@ankhorage/infra 1.0.0 → 1.0.2

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @ankhorage/infra
 
+## 1.0.2
+
+### Patch Changes
+
+- aba801b: Preserve the browser-visible forwarded origin when generated app nginx redirects canonical static routes such as `/products` to `/products/`.
+
+## 1.0.1
+
+### Patch Changes
+
+- efa43ed: Write generated Supabase browser env values into the app `.env.local` during Minikube Infra
+  Up so local Expo auth clients receive the gateway URL and anon key.
+
 ## 1.0.0
 
 ### Major Changes

package/README.md

@@ -3,7 +3,7 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v0.4.2](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v1.0.1](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 

package/dist/adapters/minikube/auth/supabase/index.js

@@ -143,6 +143,11 @@ Your app runtime deployment should import both:
 - \`app-runtime-auth-env\` (configMap)
 - \`supabase-public-runtime\` (secret)
 
+For local Expo/Metro development, \`scripts/up.sh\` also writes the same browser-safe
+\`EXPO_PUBLIC_SUPABASE_URL\` and \`EXPO_PUBLIC_SUPABASE_ANON_KEY\` values to
+\`\${APP_SOURCE_DIR}/.env.local\`, preserving unrelated entries. Restart Expo after
+Infra Up so those public values are embedded into the client bundle.
+
 Example deployment fragment:
 
 \`\`\`yaml
@@ -180,8 +185,8 @@ ${profileSection}
 ## Runtime Secrets
 
 When Supabase is enabled, \`scripts/up.sh\` creates/updates \`Secret/supabase-public-runtime\`
-with browser-safe values for the app namespace. Privileged Supabase runtime secrets remain in
-the \`supabase\` namespace.
+with browser-safe values for the app namespace and mirrors the Expo public values into the
+app \`.env.local\`. Privileged Supabase runtime secrets remain in the \`supabase\` namespace.
 `;
 }
 const DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];

package/dist/adapters/minikube/auth/supabase/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gCAAgC,EAEhC,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AAEnB,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAErC,MAAM,IAAI,GAAG,kCAAkC,CAAC;IAChD,MAAM,YAAY,GAAG,eAAe,CAAC;IACrC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,MAAM,aAAa,GAAG,mCAAmC,CAAC;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,QAAQ,CAAC;IACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,MAAM,CAAC;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,eAAe,KAAK,iFAAiF,CACtG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,oBAAoB,CAAC;oBAC5B,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sCAAsC;gBACnD,OAAO,EAAE,0BAA0B,CAAC;oBAClC,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD,GAAG,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,GAAG,aAAa,oBAAoB;wBAC1C,OAAO,EAAE,gCAAgC,CAAC,YAAY,CAAC;qBACxD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,IAAI,EAAE,GAAG,QAAQ,6BAA6B;gBAC9C,OAAO,EAAE,6BAA6B,CAAC,YAAY,CAAC;aACrD;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,sCAAsC;SACtD;QACD,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,CAAC,2BAA2B,EAAE,gCAAgC,CAAC;QAC3E,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAO7B;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;iBAGP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;CAC7D,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAAC,IAOnC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;;iBAIP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;;;CAG7D,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,YAAkC;IACvE,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO;QACzC,CAAC,CAAC;;;;WAIK,YAAY,CAAC,KAAK,2BAA2B,YAAY,CAAC,KAAK;;;;;;;;;CASzE;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkDP,cAAc;;;;;;CAMf,CAAC;AACF,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9C,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC9D,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAS5C,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAClC,2BAA2B,CAC5B,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IACnF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;QACvE,OAAO;QACP,WAAW;QACX,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,YAAY;QACZ,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAqC,EACrC,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\nimport {\n  getSupabaseProfileReconciliation,\n  type ResolvedProfileModel,\n  resolveSupabaseProfileModel,\n} from './profile';\n\nexport function generateSupabaseAuthArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n\n  const root = 'infra/minikube/k8s/auth/supabase';\n  const resourceRoot = 'auth/supabase';\n  const docsRoot = 'infra/minikube/auth';\n  const generatedRoot = 'infra/minikube/supabase/generated';\n  const scope = manifest.auth?.scope ?? 'global';\n  const authzEngine = manifest.auth?.authorization?.engine ?? 'native';\n  const authzKind = manifest.auth?.authorization?.kind ?? 'RBAC';\n  const authFieldModel = resolveAuthFieldModel(manifest);\n  const profileModel = resolveSupabaseProfileModel(manifest);\n\n  const warnings: string[] = [];\n  if (scope !== 'global') {\n    warnings.push(\n      `Auth scope \"${scope}\" is not fully modeled yet for Supabase. Baseline resources assume global auth.`,\n    );\n  }\n\n  return {\n    files: [\n      {\n        path: `${root}/supabase-auth.configmap.yaml`,\n        content: getSupabaseConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      {\n        path: `${root}/app-runtime-auth.env.configmap.yaml`,\n        content: getRuntimeAuthEnvConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      ...(profileModel.enabled\n        ? [\n            {\n              path: `${generatedRoot}/auth_profiles.sql`,\n              content: getSupabaseProfileReconciliation(profileModel),\n            },\n          ]\n        : []),\n      {\n        path: `${docsRoot}/supabase-runtime-wiring.md`,\n        content: getSupabaseRuntimeWiringGuide(profileModel),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/supabase-auth.configmap.yaml`,\n      `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,\n    ],\n    providerLifecycle: [],\n    envEntries: ['EXPO_PUBLIC_SUPABASE_URL=', 'EXPO_PUBLIC_SUPABASE_ANON_KEY='],\n    warnings,\n  };\n}\n\nfunction getSupabaseConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-auth-config\n  namespace: ${namespace}\ndata:\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n`;\n}\n\nfunction getRuntimeAuthEnvConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-runtime-auth-env\n  namespace: ${namespace}\ndata:\n  AUTH_REQUIRED: \"true\"\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n  AUTH_TOKEN_HEADER: \"Authorization\"\n  AUTH_TOKEN_PREFIX: \"Bearer\"\n`;\n}\n\nfunction getSupabaseRuntimeWiringGuide(profileModel: ResolvedProfileModel) {\n  const profileSection = profileModel.enabled\n    ? `\n## App Profile Table\n\nIdentity remains provider-owned in \\`auth.users\\`. App-facing profile data is generated in\n\\`public.${profileModel.table}\\` and linked through \\`${profileModel.table}.id -> auth.users.id\\`.\n\nThe generated profile reconciliation:\n\n- creates the profile table\n- enables row-level security\n- allows signed-in users to read and update their own profile row\n- drops stale Ankhorage-managed profile columns that are no longer configured\n- creates a trigger for new auth users when \\`AUTH_PROFILE_CREATE_STRATEGY=trigger\\`\n`\n    : '';\n\n  return `# Supabase Runtime Wiring\n\nThis file documents the runtime conventions generated by the minikube Supabase adapter.\n\n## Generated Kubernetes Objects\n\n- \\`ConfigMap/supabase-auth-config\\`: high-level auth metadata.\n- \\`Secret/supabase-public-runtime\\`: browser-safe Supabase URL and anon key material, generated by \\`scripts/up.sh\\` after local Supabase secrets exist.\n- \\`ConfigMap/app-runtime-auth-env\\`: auth runtime feature flags and authz metadata.\n\n## App Runtime Convention\n\nYour app runtime deployment should import both:\n\n- \\`app-runtime-auth-env\\` (configMap)\n- \\`supabase-public-runtime\\` (secret)\n\nExample deployment fragment:\n\n\\`\\`\\`yaml\nenvFrom:\n  - configMapRef:\n      name: app-runtime-auth-env\n  - secretRef:\n      name: supabase-public-runtime\n\\`\\`\\`\n\nThe generated base deployment at \\`k8s/app/deployment.yaml\\` already includes this wiring\nwith \\`optional: true\\` for auth sources.\n\n## Expected Environment Variables\n\n- \\`AUTH_REQUIRED\\`\n- \\`AUTH_PROVIDER\\`\n- \\`AUTH_SCOPE\\`\n- \\`AUTHZ_ENGINE\\`\n- \\`AUTHZ_KIND\\`\n- \\`AUTH_SIGN_IN_IDENTIFIERS\\`\n- \\`AUTH_SIGN_UP_REQUIRED_FIELDS\\`\n- \\`AUTH_SIGN_UP_OPTIONAL_FIELDS\\`\n- \\`AUTH_SIGN_UP_POLICY\\`\n- \\`AUTH_PROFILE_FIELDS\\`\n- \\`AUTH_PROFILE_TABLE\\`\n- \\`AUTH_PROFILE_PRIMARY_KEY\\`\n- \\`AUTH_PROFILE_CREATE_STRATEGY\\`\n- \\`AUTH_PROFILE_UPDATE_STRATEGY\\`\n- \\`SUPABASE_URL\\`\n- \\`SUPABASE_ANON_KEY\\`\n- \\`EXPO_PUBLIC_SUPABASE_URL\\`\n- \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\`\n${profileSection}\n## Runtime Secrets\n\nWhen Supabase is enabled, \\`scripts/up.sh\\` creates/updates \\`Secret/supabase-public-runtime\\`\nwith browser-safe values for the app namespace. Privileged Supabase runtime secrets remain in\nthe \\`supabase\\` namespace.\n`;\n}\n\nconst DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];\nconst DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];\nconst DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];\nconst DEFAULT_SIGN_UP_POLICY = 'autoSignIn';\ninterface ResolvedAuthFieldModel {\n  signInIdentifiersCsv: string;\n  signUpRequiredFieldsCsv: string;\n  signUpOptionalFieldsCsv: string;\n  signUpPolicy: string;\n  profileFieldsCsv: string;\n}\n\nfunction resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {\n  const signInIdentifiers = normalizeFieldList(\n    manifest.auth?.signIn?.identifiers,\n    DEFAULT_SIGN_IN_IDENTIFIERS,\n  );\n  const signUpRequiredFields = normalizeFieldList(\n    manifest.auth?.signUp?.requiredFields,\n    DEFAULT_SIGN_UP_REQUIRED_FIELDS,\n  );\n  const signUpOptionalFields = normalizeFieldList(\n    manifest.auth?.signUp?.optionalFields,\n    DEFAULT_SIGN_UP_OPTIONAL_FIELDS,\n  ).filter((field) => !signUpRequiredFields.includes(field));\n  const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;\n  const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, [\n    'email',\n    'firstName',\n    'lastName',\n  ]);\n\n  return {\n    signInIdentifiersCsv: signInIdentifiers.join(','),\n    signUpRequiredFieldsCsv: signUpRequiredFields.join(','),\n    signUpOptionalFieldsCsv: signUpOptionalFields.join(','),\n    signUpPolicy,\n    profileFieldsCsv: profileFields.join(','),\n  };\n}\n\nfunction normalizeFieldList(\n  values: readonly string[] | undefined,\n  fallback: readonly string[],\n): string[] {\n  const source = values ?? fallback;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized || next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  if (next.length > 0) {\n    return next;\n  }\n\n  return [...fallback];\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gCAAgC,EAEhC,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AAEnB,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAErC,MAAM,IAAI,GAAG,kCAAkC,CAAC;IAChD,MAAM,YAAY,GAAG,eAAe,CAAC;IACrC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,MAAM,aAAa,GAAG,mCAAmC,CAAC;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,QAAQ,CAAC;IACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,MAAM,CAAC;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,eAAe,KAAK,iFAAiF,CACtG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,oBAAoB,CAAC;oBAC5B,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sCAAsC;gBACnD,OAAO,EAAE,0BAA0B,CAAC;oBAClC,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD,GAAG,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,GAAG,aAAa,oBAAoB;wBAC1C,OAAO,EAAE,gCAAgC,CAAC,YAAY,CAAC;qBACxD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,IAAI,EAAE,GAAG,QAAQ,6BAA6B;gBAC9C,OAAO,EAAE,6BAA6B,CAAC,YAAY,CAAC;aACrD;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,sCAAsC;SACtD;QACD,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,CAAC,2BAA2B,EAAE,gCAAgC,CAAC;QAC3E,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAO7B;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;iBAGP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;CAC7D,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAAC,IAOnC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;;iBAIP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;;;CAG7D,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,YAAkC;IACvE,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO;QACzC,CAAC,CAAC;;;;WAIK,YAAY,CAAC,KAAK,2BAA2B,YAAY,CAAC,KAAK;;;;;;;;;CASzE;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuDP,cAAc;;;;;;CAMf,CAAC;AACF,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9C,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC9D,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAS5C,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAClC,2BAA2B,CAC5B,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IACnF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;QACvE,OAAO;QACP,WAAW;QACX,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,YAAY;QACZ,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAqC,EACrC,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\nimport {\n  getSupabaseProfileReconciliation,\n  type ResolvedProfileModel,\n  resolveSupabaseProfileModel,\n} from './profile';\n\nexport function generateSupabaseAuthArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n\n  const root = 'infra/minikube/k8s/auth/supabase';\n  const resourceRoot = 'auth/supabase';\n  const docsRoot = 'infra/minikube/auth';\n  const generatedRoot = 'infra/minikube/supabase/generated';\n  const scope = manifest.auth?.scope ?? 'global';\n  const authzEngine = manifest.auth?.authorization?.engine ?? 'native';\n  const authzKind = manifest.auth?.authorization?.kind ?? 'RBAC';\n  const authFieldModel = resolveAuthFieldModel(manifest);\n  const profileModel = resolveSupabaseProfileModel(manifest);\n\n  const warnings: string[] = [];\n  if (scope !== 'global') {\n    warnings.push(\n      `Auth scope \"${scope}\" is not fully modeled yet for Supabase. Baseline resources assume global auth.`,\n    );\n  }\n\n  return {\n    files: [\n      {\n        path: `${root}/supabase-auth.configmap.yaml`,\n        content: getSupabaseConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      {\n        path: `${root}/app-runtime-auth.env.configmap.yaml`,\n        content: getRuntimeAuthEnvConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      ...(profileModel.enabled\n        ? [\n            {\n              path: `${generatedRoot}/auth_profiles.sql`,\n              content: getSupabaseProfileReconciliation(profileModel),\n            },\n          ]\n        : []),\n      {\n        path: `${docsRoot}/supabase-runtime-wiring.md`,\n        content: getSupabaseRuntimeWiringGuide(profileModel),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/supabase-auth.configmap.yaml`,\n      `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,\n    ],\n    providerLifecycle: [],\n    envEntries: ['EXPO_PUBLIC_SUPABASE_URL=', 'EXPO_PUBLIC_SUPABASE_ANON_KEY='],\n    warnings,\n  };\n}\n\nfunction getSupabaseConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-auth-config\n  namespace: ${namespace}\ndata:\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n`;\n}\n\nfunction getRuntimeAuthEnvConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-runtime-auth-env\n  namespace: ${namespace}\ndata:\n  AUTH_REQUIRED: \"true\"\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n  AUTH_TOKEN_HEADER: \"Authorization\"\n  AUTH_TOKEN_PREFIX: \"Bearer\"\n`;\n}\n\nfunction getSupabaseRuntimeWiringGuide(profileModel: ResolvedProfileModel) {\n  const profileSection = profileModel.enabled\n    ? `\n## App Profile Table\n\nIdentity remains provider-owned in \\`auth.users\\`. App-facing profile data is generated in\n\\`public.${profileModel.table}\\` and linked through \\`${profileModel.table}.id -> auth.users.id\\`.\n\nThe generated profile reconciliation:\n\n- creates the profile table\n- enables row-level security\n- allows signed-in users to read and update their own profile row\n- drops stale Ankhorage-managed profile columns that are no longer configured\n- creates a trigger for new auth users when \\`AUTH_PROFILE_CREATE_STRATEGY=trigger\\`\n`\n    : '';\n\n  return `# Supabase Runtime Wiring\n\nThis file documents the runtime conventions generated by the minikube Supabase adapter.\n\n## Generated Kubernetes Objects\n\n- \\`ConfigMap/supabase-auth-config\\`: high-level auth metadata.\n- \\`Secret/supabase-public-runtime\\`: browser-safe Supabase URL and anon key material, generated by \\`scripts/up.sh\\` after local Supabase secrets exist.\n- \\`ConfigMap/app-runtime-auth-env\\`: auth runtime feature flags and authz metadata.\n\n## App Runtime Convention\n\nYour app runtime deployment should import both:\n\n- \\`app-runtime-auth-env\\` (configMap)\n- \\`supabase-public-runtime\\` (secret)\n\nFor local Expo/Metro development, \\`scripts/up.sh\\` also writes the same browser-safe\n\\`EXPO_PUBLIC_SUPABASE_URL\\` and \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\` values to\n\\`\\${APP_SOURCE_DIR}/.env.local\\`, preserving unrelated entries. Restart Expo after\nInfra Up so those public values are embedded into the client bundle.\n\nExample deployment fragment:\n\n\\`\\`\\`yaml\nenvFrom:\n  - configMapRef:\n      name: app-runtime-auth-env\n  - secretRef:\n      name: supabase-public-runtime\n\\`\\`\\`\n\nThe generated base deployment at \\`k8s/app/deployment.yaml\\` already includes this wiring\nwith \\`optional: true\\` for auth sources.\n\n## Expected Environment Variables\n\n- \\`AUTH_REQUIRED\\`\n- \\`AUTH_PROVIDER\\`\n- \\`AUTH_SCOPE\\`\n- \\`AUTHZ_ENGINE\\`\n- \\`AUTHZ_KIND\\`\n- \\`AUTH_SIGN_IN_IDENTIFIERS\\`\n- \\`AUTH_SIGN_UP_REQUIRED_FIELDS\\`\n- \\`AUTH_SIGN_UP_OPTIONAL_FIELDS\\`\n- \\`AUTH_SIGN_UP_POLICY\\`\n- \\`AUTH_PROFILE_FIELDS\\`\n- \\`AUTH_PROFILE_TABLE\\`\n- \\`AUTH_PROFILE_PRIMARY_KEY\\`\n- \\`AUTH_PROFILE_CREATE_STRATEGY\\`\n- \\`AUTH_PROFILE_UPDATE_STRATEGY\\`\n- \\`SUPABASE_URL\\`\n- \\`SUPABASE_ANON_KEY\\`\n- \\`EXPO_PUBLIC_SUPABASE_URL\\`\n- \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\`\n${profileSection}\n## Runtime Secrets\n\nWhen Supabase is enabled, \\`scripts/up.sh\\` creates/updates \\`Secret/supabase-public-runtime\\`\nwith browser-safe values for the app namespace and mirrors the Expo public values into the\napp \\`.env.local\\`. Privileged Supabase runtime secrets remain in the \\`supabase\\` namespace.\n`;\n}\n\nconst DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];\nconst DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];\nconst DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];\nconst DEFAULT_SIGN_UP_POLICY = 'autoSignIn';\ninterface ResolvedAuthFieldModel {\n  signInIdentifiersCsv: string;\n  signUpRequiredFieldsCsv: string;\n  signUpOptionalFieldsCsv: string;\n  signUpPolicy: string;\n  profileFieldsCsv: string;\n}\n\nfunction resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {\n  const signInIdentifiers = normalizeFieldList(\n    manifest.auth?.signIn?.identifiers,\n    DEFAULT_SIGN_IN_IDENTIFIERS,\n  );\n  const signUpRequiredFields = normalizeFieldList(\n    manifest.auth?.signUp?.requiredFields,\n    DEFAULT_SIGN_UP_REQUIRED_FIELDS,\n  );\n  const signUpOptionalFields = normalizeFieldList(\n    manifest.auth?.signUp?.optionalFields,\n    DEFAULT_SIGN_UP_OPTIONAL_FIELDS,\n  ).filter((field) => !signUpRequiredFields.includes(field));\n  const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;\n  const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, [\n    'email',\n    'firstName',\n    'lastName',\n  ]);\n\n  return {\n    signInIdentifiersCsv: signInIdentifiers.join(','),\n    signUpRequiredFieldsCsv: signUpRequiredFields.join(','),\n    signUpOptionalFieldsCsv: signUpOptionalFields.join(','),\n    signUpPolicy,\n    profileFieldsCsv: profileFields.join(','),\n  };\n}\n\nfunction normalizeFieldList(\n  values: readonly string[] | undefined,\n  fallback: readonly string[],\n): string[] {\n  const source = values ?? fallback;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized || next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  if (next.length > 0) {\n    return next;\n  }\n\n  return [...fallback];\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}

package/dist/adapters/minikube/base/index.js

@@ -2099,6 +2099,43 @@ write_env_value() {
   mv "\${tmp_env}" "\${ROOT_DIR}/.env"
 }
 
+write_key_value_file_value() {
+  local file_path="\${1}"
+  local key="\${2}"
+  local value="\${3}"
+  local tmp_env
+  mkdir -p "$(dirname "\${file_path}")"
+  touch "\${file_path}"
+  tmp_env="$(mktemp)"
+  awk -F= -v key="\${key}" -v value="\${value}" '
+    $1 == key {
+      print key "=" value
+      found = 1
+      next
+    }
+    { print }
+    END {
+      if (!found) print key "=" value
+    }
+  ' "\${file_path}" > "\${tmp_env}"
+  mv "\${tmp_env}" "\${file_path}"
+}
+
+sync_app_public_supabase_env() {
+  if [[ "\${SUPABASE_RUNTIME_ENABLED}" != "true" ]]; then
+    return 0
+  fi
+
+  if [[ -z "\${APP_SOURCE_DIR:-}" ]]; then
+    echo "APP_SOURCE_DIR is required to write app Supabase public environment."
+    exit 1
+  fi
+
+  local app_env_file="\${APP_SOURCE_DIR}/.env.local"
+  write_key_value_file_value "\${app_env_file}" "EXPO_PUBLIC_SUPABASE_URL" "\${EXPO_PUBLIC_SUPABASE_URL}"
+  write_key_value_file_value "\${app_env_file}" "EXPO_PUBLIC_SUPABASE_ANON_KEY" "\${EXPO_PUBLIC_SUPABASE_ANON_KEY}"
+}
+
 set_required_env_default() {
   local key="\${1}"
   local value="\${2}"
@@ -2438,6 +2475,7 @@ trap cleanup_failed_up ERR
 require_command minikube
 require_command kubectl
 ensure_supabase_runtime_env
+sync_app_public_supabase_env
 
