@ankhorage/infra 0.4.2 → 1.0.1

package/src/adapters/minikube/index.ts

@@ -7,11 +7,10 @@ import type {
 } from '../../types';
 import { generateAuthProviderArtifacts } from './auth';
 import { generateAuthorizationArtifacts } from './authz';
-import { generateMinikubeBaseArtifacts } from './base';
+import { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';
 import { generateSecretStoreArtifacts } from './secrets';
 import { generateStorageArtifacts } from './storage';
 
-const DEFAULT_NAMESPACE = 'ankh-app';
 const CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
 
 export function generateMinikubeInfra(
@@ -30,10 +29,8 @@ export function generateMinikubeInfra(
     );
   }
 
-  const namespace = resolveNamespace(manifest, options);
-  const supabaseProjectId = isSupabaseLocalEnabled(manifest)
-    ? validateCanonicalProjectSlug(options.appManifest?.metadata.slug)
-    : null;
+  const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);
+  const namespace = APP_NAMESPACE;
 
   const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });
   const authzArtifacts = generateAuthorizationArtifacts({
@@ -54,6 +51,15 @@ export function generateMinikubeInfra(
     ...storageArtifacts.resources,
     ...secretStoreArtifacts.resources,
   ]);
+  const providerLifecycle = [
+    ...authArtifacts.providerLifecycle,
+    ...authzArtifacts.providerLifecycle,
+    ...storageArtifacts.providerLifecycle,
+    ...secretStoreArtifacts.providerLifecycle,
+  ];
+  const providerNamespaces = unique([
+    ...providerLifecycle.map((contribution) => contribution.namespace),
+  ]);
   const extraEnvEntries = unique([
     ...authArtifacts.envEntries,
     ...authzArtifacts.envEntries,
@@ -63,9 +69,10 @@ export function generateMinikubeInfra(
 
   const baseFiles = generateMinikubeBaseArtifacts({
     manifest,
-    namespace,
-    supabaseProjectId,
+    appSlug,
     extraResources,
+    providerNamespaces,
+    providerLifecycle,
     extraEnvEntries,
   });
 
@@ -141,55 +148,22 @@ function collectWarnings(manifest: InfraManifestInput): string[] {
   return warnings;
 }
 
-function isSupabaseLocalEnabled(manifest: InfraManifestInput): boolean {
-  const authProvider = manifest.auth?.provider;
-  const databaseProvider = manifest.database?.provider;
-  const storageProvider = manifest.storage?.provider;
-  const secretStoreProvider = manifest.secretStore?.provider;
-
-  return (
-    authProvider === 'supabase' ||
-    databaseProvider === 'supabase' ||
-    storageProvider === 'supabase' ||
-    (storageProvider === 'auto' &&
-      (authProvider === 'supabase' || databaseProvider === 'supabase')) ||
-    secretStoreProvider === 'supabase-vault'
-  );
-}
-
-function validateCanonicalProjectSlug(slug: string | undefined): string {
+function validateCanonicalAppSlug(slug: string | undefined): string {
   if (!slug) {
     throw new Error(
-      'Cannot generate local Supabase infrastructure: appManifest.metadata.slug is required.',
+      'Cannot generate Minikube infrastructure: appManifest.metadata.slug is required.',
     );
   }
 
   if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {
     throw new Error(
-      'Cannot generate local Supabase infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',
+      'Cannot generate Minikube infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',
     );
   }
 
   return slug;
 }
 
-function resolveNamespace(
-  manifest: InfraManifestInput,
-  options: InfrastructureGenerationOptions,
-): string {
-  const source =
-    manifest.networking?.domain?.trim() ?? options.namespaceHint?.trim() ?? DEFAULT_NAMESPACE;
-
-  const normalized = source
-    .toLowerCase()
-    .replace(/[^a-z0-9-]/g, '-')
-    .replace(/-+/g, '-')
-    .replace(/^-|-$/g, '');
-
-  const safe = normalized.slice(0, 63).replace(/-+$/g, '');
-  return safe || DEFAULT_NAMESPACE;
-}
-
 function unique(values: string[]): string[] {
   return [...new Set(values)];
 }

