec.provider === 'supabase') {\n    return {\n      provider: 'supabase',\n      bucketsCsv: buckets.join(','),\n      defaultBucket,\n    };\n  }\n\n  if (spec.provider === 'auto') {\n    const shouldResolveToSupabase =\n      manifest.database?.provider === 'supabase' || manifest.auth?.provider === 'supabase';\n\n    if (!shouldResolveToSupabase) return null;\n\n    return {\n      provider: 'supabase',\n      bucketsCsv: buckets.join(','),\n      defaultBucket,\n    };\n  }\n\n  return null;\n}\n\nfunction normalizeBuckets(rawBuckets: readonly string[]): string[] {\n  const normalized: string[] = [];\n  const seen = new Set<string>();\n\n  for (const raw of rawBuckets) {\n    const bucket = raw.trim();\n    if (!bucket) continue;\n    if (seen.has(bucket)) continue;\n    seen.add(bucket);\n    normalized.push(bucket);\n  }\n\n  return normalized;\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n\nfunction getKustomizationManifest(extraResources: string[]): string {\n  const resources = [\n    'namespace.yaml',\n    'app.configmap.yaml',\n    'app/deployment.yaml',\n    'app/service.yaml',\n    ...extraResources,\n  ];\n  const resourceLines = resources.map((r) => `  - ${r}`).join('\\n');\n\n  return `apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n${resourceLines}\n`;\n}\n\nfunction getAppDeploymentManifest(args: { namespace: string; defaultAppImage: string }): string {\n  const { namespace, defaultAppImage } = args;\n\n  return `apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: app-runtime\n  namespace: ${namespace}\n  labels:\n    app.kubernetes.io/name: app-runtime\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: app-runtime\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: app-runtime\n    spec:\n      containers:\n        - name: app\n          image: ${defaultAppImage}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 8080\n              name: http\n          envFrom:\n            - configMapRef:\n                name: app-infra-config\n            - configMapRef:\n                name: app-runtime-auth-env\n                optional: true\n            - configMapRef:\n                name: app-runtime-storage-env\n                optional: true\n            - secretRef:\n                name: supabase-auth-secrets\n                optional: true\n          readinessProbe:\n            httpGet:\n              path: /\n              port: http\n            initialDelaySeconds: 5\n            periodSeconds: 10\n          livenessProbe:\n            httpGet:\n              path: /\n              port: http\n            initialDelaySeconds: 15\n            periodSeconds: 20\n`;\n}\n\nfunction getAppServiceManifest(namespace: string): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: app-runtime\n  namespace: ${namespace}\n  labels:\n    app.kubernetes.io/name: app-runtime\nspec:\n  type: ClusterIP\n  selector:\n    app.kubernetes.io/name: app-runtime\n  ports:\n    - name: http\n      port: 80\n      targetPort: http\n`;\n}\n\nfunction getUpScript(args: {\n  defaultNamespace: string;\n  defaultAppImage: string;\n  supabaseLocalEnabled: boolean;\n}): string {\n  const { defaultNamespace, defaultAppImage, supabaseLocalEnabled } = args;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nK8S_DIR=\"\\${ROOT_DIR}/k8s\"\nBUILD_SCRIPT=\"\\${SCRIPT_DIR}/build-app-image.sh\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nPROFILE=\"\\${MINIKUBE_PROFILE:-minikube}\"\nDRIVER=\"\\${MINIKUBE_DRIVER:-docker}\"\nNAMESPACE=\"\\${ANKH_NAMESPACE:-${defaultNamespace}}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-true}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-$(cd \"\\${ROOT_DIR}/../..\" && pwd)}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-.ankh/web-export}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-${defaultAppImage}}\"\nAPP_IMAGE_SYNC_STRATEGY=\"\\${APP_IMAGE_SYNC_STRATEGY:-docker-load}\"\nAPP_REPLICAS=\"\\${APP_REPLICAS:-1}\"\nAPP_FORCE_ROLLOUT_RESTART=\"\\${APP_FORCE_ROLLOUT_RESTART:-true}\"\nAPP_IMAGE_PULL_SECRET_NAME=\"\\${APP_IMAGE_PULL_SECRET_NAME:-}\"\nAPP_IMAGE_PULL_SECRET_SERVER=\"\\${APP_IMAGE_PULL_SECRET_SERVER:-ghcr.io}\"\nAPP_IMAGE_PULL_SECRET_USERNAME=\"\\${APP_IMAGE_PULL_SECRET_USERNAME:-}\"\nAPP_IMAGE_PULL_SECRET_PASSWORD=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD:-}\"\nAPP_IMAGE_PULL_SECRET_EMAIL=\"\\${APP_IMAGE_PULL_SECRET_EMAIL:-}\"\nAUTH_RUNTIME_MODE=\"\\${AUTH_RUNTIME_MODE:-local}\"\nSUPABASE_LOCAL_ENABLED=\"\\${SUPABASE_LOCAL_ENABLED:-${supabaseLocalEnabled ? 'true' : 'false'}}\"\nSUPABASE_SECRET_SYNC_ENABLED=\"\\${SUPABASE_SECRET_SYNC_ENABLED:-true}\"\nSUPABASE_LOCAL_ENV_SCRIPT=\"\\${SCRIPT_DIR}/supabase-local-env.sh\"\nSUPABASE_URL=\"\\${SUPABASE_URL:-}\"\nSUPABASE_ANON_KEY=\"\\${SUPABASE_ANON_KEY:-}\"\nSUPABASE_SERVICE_ROLE_KEY=\"\\${SUPABASE_SERVICE_ROLE_KEY:-}\"\nSUPABASE_JWT_SECRET=\"\\${SUPABASE_JWT_SECRET:-}\"\nSUPABASE_PUBLIC_URL=\"\\${EXPO_PUBLIC_SUPABASE_URL:-\\${SUPABASE_URL}}\"\nSUPABASE_PUBLIC_ANON_KEY=\"\\${EXPO_PUBLIC_SUPABASE_ANON_KEY:-\\${SUPABASE_ANON_KEY}}\"\n\nrefresh_supabase_env() {\n  SUPABASE_URL=\"\\${SUPABASE_URL:-}\"\n  SUPABASE_ANON_KEY=\"\\${SUPABASE_ANON_KEY:-}\"\n  SUPABASE_SERVICE_ROLE_KEY=\"\\${SUPABASE_SERVICE_ROLE_KEY:-}\"\n  SUPABASE_JWT_SECRET=\"\\${SUPABASE_JWT_SECRET:-}\"\n  SUPABASE_PUBLIC_URL=\"\\${EXPO_PUBLIC_SUPABASE_URL:-\\${SUPABASE_URL}}\"\n  SUPABASE_PUBLIC_ANON_KEY=\"\\${EXPO_PUBLIC_SUPABASE_ANON_KEY:-\\${SUPABASE_ANON_KEY}}\"\n}\n\nhas_required_supabase_env() {\n  [[ -n \"\\${SUPABASE_URL}\" && -n \"\\${SUPABASE_ANON_KEY}\" && -n \"\\${SUPABASE_SERVICE_ROLE_KEY}\" && -n \"\\${SUPABASE_JWT_SECRET}\" ]]\n}\n\nrefresh_supabase_env\n\nif [[ \"\\${AUTH_RUNTIME_MODE}\" != \"local\" && \"\\${AUTH_RUNTIME_MODE}\" != \"remote\" ]]; then\n  echo \"Unsupported AUTH_RUNTIME_MODE=\\${AUTH_RUNTIME_MODE}. Use local or remote.\"\n  exit 1\nfi\n\nif ! command -v minikube >/dev/null 2>&1; then\n  echo \"minikube is required but not installed.\"\n  exit 1\nfi\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"kubectl is required but not installed.\"\n  exit 1\nfi\n\nHOST_STATUS=\"$(minikube -p \"\\${PROFILE}\" status --format='{{.Host}}' 2>/dev/null || true)\"\nif [[ \"\\${HOST_STATUS}\" != \"Running\" ]]; then\n  minikube start -p \"\\${PROFILE}\" --driver=\"\\${DRIVER}\"\nfi\n\nif [[ \"\\${AUTH_RUNTIME_MODE}\" == \"local\" && \"\\${SUPABASE_LOCAL_ENABLED}\" == \"true\" ]]; then\n  if [[ ! -x \"\\${SUPABASE_LOCAL_ENV_SCRIPT}\" ]]; then\n    echo \"Supabase local bootstrap failed: missing executable \\${SUPABASE_LOCAL_ENV_SCRIPT}.\"\n    exit 1\n  else\n    echo \"Running local Supabase bootstrap, immutable migrations, generated reconciliation, and schema verification.\"\n    if ! \"\\${SUPABASE_LOCAL_ENV_SCRIPT}\"; then\n      echo \"Supabase local bootstrap failed.\"\n      exit 1\n    fi\n    if [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n      set -a\n      # shellcheck disable=SC1090\n      source \"\\${ROOT_DIR}/.env\"\n      set +a\n    fi\n    refresh_supabase_env\n  fi\nfi\n\nif [[ \"\\${APP_BUILD_ENABLED}\" == \"true\" ]]; then\n  if [[ ! -x \"\\${BUILD_SCRIPT}\" ]]; then\n    echo \"Missing build helper script: \\${BUILD_SCRIPT}\"\n    exit 1\n  fi\n\n  \"\\${BUILD_SCRIPT}\"\nfi\n\nif [[ \"\\${APP_WEB_EXPORT_DIR}\" = /* ]]; then\n  EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR}\"\nelse\n  EXPORT_DIR=\"\\${APP_SOURCE_DIR}/\\${APP_WEB_EXPORT_DIR}\"\nfi\n\ndocker_load_image_to_minikube() {\n  if command -v docker >/dev/null 2>&1 && docker image inspect \"\\${APP_IMAGE}\" >/dev/null 2>&1; then\n    minikube -p \"\\${PROFILE}\" image load --daemon=true --overwrite=true \"\\${APP_IMAGE}\" >/dev/null\n    return 0\n  fi\n\n  return 1\n}\n\ncase \"\\${APP_IMAGE_SYNC_STRATEGY}\" in\n  minikube-build)\n    if [[ ! -f \"\\${EXPORT_DIR}/index.html\" ]]; then\n      echo \"Expected web export output not found at \\${EXPORT_DIR}/index.html\"\n      echo \"Run build-app-image.sh first or switch APP_IMAGE_SYNC_STRATEGY=docker-load.\"\n      exit 1\n    fi\n\n    if minikube -p \"\\${PROFILE}\" image build -t \"\\${APP_IMAGE}\" -f \"\\${ROOT_DIR}/app-image/Dockerfile\" \"\\${EXPORT_DIR}\" >/dev/null; then\n      if ! minikube -p \"\\${PROFILE}\" image ls 2>/dev/null | grep -Fq \"\\${APP_IMAGE}\"; then\n        echo \"minikube image build did not register \\${APP_IMAGE}; falling back to docker-load.\"\n        if ! docker_load_image_to_minikube; then\n          echo \"Fallback docker-load failed: local Docker image \\${APP_IMAGE} not found.\"\n          exit 1\n        fi\n      fi\n    else\n      echo \"minikube image build failed for \\${APP_IMAGE}; falling back to docker-load.\"\n      if ! docker_load_image_to_minikube; then\n        echo \"Fallback docker-load failed: local Docker image \\${APP_IMAGE} not found.\"\n        exit 1\n      fi\n    fi\n    ;;\n  docker-load)\n    if ! docker_load_image_to_minikube; then\n      echo \"Skipping docker-load image sync; local Docker image \\${APP_IMAGE} not found.\"\n    fi\n    ;;\n  none)\n    echo \"Skipping local image sync (APP_IMAGE_SYNC_STRATEGY=none).\"\n    ;;\n  *)\n    echo \"Unsupported APP_IMAGE_SYNC_STRATEGY=\\${APP_IMAGE_SYNC_STRATEGY}. Use minikube-build, docker-load, or none.\"\n    exit 1\n    ;;\nesac\n\nkubectl apply -k \"\\${K8S_DIR}\"\n\nif [[ \"\\${SUPABASE_SECRET_SYNC_ENABLED}\" == \"true\" ]]; then\n  if ! has_required_supabase_env && [[ \"\\${AUTH_RUNTIME_MODE}\" == \"local\" && \"\\${SUPABASE_LOCAL_ENABLED}\" == \"true\" ]]; then\n    if [[ ! -x \"\\${SUPABASE_LOCAL_ENV_SCRIPT}\" ]]; then\n      echo \"Supabase local bootstrap failed: missing executable \\${SUPABASE_LOCAL_ENV_SCRIPT}.\"\n      exit 1\n    else\n      echo \"Supabase keys missing; running \\${SUPABASE_LOCAL_ENV_SCRIPT}.\"\n      if ! \"\\${SUPABASE_LOCAL_ENV_SCRIPT}\"; then\n        echo \"Supabase local bootstrap failed.\"\n        exit 1\n      fi\n      if [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n        set -a\n        # shellcheck disable=SC1090\n        source \"\\${ROOT_DIR}/.env\"\n        set +a\n      fi\n      refresh_supabase_env\n    fi\n  fi\n\n  if ! has_required_supabase_env; then\n    if [[ \"\\${AUTH_RUNTIME_MODE}\" == \"local\" ]]; then\n      echo \"Supabase secret sync skipped: local credentials still missing after bootstrap.\"\n      echo \"Run ./scripts/supabase-local-env.sh and retry.\"\n    else\n      echo \"Supabase secret sync skipped: set SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY, and SUPABASE_JWT_SECRET in .env.\"\n    fi\n  else\n    TMP_SUPABASE_ENV_FILE=\"$(mktemp)\"\n    trap 'rm -f \"\\${TMP_SUPABASE_ENV_FILE}\"' EXIT\n\n    cat > \"\\${TMP_SUPABASE_ENV_FILE}\" <<EOF\nSUPABASE_URL=\\${SUPABASE_URL}\nSUPABASE_ANON_KEY=\\${SUPABASE_ANON_KEY}\nSUPABASE_SERVICE_ROLE_KEY=\\${SUPABASE_SERVICE_ROLE_KEY}\nSUPABASE_JWT_SECRET=\\${SUPABASE_JWT_SECRET}\nEXPO_PUBLIC_SUPABASE_URL=\\${SUPABASE_PUBLIC_URL}\nEXPO_PUBLIC_SUPABASE_ANON_KEY=\\${SUPABASE_PUBLIC_ANON_KEY}\nEOF\n\n    kubectl -n \"\\${NAMESPACE}\" create secret generic supabase-auth-secrets --from-env-file=\"\\${TMP_SUPABASE_ENV_FILE}\" --dry-run=client -o yaml | kubectl -n \"\\${NAMESPACE}\" apply -f -\n\n    rm -f \"\\${TMP_SUPABASE_ENV_FILE}\"\n    trap - EXIT\n    echo \"Synchronized supabase-auth-secrets from environment values.\"\n  fi\nfi\n\nif [[ -n \"\\${APP_IMAGE_PULL_SECRET_NAME}\" ]]; then\n  if [[ -z \"\\${APP_IMAGE_PULL_SECRET_USERNAME}\" || -z \"\\${APP_IMAGE_PULL_SECRET_PASSWORD}\" ]]; then\n    echo \"APP_IMAGE_PULL_SECRET_NAME is set, but username/password are missing.\"\n    exit 1\n  fi\n\n  SECRET_EMAIL_ARG=()\n  if [[ -n \"\\${APP_IMAGE_PULL_SECRET_EMAIL}\" ]]; then\n    SECRET_EMAIL_ARG=(--docker-email=\"\\${APP_IMAGE_PULL_SECRET_EMAIL}\")\n  fi\n\n  kubectl -n \"\\${NAMESPACE}\" create secret docker-registry \"\\${APP_IMAGE_PULL_SECRET_NAME}\" --docker-server=\"\\${APP_IMAGE_PULL_SECRET_SERVER}\" --docker-username=\"\\${APP_IMAGE_PULL_SECRET_USERNAME}\" --docker-password=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD}\" \"\\${SECRET_EMAIL_ARG[@]}\" --dry-run=client -o yaml | kubectl -n \"\\${NAMESPACE}\" apply -f -\n\n  PULL_SECRET_PATCH=\"$(cat <<EOF\n{\"spec\":{\"template\":{\"spec\":{\"imagePullSecrets\":[{\"name\":\"\\${APP_IMAGE_PULL_SECRET_NAME}\"}]}}}}\nEOF\n)\"\n  kubectl -n \"\\${NAMESPACE}\" patch deployment app-runtime --type=merge --patch \"\\${PULL_SECRET_PATCH}\" >/dev/null\nelse\n  kubectl -n \"\\${NAMESPACE}\" patch deployment app-runtime --type=json --patch='[{\"op\":\"remove\",\"path\":\"/spec/template/spec/imagePullSecrets\"}]' >/dev/null 2>&1 || true\nfi\n\nkubectl -n \"\\${NAMESPACE}\" set image deployment/app-runtime app=\"\\${APP_IMAGE}\" >/dev/null\nkubectl -n \"\\${NAMESPACE}\" scale deployment/app-runtime --replicas=\"\\${APP_REPLICAS}\" >/dev/null\n\nif [[ \"\\${APP_FORCE_ROLLOUT_RESTART}\" == \"true\" ]]; then\n  kubectl -n \"\\${NAMESPACE}\" rollout restart deployment/app-runtime >/dev/null\nfi\n\nkubectl -n \"\\${NAMESPACE}\" rollout status deployment/app-runtime --timeout=180s >/dev/null\necho \"Minikube infrastructure applied.\"\n`;\n}\n\nfunction getBuildAppImageScript(args: {\n  defaultNamespace: string;\n  defaultAppImage: string;\n}): string {\n  const { defaultNamespace, defaultAppImage } = args;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nDOCKERFILE_PATH=\"\\${ROOT_DIR}/app-image/Dockerfile\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nNAMESPACE=\"\\${ANKH_NAMESPACE:-${defaultNamespace}}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-true}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-$(cd \"\\${ROOT_DIR}/../..\" && pwd)}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-.ankh/web-export}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-${defaultAppImage}}\"\n\nif [[ \"\\${APP_BUILD_ENABLED}\" != \"true\" ]]; then\n  echo \"Skipping app image build (APP_BUILD_ENABLED=\\${APP_BUILD_ENABLED}).\"\n  exit 0\nfi\n\nif ! command -v docker >/dev/null 2>&1; then\n  echo \"docker is required to build app image.\"\n  exit 1\nfi\n\nif ! command -v bunx >/dev/null 2>&1; then\n  echo \"bunx is required to export the app for container image build.\"\n  exit 1\nfi\n\nif [[ ! -f \"\\${APP_SOURCE_DIR}/package.json\" ]]; then\n  echo \"APP_SOURCE_DIR does not look like an app root: \\${APP_SOURCE_DIR}\"\n  exit 1\nfi\n\nif [[ ! -f \"\\${DOCKERFILE_PATH}\" ]]; then\n  echo \"Dockerfile for app image build is missing: \\${DOCKERFILE_PATH}\"\n  exit 1\nfi\n\n(\n  cd \"\\${APP_SOURCE_DIR}\"\n  bunx expo export --platform web --output-dir \"\\${APP_WEB_EXPORT_DIR}\"\n)\n\nif [[ \"\\${APP_WEB_EXPORT_DIR}\" = /* ]]; then\n  EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR}\"\nelse\n  EXPORT_DIR=\"\\${APP_SOURCE_DIR}/\\${APP_WEB_EXPORT_DIR}\"\nfi\n\nif [[ ! -f \"\\${EXPORT_DIR}/index.html\" ]]; then\n  echo \"Expected web export output not found at \\${EXPORT_DIR}/index.html\"\n  exit 1\nfi\n\ndocker build -t \"\\${APP_IMAGE}\" \\\n  --label \"ankhorage.kind=generated-app\" \\\n  --label \"ankhorage.namespace=\\${NAMESPACE}\" \\\n  --label \"ankhorage.image=\\${APP_IMAGE}\" \\\n  -f \"\\${DOCKERFILE_PATH}\" \\\n  \"\\${EXPORT_DIR}\"\necho \"Built app image: \\${APP_IMAGE} (namespace: \\${NAMESPACE})\"\n`;\n}\n\nfunction getAppImageDockerfile(): string {\n  return `FROM nginx:1.27-alpine\n\nRUN cat <<'EOF' > /etc/nginx/conf.d/default.conf\nserver {\n  listen 8080;\n  server_name _;\n  root /usr/share/nginx/html;\n  index index.html;\n\n  location / {\n    try_files $uri $uri/ /index.html;\n  }\n}\nEOF\n\nCOPY . /usr/share/nginx/html\n\nEXPOSE 8080\n\nCMD [\"nginx\", \"-g\", \"daemon off;\"]\n`;\n}\n\nfunction getPortForwardScript(defaultNamespace: string): string {\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nNAMESPACE=\"\\${ANKH_NAMESPACE:-${defaultNamespace}}\"\nLOCAL_PORT=\"\\${APP_PORT_FORWARD_LOCAL_PORT:-18080}\"\nREMOTE_PORT=\"\\${APP_PORT_FORWARD_REMOTE_PORT:-80}\"\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"kubectl is required but not installed.\"\n  exit 1\nfi\n\nif ! kubectl get namespace \"\\${NAMESPACE}\" >/dev/null 2>&1; then\n  echo \"Namespace '\\${NAMESPACE}' was not found.\"\n  echo \"Run ./scripts/up.sh to create infrastructure first.\"\n  exit 1\nfi\n\nif ! kubectl -n \"\\${NAMESPACE}\" get service app-runtime >/dev/null 2>&1; then\n  echo \"Service 'app-runtime' was not found in namespace '\\${NAMESPACE}'.\"\n  echo \"Run ./scripts/up.sh to apply runtime resources.\"\n  exit 1\nfi\n\necho \"Forwarding app-runtime from namespace '\\${NAMESPACE}' to http://127.0.0.1:\\${LOCAL_PORT}\"\necho \"Press Ctrl+C to stop.\"\nkubectl -n \"\\${NAMESPACE}\" port-forward service/app-runtime \"\\${LOCAL_PORT}:\\${REMOTE_PORT}\"\n`;\n}\n\nfunction getDownScript(): string {\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nK8S_DIR=\"\\${ROOT_DIR}/k8s\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nkubectl delete -k \"\\${K8S_DIR}\" --ignore-not-found\necho \"Minikube infrastructure removed.\"\n`;\n}\n\nfunction getSupabaseProfileChecksumSql(profileModel: ResolvedProfileModel): string {\n  return `do $$\ndeclare\n  actual_hash text;\n  actual_table_name text;\nbegin\n  if to_regclass('ankhorage_internal.generated_schema_state') is null then\n    raise exception 'missing ankhorage_internal.generated_schema_state';\n  end if;\n\n  select content_hash, table_name\n    into actual_hash, actual_table_name\n    from ankhorage_internal.generated_schema_state\n    where artifact_key = 'auth.profile';\n\n  if actual_hash is null then\n    raise exception 'missing generated schema state for auth.profile';\n  end if;\n\n  if actual_table_name <> '${escapeSqlLiteral(profileModel.table)}' then\n    raise exception 'generated schema state table mismatch for auth.profile: expected %, found %', '${escapeSqlLiteral(profileModel.table)}', actual_table_name;\n  end if;\n\n  if actual_hash <> '${escapeSqlLiteral(profileModel.desiredStateHash)}' then\n    raise exception 'stale generated schema state for auth.profile: expected %, found %', '${escapeSqlLiteral(profileModel.desiredStateHash)}', actual_hash;\n  end if;\nend;\n$$;`;\n}\n\nfunction getSupabaseProfileDisabledGuardSql(): string {\n  return `do $$\ndeclare\n  has_profile_state boolean := false;\nbegin\n  if to_regclass('ankhorage_internal.generated_schema_state') is not null then\n    execute\n      'select exists (\n         select 1\n         from ankhorage_internal.generated_schema_state\n         where artifact_key = $1\n       )'\n      into has_profile_state\n      using 'auth.profile';\n  end if;\n\n  if has_profile_state then\n    raise exception 'manifest auth.profile.table was removed but local generated auth.profile state still exists; reset local Supabase or add an explicit cleanup migration';\n  end if;\nend;\n$$;`;\n}\n\nfunction getSupabaseProfileVerificationSql(profileModel: ResolvedProfileModel): string {\n  const configuredColumns = profileModel.columns.map((column) => column.column);\n  const configuredArray = getSqlTextArray(configuredColumns);\n  const managedArray = getSqlTextArray(MANAGED_PROFILE_COLUMNS);\n  const updateGrantArray = getSqlTextArray(configuredColumns);\n  const protectedUpdateColumnsArray = getSqlTextArray(['id', 'created_at', 'updated_at', 'role']);\n  const table = escapeSqlLiteral(profileModel.table);\n  const selectPolicy = escapeSqlLiteral(`${profileModel.table}_select_own`);\n  const updatePolicy = escapeSqlLiteral(`${profileModel.table}_update_own`);\n  const triggerName = escapeSqlLiteral(`on_auth_user_created_${profileModel.table}`);\n  const functionName = escapeSqlLiteral(`handle_new_${profileModel.table}_user`);\n  const triggerCheck =\n    profileModel.createStrategy === 'trigger'\n      ? `  if not exists (\n    select 1\n    from pg_trigger t\n    join pg_class rel on rel.oid = t.tgrelid\n    join pg_namespace rel_ns on rel_ns.oid = rel.relnamespace\n    join pg_proc fn on fn.oid = t.tgfoid\n    join pg_namespace fn_ns on fn_ns.oid = fn.pronamespace\n    where rel_ns.nspname = 'auth'\n      and rel.relname = 'users'\n      and t.tgname = '${triggerName}'\n      and not t.tgisinternal\n      and t.tgenabled = 'O'\n      and (t.tgtype::integer & 1) = 1\n      and (t.tgtype::integer & 4) = 4\n      and (t.tgtype::integer & (2 | 8 | 16 | 32)) = 0\n      and fn_ns.nspname = 'public'\n      and fn.proname = '${functionName}'\n  ) then\n    raise exception 'missing generated new-user profile trigger';\n  end if;`\n      : `  if exists (\n    select 1\n    from pg_trigger t\n    join pg_class rel on rel.oid = t.tgrelid\n    join pg_namespace rel_ns on rel_ns.oid = rel.relnamespace\n    where rel_ns.nspname = 'auth'\n      and rel.relname = 'users'\n      and t.tgname = '${triggerName}'\n      and not t.tgisinternal\n  ) then\n    raise exception 'generated new-user profile trigger exists but createStrategy is not trigger';\n  end if;`;\n\n  return `do $$\ndeclare\n  profile_table constant text := '${table}';\n  configured_columns constant text[] := ${configuredArray};\n  managed_columns constant text[] := ${managedArray};\n  expected_column text;\nbegin\n  if to_regclass('auth.users') is null then\n    raise exception 'missing auth.users';\n  end if;\n\n  if to_regclass('public.users') is not null then\n    raise exception 'reserved conflicting identity table public.users exists';\n  end if;\n\n  if to_regclass(format('public.%I', profile_table)) is null then\n    raise exception 'missing configured profile table public.%', profile_table;\n  end if;\n\n  if not exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = format('public.%I', profile_table)::regclass\n      and c.contype = 'p'\n      and c.conkey = array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = format('public.%I', profile_table)::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n  ) then\n    raise exception 'profile table primary key must be exactly id';\n  end if;\n\n  if not exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = format('public.%I', profile_table)::regclass\n      and c.confrelid = 'auth.users'::regclass\n      and c.contype = 'f'\n      and c.confdeltype = 'c'\n      and c.conkey = array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = format('public.