 HOST_STATUS="$(minikube -p "\${PROFILE}" status --format='{{.Host}}' 2>/dev/null || true)"
 if [[ "\${HOST_STATUS}" != "Running" ]]; then
@@ -2638,6 +2676,7 @@ function getAppImageDockerfile() {
 RUN cat <<'EOF' > /etc/nginx/conf.d/default.conf
 server {
   listen 8080;
+  absolute_redirect off;
   server_name _;
   root /usr/share/nginx/html;
   index index.html;

package/dist/adapters/minikube/base/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAGvE,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAkCtC,MAAM,eAAe,GAAsB;IACzC,QAAQ,EAAE,8BAA8B;IACxC,IAAI,EAAE,0BAA0B;IAChC,IAAI,EAAE,4BAA4B;IAClC,QAAQ,EAAE,4BAA4B;IACtC,OAAO,EAAE,8BAA8B;IACvC,QAAQ,EAAE,2BAA2B;IACrC,IAAI,EAAE,gCAAgC;IACtC,OAAO,EAAE,iBAAiB;IAC1B,MAAM,EAAE,wCAAwC;CACjD,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,UAAU,6BAA6B,CAAC,IAO7C;IACC,MAAM,EACJ,QAAQ,EACR,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAChB,GAAG,IAAI,CAAC;IAET,MAAM,IAAI,GAAG,gBAAgB,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC;IAC9B,MAAM,WAAW,GAAG,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,YAAY,GAAG,GAAG,IAAI,YAAY,CAAC;IACzC,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC;IACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,MAAM,CAAC;IACnE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,CAAC;IAC/D,MAAM,mBAAmB,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,IAAI,MAAM,CAAC;IACrE,MAAM,eAAe,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,QAAQ,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC;IACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;IACjD,MAAM,yBAAyB,GAC7B,YAAY,KAAK,UAAU;QAC3B,gBAAgB,KAAK,UAAU;QAC/B,eAAe,KAAK,IAAI;QACxB,mBAAmB,KAAK,gBAAgB,CAAC;IAE3C,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,kBAAkB,GAAG;QACzB,qBAAqB;QACrB,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,SAAS,OAAO,CAAC;KACzE,CAAC;IAEF,OAAO;QACL;YACE,IAAI,EAAE,GAAG,IAAI,YAAY;YACzB,OAAO,EAAE,iBAAiB,CAAC;gBACzB,OAAO;gBACP,eAAe;gBACf,iBAAiB;gBACjB,YAAY;gBACZ,WAAW;gBACX,cAAc;gBACd,iBAAiB;gBACjB,yBAAyB;gBACzB,YAAY;gBACZ,cAAc;gBACd,kBAAkB;gBAClB,iBAAiB;aAClB,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,IAAI,eAAe;YAC5B,OAAO,EAAE,aAAa,CAAC;gBACrB,OAAO;gBACP,MAAM;gBACN,eAAe;gBACf,eAAe;gBACf,iBAAiB;gBACjB,yBAAyB;gBACzB,cAAc;aACf,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,OAAO,sBAAsB;YACtC,OAAO,EAAE,oBAAoB,CAAC,aAAa,CAAC;SAC7C;QACD,GAAG,CAAC,yBAAyB;YAC3B,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,GAAG,OAAO,2BAA2B;oBAC3C,OAAO,EAAE,oBAAoB,CAAC,kBAAkB,CAAC;iBAClD;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,GAAG,OAAO,eAAe,SAAS,OAAO;YAC/C,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;QACH;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,eAAe,CAAC;gBACvB,OAAO;gBACP,SAAS;gBACT,YAAY;gBACZ,gBAAgB;gBAChB,mBAAmB;gBACnB,eAAe;gBACf,iBAAiB;gBACjB,MAAM;aACP,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,OAAO,sBAAsB;YACtC,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC;SACnD;QACD;YACE,IAAI,EAAE,GAAG,OAAO,mBAAmB;YACnC,OAAO,EAAE,qBAAqB,EAAE;SACjC;QACD,GAAG,iBAAiB;QACpB;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,wBAAwB,CAAC;gBAChC,kBAAkB;gBAClB,eAAe,EAAE,yBAAyB;gBAC1C,cAAc;aACf,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,WAAW,QAAQ;YAC5B,OAAO,EAAE,WAAW,CAAC;gBACnB,OAAO;gBACP,eAAe;gBACf,yBAAyB;gBACzB,YAAY;gBACZ,mBAAmB;gBACnB,iBAAiB;gBACjB,cAAc;gBACd,iBAAiB;aAClB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,qBAAqB;YACzC,OAAO,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YAC7D,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,kBAAkB;YACtC,OAAO,EAAE,oBAAoB,CAAC;gBAC5B,OAAO;gBACP,yBAAyB;gBACzB,iBAAiB;aAClB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,UAAU;YAC9B,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,WAAW;YAC/B,OAAO,EAAE,cAAc,CAAC;gBACtB,OAAO;gBACP,yBAAyB;gBACzB,kBAAkB;aACnB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,aAAa;YACjC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;YAClC,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,YAAY;YAChC,OAAO,EAAE,eAAe,CAAC;gBACvB,OAAO;gBACP,yBAAyB;gBACzB,YAAY;gBACZ,iBAAiB;gBACjB,kBAAkB;gBAClB,iBAAiB;aAClB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,YAAY,aAAa;YAClC,OAAO,EAAE,qBAAqB,EAAE;SACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAa1B;IACC,MAAM,EACJ,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,MAAM,aAAa,GAAG;QACpB,qBAAqB;QACrB,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,SAAS,OAAO,CAAC;QACxE,oBAAoB;QACpB,qBAAqB;QACrB,kBAAkB;QAClB,GAAG,CAAC,yBAAyB;YAC3B,CAAC,CAAC;gBACE,wBAAwB;gBACxB,uCAAuC;gBACvC,4BAA4B;gBAC5B,wBAAwB;gBACxB,oBAAoB;gBACpB,oBAAoB;gBACpB,wBAAwB;gBACxB,uBAAuB;gBACvB,wBAAwB;gBACxB,oBAAoB;gBACpB,+BAA+B;gBAC/B,6BAA6B;gBAC7B,uBAAuB;gBACvB,sBAAsB;aACvB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,cAAc;KAClB;SACE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,QAAQ,IAAI,CAAC;SAC1C,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,eAAe,GAAG;QACtB,aAAa;QACb,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,kBAAkB;KACtB,CAAC;IACF,MAAM,gBAAgB,GAAG,oCAAoC,eAAe;SACzE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,IAAI,CAAC;SACtC,IAAI,CACH,IAAI,CACL,wHAAwH,CAAC;IAC5H,MAAM,qBAAqB,GACzB,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,4BAA4B,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QACnE,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,sBAAsB,GAC1B,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,4CAA4C,iBAAiB;aAC1D,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChB,MAAM,SAAS,GACb,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,QAAQ,CAAC,eAAe;qBACrB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,QAAQ,qBAAqB,KAAK,CAAC,SAAS,IAAI,CAAC;qBAC3E,IAAI,CAAC,IAAI,CAAC;gBACf,CAAC,CAAC,MAAM,CAAC;YACb,MAAM,SAAS,GACb,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,CAAC,QAAQ,CAAC,SAAS;qBACf,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,IAAI,UAAU,QAAQ,CAAC,GAAG,IAAI,CAAC;qBAC/D,IAAI,CAAC,IAAI,CAAC;gBACf,CAAC,CAAC,MAAM,CAAC;YACb,OAAO,OAAO,QAAQ,CAAC,EAAE,mBAAmB,QAAQ,CAAC,SAAS,iBAAiB,SAAS,eAAe,SAAS,EAAE,CAAC;QACrH,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,IAAI;QACnB,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,gBAAgB,GACpB,cAAc,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,mPAAmP;QACrP,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;;;;;;mCAM0B,OAAO;6BACb,aAAa;0BAChB,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ;EACjF,qBAAqB,0BAA0B,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA4B5B,OAAO;0EAC+B,OAAO;gDACjC,OAAO,OAAO,gBAAgB;+CAC/B,OAAO;;;;EAIpD,aAAa;;;;;;;;;;;;EAYb,gBAAgB;;;;gBAIF,eAAe,CAAC,QAAQ;YAC5B,eAAe,CAAC,IAAI;iBACf,eAAe,CAAC,IAAI;gBACrB,eAAe,CAAC,QAAQ;eACzB,eAAe,CAAC,OAAO;eACvB,eAAe,CAAC,OAAO;cACxB,eAAe,CAAC,MAAM;;;;4BAIR,iBAAiB,CAAC,GAAG;yCACR,iBAAiB,CAAC,OAAO;+BACnC,iBAAiB,CAAC,MAAM;uCAChB,iBAAiB,CAAC,EAAE;;;;4BAI/B,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;qBAC3C,YAAY;4BACL,WAAW;EACrC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,iKAAiK,CAAC,CAAC,CAAC,EAAE;EAC7L,sBAAsB;CACvB,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAQtB;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAC5F,IAAI,CAAC;IAEP,MAAM,WAAW,GAAG;QAClB,4CAA4C;QAC5C,iBAAiB,OAAO,EAAE;QAC1B,wBAAwB;QACxB,wBAAwB;QACxB,iBAAiB;QACjB,qCAAqC;QACrC,aAAa,eAAe,EAAE;QAC9B,qCAAqC;QACrC,mCAAmC;QACnC,iCAAiC;QACjC,+BAA+B;QAC/B,+BAA+B,iBAAiB,CAAC,GAAG,EAAE;QACtD,iCAAiC;QACjC,uCAAuC,iBAAiB,CAAC,OAAO,EAAE;QAClE,2CAA2C;QAC3C,sCAAsC,iBAAiB,CAAC,MAAM,EAAE;QAChE,0CAA0C;QAC1C,kCAAkC,iBAAiB,CAAC,EAAE,EAAE;QACxD,sCAAsC;QACtC,gBAAgB;QAChB,gCAAgC;QAChC,EAAE;QACF,gDAAgD;QAChD,6BAA6B;QAC7B,sCAAsC;QACtC,iCAAiC;QACjC,iCAAiC;QACjC,8BAA8B;QAC9B,EAAE;QACF,kCAAkC;QAClC,cAAc,MAAM,EAAE;QACtB,EAAE;QACF,uCAAuC;QACvC,oBAAoB;QACpB,aAAa;QACb,oBAAoB;QACpB,4BAA4B;QAC5B,2BAA2B;QAC3B,sBAAsB;QACtB,6BAA6B;QAC7B,qBAAqB;QACrB,kBAAkB;QAClB,sBAAsB;QACtB,qBAAqB;QACrB,4BAA4B;QAC5B,gCAAgC;QAChC,iBAAiB;QACjB,WAAW;QACX,6BAA6B;QAC7B,2BAA2B;QAC3B,sBAAsB;QACtB,mBAAmB;QACnB,0BAA0B;QAC1B,+BAA+B;QAC/B,oCAAoC;QACpC,qBAAqB;QACrB,gBAAgB;QAChB,YAAY;QACZ,YAAY;QACZ,4BAA4B;QAC5B,gDAAgD;QAChD,wBAAwB;QACxB,mCAAmC;QACnC,uBAAuB;QACvB,wBAAwB;QACxB,aAAa;QACb,kBAAkB;QAClB,2BAA2B;QAC3B,gCAAgC;QAChC,GAAG,yBAAyB,CAAC,cAAc,CAAC;QAC5C,EAAE;QACF,iCAAiC;KAClC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAkD;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO;QACL,EAAE;QACF,8EAA8E;QAC9E,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,KAAK,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,cAAc,EAAE;YAC9C,mBAAmB,QAAQ,CAAC,SAAS,aAAa;YAClD,mBAAmB,QAAQ,CAAC,SAAS,UAAU;YAC/C,mBAAmB,QAAQ,CAAC,SAAS,gBAAgB;SACtD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAkD;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,SAAS;SACb,GAAG,CACF,CACE,QAAQ,EACR,EAAE,CAAC,4BAA4B,QAAQ,CAAC,SAAS,kCAAkC,QAAQ,CAAC,SAAS;2BAClF,QAAQ,CAAC,SAAS,+BAA+B,QAAQ,CAAC,SAAS;2BACnE,QAAQ,CAAC,SAAS,qCAAqC,QAAQ,CAAC,SAAS,gDAAgD,CAC/I;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CAAC,SAAkD;IACpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,SAAS;SACb,GAAG,CACF,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,QAAQ,CAAC,SAAS;kBACvC,QAAQ,CAAC,SAAS,iCAAiC,QAAQ,CAAC,SAAS;kBACrE,QAAQ,CAAC,SAAS,8BAA8B,QAAQ,CAAC,SAAS;kBAClE,QAAQ,CAAC,SAAS,oCAAoC,QAAQ,CAAC,SAAS,gBAAgB,CACrG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,+BAA+B,CACtC,SAAkD;IAElD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,SAAS;SACrB,GAAG,CACF,CACE,QAAQ,EACR,EAAE,CAAC,kCAAkC,QAAQ,CAAC,SAAS,4CAA4C,QAAQ,CAAC,SAAS;2BAClG,QAAQ,CAAC,EAAE,oDAAoD,QAAQ,CAAC,SAAS,kCAAkC,QAAQ,CAAC,SAAS,+BAA+B,QAAQ,CAAC,cAAc;;KAEjN,CACA;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;EAEP,MAAM,EAAE,CAAC;AACX,CAAC;AAED,SAAS,6BAA6B,CAAC,SAAkD;IACvF,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,IAAI,gBAAgB,CAAC;AACzD,CAAC;AAED,SAAS,6BAA6B,CAAC,IAItC;IACC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IAC9D,IAAI,mBAAmB,KAAK,gBAAgB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO;;;;CAIV,CAAC;IACA,CAAC;IAED,MAAM,KAAK,GAAG,cAAc;SACzB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,mBAAmB,QAAQ,CAAC,SAAS,YAAY,CAAC;QAChE,MAAM,SAAS,GAAG,mBAAmB,QAAQ,CAAC,SAAS,SAAS,CAAC;QAEjE,OAAO,kBAAkB,KAAK,kBAAkB,SAAS;;wDAEP,GAAG;4DACC,GAAG;;eAEhD,KAAK;;;eAGL,SAAS;;KAEnB,CAAC;IACF,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;iSAIwR,qBAAqB,CAClT,OAAO,CACR;;;;;;;;EAQD,KAAK;;CAEN,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,gCAAgC,CACvC,iBAAuD;IAEvD,OAAO,GAAG,mCAAmC,CAAC;QAC5C,YAAY,EAAE,yBAAyB;QACvC,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,CACJ;KACF,CAAC;;EAEF,mCAAmC,CAAC;QACpC,YAAY,EAAE,6BAA6B;QAC3C,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAChD,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,CACJ;KACF,CAAC;;EAEA,4BAA4B,CAAC,iBAAiB,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,mCAAmC,CAAC,IAI5C;IACC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,GAAG,IAAI,CAAC,YAAY;IAC3B,IAAI,CAAC,WAAW;EAClB,CAAC;IACD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ;SACvB,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,uBAAuB,CAC9D,OAAO,CAAC,UAAU,CACnB,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC;EAC/C,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAC1C;SACA,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,OAAO,GAAG,IAAI,CAAC,YAAY;EAC3B,IAAI;EACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,iBAAuD;IAEvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpD,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CACjF,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;;EAET,CAAC;IACD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM;SAChB,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,yCAAyC,uBAAuB,CAC9D,KAAK,CAAC,SAAS,CAChB,qBAAqB,uBAAuB,CAC3C,KAAK,CAAC,QAAQ,CACf,eAAe,KAAK,CAAC,cAAc,GAAG,CAC1C;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;EACP,IAAI;EACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,iBAAuD;IACtF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,iBAAiB;SACrB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS;aACrC,GAAG,CACF,CAAC,QAAQ,EAAE,EAAE,CACX,sBAAsB,uBAAuB,CAC3C,QAAQ,CAAC,EAAE,CACZ,aAAa,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,uBAAuB,CAC9E,QAAQ,CAAC,GAAG,CACb,GAAG,CACP;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe;aAC5C,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC,4CAA4C,uBAAuB,CAC5E,KAAK,CAAC,SAAS,CAChB,qBAAqB,uBAAuB,CAC3C,KAAK,CAAC,QAAQ,CACf;uBACY,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,uBAAuB,CAChF,KAAK,CAAC,KAAK,CACZ;;uBAEkB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,uBAAuB,CAChF,KAAK,CAAC,KAAK,CACZ;KACA,CACI;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,iBAAiB,GAAG,QAAQ,CAAC,YAAY;aAC5C,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC,4BAA4B,uBAAuB,CAC5D,QAAQ,CAAC,EAAE,CACZ,iBAAiB,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC;EAC9D,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CACpC;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,CAAC,aAAa,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,OAAO;;;UAGC,SAAS;;;mCAGgB,SAAS;CAC3C,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IASxB;IACC,MAAM,EACJ,OAAO,EACP,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,MAAM,GACP,GAAG,IAAI,CAAC;IAET,MAAM,YAAY,GAAG,eAAe;QAClC,CAAC,CAAC,wBAAwB,eAAe,CAAC,QAAQ;sBAChC,sBAAsB,CAAC,eAAe,CAAC,UAAU,CAAC;6BAC3C,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC;CACjF;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;eAIM,aAAa;;oBAER,OAAO;;oBAEP,aAAa;yBACR,kBAAkB;yBAClB,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;iBAC5C,SAAS;oBACN,YAAY;wBACR,gBAAgB;4BACZ,mBAAmB;EAC7C,YAAY,sBAAsB,sBAAsB,CAAC,MAAM,CAAC;CACjE,CAAC;AACF,CAAC;AAED,SAAS,8BAA8B,CACrC,QAA4B;IAE5B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IAChC,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,aAAa;SACd,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,uBAAuB,GAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU,CAAC;QAEvF,IAAI,CAAC,uBAAuB;YAAE,OAAO,IAAI,CAAC;QAE1C,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,aAAa;SACd,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,6BAA6B,CACpC,QAA4B;IAE5B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,aAAa,GAAG,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEvE,OAAO,KAAK,CAAC,SAAS;SACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC;SAChD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,kDAAkD,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,SAAS,GAAG,EAAE;aACjB,WAAW,EAAE;aACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;QACzF,CAAC;QAED,OAAO;YACL,EAAE;YACF,SAAS;YACT,cAAc;YACd,aAAa;SACd,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,2BAA2B,CAAC,QAA4B;IAC/D,MAAM,YAAY,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACxF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;IACrE,OAAO,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,UAA6B;IACrD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAIjC;IACC,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe;QAC5C,CAAC,CAAC;YACE,uCAAuC;YACvC,4BAA4B;YAC5B,wBAAwB;YACxB,oBAAoB;YACpB,oBAAoB;YACpB,wBAAwB;YACxB,wBAAwB;YACxB,uBAAuB;YACvB,oBAAoB;YACpB,uBAAuB;YACvB,sBAAsB;SACvB;QACH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,SAAS,GAAG;QAChB,GAAG,IAAI,CAAC,kBAAkB;QAC1B,oBAAoB;QACpB,qBAAqB;QACrB,kBAAkB;QAClB,GAAG,iBAAiB;QACpB,GAAG,IAAI,CAAC,cAAc;KACvB,CAAC;IACF,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhF,OAAO;;;EAGP,aAAa;CACd,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,eAAuB;IACvD,OAAO;;;;eAIM,aAAa;;;;;;;;;;;;;;;mBAeT,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BjC,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;;;;eAIM,aAAa;;;;;;;;;;;CAW3B,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,OAAO;QACL;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,wCAAwC;YACxD,OAAO,EAAE,gCAAgC,EAAE;SAC5C;QACD;YACE,IAAI,EAAE,GAAG,OAAO,6BAA6B;YAC7C,OAAO,EAAE,sBAAsB,CAAC,wBAAwB,EAAE,MAAM,CAAC;SAClE;QACD;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,2BAA2B,EAAE;SACvC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,2BAA2B,EAAE;SACvC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,wBAAwB;YACxC,OAAO,EAAE,0BAA0B,EAAE;SACtC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,2BAA2B,EAAE;SACvC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,gCAAgC;YAChD,OAAO,EAAE,0BAA0B,EAAE;SACtC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,8BAA8B;YAC9C,OAAO,EAAE,+BAA+B,EAAE;YAC1C,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,OAAO,wBAAwB;YACxC,OAAO,EAAE,0BAA0B,EAAE;SACtC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,uBAAuB;YACvC,OAAO,EAAE,yBAAyB,EAAE;SACrC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsER,CAAC;AACF,CAAC;AAED,SAAS,gCAAgC;IACvC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;CAShC,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAY;IACxD,OAAO;;;UAGC,IAAI;eACC,kBAAkB;;;;;;iBAMhB,IAAI;CACpB,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmE1C,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFAiC8C,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEtG,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,IAAI;;;;;;;+EAOwC,kBAAkB;;;;;;;;;;;;;;;;;;;;CAoBhG,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,QAAQ;;;;;;;;;iCASV,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0ClD,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO,GAAG,sBAAsB,CAAC,uBAAuB,EAAE,MAAM,CAAC;;;;;;eAMpD,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;wFAsB8C,kBAAkB;;oCAEtE,kBAAkB;;;;;;;;;;;;;;;;;;;;;wCAqBd,kBAAkB;;;;;;;;;;;;;CAazD,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,QAAQ;;;;;;;;CAQ1C,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,IAAI;;;;;;;;;iCASN,kBAAkB;;;;;;;;;;;;;;;;;CAiBlD,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA2Bc,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;uBAuBlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;uBAuBlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;2BAwBd,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;2BAwBlB,kBAAkB;;;;;;;;;;;;2BAYlB,kBAAkB;;;;;;;;;;;;2BAYlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;0BAwBnB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;uBAwBrB,kBAAkB;;;;;;;;;;;;;;yBAchB,kBAAkB;;;;;;;;;;CAU1C,CAAC;AACF,CAAC;AAED,SAAS,+BAA+B;IACtC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BR,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDzC,CAAC;AACF,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,MAAM;;;;;;;;;oCASL,kBAAkB;;uCAEf,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BxD,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,IASpB;IACC,MAAM,EACJ,OAAO,EACP,eAAe,EACf,yBAAyB,EACzB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,uBAAuB,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,cAAc,CAAC,CAAC;IACzE,MAAM,6BAA6B,GAAG,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;IAC1F,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;QACzD,OAAO;QACP,cAAc;QACd,mBAAmB;KACpB,CAAC,CAAC;IAEH,OAAO;;;;;;;;YAQG,OAAO;;;iBAGF,aAAa;sBACR,kBAAkB;4BACZ,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;4BAiB5C,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAmHzC,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0GAoD8D,iBAAiB,CAAC,OAAO;0FACzC,iBAAiB,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;gGAoBf,iBAAiB,CAAC,EAAE;;;;EAIlH,gBAAgB;;EAEhB,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BpB,uBAAuB;;;;;;;;8BAQK,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmJ9C,6BAA6B;;;4BAGH,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;6BAC3C,OAAO;;;;;2BAKT,eAAe;;;;;;;;;+DASqB,iBAAiB,CAAC,GAAG;+EACL,iBAAiB,CAAC,OAAO;qEACnC,iBAAiB,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCvF,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiGhB,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAkD;IAChF,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAE1C,OAAO;;;;;;YAMG,OAAO;;;;;;;;;6BASU,OAAO;;;;2BAIT,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDzC,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;;;;;;;;;;;;;;;;;;;;CAoBR,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,IAI7B;IACC,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEvE,OAAO;;;;;;YAMG,OAAO;6BACU,OAAO;4BACR,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;+DACT,iBAAiB,CAAC,GAAG;;+EAEL,iBAAiB,CAAC,OAAO;;6EAE3B,iBAAiB,CAAC,MAAM;;qEAEhC,iBAAiB,CAAC,EAAE;;;;;;;;;4BAS7D,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;cAqB1D,aAAa;;;cAGb,kBAAkB;;;cAGlB,kBAAkB;;;cAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA8JF,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiH/C,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO;;;;;YAKG,OAAO;6BACU,OAAO;;;;;;;;;;;;;;;;;;;;;;;;CAwBnC,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,IAIvB;IACC,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IACxE,MAAM,eAAe,GAAG;QACtB,aAAa;QACb,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,kBAAkB;KACtB,CAAC;IACF,MAAM,sBAAsB,GAAG,eAAe;SAC3C,GAAG,CACF,CACE,SAAS,EACT,EAAE,CAAC,oDAAoD,SAAS;mEACL,SAAS,QAAQ,CAC/E;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,UAAU,GAAG,yBAAyB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACzE,MAAM,oBAAoB,GAAG,6CAA6C,eAAe,CAAC,IAAI,CAC5F,IAAI,CACL,mHAAmH,CAAC;IACrH,MAAM,qBAAqB,GAAG,oBAAoB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAE/E,OAAO;;;;;;YAMG,OAAO;6BACU,OAAO;;;;;;;;;;;;;;;;uEAgBmC,UAAU;UACvE,oBAAoB;;;;;;;;;;EAU5B,sBAAsB;QAChB,qBAAqB;CAC5B,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO;;;;;YAKG,OAAO;6BACU,OAAO;;;;;;;;;;;;;;;;;CAiBnC,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IAOxB;IACC,MAAM,EACJ,OAAO,EACP,yBAAyB,EACzB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,MAAM,UAAU,GAAG;QACjB,aAAa;QACb,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,kBAAkB;KACtB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAExE,OAAO;;;;;YAKG,OAAO;6BACU,OAAO;4BACR,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;4BAC5C,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;+EACY,iBAAiB,CAAC,OAAO;;;;;;;;4BAQ5E,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDAgCtB,kBAAkB;;;;;;;;;;uCAU7B,kBAAkB;;;mBAGtC,UAAU;;;;;;;;;wCASW,aAAa;uCACd,aAAa;;;EAGlD,oBAAoB;;;;4CAIsB,kBAAkB;2CACnB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+D5D,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAC/B,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,gBAAgB,CAAC;IACvE,OAAO;QACL,GAAG,EAAE,IAAI;QACT,OAAO,EAAE,IAAI,GAAG,CAAC;QACjB,MAAM,EAAE,IAAI,GAAG,CAAC;QAChB,EAAE,EAAE,IAAI,GAAG,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACpE,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { GeneratedInfrastructureFile } from '../../../types';\nimport type { InfraManifestInput } from '../../../types';\nimport type { ResolvedProfileModel } from '../auth/supabase/profile';\nimport { resolveSupabaseProfileModel } from '../auth/supabase/profile';\nimport type { MinikubeProviderLifecycle } from '../contracts';\n\nexport const APP_NAMESPACE = 'app';\nconst SUPABASE_NAMESPACE = 'supabase';\n\ninterface SupabaseHostPorts {\n  app: number;\n  gateway: number;\n  studio: number;\n  db: number;\n}\n\ninterface AppInfraStorageMetadata {\n  provider: 'supabase';\n  bucketsCsv: string;\n  defaultBucket: string;\n}\n\ninterface SupabaseImagePins {\n  postgres: string;\n  auth: string;\n  rest: string;\n  realtime: string;\n  storage: string;\n  imgproxy: string;\n  meta: string;\n  gateway: string;\n  studio: string;\n}\n\ninterface SupabaseOAuthProviderRuntime {\n  id: string;\n  envPrefix: string;\n  credentialsRef: string;\n  callbackRoute: string;\n}\n\nconst SUPABASE_IMAGES: SupabaseImagePins = {\n  postgres: 'supabase/postgres:17.6.1.136',\n  auth: 'supabase/gotrue:v2.189.0',\n  rest: 'postgrest/postgrest:v14.12',\n  realtime: 'supabase/realtime:v2.102.3',\n  storage: 'supabase/storage-api:v1.60.4',\n  imgproxy: 'darthsim/imgproxy:v3.30.1',\n  meta: 'supabase/postgres-meta:v0.96.6',\n  gateway: 'kong/kong:3.9.1',\n  studio: 'supabase/studio:2026.07.07-sha-a6a04f2',\n};\n\nconst PORT_BASE = 18080;\nconst PORT_BUCKET_SIZE = 20;\nconst PORT_BUCKET_COUNT = 1000;\nconst PORT_REFERENCE_SLUG = 'my-app';\n\nexport function generateMinikubeBaseArtifacts(args: {\n  manifest: InfraManifestInput;\n  appSlug: string;\n  extraResources: string[];\n  providerNamespaces: string[];\n  providerLifecycle: MinikubeProviderLifecycle[];\n  extraEnvEntries: string[];\n}): GeneratedInfrastructureFile[] {\n  const {\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  } = args;\n\n  const root = 'infra/minikube';\n  const k8sRoot = `${root}/k8s`;\n  const scriptsRoot = `${root}/scripts`;\n  const appImageRoot = `${root}/app-image`;\n  const defaultAppImage = getDefaultAppImage(appSlug);\n  const supabaseHostPorts = resolveSupabaseHostPorts(appSlug);\n\n  const authScope = manifest.auth?.scope ?? 'none';\n  const authProvider = manifest.auth?.provider ?? 'none';\n  const authzEngine = manifest.auth?.authorization?.engine ?? 'none';\n  const databaseProvider = manifest.database?.provider ?? 'none';\n  const secretStoreProvider = manifest.secretStore?.provider ?? 'none';\n  const storageMetadata = resolveAppInfraStorageMetadata(manifest);\n  const profileModel = resolveSupabaseProfileModel(manifest);\n  const oauthProviders = resolveSupabaseOAuthProviders(manifest);\n  const monitoringEnabled = manifest.deployment?.monitoring === true;\n  const domain = manifest.networking?.domain ?? '';\n  const supabaseKubernetesEnabled =\n    authProvider === 'supabase' ||\n    databaseProvider === 'supabase' ||\n    storageMetadata !== null ||\n    secretStoreProvider === 'supabase-vault';\n\n  const supabaseResources = supabaseKubernetesEnabled ? getSupabaseResourceFiles(k8sRoot) : [];\n  const namespaceResources = [\n    'namespaces/app.yaml',\n    ...(supabaseKubernetesEnabled ? ['namespaces/supabase.yaml'] : []),\n    ...providerNamespaces.map((namespace) => `namespaces/${namespace}.yaml`),\n  ];\n\n  return [\n    {\n      path: `${root}/README.md`,\n      content: getReadmeMarkdown({\n        appSlug,\n        defaultAppImage,\n        monitoringEnabled,\n        authProvider,\n        authzEngine,\n        extraResources,\n        supabaseHostPorts,\n        supabaseKubernetesEnabled,\n        profileModel,\n        oauthProviders,\n        providerNamespaces,\n        providerLifecycle,\n      }),\n    },\n    {\n      path: `${root}/.env.example`,\n      content: getEnvExample({\n        appSlug,\n        domain,\n        extraEnvEntries,\n        defaultAppImage,\n        supabaseHostPorts,\n        supabaseKubernetesEnabled,\n        oauthProviders,\n      }),\n    },\n    {\n      path: `${k8sRoot}/namespaces/app.yaml`,\n      content: getNamespaceManifest(APP_NAMESPACE),\n    },\n    ...(supabaseKubernetesEnabled\n      ? [\n          {\n            path: `${k8sRoot}/namespaces/supabase.yaml`,\n            content: getNamespaceManifest(SUPABASE_NAMESPACE),\n          },\n        ]\n      : []),\n    ...providerNamespaces.map((namespace) => ({\n      path: `${k8sRoot}/namespaces/${namespace}.yaml`,\n      content: getNamespaceManifest(namespace),\n    })),\n    {\n      path: `${k8sRoot}/app.configmap.yaml`,\n      content: getAppConfigMap({\n        appSlug,\n        authScope,\n        authProvider,\n        databaseProvider,\n        secretStoreProvider,\n        storageMetadata,\n        monitoringEnabled,\n        domain,\n      }),\n    },\n    {\n      path: `${k8sRoot}/app/deployment.yaml`,\n      content: getAppDeploymentManifest(defaultAppImage),\n    },\n    {\n      path: `${k8sRoot}/app/service.yaml`,\n      content: getAppServiceManifest(),\n    },\n    ...supabaseResources,\n    {\n      path: `${k8sRoot}/kustomization.yaml`,\n      content: getKustomizationManifest({\n        namespaceResources,\n        supabaseEnabled: supabaseKubernetesEnabled,\n        extraResources,\n      }),\n    },\n    {\n      path: `${scriptsRoot}/up.sh`,\n      content: getUpScript({\n        appSlug,\n        defaultAppImage,\n        supabaseKubernetesEnabled,\n        profileModel,\n        secretStoreProvider,\n        supabaseHostPorts,\n        oauthProviders,\n        providerLifecycle,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/build-app-image.sh`,\n      content: getBuildAppImageScript({ appSlug, defaultAppImage }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/port-forward.sh`,\n      content: getPortForwardScript({\n        appSlug,\n        supabaseKubernetesEnabled,\n        supabaseHostPorts,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/down.sh`,\n      content: getDownScript(appSlug),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/reset.sh`,\n      content: getResetScript({\n        appSlug,\n        supabaseKubernetesEnabled,\n        providerNamespaces,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/destroy.sh`,\n      content: getDestroyScript(appSlug),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/status.sh`,\n      content: getStatusScript({\n        appSlug,\n        supabaseKubernetesEnabled,\n        profileModel,\n        supabaseHostPorts,\n        providerNamespaces,\n        providerLifecycle,\n      }),\n      executable: true,\n    },\n    {\n      path: `${appImageRoot}/Dockerfile`,\n      content: getAppImageDockerfile(),\n    },\n  ];\n}\n\nfunction getReadmeMarkdown(args: {\n  appSlug: string;\n  defaultAppImage: string;\n  monitoringEnabled: boolean;\n  authProvider: string;\n  authzEngine: string;\n  extraResources: string[];\n  supabaseHostPorts: SupabaseHostPorts;\n  supabaseKubernetesEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n  providerNamespaces: readonly string[];\n  providerLifecycle: readonly MinikubeProviderLifecycle[];\n}): string {\n  const {\n    appSlug,\n    defaultAppImage,\n    monitoringEnabled,\n    authProvider,\n    authzEngine,\n    extraResources,\n    supabaseHostPorts,\n    supabaseKubernetesEnabled,\n    profileModel,\n    oauthProviders,\n    providerNamespaces,\n    providerLifecycle,\n  } = args;\n  const resourceLines = [\n    'namespaces/app.yaml',\n    ...(supabaseKubernetesEnabled ? ['namespaces/supabase.yaml'] : []),\n    ...providerNamespaces.map((namespace) => `namespaces/${namespace}.yaml`),\n    'app.configmap.yaml',\n    'app/deployment.yaml',\n    'app/service.yaml',\n    ...(supabaseKubernetesEnabled\n      ? [\n          'supabase/bootstrap.sql',\n          'supabase/postgres.init.configmap.yaml',\n          'supabase/postgres.pvc.yaml',\n          'supabase/postgres.yaml',\n          'supabase/auth.yaml',\n          'supabase/rest.yaml',\n          'supabase/realtime.yaml',\n          'supabase/storage.yaml',\n          'supabase/imgproxy.yaml',\n          'supabase/meta.yaml',\n          'supabase/gateway.template.yml',\n          'supabase/kong-entrypoint.sh',\n          'supabase/gateway.yaml',\n          'supabase/studio.yaml',\n        ]\n      : []),\n    ...extraResources,\n  ]\n    .map((resource) => `- \\`k8s/${resource}\\``)\n    .join('\\n');\n\n  const resetNamespaces = [\n    APP_NAMESPACE,\n    ...(supabaseKubernetesEnabled ? [SUPABASE_NAMESPACE] : []),\n    ...providerNamespaces,\n  ];\n  const resetDescription = `deletes and recreates namespaces ${resetNamespaces\n    .map((namespace) => `\\`${namespace}\\``)\n    .join(\n      ', ',\n    )} inside the existing profile. This removes app-owned Kubernetes state and provider-owned PVC data for reset namespaces`;\n  const providerNamespaceLine =\n    providerNamespaces.length > 0\n      ? `- Provider namespaces: \\`${providerNamespaces.join('`, `')}\\`\\n`\n      : '';\n  const providerLifecycleLines =\n    providerLifecycle.length > 0\n      ? `\\n## Provider Lifecycle Contributions\\n\\n${providerLifecycle\n          .map((provider) => {\n            const readiness =\n              provider.readinessChecks.length > 0\n                ? provider.readinessChecks\n                    .map((check) => `\\`${check.resource}\\` in namespace \\`${check.namespace}\\``)\n                    .join(', ')\n                : 'none';\n            const endpoints =\n              provider.endpoints.length > 0\n                ? provider.endpoints\n                    .map((endpoint) => `\\`${endpoint.name}\\` = \\`${endpoint.url}\\``)\n                    .join(', ')\n                : 'none';\n            return `- \\`${provider.id}\\`: namespace \\`${provider.namespace}\\`; readiness ${readiness}; endpoints ${endpoints}`;\n          })\n          .join('\\n')}\\n`\n      : '';\n  const oauthDescription =\n    oauthProviders.length > 0\n      ? `\\nConfigured OAuth providers are wired into GoTrue through generated \\`GOTRUE_EXTERNAL_*\\` runtime keys. The keys are named in \\`.env.example\\`; values must come from trusted secret resolution for the configured \\`credentialsRef\\` entries.\\n`\n      : '';\n\n  return `# Minikube Infra\n\nThis directory is generated from \\`ankh.config.json\\` (infra manifest).\n\n## Ownership Model\n\n- App slug / Minikube profile: \\`${appSlug}\\`\n- App runtime namespace: \\`${APP_NAMESPACE}\\`\n- Supabase namespace: \\`${supabaseKubernetesEnabled ? SUPABASE_NAMESPACE : 'unused'}\\`\n${providerNamespaceLine}- Default app image: \\`${defaultAppImage}\\`\n\nOne app owns one complete Minikube profile. Provider-owned workloads are separated by\nKubernetes namespace inside that profile. There is no shared \\`minikube\\` profile and no\nhost-level Supabase Compose runtime.\n\n## Quick Start\n\n1. Copy env template:\n   \\`\\`\\`bash\n   cp .env.example .env\n   \\`\\`\\`\n2. Adjust optional values in \\`.env\\`; missing Supabase development secrets are generated by \\`up.sh\\`.\n3. Start infra:\n   \\`\\`\\`bash\n   ./scripts/up.sh\n   \\`\\`\\`\n4. Check status:\n   \\`\\`\\`bash\n   ./scripts/status.sh\n   \\`\\`\\`\n5. Stop the app-owned cluster without deleting data:\n   \\`\\`\\`bash\n   ./scripts/down.sh\n   \\`\\`\\`\n\n## Lifecycle Semantics\n\n- \\`up.sh\\`: starts \\`minikube -p ${appSlug}\\`, deploys provider namespaces, runs migrations with \\`supabase migration up --db-url \"$SUPABASE_DB_URL\"\\`, starts slug-owned port-forwards, and deploys the app runtime.\n- \\`down.sh\\`: stops slug-owned port-forwards, then stops \\`minikube -p ${appSlug}\\`. Persistent data remains in the profile.\n- \\`reset.sh\\`: requires \\`ANKH_RESET_CONFIRM=${appSlug}\\`; ${resetDescription}. It does not delete the Minikube profile.\n- \\`destroy.sh\\`: deletes only \\`minikube -p ${appSlug}\\`.\n\n## Generated Resources\n\n${resourceLines}\n\n## Supabase Runtime\n\nSupabase runtime ownership is Kubernetes. Migration authoring/history remains Supabase\nmigration files. Migration execution targets the Kubernetes Postgres endpoint through\n\\`supabase migration up --db-url \"$SUPABASE_DB_URL\"\\`.\n\nSupabase manifests are generated from the current official Supabase self-hosting Docker\ntopology, service documentation, environment-variable contracts, and pinned official images.\nKubernetes/Helm is treated as community-driven upstream guidance, not an official\ndistribution copied by this generator.\n${oauthDescription}\n\nPinned images:\n\n- Postgres: \\`${SUPABASE_IMAGES.postgres}\\`\n- Auth: \\`${SUPABASE_IMAGES.auth}\\`\n- PostgREST: \\`${SUPABASE_IMAGES.rest}\\`\n- Realtime: \\`${SUPABASE_IMAGES.realtime}\\`\n- Storage: \\`${SUPABASE_IMAGES.storage}\\`\n- Gateway: \\`${SUPABASE_IMAGES.gateway}\\`\n- Studio: \\`${SUPABASE_IMAGES.studio}\\`\n\n## Host URLs\n\n- App: \\`http://127.0.0.1:${supabaseHostPorts.app}\\`\n- Supabase gateway: \\`http://127.0.0.1:${supabaseHostPorts.gateway}\\`\n- Studio: \\`http://127.0.0.1:${supabaseHostPorts.studio}\\`\n- DB migration endpoint: \\`127.0.0.1:${supabaseHostPorts.db}\\`\n\n## Runtime Conventions\n\n- Monitoring requested: \\`${monitoringEnabled ? 'true' : 'false'}\\`\n- Auth provider: \\`${authProvider}\\`\n- Authorization engine: \\`${authzEngine}\\`\n${profileModel.enabled ? '- Generated profile reconciliation lives in `supabase/generated/auth_profiles.sql` and records checksum state in `ankhorage_internal.generated_schema_state`.\\n' : ''}\n${providerLifecycleLines}\n`;\n}\n\nfunction getEnvExample(args: {\n  appSlug: string;\n  domain: string;\n  extraEnvEntries: string[];\n  defaultAppImage: string;\n  supabaseHostPorts: SupabaseHostPorts;\n  supabaseKubernetesEnabled: boolean;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n}): string {\n  const { appSlug, domain, extraEnvEntries, defaultAppImage, supabaseHostPorts, oauthProviders } =\n    args;\n\n  const baseEntries = [\n    '# App-owned Minikube profile configuration',\n    `ANKH_APP_SLUG=${appSlug}`,\n    'MINIKUBE_DRIVER=docker',\n    'APP_BUILD_ENABLED=true',\n    'APP_SOURCE_DIR=',\n    'APP_WEB_EXPORT_DIR=.ankh/web-export',\n    `APP_IMAGE=${defaultAppImage}`,\n    'APP_IMAGE_SYNC_STRATEGY=docker-load',\n    'APP_IMAGE_CLEANUP_ON_DESTROY=true',\n    'APP_IMAGE_CLEANUP_MINIKUBE=true',\n    'APP_IMAGE_CLEANUP_DOCKER=true',\n    `APP_PORT_FORWARD_LOCAL_PORT=${supabaseHostPorts.app}`,\n    'APP_PORT_FORWARD_REMOTE_PORT=80',\n    `SUPABASE_GATEWAY_FORWARD_LOCAL_PORT=${supabaseHostPorts.gateway}`,\n    'SUPABASE_GATEWAY_FORWARD_REMOTE_PORT=8000',\n    `SUPABASE_STUDIO_FORWARD_LOCAL_PORT=${supabaseHostPorts.studio}`,\n    'SUPABASE_STUDIO_FORWARD_REMOTE_PORT=3000',\n    `SUPABASE_DB_FORWARD_LOCAL_PORT=${supabaseHostPorts.db}`,\n    'SUPABASE_DB_FORWARD_REMOTE_PORT=5432',\n    'APP_REPLICAS=1',\n    'APP_FORCE_ROLLOUT_RESTART=true',\n    '',\n    '# Optional private registry auth for APP_IMAGE',\n    'APP_IMAGE_PULL_SECRET_NAME=',\n    'APP_IMAGE_PULL_SECRET_SERVER=ghcr.io',\n    'APP_IMAGE_PULL_SECRET_USERNAME=',\n    'APP_IMAGE_PULL_SECRET_PASSWORD=',\n    'APP_IMAGE_PULL_SECRET_EMAIL=',\n    '',\n    '# Optional app networking domain',\n    `APP_DOMAIN=${domain}`,\n    '',\n    '# Supabase Kubernetes runtime secrets',\n    'POSTGRES_PASSWORD=',\n    'JWT_SECRET=',\n    'SUPABASE_ANON_KEY=',\n    'SUPABASE_SERVICE_ROLE_KEY=',\n    'SUPABASE_PUBLISHABLE_KEY=',\n    'SUPABASE_SECRET_KEY=',\n    'DASHBOARD_USERNAME=supabase',\n    'DASHBOARD_PASSWORD=',\n    'SECRET_KEY_BASE=',\n    'REALTIME_DB_ENC_KEY=',\n    'PG_META_CRYPTO_KEY=',\n    'S3_PROTOCOL_ACCESS_KEY_ID=',\n    'S3_PROTOCOL_ACCESS_KEY_SECRET=',\n    'JWT_EXPIRY=3600',\n    'SITE_URL=',\n    'OAUTH_NATIVE_REDIRECT_URLS=',\n    'ADDITIONAL_REDIRECT_URLS=',\n    'SUPABASE_PUBLIC_URL=',\n    'API_EXTERNAL_URL=',\n    'ENABLE_EMAIL_SIGNUP=true',\n    'ENABLE_EMAIL_AUTOCONFIRM=true',\n    'SMTP_ADMIN_EMAIL=admin@example.com',\n    'SMTP_HOST=localhost',\n    'SMTP_PORT=2500',\n    'SMTP_USER=',\n    'SMTP_PASS=',\n    'SMTP_SENDER_NAME=Ankhorage',\n    'PGRST_DB_SCHEMAS=public,storage,graphql_public',\n    'PGRST_DB_MAX_ROWS=1000',\n    'PGRST_DB_EXTRA_SEARCH_PATH=public',\n    'GLOBAL_S3_BUCKET=stub',\n    'STORAGE_TENANT_ID=stub',\n    'REGION=stub',\n    'SUPABASE_DB_URL=',\n    'EXPO_PUBLIC_SUPABASE_URL=',\n    'EXPO_PUBLIC_SUPABASE_ANON_KEY=',\n    ...getOAuthEnvExampleEntries(oauthProviders),\n    '',\n    '# Adapter-provided runtime keys',\n  ];\n\n  const merged = [...baseEntries, ...extraEnvEntries];\n  const unique: string[] = [];\n  for (const entry of merged) {\n    if (!unique.includes(entry)) unique.push(entry);\n  }\n\n  return `${unique.join('\\n')}\\n`;\n}\n\nfunction getOAuthEnvExampleEntries(providers: readonly SupabaseOAuthProviderRuntime[]): string[] {\n  if (providers.length === 0) return [];\n\n  return [\n    '',\n    '# OAuth provider runtime values resolved from trusted credentialsRef entries',\n    ...providers.flatMap((provider) => [\n      `# ${provider.id}: ${provider.credentialsRef}`,\n      `GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID=`,\n      `GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET=`,\n      `GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI=`,\n    ]),\n  ];\n}\n\nfunction getOAuthScriptEnvDefaults(providers: readonly SupabaseOAuthProviderRuntime[]): string {\n  if (providers.length === 0) return '';\n\n  return providers\n    .map(\n      (\n        provider,\n      ) => `  export GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID=\"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID:-}\"\n  export GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET=\"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET:-}\"\n  export GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI=\"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI:-\\${API_EXTERNAL_URL}/callback}\"`,\n    )\n    .join('\\n');\n}\n\nfunction getOAuthRuntimeSecretLines(providers: readonly SupabaseOAuthProviderRuntime[]): string {\n  if (providers.length === 0) return '';\n\n  return providers\n    .map(\n      (provider) => `GOTRUE_EXTERNAL_${provider.envPrefix}_ENABLED=true\nGOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID=\\${GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID}\nGOTRUE_EXTERNAL_${provider.envPrefix}_SECRET=\\${GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET}\nGOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI=\\${GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI}`,\n    )\n    .join('\\n');\n}\n\nfunction getOAuthRuntimeValidationScript(\n  providers: readonly SupabaseOAuthProviderRuntime[],\n): string {\n  if (providers.length === 0) return '';\n\n  const checks = providers\n    .map(\n      (\n        provider,\n      ) => `  if [[ -z \"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID:-}\" || -z \"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET:-}\" ]]; then\n    echo \"OAuth provider ${provider.id} requires trusted runtime values GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID and GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET from credentialsRef ${provider.credentialsRef}.