package/src/adapters/minikube/secrets/index.test.ts

@@ -1,5 +1,4 @@
 import type { AppManifest } from '@ankhorage/contracts';
-import { SUPABASE_VAULT_MIGRATION_SQL } from '@ankhorage/supabase-vault';
 import { describe, expect, test } from 'bun:test';
 
 import { generateInfrastructure } from '../../../index';
@@ -21,7 +20,7 @@ function createManifest(overrides: Partial<InfraManifestInput> = {}): InfraManif
 }
 
 describe('minikube secret-store generation', () => {
-  test('generates the released Supabase Vault migration through the existing lifecycle', () => {
+  test('generates the released Supabase Vault migration through the Kubernetes lifecycle', () => {
     const result = generateInfrastructure(createManifest(), {
       appManifest: createAppManifest('vault-app'),
     });
@@ -29,10 +28,18 @@ describe('minikube secret-store generation', () => {
     const envExample = result.files.find((file) => file.path === 'infra/minikube/.env.example');
     const upScript = result.files.find((file) => file.path === 'infra/minikube/scripts/up.sh');
 
-    expect(migration?.content).toBe(`${SUPABASE_VAULT_MIGRATION_SQL.trim()}\n`);
+    expect(migration?.content).toContain('create schema if not exists vault;');
+    expect(migration?.content).toContain(
+      'create extension if not exists supabase_vault with schema vault;',
+    );
+    expect(migration?.content).toContain('when insufficient_privilege then');
+    expect(migration?.content).toContain('create or replace function vault.create_secret');
+    expect(migration?.content).toContain('create or replace view vault.decrypted_secrets');
+    expect(migration?.content).not.toContain('supabase_vault with schema extensions');
     expect(envExample?.content).toContain('SECRET_STORE_PROVIDER=supabase-vault');
-    expect(envExample?.content).toContain('SUPABASE_LOCAL_ENABLED=true');
-    expect(upScript?.content).toContain('SUPABASE_LOCAL_ENABLED="${SUPABASE_LOCAL_ENABLED:-true}"');
+    expect(envExample?.content).not.toContain('SUPABASE_RUNTIME_ENABLED=');
+    expect(upScript?.content).toContain('SUPABASE_RUNTIME_ENABLED="true"');
+    expect(upScript?.content).not.toContain('SUPABASE_RUNTIME_ENABLED="${SUPABASE_RUNTIME_ENABLED');
     expect(result.meta.providers).toContain('supabase-vault');
   });
 
@@ -90,8 +97,8 @@ describe('minikube secret-store generation', () => {
 
     const serialized = JSON.stringify(result.files);
     expect(serialized).toContain('auth/oauth/google');
-    expect(serialized).not.toContain('clientSecret');
-    expect(serialized).not.toContain('privateKey');
+    expect(serialized).not.toContain('sentinel-client-secret-value');
+    expect(serialized).not.toContain('sentinel-private-key-value');
   });
 
   test('rejects unknown secret-store providers', () => {
@@ -102,6 +109,7 @@ describe('minikube secret-store generation', () => {
             provider: 'aws-secrets-manager',
           },
         }),
+        { appManifest: createAppManifest('vault-app') },
       ),
     ).toThrow('Unsupported secret-store provider for minikube adapter');
   });

package/src/adapters/minikube/secrets/supabase-vault/index.ts

@@ -19,7 +19,7 @@ export function generateSupabaseVaultSecretStoreArtifacts(args: {
     files: [
       {
         path: SUPABASE_VAULT_MIGRATION_PATH,
-        content: `${SUPABASE_VAULT_MIGRATION_SQL.trim()}\n`,
+        content: getCurrentSupabaseVaultMigrationSql(),
       },
       {
         path: 'infra/minikube/secrets/supabase-vault.md',
@@ -27,14 +27,60 @@ export function generateSupabaseVaultSecretStoreArtifacts(args: {
       },
     ],
     resources: [],
-    envEntries: [
-      `SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`,
-      'SUPABASE_LOCAL_ENABLED=true',
-    ],
+    providerLifecycle: [],
+    envEntries: [`SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`],
     warnings: [],
   };
 }
 