%I', profile_table)::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n      and c.confkey = array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'auth.users'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n  ) then\n    raise exception 'profile id must reference auth.users(id) with cascade delete';\n  end if;\n\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = profile_table\n      and c.column_name = 'id'\n      and c.udt_name = 'uuid'\n      and c.is_nullable = 'NO'\n  ) then\n    raise exception 'profile id column must be uuid not null';\n  end if;\n\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = profile_table\n      and c.column_name = 'created_at'\n      and c.data_type = 'timestamp with time zone'\n      and c.is_nullable = 'NO'\n      and c.column_default = 'now()'\n  ) then\n    raise exception 'profile created_at column must be timestamptz not null default now()';\n  end if;\n\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = profile_table\n      and c.column_name = 'updated_at'\n      and c.data_type = 'timestamp with time zone'\n      and c.is_nullable = 'NO'\n      and c.column_default = 'now()'\n  ) then\n    raise exception 'profile updated_at column must be timestamptz not null default now()';\n  end if;\n\n  foreach expected_column in array configured_columns loop\n    if not exists (\n      select 1\n      from information_schema.columns c\n      where c.table_schema = 'public'\n        and c.table_name = profile_table\n        and c.column_name = expected_column\n        and c.data_type = 'text'\n    ) then\n      raise exception 'missing configured managed profile column %', expected_column;\n    end if;\n  end loop;\n\n  foreach expected_column in array managed_columns loop\n    if not expected_column = any(configured_columns) and exists (\n      select 1\n      from information_schema.columns c\n      where c.table_schema = 'public'\n        and c.table_name = profile_table\n        and c.column_name = expected_column\n    ) then\n      raise exception 'stale managed profile column % exists', expected_column;\n    end if;\n  end loop;\n\n  if exists (\n    select 1\n    from information_schema.columns\n    where table_schema = 'public'\n      and table_name = profile_table\n      and column_name = 'role'\n  ) then\n    raise exception 'generated role column must not exist';\n  end if;\n\n  if not exists (\n    select 1\n    from pg_class c\n    join pg_namespace n on n.oid = c.relnamespace\n    where n.nspname = 'public'\n      and c.relname = profile_table\n      and c.relrowsecurity\n  ) then\n    raise exception 'profile table RLS is not enabled';\n  end if;\n\n  if not exists (\n    select 1\n    from pg_policy p\n    join pg_class c on c.oid = p.polrelid\n    join pg_namespace n on n.oid = c.relnamespace\n    where n.nspname = 'public'\n      and c.relname = profile_table\n      and p.polname = '${selectPolicy}'\n      and p.polcmd = 'r'\n      and p.polroles = array['authenticated'::regrole]::oid[]\n      and regexp_replace(lower(pg_get_expr(p.polqual, p.polrelid)), '[[:space:]()]', '', 'g') in (\n        'auth.uid=id',\n        'auth.uid=' || profile_table || '.id',\n        'selectauth.uidasuid=id',\n        'selectauth.uidasuid=' || profile_table || '.id'\n      )\n      and p.polwithcheck is null\n  ) then\n    raise exception 'own-profile SELECT policy is missing or has unsafe definition';\n  end if;\n\n  if not exists (\n    select 1\n    from pg_policy p\n    join pg_class c on c.oid = p.polrelid\n    join pg_namespace n on n.oid = c.relnamespace\n    where n.nspname = 'public'\n      and c.relname = profile_table\n      and p.polname = '${updatePolicy}'\n      and p.polcmd = 'w'\n      and p.polroles = array['authenticated'::regrole]::oid[]\n      and regexp_replace(lower(pg_get_expr(p.polqual, p.polrelid)), '[[:space:]()]', '', 'g') in (\n        'auth.uid=id',\n        'auth.uid=' || profile_table || '.id',\n        'selectauth.uidasuid=id',\n        'selectauth.uidasuid=' || profile_table || '.id'\n      )\n      and regexp_replace(lower(pg_get_expr(p.polwithcheck, p.polrelid)), '[[:space:]()]', '', 'g') in (\n        'auth.uid=id',\n        'auth.uid=' || profile_table || '.id',\n        'selectauth.uidasuid=id',\n        'selectauth.uidasuid=' || profile_table || '.id'\n      )\n  ) then\n    raise exception 'own-profile UPDATE policy is missing or has unsafe definition';\n  end if;\n\n  if exists (\n    select 1\n    from pg_policy p\n    join pg_class c on c.oid = p.polrelid\n    join pg_namespace n on n.oid = c.relnamespace\n    where n.nspname = 'public'\n      and c.relname = profile_table\n      and p.polname not in ('${selectPolicy}', '${updatePolicy}')\n  ) then\n    raise exception 'unexpected profile table RLS policy exists';\n  end if;\n\n  if has_any_column_privilege('anon', format('public.%I', profile_table), 'SELECT')\n    or has_any_column_privilege('anon', format('public.%I', profile_table), 'INSERT')\n    or has_any_column_privilege('anon', format('public.%I', profile_table), 'UPDATE')\n    or has_any_column_privilege('anon', format('public.%I', profile_table), 'REFERENCES')\n    or has_table_privilege('anon', format('public.%I', profile_table), 'DELETE') then\n    raise exception 'anon must not have profile table privileges';\n  end if;\n\n  if not has_table_privilege('authenticated', format('public.%I', profile_table), 'SELECT') then\n    raise exception 'authenticated role must have profile table SELECT privilege';\n  end if;\n\n  if has_any_column_privilege('authenticated', format('public.%I', profile_table), 'INSERT')\n    or has_any_column_privilege('authenticated', format('public.%I', profile_table), 'REFERENCES')\n    or has_table_privilege('authenticated', format('public.%I', profile_table), 'DELETE') then\n    raise exception 'authenticated role must not have profile table INSERT, DELETE, or REFERENCES privilege';\n  end if;\n\n  foreach expected_column in array ${updateGrantArray} loop\n    if not has_column_privilege('authenticated', format('public.%I', profile_table), expected_column, 'UPDATE') then\n      raise exception 'authenticated role is missing UPDATE privilege on configured profile column %', expected_column;\n    end if;\n  end loop;\n\n  foreach expected_column in array (\n    select array_agg(c.column_name::text order by c.ordinal_position)\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = profile_table\n  ) loop\n    if not expected_column = any(configured_columns)\n      and has_column_privilege('authenticated', format('public.%I', profile_table), expected_column, 'UPDATE') then\n      raise exception 'authenticated role has unexpected UPDATE privilege on profile column %', expected_column;\n    end if;\n  end loop;\n\n  foreach expected_column in array ${protectedUpdateColumnsArray} loop\n    if exists (\n      select 1\n      from information_schema.columns c\n      where c.table_schema = 'public'\n        and c.table_name = profile_table\n        and c.column_name = expected_column\n    ) and has_column_privilege('authenticated', format('public.%I', profile_table), expected_column, 'UPDATE') then\n      raise exception 'authenticated role must not have UPDATE privilege on protected profile column %', expected_column;\n    end if;\n  end loop;\n\n${triggerCheck}\n\n  if '${profileModel.createStrategy}' = 'trigger' then\n    if not exists (\n      select 1\n      from pg_proc p\n      join pg_namespace n on n.oid = p.pronamespace\n      where n.nspname = 'public'\n        and p.proname = '${functionName}'\n        and p.prosecdef\n        and p.prorettype = 'trigger'::regtype\n        and p.proconfig @> array['search_path=pg_catalog, pg_temp']\n    ) then\n      raise exception 'generated trigger function is missing required SECURITY DEFINER properties';\n    end if;\n\n    if exists (\n      select 1\n      from pg_proc p\n      join pg_namespace n on n.oid = p.pronamespace\n      cross join lateral aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) acl\n      where n.nspname = 'public'\n        and p.proname = '${functionName}'\n        and acl.privilege_type = 'EXECUTE'\n        and (\n          acl.grantee = 0\n          or acl.grantee = 'anon'::regrole\n          or acl.grantee = 'authenticated'::regrole\n        )\n    ) then\n      raise exception 'generated trigger function execute privilege must be revoked from PUBLIC, anon, and authenticated';\n    end if;\n  end if;\nend;\n$$;`;\n}\n\nfunction getStatusScript(args: {\n  defaultNamespace: string;\n  supabaseProjectId: string | null;\n  supabaseLocalEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n}): string {\n  const { defaultNamespace, supabaseProjectId, supabaseLocalEnabled, profileModel } = args;\n  const profileStatusSql = profileModel.enabled ? getSupabaseProfileChecksumSql(profileModel) : '';\n  const profileVerificationSql = profileModel.enabled\n    ? getSupabaseProfileVerificationSql(profileModel)\n    : '';\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nNAMESPACE=\"\\${ANKH_NAMESPACE:-${defaultNamespace}}\"\nAUTH_RUNTIME_MODE=\"\\${AUTH_RUNTIME_MODE:-local}\"\nSUPABASE_LOCAL_ENABLED=\"\\${SUPABASE_LOCAL_ENABLED:-${supabaseLocalEnabled ? 'true' : 'false'}}\"\nSUPABASE_SECRET_SYNC_ENABLED=\"\\${SUPABASE_SECRET_SYNC_ENABLED:-true}\"\nSUPABASE_PROJECT_DIR=\"\\${SUPABASE_PROJECT_DIR:-\\${ROOT_DIR}}\"\nEXPECTED_SUPABASE_PROJECT_ID=\"${supabaseProjectId ?? ''}\"\nSUPABASE_PROFILE_ENABLED=\"${profileModel.enabled ? 'true' : 'false'}\"\nSUPABASE_PROFILE_RECONCILE_FILE=\"\\${SUPABASE_PROJECT_DIR}/supabase/generated/auth_profiles.sql\"\nexport EXPECTED_SUPABASE_PROJECT_ID\n\nreject_supabase_project_id_override() {\n  if [[ -n \"\\${SUPABASE_PROJECT_ID:-}\" ]]; then\n    echo \"SUPABASE_PROJECT_ID must not be set for generated local Infra scripts.\"\n    echo \"Unset SUPABASE_PROJECT_ID and use supabase/config.toml project_id instead.\"\n    return 1\n  fi\n\n  unset SUPABASE_PROJECT_ID\n}\n\nrequire_expected_supabase_project_identity() {\n  if [[ -z \"\\${EXPECTED_SUPABASE_PROJECT_ID}\" ]]; then\n    echo \"Cannot run local Supabase infrastructure: expected Supabase project identity is empty.\"\n    echo \"Regenerate Infra with appManifest.metadata.slug for Supabase-backed local services.\"\n    return 1\n  fi\n}\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"kubectl is required but not installed.\"\n  exit 1\nfi\n\nif ! kubectl config current-context >/dev/null 2>&1; then\n  echo \"No active kubectl context is configured.\"\n  echo \"Run ./scripts/up.sh to start Minikube and apply manifests.\"\n  exit 1\nfi\n\nif ! kubectl cluster-info >/dev/null 2>&1; then\n  CONTEXT=\"$(kubectl config current-context 2>/dev/null || echo \"unknown\")\"\n  echo \"Cannot reach Kubernetes API server for context '\\${CONTEXT}'.\"\n  echo \"Run ./scripts/up.sh or verify your kubeconfig context.\"\n  exit 1\nfi\n\nif ! kubectl get namespace \"\\${NAMESPACE}\" >/dev/null 2>&1; then\n  echo \"Namespace '\\${NAMESPACE}' was not found in the current cluster.\"\n  echo \"Run ./scripts/up.sh to create it and apply resources.\"\n  exit 1\nfi\n\nkubectl get all -n \"\\${NAMESPACE}\"\n\necho\necho \"Runtime auth checks:\"\necho \"- AUTH_RUNTIME_MODE=\\${AUTH_RUNTIME_MODE}\"\necho \"- SUPABASE_SECRET_SYNC_ENABLED=\\${SUPABASE_SECRET_SYNC_ENABLED}\"\n\nif kubectl -n \"\\${NAMESPACE}\" get configmap app-runtime-auth-env >/dev/null 2>&1; then\n  echo \"- configmap/app-runtime-auth-env: present\"\nelse\n  echo \"- configmap/app-runtime-auth-env: missing\"\nfi\n\nif [[ \"\\${SUPABASE_SECRET_SYNC_ENABLED}\" == \"true\" ]]; then\n  if kubectl -n \"\\${NAMESPACE}\" get secret supabase-auth-secrets >/dev/null 2>&1; then\n    echo \"- secret/supabase-auth-secrets: present\"\n\n    has_secret_key() {\n      local key=\"$1\"\n      local value\n      value=\"$(kubectl -n \"\\${NAMESPACE}\" get secret supabase-auth-secrets -o \"jsonpath={.data.\\${key}}\" 2>/dev/null || true)\"\n      [[ -n \"\\${value}\" ]]\n    }\n\n    required_secret_keys=(\n      SUPABASE_URL\n      SUPABASE_ANON_KEY\n      SUPABASE_SERVICE_ROLE_KEY\n      SUPABASE_JWT_SECRET\n      EXPO_PUBLIC_SUPABASE_URL\n      EXPO_PUBLIC_SUPABASE_ANON_KEY\n    )\n\n    for key in \"\\${required_secret_keys[@]}\"; do\n      if has_secret_key \"\\${key}\"; then\n        echo \"  - \\${key}: present\"\n      else\n        echo \"  - \\${key}: missing\"\n      fi\n    done\n  else\n    echo \"- secret/supabase-auth-secrets: missing\"\n  fi\nelse\n  echo \"- secret/supabase-auth-secrets: skipped (SUPABASE_SECRET_SYNC_ENABLED=false)\"\nfi\n\nversion_ge() {\n  local actual=\"$1\"\n  local minimum=\"$2\"\n\n  local actual_major actual_minor actual_patch\n  local minimum_major minimum_minor minimum_patch\n  IFS=. read -r actual_major actual_minor actual_patch <<< \"\\${actual}\"\n  IFS=. read -r minimum_major minimum_minor minimum_patch <<< \"\\${minimum}\"\n\n  actual_major=\"\\${actual_major:-0}\"\n  actual_minor=\"\\${actual_minor:-0}\"\n  actual_patch=\"\\${actual_patch:-0}\"\n  minimum_major=\"\\${minimum_major:-0}\"\n  minimum_minor=\"\\${minimum_minor:-0}\"\n  minimum_patch=\"\\${minimum_patch:-0}\"\n\n  (( actual_major > minimum_major )) && return 0\n  (( actual_major < minimum_major )) && return 1\n  (( actual_minor > minimum_minor )) && return 0\n  (( actual_minor < minimum_minor )) && return 1\n  (( actual_patch >= minimum_patch ))\n}\n\nrequire_supabase_cli_capabilities() {\n  if ! command -v supabase >/dev/null 2>&1; then\n    echo \"supabase CLI is required for local schema status checks.\"\n    echo \"Install or upgrade: https://supabase.com/docs/guides/local-development/cli/getting-started\"\n    return 1\n  fi\n\n  local version\n  version=\"$(supabase --version | awk '{print $NF}')\"\n  if ! version_ge \"\\${version}\" \"2.106.0\"; then\n    echo \"supabase CLI >= 2.106.0 is required; found \\${version}.\"\n    echo \"Upgrade: https://supabase.com/docs/guides/local-development/cli/getting-started\"\n    return 1\n  fi\n\n  if ! supabase status --help 2>/dev/null | grep -Fq -- \"--workdir\"; then\n    echo \"supabase CLI does not support required global --workdir flag.\"\n    return 1\n  fi\n\n  if ! supabase migration up --help 2>/dev/null | grep -Fq -- \"--local\"; then\n    echo \"supabase CLI does not support required migration up --local command.\"\n    return 1\n  fi\n\n  if ! command -v psql >/dev/null 2>&1; then\n    echo \"psql is required for local schema status checks.\"\n    return 1\n  fi\n}\n\nread_env_value() {\n  local source=\"$1\"\n  local key=\"$2\"\n  local line\n  line=\"$(printf '%s\\\\n' \"\\${source}\" | awk -v key=\"\\${key}\" '\n    $0 ~ \"^(export[[:space:]]+)?\" key \"=\" {print}\n  ' | tail -n1)\"\n\n  if [[ -z \"\\${line}\" ]]; then\n    echo \"\"\n    return\n  fi\n\n  line=\"\\${line#export }\"\n  line=\"\\${line#\\${key}=}\"\n  line=\"\\${line%\\\\\"}\"\n  line=\"\\${line#\\\\\"}\"\n  printf '%s' \"\\${line}\"\n}\n\nrun_supabase_sql() {\n  local sql=\"$1\"\n  local label=\"$2\"\n  local tmp_file\n  tmp_file=\"$(mktemp)\"\n  printf '%s\\\\n' \"\\${sql}\" > \"\\${tmp_file}\"\n\n  if psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${tmp_file}\" >/dev/null; then\n    rm -f \"\\${tmp_file}\"\n    return 0\n  fi\n\n  rm -f \"\\${tmp_file}\"\n  echo \"- \\${label}: failed\"\n  return 1\n}\n\nvalidate_supabase_project_identity() {\n  local config_file=\"\\${SUPABASE_PROJECT_DIR}/supabase/config.toml\"\n\n  if [[ -z \"\\${EXPECTED_SUPABASE_PROJECT_ID}\" ]]; then\n    return 0\n  fi\n\n  if [[ ! -f \"\\${config_file}\" ]]; then\n    echo \"- local Supabase project identity: config missing at \\${config_file}\"\n    return 1\n  fi\n\n  if ! command -v python3 >/dev/null 2>&1; then\n    echo \"- local Supabase project identity: python3 is required to read \\${config_file}\"\n    return 1\n  fi\n\n  python3 - \"\\${config_file}\" <<'PY'\nimport os\nimport re\nimport sys\n\n\ndef read_top_level_project_id(config_path):\n    key_re = re.compile(r'^\\\\s*project_id\\\\s*=\\\\s*(.*?)\\\\s*(?:#.*)?$')\n    section_re = re.compile(r'^\\\\s*\\\\[[^\\\\]]+\\\\]\\\\s*$')\n\n    with open(config_path, 'r', encoding='utf-8') as f:\n        for line in f:\n            if section_re.match(line):\n                return None\n            match = key_re.match(line)\n            if not match:\n                continue\n            raw = match.group(1).strip()\n            quoted = re.match(r'^[\"\\\\']([^\"\\\\']*)[\"\\\\']$', raw)\n            return quoted.group(1) if quoted else raw\n\n    return None\n\n\nexpected = os.environ['EXPECTED_SUPABASE_PROJECT_ID']\nactual = read_top_level_project_id(sys.argv[1])\n\nif actual == expected:\n    raise SystemExit(0)\n\nfound = 'missing' if actual is None else f'\"{actual}\"'\nprint('Supabase project identity mismatch.', file=sys.stderr)\nprint(f'Expected \"{expected}\", found {found}.', file=sys.stderr)\nprint('Destroy the invalid local stack and run Infra Up again.', file=sys.stderr)\nraise SystemExit(1)\nPY\n}\n\ncheck_immutable_migrations_applied() {\n  local migrations_dir=\"\\${SUPABASE_PROJECT_DIR}/supabase/migrations\"\n  local applied_versions\n  applied_versions=\"$(psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -Atc \"select version from supabase_migrations.schema_migrations\" 2>/dev/null || true)\"\n\n  if [[ -z \"\\${applied_versions}\" ]]; then\n    applied_versions=\"\"\n  fi\n\n  if [[ ! -d \"\\${migrations_dir}\" ]]; then\n    return 0\n  fi\n\n  local file\n  local version\n  local pending=0\n  for file in \"\\${migrations_dir}\"/*.sql; do\n    [[ -e \"\\${file}\" ]] || continue\n    version=\"$(basename \"\\${file}\")\"\n    version=\"\\${version%%_*}\"\n    if ! printf '%s\\\\n' \"\\${applied_versions}\" | grep -Fxq \"\\${version}\"; then\n      echo \"- immutable migrations: pending \\${file}\"\n      pending=1\n    fi\n  done\n\n  return \"\\${pending}\"\n}\n\nif [[ \"\\${AUTH_RUNTIME_MODE}\" == \"local\" && \"\\${SUPABASE_LOCAL_ENABLED}\" == \"true\" ]]; then\n  echo\n  echo \"Local Supabase database checks:\"\n  status_failed=0\n\n  if ! require_expected_supabase_project_identity; then\n    status_failed=1\n  elif ! reject_supabase_project_id_override; then\n    status_failed=1\n  elif require_supabase_cli_capabilities; then\n    if ! validate_supabase_project_identity; then\n      status_failed=1\n    elif supabase --workdir \"\\${SUPABASE_PROJECT_DIR}\" status >/dev/null 2>&1; then\n      STATUS_ENV=\"$(supabase --workdir \"\\${SUPABASE_PROJECT_DIR}\" status -o env)\"\n      SUPABASE_DB_URL=\"$(read_env_value \"\\${STATUS_ENV}\" DB_URL)\"\n      if [[ -z \"\\${SUPABASE_DB_URL}\" ]]; then\n        echo \"- immutable migrations: status unavailable (DB_URL missing from supabase status)\"\n        status_failed=1\n      elif check_immutable_migrations_applied; then\n        echo \"- immutable migrations: applied\"\n      else\n        echo \"- immutable migrations: pending\"\n        status_failed=1\n      fi\n\n      if [[ \"\\${SUPABASE_PROFILE_ENABLED}\" == \"true\" ]]; then\n        if [[ -f \"\\${SUPABASE_PROFILE_RECONCILE_FILE}\" ]]; then\n          PROFILE_STATUS_SQL=$(cat <<'SQL'\n${profileStatusSql}\nSQL\n)\n          PROFILE_VERIFY_SQL=$(cat <<'SQL'\n${profileVerificationSql}\nSQL\n)\n\n          if run_supabase_sql \"\\${PROFILE_STATUS_SQL}\" \"profile reconciliation\"; then\n            echo \"- profile reconciliation: applied, checksum matches\"\n          else\n            echo \"- profile reconciliation: pending or stale\"\n            status_failed=1\n          fi\n\n          if run_supabase_sql \"\\${PROFILE_VERIFY_SQL}\" \"profile schema\"; then\n            echo \"- profile schema: verified\"\n          else\n            echo \"- profile schema: drift detected\"\n            status_failed=1\n          fi\n        else\n          echo \"- profile reconciliation: generated file missing at \\${SUPABASE_PROFILE_RECONCILE_FILE}\"\n          echo \"- profile schema: not verified\"\n          status_failed=1\n        fi\n      else\n        PROFILE_DISABLED_SQL=$(cat <<'SQL'\n${getSupabaseProfileDisabledGuardSql()}\nSQL\n)\n        if run_supabase_sql \"\\${PROFILE_DISABLED_SQL}\" \"profile disabled-state\"; then\n          echo \"- profile reconciliation: skipped (no profile table configured)\"\n          echo \"- profile schema: skipped (no profile table configured)\"\n        else\n          echo \"- profile reconciliation: stale generated state exists for removed profile table\"\n          echo \"- profile schema: not verified\"\n          status_failed=1\n        fi\n      fi\n    else\n      echo \"- local Supabase stack: not running or not reachable from \\${SUPABASE_PROJECT_DIR}\"\n      status_failed=1\n    fi\n  else\n    status_failed=1\n  fi\n\n  if [[ \"\\${status_failed}\" -ne 0 ]]; then\n    exit \"\\${status_failed}\"\n  fi\nfi\n`;\n}\n\nfunction getSupabaseLocalEnvScript(args: {\n  supabaseProjectId: string | null;\n  supabaseLocalPorts: SupabaseLocalPorts;\n  profileModel: ResolvedProfileModel;\n}): string {\n  const { supabaseProjectId, supabaseLocalPorts, profileModel } = args;\n  const profileStatusSql = profileModel.enabled ? getSupabaseProfileChecksumSql(profileModel) : '';\n  const profileVerificationSql = profileModel.enabled\n    ? getSupabaseProfileVerificationSql(profileModel)\n    : '';\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nENV_FILE=\"\\${ROOT_DIR}/.env\"\nENV_EXAMPLE_FILE=\"\\${ROOT_DIR}/.env.example\"\n\nif [[ -f \"\\${ENV_FILE}\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ENV_FILE}\"\n  set +a\nfi\n\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-$(cd \"\\${ROOT_DIR}/../..\" && pwd)}\"\nSUPABASE_PROJECT_DIR=\"\\${SUPABASE_PROJECT_DIR:-\\${ROOT_DIR}}\"\nEXPECTED_SUPABASE_PROJECT_ID=\"${supabaseProjectId ?? ''}\"\nAPP_SUPABASE_ENV_FILE=\"\\${APP_SUPABASE_ENV_FILE:-\\${APP_SOURCE_DIR}/.env.local}\"\nSUPABASE_PROFILE_ENABLED=\"${profileModel.enabled ? 'true' : 'false'}\"\nSUPABASE_PROFILE_RECONCILE_FILE=\"\\${SUPABASE_PROJECT_DIR}/supabase/generated/auth_profiles.sql\"\nexport EXPECTED_SUPABASE_PROJECT_ID\n\nreject_supabase_project_id_override() {\n  if [[ -n \"\\${SUPABASE_PROJECT_ID:-}\" ]]; then\n    echo \"SUPABASE_PROJECT_ID must not be set for generated local Infra scripts.\"\n    echo \"Unset SUPABASE_PROJECT_ID and use supabase/config.toml project_id instead.\"\n    exit 1\n  fi\n\n  unset SUPABASE_PROJECT_ID\n}\n\nrequire_expected_supabase_project_identity() {\n  if [[ -z \"\\${EXPECTED_SUPABASE_PROJECT_ID}\" ]]; then\n    echo \"Cannot run local Supabase infrastructure: expected Supabase project identity is empty.\"\n    echo \"Regenerate Infra with appManifest.metadata.slug for Supabase-backed local services.\"\n    exit 1\n  fi\n}\n\nSUPABASE_LOCAL_PORT_BASE=\"\\${SUPABASE_LOCAL_PORT_BASE:-${supabaseLocalPorts.base}}\"\nSUPABASE_LOCAL_SHADOW_PORT=\"\\${SUPABASE_LOCAL_SHADOW_PORT:-\\${SUPABASE_LOCAL_PORT_BASE}}\"\nSUPABASE_LOCAL_API_PORT=\"\\${SUPABASE_LOCAL_API_PORT:-$((SUPABASE_LOCAL_PORT_BASE + 1))}\"\nSUPABASE_LOCAL_DB_PORT=\"\\${SUPABASE_LOCAL_DB_PORT:-$((SUPABASE_LOCAL_PORT_BASE + 2))}\"\nSUPABASE_LOCAL_STUDIO_PORT=\"\\${SUPABASE_LOCAL_STUDIO_PORT:-$((SUPABASE_LOCAL_PORT_BASE + 3))}\"\nSUPABASE_LOCAL_INBUCKET_PORT=\"\\${SUPABASE_LOCAL_INBUCKET_PORT:-$((SUPABASE_LOCAL_PORT_BASE + 4))}\"\nSUPABASE_LOCAL_ANALYTICS_PORT=\"\\${SUPABASE_LOCAL_ANALYTICS_PORT:-$((SUPABASE_LOCAL_PORT_BASE + 5))}\"\nexport SUPABASE_LOCAL_PORT_BASE\nexport SUPABASE_LOCAL_SHADOW_PORT\nexport SUPABASE_LOCAL_API_PORT\nexport SUPABASE_LOCAL_DB_PORT\nexport SUPABASE_LOCAL_STUDIO_PORT\nexport SUPABASE_LOCAL_INBUCKET_PORT\nexport SUPABASE_LOCAL_ANALYTICS_PORT\nversion_ge() {\n  local actual=\"$1\"\n  local minimum=\"$2\"\n\n  local actual_major actual_minor actual_patch\n  local minimum_major minimum_minor minimum_patch\n  IFS=. read -r actual_major actual_minor actual_patch <<< \"\\${actual}\"\n  IFS=. read -r minimum_major minimum_minor minimum_patch <<< \"\\${minimum}\"\n\n  actual_major=\"\\${actual_major:-0}\"\n  actual_minor=\"\\${actual_minor:-0}\"\n  actual_patch=\"\\${actual_patch:-0}\"\n  minimum_major=\"\\${minimum_major:-0}\"\n  minimum_minor=\"\\${minimum_minor:-0}\"\n  minimum_patch=\"\\${minimum_patch:-0}\"\n\n  (( actual_major > minimum_major )) && return 0\n  (( actual_major < minimum_major )) && return 1\n  (( actual_minor > minimum_minor )) && return 0\n  (( actual_minor < minimum_minor )) && return 1\n  (( actual_patch >= minimum_patch ))\n}\n\nrequire_supabase_cli_capabilities() {\n  if ! command -v supabase >/dev/null 2>&1; then\n    echo \"supabase CLI is required but not installed.\"\n    echo \"Install or upgrade: https://supabase.com/docs/guides/local-development/cli/getting-started\"\n    exit 1\n  fi\n\n  if ! command -v python3 >/dev/null 2>&1; then\n    echo \"python3 is required to reconcile supabase/config.toml before local Supabase startup.\"\n    exit 1\n  fi\n\n  local version\n  version=\"$(supabase --version | awk '{print $NF}')\"\n  if ! version_ge \"\\${version}\" \"2.106.0\"; then\n    echo \"supabase CLI >= 2.106.0 is required; found \\${version}.\"\n    echo \"Upgrade: https://supabase.com/docs/guides/local-development/cli/getting-started\"\n    exit 1\n  fi\n\n  if ! supabase status --help 2>/dev/null | grep -Fq -- \"--workdir\"; then\n    echo \"supabase CLI does not support required global --workdir flag.\"\n    echo \"Upgrade: https://supabase.com/docs/guides/local-development/cli/getting-started\"\n    exit 1\n  fi\n\n  if ! supabase migration up --help 2>/dev/null | grep -Fq -- \"--local\"; then\n    echo \"supabase CLI does not support required migration up --local command.\"\n    echo \"Upgrade: https://supabase.com/docs/guides/local-development/cli/getting-started\"\n    exit 1\n  fi\n\n  if ! command -v psql >/dev/null 2>&1; then\n    echo \"psql is required but not installed.\"\n    exit 1\n  fi\n}\n\nformat_command() {\n  printf '%q ' \"$@\"\n}\n\nrun_checked_command() {\n  local label=\"$1\"\n  local sql_file=\"$2\"\n  shift 2\n  local status\n  set +e\n  \"$@\"\n  status=$?\n  set -e\n\n  if [[ \"\\${status}\" -ne 0 ]]; then\n    echo \"\\${label} failed.