\"\n    exit 1\n  fi`,\n    )\n    .join('\\n');\n\n  return `\n  # OAuth provider secrets must be resolved by trusted host code before Kubernetes sync.\n${checks}`;\n}\n\nfunction getSupabaseOAuthCallbackRoute(providers: readonly SupabaseOAuthProviderRuntime[]): string {\n  return providers[0]?.callbackRoute ?? '/auth/callback';\n}\n\nfunction getOAuthVaultResolutionScript(args: {\n  appSlug: string;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n  secretStoreProvider: string;\n}): string {\n  const { appSlug, oauthProviders, secretStoreProvider } = args;\n  if (secretStoreProvider !== 'supabase-vault' || oauthProviders.length === 0) {\n    return `\nresolve_oauth_credentials_from_vault() {\n  return 0\n}\n`;\n  }\n\n  const lines = oauthProviders\n    .map((provider) => {\n      const ref = escapeSingleQuotedSql(provider.credentialsRef);\n      const idKey = `GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID`;\n      const secretKey = `GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET`;\n\n      return `  if [[ -z \"\\${${idKey}:-}\" || -z \"\\${${secretKey}:-}\" ]]; then\n    local resolved_client_id resolved_client_secret\n    resolved_client_id=\"$(resolve_vault_secret_field '${ref}' 'clientId')\"\n    resolved_client_secret=\"$(resolve_vault_secret_field '${ref}' 'clientSecret')\"\n    if [[ -n \"\\${resolved_client_id}\" ]]; then\n      export ${idKey}=\"\\${resolved_client_id}\"\n    fi\n    if [[ -n \"\\${resolved_client_secret}\" ]]; then\n      export ${secretKey}=\"\\${resolved_client_secret}\"\n    fi\n  fi`;\n    })\n    .join('\\n');\n\n  return `\nresolve_vault_secret_field() {\n  local ref=\"\\${1}\"\n  local field=\"\\${2}\"\n  psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -Atq -c \"select coalesce(decrypted.decrypted_secret::jsonb ->> '\\${field}', '') from ankh_secret_store.secret_metadata metadata join vault.decrypted_secrets decrypted on decrypted.id = metadata.vault_secret_id where metadata.project_id = '${escapeSingleQuotedSql(\n    appSlug,\n  )}' and metadata.environment = 'local' and metadata.secret_ref = '\\${ref}' limit 1;\" 2>/dev/null || true\n}\n\nresolve_oauth_credentials_from_vault() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n${lines}\n}\n`;\n}\n\nfunction escapeSingleQuotedSql(value: string): string {\n  return value.replace(/'/gu, \"''\");\n}\n\nfunction escapeShellDoubleQuoted(value: string): string {\n  return value.replace(/[\"\\\\$`]/gu, (char) => `\\\\${char}`);\n}\n\nfunction getProviderLifecycleStageScripts(\n  providerLifecycle: readonly MinikubeProviderLifecycle[],\n): string {\n  return `${getProviderLifecycleCommandFunction({\n    functionName: 'run_provider_migrations',\n    emptyReturn: 'return 0',\n    commands: providerLifecycle.flatMap((provider) =>\n      provider.migrationCommands.map((command) => ({\n        providerId: provider.id,\n        label: command.label,\n        command: command.command,\n      })),\n    ),\n  })}\n\n${getProviderLifecycleCommandFunction({\n  functionName: 'run_provider_reconciliation',\n  emptyReturn: 'return 0',\n  commands: providerLifecycle.flatMap((provider) =>\n    provider.reconciliationCommands.map((command) => ({\n      providerId: provider.id,\n      label: command.label,\n      command: command.command,\n    })),\n  ),\n})}\n\n${getProviderReadinessFunction(providerLifecycle)}`;\n}\n\nfunction getProviderLifecycleCommandFunction(args: {\n  functionName: string;\n  emptyReturn: string;\n  commands: readonly { providerId: string; label: string; command: string }[];\n}): string {\n  if (args.commands.length === 0) {\n    return `${args.functionName}() {\n  ${args.emptyReturn}\n}`;\n  }\n\n  const body = args.commands\n    .map(\n      (command) => `  echo \"Running provider ${escapeShellDoubleQuoted(\n        command.providerId,\n      )} ${escapeShellDoubleQuoted(command.label)}.\"\n${indentShellBlock(command.command.trim(), 2)}`,\n    )\n    .join('\\n\\n');\n\n  return `${args.functionName}() {\n${body}\n}`;\n}\n\nfunction getProviderReadinessFunction(\n  providerLifecycle: readonly MinikubeProviderLifecycle[],\n): string {\n  const checks = providerLifecycle.flatMap((provider) =>\n    provider.readinessChecks.map((check) => ({ providerId: provider.id, ...check })),\n  );\n\n  if (checks.length === 0) {\n    return `wait_for_provider_readiness() {\n  return 0\n}`;\n  }\n\n  const body = checks\n    .map(\n      (check) =>\n        `  kubectl --context \"\\${PROFILE}\" -n \"${escapeShellDoubleQuoted(\n          check.namespace,\n        )}\" rollout status \"${escapeShellDoubleQuoted(\n          check.resource,\n        )}\" --timeout=${check.timeoutSeconds}s`,\n    )\n    .join('\\n');\n\n  return `wait_for_provider_readiness() {\n${body}\n}`;\n}\n\nfunction getProviderStatusScript(providerLifecycle: readonly MinikubeProviderLifecycle[]): string {\n  if (providerLifecycle.length === 0) {\n    return '';\n  }\n\n  return providerLifecycle\n    .map((provider) => {\n      const endpointLines = provider.endpoints\n        .map(\n          (endpoint) =>\n            `  echo \"- provider ${escapeShellDoubleQuoted(\n              provider.id,\n            )} endpoint/${escapeShellDoubleQuoted(endpoint.name)}: ${escapeShellDoubleQuoted(\n              endpoint.url,\n            )}\"`,\n        )\n        .join('\\n');\n      const readinessLines = provider.readinessChecks\n        .map(\n          (check) => `  if kubectl --context \"\\${PROFILE}\" -n \"${escapeShellDoubleQuoted(\n            check.namespace,\n          )}\" rollout status \"${escapeShellDoubleQuoted(\n            check.resource,\n          )}\" --timeout=5s >/dev/null 2>&1; then\n    echo \"- provider ${escapeShellDoubleQuoted(provider.id)}/${escapeShellDoubleQuoted(\n      check.label,\n    )}: ready\"\n  else\n    echo \"- provider ${escapeShellDoubleQuoted(provider.id)}/${escapeShellDoubleQuoted(\n      check.label,\n    )}: not ready\"\n  fi`,\n        )\n        .join('\\n');\n      const customStatusLines = provider.statusChecks\n        .map(\n          (check) => `  echo \"Running provider ${escapeShellDoubleQuoted(\n            provider.id,\n          )} status check ${escapeShellDoubleQuoted(check.label)}.\"\n${indentShellBlock(check.command.trim(), 2)}`,\n        )\n        .join('\\n');\n\n      return [endpointLines, readinessLines, customStatusLines].filter(Boolean).join('\\n');\n    })\n    .filter(Boolean)\n    .join('\\n');\n}\n\nfunction indentShellBlock(value: string, spaces: number): string {\n  const indent = ' '.repeat(spaces);\n  return value\n    .split('\\n')\n    .map((line) => `${indent}${line}`)\n    .join('\\n');\n}\n\nfunction getNamespaceManifest(namespace: string): string {\n  return `apiVersion: v1\nkind: Namespace\nmetadata:\n  name: ${namespace}\n  labels:\n    app.kubernetes.io/part-of: ankhorage\n    ankhorage.io/namespace-role: ${namespace}\n`;\n}\n\nfunction getAppConfigMap(args: {\n  appSlug: string;\n  authScope: string;\n  authProvider: string;\n  databaseProvider: string;\n  secretStoreProvider: string;\n  storageMetadata: AppInfraStorageMetadata | null;\n  monitoringEnabled: boolean;\n  domain: string;\n}): string {\n  const {\n    appSlug,\n    authScope,\n    authProvider,\n    databaseProvider,\n    secretStoreProvider,\n    storageMetadata,\n    monitoringEnabled,\n    domain,\n  } = args;\n\n  const storageLines = storageMetadata\n    ? `  STORAGE_PROVIDER: \"${storageMetadata.provider}\"\n  STORAGE_BUCKETS: \"${escapeYamlDoubleQuoted(storageMetadata.bucketsCsv)}\"\n  STORAGE_DEFAULT_BUCKET: \"${escapeYamlDoubleQuoted(storageMetadata.defaultBucket)}\"\n`\n    : '';\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-infra-config\n  namespace: ${APP_NAMESPACE}\ndata:\n  ANKH_APP_SLUG: \"${appSlug}\"\n  DEPLOYMENT_TARGET: \"minikube\"\n  APP_NAMESPACE: \"${APP_NAMESPACE}\"\n  SUPABASE_NAMESPACE: \"${SUPABASE_NAMESPACE}\"\n  MONITORING_ENABLED: \"${monitoringEnabled ? 'true' : 'false'}\"\n  AUTH_SCOPE: \"${authScope}\"\n  AUTH_PROVIDER: \"${authProvider}\"\n  DATABASE_PROVIDER: \"${databaseProvider}\"\n  SECRET_STORE_PROVIDER: \"${secretStoreProvider}\"\n${storageLines}  NETWORK_DOMAIN: \"${escapeYamlDoubleQuoted(domain)}\"\n`;\n}\n\nfunction resolveAppInfraStorageMetadata(\n  manifest: InfraManifestInput,\n): AppInfraStorageMetadata | null {\n  const spec = manifest.storage;\n  if (!spec) return null;\n\n  const buckets = normalizeBuckets(spec.buckets);\n  if (buckets.length === 0) return null;\n  const [defaultBucket] = buckets;\n  if (!defaultBucket) return null;\n\n  if (spec.provider === 'supabase') {\n    return {\n      provider: 'supabase',\n      bucketsCsv: buckets.join(','),\n      defaultBucket,\n    };\n  }\n\n  if (spec.provider === 'auto') {\n    const shouldResolveToSupabase =\n      manifest.database?.provider === 'supabase' || manifest.auth?.provider === 'supabase';\n\n    if (!shouldResolveToSupabase) return null;\n\n    return {\n      provider: 'supabase',\n      bucketsCsv: buckets.join(','),\n      defaultBucket,\n    };\n  }\n\n  return null;\n}\n\nfunction resolveSupabaseOAuthProviders(\n  manifest: InfraManifestInput,\n): readonly SupabaseOAuthProviderRuntime[] {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return [];\n  const callbackRoute = normalizeOAuthCallbackRoute(oauth.callbackRoute);\n\n  return oauth.providers\n    .filter((provider) => provider.enabled !== false)\n    .map((provider) => {\n      const id = provider.id.trim();\n      const credentialsRef = provider.credentialsRef?.trim();\n      if (!credentialsRef) {\n        throw new Error(`OAuth provider \"${id}\" is enabled but does not define credentialsRef.`);\n      }\n\n      const envPrefix = id\n        .toUpperCase()\n        .replace(/[^A-Z0-9]+/gu, '_')\n        .replace(/^_+|_+$/gu, '');\n      if (!envPrefix) {\n        throw new Error(`OAuth provider \"${id}\" cannot be mapped to GoTrue environment keys.`);\n      }\n\n      return {\n        id,\n        envPrefix,\n        credentialsRef,\n        callbackRoute,\n      };\n    });\n}\n\nfunction normalizeOAuthCallbackRoute(rawRoute: string | undefined): string {\n  const trimmedRoute = rawRoute?.trim();\n  const route = trimmedRoute && trimmedRoute.length > 0 ? trimmedRoute : '/auth/callback';\n  const withLeadingSlash = route.startsWith('/') ? route : `/${route}`;\n  return withLeadingSlash.replace(/\\/+/gu, '/');\n}\n\nfunction normalizeBuckets(rawBuckets: readonly string[]): string[] {\n  const normalized: string[] = [];\n  const seen = new Set<string>();\n\n  for (const raw of rawBuckets) {\n    const bucket = raw.trim();\n    if (!bucket) continue;\n    if (seen.has(bucket)) continue;\n    seen.add(bucket);\n    normalized.push(bucket);\n  }\n\n  return normalized;\n}\n\nfunction getKustomizationManifest(args: {\n  namespaceResources: string[];\n  supabaseEnabled: boolean;\n  extraResources: string[];\n}): string {\n  const supabaseResources = args.supabaseEnabled\n    ? [\n        'supabase/postgres.init.configmap.yaml',\n        'supabase/postgres.pvc.yaml',\n        'supabase/postgres.yaml',\n        'supabase/auth.yaml',\n        'supabase/rest.yaml',\n        'supabase/realtime.yaml',\n        'supabase/imgproxy.yaml',\n        'supabase/storage.yaml',\n        'supabase/meta.yaml',\n        'supabase/gateway.yaml',\n        'supabase/studio.yaml',\n      ]\n    : [];\n  const resources = [\n    ...args.namespaceResources,\n    'app.configmap.yaml',\n    'app/deployment.yaml',\n    'app/service.yaml',\n    ...supabaseResources,\n    ...args.extraResources,\n  ];\n  const resourceLines = resources.map((resource) => `  - ${resource}`).join('\\n');\n\n  return `apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n${resourceLines}\n`;\n}\n\nfunction getAppDeploymentManifest(defaultAppImage: string): string {\n  return `apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: app-runtime\n  namespace: ${APP_NAMESPACE}\n  labels:\n    app.kubernetes.io/name: app-runtime\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: app-runtime\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: app-runtime\n    spec:\n      containers:\n        - name: app\n          image: ${defaultAppImage}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 8080\n              name: http\n          envFrom:\n            - configMapRef:\n                name: app-infra-config\n            - configMapRef:\n                name: app-runtime-auth-env\n                optional: true\n            - configMapRef:\n                name: app-runtime-storage-env\n                optional: true\n            - secretRef:\n                name: supabase-public-runtime\n                optional: true\n          readinessProbe:\n            httpGet:\n              path: /\n              port: http\n            initialDelaySeconds: 5\n            periodSeconds: 10\n          livenessProbe:\n            httpGet:\n              path: /\n              port: http\n            initialDelaySeconds: 15\n            periodSeconds: 20\n`;\n}\n\nfunction getAppServiceManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: app-runtime\n  namespace: ${APP_NAMESPACE}\n  labels:\n    app.kubernetes.io/name: app-runtime\nspec:\n  type: ClusterIP\n  selector:\n    app.kubernetes.io/name: app-runtime\n  ports:\n    - name: http\n      port: 80\n      targetPort: http\n`;\n}\n\nfunction getSupabaseResourceFiles(k8sRoot: string): GeneratedInfrastructureFile[] {\n  return [\n    {\n      path: `${k8sRoot}/supabase/bootstrap.sql`,\n      content: getSupabaseBootstrapSql(),\n    },\n    {\n      path: `${k8sRoot}/supabase/postgres.init.configmap.yaml`,\n      content: getSupabasePostgresInitConfigMap(),\n    },\n    {\n      path: `${k8sRoot}/supabase/postgres.pvc.yaml`,\n      content: getSupabasePvcManifest('supabase-postgres-data', '20Gi'),\n    },\n    {\n      path: `${k8sRoot}/supabase/postgres.yaml`,\n      content: getSupabasePostgresManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/auth.yaml`,\n      content: getSupabaseAuthManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/rest.yaml`,\n      content: getSupabaseRestManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/realtime.yaml`,\n      content: getSupabaseRealtimeManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/storage.yaml`,\n      content: getSupabaseStorageManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/imgproxy.yaml`,\n      content: getSupabaseImgproxyManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/meta.yaml`,\n      content: getSupabaseMetaManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/gateway.template.yml`,\n      content: getSupabaseGatewayTemplate(),\n    },\n    {\n      path: `${k8sRoot}/supabase/kong-entrypoint.sh`,\n      content: getSupabaseKongEntrypointScript(),\n      executable: true,\n    },\n    {\n      path: `${k8sRoot}/supabase/gateway.yaml`,\n      content: getSupabaseGatewayManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/studio.yaml`,\n      content: getSupabaseStudioManifest(),\n    },\n  ];\n}\n\nfunction getSupabaseBootstrapSql(): string {\n  return `-- Generated from the official Supabase self-hosting Docker database bootstrap contract.\n-- Applied by scripts/up.sh after Postgres is ready and before Supabase services start.\n\\\\set pgpass \\`echo \"$POSTGRES_PASSWORD\"\\`\n\\\\set jwt_secret \\`echo \"$JWT_SECRET\"\\`\n\\\\set jwt_exp \\`echo \"$JWT_EXP\"\\`\n\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'anon') THEN\n    CREATE ROLE anon NOLOGIN NOINHERIT;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticated') THEN\n    CREATE ROLE authenticated NOLOGIN NOINHERIT;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'service_role') THEN\n    CREATE ROLE service_role NOLOGIN NOINHERIT BYPASSRLS;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticator') THEN\n    CREATE ROLE authenticator NOINHERIT LOGIN;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_admin') THEN\n    CREATE ROLE supabase_admin LOGIN CREATEROLE CREATEDB REPLICATION BYPASSRLS;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_auth_admin') THEN\n    CREATE ROLE supabase_auth_admin LOGIN CREATEROLE;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_storage_admin') THEN\n    CREATE ROLE supabase_storage_admin LOGIN CREATEROLE;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_functions_admin') THEN\n    CREATE ROLE supabase_functions_admin LOGIN CREATEROLE;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'pgbouncer') THEN\n    CREATE ROLE pgbouncer LOGIN;\n  END IF;\nEND\n$$;\n\nALTER ROLE authenticator WITH PASSWORD :'pgpass';\nALTER ROLE pgbouncer WITH PASSWORD :'pgpass';\nALTER ROLE supabase_auth_admin WITH PASSWORD :'pgpass';\nALTER ROLE supabase_functions_admin WITH PASSWORD :'pgpass';\nALTER ROLE supabase_storage_admin WITH PASSWORD :'pgpass';\nALTER ROLE supabase_admin WITH PASSWORD :'pgpass';\n\nGRANT anon, authenticated, service_role TO authenticator;\nGRANT anon, authenticated, service_role TO supabase_storage_admin;\nGRANT postgres TO supabase_auth_admin;\nGRANT postgres TO supabase_storage_admin;\nGRANT postgres TO supabase_functions_admin;\nGRANT pg_monitor TO supabase_admin;\n\nCREATE SCHEMA IF NOT EXISTS auth AUTHORIZATION supabase_auth_admin;\nCREATE SCHEMA IF NOT EXISTS storage AUTHORIZATION supabase_storage_admin;\nCREATE SCHEMA IF NOT EXISTS graphql_public;\nCREATE SCHEMA IF NOT EXISTS _realtime AUTHORIZATION supabase_admin;\n\nGRANT USAGE ON SCHEMA public, graphql_public TO anon, authenticated, service_role;\nGRANT USAGE ON SCHEMA auth TO supabase_auth_admin;\nGRANT USAGE ON SCHEMA storage TO supabase_storage_admin, anon, authenticated, service_role;\nGRANT USAGE ON SCHEMA _realtime TO supabase_admin;\n\nALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO anon, authenticated, service_role;\nALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO anon, authenticated, service_role;\n\nALTER DATABASE postgres SET \"app.settings.jwt_secret\" TO :'jwt_secret';\nALTER DATABASE postgres SET \"app.settings.jwt_exp\" TO :'jwt_exp';\n\nSELECT 'CREATE DATABASE _supabase WITH OWNER supabase_admin'\nWHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '_supabase')\\\\gexec\n`;\n}\n\nfunction getSupabasePostgresInitConfigMap(): string {\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-postgres-init\n  namespace: ${SUPABASE_NAMESPACE}\ndata:\n  99-ankhorage-local-dev-extensions.sql: |\n    -- Local Minikube bootstrap for extension setup performed before runtime migrations.