+function getCurrentSupabaseVaultMigrationSql(): string {
+  return `${SUPABASE_VAULT_MIGRATION_SQL.trim()
+    .replace(
+      'create extension if not exists supabase_vault with schema extensions;',
+      () => `create schema if not exists vault;
+do $$
+begin
+  create extension if not exists supabase_vault with schema vault;
+exception
+  when insufficient_privilege then
+    create table if not exists vault.secrets (
+      id uuid primary key default gen_random_uuid(),
+      secret text not null,
+      name text,
+      description text,
+      created_at timestamptz not null default now()
+    );
+
+    create or replace function vault.create_secret(
+      secret text,
+      name text default null,
+      description text default null
+    )
+    returns uuid
+    language plpgsql
+    security definer
+    set search_path = vault, public
+    as $vault$
+    declare
+      secret_id uuid;
+    begin
+      insert into vault.secrets (secret, name, description)
+      values (secret, name, description)
+      returning id into secret_id;
+
+      return secret_id;
+    end;
+    $vault$;
+
+    create or replace view vault.decrypted_secrets as
+      select id, secret as decrypted_secret
+      from vault.secrets;
+end
+$$;`,
+    )
+    .trim()}\n`;
+}
+
 function validateOAuthSecretReferences(manifest: InfraManifestInput): void {
   const oauth = manifest.auth?.oauth;
   if (!oauth?.enabled) return;
@@ -68,7 +114,8 @@ The immutable migration at:
 ${SUPABASE_VAULT_MIGRATION_PATH}
 \`\`\`
 
-is applied by the existing local Supabase migration lifecycle during \`scripts/up.sh\`.
+is applied by the Kubernetes-owned Supabase migration lifecycle during \`scripts/up.sh\`
+with \`supabase migration up --db-url "$SUPABASE_DB_URL"\`.
 
 ## Security boundary
 

package/src/adapters/minikube/storage/supabase/index.ts

@@ -25,11 +25,6 @@ export function generateSupabaseStorageArtifacts(args: {
     envEntries.push(
       '',
       '# Supabase provider connection details',
-      'SUPABASE_SECRET_SYNC_ENABLED=true',
-      'SUPABASE_URL=',
-      'SUPABASE_ANON_KEY=',
-      'SUPABASE_SERVICE_ROLE_KEY=',
-      'SUPABASE_JWT_SECRET=',
       'EXPO_PUBLIC_SUPABASE_URL=',
       'EXPO_PUBLIC_SUPABASE_ANON_KEY=',
     );
@@ -58,6 +53,7 @@ export function generateSupabaseStorageArtifacts(args: {
       `${resourceRoot}/supabase-storage.configmap.yaml`,
       `${resourceRoot}/app-runtime-storage.env.configmap.yaml`,
     ],
+    providerLifecycle: [],
     envEntries,
     warnings: [
       `Storage buckets are configured but not created automatically yet. Ensure buckets exist in Supabase Storage: ${bucketsCsv}.`,

package/src/apis.test.ts

@@ -2,6 +2,7 @@ import type { AppManifest } from '@ankhorage/contracts';
 import { describe, expect, test } from 'bun:test';
 
 import { generateInfrastructure } from './index';
+import { createAppManifest } from './testSupport';
 import type { InfraManifestInput } from './types';
 
 describe('API infrastructure generation', () => {
@@ -197,7 +198,7 @@ describe('API infrastructure generation', () => {
       plugins: [],
     };
 
-    const result = generateInfrastructure(manifest, { namespaceHint: 'cards' });
+    const result = generateInfrastructure(manifest, { appManifest: createAppManifest('cards') });
 
     expect(result.meta.providers).toContain('legend');
     expect(result.dependencies).toEqual([