\"\n    if [[ -n \"\\${sql_file}\" ]]; then\n      echo \"SQL file: \\${sql_file}\"\n    fi\n    echo \"Supabase project workdir: \\${SUPABASE_PROJECT_DIR}\"\n    echo \"Command: $(format_command \"$@\")\"\n    echo \"Exit status: \\${status}\"\n    exit \"\\${status}\"\n  fi\n}\n\nrun_checked_sql_file() {\n  local label=\"$1\"\n  local sql_file=\"$2\"\n  run_checked_command \\\n    \"\\${label}\" \\\n    \"\\${sql_file}\" \\\n    psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${sql_file}\"\n}\n\nrequire_expected_supabase_project_identity\nreject_supabase_project_id_override\nrequire_supabase_cli_capabilities\n\nif [[ ! -d \"\\${SUPABASE_PROJECT_DIR}\" ]]; then\n  echo \"Supabase project directory does not exist: \\${SUPABASE_PROJECT_DIR}\"\n  exit 1\nfi\n\nconfigure_supabase_local_ports() {\n  local config_file=\"\\${SUPABASE_PROJECT_DIR}/supabase/config.toml\"\n\n  python3 - \"\\${config_file}\" <<'PY'\nimport os\nimport re\nimport sys\nfrom dataclasses import dataclass\n\n\n@dataclass(frozen=True)\nclass Patch:\n    section: str\n    key: str\n    value: str\n\n\ndef _env_required(name):\n    value = os.environ.get(name)\n    if value is None or value == \"\":\n        raise RuntimeError(f\"Missing required env var: {name}\")\n    return value\n\n\ndef _is_section_header(line):\n    return re.match(r\"^\\\\s*\\\\[[^\\\\]]+\\\\]\\\\s*$\", line) is not None\n\n\ndef _section_name(line):\n    match = re.match(r\"^\\\\s*\\\\[([^\\\\]]+)\\\\]\\\\s*$\", line)\n    return match.group(1) if match else None\n\n\ndef _patch_section(lines, section, key, value):\n    current_section = None\n    section_start = None\n\n    for i, line in enumerate(lines):\n        if _is_section_header(line):\n            current_section = _section_name(line)\n            if current_section == section and section_start is None:\n                section_start = i\n\n    if section_start is None:\n        if lines and not lines[-1].endswith(\"\\\\n\"):\n            lines[-1] = lines[-1] + \"\\\\n\"\n        if lines and lines[-1].strip() != \"\":\n            lines.append(\"\\\\n\")\n        lines.append(f\"[{section}]\\\\n\")\n        lines.append(f\"{key} = {value}\\\\n\")\n        return lines\n\n    section_end = len(lines)\n    for j in range(section_start + 1, len(lines)):\n        if _is_section_header(lines[j]):\n            section_end = j\n            break\n\n    key_re = re.compile(rf\"^(\\\\s*){re.escape(key)}\\\\s*=\\\\s*(.*?)(\\\\s*(#.*)?)?$\")\n    for k in range(section_start + 1, section_end):\n        match = key_re.match(lines[k])\n        if match:\n            indent = match.group(1) or \"\"\n            trailing = match.group(3) or \"\"\n            suffix = trailing.rstrip(\"\\\\n\")\n            lines[k] = f\"{indent}{key} = {value}{suffix}\\\\n\"\n            return lines\n\n    insert_at = section_end\n    while insert_at > section_start + 1 and lines[insert_at - 1].strip() == \"\":\n        insert_at -= 1\n    lines.insert(insert_at, f\"{key} = {value}\\\\n\")\n    return lines\n\n\ndef main():\n    if len(sys.argv) != 2:\n        raise RuntimeError(\"Usage: patch_config.py <supabase/config.toml>\")\n\n    config_path = sys.argv[1]\n    with open(config_path, \"r\", encoding=\"utf-8\") as f:\n        lines = f.readlines()\n\n    patches = [\n        Patch(\"api\", \"port\", _env_required(\"SUPABASE_LOCAL_API_PORT\")),\n        Patch(\"db\", \"port\", _env_required(\"SUPABASE_LOCAL_DB_PORT\")),\n        Patch(\"db\", \"shadow_port\", _env_required(\"SUPABASE_LOCAL_SHADOW_PORT\")),\n        Patch(\"studio\", \"port\", _env_required(\"SUPABASE_LOCAL_STUDIO_PORT\")),\n        Patch(\"inbucket\", \"port\", _env_required(\"SUPABASE_LOCAL_INBUCKET_PORT\")),\n        Patch(\"analytics\", \"port\", _env_required(\"SUPABASE_LOCAL_ANALYTICS_PORT\")),\n    ]\n\n    for p in patches:\n        lines = _patch_section(lines, p.section, p.key, p.value)\n\n    with open(config_path, \"w\", encoding=\"utf-8\") as f:\n        f.writelines(lines)\n\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\nPY\n}\n\nwrite_supabase_project_identity_for_new_config() {\n  local config_file=\"\\${SUPABASE_PROJECT_DIR}/supabase/config.toml\"\n\n  require_expected_supabase_project_identity\n\n  if ! command -v python3 >/dev/null 2>&1; then\n    echo \"python3 is required to write Supabase project_id in \\${config_file}.\"\n    exit 1\n  fi\n\n  python3 - \"\\${config_file}\" <<'PY'\nimport os\nimport re\nimport sys\n\n\ndef write_top_level_project_id(config_path, expected):\n    key_re = re.compile(r'^(\\\\s*)project_id\\\\s*=\\\\s*(.*?)(\\\\s*(#.*)?)?$')\n    section_re = re.compile(r'^\\\\s*\\\\[[^\\\\]]+\\\\]\\\\s*$')\n\n    with open(config_path, 'r', encoding='utf-8') as f:\n        lines = f.readlines()\n\n    section_start = len(lines)\n    for i, line in enumerate(lines):\n        if section_re.match(line):\n            section_start = i\n            break\n\n    for i in range(section_start):\n        match = key_re.match(lines[i])\n        if not match:\n            continue\n        indent = match.group(1) or ''\n        trailing = (match.group(3) or '').rstrip('\\\\n')\n        lines[i] = f'{indent}project_id = \"{expected}\"{trailing}\\\\n'\n        break\n    else:\n        insert_at = section_start\n        lines.insert(insert_at, f'project_id = \"{expected}\"\\\\n')\n\n    with open(config_path, 'w', encoding='utf-8') as f:\n        f.writelines(lines)\n\n\nwrite_top_level_project_id(sys.argv[1], os.environ['EXPECTED_SUPABASE_PROJECT_ID'])\nPY\n}\n\nvalidate_supabase_project_identity() {\n  local config_file=\"\\${SUPABASE_PROJECT_DIR}/supabase/config.toml\"\n\n  require_expected_supabase_project_identity\n\n  if [[ ! -f \"\\${config_file}\" ]]; then\n    echo \"Supabase project identity mismatch.\"\n    printf 'Expected \"%s\", found missing.\\n' \"\\${EXPECTED_SUPABASE_PROJECT_ID}\"\n    echo \"The existing local Supabase project belongs to a different identity.\"\n    echo \"Destroy the invalid local stack and its project-owned resources, then run Infra Up again.\"\n    exit 1\n  fi\n\n  if ! command -v python3 >/dev/null 2>&1; then\n    echo \"python3 is required to read Supabase project_id in \\${config_file}.\"\n    exit 1\n  fi\n\n  python3 - \"\\${config_file}\" <<'PY'\nimport os\nimport re\nimport sys\n\n\ndef read_top_level_project_id(config_path):\n    key_re = re.compile(r'^\\\\s*project_id\\\\s*=\\\\s*(.*?)\\\\s*(?:#.*)?$')\n    section_re = re.compile(r'^\\\\s*\\\\[[^\\\\]]+\\\\]\\\\s*$')\n\n    with open(config_path, 'r', encoding='utf-8') as f:\n        for line in f:\n            if section_re.match(line):\n                return None\n            match = key_re.match(line)\n            if not match:\n                continue\n            raw = match.group(1).strip()\n            quoted = re.match(r'^[\"\\\\']([^\"\\\\']*)[\"\\\\']$', raw)\n            return quoted.group(1) if quoted else raw\n\n    return None\n\n\nexpected = os.environ['EXPECTED_SUPABASE_PROJECT_ID']\nactual = read_top_level_project_id(sys.argv[1])\n\nif actual == expected:\n    raise SystemExit(0)\n\nfound = 'missing' if actual is None else f'\"{actual}\"'\nprint('Supabase project identity mismatch.', file=sys.stderr)\nprint(f'Expected \"{expected}\", found {found}.', file=sys.stderr)\nprint('The existing local Supabase project belongs to a different identity.', file=sys.stderr)\nprint('Destroy the invalid local stack and its project-owned resources, then run Infra Up again.', file=sys.stderr)\nraise SystemExit(1)\nPY\n}\n\nassert_supabase_local_ports_available() {\n  local project_label=\"\\${EXPECTED_SUPABASE_PROJECT_ID}\"\n\n  ANKH_PROJECT_LABEL=\"\\${project_label}\" python3 - <<'PY'\nimport os\nimport socket\nimport sys\n\n\nPORT_KEYS = [\n    \"SUPABASE_LOCAL_SHADOW_PORT\",\n    \"SUPABASE_LOCAL_API_PORT\",\n    \"SUPABASE_LOCAL_DB_PORT\",\n    \"SUPABASE_LOCAL_STUDIO_PORT\",\n    \"SUPABASE_LOCAL_INBUCKET_PORT\",\n    \"SUPABASE_LOCAL_ANALYTICS_PORT\",\n]\n\n\ndef read_port(key):\n    value = os.environ.get(key, \"\")\n    try:\n        port = int(value)\n    except ValueError:\n        raise RuntimeError(f\"{key} must be an integer, got {value!r}\") from None\n\n    if port < 1 or port > 65535:\n        raise RuntimeError(f\"{key} must be between 1 and 65535, got {port}\")\n\n    return port\n\n\ndef can_bind(port):\n    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:\n        try:\n            sock.bind((\"0.0.0.0\", port))\n        except OSError:\n            return False\n    return True\n\n\ndef main():\n    project_label = os.environ.get(\"ANKH_PROJECT_LABEL\", \"unknown\")\n    ports = [(key, read_port(key)) for key in PORT_KEYS]\n\n    seen = {}\n    duplicates = []\n    for key, port in ports:\n      existing = seen.get(port)\n      if existing is not None:\n        duplicates.append((key, existing, port))\n      else:\n        seen[port] = key\n\n    blocked = [(key, port) for key, port in ports if not can_bind(port)]\n\n    if not duplicates and not blocked:\n        return 0\n\n    print(f\"Supabase local port preflight failed for project '{project_label}'.\", file=sys.stderr)\n\n    for key, existing, port in duplicates:\n        print(f\"- {key} duplicates {existing} on port {port}.\", file=sys.stderr)\n\n    for key, port in blocked:\n        print(f\"- {key}={port} is already in use on this host.\", file=sys.stderr)\n\n    print(\"Override SUPABASE_LOCAL_PORT_BASE or the specific SUPABASE_LOCAL_*_PORT values in infra/minikube/.env and retry.\", file=sys.stderr)\n    return 1\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\nPY\n}\n\nif [[ ! -f \"\\${SUPABASE_PROJECT_DIR}/supabase/config.toml\" ]]; then\n  echo \"No supabase/config.toml found in \\${SUPABASE_PROJECT_DIR}. Initializing Supabase project...\"\n  supabase --workdir \"\\${SUPABASE_PROJECT_DIR}\" init --yes >/dev/null\n  write_supabase_project_identity_for_new_config\nfi\n\nvalidate_supabase_project_identity\nconfigure_supabase_local_ports\n\nSTATUS_ENV=\"$(\n  supabase --workdir \"\\${SUPABASE_PROJECT_DIR}\" status -o env 2>/dev/null || true\n)\"\n\nread_env_value() {\n  local key=\"$1\"\n  local line\n  line=\"$(printf '%s\\\\n' \"\\${STATUS_ENV}\" | awk -v key=\"\\${key}\" '\n    $0 ~ \"^(export[[:space:]]+)?\" key \"=\" {print}\n  ' | tail -n1)\"\n\n  if [[ -z \"\\${line}\" ]]; then\n    echo \"\"\n    return\n  fi\n\n  line=\"\\${line#export }\"\n  line=\"\\${line#\\${key}=}\"\n  line=\"\\${line%\\\\\"}\"\n  line=\"\\${line#\\\\\"}\"\n  printf '%s' \"\\${line}\"\n}\n\ncheck_immutable_migrations_applied() {\n  local migrations_dir=\"\\${SUPABASE_PROJECT_DIR}/supabase/migrations\"\n  local applied_versions\n  applied_versions=\"$(psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -Atc \"select version from supabase_migrations.schema_migrations\" 2>/dev/null || true)\"\n\n  if [[ -z \"\\${applied_versions}\" ]]; then\n    applied_versions=\"\"\n  fi\n\n  if [[ ! -d \"\\${migrations_dir}\" ]]; then\n    return 0\n  fi\n\n  local file\n  local version\n  local pending=0\n  for file in \"\\${migrations_dir}\"/*.sql; do\n    [[ -e \"\\${file}\" ]] || continue\n    version=\"$(basename \"\\${file}\")\"\n    version=\"\\${version%%_*}\"\n    if ! printf '%s\\\\n' \"\\${applied_versions}\" | grep -Fxq \"\\${version}\"; then\n      echo \"Pending immutable Supabase migration: \\${file}\"\n      pending=1\n    fi\n  done\n\n  return \"\\${pending}\"\n}\n\nstart_supabase_local_stack() {\n  if supabase --workdir \"\\${SUPABASE_PROJECT_DIR}\" start >/dev/null; then\n    return 0\n  fi\n\n  echo \"Supabase local start failed. Stopping stale local stack and retrying once...\"\n  supabase --workdir \"\\${SUPABASE_PROJECT_DIR}\" stop --no-backup >/dev/null 2>&1 || true\n\n  if supabase --workdir \"\\${SUPABASE_PROJECT_DIR}\" start >/dev/null; then\n    return 0\n  fi\n\n  echo \"Supabase local start failed after retry.\"\n  return 1\n}\n\nif [[ -z \"\\${STATUS_ENV}\" ]]; then\n  validate_supabase_project_identity\n  assert_supabase_local_ports_available\n  echo \"Supabase local stack not detected. Starting with 'supabase start'...\"\n  start_supabase_local_stack\n  STATUS_ENV=\"$(supabase --workdir \"\\${SUPABASE_PROJECT_DIR}\" status -o env)\"\nfi\n\nSUPABASE_DB_URL=\"$(read_env_value DB_URL)\"\nif [[ -z \"\\${SUPABASE_DB_URL}\" ]]; then\n  echo \"Unable to read DB_URL from 'supabase status -o env'.\"\n  exit 1\nfi\n\necho \"Applying pending immutable Supabase migrations...\"\nvalidate_supabase_project_identity\nrun_checked_command \\\n  \"Immutable Supabase migration application\" \\\n  \"\" \\\n  supabase --workdir \"\\${SUPABASE_PROJECT_DIR}\" migration up --local\n\nif ! check_immutable_migrations_applied; then\n  echo \"Immutable Supabase migration application did not apply every local migration.\"\n  exit 1\nfi\n\nif [[ \"\\${SUPABASE_PROFILE_ENABLED}\" == \"true\" ]]; then\n  if [[ ! -f \"\\${SUPABASE_PROFILE_RECONCILE_FILE}\" ]]; then\n    echo \"Generated profile reconciliation file is missing: \\${SUPABASE_PROFILE_RECONCILE_FILE}\"\n    exit 1\n  fi\n\n  echo \"Applying generated profile reconciliation...\"\n  run_checked_sql_file \\\n    \"Generated profile reconciliation\" \\\n    \"\\${SUPABASE_PROFILE_RECONCILE_FILE}\"\n\n  PROFILE_STATUS_SQL=$(cat <<'SQL'\n${profileStatusSql}\nSQL\n)\n  PROFILE_VERIFY_SQL=$(cat <<'SQL'\n${profileVerificationSql}\nSQL\n)\n\n  PROFILE_STATUS_FILE=\"$(mktemp)\"\n  PROFILE_VERIFY_FILE=\"$(mktemp)\"\n  printf '%s\\\\n' \"\\${PROFILE_STATUS_SQL}\" > \"\\${PROFILE_STATUS_FILE}\"\n  printf '%s\\\\n' \"\\${PROFILE_VERIFY_SQL}\" > \"\\${PROFILE_VERIFY_FILE}\"\n\n  run_checked_sql_file \\\n    \"Generated profile reconciliation checksum verification\" \\\n    \"\\${PROFILE_STATUS_FILE}\"\n  run_checked_sql_file \\\n    \"Generated profile schema verification\" \\\n    \"\\${PROFILE_VERIFY_FILE}\"\n\n  rm -f \"\\${PROFILE_STATUS_FILE}\" \"\\${PROFILE_VERIFY_FILE}\"\n  echo \"Generated profile reconciliation applied and schema verified.\"\nelse\n  PROFILE_DISABLED_FILE=\"$(mktemp)\"\n  cat > \"\\${PROFILE_DISABLED_FILE}\" <<'SQL'\n${getSupabaseProfileDisabledGuardSql()}\nSQL\n  run_checked_sql_file \\\n    \"Generated profile disabled-state verification\" \\\n    \"\\${PROFILE_DISABLED_FILE}\"\n  rm -f \"\\${PROFILE_DISABLED_FILE}\"\nfi\n\nSTATUS_ENV=\"$(supabase --workdir \"\\${SUPABASE_PROJECT_DIR}\" status -o env)\"\n\nAPI_URL=\"$(read_env_value API_URL)\"\nANON_KEY=\"$(read_env_value ANON_KEY)\"\nSERVICE_ROLE_KEY=\"$(read_env_value SERVICE_ROLE_KEY)\"\nJWT_SECRET=\"$(read_env_value JWT_SECRET)\"\n\nif [[ -z \"\\${API_URL}\" || -z \"\\${ANON_KEY}\" || -z \"\\${SERVICE_ROLE_KEY}\" || -z \"\\${JWT_SECRET}\" ]]; then\n  echo \"Unable to read required Supabase values from 'supabase status -o env'.\"\n  echo \"Expected API_URL, ANON_KEY, SERVICE_ROLE_KEY, JWT_SECRET.\"\n  exit 1\nfi\n\nupsert_env() {\n  local file=\"$1\"\n  local key=\"$2\"\n  local value=\"$3\"\n  local tmp_file\n  tmp_file=\"$(mktemp)\"\n\n  awk -v key=\"\\${key}\" -v value=\"\\${value}\" '\n    BEGIN { replaced = 0 }\n    index($0, key \"=\") == 1 {\n      print key \"=\" value\n      replaced = 1\n      next\n    }\n    { print }\n    END {\n      if (replaced == 0) {\n        print key \"=\" value\n      }\n    }\n  ' \"\\${file}\" > \"\\${tmp_file}\"\n\n  mv \"\\${tmp_file}\" \"\\${file}\"\n}\n\nif [[ ! -f \"\\${ENV_FILE}\" ]]; then\n  cp \"\\${ENV_EXAMPLE_FILE}\" \"\\${ENV_FILE}\"\nfi\n\nif [[ ! -f \"\\${APP_SUPABASE_ENV_FILE}\" ]]; then\n  touch \"\\${APP_SUPABASE_ENV_FILE}\"\nfi\n\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_SECRET_SYNC_ENABLED\" \"true\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_URL\" \"\\${API_URL}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_ANON_KEY\" \"\\${ANON_KEY}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_SERVICE_ROLE_KEY\" \"\\${SERVICE_ROLE_KEY}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_JWT_SECRET\" \"\\${JWT_SECRET}\"\nupsert_env \"\\${ENV_FILE}\" \"EXPO_PUBLIC_SUPABASE_URL\" \"\\${API_URL}\"\nupsert_env \"\\${ENV_FILE}\" \"EXPO_PUBLIC_SUPABASE_ANON_KEY\" \"\\${ANON_KEY}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_PROJECT_DIR\" \"\\${SUPABASE_PROJECT_DIR}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_LOCAL_PORT_BASE\" \"\\${SUPABASE_LOCAL_PORT_BASE}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_LOCAL_SHADOW_PORT\" \"\\${SUPABASE_LOCAL_SHADOW_PORT}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_LOCAL_API_PORT\" \"\\${SUPABASE_LOCAL_API_PORT}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_LOCAL_DB_PORT\" \"\\${SUPABASE_LOCAL_DB_PORT}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_LOCAL_STUDIO_PORT\" \"\\${SUPABASE_LOCAL_STUDIO_PORT}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_LOCAL_INBUCKET_PORT\" \"\\${SUPABASE_LOCAL_INBUCKET_PORT}\"\nupsert_env \"\\${ENV_FILE}\" \"SUPABASE_LOCAL_ANALYTICS_PORT\" \"\\${SUPABASE_LOCAL_ANALYTICS_PORT}\"\n\nupsert_env \"\\${APP_SUPABASE_ENV_FILE}\" \"EXPO_PUBLIC_SUPABASE_URL\" \"\\${API_URL}\"\nupsert_env \"\\${APP_SUPABASE_ENV_FILE}\" \"EXPO_PUBLIC_SUPABASE_ANON_KEY\" \"\\${ANON_KEY}\"\nupsert_env \"\\${APP_SUPABASE_ENV_FILE}\" \"SUPABASE_URL\" \"\\${API_URL}\"\nupsert_env \"\\${APP_SUPABASE_ENV_FILE}\" \"SUPABASE_ANON_KEY\" \"\\${ANON_KEY}\"\n\necho \"Updated \\${ENV_FILE} with local Supabase credentials from \\${SUPABASE_PROJECT_DIR}.\"\necho \"Updated \\${APP_SUPABASE_ENV_FILE} with Expo Supabase credentials for local app runs.\"\necho \"If Expo is already running, restart it to pick up updated EXPO_PUBLIC_* variables.\"\necho \"Next: run ./scripts/up.sh to sync Kubernetes secrets and apply infrastructure.\"\n`;\n}\n\nfunction getDefaultAppImage(namespace: string): string {\n  return `ankh/${namespace}:dev`;\n}\n\nfunction resolveSupabaseLocalPorts(namespace: string): SupabaseLocalPorts {\n  const base =\n    SUPABASE_LOCAL_PORT_BASE +\n    resolveSupabaseLocalPortBucket(namespace) * SUPABASE_LOCAL_PORT_BUCKET_SIZE;\n\n  return {\n    base,\n    shadow: base,\n    api: base + 1,\n    db: base + 2,\n    studio: base + 3,\n    inbucket: base + 4,\n    analytics: base + 5,\n  };\n}\n\nfunction resolveSupabaseLocalPortBucket(namespace: string): number {\n  const rawBucket = hashProjectId(namespace) - hashProjectId(SUPABASE_LOCAL_PORT_REFERENCE_PROJECT);\n  return (rawBucket + SUPABASE_LOCAL_PORT_BUCKET_COUNT) % SUPABASE_LOCAL_PORT_BUCKET_COUNT;\n}\n\nfunction hashProjectId(value: string): number {\n  const source = value.trim().length > 0 ? value.trim() : 'app';\n  let hash = 0;\n\n  for (const char of source) {\n    hash = (hash * 31 + char.charCodeAt(0)) % SUPABASE_LOCAL_PORT_BUCKET_COUNT;\n  }\n\n  return hash;\n}\n\nfunction getSqlTextArray(values: readonly string[]): string {\n  return `array[${values.map((value) => `'${escapeSqlLiteral(value)}'`).join(', ')}]::text[]`;\n}\n\nfunction escapeSqlLiteral(value: string): string {\n  return value.replaceAll(\"'\", \"''\");\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAGvE,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAkCtC,MAAM,eAAe,GAAsB;IACzC,QAAQ,EAAE,8BAA8B;IACxC,IAAI,EAAE,0BAA0B;IAChC,IAAI,EAAE,4BAA4B;IAClC,QAAQ,EAAE,4BAA4B;IACtC,OAAO,EAAE,8BAA8B;IACvC,QAAQ,EAAE,2BAA2B;IACrC,IAAI,EAAE,gCAAgC;IACtC,OAAO,EAAE,iBAAiB;IAC1B,MAAM,EAAE,wCAAwC;CACjD,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,UAAU,6BAA6B,CAAC,IAO7C;IACC,MAAM,EACJ,QAAQ,EACR,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAChB,GAAG,IAAI,CAAC;IAET,MAAM,IAAI,GAAG,gBAAgB,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC;IAC9B,MAAM,WAAW,GAAG,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,YAAY,GAAG,GAAG,IAAI,YAAY,CAAC;IACzC,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC;IACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,MAAM,CAAC;IACnE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,CAAC;IAC/D,MAAM,mBAAmB,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,IAAI,MAAM,CAAC;IACrE,MAAM,eAAe,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,QAAQ,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC;IACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;IACjD,MAAM,yBAAyB,GAC7B,YAAY,KAAK,UAAU;QAC3B,gBAAgB,KAAK,UAAU;QAC/B,eAAe,KAAK,IAAI;QACxB,mBAAmB,KAAK,gBAAgB,CAAC;IAE3C,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,kBAAkB,GAAG;QACzB,qBAAqB;QACrB,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,SAAS,OAAO,CAAC;KACzE,CAAC;IAEF,OAAO;QACL;YACE,IAAI,EAAE,GAAG,IAAI,YAAY;YACzB,OAAO,EAAE,iBAAiB,CAAC;gBACzB,OAAO;gBACP,eAAe;gBACf,iBAAiB;gBACjB,YAAY;gBACZ,WAAW;gBACX,cAAc;gBACd,iBAAiB;gBACjB,yBAAyB;gBACzB,YAAY;gBACZ,cAAc;gBACd,kBAAkB;gBAClB,iBAAiB;aAClB,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,IAAI,eAAe;YAC5B,OAAO,EAAE,aAAa,CAAC;gBACrB,OAAO;gBACP,MAAM;gBACN,eAAe;gBACf,eAAe;gBACf,iBAAiB;gBACjB,yBAAyB;gBACzB,cAAc;aACf,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,OAAO,sBAAsB;YACtC,OAAO,EAAE,oBAAoB,CAAC,aAAa,CAAC;SAC7C;QACD,GAAG,CAAC,yBAAyB;YAC3B,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,GAAG,OAAO,2BAA2B;oBAC3C,OAAO,EAAE,oBAAoB,CAAC,kBAAkB,CAAC;iBAClD;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,GAAG,OAAO,eAAe,SAAS,OAAO;YAC/C,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;QACH;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,eAAe,CAAC;gBACvB,OAAO;gBACP,SAAS;gBACT,YAAY;gBACZ,gBAAgB;gBAChB,mBAAmB;gBACnB,eAAe;gBACf,iBAAiB;gBACjB,MAAM;aACP,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,OAAO,sBAAsB;YACtC,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC;SACnD;QACD;YACE,IAAI,EAAE,GAAG,OAAO,mBAAmB;YACnC,OAAO,EAAE,qBAAqB,EAAE;SACjC;QACD,GAAG,iBAAiB;QACpB;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,wBAAwB,CAAC;gBAChC,kBAAkB;gBAClB,eAAe,EAAE,yBAAyB;gBAC1C,cAAc;aACf,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,WAAW,QAAQ;YAC5B,OAAO,EAAE,WAAW,CAAC;gBACnB,OAAO;gBACP,eAAe;gBACf,yBAAyB;gBACzB,YAAY;gBACZ,mBAAmB;gBACnB,iBAAiB;gBACjB,cAAc;gBACd,iBAAiB;aAClB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,qBAAqB;YACzC,OAAO,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YAC7D,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,kBAAkB;YACtC,OAAO,EAAE,oBAAoB,CAAC;gBAC5B,OAAO;gBACP,yBAAyB;gBACzB,iBAAiB;aAClB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,UAAU;YAC9B,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,WAAW;YAC/B,OAAO,EAAE,cAAc,CAAC;gBACtB,OAAO;gBACP,yBAAyB;gBACzB,kBAAkB;aACnB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,aAAa;YACjC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;YAClC,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,YAAY;YAChC,OAAO,EAAE,eAAe,CAAC;gBACvB,OAAO;gBACP,yBAAyB;gBACzB,YAAY;gBACZ,iBAAiB;gBACjB,kBAAkB;gBAClB,iBAAiB;aAClB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,YAAY,aAAa;YAClC,OAAO,EAAE,qBAAqB,EAAE;SACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAa1B;IACC,MAAM,EACJ,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,MAAM,aAAa,GAAG;QACpB,qBAAqB;QACrB,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,SAAS,OAAO,CAAC;QACxE,oBAAoB;QACpB,qBAAqB;QACrB,kBAAkB;QAClB,GAAG,CAAC,yBAAyB;YAC3B,CAAC,CAAC;gBACE,wBAAwB;gBACxB,uCAAuC;gBACvC,4BAA4B;gBAC5B,wBAAwB;gBACxB,oBAAoB;gBACpB,oBAAoB;gBACpB,wBAAwB;gBACxB,uBAAuB;gBACvB,wBAAwB;gBACxB,oBAAoB;gBACpB,+BAA+B;gBAC/B,6BAA6B;gBAC7B,uBAAuB;gBACvB,sBAAsB;aACvB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,cAAc;KAClB;SACE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,QAAQ,IAAI,CAAC;SAC1C,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,eAAe,GAAG;QACtB,aAAa;QACb,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,kBAAkB;KACtB,CAAC;IACF,MAAM,gBAAgB,GAAG,oCAAoC,eAAe;SACzE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,IAAI,CAAC;SACtC,IAAI,CACH,IAAI,CACL,wHAAwH,CAAC;IAC5H,MAAM,qBAAqB,GACzB,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,4BAA4B,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QACnE,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,sBAAsB,GAC1B,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,4CAA4C,iBAAiB;aAC1D,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChB,MAAM,SAAS,GACb,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,QAAQ,CAAC,eAAe;qBACrB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,QAAQ,qBAAqB,KAAK,CAAC,SAAS,IAAI,CAAC;qBAC3E,IAAI,CAAC,IAAI,CAAC;gBACf,CAAC,CAAC,MAAM,CAAC;YACb,MAAM,SAAS,GACb,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,CAAC,QAAQ,CAAC,SAAS;qBACf,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,IAAI,UAAU,QAAQ,CAAC,GAAG,IAAI,CAAC;qBAC/D,IAAI,CAAC,IAAI,CAAC;gBACf,CAAC,CAAC,MAAM,CAAC;YACb,OAAO,OAAO,QAAQ,CAAC,EAAE,mBAAmB,QAAQ,CAAC,SAAS,iBAAiB,SAAS,eAAe,SAAS,EAAE,CAAC;QACrH,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,IAAI;QACnB,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,gBAAgB,GACpB,cAAc,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,mPAAmP;QACrP,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;;;;;;mCAM0B,OAAO;6BACb,aAAa;0BAChB,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ;EACjF,qBAAqB,0BAA0B,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA4B5B,OAAO;0EAC+B,OAAO;gDACjC,OAAO,OAAO,gBAAgB;+CAC/B,OAAO;;;;EAIpD,aAAa;;;;;;;;;;;;EAYb,gBAAgB;;;;gBAIF,eAAe,CAAC,QAAQ;YAC5B,eAAe,CAAC,IAAI;iBACf,eAAe,CAAC,IAAI;gBACrB,eAAe,CAAC,QAAQ;eACzB,eAAe,CAAC,OAAO;eACvB,eAAe,CAAC,OAAO;cACxB,eAAe,CAAC,MAAM;;;;4BAIR,iBAAiB,CAAC,GAAG;yCACR,iBAAiB,CAAC,OAAO;+BACnC,iBAAiB,CAAC,MAAM;uCAChB,iBAAiB,CAAC,EAAE;;;;4BAI/B,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;qBAC3C,YAAY;4BACL,WAAW;EACrC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,iKAAiK,CAAC,CAAC,CAAC,EAAE;EAC7L,sBAAsB;CACvB,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAQtB;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAC5F,IAAI,CAAC;IAEP,MAAM,WAAW,GAAG;QAClB,4CAA4C;QAC5C,iBAAiB,OAAO,EAAE;QAC1B,wBAAwB;QACxB,wBAAwB;QACxB,iBAAiB;QACjB,qCAAqC;QACrC,aAAa,eAAe,EAAE;QAC9B,qCAAqC;QACrC,mCAAmC;QACnC,iCAAiC;QACjC,+BAA+B;QAC/B,+BAA+B,iBAAiB,CAAC,GAAG,EAAE;QACtD,iCAAiC;QACjC,uCAAuC,iBAAiB,CAAC,OAAO,EAAE;QAClE,2CAA2C;QAC3C,sCAAsC,iBAAiB,CAAC,MAAM,EAAE;QAChE,0CAA0C;QAC1C,kCAAkC,iBAAiB,CAAC,EAAE,EAAE;QACxD,sCAAsC;QACtC,gBAAgB;QAChB,gCAAgC;QAChC,EAAE;QACF,gDAAgD;QAChD,6BAA6B;QAC7B,sCAAsC;QACtC,iCAAiC;QACjC,iCAAiC;QACjC,8BAA8B;QAC9B,EAAE;QACF,kCAAkC;QAClC,cAAc,MAAM,EAAE;QACtB,EAAE;QACF,uCAAuC;QACvC,oBAAoB;QACpB,aAAa;QACb,oBAAoB;QACpB,4BAA4B;QAC5B,2BAA2B;QAC3B,sBAAsB;QACtB,6BAA6B;QAC7B,qBAAqB;QACrB,kBAAkB;QAClB,sBAAsB;QACtB,qBAAqB;QACrB,4BAA4B;QAC5B,gCAAgC;QAChC,iBAAiB;QACjB,WAAW;QACX,6BAA6B;QAC7B,2BAA2B;QAC3B,sBAAsB;QACtB,mBAAmB;QACnB,0BAA0B;QAC1B,+BAA+B;QAC/B,oCAAoC;QACpC,qBAAqB;QACrB,gBAAgB;QAChB,YAAY;QACZ,YAAY;QACZ,4BAA4B;QAC5B,gDAAgD;QAChD,wBAAwB;QACxB,mCAAmC;QACnC,uBAAuB;QACvB,wBAAwB;QACxB,aAAa;QACb,kBAAkB;QAClB,2BAA2B;QAC3B,gCAAgC;QAChC,GAAG,yBAAyB,CAAC,cAAc,CAAC;QAC5C,EAAE;QACF,iCAAiC;KAClC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAkD;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO;QACL,EAAE;QACF,8EAA8E;QAC9E,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,KAAK,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,cAAc,EAAE;YAC9C,mBAAmB,QAAQ,CAAC,SAAS,aAAa;YAClD,mBAAmB,QAAQ,CAAC,SAAS,UAAU;YAC/C,mBAAmB,QAAQ,CAAC,SAAS,gBAAgB;SACtD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAkD;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,SAAS;SACb,GAAG,CACF,CACE,QAAQ,EACR,EAAE,CAAC,4BAA4B,QAAQ,CAAC,SAAS,kCAAkC,QAAQ,CAAC,SAAS;2BAClF,QAAQ,CAAC,SAAS,+BAA+B,QAAQ,CAAC,SAAS;2BACnE,QAAQ,CAAC,SAAS,qCAAqC,QAAQ,CAAC,SAAS,gDAAgD,CAC/I;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CAAC,SAAkD;IACpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,SAAS;SACb,GAAG,CACF,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,QAAQ,CAAC,SAAS;kBACvC,QAAQ,CAAC,SAAS,iCAAiC,QAAQ,CAAC,SAAS;kBACrE,QAAQ,CAAC,SAAS,8BAA8B,QAAQ,CAAC,SAAS;kBAClE,QAAQ,CAAC,SAAS,oCAAoC,QAAQ,CAAC,SAAS,gBAAgB,CACrG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,+BAA+B,CACtC,SAAkD;IAElD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,SAAS;SACrB,GAAG,CACF,CACE,QAAQ,EACR,EAAE,CAAC,kCAAkC,QAAQ,CAAC,SAAS,4CAA4C,QAAQ,CAAC,SAAS;2BAClG,QAAQ,CAAC,EAAE,oDAAoD,QAAQ,CAAC,SAAS,kCAAkC,QAAQ,CAAC,SAAS,+BAA+B,QAAQ,CAAC,cAAc;;KAEjN,CACA;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;EAEP,MAAM,EAAE,CAAC;AACX,CAAC;AAED,SAAS,6BAA6B,CAAC,SAAkD;IACvF,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,IAAI,gBAAgB,CAAC;AACzD,CAAC;AAED,SAAS,6BAA6B,CAAC,IAItC;IACC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IAC9D,IAAI,mBAAmB,KAAK,gBAAgB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO;;;;CAIV,CAAC;IACA,CAAC;IAED,MAAM,KAAK,GAAG,cAAc;SACzB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,mBAAmB,QAAQ,CAAC,SAAS,YAAY,CAAC;QAChE,MAAM,SAAS,GAAG,mBAAmB,QAAQ,CAAC,SAAS,SAAS,CAAC;QAEjE,OAAO,kBAAkB,KAAK,kBAAkB,SAAS;;wDAEP,GAAG;4DACC,GAAG;;eAEhD,KAAK;;;eAGL,SAAS;;KAEnB,CAAC;IACF,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;iSAIwR,qBAAqB,CAClT,OAAO,CACR;;;;;;;;EAQD,KAAK;;CAEN,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,gCAAgC,CACvC,iBAAuD;IAEvD,OAAO,GAAG,mCAAmC,CAAC;QAC5C,YAAY,EAAE,yBAAyB;QACvC,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,CACJ;KACF,CAAC;;EAEF,mCAAmC,CAAC;QACpC,YAAY,EAAE,6BAA6B;QAC3C,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAChD,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,CACJ;KACF,CAAC;;EAEA,4BAA4B,CAAC,iBAAiB,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,mCAAmC,CAAC,IAI5C;IACC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,GAAG,IAAI,CAAC,YAAY;IAC3B,IAAI,CAAC,WAAW;EAClB,CAAC;IACD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ;SACvB,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,uBAAuB,CAC9D,OAAO,CAAC,UAAU,CACnB,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC;EAC/C,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAC1C;SACA,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,OAAO,GAAG,IAAI,CAAC,YAAY;EAC3B,IAAI;EACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,iBAAuD;IAEvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpD,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CACjF,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;;EAET,CAAC;IACD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM;SAChB,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,yCAAyC,uBAAuB,CAC9D,KAAK,CAAC,SAAS,CAChB,qBAAqB,uBAAuB,CAC3C,KAAK,CAAC,QAAQ,CACf,eAAe,KAAK,CAAC,cAAc,GAAG,CAC1C;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;EACP,IAAI;EACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,iBAAuD;IACtF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,iBAAiB;SACrB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS;aACrC,GAAG,CACF,CAAC,QAAQ,EAAE,EAAE,CACX,sBAAsB,uBAAuB,CAC3C,QAAQ,CAAC,EAAE,CACZ,aAAa,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,uBAAuB,CAC9E,QAAQ,CAAC,GAAG,CACb,GAAG,CACP;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe;aAC5C,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC,4CAA4C,uBAAuB,CAC5E,KAAK,CAAC,SAAS,CAChB,qBAAqB,uBAAuB,CAC3C,KAAK,CAAC,QAAQ,CACf;uBACY,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,uBAAuB,CAChF,KAAK,CAAC,KAAK,CACZ;;uBAEkB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,uBAAuB,CAChF,KAAK,CAAC,KAAK,CACZ;KACA,CACI;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,iBAAiB,GAAG,QAAQ,CAAC,YAAY;aAC5C,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC,4BAA4B,uBAAuB,CAC5D,QAAQ,CAAC,EAAE,CACZ,iBAAiB,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC;EAC9D,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CACpC;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,CAAC,aAAa,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,OAAO;;;UAGC,SAAS;;;mCAGgB,SAAS;CAC3C,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IASxB;IACC,MAAM,EACJ,OAAO,EACP,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,MAAM,GACP,GAAG,IAAI,CAAC;IAET,MAAM,YAAY,GAAG,eAAe;QAClC,CAAC,CAAC,wBAAwB,eAAe,CAAC,QAAQ;sBAChC,sBAAsB,CAAC,eAAe,CAAC,UAAU,CAAC;6BAC3C,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC;CACjF;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;eAIM,aAAa;;oBAER,OAAO;;oBAEP,aAAa;yBACR,kBAAkB;yBAClB,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;iBAC5C,SAAS;oBACN,YAAY;wBACR,gBAAgB;4BACZ,mBAAmB;EAC7C,YAAY,sBAAsB,sBAAsB,CAAC,MAAM,CAAC;CACjE,CAAC;AACF,CAAC;AAED,SAAS,8BAA8B,CACrC,QAA4B;IAE5B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IAChC,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,aAAa;SACd,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,uBAAuB,GAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU,CAAC;QAEvF,IAAI,CAAC,uBAAuB;YAAE,OAAO,IAAI,CAAC;QAE1C,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,aAAa;SACd,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,6BAA6B,CACpC,QAA4B;IAE5B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,aAAa,GAAG,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEvE,OAAO,KAAK,CAAC,SAAS;SACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC;SAChD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,kDAAkD,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,SAAS,GAAG,EAAE;aACjB,WAAW,EAAE;aACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;QACzF,CAAC;QAED,OAAO;YACL,EAAE;YACF,SAAS;YACT,cAAc;YACd,aAAa;SACd,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,2BAA2B,CAAC,QAA4B;IAC/D,MAAM,YAAY,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACxF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;IACrE,OAAO,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,UAA6B;IACrD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAIjC;IACC,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe;QAC5C,CAAC,CAAC;YACE,uCAAuC;YACvC,4BAA4B;YAC5B,wBAAwB;YACxB,oBAAoB;YACpB,oBAAoB;YACpB,wBAAwB;YACxB,wBAAwB;YACxB,uBAAuB;YACvB,oBAAoB;YACpB,uBAAuB;YACvB,sBAAsB;SACvB;QACH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,SAAS,GAAG;QAChB,GAAG,IAAI,CAAC,kBAAkB;QAC1B,oBAAoB;QACpB,qBAAqB;QACrB,kBAAkB;QAClB,GAAG,iBAAiB;QACpB,GAAG,IAAI,CAAC,cAAc;KACvB,CAAC;IACF,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhF,OAAO;;;EAGP,aAAa;CACd,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,eAAuB;IACvD,OAAO;;;;eAIM,aAAa;;;;;;;;;;;;;;;mBAeT,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BjC,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;;;;eAIM,aAAa;;;;;;;;;;;CAW3B,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,OAAO;QACL;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,wCAAwC;YACxD,OAAO,EAAE,gCAAgC,EAAE;SAC5C;QACD;YACE,IAAI,EAAE,GAAG,OAAO,6BAA6B;YAC7C,OAAO,EAAE,sBAAsB,CAAC,wBAAwB,EAAE,MAAM,CAAC;SAClE;QACD;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,2BAA2B,EAAE;SACvC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,2BAA2B,EAAE;SACvC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,wBAAwB;YACxC,OAAO,EAAE,0BAA0B,EAAE;SACtC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,2BAA2B,EAAE;SACvC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,gCAAgC;YAChD,OAAO,EAAE,0BAA0B,EAAE;SACtC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,8BAA8B;YAC9C,OAAO,EAAE,+BAA+B,EAAE;YAC1C,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,OAAO,wBAAwB;YACxC,OAAO,EAAE,0BAA0B,EAAE;SACtC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,uBAAuB;YACvC,OAAO,EAAE,yBAAyB,EAAE;SACrC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsER,CAAC;AACF,CAAC;AAED,SAAS,gCAAgC;IACvC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;CAShC,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAY;IACxD,OAAO;;;UAGC,IAAI;eACC,kBAAkB;;;;;;iBAMhB,IAAI;CACpB,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmE1C,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFAiC8C,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEtG,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,IAAI;;;;;;;+EAOwC,kBAAkB;;;;;;;;;;;;;;;;;;;;CAoBhG,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,QAAQ;;;;;;;;;iCASV,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0ClD,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO,GAAG,sBAAsB,CAAC,uBAAuB,EAAE,MAAM,CAAC;;;;;;eAMpD,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;wFAsB8C,kBAAkB;;oCAEtE,kBAAkB;;;;;;;;;;;;;;;;;;;;;wCAqBd,kBAAkB;;;;;;;;;;;;;CAazD,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,QAAQ;;;;;;;;CAQ1C,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,IAAI;;;;;;;;;iCASN,kBAAkB;;;;;;;;;;;;;;;;;CAiBlD,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA2Bc,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;uBAuBlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;uBAuBlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;2BAwBd,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;2BAwBlB,kBAAkB;;;;;;;;;;;;2BAYlB,kBAAkB;;;;;;;;;;;;2BAYlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;0BAwBnB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;uBAwBrB,kBAAkB;;;;;;;;;;;;;;yBAchB,kBAAkB;;;;;;;;;;CAU1C,CAAC;AACF,CAAC;AAED,SAAS,+BAA+B;IACtC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BR,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDzC,CAAC;AACF,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,MAAM;;;;;;;;;oCASL,kBAAkB;;uCAEf,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BxD,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,IASpB;IACC,MAAM,EACJ,OAAO,EACP,eAAe,EACf,yBAAyB,EACzB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,uBAAuB,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,cAAc,CAAC,CAAC;IACzE,MAAM,6BAA6B,GAAG,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;IAC1F,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;QACzD,OAAO;QACP,cAAc;QACd,mBAAmB;KACpB,CAAC,CAAC;IAEH,OAAO;;;;;;;;YAQG,OAAO;;;iBAGF,aAAa;sBACR,kBAAkB;4BACZ,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;4BAiB5C,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAwJzC,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0GAoD8D,iBAAiB,CAAC,OAAO;0FACzC,iBAAiB,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;gGAoBf,iBAAiB,CAAC,EAAE;;;;EAIlH,gBAAgB;;EAEhB,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BpB,uBAAuB;;;;;;;;8BAQK,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmJ9C,6BAA6B;;;4BAGH,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;6BAC3C,OAAO;;;;;2BAKT,eAAe;;;;;;;;;+DASqB,iBAAiB,CAAC,GAAG;+EACL,iBAAiB,CAAC,OAAO;qEACnC,iBAAiB,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCvF,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiGhB,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAkD;IAChF,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAE1C,OAAO;;;;;;YAMG,OAAO;;;;;;;;;6BASU,OAAO;;;;2BAIT,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDzC,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;;;;;;;;;;;;;;;;;;;;CAoBR,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,IAI7B;IACC,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEvE,OAAO;;;;;;YAMG,OAAO;6BACU,OAAO;4BACR,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;+DACT,iBAAiB,CAAC,GAAG;;+EAEL,iBAAiB,CAAC,OAAO;;6EAE3B,iBAAiB,CAAC,MAAM;;qEAEhC,iBAAiB,CAAC,EAAE;;;;;;;;;4BAS7D,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;cAqB1D,aAAa;;;cAGb,kBAAkB;;;cAGlB,kBAAkB;;;cAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA8JF,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiH/C,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO;;;;;YAKG,OAAO;6BACU,OAAO;;;;;;;;;;;;;;;;;;;;;;;;CAwBnC,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,IAIvB;IACC,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IACxE,MAAM,eAAe,GAAG;QACtB,aAAa;QACb,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,kBAAkB;KACtB,CAAC;IACF,MAAM,sBAAsB,GAAG,eAAe;SAC3C,GAAG,CACF,CACE,SAAS,EACT,EAAE,CAAC,oDAAoD,SAAS;mEACL,SAAS,QAAQ,CAC/E;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,UAAU,GAAG,yBAAyB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACzE,MAAM,oBAAoB,GAAG,6CAA6C,eAAe,CAAC,IAAI,CAC5F,IAAI,CACL,mHAAmH,CAAC;IACrH,MAAM,qBAAqB,GAAG,oBAAoB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAE/E,OAAO;;;;;;YAMG,OAAO;6BACU,OAAO;;;;;;;;;;;;;;;;uEAgBmC,UAAU;UACvE,oBAAoB;;;;;;;;;;EAU5B,sBAAsB;QAChB,qBAAqB;CAC5B,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO;;;;;YAKG,OAAO;6BACU,OAAO;;;;;;;;;;;;;;;;;CAiBnC,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IAOxB;IACC,MAAM,EACJ,OAAO,EACP,yBAAyB,EACzB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,MAAM,UAAU,GAAG;QACjB,aAAa;QACb,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,kBAAkB;KACtB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAExE,OAAO;;;;;YAKG,OAAO;6BACU,OAAO;4BACR,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;4BAC5C,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;+EACY,iBAAiB,CAAC,OAAO;;;;;;;;4BAQ5E,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDAgCtB,kBAAkB;;;;;;;;;;uCAU7B,kBAAkB;;;mBAGtC,UAAU;;;;;;;;;wCASW,aAAa;uCACd,aAAa;;;EAGlD,oBAAoB;;;;4CAIsB,kBAAkB;2CACnB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+D5D,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAC/B,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,gBAAgB,CAAC;IACvE,OAAO;QACL,GAAG,EAAE,IAAI;QACT,OAAO,EAAE,IAAI,GAAG,CAAC;QACjB,MAAM,EAAE,IAAI,GAAG,CAAC;QAChB,EAAE,EAAE,IAAI,GAAG,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACpE,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { GeneratedInfrastructureFile } from '../../../types';\nimport type { InfraManifestInput } from '../../../types';\nimport type { ResolvedProfileModel } from '../auth/supabase/profile';\nimport { resolveSupabaseProfileModel } from '../auth/supabase/profile';\nimport type { MinikubeProviderLifecycle } from '../contracts';\n\nexport const APP_NAMESPACE = 'app';\nconst SUPABASE_NAMESPACE = 'supabase';\n\ninterface SupabaseHostPorts {\n  app: number;\n  gateway: number;\n  studio: number;\n  db: number;\n}\n\ninterface AppInfraStorageMetadata {\n  provider: 'supabase';\n  bucketsCsv: string;\n  defaultBucket: string;\n}\n\ninterface SupabaseImagePins {\n  postgres: string;\n  auth: string;\n  rest: string;\n  realtime: string;\n  storage: string;\n  imgproxy: string;\n  meta: string;\n  gateway: string;\n  studio: string;\n}\n\ninterface SupabaseOAuthProviderRuntime {\n  id: string;\n  envPrefix: string;\n  credentialsRef: string;\n  callbackRoute: string;\n}\n\nconst SUPABASE_IMAGES: SupabaseImagePins = {\n  postgres: 'supabase/postgres:17.6.1.136',\n  auth: 'supabase/gotrue:v2.189.0',\n  rest: 'postgrest/postgrest:v14.12',\n  realtime: 'supabase/realtime:v2.102.3',\n  storage: 'supabase/storage-api:v1.60.4',\n  imgproxy: 'darthsim/imgproxy:v3.30.1',\n  meta: 'supabase/postgres-meta:v0.96.6',\n  gateway: 'kong/kong:3.9.1',\n  studio: 'supabase/studio:2026.07.07-sha-a6a04f2',\n};\n\nconst PORT_BASE = 18080;\nconst PORT_BUCKET_SIZE = 20;\nconst PORT_BUCKET_COUNT = 1000;\nconst PORT_REFERENCE_SLUG = 'my-app';\n\nexport function generateMinikubeBaseArtifacts(args: {\n  manifest: InfraManifestInput;\n  appSlug: string;\n  extraResources: string[];\n  providerNamespaces: string[];\n  providerLifecycle: MinikubeProviderLifecycle[];\n  extraEnvEntries: string[];\n}): GeneratedInfrastructureFile[] {\n  const {\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  } = args;\n\n  const root = 'infra/minikube';\n  const k8sRoot = `${root}/k8s`;\n  const scriptsRoot = `${root}/scripts`;\n  const appImageRoot = `${root}/app-image`;\n  const defaultAppImage = getDefaultAppImage(appSlug);\n  const supabaseHostPorts = resolveSupabaseHostPorts(appSlug);\n\n  const authScope = manifest.auth?.scope ?? 'none';\n  const authProvider = manifest.auth?.provider ?? 'none';\n  const authzEngine = manifest.auth?.authorization?.engine ?? 'none';\n  const databaseProvider = manifest.database?.provider ?? 'none';\n  const secretStoreProvider = manifest.secretStore?.provider ?? 'none';\n  const storageMetadata = resolveAppInfraStorageMetadata(manifest);\n  const profileModel = resolveSupabaseProfileModel(manifest);\n  const oauthProviders = resolveSupabaseOAuthProviders(manifest);\n  const monitoringEnabled = manifest.deployment?.monitoring === true;\n  const domain = manifest.networking?.domain ?? '';\n  const supabaseKubernetesEnabled =\n    authProvider === 'supabase' ||\n    databaseProvider === 'supabase' ||\n    storageMetadata !== null ||\n    secretStoreProvider === 'supabase-vault';\n\n  const supabaseResources = supabaseKubernetesEnabled ? getSupabaseResourceFiles(k8sRoot) : [];\n  const namespaceResources = [\n    'namespaces/app.yaml',\n    ...(supabaseKubernetesEnabled ? ['namespaces/supabase.yaml'] : []),\n    ...providerNamespaces.map((namespace) => `namespaces/${namespace}.yaml`),\n  ];\n\n  return [\n    {\n      path: `${root}/README.md`,\n      content: getReadmeMarkdown({\n        appSlug,\n        defaultAppImage,\n        monitoringEnabled,\n        authProvider,\n        authzEngine,\n        extraResources,\n        supabaseHostPorts,\n        supabaseKubernetesEnabled,\n        profileModel,\n        oauthProviders,\n        providerNamespaces,\n        providerLifecycle,\n      }),\n    },\n    {\n      path: `${root}/.env.example`,\n      content: getEnvExample({\n        appSlug,\n        domain,\n        extraEnvEntries,\n        defaultAppImage,\n        supabaseHostPorts,\n        supabaseKubernetesEnabled,\n        oauthProviders,\n      }),\n    },\n    {\n      path: `${k8sRoot}/namespaces/app.yaml`,\n      content: getNamespaceManifest(APP_NAMESPACE),\n    },\n    ...(supabaseKubernetesEnabled\n      ? [\n          {\n            path: `${k8sRoot}/namespaces/supabase.yaml`,\n            content: getNamespaceManifest(SUPABASE_NAMESPACE),\n          },\n        ]\n      : []),\n    ...providerNamespaces.map((namespace) => ({\n      path: `${k8sRoot}/namespaces/${namespace}.yaml`,\n      content: getNamespaceManifest(namespace),\n    })),\n    {\n      path: `${k8sRoot}/app.configmap.yaml`,\n      content: getAppConfigMap({\n        appSlug,\n        authScope,\n        authProvider,\n        databaseProvider,\n        secretStoreProvider,\n        storageMetadata,\n        monitoringEnabled,\n        domain,\n      }),\n    },\n    {\n      path: `${k8sRoot}/app/deployment.yaml`,\n      content: getAppDeploymentManifest(defaultAppImage),\n    },\n    {\n      path: `${k8sRoot}/app/service.yaml`,\n      content: getAppServiceManifest(),\n    },\n    ...supabaseResources,\n    {\n      path: `${k8sRoot}/kustomization.yaml`,\n      content: getKustomizationManifest({\n        namespaceResources,\n        supabaseEnabled: supabaseKubernetesEnabled,\n        extraResources,\n      }),\n    },\n    {\n      path: `${scriptsRoot}/up.sh`,\n      content: getUpScript({\n        appSlug,\n        defaultAppImage,\n        supabaseKubernetesEnabled,\n        profileModel,\n        secretStoreProvider,\n        supabaseHostPorts,\n        oauthProviders,\n        providerLifecycle,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/build-app-image.sh`,\n      content: getBuildAppImageScript({ appSlug, defaultAppImage }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/port-forward.sh`,\n      content: getPortForwardScript({\n        appSlug,\n        supabaseKubernetesEnabled,\n        supabaseHostPorts,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/down.sh`,\n      content: getDownScript(appSlug),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/reset.sh`,\n      content: getResetScript({\n        appSlug,\n        supabaseKubernetesEnabled,\n        providerNamespaces,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/destroy.sh`,\n      content: getDestroyScript(appSlug),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/status.sh`,\n      content: getStatusScript({\n        appSlug,\n        supabaseKubernetesEnabled,\n        profileModel,\n        supabaseHostPorts,\n        providerNamespaces,\n        providerLifecycle,\n      }),\n      executable: true,\n    },\n    {\n      path: `${appImageRoot}/Dockerfile`,\n      content: getAppImageDockerfile(),\n    },\n  ];\n}\n\nfunction getReadmeMarkdown(args: {\n  appSlug: string;\n  defaultAppImage: string;\n  monitoringEnabled: boolean;\n  authProvider: string;\n  authzEngine: string;\n  extraResources: string[];\n  supabaseHostPorts: SupabaseHostPorts;\n  supabaseKubernetesEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n  providerNamespaces: readonly string[];\n  providerLifecycle: readonly MinikubeProviderLifecycle[];\n}): string {\n  const {\n    appSlug,\n    defaultAppImage,\n    monitoringEnabled,\n    authProvider,\n    authzEngine,\n    extraResources,\n    supabaseHostPorts,\n    supabaseKubernetesEnabled,\n    profileModel,\n    oauthProviders,\n    providerNamespaces,\n    providerLifecycle,\n  } = args;\n  const resourceLines = [\n    'namespaces/app.yaml',\n    ...(supabaseKubernetesEnabled ? ['namespaces/supabase.yaml'] : []),\n    ...providerNamespaces.map((namespace) => `namespaces/${namespace}.yaml`),\n    'app.configmap.yaml',\n    'app/deployment.yaml',\n    'app/service.yaml',\n    ...(supabaseKubernetesEnabled\n      ? [\n          'supabase/bootstrap.sql',\n          'supabase/postgres.init.configmap.yaml',\n          'supabase/postgres.pvc.yaml',\n          'supabase/postgres.yaml',\n          'supabase/auth.yaml',\n          'supabase/rest.yaml',\n          'supabase/realtime.yaml',\n          'supabase/storage.yaml',\n          'supabase/imgproxy.yaml',\n          'supabase/meta.yaml',\n          'supabase/gateway.template.yml',\n          'supabase/kong-entrypoint.sh',\n          'supabase/gateway.yaml',\n          'supabase/studio.yaml',\n        ]\n      : []),\n    ...extraResources,\n  ]\n    .map((resource) => `- \\`k8s/${resource}\\``)\n    .join('\\n');\n\n  const resetNamespaces = [\n    APP_NAMESPACE,\n    ...