\n    alter role postgres with superuser;\n    grant pg_read_server_files to postgres;\n    grant pg_read_server_files to supabase_admin;\n    grant execute on function pg_read_file(text) to public;\n    grant execute on function pg_read_file(text, bigint, bigint) to public;\n`;\n}\n\nfunction getSupabasePvcManifest(name: string, size: string): string {\n  return `apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n  name: ${name}\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  accessModes:\n    - ReadWriteOnce\n  resources:\n    requests:\n      storage: ${size}\n`;\n}\n\nfunction getSupabasePostgresManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: postgres\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-postgres\n  ports:\n    - name: postgres\n      port: 5432\n      targetPort: postgres\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: postgres\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-postgres\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-postgres\n    spec:\n      containers:\n        - name: postgres\n          image: ${SUPABASE_IMAGES.postgres}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 5432\n              name: postgres\n          env:\n            - name: POSTGRES_USER\n              value: postgres\n            - name: POSTGRES_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: PGPASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: POSTGRES_DB\n              value: postgres\n            - name: PGDATABASE\n              value: postgres\n            - name: PGPORT\n              value: \"5432\"\n            - name: POSTGRES_PORT\n              value: \"5432\"\n            - name: POSTGRES_HOST\n              value: /var/run/postgresql\n            - name: JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: JWT_EXP\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: JWT_EXPIRY\n          volumeMounts:\n            - name: data\n              mountPath: /var/lib/postgresql/data\n            - name: init-scripts\n              mountPath: /docker-entrypoint-initdb.d/99-ankhorage-local-dev-extensions.sql\n              subPath: 99-ankhorage-local-dev-extensions.sql\n          readinessProbe:\n            exec:\n              command: [\"pg_isready\", \"-U\", \"postgres\"]\n            initialDelaySeconds: 15\n            periodSeconds: 5\n          livenessProbe:\n            exec:\n              command: [\"pg_isready\", \"-U\", \"postgres\"]\n            initialDelaySeconds: 30\n            periodSeconds: 10\n          args:\n            - postgres\n            - -c\n            - config_file=/etc/postgresql/postgresql.conf\n            - -c\n            - log_min_messages=fatal\n      volumes:\n        - name: data\n          persistentVolumeClaim:\n            claimName: supabase-postgres-data\n        - name: init-scripts\n          configMap:\n            name: supabase-postgres-init\n`;\n}\n\nfunction getSupabaseAuthManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: auth\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-auth\n  ports:\n    - name: http\n      port: 9999\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: auth\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-auth\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-auth\n    spec:\n      containers:\n        - name: auth\n          image: ${SUPABASE_IMAGES.auth}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 9999\n              name: http\n          env:\n            - name: GOTRUE_API_HOST\n              value: \"0.0.0.0\"\n            - name: GOTRUE_API_PORT\n              value: \"9999\"\n            - name: API_EXTERNAL_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: API_EXTERNAL_URL\n            - name: GOTRUE_SITE_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SITE_URL\n            - name: GOTRUE_URI_ALLOW_LIST\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: ADDITIONAL_REDIRECT_URLS\n            - name: GOTRUE_JWT_ISSUER\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: API_EXTERNAL_URL\n            - name: GOTRUE_DB_DRIVER\n              value: postgres\n            - name: GOTRUE_DB_DATABASE_URL\n              value: \"postgres://supabase_auth_admin:$(POSTGRES_PASSWORD)@postgres.${SUPABASE_NAMESPACE}.svc.cluster.local:5432/postgres?search_path=auth&sslmode=disable\"\n            - name: GOTRUE_JWT_AUD\n              value: authenticated\n            - name: GOTRUE_JWT_DEFAULT_GROUP_NAME\n              value: authenticated\n            - name: GOTRUE_JWT_ADMIN_ROLES\n              value: service_role\n            - name: GOTRUE_JWT_EXP\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: JWT_EXPIRY\n            - name: GOTRUE_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: GOTRUE_EXTERNAL_EMAIL_ENABLED\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: ENABLE_EMAIL_SIGNUP\n            - name: GOTRUE_MAILER_AUTOCONFIRM\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: ENABLE_EMAIL_AUTOCONFIRM\n            - name: GOTRUE_SMTP_ADMIN_EMAIL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_ADMIN_EMAIL\n            - name: GOTRUE_SMTP_HOST\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_HOST\n            - name: GOTRUE_SMTP_PORT\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_PORT\n            - name: GOTRUE_SMTP_USER\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SMTP_USER\n            - name: GOTRUE_SMTP_PASS\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SMTP_PASS\n            - name: GOTRUE_SMTP_SENDER_NAME\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_SENDER_NAME\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n          readinessProbe:\n            httpGet:\n              path: /health\n              port: http\n            initialDelaySeconds: 10\n            periodSeconds: 10\n`;\n}\n\nfunction getSupabaseRestManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: rest\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-rest\n  ports:\n    - name: http\n      port: 3000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: rest\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-rest\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-rest\n    spec:\n      containers:\n        - name: rest\n          image: ${SUPABASE_IMAGES.rest}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 3000\n              name: http\n          env:\n            - name: PGRST_DB_URI\n              value: \"postgres://authenticator:$(POSTGRES_PASSWORD)@postgres.${SUPABASE_NAMESPACE}.svc.cluster.local:5432/postgres\"\n            - name: PGRST_DB_SCHEMAS\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: PGRST_DB_SCHEMAS\n            - name: PGRST_DB_ANON_ROLE\n              value: anon\n            - name: PGRST_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: PGRST_DB_USE_LEGACY_GUCS\n              value: \"false\"\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n`;\n}\n\nfunction getSupabaseRealtimeManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: realtime\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-realtime\n  ports:\n    - name: http\n      port: 4000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: realtime\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-realtime\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-realtime\n    spec:\n      containers:\n        - name: realtime\n          image: ${SUPABASE_IMAGES.realtime}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 4000\n              name: http\n          env:\n            - name: PORT\n              value: \"4000\"\n            - name: DB_HOST\n              value: \"postgres.${SUPABASE_NAMESPACE}.svc.cluster.local\"\n            - name: DB_PORT\n              value: \"5432\"\n            - name: DB_NAME\n              value: postgres\n            - name: DB_USER\n              value: supabase_admin\n            - name: DB_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: API_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: SECRET_KEY_BASE\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SECRET_KEY_BASE\n            - name: DB_AFTER_CONNECT_QUERY\n              value: \"SET search_path TO _realtime\"\n            - name: DB_ENC_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: REALTIME_DB_ENC_KEY\n            - name: METRICS_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: APP_NAME\n              value: realtime\n            - name: SEED_SELF_HOST\n              value: \"true\"\n            - name: RUN_JANITOR\n              value: \"true\"\n            - name: DISABLE_HEALTHCHECK_LOGGING\n              value: \"true\"\n`;\n}\n\nfunction getSupabaseStorageManifest(): string {\n  return `${getSupabasePvcManifest('supabase-storage-data', '10Gi')}\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: storage\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-storage\n  ports:\n    - name: http\n      port: 5000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: storage\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-storage\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-storage\n    spec:\n      containers:\n        - name: storage\n          image: ${SUPABASE_IMAGES.storage}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 5000\n              name: http\n          env:\n            - name: ANON_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_ANON_KEY\n            - name: SERVICE_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_SERVICE_ROLE_KEY\n            - name: AUTH_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: DATABASE_URL\n              value: \"postgres://supabase_storage_admin:$(POSTGRES_PASSWORD)@postgres.${SUPABASE_NAMESPACE}.svc.cluster.local:5432/postgres?search_path=storage&sslmode=disable\"\n            - name: POSTGREST_URL\n              value: \"http://rest.${SUPABASE_NAMESPACE}.svc.cluster.local:3000\"\n            - name: STORAGE_BACKEND\n              value: file\n            - name: STORAGE_PUBLIC_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SUPABASE_PUBLIC_URL\n            - name: REQUEST_ALLOW_X_FORWARDED_PATH\n              value: \"true\"\n            - name: FILE_SIZE_LIMIT\n              value: \"52428800\"\n            - name: FILE_STORAGE_BACKEND_PATH\n              value: /var/lib/storage\n            - name: TENANT_ID\n              value: stub\n            - name: REGION\n              value: local\n            - name: GLOBAL_S3_BUCKET\n              value: local\n            - name: IMGPROXY_URL\n              value: \"http://imgproxy.${SUPABASE_NAMESPACE}.svc.cluster.local:5001\"\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n          volumeMounts:\n            - name: storage\n              mountPath: /var/lib/storage\n      volumes:\n        - name: storage\n          persistentVolumeClaim:\n            claimName: supabase-storage-data\n`;\n}\n\nfunction getSupabaseImgproxyManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: imgproxy\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-imgproxy\n  ports:\n    - name: http\n      port: 5001\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: imgproxy\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-imgproxy\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-imgproxy\n    spec:\n      containers:\n        - name: imgproxy\n          image: ${SUPABASE_IMAGES.imgproxy}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 5001\n              name: http\n          env:\n            - name: IMGPROXY_BIND\n              value: \":5001\"\n`;\n}\n\nfunction getSupabaseMetaManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: meta\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-meta\n  ports:\n    - name: http\n      port: 8080\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: meta\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-meta\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-meta\n    spec:\n      containers:\n        - name: meta\n          image: ${SUPABASE_IMAGES.meta}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 8080\n              name: http\n          env:\n            - name: PG_META_PORT\n              value: \"8080\"\n            - name: PG_META_DB_HOST\n              value: \"postgres.${SUPABASE_NAMESPACE}.svc.cluster.local\"\n            - name: PG_META_DB_PORT\n              value: \"5432\"\n            - name: PG_META_DB_NAME\n              value: postgres\n            - name: PG_META_DB_USER\n              value: postgres\n            - name: PG_META_DB_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: CRYPTO_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: PG_META_CRYPTO_KEY\n`;\n}\n\nfunction getSupabaseGatewayTemplate(): string {\n  return `_format_version: '2.1'\n_transform: true\n\nconsumers:\n  - username: DASHBOARD\n  - username: anon\n    keyauth_credentials:\n      - key: $SUPABASE_ANON_KEY\n      - key: $SUPABASE_PUBLISHABLE_KEY\n  - username: service_role\n    keyauth_credentials:\n      - key: $SUPABASE_SERVICE_KEY\n      - key: $SUPABASE_SECRET_KEY\n\nacls:\n  - consumer: anon\n    group: anon\n  - consumer: service_role\n    group: admin\n\nbasicauth_credentials:\n  - consumer: DASHBOARD\n    username: '$DASHBOARD_USERNAME'\n    password: '$DASHBOARD_PASSWORD'\n\nservices:\n  - name: auth-v1-open\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/verify\n    routes:\n      - name: auth-v1-open\n        strip_path: true\n        paths: [/auth/v1/verify]\n    plugins:\n      - name: cors\n  - name: auth-v1-open-callback\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/callback\n    routes:\n      - name: auth-v1-open-callback\n        strip_path: true\n        paths: [/auth/v1/callback]\n    plugins:\n      - name: cors\n  - name: auth-v1-open-authorize\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/authorize\n    routes:\n      - name: auth-v1-open-authorize\n        strip_path: true\n        paths: [/auth/v1/authorize]\n    plugins:\n      - name: cors\n  - name: auth-v1-open-jwks\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/.well-known/jwks.json\n    routes:\n      - name: auth-v1-open-jwks\n        strip_path: true\n        paths: [/auth/v1/.well-known/jwks.json]\n    plugins:\n      - name: cors\n  - name: auth-v1\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/\n    routes:\n      - name: auth-v1-all\n        strip_path: true\n        paths: [/auth/v1/]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: rest-v1\n    url: http://rest.${SUPABASE_NAMESPACE}.svc.cluster.local:3000/\n    routes:\n      - name: rest-v1-all\n        strip_path: true\n        paths: [/rest/v1/]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: graphql-v1\n    url: http://rest.${SUPABASE_NAMESPACE}.svc.cluster.local:3000/rpc/graphql\n    routes:\n      - name: graphql-v1-all\n        strip_path: true\n        paths: [/graphql/v1]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Content-Profile: graphql_public\"\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: realtime-v1-ws\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/socket\n    protocol: ws\n    routes:\n      - name: realtime-v1-ws\n        strip_path: true\n        paths: [/realtime/v1/]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"x-api-key:$LUA_RT_WS_EXPR\"\n          replace:\n            querystring:\n              - \"apikey:$LUA_RT_WS_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: realtime-v1-rest-openapi\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/api/openapi\n    protocol: http\n    routes:\n      - name: realtime-v1-rest-openapi\n        strip_path: true\n        paths: [/realtime/v1/api/openapi]\n    plugins:\n      - name: request-termination\n        config:\n          status_code: 403\n          message: \"Access is forbidden.\"\n  - name: realtime-v1-rest-tenants\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/api/tenants\n    protocol: http\n    routes:\n      - name: realtime-v1-rest-tenants\n        strip_path: true\n        paths: [/realtime/v1/api/tenants]\n    plugins:\n      - name: request-termination\n        config:\n          status_code: 403\n          message: \"Access is forbidden.\"\n  - name: realtime-v1-rest\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/api\n    protocol: http\n    routes:\n      - name: realtime-v1-rest\n        strip_path: true\n        paths: [/realtime/v1/api]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: storage-v1\n    url: http://storage.${SUPABASE_NAMESPACE}.svc.cluster.local:5000/\n    routes:\n      - name: storage-v1-all\n        strip_path: true\n        paths: [/storage/v1/]\n    plugins:\n      - name: cors\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: post-function\n        config:\n          access:\n            - |\n              local auth = kong.request.get_header(\"authorization\")\n              if auth == nil or auth == \"\" or auth:find(\"^%s*$\") then\n                kong.service.request.clear_header(\"authorization\")\n              end\n  - name: meta\n    url: http://meta.${SUPABASE_NAMESPACE}.svc.cluster.local:8080/\n    routes:\n      - name: meta-all\n        strip_path: true\n        paths: [/pg/]\n    plugins:\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin]\n  - name: dashboard\n    url: http://studio.${SUPABASE_NAMESPACE}.svc.cluster.local:3000/\n    routes:\n      - name: dashboard-all\n        strip_path: true\n        paths: [/]\n    plugins:\n      - name: cors\n      - name: basic-auth\n        config:\n          hide_credentials: true\n`;\n}\n\nfunction getSupabaseKongEntrypointScript(): string {\n  return `#!/bin/sh\nset -eu\n\nif [ -n \"\\${SUPABASE_SECRET_KEY:-}\" ] && [ -n \"\\${SUPABASE_PUBLISHABLE_KEY:-}\" ]; then\n  export LUA_AUTH_EXPR=\"\\\\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or (headers.apikey == '\\${SUPABASE_SECRET_KEY}' and 'Bearer \\${SERVICE_ROLE_KEY_ASYMMETRIC:-}') or (headers.apikey == '\\${SUPABASE_PUBLISHABLE_KEY}' and 'Bearer \\${ANON_KEY_ASYMMETRIC:-}') or headers.apikey)\"\n  export LUA_RT_WS_EXPR=\"\\\\$((query_params.apikey == '\\${SUPABASE_SECRET_KEY}' and '\\${SERVICE_ROLE_KEY_ASYMMETRIC:-}') or (query_params.apikey == '\\${SUPABASE_PUBLISHABLE_KEY}' and '\\${ANON_KEY_ASYMMETRIC:-}') or query_params.apikey)\"\nelse\n  export LUA_AUTH_EXPR=\"\\\\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or headers.apikey)\"\n  export LUA_RT_WS_EXPR=\"\\\\$(query_params.apikey)\"\nfi\n\nawk '{\n  result = \"\"\n  rest = $0\n  while (match(rest, /\\\\$[A-Za-z_][A-Za-z_0-9]*/)) {\n    varname = substr(rest, RSTART + 1, RLENGTH - 1)\n    if (varname in ENVIRON) {\n      result = result substr(rest, 1, RSTART - 1) ENVIRON[varname]\n    } else {\n      result = result substr(rest, 1, RSTART + RLENGTH - 1)\n    }\n    rest = substr(rest, RSTART + RLENGTH)\n  }\n  print result rest\n}' /home/kong/temp.yml > \"\\${KONG_DECLARATIVE_CONFIG}\"\n\nsed -i '/^[[:space:]]*- key:[[:space:]]*$/d' \"\\${KONG_DECLARATIVE_CONFIG}\"\n\nexec /entrypoint.sh kong docker-start\n`;\n}\n\nfunction getSupabaseGatewayManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: gateway\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-gateway\n  ports:\n    - name: http\n      port: 8000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: gateway\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-gateway\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-gateway\n    spec:\n      containers:\n        - name: gateway\n          image: ${SUPABASE_IMAGES.gateway}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 8000\n              name: http\n          env:\n            - name: KONG_DATABASE\n              value: \"off\"\n            - name: KONG_DECLARATIVE_CONFIG\n              value: /usr/local/kong/kong.yml\n            - name: KONG_ROUTER_FLAVOR\n              value: expressions\n            - name: KONG_DNS_ORDER\n              value: LAST,A,CNAME\n            - name: KONG_DNS_NOT_FOUND_TTL\n              value: \"1\"\n            - name: KONG_PLUGINS\n              value: request-transformer,cors,key-auth,acl,basic-auth,request-termination,ip-restriction,post-function\n            - name: KONG_PROXY_LISTEN\n              value: \"0.0.0.0:8000\"\n            - name: SUPABASE_SERVICE_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_SERVICE_ROLE_KEY\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n          volumeMounts:\n            - name: config\n              mountPath: /home/kong/temp.yml\n              subPath: temp.yml\n              readOnly: true\n            - name: entrypoint\n              mountPath: /home/kong/kong-entrypoint.sh\n              subPath: kong-entrypoint.sh\n              readOnly: true\n          command: [\"/bin/sh\", \"/home/kong/kong-entrypoint.sh\"]\n          readinessProbe:\n            exec:\n              command: [\"kong\", \"health\"]\n            initialDelaySeconds: 10\n            periodSeconds: 10\n      volumes:\n        - name: config\n          configMap:\n            name: supabase-gateway-config\n        - name: entrypoint\n          configMap:\n            name: supabase-kong-entrypoint\n            defaultMode: 0755\n`;\n}\n\nfunction getSupabaseStudioManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: studio\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-studio\n  ports:\n    - name: http\n      port: 3000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: studio\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-studio\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-studio\n    spec:\n      containers:\n        - name: studio\n          image: ${SUPABASE_IMAGES.studio}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 3000\n              name: http\n          env:\n            - name: HOSTNAME\n              value: \"0.0.0.0\"\n            - name: STUDIO_PG_META_URL\n              value: \"http://meta.${SUPABASE_NAMESPACE}.svc.cluster.local:8080\"\n            - name: SUPABASE_URL\n              value: \"http://gateway.${SUPABASE_NAMESPACE}.svc.cluster.local:8000\"\n            - name: SUPABASE_PUBLIC_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SUPABASE_PUBLIC_URL\n            - name: SUPABASE_ANON_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_ANON_KEY\n            - name: SUPABASE_SERVICE_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_SERVICE_ROLE_KEY\n            - name: AUTH_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n`;\n}\n\nfunction getUpScript(args: {\n  appSlug: string;\n  defaultAppImage: string;\n  supabaseKubernetesEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n  secretStoreProvider: string;\n  supabaseHostPorts: SupabaseHostPorts;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n  providerLifecycle: readonly MinikubeProviderLifecycle[];\n}): string {\n  const {\n    appSlug,\n    defaultAppImage,\n    supabaseKubernetesEnabled,\n    profileModel,\n    secretStoreProvider,\n    supabaseHostPorts,\n    oauthProviders,\n    providerLifecycle,\n  } = args;\n  const oauthEnvDefaults = getOAuthScriptEnvDefaults(oauthProviders);\n  const oauthRuntimeSecretLines = getOAuthRuntimeSecretLines(oauthProviders);\n  const oauthValidation = getOAuthRuntimeValidationScript(oauthProviders);\n  const oauthCallbackRoute = getSupabaseOAuthCallbackRoute(oauthProviders);\n  const providerLifecycleStageScripts = getProviderLifecycleStageScripts(providerLifecycle);\n  const oauthVaultResolution = getOAuthVaultResolutionScript({\n    appSlug,\n    oauthProviders,\n    secretStoreProvider,\n  });\n\n  return `#!/usr/bin/env bash\nset -Eeuo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nK8S_DIR=\"\\${ROOT_DIR}/k8s\"\nBUILD_SCRIPT=\"\\${SCRIPT_DIR}/build-app-image.sh\"\nPORT_FORWARD_SCRIPT=\"\\${SCRIPT_DIR}/port-forward.sh\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-}\"\nDRIVER=\"\\${MINIKUBE_DRIVER:-}\"\nAPP_NAMESPACE=\"${APP_NAMESPACE}\"\nSUPABASE_NAMESPACE=\"${SUPABASE_NAMESPACE}\"\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-}\"\nAPP_IMAGE_SYNC_STRATEGY=\"\\${APP_IMAGE_SYNC_STRATEGY:-}\"\nAPP_REPLICAS=\"\\${APP_REPLICAS:-}\"\nAPP_FORCE_ROLLOUT_RESTART=\"\\${APP_FORCE_ROLLOUT_RESTART:-}\"\nAPP_IMAGE_PULL_SECRET_NAME=\"\\${APP_IMAGE_PULL_SECRET_NAME:-}\"\nAPP_IMAGE_PULL_SECRET_SERVER=\"\\${APP_IMAGE_PULL_SECRET_SERVER:-}\"\nAPP_IMAGE_PULL_SECRET_USERNAME=\"\\${APP_IMAGE_PULL_SECRET_USERNAME:-}\"\nAPP_IMAGE_PULL_SECRET_PASSWORD=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD:-}\"\nAPP_IMAGE_PULL_SECRET_EMAIL=\"\\${APP_IMAGE_PULL_SECRET_EMAIL:-}\"\nAPP_PORT_FORWARD_LOCAL_PORT=\"\\${APP_PORT_FORWARD_LOCAL_PORT:-}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-}\"\nSUPABASE_DB_FORWARD_LOCAL_PORT=\"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-}\"\nSUPABASE_DB_URL=\"\\${SUPABASE_DB_URL:-}\"\nSUPABASE_PROFILE_ENABLED=\"${profileModel.enabled ? 'true' : 'false'}\"\nSUPABASE_PROFILE_RECONCILE_FILE=\"\\${ROOT_DIR}/supabase/generated/auth_profiles.sql\"\n\nrequire_command() {\n  if ! command -v \"\\${1}\" >/dev/null 2>&1; then\n    echo \"\\${1} is required but not installed.\"\n    exit 1\n  fi\n}\n\nload_env_file_preserving_process_env() {\n  local line trimmed key value current\n  if [[ ! -f \"\\${ROOT_DIR}/.env\" ]]; then\n    return 0\n  fi\n\n  while IFS= read -r line || [[ -n \"\\${line}\" ]]; do\n    trimmed=\"$(printf '%s' \"\\${line}\" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')\"\n    if [[ -z \"\\${trimmed}\" || \"\\${trimmed}\" == \\\\#* || \"\\${trimmed}\" != *=* ]]; then\n      continue\n    fi\n\n    key=\"\\${trimmed%%=*}\"\n    value=\"\\${trimmed#*=}\"\n    key=\"\\${key//[[:space:]]/}\"\n    value=\"$(printf '%s' \"\\${value}\" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')\"\n    value=\"\\${value%\\\\\"}\"\n    value=\"\\${value#\\\\\"}\"\n    value=\"\\${value%\\\\'}\"\n    value=\"\\${value#\\\\'}\"\n    current=\"\\${!key:-}\"\n    if [[ -n \"\\${current}\" ]]; then\n      continue\n    fi\n    export \"\\${key}=\\${value}\"\n  done < \"\\${ROOT_DIR}/.env\"\n}\n\nenv_file_value() {\n  local key=\"\\${1}\"\n  if [[ ! -f \"\\${ROOT_DIR}/.env\" ]]; then\n    return 0\n  fi\n  awk -F= -v key=\"\\${key}\" '$1 == key { value = substr($0, index($0, \"=\") + 1) } END { print value }' \"\\${ROOT_DIR}/.env\"\n}\n\nenv_file_has_key() {\n  local key=\"\\${1}\"\n  if [[ ! -f \"\\${ROOT_DIR}/.env\" ]]; then\n    return 1\n  fi\n  awk -F= -v key=\"\\${key}\" '$1 == key { found = 1 } END { exit found ? 0 : 1 }' \"\\${ROOT_DIR}/.env\"\n}\n\nwrite_env_value() {\n  local key=\"\\${1}\"\n  local value=\"\\${2}\"\n  local tmp_env\n  mkdir -p \"\\${ROOT_DIR}\"\n  touch \"\\${ROOT_DIR}/.env\"\n  tmp_env=\"$(mktemp)\"\n  awk -F= -v key=\"\\${key}\" -v value=\"\\${value}\" '\n    $1 == key {\n      print key \"=\" value\n      found = 1\n      next\n    }\n    { print }\n    END {\n      if (!found) print key \"=\" value\n    }\n  ' \"\\${ROOT_DIR}/.env\" > \"\\${tmp_env}\"\n  mv \"\\${tmp_env}\" \"\\${ROOT_DIR}/.env\"\n}\n\nset_required_env_default() {\n  local key=\"\\${1}\"\n  local value=\"\\${2}\"\n  local current=\"\\${!key:-}\"\n  if [[ -n \"\\${current}\" ]]; then\n    write_env_value \"\\${key}\" \"\\${current}\"\n    return 0\n  fi\n\n  current=\"$(env_file_value \"\\${key}\")\"\n  if [[ -n \"\\${current}\" ]]; then\n    export \"\\${key}=\\${current}\"\n    return 0\n  fi\n\n  write_env_value \"\\${key}\" \"\\${value}\"\n  export \"\\${key}=\\${value}\"\n}\n\nset_optional_env_default() {\n  local key=\"\\${1}\"\n  local value=\"\\${2}\"\n  local current=\"\\${!key:-}\"\n  if env_file_has_key \"\\${key}\"; then\n    export \"\\${key}=\\${current}\"\n    return 0\n  fi\n  if [[ -n \"\\${current}\" ]]; then\n    write_env_value \"\\${key}\" \"\\${current}\"\n    return 0\n  fi\n  write_env_value \"\\${key}\" \"\\${value}\"\n  export \"\\${key}=\\${value}\"\n}\n\nset_env_default() {\n  set_required_env_default \"\\${1}\" \"\\${2}\"\n}\n\nderive_additional_redirect_urls() {\n  local callback_route=\"${oauthCallbackRoute}\"\n  local callback_path=\"\\${callback_route#/}\"\n  local site_url_without_slash=\"\\${SITE_URL%/}\"\n  local urls=\"\\${site_url_without_slash},\\${site_url_without_slash}/\\${callback_path}\"\n  if [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n    urls=\"\\${urls},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\n  fi\n  printf '%s' \"\\${urls}\"\n}\n\nrandom_base64() {\n  openssl rand -base64 \"\\${1}\" | tr -d '\\\\n'\n}\n\nrandom_hex() {\n  openssl rand -hex \"\\${1}\" | tr -d '\\\\n'\n}\n\nbase64url() {\n  openssl base64 -A | tr '+/' '-_' | tr -d '='\n}\n\ngenerate_supabase_jwt() {\n  local role=\"\\${1}\"\n  local iat exp header payload signature\n  iat=\"$(date +%s)\"\n  exp=\"$((iat + 315360000))\"\n  header=\"$(printf '{\"alg\":\"HS256\",\"typ\":\"JWT\"}' | base64url)\"\n  payload=\"$(printf '{\"role\":\"%s\",\"iss\":\"supabase-demo\",\"iat\":%s,\"exp\":%s}' \"\\${role}\" \"\\${iat}\" \"\\${exp}\" | base64url)\"\n  signature=\"$(printf '%s.%s' \"\\${header}\" \"\\${payload}\" | openssl dgst -binary -sha256 -hmac \"\\${JWT_SECRET}\" | base64url)\"\n  printf '%s.%s.%s' \"\\${header}\" \"\\${payload}\" \"\\${signature}\"\n}\n\nensure_supabase_runtime_env() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  require_command openssl\n\n  set_required_env_default POSTGRES_PASSWORD \"$(random_hex 32)\"\n  set_required_env_default JWT_SECRET \"$(random_base64 48)\"\n  set_required_env_default SUPABASE_ANON_KEY \"$(generate_supabase_jwt anon)\"\n  set_required_env_default SUPABASE_SERVICE_ROLE_KEY \"$(generate_supabase_jwt service_role)\"\n  set_required_env_default DASHBOARD_USERNAME \"supabase\"\n  set_required_env_default DASHBOARD_PASSWORD \"$(random_base64 24)\"\n  set_required_env_default SECRET_KEY_BASE \"$(random_base64 48)\"\n  set_required_env_default REALTIME_DB_ENC_KEY \"$(random_hex 8)\"\n  set_required_env_default PG_META_CRYPTO_KEY \"$(random_base64 32)\"\n  set_required_env_default S3_PROTOCOL_ACCESS_KEY_ID \"$(random_hex 16)\"\n  set_required_env_default S3_PROTOCOL_ACCESS_KEY_SECRET \"$(random_hex 32)\"\n  set_required_env_default JWT_EXPIRY \"3600\"\n  set_required_env_default SUPABASE_GATEWAY_FORWARD_LOCAL_PORT \"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\n  set_required_env_default APP_PORT_FORWARD_LOCAL_PORT \"\\${APP_PORT_FORWARD_LOCAL_PORT:-${supabaseHostPorts.app}}\"\n  set_required_env_default SUPABASE_PUBLIC_URL \"http://127.0.0.1:\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT}\"\n  set_required_env_default API_EXTERNAL_URL \"\\${SUPABASE_PUBLIC_URL}/auth/v1\"\n  set_required_env_default SITE_URL \"http://127.0.0.1:\\${APP_PORT_FORWARD_LOCAL_PORT}\"\n  export OAUTH_NATIVE_REDIRECT_URLS=\"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\"\n  set_required_env_default ADDITIONAL_REDIRECT_URLS \"$(derive_additional_redirect_urls)\"\n  set_required_env_default ENABLE_EMAIL_SIGNUP \"true\"\n  set_required_env_default ENABLE_EMAIL_AUTOCONFIRM \"true\"\n  set_required_env_default SMTP_ADMIN_EMAIL \"admin@example.com\"\n  set_required_env_default SMTP_HOST \"localhost\"\n  set_required_env_default SMTP_PORT \"2500\"\n  set_optional_env_default SMTP_USER \"\"\n  set_optional_env_default SMTP_PASS \"\"\n  set_required_env_default SMTP_SENDER_NAME \"Ankhorage\"\n  set_required_env_default PGRST_DB_SCHEMAS \"public,storage,graphql_public\"\n  set_required_env_default PGRST_DB_MAX_ROWS \"1000\"\n  set_required_env_default PGRST_DB_EXTRA_SEARCH_PATH \"public\"\n  set_required_env_default GLOBAL_S3_BUCKET \"stub\"\n  set_required_env_default STORAGE_TENANT_ID \"stub\"\n  set_required_env_default REGION \"stub\"\n  set_required_env_default SUPABASE_DB_FORWARD_LOCAL_PORT \"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-${supabaseHostPorts.db}}\"\n  set_required_env_default SUPABASE_DB_URL \"postgres://postgres:\\${POSTGRES_PASSWORD}@127.0.0.1:\\${SUPABASE_DB_FORWARD_LOCAL_PORT}/postgres?sslmode=disable\"\n  set_required_env_default EXPO_PUBLIC_SUPABASE_URL \"\\${SUPABASE_PUBLIC_URL}\"\n  set_required_env_default EXPO_PUBLIC_SUPABASE_ANON_KEY \"\\${SUPABASE_ANON_KEY}\"\n${oauthEnvDefaults}\n}\n${oauthVaultResolution}\n\nsync_supabase_secrets() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  local tmp_runtime tmp_public\n  tmp_runtime=\"$(mktemp)\"\n  tmp_public=\"$(mktemp)\"\n  trap 'rm -f \"\\${tmp_runtime}\" \"\\${tmp_public}\"' EXIT\n\n  cat > \"\\${tmp_runtime}\" <<EOF\nPOSTGRES_PASSWORD=\\${POSTGRES_PASSWORD}\nJWT_SECRET=\\${JWT_SECRET}\nSUPABASE_ANON_KEY=\\${SUPABASE_ANON_KEY}\nSUPABASE_SERVICE_ROLE_KEY=\\${SUPABASE_SERVICE_ROLE_KEY}\nSUPABASE_PUBLISHABLE_KEY=\\${SUPABASE_PUBLISHABLE_KEY:-}\nSUPABASE_SECRET_KEY=\\${SUPABASE_SECRET_KEY:-}\nDASHBOARD_USERNAME=\\${DASHBOARD_USERNAME:-supabase}\nDASHBOARD_PASSWORD=\\${DASHBOARD_PASSWORD:-}\nSMTP_USER=\\${SMTP_USER:-}\nSMTP_PASS=\\${SMTP_PASS:-}\nSECRET_KEY_BASE=\\${SECRET_KEY_BASE}\nREALTIME_DB_ENC_KEY=\\${REALTIME_DB_ENC_KEY}\nPG_META_CRYPTO_KEY=\\${PG_META_CRYPTO_KEY}\nS3_PROTOCOL_ACCESS_KEY_ID=\\${S3_PROTOCOL_ACCESS_KEY_ID}\nS3_PROTOCOL_ACCESS_KEY_SECRET=\\${S3_PROTOCOL_ACCESS_KEY_SECRET}\n${oauthRuntimeSecretLines}\nEOF\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create secret generic supabase-runtime-secrets --from-env-file=\"\\${tmp_runtime}\" --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n\n  cat > \"\\${tmp_public}\" <<EOF\nEXPO_PUBLIC_SUPABASE_URL=\\${EXPO_PUBLIC_SUPABASE_URL}\nEXPO_PUBLIC_SUPABASE_ANON_KEY=\\${EXPO_PUBLIC_SUPABASE_ANON_KEY}\nSUPABASE_URL=http://gateway.${SUPABASE_NAMESPACE}.svc.cluster.local:8000\nSUPABASE_ANON_KEY=\\${SUPABASE_ANON_KEY}\nEOF\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" create secret generic supabase-public-runtime --from-env-file=\"\\${tmp_public}\" --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" apply -f -\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create configmap supabase-runtime-config \\\n    --from-literal=SUPABASE_PUBLIC_URL=\"\\${SUPABASE_PUBLIC_URL}\" \\\n    --from-literal=API_EXTERNAL_URL=\"\\${API_EXTERNAL_URL}\" \\\n    --from-literal=SITE_URL=\"\\${SITE_URL}\" \\\n    --from-literal=ADDITIONAL_REDIRECT_URLS=\"\\${ADDITIONAL_REDIRECT_URLS}\" \\\n    --from-literal=JWT_EXPIRY=\"\\${JWT_EXPIRY}\" \\\n    --from-literal=ENABLE_EMAIL_SIGNUP=\"\\${ENABLE_EMAIL_SIGNUP}\" \\\n    --from-literal=ENABLE_EMAIL_AUTOCONFIRM=\"\\${ENABLE_EMAIL_AUTOCONFIRM}\" \\\n    --from-literal=SMTP_ADMIN_EMAIL=\"\\${SMTP_ADMIN_EMAIL}\" \\\n    --from-literal=SMTP_HOST=\"\\${SMTP_HOST}\" \\\n    --from-literal=SMTP_PORT=\"\\${SMTP_PORT}\" \\\n    --from-literal=SMTP_SENDER_NAME=\"\\${SMTP_SENDER_NAME}\" \\\n    --from-literal=PGRST_DB_SCHEMAS=\"\\${PGRST_DB_SCHEMAS}\" \\\n    --from-literal=PGRST_DB_MAX_ROWS=\"\\${PGRST_DB_MAX_ROWS}\" \\\n    --from-literal=PGRST_DB_EXTRA_SEARCH_PATH=\"\\${PGRST_DB_EXTRA_SEARCH_PATH}\" \\\n    --from-literal=GLOBAL_S3_BUCKET=\"\\${GLOBAL_S3_BUCKET}\" \\\n    --from-literal=STORAGE_TENANT_ID=\"\\${STORAGE_TENANT_ID}\" \\\n    --from-literal=REGION=\"\\${REGION}\" \\\n    --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create configmap supabase-gateway-config \\\n    --from-file=temp.yml=\"\\${K8S_DIR}/supabase/gateway.template.yml\" \\\n    --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create configmap supabase-kong-entrypoint \\\n    --from-file=kong-entrypoint.sh=\"\\${K8S_DIR}/supabase/kong-entrypoint.sh\" \\\n    --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n\n  rm -f \"\\${tmp_runtime}\" \"\\${tmp_public}\"\n  trap - EXIT\n}\n\ndocker_load_image_to_minikube() {\n  if command -v docker >/dev/null 2>&1 && docker image inspect \"\\${APP_IMAGE}\" >/dev/null 2>&1; then\n    minikube -p \"\\${PROFILE}\" image load --daemon=true --overwrite=true \"\\${APP_IMAGE}\" >/dev/null\n    return 0\n  fi\n\n  return 1\n}\n\nrun_supabase_migrations() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  export SUPABASE_DB_URL PGSSLMODE=disable\n\n  if [[ -d \"\\${ROOT_DIR}/supabase/migrations\" ]]; then\n    require_command supabase\n    (\n      cd \"\\${ROOT_DIR}\"\n      supabase migration up --db-url \"\\${SUPABASE_DB_URL}\"\n    )\n  fi\n}\n\nreconcile_supabase_profile() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n  if [[ \"\\${SUPABASE_PROFILE_ENABLED}\" == \"true\" && -f \"\\${SUPABASE_PROFILE_RECONCILE_FILE}\" ]]; then\n    psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${SUPABASE_PROFILE_RECONCILE_FILE}\"\n  fi\n}\n\nreload_postgrest_schema() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -c \"notify pgrst, 'reload schema';\"\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout restart deployment/rest >/dev/null\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/rest --timeout=600s\n}\n\nbootstrap_supabase_vault_migration() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n  if [[ -f \"\\${ROOT_DIR}/supabase/migrations/202607120001_ankhorage_supabase_vault.sql\" ]]; then\n    kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" exec deployment/postgres -- psql -U postgres -d postgres -v ON_ERROR_STOP=1 -q -c \"alter role postgres with superuser;\"\n    kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" exec deployment/postgres -- psql -U postgres -d postgres -v ON_ERROR_STOP=1 -q -c \"create schema if not exists vault; grant pg_read_server_files to postgres; grant pg_read_server_files to supabase_admin; grant execute on function pg_read_file(text) to public; grant execute on function pg_read_file(text, bigint, bigint) to public;\"\n    psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${ROOT_DIR}/supabase/migrations/202607120001_ankhorage_supabase_vault.sql\"\n  fi\n}\n\nbootstrap_supabase_database() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  require_command psql\n  export POSTGRES_PASSWORD JWT_SECRET JWT_EXP=\"\\${JWT_EXPIRY}\" POSTGRES_USER=postgres\n  psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${K8S_DIR}/supabase/bootstrap.sql\"\n}\n\nwait_for_supabase_database() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  require_command psql\n  if ! \"\\${PORT_FORWARD_SCRIPT}\" start db-migration; then\n    echo \"Failed to start db-migration port-forward for Supabase bootstrap.\"\n    \"\\${PORT_FORWARD_SCRIPT}\" status db-migration || true\n    exit 1\n  fi\n  for attempt in {1..60}; do\n    if PGPASSWORD=\"\\${POSTGRES_PASSWORD}\" psql -h 127.0.0.1 -p \"\\${SUPABASE_DB_FORWARD_LOCAL_PORT}\" -U postgres -d postgres -v ON_ERROR_STOP=1 -Atq -c 'select 1' >/dev/null 2>&1; then\n      return 0\n    fi\n    sleep 2\n  done\n\n  echo \"Postgres did not accept SQL connections as postgres before bootstrap.\"\n  \"\\${PORT_FORWARD_SCRIPT}\" status db-migration || true\n  exit 1\n}\n\napply_supabase_runtime_workloads() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/auth.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/rest.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/realtime.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/imgproxy.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/storage.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/meta.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/gateway.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/studio.yaml\"\n}\n\napply_namespace_manifests() {\n  local namespace_manifest\n  for namespace_manifest in \"\\${K8S_DIR}\"/namespaces/*.yaml; do\n    kubectl --context \"\\${PROFILE}\" apply -f \"\\${namespace_manifest}\"\n  done\n}\n\n${providerLifecycleStageScripts}\n\nload_env_file_preserving_process_env\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nDRIVER=\"\\${MINIKUBE_DRIVER:-docker}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-true}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-$(cd \"\\${ROOT_DIR}/../..\" && pwd)}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-.ankh/web-export}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-${defaultAppImage}}\"\nAPP_IMAGE_SYNC_STRATEGY=\"\\${APP_IMAGE_SYNC_STRATEGY:-docker-load}\"\nAPP_REPLICAS=\"\\${APP_REPLICAS:-1}\"\nAPP_FORCE_ROLLOUT_RESTART=\"\\${APP_FORCE_ROLLOUT_RESTART:-true}\"\nAPP_IMAGE_PULL_SECRET_NAME=\"\\${APP_IMAGE_PULL_SECRET_NAME:-}\"\nAPP_IMAGE_PULL_SECRET_SERVER=\"\\${APP_IMAGE_PULL_SECRET_SERVER:-ghcr.io}\"\nAPP_IMAGE_PULL_SECRET_USERNAME=\"\\${APP_IMAGE_PULL_SECRET_USERNAME:-}\"\nAPP_IMAGE_PULL_SECRET_PASSWORD=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD:-}\"\nAPP_IMAGE_PULL_SECRET_EMAIL=\"\\${APP_IMAGE_PULL_SECRET_EMAIL:-}\"\nAPP_PORT_FORWARD_LOCAL_PORT=\"\\${APP_PORT_FORWARD_LOCAL_PORT:-${supabaseHostPorts.app}}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\nSUPABASE_DB_FORWARD_LOCAL_PORT=\"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-${supabaseHostPorts.db}}\"\nSUPABASE_DB_URL=\"\\${SUPABASE_DB_URL:-}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\ncleanup_failed_up() {\n  \"\\${PORT_FORWARD_SCRIPT}\" stop all >/dev/null 2>&1 || true\n}\n\ntrap cleanup_failed_up ERR\n\nrequire_command minikube\nrequire_command kubectl\nensure_supabase_runtime_env\n\nHOST_STATUS=\"$(minikube -p \"\\${PROFILE}\" status --format='{{.Host}}' 2>/dev/null || true)\"\nif [[ \"\\${HOST_STATUS}\" != \"Running\" ]]; then\n  minikube start -p \"\\${PROFILE}\" --driver=\"\\${DRIVER}\"\nfi\n\nif [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n  apply_namespace_manifests\n  sync_supabase_secrets\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/postgres.init.configmap.