(supabaseKubernetesEnabled ? [SUPABASE_NAMESPACE] : []),\n    ...providerNamespaces,\n  ];\n  const resetDescription = `deletes and recreates namespaces ${resetNamespaces\n    .map((namespace) => `\\`${namespace}\\``)\n    .join(\n      ', ',\n    )} inside the existing profile. This removes app-owned Kubernetes state and provider-owned PVC data for reset namespaces`;\n  const providerNamespaceLine =\n    providerNamespaces.length > 0\n      ? `- Provider namespaces: \\`${providerNamespaces.join('`, `')}\\`\\n`\n      : '';\n  const providerLifecycleLines =\n    providerLifecycle.length > 0\n      ? `\\n## Provider Lifecycle Contributions\\n\\n${providerLifecycle\n          .map((provider) => {\n            const readiness =\n              provider.readinessChecks.length > 0\n                ? provider.readinessChecks\n                    .map((check) => `\\`${check.resource}\\` in namespace \\`${check.namespace}\\``)\n                    .join(', ')\n                : 'none';\n            const endpoints =\n              provider.endpoints.length > 0\n                ? provider.endpoints\n                    .map((endpoint) => `\\`${endpoint.name}\\` = \\`${endpoint.url}\\``)\n                    .join(', ')\n                : 'none';\n            return `- \\`${provider.id}\\`: namespace \\`${provider.namespace}\\`; readiness ${readiness}; endpoints ${endpoints}`;\n          })\n          .join('\\n')}\\n`\n      : '';\n  const oauthDescription =\n    oauthProviders.length > 0\n      ? `\\nConfigured OAuth providers are wired into GoTrue through generated \\`GOTRUE_EXTERNAL_*\\` runtime keys. The keys are named in \\`.env.example\\`; values must come from trusted secret resolution for the configured \\`credentialsRef\\` entries.\\n`\n      : '';\n\n  return `# Minikube Infra\n\nThis directory is generated from \\`ankh.config.json\\` (infra manifest).\n\n## Ownership Model\n\n- App slug / Minikube profile: \\`${appSlug}\\`\n- App runtime namespace: \\`${APP_NAMESPACE}\\`\n- Supabase namespace: \\`${supabaseKubernetesEnabled ? SUPABASE_NAMESPACE : 'unused'}\\`\n${providerNamespaceLine}- Default app image: \\`${defaultAppImage}\\`\n\nOne app owns one complete Minikube profile. Provider-owned workloads are separated by\nKubernetes namespace inside that profile. There is no shared \\`minikube\\` profile and no\nhost-level Supabase Compose runtime.\n\n## Quick Start\n\n1. Copy env template:\n   \\`\\`\\`bash\n   cp .env.example .env\n   \\`\\`\\`\n2. Adjust optional values in \\`.env\\`; missing Supabase development secrets are generated by \\`up.sh\\`.\n3. Start infra:\n   \\`\\`\\`bash\n   ./scripts/up.sh\n   \\`\\`\\`\n4. Check status:\n   \\`\\`\\`bash\n   ./scripts/status.sh\n   \\`\\`\\`\n5. Stop the app-owned cluster without deleting data:\n   \\`\\`\\`bash\n   ./scripts/down.sh\n   \\`\\`\\`\n\n## Lifecycle Semantics\n\n- \\`up.sh\\`: starts \\`minikube -p ${appSlug}\\`, deploys provider namespaces, runs migrations with \\`supabase migration up --db-url \"$SUPABASE_DB_URL\"\\`, starts slug-owned port-forwards, and deploys the app runtime.\n- \\`down.sh\\`: stops slug-owned port-forwards, then stops \\`minikube -p ${appSlug}\\`. Persistent data remains in the profile.\n- \\`reset.sh\\`: requires \\`ANKH_RESET_CONFIRM=${appSlug}\\`; ${resetDescription}. It does not delete the Minikube profile.\n- \\`destroy.sh\\`: deletes only \\`minikube -p ${appSlug}\\`.\n\n## Generated Resources\n\n${resourceLines}\n\n## Supabase Runtime\n\nSupabase runtime ownership is Kubernetes. Migration authoring/history remains Supabase\nmigration files. Migration execution targets the Kubernetes Postgres endpoint through\n\\`supabase migration up --db-url \"$SUPABASE_DB_URL\"\\`.\n\nSupabase manifests are generated from the current official Supabase self-hosting Docker\ntopology, service documentation, environment-variable contracts, and pinned official images.\nKubernetes/Helm is treated as community-driven upstream guidance, not an official\ndistribution copied by this generator.\n${oauthDescription}\n\nPinned images:\n\n- Postgres: \\`${SUPABASE_IMAGES.postgres}\\`\n- Auth: \\`${SUPABASE_IMAGES.auth}\\`\n- PostgREST: \\`${SUPABASE_IMAGES.rest}\\`\n- Realtime: \\`${SUPABASE_IMAGES.realtime}\\`\n- Storage: \\`${SUPABASE_IMAGES.storage}\\`\n- Gateway: \\`${SUPABASE_IMAGES.gateway}\\`\n- Studio: \\`${SUPABASE_IMAGES.studio}\\`\n\n## Host URLs\n\n- App: \\`http://127.0.0.1:${supabaseHostPorts.app}\\`\n- Supabase gateway: \\`http://127.0.0.1:${supabaseHostPorts.gateway}\\`\n- Studio: \\`http://127.0.0.1:${supabaseHostPorts.studio}\\`\n- DB migration endpoint: \\`127.0.0.1:${supabaseHostPorts.db}\\`\n\n## Runtime Conventions\n\n- Monitoring requested: \\`${monitoringEnabled ? 'true' : 'false'}\\`\n- Auth provider: \\`${authProvider}\\`\n- Authorization engine: \\`${authzEngine}\\`\n${profileModel.enabled ? '- Generated profile reconciliation lives in `supabase/generated/auth_profiles.sql` and records checksum state in `ankhorage_internal.generated_schema_state`.\\n' : ''}\n${providerLifecycleLines}\n`;\n}\n\nfunction getEnvExample(args: {\n  appSlug: string;\n  domain: string;\n  extraEnvEntries: string[];\n  defaultAppImage: string;\n  supabaseHostPorts: SupabaseHostPorts;\n  supabaseKubernetesEnabled: boolean;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n}): string {\n  const { appSlug, domain, extraEnvEntries, defaultAppImage, supabaseHostPorts, oauthProviders } =\n    args;\n\n  const baseEntries = [\n    '# App-owned Minikube profile configuration',\n    `ANKH_APP_SLUG=${appSlug}`,\n    'MINIKUBE_DRIVER=docker',\n    'APP_BUILD_ENABLED=true',\n    'APP_SOURCE_DIR=',\n    'APP_WEB_EXPORT_DIR=.ankh/web-export',\n    `APP_IMAGE=${defaultAppImage}`,\n    'APP_IMAGE_SYNC_STRATEGY=docker-load',\n    'APP_IMAGE_CLEANUP_ON_DESTROY=true',\n    'APP_IMAGE_CLEANUP_MINIKUBE=true',\n    'APP_IMAGE_CLEANUP_DOCKER=true',\n    `APP_PORT_FORWARD_LOCAL_PORT=${supabaseHostPorts.app}`,\n    'APP_PORT_FORWARD_REMOTE_PORT=80',\n    `SUPABASE_GATEWAY_FORWARD_LOCAL_PORT=${supabaseHostPorts.gateway}`,\n    'SUPABASE_GATEWAY_FORWARD_REMOTE_PORT=8000',\n    `SUPABASE_STUDIO_FORWARD_LOCAL_PORT=${supabaseHostPorts.studio}`,\n    'SUPABASE_STUDIO_FORWARD_REMOTE_PORT=3000',\n    `SUPABASE_DB_FORWARD_LOCAL_PORT=${supabaseHostPorts.db}`,\n    'SUPABASE_DB_FORWARD_REMOTE_PORT=5432',\n    'APP_REPLICAS=1',\n    'APP_FORCE_ROLLOUT_RESTART=true',\n    '',\n    '# Optional private registry auth for APP_IMAGE',\n    'APP_IMAGE_PULL_SECRET_NAME=',\n    'APP_IMAGE_PULL_SECRET_SERVER=ghcr.io',\n    'APP_IMAGE_PULL_SECRET_USERNAME=',\n    'APP_IMAGE_PULL_SECRET_PASSWORD=',\n    'APP_IMAGE_PULL_SECRET_EMAIL=',\n    '',\n    '# Optional app networking domain',\n    `APP_DOMAIN=${domain}`,\n    '',\n    '# Supabase Kubernetes runtime secrets',\n    'POSTGRES_PASSWORD=',\n    'JWT_SECRET=',\n    'SUPABASE_ANON_KEY=',\n    'SUPABASE_SERVICE_ROLE_KEY=',\n    'SUPABASE_PUBLISHABLE_KEY=',\n    'SUPABASE_SECRET_KEY=',\n    'DASHBOARD_USERNAME=supabase',\n    'DASHBOARD_PASSWORD=',\n    'SECRET_KEY_BASE=',\n    'REALTIME_DB_ENC_KEY=',\n    'PG_META_CRYPTO_KEY=',\n    'S3_PROTOCOL_ACCESS_KEY_ID=',\n    'S3_PROTOCOL_ACCESS_KEY_SECRET=',\n    'JWT_EXPIRY=3600',\n    'SITE_URL=',\n    'OAUTH_NATIVE_REDIRECT_URLS=',\n    'ADDITIONAL_REDIRECT_URLS=',\n    'SUPABASE_PUBLIC_URL=',\n    'API_EXTERNAL_URL=',\n    'ENABLE_EMAIL_SIGNUP=true',\n    'ENABLE_EMAIL_AUTOCONFIRM=true',\n    'SMTP_ADMIN_EMAIL=admin@example.com',\n    'SMTP_HOST=localhost',\n    'SMTP_PORT=2500',\n    'SMTP_USER=',\n    'SMTP_PASS=',\n    'SMTP_SENDER_NAME=Ankhorage',\n    'PGRST_DB_SCHEMAS=public,storage,graphql_public',\n    'PGRST_DB_MAX_ROWS=1000',\n    'PGRST_DB_EXTRA_SEARCH_PATH=public',\n    'GLOBAL_S3_BUCKET=stub',\n    'STORAGE_TENANT_ID=stub',\n    'REGION=stub',\n    'SUPABASE_DB_URL=',\n    'EXPO_PUBLIC_SUPABASE_URL=',\n    'EXPO_PUBLIC_SUPABASE_ANON_KEY=',\n    ...getOAuthEnvExampleEntries(oauthProviders),\n    '',\n    '# Adapter-provided runtime keys',\n  ];\n\n  const merged = [...baseEntries, ...extraEnvEntries];\n  const unique: string[] = [];\n  for (const entry of merged) {\n    if (!unique.includes(entry)) unique.push(entry);\n  }\n\n  return `${unique.join('\\n')}\\n`;\n}\n\nfunction getOAuthEnvExampleEntries(providers: readonly SupabaseOAuthProviderRuntime[]): string[] {\n  if (providers.length === 0) return [];\n\n  return [\n    '',\n    '# OAuth provider runtime values resolved from trusted credentialsRef entries',\n    ...providers.flatMap((provider) => [\n      `# ${provider.id}: ${provider.credentialsRef}`,\n      `GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID=`,\n      `GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET=`,\n      `GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI=`,\n    ]),\n  ];\n}\n\nfunction getOAuthScriptEnvDefaults(providers: readonly SupabaseOAuthProviderRuntime[]): string {\n  if (providers.length === 0) return '';\n\n  return providers\n    .map(\n      (\n        provider,\n      ) => `  export GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID=\"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID:-}\"\n  export GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET=\"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET:-}\"\n  export GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI=\"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI:-\\${API_EXTERNAL_URL}/callback}\"`,\n    )\n    .join('\\n');\n}\n\nfunction getOAuthRuntimeSecretLines(providers: readonly SupabaseOAuthProviderRuntime[]): string {\n  if (providers.length === 0) return '';\n\n  return providers\n    .map(\n      (provider) => `GOTRUE_EXTERNAL_${provider.envPrefix}_ENABLED=true\nGOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID=\\${GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID}\nGOTRUE_EXTERNAL_${provider.envPrefix}_SECRET=\\${GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET}\nGOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI=\\${GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI}`,\n    )\n    .join('\\n');\n}\n\nfunction getOAuthRuntimeValidationScript(\n  providers: readonly SupabaseOAuthProviderRuntime[],\n): string {\n  if (providers.length === 0) return '';\n\n  const checks = providers\n    .map(\n      (\n        provider,\n      ) => `  if [[ -z \"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID:-}\" || -z \"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET:-}\" ]]; then\n    echo \"OAuth provider ${provider.id} requires trusted runtime values GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID and GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET from credentialsRef ${provider.credentialsRef}.\"\n    exit 1\n  fi`,\n    )\n    .join('\\n');\n\n  return `\n  # OAuth provider secrets must be resolved by trusted host code before Kubernetes sync.\n${checks}`;\n}\n\nfunction getSupabaseOAuthCallbackRoute(providers: readonly SupabaseOAuthProviderRuntime[]): string {\n  return providers[0]?.callbackRoute ?? '/auth/callback';\n}\n\nfunction getOAuthVaultResolutionScript(args: {\n  appSlug: string;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n  secretStoreProvider: string;\n}): string {\n  const { appSlug, oauthProviders, secretStoreProvider } = args;\n  if (secretStoreProvider !== 'supabase-vault' || oauthProviders.length === 0) {\n    return `\nresolve_oauth_credentials_from_vault() {\n  return 0\n}\n`;\n  }\n\n  const lines = oauthProviders\n    .map((provider) => {\n      const ref = escapeSingleQuotedSql(provider.credentialsRef);\n      const idKey = `GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID`;\n      const secretKey = `GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET`;\n\n      return `  if [[ -z \"\\${${idKey}:-}\" || -z \"\\${${secretKey}:-}\" ]]; then\n    local resolved_client_id resolved_client_secret\n    resolved_client_id=\"$(resolve_vault_secret_field '${ref}' 'clientId')\"\n    resolved_client_secret=\"$(resolve_vault_secret_field '${ref}' 'clientSecret')\"\n    if [[ -n \"\\${resolved_client_id}\" ]]; then\n      export ${idKey}=\"\\${resolved_client_id}\"\n    fi\n    if [[ -n \"\\${resolved_client_secret}\" ]]; then\n      export ${secretKey}=\"\\${resolved_client_secret}\"\n    fi\n  fi`;\n    })\n    .join('\\n');\n\n  return `\nresolve_vault_secret_field() {\n  local ref=\"\\${1}\"\n  local field=\"\\${2}\"\n  psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -Atq -c \"select coalesce(decrypted.decrypted_secret::jsonb ->> '\\${field}', '') from ankh_secret_store.secret_metadata metadata join vault.decrypted_secrets decrypted on decrypted.id = metadata.vault_secret_id where metadata.project_id = '${escapeSingleQuotedSql(\n    appSlug,\n  )}' and metadata.environment = 'local' and metadata.secret_ref = '\\${ref}' limit 1;\" 2>/dev/null || true\n}\n\nresolve_oauth_credentials_from_vault() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n${lines}\n}\n`;\n}\n\nfunction escapeSingleQuotedSql(value: string): string {\n  return value.replace(/'/gu, \"''\");\n}\n\nfunction escapeShellDoubleQuoted(value: string): string {\n  return value.replace(/[\"\\\\$`]/gu, (char) => `\\\\${char}`);\n}\n\nfunction getProviderLifecycleStageScripts(\n  providerLifecycle: readonly MinikubeProviderLifecycle[],\n): string {\n  return `${getProviderLifecycleCommandFunction({\n    functionName: 'run_provider_migrations',\n    emptyReturn: 'return 0',\n    commands: providerLifecycle.flatMap((provider) =>\n      provider.migrationCommands.map((command) => ({\n        providerId: provider.id,\n        label: command.label,\n        command: command.command,\n      })),\n    ),\n  })}\n\n${getProviderLifecycleCommandFunction({\n  functionName: 'run_provider_reconciliation',\n  emptyReturn: 'return 0',\n  commands: providerLifecycle.flatMap((provider) =>\n    provider.reconciliationCommands.map((command) => ({\n      providerId: provider.id,\n      label: command.label,\n      command: command.command,\n    })),\n  ),\n})}\n\n${getProviderReadinessFunction(providerLifecycle)}`;\n}\n\nfunction getProviderLifecycleCommandFunction(args: {\n  functionName: string;\n  emptyReturn: string;\n  commands: readonly { providerId: string; label: string; command: string }[];\n}): string {\n  if (args.commands.length === 0) {\n    return `${args.functionName}() {\n  ${args.emptyReturn}\n}`;\n  }\n\n  const body = args.commands\n    .map(\n      (command) => `  echo \"Running provider ${escapeShellDoubleQuoted(\n        command.providerId,\n      )} ${escapeShellDoubleQuoted(command.label)}.\"\n${indentShellBlock(command.command.trim(), 2)}`,\n    )\n    .join('\\n\\n');\n\n  return `${args.functionName}() {\n${body}\n}`;\n}\n\nfunction getProviderReadinessFunction(\n  providerLifecycle: readonly MinikubeProviderLifecycle[],\n): string {\n  const checks = providerLifecycle.flatMap((provider) =>\n    provider.readinessChecks.map((check) => ({ providerId: provider.id, ...check })),\n  );\n\n  if (checks.length === 0) {\n    return `wait_for_provider_readiness() {\n  return 0\n}`;\n  }\n\n  const body = checks\n    .map(\n      (check) =>\n        `  kubectl --context \"\\${PROFILE}\" -n \"${escapeShellDoubleQuoted(\n          check.namespace,\n        )}\" rollout status \"${escapeShellDoubleQuoted(\n          check.resource,\n        )}\" --timeout=${check.timeoutSeconds}s`,\n    )\n    .join('\\n');\n\n  return `wait_for_provider_readiness() {\n${body}\n}`;\n}\n\nfunction getProviderStatusScript(providerLifecycle: readonly MinikubeProviderLifecycle[]): string {\n  if (providerLifecycle.length === 0) {\n    return '';\n  }\n\n  return providerLifecycle\n    .map((provider) => {\n      const endpointLines = provider.endpoints\n        .map(\n          (endpoint) =>\n            `  echo \"- provider ${escapeShellDoubleQuoted(\n              provider.id,\n            )} endpoint/${escapeShellDoubleQuoted(endpoint.name)}: ${escapeShellDoubleQuoted(\n              endpoint.url,\n            )}\"`,\n        )\n        .join('\\n');\n      const readinessLines = provider.readinessChecks\n        .map(\n          (check) => `  if kubectl --context \"\\${PROFILE}\" -n \"${escapeShellDoubleQuoted(\n            check.namespace,\n          )}\" rollout status \"${escapeShellDoubleQuoted(\n            check.resource,\n          )}\" --timeout=5s >/dev/null 2>&1; then\n    echo \"- provider ${escapeShellDoubleQuoted(provider.id)}/${escapeShellDoubleQuoted(\n      check.label,\n    )}: ready\"\n  else\n    echo \"- provider ${escapeShellDoubleQuoted(provider.id)}/${escapeShellDoubleQuoted(\n      check.label,\n    )}: not ready\"\n  fi`,\n        )\n        .join('\\n');\n      const customStatusLines = provider.statusChecks\n        .map(\n          (check) => `  echo \"Running provider ${escapeShellDoubleQuoted(\n            provider.id,\n          )} status check ${escapeShellDoubleQuoted(check.label)}.\"\n${indentShellBlock(check.command.trim(), 2)}`,\n        )\n        .join('\\n');\n\n      return [endpointLines, readinessLines, customStatusLines].filter(Boolean).join('\\n');\n    })\n    .filter(Boolean)\n    .join('\\n');\n}\n\nfunction indentShellBlock(value: string, spaces: number): string {\n  const indent = ' '.repeat(spaces);\n  return value\n    .split('\\n')\n    .map((line) => `${indent}${line}`)\n    .join('\\n');\n}\n\nfunction getNamespaceManifest(namespace: string): string {\n  return `apiVersion: v1\nkind: Namespace\nmetadata:\n  name: ${namespace}\n  labels:\n    app.kubernetes.io/part-of: ankhorage\n    ankhorage.io/namespace-role: ${namespace}\n`;\n}\n\nfunction getAppConfigMap(args: {\n  appSlug: string;\n  authScope: string;\n  authProvider: string;\n  databaseProvider: string;\n  secretStoreProvider: string;\n  storageMetadata: AppInfraStorageMetadata | null;\n  monitoringEnabled: boolean;\n  domain: string;\n}): string {\n  const {\n    appSlug,\n    authScope,\n    authProvider,\n    databaseProvider,\n    secretStoreProvider,\n    storageMetadata,\n    monitoringEnabled,\n    domain,\n  } = args;\n\n  const storageLines = storageMetadata\n    ? `  STORAGE_PROVIDER: \"${storageMetadata.provider}\"\n  STORAGE_BUCKETS: \"${escapeYamlDoubleQuoted(storageMetadata.bucketsCsv)}\"\n  STORAGE_DEFAULT_BUCKET: \"${escapeYamlDoubleQuoted(storageMetadata.defaultBucket)}\"\n`\n    : '';\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-infra-config\n  namespace: ${APP_NAMESPACE}\ndata:\n  ANKH_APP_SLUG: \"${appSlug}\"\n  DEPLOYMENT_TARGET: \"minikube\"\n  APP_NAMESPACE: \"${APP_NAMESPACE}\"\n  SUPABASE_NAMESPACE: \"${SUPABASE_NAMESPACE}\"\n  MONITORING_ENABLED: \"${monitoringEnabled ? 'true' : 'false'}\"\n  AUTH_SCOPE: \"${authScope}\"\n  AUTH_PROVIDER: \"${authProvider}\"\n  DATABASE_PROVIDER: \"${databaseProvider}\"\n  SECRET_STORE_PROVIDER: \"${secretStoreProvider}\"\n${storageLines}  NETWORK_DOMAIN: \"${escapeYamlDoubleQuoted(domain)}\"\n`;\n}\n\nfunction resolveAppInfraStorageMetadata(\n  manifest: InfraManifestInput,\n): AppInfraStorageMetadata | null {\n  const spec = manifest.storage;\n  if (!spec) return null;\n\n  const buckets = normalizeBuckets(spec.buckets);\n  if (buckets.length === 0) return null;\n  const [defaultBucket] = buckets;\n  if (!defaultBucket) return null;\n\n  if (spec.provider === 'supabase') {\n    return {\n      provider: 'supabase',\n      bucketsCsv: buckets.join(','),\n      defaultBucket,\n    };\n  }\n\n  if (spec.provider === 'auto') {\n    const shouldResolveToSupabase =\n      manifest.database?.provider === 'supabase' || manifest.auth?.provider === 'supabase';\n\n    if (!shouldResolveToSupabase) return null;\n\n    return {\n      provider: 'supabase',\n      bucketsCsv: buckets.join(','),\n      defaultBucket,\n    };\n  }\n\n  return null;\n}\n\nfunction resolveSupabaseOAuthProviders(\n  manifest: InfraManifestInput,\n): readonly SupabaseOAuthProviderRuntime[] {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return [];\n  const callbackRoute = normalizeOAuthCallbackRoute(oauth.callbackRoute);\n\n  return oauth.providers\n    .filter((provider) => provider.enabled !== false)\n    .map((provider) => {\n      const id = provider.id.trim();\n      const credentialsRef = provider.credentialsRef?.trim();\n      if (!credentialsRef) {\n        throw new Error(`OAuth provider \"${id}\" is enabled but does not define credentialsRef.`);\n      }\n\n      const envPrefix = id\n        .toUpperCase()\n        .replace(/[^A-Z0-9]+/gu, '_')\n        .replace(/^_+|_+$/gu, '');\n      if (!envPrefix) {\n        throw new Error(`OAuth provider \"${id}\" cannot be mapped to GoTrue environment keys.`);\n      }\n\n      return {\n        id,\n        envPrefix,\n        credentialsRef,\n        callbackRoute,\n      };\n    });\n}\n\nfunction normalizeOAuthCallbackRoute(rawRoute: string | undefined): string {\n  const trimmedRoute = rawRoute?.trim();\n  const route = trimmedRoute && trimmedRoute.length > 0 ? trimmedRoute : '/auth/callback';\n  const withLeadingSlash = route.startsWith('/') ? route : `/${route}`;\n  return withLeadingSlash.replace(/\\/+/gu, '/');\n}\n\nfunction normalizeBuckets(rawBuckets: readonly string[]): string[] {\n  const normalized: string[] = [];\n  const seen = new Set<string>();\n\n  for (const raw of rawBuckets) {\n    const bucket = raw.trim();\n    if (!bucket) continue;\n    if (seen.has(bucket)) continue;\n    seen.add(bucket);\n    normalized.push(bucket);\n  }\n\n  return normalized;\n}\n\nfunction getKustomizationManifest(args: {\n  namespaceResources: string[];\n  supabaseEnabled: boolean;\n  extraResources: string[];\n}): string {\n  const supabaseResources = args.supabaseEnabled\n    ? [\n        'supabase/postgres.init.configmap.yaml',\n        'supabase/postgres.pvc.yaml',\n        'supabase/postgres.yaml',\n        'supabase/auth.yaml',\n        'supabase/rest.yaml',\n        'supabase/realtime.yaml',\n        'supabase/imgproxy.yaml',\n        'supabase/storage.yaml',\n        'supabase/meta.yaml',\n        'supabase/gateway.yaml',\n        'supabase/studio.yaml',\n      ]\n    : [];\n  const resources = [\n    ...args.namespaceResources,\n    'app.configmap.yaml',\n    'app/deployment.yaml',\n    'app/service.yaml',\n    ...supabaseResources,\n    ...args.extraResources,\n  ];\n  const resourceLines = resources.map((resource) => `  - ${resource}`).join('\\n');\n\n  return `apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n${resourceLines}\n`;\n}\n\nfunction getAppDeploymentManifest(defaultAppImage: string): string {\n  return `apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: app-runtime\n  namespace: ${APP_NAMESPACE}\n  labels:\n    app.kubernetes.io/name: app-runtime\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: app-runtime\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: app-runtime\n    spec:\n      containers:\n        - name: app\n          image: ${defaultAppImage}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 8080\n              name: http\n          envFrom:\n            - configMapRef:\n                name: app-infra-config\n            - configMapRef:\n                name: app-runtime-auth-env\n                optional: true\n            - configMapRef:\n                name: app-runtime-storage-env\n                optional: true\n            - secretRef:\n                name: supabase-public-runtime\n                optional: true\n          readinessProbe:\n            httpGet:\n              path: /\n              port: http\n            initialDelaySeconds: 5\n            periodSeconds: 10\n          livenessProbe:\n            httpGet:\n              path: /\n              port: http\n            initialDelaySeconds: 15\n            periodSeconds: 20\n`;\n}\n\nfunction getAppServiceManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: app-runtime\n  namespace: ${APP_NAMESPACE}\n  labels:\n    app.kubernetes.io/name: app-runtime\nspec:\n  type: ClusterIP\n  selector:\n    app.kubernetes.io/name: app-runtime\n  ports:\n    - name: http\n      port: 80\n      targetPort: http\n`;\n}\n\nfunction getSupabaseResourceFiles(k8sRoot: string): GeneratedInfrastructureFile[] {\n  return [\n    {\n      path: `${k8sRoot}/supabase/bootstrap.sql`,\n      content: getSupabaseBootstrapSql(),\n    },\n    {\n      path: `${k8sRoot}/supabase/postgres.init.configmap.yaml`,\n      content: getSupabasePostgresInitConfigMap(),\n    },\n    {\n      path: `${k8sRoot}/supabase/postgres.pvc.yaml`,\n      content: getSupabasePvcManifest('supabase-postgres-data', '20Gi'),\n    },\n    {\n      path: `${k8sRoot}/supabase/postgres.yaml`,\n      content: getSupabasePostgresManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/auth.yaml`,\n      content: getSupabaseAuthManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/rest.yaml`,\n      content: getSupabaseRestManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/realtime.yaml`,\n      content: getSupabaseRealtimeManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/storage.yaml`,\n      content: getSupabaseStorageManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/imgproxy.yaml`,\n      content: getSupabaseImgproxyManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/meta.yaml`,\n      content: getSupabaseMetaManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/gateway.template.yml`,\n      content: getSupabaseGatewayTemplate(),\n    },\n    {\n      path: `${k8sRoot}/supabase/kong-entrypoint.sh`,\n      content: getSupabaseKongEntrypointScript(),\n      executable: true,\n    },\n    {\n      path: `${k8sRoot}/supabase/gateway.yaml`,\n      content: getSupabaseGatewayManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/studio.yaml`,\n      content: getSupabaseStudioManifest(),\n    },\n  ];\n}\n\nfunction getSupabaseBootstrapSql(): string {\n  return `-- Generated from the official Supabase self-hosting Docker database bootstrap contract.\n-- Applied by scripts/up.sh after Postgres is ready and before Supabase services start.\n\\\\set pgpass \\`echo \"$POSTGRES_PASSWORD\"\\`\n\\\\set jwt_secret \\`echo \"$JWT_SECRET\"\\`\n\\\\set jwt_exp \\`echo \"$JWT_EXP\"\\`\n\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'anon') THEN\n    CREATE ROLE anon NOLOGIN NOINHERIT;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticated') THEN\n    CREATE ROLE authenticated NOLOGIN NOINHERIT;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'service_role') THEN\n    CREATE ROLE service_role NOLOGIN NOINHERIT BYPASSRLS;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticator') THEN\n    CREATE ROLE authenticator NOINHERIT LOGIN;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_admin') THEN\n    CREATE ROLE supabase_admin LOGIN CREATEROLE CREATEDB REPLICATION BYPASSRLS;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_auth_admin') THEN\n    CREATE ROLE supabase_auth_admin LOGIN CREATEROLE;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_storage_admin') THEN\n    CREATE ROLE supabase_storage_admin LOGIN CREATEROLE;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_functions_admin') THEN\n    CREATE ROLE supabase_functions_admin LOGIN CREATEROLE;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'pgbouncer') THEN\n    CREATE ROLE pgbouncer LOGIN;\n  END IF;\nEND\n$$;\n\nALTER ROLE authenticator WITH PASSWORD :'pgpass';\nALTER ROLE pgbouncer WITH PASSWORD :'pgpass';\nALTER ROLE supabase_auth_admin WITH PASSWORD :'pgpass';\nALTER ROLE supabase_functions_admin WITH PASSWORD :'pgpass';\nALTER ROLE supabase_storage_admin WITH PASSWORD :'pgpass';\nALTER ROLE supabase_admin WITH PASSWORD :'pgpass';\n\nGRANT anon, authenticated, service_role TO authenticator;\nGRANT anon, authenticated, service_role TO supabase_storage_admin;\nGRANT postgres TO supabase_auth_admin;\nGRANT postgres TO supabase_storage_admin;\nGRANT postgres TO supabase_functions_admin;\nGRANT pg_monitor TO supabase_admin;\n\nCREATE SCHEMA IF NOT EXISTS auth AUTHORIZATION supabase_auth_admin;\nCREATE SCHEMA IF NOT EXISTS storage AUTHORIZATION supabase_storage_admin;\nCREATE SCHEMA IF NOT EXISTS graphql_public;\nCREATE SCHEMA IF NOT EXISTS _realtime AUTHORIZATION supabase_admin;\n\nGRANT USAGE ON SCHEMA public, graphql_public TO anon, authenticated, service_role;\nGRANT USAGE ON SCHEMA auth TO supabase_auth_admin;\nGRANT USAGE ON SCHEMA storage TO supabase_storage_admin, anon, authenticated, service_role;\nGRANT USAGE ON SCHEMA _realtime TO supabase_admin;\n\nALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO anon, authenticated, service_role;\nALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO anon, authenticated, service_role;\n\nALTER DATABASE postgres SET \"app.settings.jwt_secret\" TO :'jwt_secret';\nALTER DATABASE postgres SET \"app.settings.jwt_exp\" TO :'jwt_exp';\n\nSELECT 'CREATE DATABASE _supabase WITH OWNER supabase_admin'\nWHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '_supabase')\\\\gexec\n`;\n}\n\nfunction getSupabasePostgresInitConfigMap(): string {\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-postgres-init\n  namespace: ${SUPABASE_NAMESPACE}\ndata:\n  99-ankhorage-local-dev-extensions.sql: |\n    -- Local Minikube bootstrap for extension setup performed before runtime migrations.\n    alter role postgres with superuser;\n    grant pg_read_server_files to postgres;\n    grant pg_read_server_files to supabase_admin;\n    grant execute on function pg_read_file(text) to public;\n    grant execute on function pg_read_file(text, bigint, bigint) to public;\n`;\n}\n\nfunction getSupabasePvcManifest(name: string, size: string): string {\n  return `apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n  name: ${name}\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  accessModes:\n    - ReadWriteOnce\n  resources:\n    requests:\n      storage: ${size}\n`;\n}\n\nfunction getSupabasePostgresManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: postgres\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-postgres\n  ports:\n    - name: postgres\n      port: 5432\n      targetPort: postgres\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: postgres\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-postgres\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-postgres\n    spec:\n      containers:\n        - name: postgres\n          image: ${SUPABASE_IMAGES.postgres}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 5432\n              name: postgres\n          env:\n            - name: POSTGRES_USER\n              value: postgres\n            - name: POSTGRES_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: PGPASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: POSTGRES_DB\n              value: postgres\n            - name: PGDATABASE\n              value: postgres\n            - name: PGPORT\n              value: \"5432\"\n            - name: POSTGRES_PORT\n              value: \"5432\"\n            - name: POSTGRES_HOST\n              value: /var/run/postgresql\n            - name: JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: JWT_EXP\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: JWT_EXPIRY\n          volumeMounts:\n            - name: data\n              mountPath: /var/lib/postgresql/data\n            - name: init-scripts\n              mountPath: /docker-entrypoint-initdb.d/99-ankhorage-local-dev-extensions.sql\n              subPath: 99-ankhorage-local-dev-extensions.sql\n          readinessProbe:\n            exec:\n              command: [\"pg_isready\", \"-U\", \"postgres\"]\n            initialDelaySeconds: 15\n            periodSeconds: 5\n          livenessProbe:\n            exec:\n              command: [\"pg_isready\", \"-U\", \"postgres\"]\n            initialDelaySeconds: 30\n            periodSeconds: 10\n          args:\n            - postgres\n            - -c\n            - config_file=/etc/postgresql/postgresql.conf\n            - -c\n            - log_min_messages=fatal\n      volumes:\n        - name: data\n          persistentVolumeClaim:\n            claimName: supabase-postgres-data\n        - name: init-scripts\n          configMap:\n            name: supabase-postgres-init\n`;\n}\n\nfunction getSupabaseAuthManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: auth\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-auth\n  ports:\n    - name: http\n      port: 9999\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: auth\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-auth\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-auth\n    spec:\n      containers:\n        - name: auth\n          image: ${SUPABASE_IMAGES.auth}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 9999\n              name: http\n          env:\n            - name: GOTRUE_API_HOST\n              value: \"0.0.0.0\"\n            - name: GOTRUE_API_PORT\n              value: \"9999\"\n            - name: API_EXTERNAL_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: API_EXTERNAL_URL\n            - name: GOTRUE_SITE_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SITE_URL\n            - name: GOTRUE_URI_ALLOW_LIST\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: ADDITIONAL_REDIRECT_URLS\n            - name: GOTRUE_JWT_ISSUER\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: API_EXTERNAL_URL\n            - name: GOTRUE_DB_DRIVER\n              value: postgres\n            - name: GOTRUE_DB_DATABASE_URL\n              value: \"postgres://supabase_auth_admin:$(POSTGRES_PASSWORD)@postgres.${SUPABASE_NAMESPACE}.svc.cluster.local:5432/postgres?search_path=auth&sslmode=disable\"\n            - name: GOTRUE_JWT_AUD\n              value: authenticated\n            - name: GOTRUE_JWT_DEFAULT_GROUP_NAME\n              value: authenticated\n            - name: GOTRUE_JWT_ADMIN_ROLES\n              value: service_role\n            - name: GOTRUE_JWT_EXP\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: JWT_EXPIRY\n            - name: GOTRUE_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: GOTRUE_EXTERNAL_EMAIL_ENABLED\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: ENABLE_EMAIL_SIGNUP\n            - name: GOTRUE_MAILER_AUTOCONFIRM\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: ENABLE_EMAIL_AUTOCONFIRM\n            - name: GOTRUE_SMTP_ADMIN_EMAIL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_ADMIN_EMAIL\n            - name: GOTRUE_SMTP_HOST\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_HOST\n            - name: GOTRUE_SMTP_PORT\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_PORT\n            - name: GOTRUE_SMTP_USER\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SMTP_USER\n            - name: GOTRUE_SMTP_PASS\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SMTP_PASS\n            - name: GOTRUE_SMTP_SENDER_NAME\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_SENDER_NAME\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n          readinessProbe:\n            httpGet:\n              path: /health\n              port: http\n            initialDelaySeconds: 10\n            periodSeconds: 10\n`;\n}\n\nfunction getSupabaseRestManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: rest\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-rest\n  ports:\n    - name: http\n      port: 3000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: rest\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-rest\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-rest\n    spec:\n      containers:\n        - name: rest\n          image: ${SUPABASE_IMAGES.rest}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 3000\n              name: http\n          env:\n            - name: PGRST_DB_URI\n              value: \"postgres://authenticator:$(POSTGRES_PASSWORD)@postgres.${SUPABASE_NAMESPACE}.svc.cluster.local:5432/postgres\"\n            - name: PGRST_DB_SCHEMAS\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: PGRST_DB_SCHEMAS\n            - name: PGRST_DB_ANON_ROLE\n              value: anon\n            - name: PGRST_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: PGRST_DB_USE_LEGACY_GUCS\n              value: \"false\"\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n`;\n}\n\nfunction getSupabaseRealtimeManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: realtime\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-realtime\n  ports:\n    - name: http\n      port: 4000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: realtime\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-realtime\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-realtime\n    spec:\n      containers:\n        - name: realtime\n          image: ${SUPABASE_IMAGES.realtime}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 4000\n              name: http\n          env:\n            - name: PORT\n              value: \"4000\"\n            - name: DB_HOST\n              value: \"postgres.${SUPABASE_NAMESPACE}.svc.cluster.local\"\n            - name: DB_PORT\n              value: \"5432\"\n            - name: DB_NAME\n              value: postgres\n            - name: DB_USER\n              value: supabase_admin\n            - name: DB_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: API_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: SECRET_KEY_BASE\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SECRET_KEY_BASE\n            - name: DB_AFTER_CONNECT_QUERY\n              value: \"SET search_path TO _realtime\"\n            - name: DB_ENC_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: REALTIME_DB_ENC_KEY\n            - name: METRICS_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: APP_NAME\n              value: realtime\n            - name: SEED_SELF_HOST\n              value: \"true\"\n            - name: RUN_JANITOR\n              value: \"true\"\n            - name: DISABLE_HEALTHCHECK_LOGGING\n              value: \"true\"\n`;\n}\n\nfunction getSupabaseStorageManifest(): string {\n  return `${getSupabasePvcManifest('supabase-storage-data', '10Gi')}\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: storage\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-storage\n  ports:\n    - name: http\n      port: 5000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: storage\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-storage\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-storage\n    spec:\n      containers:\n        - name: storage\n          image: ${SUPABASE_IMAGES.storage}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 5000\n              name: http\n          env:\n            - name: ANON_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_ANON_KEY\n            - name: SERVICE_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_SERVICE_ROLE_KEY\n            - name: AUTH_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: DATABASE_URL\n              value: \"postgres://supabase_storage_admin:$(POSTGRES_PASSWORD)@postgres.${SUPABASE_NAMESPACE}.svc.cluster.local:5432/postgres?search_path=storage&sslmode=disable\"\n            - name: POSTGREST_URL\n              value: \"http://rest.${SUPABASE_NAMESPACE}.svc.cluster.local:3000\"\n            - name: STORAGE_BACKEND\n              value: file\n            - name: STORAGE_PUBLIC_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SUPABASE_PUBLIC_URL\n            - name: REQUEST_ALLOW_X_FORWARDED_PATH\n              value: \"true\"\n            - name: FILE_SIZE_LIMIT\n              value: \"52428800\"\n            - name: FILE_STORAGE_BACKEND_PATH\n              value: /var/lib/storage\n            - name: TENANT_ID\n              value: stub\n            - name: REGION\n              value: local\n            - name: GLOBAL_S3_BUCKET\n              value: local\n            - name: IMGPROXY_URL\n              value: \"http://imgproxy.${SUPABASE_NAMESPACE}.svc.cluster.local:5001\"\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n          volumeMounts:\n            - name: storage\n              mountPath: /var/lib/storage\n      volumes:\n        - name: storage\n          persistentVolumeClaim:\n            claimName: supabase-storage-data\n`;\n}\n\nfunction getSupabaseImgproxyManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: imgproxy\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-imgproxy\n  ports:\n    - name: http\n      port: 5001\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: imgproxy\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-imgproxy\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-imgproxy\n    spec:\n      containers:\n        - name: imgproxy\n          image: ${SUPABASE_IMAGES.imgproxy}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 5001\n              name: http\n          env:\n            - name: IMGPROXY_BIND\n              value: \":5001\"\n`;\n}\n\nfunction getSupabaseMetaManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: meta\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-meta\n  ports:\n    - name: http\n      port: 8080\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: meta\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-meta\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-meta\n    spec:\n      containers:\n        - name: meta\n          image: ${SUPABASE_IMAGES.meta}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 8080\n              name: http\n          env:\n            - name: PG_META_PORT\n              value: \"8080\"\n            - name: PG_META_DB_HOST\n              value: \"postgres.${SUPABASE_NAMESPACE}.svc.cluster.local\"\n            - name: PG_META_DB_PORT\n              value: \"5432\"\n            - name: PG_META_DB_NAME\n              value: postgres\n            - name: PG_META_DB_USER\n              value: postgres\n            - name: PG_META_DB_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: CRYPTO_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: PG_META_CRYPTO_KEY\n`;\n}\n\nfunction getSupabaseGatewayTemplate(): string {\n  return `_format_version: '2.1'\n_transform: true\n\nconsumers:\n  - username: DASHBOARD\n  - username: anon\n    keyauth_credentials:\n      - key: $SUPABASE_ANON_KEY\n      - key: $SUPABASE_PUBLISHABLE_KEY\n  - username: service_role\n    keyauth_credentials:\n      - key: $SUPABASE_SERVICE_KEY\n      - key: $SUPABASE_SECRET_KEY\n\nacls:\n  - consumer: anon\n    group: anon\n  - consumer: service_role\n    group: admin\n\nbasicauth_credentials:\n  - consumer: DASHBOARD\n    username: '$DASHBOARD_USERNAME'\n    password: '$DASHBOARD_PASSWORD'\n\nservices:\n  - name: auth-v1-open\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/verify\n    routes:\n      - name: auth-v1-open\n        strip_path: true\n        paths: [/auth/v1/verify]\n    plugins:\n      - name: cors\n  - name: auth-v1-open-callback\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/callback\n    routes:\n      - name: auth-v1-open-callback\n        strip_path: true\n        paths: [/auth/v1/callback]\n    plugins:\n      - name: cors\n  - name: auth-v1-open-authorize\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/authorize\n    routes:\n      - name: auth-v1-open-authorize\n        strip_path: true\n        paths: [/auth/v1/authorize]\n    plugins:\n      - name: cors\n  - name: auth-v1-open-jwks\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/.well-known/jwks.json\n    routes:\n      - name: auth-v1-open-jwks\n        strip_path: true\n        paths: [/auth/v1/.well-known/jwks.json]\n    plugins:\n      - name: cors\n  - name: auth-v1\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/\n    routes:\n      - name: auth-v1-all\n        strip_path: true\n        paths: [/auth/v1/]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: rest-v1\n    url: http://rest.${SUPABASE_NAMESPACE}.svc.cluster.local:3000/\n    routes:\n      - name: rest-v1-all\n        strip_path: true\n        paths: [/rest/v1/]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: graphql-v1\n    url: http://rest.${SUPABASE_NAMESPACE}.svc.cluster.local:3000/rpc/graphql\n    routes:\n      - name: graphql-v1-all\n        strip_path: true\n        paths: [/graphql/v1]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Content-Profile: graphql_public\"\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: realtime-v1-ws\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/socket\n    protocol: ws\n    routes:\n      - name: realtime-v1-ws\n        strip_path: true\n        paths: [/realtime/v1/]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"x-api-key:$LUA_RT_WS_EXPR\"\n          replace:\n            querystring:\n              - \"apikey:$LUA_RT_WS_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: realtime-v1-rest-openapi\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/api/openapi\n    protocol: http\n    routes:\n      - name: realtime-v1-rest-openapi\n        strip_path: true\n        paths: [/realtime/v1/api/openapi]\n    plugins:\n      - name: request-termination\n        config:\n          status_code: 403\n          message: \"Access is forbidden.\"\n  - name: realtime-v1-rest-tenants\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/api/tenants\n    protocol: http\n    routes:\n      - name: realtime-v1-rest-tenants\n        strip_path: true\n        paths: [/realtime/v1/api/tenants]\n    plugins:\n      - name: request-termination\n        config:\n          status_code: 403\n          message: \"Access is forbidden.\"\n  - name: realtime-v1-rest\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/api\n    protocol: http\n    routes:\n      - name: realtime-v1-rest\n        strip_path: true\n        paths: [/realtime/v1/api]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: storage-v1\n    url: http://storage.${SUPABASE_NAMESPACE}.svc.cluster.local:5000/\n    routes:\n      - name: storage-v1-all\n        strip_path: true\n        paths: [/storage/v1/]\n    plugins:\n      - name: cors\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: post-function\n        config:\n          access:\n            - |\n              local auth = kong.request.get_header(\"authorization\")\n              if auth == nil or auth == \"\" or auth:find(\"^%s*$\") then\n                kong.service.request.clear_header(\"authorization\")\n              end\n  - name: meta\n    url: http://meta.${SUPABASE_NAMESPACE}.svc.cluster.local:8080/\n    routes:\n      - name: meta-all\n        strip_path: true\n        paths: [/pg/]\n    plugins:\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin]\n  - name: dashboard\n    url: http://studio.${SUPABASE_NAMESPACE}.svc.cluster.local:3000/\n    routes:\n      - name: dashboard-all\n        strip_path: true\n        paths: [/]\n    plugins:\n      - name: cors\n      - name: basic-auth\n        config:\n          hide_credentials: true\n`;\n}\n\nfunction getSupabaseKongEntrypointScript(): string {\n  return `#!/bin/sh\nset -eu\n\nif [ -n \"\\${SUPABASE_SECRET_KEY:-}\" ] && [ -n \"\\${SUPABASE_PUBLISHABLE_KEY:-}\" ]; then\n  export LUA_AUTH_EXPR=\"\\\\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or (headers.apikey == '\\${SUPABASE_SECRET_KEY}' and 'Bearer \\${SERVICE_ROLE_KEY_ASYMMETRIC:-}') or (headers.apikey == '\\${SUPABASE_PUBLISHABLE_KEY}' and 'Bearer \\${ANON_KEY_ASYMMETRIC:-}') or headers.apikey)\"\n  export LUA_RT_WS_EXPR=\"\\\\$((query_params.apikey == '\\${SUPABASE_SECRET_KEY}' and '\\${SERVICE_ROLE_KEY_ASYMMETRIC:-}') or (query_params.apikey == '\\${SUPABASE_PUBLISHABLE_KEY}' and '\\${ANON_KEY_ASYMMETRIC:-}') or query_params.apikey)\"\nelse\n  export LUA_AUTH_EXPR=\"\\\\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or headers.apikey)\"\n  export LUA_RT_WS_EXPR=\"\\\\$(query_params.apikey)\"\nfi\n\nawk '{\n  result = \"\"\n  rest = $0\n  while (match(rest, /\\\\$[A-Za-z_][A-Za-z_0-9]*/)) {\n    varname = substr(rest, RSTART + 1, RLENGTH - 1)\n    if (varname in ENVIRON) {\n      result = result substr(rest, 1, RSTART - 1) ENVIRON[varname]\n    } else {\n      result = result substr(rest, 1, RSTART + RLENGTH - 1)\n    }\n    rest = substr(rest, RSTART + RLENGTH)\n  }\n  print result rest\n}' /home/kong/temp.yml > \"\\${KONG_DECLARATIVE_CONFIG}\"\n\nsed -i '/^[[:space:]]*- key:[[:space:]]*$/d' \"\\${KONG_DECLARATIVE_CONFIG}\"\n\nexec /entrypoint.sh kong docker-start\n`;\n}\n\nfunction getSupabaseGatewayManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: gateway\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-gateway\n  ports:\n    - name: http\n      port: 8000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: gateway\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-gateway\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-gateway\n    spec:\n      containers:\n        - name: gateway\n          image: ${SUPABASE_IMAGES.gateway}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 8000\n              name: http\n          env:\n            - name: KONG_DATABASE\n              value: \"off\"\n            - name: KONG_DECLARATIVE_CONFIG\n              value: /usr/local/kong/kong.yml\n            - name: KONG_ROUTER_FLAVOR\n              value: expressions\n            - name: KONG_DNS_ORDER\n              value: LAST,A,CNAME\n            - name: KONG_DNS_NOT_FOUND_TTL\n              value: \"1\"\n            - name: KONG_PLUGINS\n              value: request-transformer,cors,key-auth,acl,basic-auth,request-termination,ip-restriction,post-function\n            - name: KONG_PROXY_LISTEN\n              value: \"0.0.0.0:8000\"\n            - name: SUPABASE_SERVICE_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_SERVICE_ROLE_KEY\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n          volumeMounts:\n            - name: config\n              mountPath: /home/kong/temp.yml\n              subPath: temp.yml\n              readOnly: true\n            - name: entrypoint\n              mountPath: /home/kong/kong-entrypoint.sh\n              subPath: kong-entrypoint.sh\n              readOnly: true\n          command: [\"/bin/sh\", \"/home/kong/kong-entrypoint.sh\"]\n          readinessProbe:\n            exec:\n              command: [\"kong\", \"health\"]\n            initialDelaySeconds: 10\n            periodSeconds: 10\n      volumes:\n        - name: config\n          configMap:\n            name: supabase-gateway-config\n        - name: entrypoint\n          configMap:\n            name: supabase-kong-entrypoint\n            defaultMode: 0755\n`;\n}\n\nfunction getSupabaseStudioManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: studio\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-studio\n  ports:\n    - name: http\n      port: 3000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: studio\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-studio\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-studio\n    spec:\n      containers:\n        - name: studio\n          image: ${SUPABASE_IMAGES.studio}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 3000\n              name: http\n          env:\n            - name: HOSTNAME\n              value: \"0.0.0.0\"\n            - name: STUDIO_PG_META_URL\n              value: \"http://meta.