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/postgres.pvc.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/postgres.yaml\"\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/postgres --timeout=900s\n  wait_for_supabase_database\n  bootstrap_supabase_database\n  bootstrap_supabase_vault_migration\n  resolve_oauth_credentials_from_vault\n${oauthValidation}\n  sync_supabase_secrets\n  apply_supabase_runtime_workloads\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/auth --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/rest --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/realtime --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/storage --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/gateway --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/studio --timeout=600s\n  run_supabase_migrations\n  reconcile_supabase_profile\n  reload_postgrest_schema\n  \"\\${PORT_FORWARD_SCRIPT}\" start supabase-gateway >/dev/null\n  \"\\${PORT_FORWARD_SCRIPT}\" start studio >/dev/null\nelse\n  kubectl --context \"\\${PROFILE}\" apply -k \"\\${K8S_DIR}\"\nfi\n\nif [[ \"\\${APP_BUILD_ENABLED}\" == \"true\" ]]; then\n  if [[ ! -x \"\\${BUILD_SCRIPT}\" ]]; then\n    echo \"Missing build helper script: \\${BUILD_SCRIPT}\"\n    exit 1\n  fi\n\n  \"\\${BUILD_SCRIPT}\"\nfi\n\nif [[ \"\\${APP_WEB_EXPORT_DIR}\" = /* ]]; then\n  EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR}\"\nelse\n  EXPORT_DIR=\"\\${APP_SOURCE_DIR}/\\${APP_WEB_EXPORT_DIR}\"\nfi\n\ncase \"\\${APP_IMAGE_SYNC_STRATEGY}\" in\n  minikube-build)\n    if [[ ! -f \"\\${EXPORT_DIR}/index.html\" ]]; then\n      echo \"Expected web export output not found at \\${EXPORT_DIR}/index.html\"\n      exit 1\n    fi\n    minikube -p \"\\${PROFILE}\" image build -t \"\\${APP_IMAGE}\" -f \"\\${ROOT_DIR}/app-image/Dockerfile\" \"\\${EXPORT_DIR}\" >/dev/null\n    ;;\n  docker-load)\n    if ! docker_load_image_to_minikube; then\n      echo \"Skipping docker-load image sync; local Docker image \\${APP_IMAGE} not found.\"\n    fi\n    ;;\n  none)\n    echo \"Skipping local image sync (APP_IMAGE_SYNC_STRATEGY=none).\"\n    ;;\n  *)\n    echo \"Unsupported APP_IMAGE_SYNC_STRATEGY=\\${APP_IMAGE_SYNC_STRATEGY}. Use minikube-build, docker-load, or none.\"\n    exit 1\n    ;;\nesac\n\nif [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n  kubectl --context \"\\${PROFILE}\" apply -k \"\\${K8S_DIR}\"\nfi\n\nwait_for_provider_readiness\nrun_provider_migrations\nrun_provider_reconciliation\n\nif [[ -n \"\\${APP_IMAGE_PULL_SECRET_NAME}\" ]]; then\n  if [[ -z \"\\${APP_IMAGE_PULL_SECRET_USERNAME}\" || -z \"\\${APP_IMAGE_PULL_SECRET_PASSWORD}\" ]]; then\n    echo \"APP_IMAGE_PULL_SECRET_NAME is set, but username/password are missing.\"\n    exit 1\n  fi\n\n  SECRET_EMAIL_ARG=()\n  if [[ -n \"\\${APP_IMAGE_PULL_SECRET_EMAIL}\" ]]; then\n    SECRET_EMAIL_ARG=(--docker-email=\"\\${APP_IMAGE_PULL_SECRET_EMAIL}\")\n  fi\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" create secret docker-registry \"\\${APP_IMAGE_PULL_SECRET_NAME}\" --docker-server=\"\\${APP_IMAGE_PULL_SECRET_SERVER}\" --docker-username=\"\\${APP_IMAGE_PULL_SECRET_USERNAME}\" --docker-password=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD}\" \"\\${SECRET_EMAIL_ARG[@]}\" --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" apply -f -\n\n  PULL_SECRET_PATCH=\"$(cat <<EOF\n{\"spec\":{\"template\":{\"spec\":{\"imagePullSecrets\":[{\"name\":\"\\${APP_IMAGE_PULL_SECRET_NAME}\"}]}}}}\nEOF\n)\"\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" patch deployment app-runtime --type=merge --patch \"\\${PULL_SECRET_PATCH}\" >/dev/null\nelse\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" patch deployment app-runtime --type=json --patch='[{\"op\":\"remove\",\"path\":\"/spec/template/spec/imagePullSecrets\"}]' >/dev/null 2>&1 || true\nfi\n\nkubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" set image deployment/app-runtime app=\"\\${APP_IMAGE}\" >/dev/null\nkubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" scale deployment/app-runtime --replicas=\"\\${APP_REPLICAS}\" >/dev/null\n\nif [[ \"\\${APP_FORCE_ROLLOUT_RESTART}\" == \"true\" ]]; then\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" rollout restart deployment/app-runtime >/dev/null\nfi\n\nkubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" rollout status deployment/app-runtime --timeout=180s >/dev/null\n\"\\${PORT_FORWARD_SCRIPT}\" start app >/dev/null\n\ntrap - ERR\necho \"Minikube infrastructure for '\\${PROFILE}' is running.\"\n`;\n}\n\nfunction getBuildAppImageScript(args: { appSlug: string; defaultAppImage: string }): string {\n  const { appSlug, defaultAppImage } = args;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nDOCKERFILE_PATH=\"\\${ROOT_DIR}/app-image/Dockerfile\"\nAPP_SLUG=\"${appSlug}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-true}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-$(cd \"\\${ROOT_DIR}/../..\" && pwd)}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-.ankh/web-export}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-${defaultAppImage}}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\nif [[ \"\\${APP_BUILD_ENABLED}\" != \"true\" ]]; then\n  echo \"Skipping app image build (APP_BUILD_ENABLED=\\${APP_BUILD_ENABLED}).\"\n  exit 0\nfi\n\nif ! command -v docker >/dev/null 2>&1; then\n  echo \"docker is required to build app image.\"\n  exit 1\nfi\n\nif ! command -v bunx >/dev/null 2>&1; then\n  echo \"bunx is required to export the app for container image build.\"\n  exit 1\nfi\n\nif [[ ! -f \"\\${APP_SOURCE_DIR}/package.json\" ]]; then\n  echo \"APP_SOURCE_DIR does not look like an app root: \\${APP_SOURCE_DIR}\"\n  exit 1\nfi\n\nif [[ ! -f \"\\${DOCKERFILE_PATH}\" ]]; then\n  echo \"Dockerfile for app image build is missing: \\${DOCKERFILE_PATH}\"\n  exit 1\nfi\n\n(\n  cd \"\\${APP_SOURCE_DIR}\"\n  bunx expo export --platform web --output-dir \"\\${APP_WEB_EXPORT_DIR}\"\n)\n\nif [[ \"\\${APP_WEB_EXPORT_DIR}\" = /* ]]; then\n  EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR}\"\nelse\n  EXPORT_DIR=\"\\${APP_SOURCE_DIR}/\\${APP_WEB_EXPORT_DIR}\"\nfi\n\nif [[ ! -f \"\\${EXPORT_DIR}/index.html\" ]]; then\n  echo \"Expected web export output not found at \\${EXPORT_DIR}/index.html\"\n  exit 1\nfi\n\ndocker build -t \"\\${APP_IMAGE}\" \\\n  --label \"ankhorage.kind=generated-app\" \\\n  --label \"ankhorage.app_slug=\\${PROFILE}\" \\\n  --label \"ankhorage.image=\\${APP_IMAGE}\" \\\n  -f \"\\${DOCKERFILE_PATH}\" \\\n  \"\\${EXPORT_DIR}\"\necho \"Built app image: \\${APP_IMAGE} (profile: \\${PROFILE})\"\n`;\n}\n\nfunction getAppImageDockerfile(): string {\n  return `FROM nginx:1.27-alpine\n\nRUN cat <<'EOF' > /etc/nginx/conf.d/default.conf\nserver {\n  listen 8080;\n  server_name _;\n  root /usr/share/nginx/html;\n  index index.html;\n\n  location / {\n    try_files $uri $uri/ /index.html;\n  }\n}\nEOF\n\nCOPY . /usr/share/nginx/html\n\nEXPOSE 8080\n\nCMD [\"nginx\", \"-g\", \"daemon off;\"]\n`;\n}\n\nfunction getPortForwardScript(args: {\n  appSlug: string;\n  supabaseKubernetesEnabled: boolean;\n  supabaseHostPorts: SupabaseHostPorts;\n}): string {\n  const { appSlug, supabaseKubernetesEnabled, supabaseHostPorts } = args;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nSTATE_DIR=\"\\${ROOT_DIR}/.state/forwards\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nAPP_PORT_FORWARD_LOCAL_PORT=\"\\${APP_PORT_FORWARD_LOCAL_PORT:-${supabaseHostPorts.app}}\"\nAPP_PORT_FORWARD_REMOTE_PORT=\"\\${APP_PORT_FORWARD_REMOTE_PORT:-80}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\nSUPABASE_GATEWAY_FORWARD_REMOTE_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_REMOTE_PORT:-8000}\"\nSUPABASE_STUDIO_FORWARD_LOCAL_PORT=\"\\${SUPABASE_STUDIO_FORWARD_LOCAL_PORT:-${supabaseHostPorts.studio}}\"\nSUPABASE_STUDIO_FORWARD_REMOTE_PORT=\"\\${SUPABASE_STUDIO_FORWARD_REMOTE_PORT:-3000}\"\nSUPABASE_DB_FORWARD_LOCAL_PORT=\"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-${supabaseHostPorts.db}}\"\nSUPABASE_DB_FORWARD_REMOTE_PORT=\"\\${SUPABASE_DB_FORWARD_REMOTE_PORT:-5432}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"kubectl is required but not installed.\"\n  exit 1\nfi\n\nmkdir -p \"\\${STATE_DIR}\"\n\npid_file_for() {\n  echo \"\\${STATE_DIR}/\\${PROFILE}-\\${1}.pid\"\n}\n\ntarget_for() {\n  case \"\\${1}\" in\n    app)\n      echo \"${APP_NAMESPACE} service/app-runtime \\${APP_PORT_FORWARD_LOCAL_PORT} \\${APP_PORT_FORWARD_REMOTE_PORT}\"\n      ;;\n    supabase-gateway)\n      echo \"${SUPABASE_NAMESPACE} service/gateway \\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT} \\${SUPABASE_GATEWAY_FORWARD_REMOTE_PORT}\"\n      ;;\n    studio)\n      echo \"${SUPABASE_NAMESPACE} service/studio \\${SUPABASE_STUDIO_FORWARD_LOCAL_PORT} \\${SUPABASE_STUDIO_FORWARD_REMOTE_PORT}\"\n      ;;\n    db-migration)\n      echo \"${SUPABASE_NAMESPACE} service/postgres \\${SUPABASE_DB_FORWARD_LOCAL_PORT} \\${SUPABASE_DB_FORWARD_REMOTE_PORT}\"\n      ;;\n    *)\n      echo \"Unknown forward '\\${1}'. Use app, supabase-gateway, studio, db-migration, or all.\" >&2\n      return 1\n      ;;\n  esac\n}\n\nis_pid_running() {\n  local pid=\"\\${1}\"\n  [[ -n \"\\${pid}\" ]] && kill -0 \"\\${pid}\" >/dev/null 2>&1\n}\n\nis_port_accepting() {\n  local port=\"\\${1}\"\n  (echo >/dev/tcp/127.0.0.1/\"\\${port}\") >/dev/null 2>&1\n}\n\nprint_forward_log_tail() {\n  local name=\"\\${1}\"\n  local log_file=\"\\${STATE_DIR}/\\${PROFILE}-\\${name}.log\"\n  if [[ -s \"\\${log_file}\" ]]; then\n    echo \"\\${name}: recent kubectl port-forward log:\"\n    tail -n 20 \"\\${log_file}\"\n  fi\n}\n\nprocess_command_for_pid() {\n  local pid=\"\\${1}\"\n  ps -p \"\\${pid}\" -o command= 2>/dev/null || true\n}\n\nprocess_name_for_pid() {\n  local pid=\"\\${1}\"\n  ps -p \"\\${pid}\" -o comm= 2>/dev/null || true\n}\n\nis_owned_forward_process() {\n  local pid=\"\\${1}\"\n  local namespace=\"\\${2}\"\n  local resource=\"\\${3}\"\n  local local_port=\"\\${4}\"\n  local remote_port=\"\\${5}\"\n  local command\n  local process_name\n  command=\"$(process_command_for_pid \"\\${pid}\")\"\n  process_name=\"$(process_name_for_pid \"\\${pid}\")\"\n\n  case \"\\${process_name}\" in\n    *kubectl) ;;\n    *) return 1 ;;\n  esac\n\n  case \"\\${command}\" in\n    *\"kubectl --context \\${PROFILE} -n \\${namespace} port-forward \\${resource} \\${local_port}:\\${remote_port}\"*)\n      return 0\n      ;;\n    *)\n      return 1\n      ;;\n  esac\n}\n\nhandle_non_owned_forward_pid() {\n  local name=\"\\${1}\"\n  local pid=\"\\${2}\"\n  local pid_file=\"\\${3}\"\n  local local_port=\"\\${4}\"\n  echo \"\\${name}: stale pid file pointed at non-owned live pid \\${pid}; removing ownership record \\${pid_file}\"\n  rm -f \"\\${pid_file}\"\n\n  if is_port_accepting \"\\${local_port}\"; then\n    echo \"\\${name}: port occupied by non-owned process on local port \\${local_port}\"\n    return 1\n  fi\n\n  return 0\n}\n\nterminate_forward_process() {\n  local name=\"\\${1}\"\n  local pid=\"\\${2}\"\n  local namespace=\"\\${3}\"\n  local resource=\"\\${4}\"\n  local local_port=\"\\${5}\"\n  local remote_port=\"\\${6}\"\n\n  if [[ -z \"\\${pid}\" ]]; then\n    return 0\n  fi\n\n  if is_pid_running \"\\${pid}\" && ! is_owned_forward_process \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n    echo \"\\${name}: refusing to terminate non-owned live pid \\${pid}\"\n    return 1\n  fi\n\n  if is_pid_running \"\\${pid}\"; then\n    kill \"\\${pid}\" >/dev/null 2>&1 || true\n    for attempt in {1..20}; do\n      if ! is_pid_running \"\\${pid}\"; then\n        break\n      fi\n      sleep 0.25\n    done\n  fi\n\n  if is_pid_running \"\\${pid}\"; then\n    kill -KILL \"\\${pid}\" >/dev/null 2>&1 || true\n    for attempt in {1..20}; do\n      if ! is_pid_running \"\\${pid}\"; then\n        break\n      fi\n      sleep 0.25\n    done\n  fi\n\n  if is_pid_running \"\\${pid}\"; then\n    echo \"\\${name}: failed to stop owned port-forward pid \\${pid}\"\n    return 1\n  fi\n\n  for attempt in {1..20}; do\n    if ! is_port_accepting \"\\${local_port}\"; then\n      return 0\n    fi\n    sleep 0.25\n  done\n\n  echo \"\\${name}: owned port-forward pid \\${pid} stopped, but local port \\${local_port} is still accepting connections\"\n  return 1\n}\n\nstart_forward() {\n  local name=\"\\${1}\"\n  local pid_file\n  pid_file=\"$(pid_file_for \"\\${name}\")\"\n  read -r namespace resource local_port remote_port <<<\"$(target_for \"\\${name}\")\"\n\n  if [[ -f \"\\${pid_file}\" ]]; then\n    local existing_pid\n    existing_pid=\"$(cat \"\\${pid_file}\")\"\n    if is_pid_running \"\\${existing_pid}\"; then\n      if ! is_owned_forward_process \"\\${existing_pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n        handle_non_owned_forward_pid \"\\${name}\" \"\\${existing_pid}\" \"\\${pid_file}\" \"\\${local_port}\" || return 1\n      elif is_port_accepting \"\\${local_port}\"; then\n        echo \"\\${name}: running (pid \\${existing_pid})\"\n        return 0\n      else\n        echo \"\\${name}: stale running pid \\${existing_pid} was not accepting local port \\${local_port}; restarting\"\n        terminate_forward_process \"\\${name}\" \"\\${existing_pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\" || return 1\n        rm -f \"\\${pid_file}\"\n      fi\n    else\n      rm -f \"\\${pid_file}\"\n    fi\n  fi\n\n  if [[ \"\\${namespace}\" == \"${SUPABASE_NAMESPACE}\" && \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    echo \"\\${name}: skipped (Supabase Kubernetes disabled)\"\n    return 0\n  fi\n\n  if ! kubectl --context \"\\${PROFILE}\" -n \"\\${namespace}\" get \"\\${resource}\" >/dev/null 2>&1; then\n    echo \"\\${name}: target \\${namespace}/\\${resource} not found\"\n    return 1\n  fi\n\n  nohup kubectl --context \"\\${PROFILE}\" -n \"\\${namespace}\" port-forward \"\\${resource}\" \"\\${local_port}:\\${remote_port}\" >\"\\${STATE_DIR}/\\${PROFILE}-\\${name}.log\" 2>&1 &\n  local pid=\"$!\"\n  echo \"\\${pid}\" > \"\\${pid_file}\"\n\n  for attempt in {1..40}; do\n    if ! is_pid_running \"\\${pid}\"; then\n      echo \"\\${name}: failed to start local port \\${local_port} for \\${namespace}/\\${resource}:\\${remote_port}\"\n      print_forward_log_tail \"\\${name}\"\n      rm -f \"\\${pid_file}\"\n      return 1\n    fi\n    if is_port_accepting \"\\${local_port}\"; then\n      echo \"\\${name}: started (pid \\${pid}, local port \\${local_port})\"\n      return 0\n    fi\n    sleep 0.5\n  done\n\n  echo \"\\${name}: did not become ready on local port \\${local_port} for \\${namespace}/\\${resource}:\\${remote_port}\"\n  print_forward_log_tail \"\\${name}\"\n  terminate_forward_process \"\\${name}\" \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\" || return 1\n  rm -f \"\\${pid_file}\"\n  return 1\n}\n\nstop_forward() {\n  local name=\"\\${1}\"\n  local pid_file\n  pid_file=\"$(pid_file_for \"\\${name}\")\"\n  read -r namespace resource local_port remote_port <<<\"$(target_for \"\\${name}\")\"\n  if [[ ! -f \"\\${pid_file}\" ]]; then\n    echo \"\\${name}: stopped\"\n    return 0\n  fi\n\n  local pid\n  pid=\"$(cat \"\\${pid_file}\")\"\n  if is_pid_running \"\\${pid}\" && ! is_owned_forward_process \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n    handle_non_owned_forward_pid \"\\${name}\" \"\\${pid}\" \"\\${pid_file}\" \"\\${local_port}\" || return 1\n    echo \"\\${name}: stopped\"\n    return 0\n  fi\n\n  terminate_forward_process \"\\${name}\" \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\" || return 1\n  rm -f \"\\${pid_file}\"\n  echo \"\\${name}: stopped\"\n}\n\nstatus_forward() {\n  local name=\"\\${1}\"\n  local pid_file\n  pid_file=\"$(pid_file_for \"\\${name}\")\"\n  if [[ ! -f \"\\${pid_file}\" ]]; then\n    echo \"\\${name}: stopped\"\n    return 0\n  fi\n\n  local pid\n  pid=\"$(cat \"\\${pid_file}\")\"\n  if is_pid_running \"\\${pid}\"; then\n    read -r namespace resource local_port remote_port <<<\"$(target_for \"\\${name}\")\"\n    if ! is_owned_forward_process \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n      echo \"\\${name}: stale_pid_non_owned=\\${pid}\"\n      rm -f \"\\${pid_file}\"\n      return 0\n    fi\n    if is_port_accepting \"\\${local_port}\"; then\n      echo \"\\${name}: running pid=\\${pid} url=127.0.0.1:\\${local_port} target=\\${namespace}/\\${resource}:\\${remote_port}\"\n      return 0\n    fi\n    echo \"\\${name}: not ready pid=\\${pid} url=127.0.0.1:\\${local_port} target=\\${namespace}/\\${resource}:\\${remote_port}\"\n    return 0\n  fi\n\n  echo \"\\${name}: crashed stale_pid=\\${pid}\"\n  rm -f \"\\${pid_file}\"\n}\n\nfor_each_forward() {\n  local action=\"\\${1}\"\n  \"\\${action}_forward\" app\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n    \"\\${action}_forward\" supabase-gateway\n    \"\\${action}_forward\" studio\n    \"\\${action}_forward\" db-migration\n  fi\n}\n\nACTION=\"\\${1:-start}\"\nNAME=\"\\${2:-all}\"\n\ncase \"\\${ACTION}:\\${NAME}\" in\n  start:all) for_each_forward start ;;\n  stop:all) for_each_forward stop ;;\n  status:all) for_each_forward status ;;\n  start:*) start_forward \"\\${NAME}\" ;;\n  stop:*) stop_forward \"\\${NAME}\" ;;\n  status:*) status_forward \"\\${NAME}\" ;;\n  *)\n    echo \"Usage: ./scripts/port-forward.sh {start|stop|status} {app|supabase-gateway|studio|db-migration|all}\"\n    exit 1\n    ;;\nesac\n`;\n}\n\nfunction getDownScript(appSlug: string): string {\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" stop all >/dev/null || true\n\nif command -v minikube >/dev/null 2>&1; then\n  minikube stop -p \"\\${PROFILE}\"\nelse\n  echo \"minikube is required but not installed.\"\n  exit 1\nfi\n\necho \"Stopped Minikube profile '\\${PROFILE}'. Persistent data remains in the profile.\"\n`;\n}\n\nfunction getResetScript(args: {\n  appSlug: string;\n  supabaseKubernetesEnabled: boolean;\n  providerNamespaces: readonly string[];\n}): string {\n  const { appSlug, supabaseKubernetesEnabled, providerNamespaces } = args;\n  const resetNamespaces = [\n    APP_NAMESPACE,\n    ...(supabaseKubernetesEnabled ? [SUPABASE_NAMESPACE] : []),\n    ...providerNamespaces,\n  ];\n  const resetNamespaceCommands = resetNamespaces\n    .map(\n      (\n        namespace,\n      ) => `kubectl --context \"\\${PROFILE}\" delete namespace ${namespace} --ignore-not-found\nkubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/namespaces/${namespace}.yaml\"`,\n    )\n    .join('\\n');\n  const resetScope = `Kubernetes namespaces ${resetNamespaces.join(', ')}`;\n  const resetDataDescription = `reset.sh deletes and recreates namespaces ${resetNamespaces.join(\n    ', ',\n  )}. This resets app workloads and provider-owned data in those namespaces. It does not delete the Minikube profile.`;\n  const completionDescription = `Reset namespaces ${resetNamespaces.join(', ')}`;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nK8S_DIR=\"\\${ROOT_DIR}/k8s\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nCONFIRM=\"\\${ANKH_RESET_CONFIRM:-}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\nif [[ \"\\${CONFIRM}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"Refusing reset. Set ANKH_RESET_CONFIRM=\\${APP_SLUG} to reset ${resetScope} inside profile '\\${PROFILE}'.\"\n  echo \"${resetDataDescription}\"\n  exit 1\nfi\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"kubectl is required but not installed.