${SUPABASE_NAMESPACE}.svc.cluster.local:8080\"\n            - name: SUPABASE_URL\n              value: \"http://gateway.${SUPABASE_NAMESPACE}.svc.cluster.local:8000\"\n            - name: SUPABASE_PUBLIC_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SUPABASE_PUBLIC_URL\n            - name: SUPABASE_ANON_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_ANON_KEY\n            - name: SUPABASE_SERVICE_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_SERVICE_ROLE_KEY\n            - name: AUTH_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n`;\n}\n\nfunction getUpScript(args: {\n  appSlug: string;\n  defaultAppImage: string;\n  supabaseKubernetesEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n  secretStoreProvider: string;\n  supabaseHostPorts: SupabaseHostPorts;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n  providerLifecycle: readonly MinikubeProviderLifecycle[];\n}): string {\n  const {\n    appSlug,\n    defaultAppImage,\n    supabaseKubernetesEnabled,\n    profileModel,\n    secretStoreProvider,\n    supabaseHostPorts,\n    oauthProviders,\n    providerLifecycle,\n  } = args;\n  const oauthEnvDefaults = getOAuthScriptEnvDefaults(oauthProviders);\n  const oauthRuntimeSecretLines = getOAuthRuntimeSecretLines(oauthProviders);\n  const oauthValidation = getOAuthRuntimeValidationScript(oauthProviders);\n  const oauthCallbackRoute = getSupabaseOAuthCallbackRoute(oauthProviders);\n  const providerLifecycleStageScripts = getProviderLifecycleStageScripts(providerLifecycle);\n  const oauthVaultResolution = getOAuthVaultResolutionScript({\n    appSlug,\n    oauthProviders,\n    secretStoreProvider,\n  });\n\n  return `#!/usr/bin/env bash\nset -Eeuo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nK8S_DIR=\"\\${ROOT_DIR}/k8s\"\nBUILD_SCRIPT=\"\\${SCRIPT_DIR}/build-app-image.sh\"\nPORT_FORWARD_SCRIPT=\"\\${SCRIPT_DIR}/port-forward.sh\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-}\"\nDRIVER=\"\\${MINIKUBE_DRIVER:-}\"\nAPP_NAMESPACE=\"${APP_NAMESPACE}\"\nSUPABASE_NAMESPACE=\"${SUPABASE_NAMESPACE}\"\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-}\"\nAPP_IMAGE_SYNC_STRATEGY=\"\\${APP_IMAGE_SYNC_STRATEGY:-}\"\nAPP_REPLICAS=\"\\${APP_REPLICAS:-}\"\nAPP_FORCE_ROLLOUT_RESTART=\"\\${APP_FORCE_ROLLOUT_RESTART:-}\"\nAPP_IMAGE_PULL_SECRET_NAME=\"\\${APP_IMAGE_PULL_SECRET_NAME:-}\"\nAPP_IMAGE_PULL_SECRET_SERVER=\"\\${APP_IMAGE_PULL_SECRET_SERVER:-}\"\nAPP_IMAGE_PULL_SECRET_USERNAME=\"\\${APP_IMAGE_PULL_SECRET_USERNAME:-}\"\nAPP_IMAGE_PULL_SECRET_PASSWORD=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD:-}\"\nAPP_IMAGE_PULL_SECRET_EMAIL=\"\\${APP_IMAGE_PULL_SECRET_EMAIL:-}\"\nAPP_PORT_FORWARD_LOCAL_PORT=\"\\${APP_PORT_FORWARD_LOCAL_PORT:-}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-}\"\nSUPABASE_DB_FORWARD_LOCAL_PORT=\"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-}\"\nSUPABASE_DB_URL=\"\\${SUPABASE_DB_URL:-}\"\nSUPABASE_PROFILE_ENABLED=\"${profileModel.enabled ? 'true' : 'false'}\"\nSUPABASE_PROFILE_RECONCILE_FILE=\"\\${ROOT_DIR}/supabase/generated/auth_profiles.sql\"\n\nrequire_command() {\n  if ! command -v \"\\${1}\" >/dev/null 2>&1; then\n    echo \"\\${1} is required but not installed.\"\n    exit 1\n  fi\n}\n\nload_env_file_preserving_process_env() {\n  local line trimmed key value current\n  if [[ ! -f \"\\${ROOT_DIR}/.env\" ]]; then\n    return 0\n  fi\n\n  while IFS= read -r line || [[ -n \"\\${line}\" ]]; do\n    trimmed=\"$(printf '%s' \"\\${line}\" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')\"\n    if [[ -z \"\\${trimmed}\" || \"\\${trimmed}\" == \\\\#* || \"\\${trimmed}\" != *=* ]]; then\n      continue\n    fi\n\n    key=\"\\${trimmed%%=*}\"\n    value=\"\\${trimmed#*=}\"\n    key=\"\\${key//[[:space:]]/}\"\n    value=\"$(printf '%s' \"\\${value}\" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')\"\n    value=\"\\${value%\\\\\"}\"\n    value=\"\\${value#\\\\\"}\"\n    value=\"\\${value%\\\\'}\"\n    value=\"\\${value#\\\\'}\"\n    current=\"\\${!key:-}\"\n    if [[ -n \"\\${current}\" ]]; then\n      continue\n    fi\n    export \"\\${key}=\\${value}\"\n  done < \"\\${ROOT_DIR}/.env\"\n}\n\nenv_file_value() {\n  local key=\"\\${1}\"\n  if [[ ! -f \"\\${ROOT_DIR}/.env\" ]]; then\n    return 0\n  fi\n  awk -F= -v key=\"\\${key}\" '$1 == key { value = substr($0, index($0, \"=\") + 1) } END { print value }' \"\\${ROOT_DIR}/.env\"\n}\n\nenv_file_has_key() {\n  local key=\"\\${1}\"\n  if [[ ! -f \"\\${ROOT_DIR}/.env\" ]]; then\n    return 1\n  fi\n  awk -F= -v key=\"\\${key}\" '$1 == key { found = 1 } END { exit found ? 0 : 1 }' \"\\${ROOT_DIR}/.env\"\n}\n\nwrite_env_value() {\n  local key=\"\\${1}\"\n  local value=\"\\${2}\"\n  local tmp_env\n  mkdir -p \"\\${ROOT_DIR}\"\n  touch \"\\${ROOT_DIR}/.env\"\n  tmp_env=\"$(mktemp)\"\n  awk -F= -v key=\"\\${key}\" -v value=\"\\${value}\" '\n    $1 == key {\n      print key \"=\" value\n      found = 1\n      next\n    }\n    { print }\n    END {\n      if (!found) print key \"=\" value\n    }\n  ' \"\\${ROOT_DIR}/.env\" > \"\\${tmp_env}\"\n  mv \"\\${tmp_env}\" \"\\${ROOT_DIR}/.env\"\n}\n\nwrite_key_value_file_value() {\n  local file_path=\"\\${1}\"\n  local key=\"\\${2}\"\n  local value=\"\\${3}\"\n  local tmp_env\n  mkdir -p \"$(dirname \"\\${file_path}\")\"\n  touch \"\\${file_path}\"\n  tmp_env=\"$(mktemp)\"\n  awk -F= -v key=\"\\${key}\" -v value=\"\\${value}\" '\n    $1 == key {\n      print key \"=\" value\n      found = 1\n      next\n    }\n    { print }\n    END {\n      if (!found) print key \"=\" value\n    }\n  ' \"\\${file_path}\" > \"\\${tmp_env}\"\n  mv \"\\${tmp_env}\" \"\\${file_path}\"\n}\n\nsync_app_public_supabase_env() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  if [[ -z \"\\${APP_SOURCE_DIR:-}\" ]]; then\n    echo \"APP_SOURCE_DIR is required to write app Supabase public environment.\"\n    exit 1\n  fi\n\n  local app_env_file=\"\\${APP_SOURCE_DIR}/.env.local\"\n  write_key_value_file_value \"\\${app_env_file}\" \"EXPO_PUBLIC_SUPABASE_URL\" \"\\${EXPO_PUBLIC_SUPABASE_URL}\"\n  write_key_value_file_value \"\\${app_env_file}\" \"EXPO_PUBLIC_SUPABASE_ANON_KEY\" \"\\${EXPO_PUBLIC_SUPABASE_ANON_KEY}\"\n}\n\nset_required_env_default() {\n  local key=\"\\${1}\"\n  local value=\"\\${2}\"\n  local current=\"\\${!key:-}\"\n  if [[ -n \"\\${current}\" ]]; then\n    write_env_value \"\\${key}\" \"\\${current}\"\n    return 0\n  fi\n\n  current=\"$(env_file_value \"\\${key}\")\"\n  if [[ -n \"\\${current}\" ]]; then\n    export \"\\${key}=\\${current}\"\n    return 0\n  fi\n\n  write_env_value \"\\${key}\" \"\\${value}\"\n  export \"\\${key}=\\${value}\"\n}\n\nset_optional_env_default() {\n  local key=\"\\${1}\"\n  local value=\"\\${2}\"\n  local current=\"\\${!key:-}\"\n  if env_file_has_key \"\\${key}\"; then\n    export \"\\${key}=\\${current}\"\n    return 0\n  fi\n  if [[ -n \"\\${current}\" ]]; then\n    write_env_value \"\\${key}\" \"\\${current}\"\n    return 0\n  fi\n  write_env_value \"\\${key}\" \"\\${value}\"\n  export \"\\${key}=\\${value}\"\n}\n\nset_env_default() {\n  set_required_env_default \"\\${1}\" \"\\${2}\"\n}\n\nderive_additional_redirect_urls() {\n  local callback_route=\"${oauthCallbackRoute}\"\n  local callback_path=\"\\${callback_route#/}\"\n  local site_url_without_slash=\"\\${SITE_URL%/}\"\n  local urls=\"\\${site_url_without_slash},\\${site_url_without_slash}/\\${callback_path}\"\n  if [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n    urls=\"\\${urls},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\n  fi\n  printf '%s' \"\\${urls}\"\n}\n\nrandom_base64() {\n  openssl rand -base64 \"\\${1}\" | tr -d '\\\\n'\n}\n\nrandom_hex() {\n  openssl rand -hex \"\\${1}\" | tr -d '\\\\n'\n}\n\nbase64url() {\n  openssl base64 -A | tr '+/' '-_' | tr -d '='\n}\n\ngenerate_supabase_jwt() {\n  local role=\"\\${1}\"\n  local iat exp header payload signature\n  iat=\"$(date +%s)\"\n  exp=\"$((iat + 315360000))\"\n  header=\"$(printf '{\"alg\":\"HS256\",\"typ\":\"JWT\"}' | base64url)\"\n  payload=\"$(printf '{\"role\":\"%s\",\"iss\":\"supabase-demo\",\"iat\":%s,\"exp\":%s}' \"\\${role}\" \"\\${iat}\" \"\\${exp}\" | base64url)\"\n  signature=\"$(printf '%s.%s' \"\\${header}\" \"\\${payload}\" | openssl dgst -binary -sha256 -hmac \"\\${JWT_SECRET}\" | base64url)\"\n  printf '%s.%s.%s' \"\\${header}\" \"\\${payload}\" \"\\${signature}\"\n}\n\nensure_supabase_runtime_env() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  require_command openssl\n\n  set_required_env_default POSTGRES_PASSWORD \"$(random_hex 32)\"\n  set_required_env_default JWT_SECRET \"$(random_base64 48)\"\n  set_required_env_default SUPABASE_ANON_KEY \"$(generate_supabase_jwt anon)\"\n  set_required_env_default SUPABASE_SERVICE_ROLE_KEY \"$(generate_supabase_jwt service_role)\"\n  set_required_env_default DASHBOARD_USERNAME \"supabase\"\n  set_required_env_default DASHBOARD_PASSWORD \"$(random_base64 24)\"\n  set_required_env_default SECRET_KEY_BASE \"$(random_base64 48)\"\n  set_required_env_default REALTIME_DB_ENC_KEY \"$(random_hex 8)\"\n  set_required_env_default PG_META_CRYPTO_KEY \"$(random_base64 32)\"\n  set_required_env_default S3_PROTOCOL_ACCESS_KEY_ID \"$(random_hex 16)\"\n  set_required_env_default S3_PROTOCOL_ACCESS_KEY_SECRET \"$(random_hex 32)\"\n  set_required_env_default JWT_EXPIRY \"3600\"\n  set_required_env_default SUPABASE_GATEWAY_FORWARD_LOCAL_PORT \"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\n  set_required_env_default APP_PORT_FORWARD_LOCAL_PORT \"\\${APP_PORT_FORWARD_LOCAL_PORT:-${supabaseHostPorts.app}}\"\n  set_required_env_default SUPABASE_PUBLIC_URL \"http://127.0.0.1:\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT}\"\n  set_required_env_default API_EXTERNAL_URL \"\\${SUPABASE_PUBLIC_URL}/auth/v1\"\n  set_required_env_default SITE_URL \"http://127.0.0.1:\\${APP_PORT_FORWARD_LOCAL_PORT}\"\n  export OAUTH_NATIVE_REDIRECT_URLS=\"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\"\n  set_required_env_default ADDITIONAL_REDIRECT_URLS \"$(derive_additional_redirect_urls)\"\n  set_required_env_default ENABLE_EMAIL_SIGNUP \"true\"\n  set_required_env_default ENABLE_EMAIL_AUTOCONFIRM \"true\"\n  set_required_env_default SMTP_ADMIN_EMAIL \"admin@example.com\"\n  set_required_env_default SMTP_HOST \"localhost\"\n  set_required_env_default SMTP_PORT \"2500\"\n  set_optional_env_default SMTP_USER \"\"\n  set_optional_env_default SMTP_PASS \"\"\n  set_required_env_default SMTP_SENDER_NAME \"Ankhorage\"\n  set_required_env_default PGRST_DB_SCHEMAS \"public,storage,graphql_public\"\n  set_required_env_default PGRST_DB_MAX_ROWS \"1000\"\n  set_required_env_default PGRST_DB_EXTRA_SEARCH_PATH \"public\"\n  set_required_env_default GLOBAL_S3_BUCKET \"stub\"\n  set_required_env_default STORAGE_TENANT_ID \"stub\"\n  set_required_env_default REGION \"stub\"\n  set_required_env_default SUPABASE_DB_FORWARD_LOCAL_PORT \"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-${supabaseHostPorts.db}}\"\n  set_required_env_default SUPABASE_DB_URL \"postgres://postgres:\\${POSTGRES_PASSWORD}@127.0.0.1:\\${SUPABASE_DB_FORWARD_LOCAL_PORT}/postgres?sslmode=disable\"\n  set_required_env_default EXPO_PUBLIC_SUPABASE_URL \"\\${SUPABASE_PUBLIC_URL}\"\n  set_required_env_default EXPO_PUBLIC_SUPABASE_ANON_KEY \"\\${SUPABASE_ANON_KEY}\"\n${oauthEnvDefaults}\n}\n${oauthVaultResolution}\n\nsync_supabase_secrets() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  local tmp_runtime tmp_public\n  tmp_runtime=\"$(mktemp)\"\n  tmp_public=\"$(mktemp)\"\n  trap 'rm -f \"\\${tmp_runtime}\" \"\\${tmp_public}\"' EXIT\n\n  cat > \"\\${tmp_runtime}\" <<EOF\nPOSTGRES_PASSWORD=\\${POSTGRES_PASSWORD}\nJWT_SECRET=\\${JWT_SECRET}\nSUPABASE_ANON_KEY=\\${SUPABASE_ANON_KEY}\nSUPABASE_SERVICE_ROLE_KEY=\\${SUPABASE_SERVICE_ROLE_KEY}\nSUPABASE_PUBLISHABLE_KEY=\\${SUPABASE_PUBLISHABLE_KEY:-}\nSUPABASE_SECRET_KEY=\\${SUPABASE_SECRET_KEY:-}\nDASHBOARD_USERNAME=\\${DASHBOARD_USERNAME:-supabase}\nDASHBOARD_PASSWORD=\\${DASHBOARD_PASSWORD:-}\nSMTP_USER=\\${SMTP_USER:-}\nSMTP_PASS=\\${SMTP_PASS:-}\nSECRET_KEY_BASE=\\${SECRET_KEY_BASE}\nREALTIME_DB_ENC_KEY=\\${REALTIME_DB_ENC_KEY}\nPG_META_CRYPTO_KEY=\\${PG_META_CRYPTO_KEY}\nS3_PROTOCOL_ACCESS_KEY_ID=\\${S3_PROTOCOL_ACCESS_KEY_ID}\nS3_PROTOCOL_ACCESS_KEY_SECRET=\\${S3_PROTOCOL_ACCESS_KEY_SECRET}\n${oauthRuntimeSecretLines}\nEOF\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create secret generic supabase-runtime-secrets --from-env-file=\"\\${tmp_runtime}\" --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n\n  cat > \"\\${tmp_public}\" <<EOF\nEXPO_PUBLIC_SUPABASE_URL=\\${EXPO_PUBLIC_SUPABASE_URL}\nEXPO_PUBLIC_SUPABASE_ANON_KEY=\\${EXPO_PUBLIC_SUPABASE_ANON_KEY}\nSUPABASE_URL=http://gateway.${SUPABASE_NAMESPACE}.svc.cluster.local:8000\nSUPABASE_ANON_KEY=\\${SUPABASE_ANON_KEY}\nEOF\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" create secret generic supabase-public-runtime --from-env-file=\"\\${tmp_public}\" --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" apply -f -\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create configmap supabase-runtime-config \\\n    --from-literal=SUPABASE_PUBLIC_URL=\"\\${SUPABASE_PUBLIC_URL}\" \\\n    --from-literal=API_EXTERNAL_URL=\"\\${API_EXTERNAL_URL}\" \\\n    --from-literal=SITE_URL=\"\\${SITE_URL}\" \\\n    --from-literal=ADDITIONAL_REDIRECT_URLS=\"\\${ADDITIONAL_REDIRECT_URLS}\" \\\n    --from-literal=JWT_EXPIRY=\"\\${JWT_EXPIRY}\" \\\n    --from-literal=ENABLE_EMAIL_SIGNUP=\"\\${ENABLE_EMAIL_SIGNUP}\" \\\n    --from-literal=ENABLE_EMAIL_AUTOCONFIRM=\"\\${ENABLE_EMAIL_AUTOCONFIRM}\" \\\n    --from-literal=SMTP_ADMIN_EMAIL=\"\\${SMTP_ADMIN_EMAIL}\" \\\n    --from-literal=SMTP_HOST=\"\\${SMTP_HOST}\" \\\n    --from-literal=SMTP_PORT=\"\\${SMTP_PORT}\" \\\n    --from-literal=SMTP_SENDER_NAME=\"\\${SMTP_SENDER_NAME}\" \\\n    --from-literal=PGRST_DB_SCHEMAS=\"\\${PGRST_DB_SCHEMAS}\" \\\n    --from-literal=PGRST_DB_MAX_ROWS=\"\\${PGRST_DB_MAX_ROWS}\" \\\n    --from-literal=PGRST_DB_EXTRA_SEARCH_PATH=\"\\${PGRST_DB_EXTRA_SEARCH_PATH}\" \\\n    --from-literal=GLOBAL_S3_BUCKET=\"\\${GLOBAL_S3_BUCKET}\" \\\n    --from-literal=STORAGE_TENANT_ID=\"\\${STORAGE_TENANT_ID}\" \\\n    --from-literal=REGION=\"\\${REGION}\" \\\n    --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create configmap supabase-gateway-config \\\n    --from-file=temp.yml=\"\\${K8S_DIR}/supabase/gateway.template.yml\" \\\n    --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create configmap supabase-kong-entrypoint \\\n    --from-file=kong-entrypoint.sh=\"\\${K8S_DIR}/supabase/kong-entrypoint.sh\" \\\n    --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n\n  rm -f \"\\${tmp_runtime}\" \"\\${tmp_public}\"\n  trap - EXIT\n}\n\ndocker_load_image_to_minikube() {\n  if command -v docker >/dev/null 2>&1 && docker image inspect \"\\${APP_IMAGE}\" >/dev/null 2>&1; then\n    minikube -p \"\\${PROFILE}\" image load --daemon=true --overwrite=true \"\\${APP_IMAGE}\" >/dev/null\n    return 0\n  fi\n\n  return 1\n}\n\nrun_supabase_migrations() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  export SUPABASE_DB_URL PGSSLMODE=disable\n\n  if [[ -d \"\\${ROOT_DIR}/supabase/migrations\" ]]; then\n    require_command supabase\n    (\n      cd \"\\${ROOT_DIR}\"\n      supabase migration up --db-url \"\\${SUPABASE_DB_URL}\"\n    )\n  fi\n}\n\nreconcile_supabase_profile() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n  if [[ \"\\${SUPABASE_PROFILE_ENABLED}\" == \"true\" && -f \"\\${SUPABASE_PROFILE_RECONCILE_FILE}\" ]]; then\n    psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${SUPABASE_PROFILE_RECONCILE_FILE}\"\n  fi\n}\n\nreload_postgrest_schema() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -c \"notify pgrst, 'reload schema';\"\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout restart deployment/rest >/dev/null\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/rest --timeout=600s\n}\n\nbootstrap_supabase_vault_migration() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n  if [[ -f \"\\${ROOT_DIR}/supabase/migrations/202607120001_ankhorage_supabase_vault.sql\" ]]; then\n    kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" exec deployment/postgres -- psql -U postgres -d postgres -v ON_ERROR_STOP=1 -q -c \"alter role postgres with superuser;\"\n    kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" exec deployment/postgres -- psql -U postgres -d postgres -v ON_ERROR_STOP=1 -q -c \"create schema if not exists vault; grant pg_read_server_files to postgres; grant pg_read_server_files to supabase_admin; grant execute on function pg_read_file(text) to public; grant execute on function pg_read_file(text, bigint, bigint) to public;\"\n    psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${ROOT_DIR}/supabase/migrations/202607120001_ankhorage_supabase_vault.sql\"\n  fi\n}\n\nbootstrap_supabase_database() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  require_command psql\n  export POSTGRES_PASSWORD JWT_SECRET JWT_EXP=\"\\${JWT_EXPIRY}\" POSTGRES_USER=postgres\n  psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${K8S_DIR}/supabase/bootstrap.sql\"\n}\n\nwait_for_supabase_database() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  require_command psql\n  if ! \"\\${PORT_FORWARD_SCRIPT}\" start db-migration; then\n    echo \"Failed to start db-migration port-forward for Supabase bootstrap.\"\n    \"\\${PORT_FORWARD_SCRIPT}\" status db-migration || true\n    exit 1\n  fi\n  for attempt in {1..60}; do\n    if PGPASSWORD=\"\\${POSTGRES_PASSWORD}\" psql -h 127.0.0.1 -p \"\\${SUPABASE_DB_FORWARD_LOCAL_PORT}\" -U postgres -d postgres -v ON_ERROR_STOP=1 -Atq -c 'select 1' >/dev/null 2>&1; then\n      return 0\n    fi\n    sleep 2\n  done\n\n  echo \"Postgres did not accept SQL connections as postgres before bootstrap.\"\n  \"\\${PORT_FORWARD_SCRIPT}\" status db-migration || true\n  exit 1\n}\n\napply_supabase_runtime_workloads() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/auth.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/rest.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/realtime.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/imgproxy.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/storage.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/meta.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/gateway.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/studio.yaml\"\n}\n\napply_namespace_manifests() {\n  local namespace_manifest\n  for namespace_manifest in \"\\${K8S_DIR}\"/namespaces/*.yaml; do\n    kubectl --context \"\\${PROFILE}\" apply -f \"\\${namespace_manifest}\"\n  done\n}\n\n${providerLifecycleStageScripts}\n\nload_env_file_preserving_process_env\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nDRIVER=\"\\${MINIKUBE_DRIVER:-docker}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-true}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-$(cd \"\\${ROOT_DIR}/../..\" && pwd)}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-.ankh/web-export}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-${defaultAppImage}}\"\nAPP_IMAGE_SYNC_STRATEGY=\"\\${APP_IMAGE_SYNC_STRATEGY:-docker-load}\"\nAPP_REPLICAS=\"\\${APP_REPLICAS:-1}\"\nAPP_FORCE_ROLLOUT_RESTART=\"\\${APP_FORCE_ROLLOUT_RESTART:-true}\"\nAPP_IMAGE_PULL_SECRET_NAME=\"\\${APP_IMAGE_PULL_SECRET_NAME:-}\"\nAPP_IMAGE_PULL_SECRET_SERVER=\"\\${APP_IMAGE_PULL_SECRET_SERVER:-ghcr.io}\"\nAPP_IMAGE_PULL_SECRET_USERNAME=\"\\${APP_IMAGE_PULL_SECRET_USERNAME:-}\"\nAPP_IMAGE_PULL_SECRET_PASSWORD=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD:-}\"\nAPP_IMAGE_PULL_SECRET_EMAIL=\"\\${APP_IMAGE_PULL_SECRET_EMAIL:-}\"\nAPP_PORT_FORWARD_LOCAL_PORT=\"\\${APP_PORT_FORWARD_LOCAL_PORT:-${supabaseHostPorts.app}}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\nSUPABASE_DB_FORWARD_LOCAL_PORT=\"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-${supabaseHostPorts.db}}\"\nSUPABASE_DB_URL=\"\\${SUPABASE_DB_URL:-}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\ncleanup_failed_up() {\n  \"\\${PORT_FORWARD_SCRIPT}\" stop all >/dev/null 2>&1 || true\n}\n\ntrap cleanup_failed_up ERR\n\nrequire_command minikube\nrequire_command kubectl\nensure_supabase_runtime_env\nsync_app_public_supabase_env\n\nHOST_STATUS=\"$(minikube -p \"\\${PROFILE}\" status --format='{{.Host}}' 2>/dev/null || true)\"\nif [[ \"\\${HOST_STATUS}\" != \"Running\" ]]; then\n  minikube start -p \"\\${PROFILE}\" --driver=\"\\${DRIVER}\"\nfi\n\nif [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n  apply_namespace_manifests\n  sync_supabase_secrets\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/postgres.init.configmap.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/postgres.pvc.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/postgres.yaml\"\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/postgres --timeout=900s\n  wait_for_supabase_database\n  bootstrap_supabase_database\n  bootstrap_supabase_vault_migration\n  resolve_oauth_credentials_from_vault\n${oauthValidation}\n  sync_supabase_secrets\n  apply_supabase_runtime_workloads\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/auth --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/rest --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/realtime --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/storage --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/gateway --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/studio --timeout=600s\n  run_supabase_migrations\n  reconcile_supabase_profile\n  reload_postgrest_schema\n  \"\\${PORT_FORWARD_SCRIPT}\" start supabase-gateway >/dev/null\n  \"\\${PORT_FORWARD_SCRIPT}\" start studio >/dev/null\nelse\n  kubectl --context \"\\${PROFILE}\" apply -k \"\\${K8S_DIR}\"\nfi\n\nif [[ \"\\${APP_BUILD_ENABLED}\" == \"true\" ]]; then\n  if [[ ! -x \"\\${BUILD_SCRIPT}\" ]]; then\n    echo \"Missing build helper script: \\${BUILD_SCRIPT}\"\n    exit 1\n  fi\n\n  \"\\${BUILD_SCRIPT}\"\nfi\n\nif [[ \"\\${APP_WEB_EXPORT_DIR}\" = /* ]]; then\n  EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR}\"\nelse\n  EXPORT_DIR=\"\\${APP_SOURCE_DIR}/\\${APP_WEB_EXPORT_DIR}\"\nfi\n\ncase \"\\${APP_IMAGE_SYNC_STRATEGY}\" in\n  minikube-build)\n    if [[ ! -f \"\\${EXPORT_DIR}/index.html\" ]]; then\n      echo \"Expected web export output not found at \\${EXPORT_DIR}/index.html\"\n      exit 1\n    fi\n    minikube -p \"\\${PROFILE}\" image build -t \"\\${APP_IMAGE}\" -f \"\\${ROOT_DIR}/app-image/Dockerfile\" \"\\${EXPORT_DIR}\" >/dev/null\n    ;;\n  docker-load)\n    if ! docker_load_image_to_minikube; then\n      echo \"Skipping docker-load image sync; local Docker image \\${APP_IMAGE} not found.\"\n    fi\n    ;;\n  none)\n    echo \"Skipping local image sync (APP_IMAGE_SYNC_STRATEGY=none).\"\n    ;;\n  *)\n    echo \"Unsupported APP_IMAGE_SYNC_STRATEGY=\\${APP_IMAGE_SYNC_STRATEGY}. Use minikube-build, docker-load, or none.\"\n    exit 1\n    ;;\nesac\n\nif [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n  kubectl --context \"\\${PROFILE}\" apply -k \"\\${K8S_DIR}\"\nfi\n\nwait_for_provider_readiness\nrun_provider_migrations\nrun_provider_reconciliation\n\nif [[ -n \"\\${APP_IMAGE_PULL_SECRET_NAME}\" ]]; then\n  if [[ -z \"\\${APP_IMAGE_PULL_SECRET_USERNAME}\" || -z \"\\${APP_IMAGE_PULL_SECRET_PASSWORD}\" ]]; then\n    echo \"APP_IMAGE_PULL_SECRET_NAME is set, but username/password are missing.\"\n    exit 1\n  fi\n\n  SECRET_EMAIL_ARG=()\n  if [[ -n \"\\${APP_IMAGE_PULL_SECRET_EMAIL}\" ]]; then\n    SECRET_EMAIL_ARG=(--docker-email=\"\\${APP_IMAGE_PULL_SECRET_EMAIL}\")\n  fi\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" create secret docker-registry \"\\${APP_IMAGE_PULL_SECRET_NAME}\" --docker-server=\"\\${APP_IMAGE_PULL_SECRET_SERVER}\" --docker-username=\"\\${APP_IMAGE_PULL_SECRET_USERNAME}\" --docker-password=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD}\" \"\\${SECRET_EMAIL_ARG[@]}\" --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" apply -f -\n\n  PULL_SECRET_PATCH=\"$(cat <<EOF\n{\"spec\":{\"template\":{\"spec\":{\"imagePullSecrets\":[{\"name\":\"\\${APP_IMAGE_PULL_SECRET_NAME}\"}]}}}}\nEOF\n)\"\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" patch deployment app-runtime --type=merge --patch \"\\${PULL_SECRET_PATCH}\" >/dev/null\nelse\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" patch deployment app-runtime --type=json --patch='[{\"op\":\"remove\",\"path\":\"/spec/template/spec/imagePullSecrets\"}]' >/dev/null 2>&1 || true\nfi\n\nkubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" set image deployment/app-runtime app=\"\\${APP_IMAGE}\" >/dev/null\nkubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" scale deployment/app-runtime --replicas=\"\\${APP_REPLICAS}\" >/dev/null\n\nif [[ \"\\${APP_FORCE_ROLLOUT_RESTART}\" == \"true\" ]]; then\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" rollout restart deployment/app-runtime >/dev/null\nfi\n\nkubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" rollout status deployment/app-runtime --timeout=180s >/dev/null\n\"\\${PORT_FORWARD_SCRIPT}\" start app >/dev/null\n\ntrap - ERR\necho \"Minikube infrastructure for '\\${PROFILE}' is running.\"\n`;\n}\n\nfunction getBuildAppImageScript(args: { appSlug: string; defaultAppImage: string }): string {\n  const { appSlug, defaultAppImage } = args;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nDOCKERFILE_PATH=\"\\${ROOT_DIR}/app-image/Dockerfile\"\nAPP_SLUG=\"${appSlug}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-true}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-$(cd \"\\${ROOT_DIR}/../..\" && pwd)}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-.ankh/web-export}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-${defaultAppImage}}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\nif [[ \"\\${APP_BUILD_ENABLED}\" != \"true\" ]]; then\n  echo \"Skipping app image build (APP_BUILD_ENABLED=\\${APP_BUILD_ENABLED}).\"\n  exit 0\nfi\n\nif ! command -v docker >/dev/null 2>&1; then\n  echo \"docker is required to build app image.\"\n  exit 1\nfi\n\nif ! command -v bunx >/dev/null 2>&1; then\n  echo \"bunx is required to export the app for container image build.\"\n  exit 1\nfi\n\nif [[ ! -f \"\\${APP_SOURCE_DIR}/package.json\" ]]; then\n  echo \"APP_SOURCE_DIR does not look like an app root: \\${APP_SOURCE_DIR}\"\n  exit 1\nfi\n\nif [[ ! -f \"\\${DOCKERFILE_PATH}\" ]]; then\n  echo \"Dockerfile for app image build is missing: \\${DOCKERFILE_PATH}\"\n  exit 1\nfi\n\n(\n  cd \"\\${APP_SOURCE_DIR}\"\n  bunx expo export --platform web --output-dir \"\\${APP_WEB_EXPORT_DIR}\"\n)\n\nif [[ \"\\${APP_WEB_EXPORT_DIR}\" = /* ]]; then\n  EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR}\"\nelse\n  EXPORT_DIR=\"\\${APP_SOURCE_DIR}/\\${APP_WEB_EXPORT_DIR}\"\nfi\n\nif [[ ! -f \"\\${EXPORT_DIR}/index.html\" ]]; then\n  echo \"Expected web export output not found at \\${EXPORT_DIR}/index.html\"\n  exit 1\nfi\n\ndocker build -t \"\\${APP_IMAGE}\" \\\n  --label \"ankhorage.kind=generated-app\" \\\n  --label \"ankhorage.app_slug=\\${PROFILE}\" \\\n  --label \"ankhorage.image=\\${APP_IMAGE}\" \\\n  -f \"\\${DOCKERFILE_PATH}\" \\\n  \"\\${EXPORT_DIR}\"\necho \"Built app image: \\${APP_IMAGE} (profile: \\${PROFILE})\"\n`;\n}\n\nfunction getAppImageDockerfile(): string {\n  return `FROM nginx:1.27-alpine\n\nRUN cat <<'EOF' > /etc/nginx/conf.d/default.conf\nserver {\n  listen 8080;\n  server_name _;\n  root /usr/share/nginx/html;\n  index index.html;\n\n  location / {\n    try_files $uri $uri/ /index.html;\n  }\n}\nEOF\n\nCOPY . /usr/share/nginx/html\n\nEXPOSE 8080\n\nCMD [\"nginx\", \"-g\", \"daemon off;\"]\n`;\n}\n\nfunction getPortForwardScript(args: {\n  appSlug: string;\n  supabaseKubernetesEnabled: boolean;\n  supabaseHostPorts: SupabaseHostPorts;\n}): string {\n  const { appSlug, supabaseKubernetesEnabled, supabaseHostPorts } = args;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nSTATE_DIR=\"\\${ROOT_DIR}/.state/forwards\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nAPP_PORT_FORWARD_LOCAL_PORT=\"\\${APP_PORT_FORWARD_LOCAL_PORT:-${supabaseHostPorts.app}}\"\nAPP_PORT_FORWARD_REMOTE_PORT=\"\\${APP_PORT_FORWARD_REMOTE_PORT:-80}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\nSUPABASE_GATEWAY_FORWARD_REMOTE_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_REMOTE_PORT:-8000}\"\nSUPABASE_STUDIO_FORWARD_LOCAL_PORT=\"\\${SUPABASE_STUDIO_FORWARD_LOCAL_PORT:-${supabaseHostPorts.studio}}\"\nSUPABASE_STUDIO_FORWARD_REMOTE_PORT=\"\\${SUPABASE_STUDIO_FORWARD_REMOTE_PORT:-3000}\"\nSUPABASE_DB_FORWARD_LOCAL_PORT=\"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-${supabaseHostPorts.db}}\"\nSUPABASE_DB_FORWARD_REMOTE_PORT=\"\\${SUPABASE_DB_FORWARD_REMOTE_PORT:-5432}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"kubectl is required but not installed.\"\n  exit 1\nfi\n\nmkdir -p \"\\${STATE_DIR}\"\n\npid_file_for() {\n  echo \"\\${STATE_DIR}/\\${PROFILE}-\\${1}.pid\"\n}\n\ntarget_for() {\n  case \"\\${1}\" in\n    app)\n      echo \"${APP_NAMESPACE} service/app-runtime \\${APP_PORT_FORWARD_LOCAL_PORT} \\${APP_PORT_FORWARD_REMOTE_PORT}\"\n      ;;\n    supabase-gateway)\n      echo \"${SUPABASE_NAMESPACE} service/gateway \\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT} \\${SUPABASE_GATEWAY_FORWARD_REMOTE_PORT}\"\n      ;;\n    studio)\n      echo \"${SUPABASE_NAMESPACE} service/studio \\${SUPABASE_STUDIO_FORWARD_LOCAL_PORT} \\${SUPABASE_STUDIO_FORWARD_REMOTE_PORT}\"\n      ;;\n    db-migration)\n      echo \"${SUPABASE_NAMESPACE} service/postgres \\${SUPABASE_DB_FORWARD_LOCAL_PORT} \\${SUPABASE_DB_FORWARD_REMOTE_PORT}\"\n      ;;\n    *)\n      echo \"Unknown forward '\\${1}'. Use app, supabase-gateway, studio, db-migration, or all.\" >&2\n      return 1\n      ;;\n  esac\n}\n\nis_pid_running() {\n  local pid=\"\\${1}\"\n  [[ -n \"\\${pid}\" ]] && kill -0 \"\\${pid}\" >/dev/null 2>&1\n}\n\nis_port_accepting() {\n  local port=\"\\${1}\"\n  (echo >/dev/tcp/127.0.0.1/\"\\${port}\") >/dev/null 2>&1\n}\n\nprint_forward_log_tail() {\n  local name=\"\\${1}\"\n  local log_file=\"\\${STATE_DIR}/\\${PROFILE}-\\${name}.log\"\n  if [[ -s \"\\${log_file}\" ]]; then\n    echo \"\\${name}: recent kubectl port-forward log:\"\n    tail -n 20 \"\\${log_file}\"\n  fi\n}\n\nprocess_command_for_pid() {\n  local pid=\"\\${1}\"\n  ps -p \"\\${pid}\" -o command= 2>/dev/null || true\n}\n\nprocess_name_for_pid() {\n  local pid=\"\\${1}\"\n  ps -p \"\\${pid}\" -o comm= 2>/dev/null || true\n}\n\nis_owned_forward_process() {\n  local pid=\"\\${1}\"\n  local namespace=\"\\${2}\"\n  local resource=\"\\${3}\"\n  local local_port=\"\\${4}\"\n  local remote_port=\"\\${5}\"\n  local command\n  local process_name\n  command=\"$(process_command_for_pid \"\\${pid}\")\"\n  process_name=\"$(process_name_for_pid \"\\${pid}\")\"\n\n  case \"\\${process_name}\" in\n    *kubectl) ;;\n    *) return 1 ;;\n  esac\n\n  case \"\\${command}\" in\n    *\"kubectl --context \\${PROFILE} -n \\${namespace} port-forward \\${resource} \\${local_port}:\\${remote_port}\"*)\n      return 0\n      ;;\n    *)\n      return 1\n      ;;\n  esac\n}\n\nhandle_non_owned_forward_pid() {\n  local name=\"\\${1}\"\n  local pid=\"\\${2}\"\n  local pid_file=\"\\${3}\"\n  local local_port=\"\\${4}\"\n  echo \"\\${name}: stale pid file pointed at non-owned live pid \\${pid}; removing ownership record \\${pid_file}\"\n  rm -f \"\\${pid_file}\"\n\n  if is_port_accepting \"\\${local_port}\"; then\n    echo \"\\${name}: port occupied by non-owned process on local port \\${local_port}\"\n    return 1\n  fi\n\n  return 0\n}\n\nterminate_forward_process() {\n  local name=\"\\${1}\"\n  local pid=\"\\${2}\"\n  local namespace=\"\\${3}\"\n  local resource=\"\\${4}\"\n  local local_port=\"\\${5}\"\n  local remote_port=\"\\${6}\"\n\n  if [[ -z \"\\${pid}\" ]]; then\n    return 0\n  fi\n\n  if is_pid_running \"\\${pid}\" && ! is_owned_forward_process \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n    echo \"\\${name}: refusing to terminate non-owned live pid \\${pid}\"\n    return 1\n  fi\n\n  if is_pid_running \"\\${pid}\"; then\n    kill \"\\${pid}\" >/dev/null 2>&1 || true\n    for attempt in {1..20}; do\n      if ! is_pid_running \"\\${pid}\"; then\n        break\n      fi\n      sleep 0.25\n    done\n  fi\n\n  if is_pid_running \"\\${pid}\"; then\n    kill -KILL \"\\${pid}\" >/dev/null 2>&1 || true\n    for attempt in {1..20}; do\n      if ! is_pid_running \"\\${pid}\"; then\n        break\n      fi\n      sleep 0.25\n    done\n  fi\n\n  if is_pid_running \"\\${pid}\"; then\n    echo \"\\${name}: failed to stop owned port-forward pid \\${pid}\"\n    return 1\n  fi\n\n  for attempt in {1..20}; do\n    if ! is_port_accepting \"\\${local_port}\"; then\n      return 0\n    fi\n    sleep 0.25\n  done\n\n  echo \"\\${name}: owned port-forward pid \\${pid} stopped, but local port \\${local_port} is still accepting connections\"\n  return 1\n}\n\nstart_forward() {\n  local name=\"\\${1}\"\n  local pid_file\n  pid_file=\"$(pid_file_for \"\\${name}\")\"\n  read -r namespace resource local_port remote_port <<<\"$(target_for \"\\${name}\")\"\n\n  if [[ -f \"\\${pid_file}\" ]]; then\n    local existing_pid\n    existing_pid=\"$(cat \"\\${pid_file}\")\"\n    if is_pid_running \"\\${existing_pid}\"; then\n      if ! is_owned_forward_process \"\\${existing_pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n        handle_non_owned_forward_pid \"\\${name}\" \"\\${existing_pid}\" \"\\${pid_file}\" \"\\${local_port}\" || return 1\n      elif is_port_accepting \"\\${local_port}\"; then\n        echo \"\\${name}: running (pid \\${existing_pid})\"\n        return 0\n      else\n        echo \"\\${name}: stale running pid \\${existing_pid} was not accepting local port \\${local_port}; restarting\"\n        terminate_forward_process \"\\${name}\" \"\\${existing_pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\" || return 1\n        rm -f \"\\${pid_file}\"\n      fi\n    else\n      rm -f \"\\${pid_file}\"\n    fi\n  fi\n\n  if [[ \"\\${namespace}\" == \"${SUPABASE_NAMESPACE}\" && \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    echo \"\\${name}: skipped (Supabase Kubernetes disabled)\"\n    return 0\n  fi\n\n  if ! kubectl --context \"\\${PROFILE}\" -n \"\\${namespace}\" get \"\\${resource}\" >/dev/null 2>&1; then\n    echo \"\\${name}: target \\${namespace}/\\${resource} not found\"\n    return 1\n  fi\n\n  nohup kubectl --context \"\\${PROFILE}\" -n \"\\${namespace}\" port-forward \"\\${resource}\" \"\\${local_port}:\\${remote_port}\" >\"\\${STATE_DIR}/\\${PROFILE}-\\${name}.log\" 2>&1 &\n  local pid=\"$!\"\n  echo \"\\${pid}\" > \"\\${pid_file}\"\n\n  for attempt in {1..40}; do\n    if ! is_pid_running \"\\${pid}\"; then\n      echo \"\\${name}: failed to start local port \\${local_port} for \\${namespace}/\\${resource}:\\${remote_port}\"\n      print_forward_log_tail \"\\${name}\"\n      rm -f \"\\${pid_file}\"\n      return 1\n    fi\n    if is_port_accepting \"\\${local_port}\"; then\n      echo \"\\${name}: started (pid \\${pid}, local port \\${local_port})\"\n      return 0\n    fi\n    sleep 0.5\n  done\n\n  echo \"\\${name}: did not become ready on local port \\${local_port} for \\${namespace}/\\${resource}:\\${remote_port}\"\n  print_forward_log_tail \"\\${name}\"\n  terminate_forward_process \"\\${name}\" \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\" || return 1\n  rm -f \"\\${pid_file}\"\n  return 1\n}\n\nstop_forward() {\n  local name=\"\\${1}\"\n  local pid_file\n  pid_file=\"$(pid_file_for \"\\${name}\")\"\n  read -r namespace resource local_port remote_port <<<\"$(target_for \"\\${name}\")\"\n  if [[ ! -f \"\\${pid_file}\" ]]; then\n    echo \"\\${name}: stopped\"\n    return 0\n  fi\n\n  local pid\n  pid=\"$(cat \"\\${pid_file}\")\"\n  if is_pid_running \"\\${pid}\" && ! is_owned_forward_process \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n    handle_non_owned_forward_pid \"\\${name}\" \"\\${pid}\" \"\\${pid_file}\" \"\\${local_port}\" || return 1\n    echo \"\\${name}: stopped\"\n    return 0\n  fi\n\n  terminate_forward_process \"\\${name}\" \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\" || return 1\n  rm -f \"\\${pid_file}\"\n  echo \"\\${name}: stopped\"\n}\n\nstatus_forward() {\n  local name=\"\\${1}\"\n  local pid_file\n  pid_file=\"$(pid_file_for \"\\${name}\")\"\n  if [[ ! -f \"\\${pid_file}\" ]]; then\n    echo \"\\${name}: stopped\"\n    return 0\n  fi\n\n  local pid\n  pid=\"$(cat \"\\${pid_file}\")\"\n  if is_pid_running \"\\${pid}\"; then\n    read -r namespace resource local_port remote_port <<<\"$(target_for \"\\${name}\")\"\n    if ! is_owned_forward_process \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n      echo \"\\${name}: stale_pid_non_owned=\\${pid}\"\n      rm -f \"\\${pid_file}\"\n      return 0\n    fi\n    if is_port_accepting \"\\${local_port}\"; then\n      echo \"\\${name}: running pid=\\${pid} url=127.0.0.1:\\${local_port} target=\\${namespace}/\\${resource}:\\${remote_port}\"\n      return 0\n    fi\n    echo \"\\${name}: not ready pid=\\${pid} url=127.0.0.1:\\${local_port} target=\\${namespace}/\\${resource}:\\${remote_port}\"\n    return 0\n  fi\n\n  echo \"\\${name}: crashed stale_pid=\\${pid}\"\n  rm -f \"\\${pid_file}\"\n}\n\nfor_each_forward() {\n  local action=\"\\${1}\"\n  \"\\${action}_forward\" app\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n    \"\\${action}_forward\" supabase-gateway\n    \"\\${action}_forward\" studio\n    \"\\${action}_forward\" db-migration\n  fi\n}\n\nACTION=\"\\${1:-start}\"\nNAME=\"\\${2:-all}\"\n\ncase \"\\${ACTION}:\\${NAME}\" in\n  start:all) for_each_forward start ;;\n  stop:all) for_each_forward stop ;;\n  status:all) for_each_forward status ;;\n  start:*) start_forward \"\\${NAME}\" ;;\n  stop:*) stop_forward \"\\${NAME}\" ;;\n  status:*) status_forward \"\\${NAME}\" ;;\n  *)\n    echo \"Usage: ./scripts/port-forward.sh {start|stop|status} {app|supabase-gateway|studio|db-migration|all}\"\n    exit 1\n    ;;\nesac\n`;\n}\n\nfunction getDownScript(appSlug: string): string {\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" stop all >/dev/null || true\n\nif command -v minikube >/dev/null 2>&1; then\n  minikube stop -p \"\\${PROFILE}\"\nelse\n  echo \"minikube is required but not installed.\"\n  exit 1\nfi\n\necho \"Stopped Minikube profile '\\${PROFILE}'. Persistent data remains in the profile.\"\n`;\n}\n\nfunction getResetScript(args: {\n  appSlug: string;\n  supabaseKubernetesEnabled: boolean;\n  providerNamespaces: readonly string[];\n}): string {\n  const { appSlug, supabaseKubernetesEnabled, providerNamespaces } = args;\n  const resetNamespaces = [\n    APP_NAMESPACE,\n    ...(supabaseKubernetesEnabled ? [SUPABASE_NAMESPACE] : []),\n    ...providerNamespaces,\n  ];\n  const resetNamespaceCommands = resetNamespaces\n    .map(\n      (\n        namespace,\n      ) => `kubectl --context \"\\${PROFILE}\" delete namespace ${namespace} --ignore-not-found\nkubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/namespaces/${namespace}.yaml\"`,\n    )\n    .join('\\n');\n  const resetScope = `Kubernetes namespaces ${resetNamespaces.join(', ')}`;\n  const resetDataDescription = `reset.sh deletes and recreates namespaces ${resetNamespaces.join(\n    ', ',\n  )}. This resets app workloads and provider-owned data in those namespaces. It does not delete the Minikube profile.`;\n  const completionDescription = `Reset namespaces ${resetNamespaces.join(', ')}`;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nK8S_DIR=\"\\${ROOT_DIR}/k8s\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nCONFIRM=\"\\${ANKH_RESET_CONFIRM:-}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\nif [[ \"\\${CONFIRM}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"Refusing reset. Set ANKH_RESET_CONFIRM=\\${APP_SLUG} to reset ${resetScope} inside profile '\\${PROFILE}'.\"\n  echo \"${resetDataDescription}\"\n  exit 1\nfi\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"kubectl is required but not installed.\"\n  exit 1\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" stop all >/dev/null || true\n${resetNamespaceCommands}\necho \"${completionDescription} for profile '\\${PROFILE}'. Run ./scripts/up.sh to recreate runtime secrets, migrations, forwards, and app rollout.\"\n`;\n}\n\nfunction getDestroyScript(appSlug: string): string {\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" stop all >/dev/null || true\nminikube delete -p \"\\${PROFILE}\"\necho \"Deleted Minikube profile '\\${PROFILE}'.\"\n`;\n}\n\nfunction getStatusScript(args: {\n  appSlug: string;\n  supabaseKubernetesEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n  supabaseHostPorts: SupabaseHostPorts;\n  providerNamespaces: readonly string[];\n  providerLifecycle: readonly MinikubeProviderLifecycle[];\n}): string {\n  const {\n    appSlug,\n    supabaseKubernetesEnabled,\n    profileModel,\n    supabaseHostPorts,\n    providerNamespaces,\n    providerLifecycle,\n  } = args;\n  const namespaces = [\n    APP_NAMESPACE,\n    ...(supabaseKubernetesEnabled ? [SUPABASE_NAMESPACE] : []),\n    ...providerNamespaces,\n  ].join(' ');\n  const providerStatusScript = getProviderStatusScript(providerLifecycle);\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nSUPABASE_PROFILE_ENABLED=\"${profileModel.enabled ? 'true' : 'false'}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\necho \"Infra status for profile: \\${PROFILE}\"\n\nif ! command -v minikube >/dev/null 2>&1; then\n  echo \"- minikube: missing\"\n  exit 1\nfi\n\nHOST_STATUS=\"$(minikube -p \"\\${PROFILE}\" status --format='{{.Host}}' 2>/dev/null || true)\"\necho \"- minikube host: \\${HOST_STATUS:-missing}\"\n\nif [[ \"\\${HOST_STATUS}\" != \"Running\" ]]; then\n  echo \"- cluster: stopped\"\n  \"\\${SCRIPT_DIR}/port-forward.sh\" status all || true\n  exit 0\nfi\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"- kubectl: missing\"\n  exit 1\nfi\n\ncheck_secret_key() {\n  local secret=\"\\${1}\"\n  local key=\"\\${2}\"\n  local encoded\n  encoded=\"$(kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} get secret \"\\${secret}\" -o \"jsonpath={.data.\\${key}}\" 2>/dev/null || true)\"\n  if [[ -n \"\\${encoded}\" ]]; then\n    echo \"- secret/\\${secret}:\\${key}: present\"\n  else\n    echo \"- secret/\\${secret}:\\${key}: missing\"\n  fi\n}\n\npostgres_query() {\n  local sql=\"\\${1}\"\n  kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} exec deployment/postgres -- psql -U postgres -d postgres -Atq -c \"\\${sql}\" 2>/dev/null || true\n}\n\nfor namespace in ${namespaces}; do\n  if kubectl --context \"\\${PROFILE}\" get namespace \"\\${namespace}\" >/dev/null 2>&1; then\n    echo \"- namespace/\\${namespace}: present\"\n    kubectl --context \"\\${PROFILE}\" -n \"\\${namespace}\" get pods\n  else\n    echo \"- namespace/\\${namespace}: missing\"\n  fi\ndone\n\nif kubectl --context \"\\${PROFILE}\" -n ${APP_NAMESPACE} get deployment app-runtime >/dev/null 2>&1; then\n  kubectl --context \"\\${PROFILE}\" -n ${APP_NAMESPACE} rollout status deployment/app-runtime --timeout=5s >/dev/null 2>&1 && echo \"- app-runtime: ready\" || echo \"- app-runtime: not ready\"\nfi\n\n${providerStatusScript}\n\nif [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n  for deployment in postgres auth rest realtime storage gateway studio; do\n    if kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} get deployment \"\\${deployment}\" >/dev/null 2>&1; then\n      kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} rollout status \"deployment/\\${deployment}\" --timeout=5s >/dev/null 2>&1 && echo \"- supabase/\\${deployment}: ready\" || echo \"- supabase/\\${deployment}: not ready\"\n    else\n      echo \"- supabase/\\${deployment}: missing\"\n    fi\n  done\n\n  for key in POSTGRES_PASSWORD JWT_SECRET SUPABASE_ANON_KEY SUPABASE_SERVICE_ROLE_KEY SECRET_KEY_BASE REALTIME_DB_ENC_KEY PG_META_CRYPTO_KEY; do\n    check_secret_key supabase-runtime-secrets \"\\${key}\"\n  done\n\n  db_check=\"$(postgres_query 'select 1')\"\n  if [[ \"\\${db_check}\" == \"1\" ]]; then\n    echo \"- postgres connectivity: ok\"\n  else\n    echo \"- postgres connectivity: failed\"\n  fi\n\n  migration_count=\"$(postgres_query \"select count(*) from supabase_migrations.schema_migrations\" || true)\"\n  if [[ \"\\${migration_count}\" =~ ^[0-9]+$ ]]; then\n    echo \"- migration history: \\${migration_count} applied\"\n  else\n    echo \"- migration history: unavailable\"\n  fi\n\n  if [[ \"\\${SUPABASE_PROFILE_ENABLED}\" == \"true\" ]]; then\n    profile_state=\"$(postgres_query \"select count(*) from ankhorage_internal.generated_schema_state where artifact_key = 'auth.profile'\" || true)\"\n    if [[ \"\\${profile_state}\" =~ ^[1-9][0-9]*$ ]]; then\n      echo \"- profile reconciliation: applied\"\n    else\n      echo \"- profile reconciliation: missing\"\n    fi\n  else\n    state_table=\"$(postgres_query \"select to_regclass('ankhorage_internal.generated_schema_state') is not null\" || true)\"\n    if [[ \"\\${state_table}\" != \"t\" ]]; then\n      echo \"- profile reconciliation: disabled\"\n    else\n      profile_state=\"$(postgres_query \"select coalesce((select case when table_name is null then 'stale-state-missing-table-name' when to_regclass(format('public.%I', table_name)) is null then 'stale-state-missing-table:' || table_name else 'stale-state-table-present:' || table_name end from ankhorage_internal.generated_schema_state where artifact_key = 'auth.profile'), 'disabled')\" || true)\"\n      if [[ \"\\${profile_state}\" == \"disabled\" ]]; then\n        echo \"- profile reconciliation: disabled\"\n      else\n        echo \"- profile reconciliation: unexpected \\${profile_state}\"\n      fi\n    fi\n  fi\n\n  vault_state=\"$(postgres_query \"select exists(select 1 from pg_namespace where nspname = 'vault')\" || true)\"\n  if [[ \"\\${vault_state}\" == \"t\" ]]; then\n    echo \"- vault schema: present\"\n  else\n    echo \"- vault schema: absent\"\n  fi\n\n  if command -v curl >/dev/null 2>&1; then\n    public_url=\"\\${SUPABASE_PUBLIC_URL:-http://127.0.0.1:\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT}}\"\n    if curl -fsS \"\\${public_url}/auth/v1/health\" >/dev/null 2>&1; then\n      echo \"- supabase public endpoint: ok (\\${public_url})\"\n    else\n      echo \"- supabase public endpoint: unavailable (\\${public_url})\"\n    fi\n  fi\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" status all || true\n`;\n}\n\nfunction getDefaultAppImage(appSlug: string): string {\n  return `ankh/${appSlug}:dev`;\n}\n\nfunction resolveSupabaseHostPorts(appSlug: string): SupabaseHostPorts {\n  const base = PORT_BASE + resolvePortBucket(appSlug) * PORT_BUCKET_SIZE;\n  return {\n    app: base,\n    gateway: base + 1,\n    studio: base + 2,\n    db: base + 3,\n  };\n}\n\nfunction resolvePortBucket(appSlug: string): number {\n  const rawBucket = hashSlug(appSlug) - hashSlug(PORT_REFERENCE_SLUG);\n  return (rawBucket + PORT_BUCKET_COUNT) % PORT_BUCKET_COUNT;\n}\n\nfunction hashSlug(value: string): number {\n  let hash = 0;\n  for (const char of value) {\n    hash = (hash * 31 + char.charCodeAt(0)) % PORT_BUCKET_COUNT;\n  }\n  return hash;\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}