\"\n  exit 1\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" stop all >/dev/null || true\n${resetNamespaceCommands}\necho \"${completionDescription} for profile '\\${PROFILE}'. Run ./scripts/up.sh to recreate runtime secrets, migrations, forwards, and app rollout.\"\n`;\n}\n\nfunction getDestroyScript(appSlug: string): string {\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" stop all >/dev/null || true\nminikube delete -p \"\\${PROFILE}\"\necho \"Deleted Minikube profile '\\${PROFILE}'.\"\n`;\n}\n\nfunction getStatusScript(args: {\n  appSlug: string;\n  supabaseKubernetesEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n  supabaseHostPorts: SupabaseHostPorts;\n  providerNamespaces: readonly string[];\n  providerLifecycle: readonly MinikubeProviderLifecycle[];\n}): string {\n  const {\n    appSlug,\n    supabaseKubernetesEnabled,\n    profileModel,\n    supabaseHostPorts,\n    providerNamespaces,\n    providerLifecycle,\n  } = args;\n  const namespaces = [\n    APP_NAMESPACE,\n    ...(supabaseKubernetesEnabled ? [SUPABASE_NAMESPACE] : []),\n    ...providerNamespaces,\n  ].join(' ');\n  const providerStatusScript = getProviderStatusScript(providerLifecycle);\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nSUPABASE_PROFILE_ENABLED=\"${profileModel.enabled ? 'true' : 'false'}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\necho \"Infra status for profile: \\${PROFILE}\"\n\nif ! command -v minikube >/dev/null 2>&1; then\n  echo \"- minikube: missing\"\n  exit 1\nfi\n\nHOST_STATUS=\"$(minikube -p \"\\${PROFILE}\" status --format='{{.Host}}' 2>/dev/null || true)\"\necho \"- minikube host: \\${HOST_STATUS:-missing}\"\n\nif [[ \"\\${HOST_STATUS}\" != \"Running\" ]]; then\n  echo \"- cluster: stopped\"\n  \"\\${SCRIPT_DIR}/port-forward.sh\" status all || true\n  exit 0\nfi\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"- kubectl: missing\"\n  exit 1\nfi\n\ncheck_secret_key() {\n  local secret=\"\\${1}\"\n  local key=\"\\${2}\"\n  local encoded\n  encoded=\"$(kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} get secret \"\\${secret}\" -o \"jsonpath={.data.\\${key}}\" 2>/dev/null || true)\"\n  if [[ -n \"\\${encoded}\" ]]; then\n    echo \"- secret/\\${secret}:\\${key}: present\"\n  else\n    echo \"- secret/\\${secret}:\\${key}: missing\"\n  fi\n}\n\npostgres_query() {\n  local sql=\"\\${1}\"\n  kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} exec deployment/postgres -- psql -U postgres -d postgres -Atq -c \"\\${sql}\" 2>/dev/null || true\n}\n\nfor namespace in ${namespaces}; do\n  if kubectl --context \"\\${PROFILE}\" get namespace \"\\${namespace}\" >/dev/null 2>&1; then\n    echo \"- namespace/\\${namespace}: present\"\n    kubectl --context \"\\${PROFILE}\" -n \"\\${namespace}\" get pods\n  else\n    echo \"- namespace/\\${namespace}: missing\"\n  fi\ndone\n\nif kubectl --context \"\\${PROFILE}\" -n ${APP_NAMESPACE} get deployment app-runtime >/dev/null 2>&1; then\n  kubectl --context \"\\${PROFILE}\" -n ${APP_NAMESPACE} rollout status deployment/app-runtime --timeout=5s >/dev/null 2>&1 && echo \"- app-runtime: ready\" || echo \"- app-runtime: not ready\"\nfi\n\n${providerStatusScript}\n\nif [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n  for deployment in postgres auth rest realtime storage gateway studio; do\n    if kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} get deployment \"\\${deployment}\" >/dev/null 2>&1; then\n      kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} rollout status \"deployment/\\${deployment}\" --timeout=5s >/dev/null 2>&1 && echo \"- supabase/\\${deployment}: ready\" || echo \"- supabase/\\${deployment}: not ready\"\n    else\n      echo \"- supabase/\\${deployment}: missing\"\n    fi\n  done\n\n  for key in POSTGRES_PASSWORD JWT_SECRET SUPABASE_ANON_KEY SUPABASE_SERVICE_ROLE_KEY SECRET_KEY_BASE REALTIME_DB_ENC_KEY PG_META_CRYPTO_KEY; do\n    check_secret_key supabase-runtime-secrets \"\\${key}\"\n  done\n\n  db_check=\"$(postgres_query 'select 1')\"\n  if [[ \"\\${db_check}\" == \"1\" ]]; then\n    echo \"- postgres connectivity: ok\"\n  else\n    echo \"- postgres connectivity: failed\"\n  fi\n\n  migration_count=\"$(postgres_query \"select count(*) from supabase_migrations.schema_migrations\" || true)\"\n  if [[ \"\\${migration_count}\" =~ ^[0-9]+$ ]]; then\n    echo \"- migration history: \\${migration_count} applied\"\n  else\n    echo \"- migration history: unavailable\"\n  fi\n\n  if [[ \"\\${SUPABASE_PROFILE_ENABLED}\" == \"true\" ]]; then\n    profile_state=\"$(postgres_query \"select count(*) from ankhorage_internal.generated_schema_state where artifact_key = 'auth.profile'\" || true)\"\n    if [[ \"\\${profile_state}\" =~ ^[1-9][0-9]*$ ]]; then\n      echo \"- profile reconciliation: applied\"\n    else\n      echo \"- profile reconciliation: missing\"\n    fi\n  else\n    state_table=\"$(postgres_query \"select to_regclass('ankhorage_internal.generated_schema_state') is not null\" || true)\"\n    if [[ \"\\${state_table}\" != \"t\" ]]; then\n      echo \"- profile reconciliation: disabled\"\n    else\n      profile_state=\"$(postgres_query \"select coalesce((select case when table_name is null then 'stale-state-missing-table-name' when to_regclass(format('public.%I', table_name)) is null then 'stale-state-missing-table:' || table_name else 'stale-state-table-present:' || table_name end from ankhorage_internal.generated_schema_state where artifact_key = 'auth.profile'), 'disabled')\" || true)\"\n      if [[ \"\\${profile_state}\" == \"disabled\" ]]; then\n        echo \"- profile reconciliation: disabled\"\n      else\n        echo \"- profile reconciliation: unexpected \\${profile_state}\"\n      fi\n    fi\n  fi\n\n  vault_state=\"$(postgres_query \"select exists(select 1 from pg_namespace where nspname = 'vault')\" || true)\"\n  if [[ \"\\${vault_state}\" == \"t\" ]]; then\n    echo \"- vault schema: present\"\n  else\n    echo \"- vault schema: absent\"\n  fi\n\n  if command -v curl >/dev/null 2>&1; then\n    public_url=\"\\${SUPABASE_PUBLIC_URL:-http://127.0.0.1:\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT}}\"\n    if curl -fsS \"\\${public_url}/auth/v1/health\" >/dev/null 2>&1; then\n      echo \"- supabase public endpoint: ok (\\${public_url})\"\n    else\n      echo \"- supabase public endpoint: unavailable (\\${public_url})\"\n    fi\n  fi\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" status all || true\n`;\n}\n\nfunction getDefaultAppImage(appSlug: string): string {\n  return `ankh/${appSlug}:dev`;\n}\n\nfunction resolveSupabaseHostPorts(appSlug: string): SupabaseHostPorts {\n  const base = PORT_BASE + resolvePortBucket(appSlug) * PORT_BUCKET_SIZE;\n  return {\n    app: base,\n    gateway: base + 1,\n    studio: base + 2,\n    db: base + 3,\n  };\n}\n\nfunction resolvePortBucket(appSlug: string): number {\n  const rawBucket = hashSlug(appSlug) - hashSlug(PORT_REFERENCE_SLUG);\n  return (rawBucket + PORT_BUCKET_COUNT) % PORT_BUCKET_COUNT;\n}\n\nfunction hashSlug(value: string): number {\n  let hash = 0;\n  for (const char of value) {\n    hash = (hash * 31 + char.charCodeAt(0)) % PORT_BUCKET_COUNT;\n  }\n  return hash;\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAGvE,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAkCtC,MAAM,eAAe,GAAsB;IACzC,QAAQ,EAAE,8BAA8B;IACxC,IAAI,EAAE,0BAA0B;IAChC,IAAI,EAAE,4BAA4B;IAClC,QAAQ,EAAE,4BAA4B;IACtC,OAAO,EAAE,8BAA8B;IACvC,QAAQ,EAAE,2BAA2B;IACrC,IAAI,EAAE,gCAAgC;IACtC,OAAO,EAAE,iBAAiB;IAC1B,MAAM,EAAE,wCAAwC;CACjD,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,UAAU,6BAA6B,CAAC,IAO7C;IACC,MAAM,EACJ,QAAQ,EACR,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAChB,GAAG,IAAI,CAAC;IAET,MAAM,IAAI,GAAG,gBAAgB,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC;IAC9B,MAAM,WAAW,GAAG,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,YAAY,GAAG,GAAG,IAAI,YAAY,CAAC;IACzC,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC;IACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,MAAM,CAAC;IACnE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,CAAC;IAC/D,MAAM,mBAAmB,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,IAAI,MAAM,CAAC;IACrE,MAAM,eAAe,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,QAAQ,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC;IACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;IACjD,MAAM,yBAAyB,GAC7B,YAAY,KAAK,UAAU;QAC3B,gBAAgB,KAAK,UAAU;QAC/B,eAAe,KAAK,IAAI;QACxB,mBAAmB,KAAK,gBAAgB,CAAC;IAE3C,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,kBAAkB,GAAG;QACzB,qBAAqB;QACrB,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,SAAS,OAAO,CAAC;KACzE,CAAC;IAEF,OAAO;QACL;YACE,IAAI,EAAE,GAAG,IAAI,YAAY;YACzB,OAAO,EAAE,iBAAiB,CAAC;gBACzB,OAAO;gBACP,eAAe;gBACf,iBAAiB;gBACjB,YAAY;gBACZ,WAAW;gBACX,cAAc;gBACd,iBAAiB;gBACjB,yBAAyB;gBACzB,YAAY;gBACZ,cAAc;gBACd,kBAAkB;gBAClB,iBAAiB;aAClB,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,IAAI,eAAe;YAC5B,OAAO,EAAE,aAAa,CAAC;gBACrB,OAAO;gBACP,MAAM;gBACN,eAAe;gBACf,eAAe;gBACf,iBAAiB;gBACjB,yBAAyB;gBACzB,cAAc;aACf,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,OAAO,sBAAsB;YACtC,OAAO,EAAE,oBAAoB,CAAC,aAAa,CAAC;SAC7C;QACD,GAAG,CAAC,yBAAyB;YAC3B,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,GAAG,OAAO,2BAA2B;oBAC3C,OAAO,EAAE,oBAAoB,CAAC,kBAAkB,CAAC;iBAClD;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,GAAG,OAAO,eAAe,SAAS,OAAO;YAC/C,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;QACH;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,eAAe,CAAC;gBACvB,OAAO;gBACP,SAAS;gBACT,YAAY;gBACZ,gBAAgB;gBAChB,mBAAmB;gBACnB,eAAe;gBACf,iBAAiB;gBACjB,MAAM;aACP,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,OAAO,sBAAsB;YACtC,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC;SACnD;QACD;YACE,IAAI,EAAE,GAAG,OAAO,mBAAmB;YACnC,OAAO,EAAE,qBAAqB,EAAE;SACjC;QACD,GAAG,iBAAiB;QACpB;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,wBAAwB,CAAC;gBAChC,kBAAkB;gBAClB,eAAe,EAAE,yBAAyB;gBAC1C,cAAc;aACf,CAAC;SACH;QACD;YACE,IAAI,EAAE,GAAG,WAAW,QAAQ;YAC5B,OAAO,EAAE,WAAW,CAAC;gBACnB,OAAO;gBACP,eAAe;gBACf,yBAAyB;gBACzB,YAAY;gBACZ,mBAAmB;gBACnB,iBAAiB;gBACjB,cAAc;gBACd,iBAAiB;aAClB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,qBAAqB;YACzC,OAAO,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YAC7D,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,kBAAkB;YACtC,OAAO,EAAE,oBAAoB,CAAC;gBAC5B,OAAO;gBACP,yBAAyB;gBACzB,iBAAiB;aAClB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,UAAU;YAC9B,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,WAAW;YAC/B,OAAO,EAAE,cAAc,CAAC;gBACtB,OAAO;gBACP,yBAAyB;gBACzB,kBAAkB;aACnB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,aAAa;YACjC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;YAClC,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,WAAW,YAAY;YAChC,OAAO,EAAE,eAAe,CAAC;gBACvB,OAAO;gBACP,yBAAyB;gBACzB,YAAY;gBACZ,iBAAiB;gBACjB,kBAAkB;gBAClB,iBAAiB;aAClB,CAAC;YACF,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,YAAY,aAAa;YAClC,OAAO,EAAE,qBAAqB,EAAE;SACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAa1B;IACC,MAAM,EACJ,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,MAAM,aAAa,GAAG;QACpB,qBAAqB;QACrB,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,SAAS,OAAO,CAAC;QACxE,oBAAoB;QACpB,qBAAqB;QACrB,kBAAkB;QAClB,GAAG,CAAC,yBAAyB;YAC3B,CAAC,CAAC;gBACE,wBAAwB;gBACxB,uCAAuC;gBACvC,4BAA4B;gBAC5B,wBAAwB;gBACxB,oBAAoB;gBACpB,oBAAoB;gBACpB,wBAAwB;gBACxB,uBAAuB;gBACvB,wBAAwB;gBACxB,oBAAoB;gBACpB,+BAA+B;gBAC/B,6BAA6B;gBAC7B,uBAAuB;gBACvB,sBAAsB;aACvB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,cAAc;KAClB;SACE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,QAAQ,IAAI,CAAC;SAC1C,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,eAAe,GAAG;QACtB,aAAa;QACb,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,kBAAkB;KACtB,CAAC;IACF,MAAM,gBAAgB,GAAG,oCAAoC,eAAe;SACzE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,IAAI,CAAC;SACtC,IAAI,CACH,IAAI,CACL,wHAAwH,CAAC;IAC5H,MAAM,qBAAqB,GACzB,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,4BAA4B,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QACnE,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,sBAAsB,GAC1B,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,4CAA4C,iBAAiB;aAC1D,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChB,MAAM,SAAS,GACb,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,QAAQ,CAAC,eAAe;qBACrB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,QAAQ,qBAAqB,KAAK,CAAC,SAAS,IAAI,CAAC;qBAC3E,IAAI,CAAC,IAAI,CAAC;gBACf,CAAC,CAAC,MAAM,CAAC;YACb,MAAM,SAAS,GACb,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,CAAC,QAAQ,CAAC,SAAS;qBACf,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,IAAI,UAAU,QAAQ,CAAC,GAAG,IAAI,CAAC;qBAC/D,IAAI,CAAC,IAAI,CAAC;gBACf,CAAC,CAAC,MAAM,CAAC;YACb,OAAO,OAAO,QAAQ,CAAC,EAAE,mBAAmB,QAAQ,CAAC,SAAS,iBAAiB,SAAS,eAAe,SAAS,EAAE,CAAC;QACrH,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,IAAI;QACnB,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,gBAAgB,GACpB,cAAc,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,mPAAmP;QACrP,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;;;;;;mCAM0B,OAAO;6BACb,aAAa;0BAChB,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ;EACjF,qBAAqB,0BAA0B,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA4B5B,OAAO;0EAC+B,OAAO;gDACjC,OAAO,OAAO,gBAAgB;+CAC/B,OAAO;;;;EAIpD,aAAa;;;;;;;;;;;;EAYb,gBAAgB;;;;gBAIF,eAAe,CAAC,QAAQ;YAC5B,eAAe,CAAC,IAAI;iBACf,eAAe,CAAC,IAAI;gBACrB,eAAe,CAAC,QAAQ;eACzB,eAAe,CAAC,OAAO;eACvB,eAAe,CAAC,OAAO;cACxB,eAAe,CAAC,MAAM;;;;4BAIR,iBAAiB,CAAC,GAAG;yCACR,iBAAiB,CAAC,OAAO;+BACnC,iBAAiB,CAAC,MAAM;uCAChB,iBAAiB,CAAC,EAAE;;;;4BAI/B,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;qBAC3C,YAAY;4BACL,WAAW;EACrC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,iKAAiK,CAAC,CAAC,CAAC,EAAE;EAC7L,sBAAsB;CACvB,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAQtB;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAC5F,IAAI,CAAC;IAEP,MAAM,WAAW,GAAG;QAClB,4CAA4C;QAC5C,iBAAiB,OAAO,EAAE;QAC1B,wBAAwB;QACxB,wBAAwB;QACxB,iBAAiB;QACjB,qCAAqC;QACrC,aAAa,eAAe,EAAE;QAC9B,qCAAqC;QACrC,mCAAmC;QACnC,iCAAiC;QACjC,+BAA+B;QAC/B,+BAA+B,iBAAiB,CAAC,GAAG,EAAE;QACtD,iCAAiC;QACjC,uCAAuC,iBAAiB,CAAC,OAAO,EAAE;QAClE,2CAA2C;QAC3C,sCAAsC,iBAAiB,CAAC,MAAM,EAAE;QAChE,0CAA0C;QAC1C,kCAAkC,iBAAiB,CAAC,EAAE,EAAE;QACxD,sCAAsC;QACtC,gBAAgB;QAChB,gCAAgC;QAChC,EAAE;QACF,gDAAgD;QAChD,6BAA6B;QAC7B,sCAAsC;QACtC,iCAAiC;QACjC,iCAAiC;QACjC,8BAA8B;QAC9B,EAAE;QACF,kCAAkC;QAClC,cAAc,MAAM,EAAE;QACtB,EAAE;QACF,uCAAuC;QACvC,oBAAoB;QACpB,aAAa;QACb,oBAAoB;QACpB,4BAA4B;QAC5B,2BAA2B;QAC3B,sBAAsB;QACtB,6BAA6B;QAC7B,qBAAqB;QACrB,kBAAkB;QAClB,sBAAsB;QACtB,qBAAqB;QACrB,4BAA4B;QAC5B,gCAAgC;QAChC,iBAAiB;QACjB,WAAW;QACX,6BAA6B;QAC7B,2BAA2B;QAC3B,sBAAsB;QACtB,mBAAmB;QACnB,0BAA0B;QAC1B,+BAA+B;QAC/B,oCAAoC;QACpC,qBAAqB;QACrB,gBAAgB;QAChB,YAAY;QACZ,YAAY;QACZ,4BAA4B;QAC5B,gDAAgD;QAChD,wBAAwB;QACxB,mCAAmC;QACnC,uBAAuB;QACvB,wBAAwB;QACxB,aAAa;QACb,kBAAkB;QAClB,2BAA2B;QAC3B,gCAAgC;QAChC,GAAG,yBAAyB,CAAC,cAAc,CAAC;QAC5C,EAAE;QACF,iCAAiC;KAClC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAkD;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO;QACL,EAAE;QACF,8EAA8E;QAC9E,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,KAAK,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,cAAc,EAAE;YAC9C,mBAAmB,QAAQ,CAAC,SAAS,aAAa;YAClD,mBAAmB,QAAQ,CAAC,SAAS,UAAU;YAC/C,mBAAmB,QAAQ,CAAC,SAAS,gBAAgB;SACtD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAkD;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,SAAS;SACb,GAAG,CACF,CACE,QAAQ,EACR,EAAE,CAAC,4BAA4B,QAAQ,CAAC,SAAS,kCAAkC,QAAQ,CAAC,SAAS;2BAClF,QAAQ,CAAC,SAAS,+BAA+B,QAAQ,CAAC,SAAS;2BACnE,QAAQ,CAAC,SAAS,qCAAqC,QAAQ,CAAC,SAAS,gDAAgD,CAC/I;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CAAC,SAAkD;IACpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,SAAS;SACb,GAAG,CACF,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,QAAQ,CAAC,SAAS;kBACvC,QAAQ,CAAC,SAAS,iCAAiC,QAAQ,CAAC,SAAS;kBACrE,QAAQ,CAAC,SAAS,8BAA8B,QAAQ,CAAC,SAAS;kBAClE,QAAQ,CAAC,SAAS,oCAAoC,QAAQ,CAAC,SAAS,gBAAgB,CACrG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,+BAA+B,CACtC,SAAkD;IAElD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,SAAS;SACrB,GAAG,CACF,CACE,QAAQ,EACR,EAAE,CAAC,kCAAkC,QAAQ,CAAC,SAAS,4CAA4C,QAAQ,CAAC,SAAS;2BAClG,QAAQ,CAAC,EAAE,oDAAoD,QAAQ,CAAC,SAAS,kCAAkC,QAAQ,CAAC,SAAS,+BAA+B,QAAQ,CAAC,cAAc;;KAEjN,CACA;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;EAEP,MAAM,EAAE,CAAC;AACX,CAAC;AAED,SAAS,6BAA6B,CAAC,SAAkD;IACvF,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,IAAI,gBAAgB,CAAC;AACzD,CAAC;AAED,SAAS,6BAA6B,CAAC,IAItC;IACC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IAC9D,IAAI,mBAAmB,KAAK,gBAAgB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO;;;;CAIV,CAAC;IACA,CAAC;IAED,MAAM,KAAK,GAAG,cAAc;SACzB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,mBAAmB,QAAQ,CAAC,SAAS,YAAY,CAAC;QAChE,MAAM,SAAS,GAAG,mBAAmB,QAAQ,CAAC,SAAS,SAAS,CAAC;QAEjE,OAAO,kBAAkB,KAAK,kBAAkB,SAAS;;wDAEP,GAAG;4DACC,GAAG;;eAEhD,KAAK;;;eAGL,SAAS;;KAEnB,CAAC;IACF,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;iSAIwR,qBAAqB,CAClT,OAAO,CACR;;;;;;;;EAQD,KAAK;;CAEN,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,gCAAgC,CACvC,iBAAuD;IAEvD,OAAO,GAAG,mCAAmC,CAAC;QAC5C,YAAY,EAAE,yBAAyB;QACvC,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,CACJ;KACF,CAAC;;EAEF,mCAAmC,CAAC;QACpC,YAAY,EAAE,6BAA6B;QAC3C,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAChD,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,CACJ;KACF,CAAC;;EAEA,4BAA4B,CAAC,iBAAiB,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,mCAAmC,CAAC,IAI5C;IACC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,GAAG,IAAI,CAAC,YAAY;IAC3B,IAAI,CAAC,WAAW;EAClB,CAAC;IACD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ;SACvB,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,uBAAuB,CAC9D,OAAO,CAAC,UAAU,CACnB,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC;EAC/C,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAC1C;SACA,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,OAAO,GAAG,IAAI,CAAC,YAAY;EAC3B,IAAI;EACJ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,iBAAuD;IAEvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpD,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CACjF,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;;EAET,CAAC;IACD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM;SAChB,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,yCAAyC,uBAAuB,CAC9D,KAAK,CAAC,SAAS,CAChB,qBAAqB,uBAAuB,CAC3C,KAAK,CAAC,QAAQ,CACf,eAAe,KAAK,CAAC,cAAc,GAAG,CAC1C;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;EACP,IAAI;EACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,iBAAuD;IACtF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,iBAAiB;SACrB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS;aACrC,GAAG,CACF,CAAC,QAAQ,EAAE,EAAE,CACX,sBAAsB,uBAAuB,CAC3C,QAAQ,CAAC,EAAE,CACZ,aAAa,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,uBAAuB,CAC9E,QAAQ,CAAC,GAAG,CACb,GAAG,CACP;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe;aAC5C,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC,4CAA4C,uBAAuB,CAC5E,KAAK,CAAC,SAAS,CAChB,qBAAqB,uBAAuB,CAC3C,KAAK,CAAC,QAAQ,CACf;uBACY,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,uBAAuB,CAChF,KAAK,CAAC,KAAK,CACZ;;uBAEkB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,uBAAuB,CAChF,KAAK,CAAC,KAAK,CACZ;KACA,CACI;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,iBAAiB,GAAG,QAAQ,CAAC,YAAY;aAC5C,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC,4BAA4B,uBAAuB,CAC5D,QAAQ,CAAC,EAAE,CACZ,iBAAiB,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC;EAC9D,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CACpC;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,CAAC,aAAa,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,OAAO;;;UAGC,SAAS;;;mCAGgB,SAAS;CAC3C,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IASxB;IACC,MAAM,EACJ,OAAO,EACP,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,MAAM,GACP,GAAG,IAAI,CAAC;IAET,MAAM,YAAY,GAAG,eAAe;QAClC,CAAC,CAAC,wBAAwB,eAAe,CAAC,QAAQ;sBAChC,sBAAsB,CAAC,eAAe,CAAC,UAAU,CAAC;6BAC3C,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC;CACjF;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;eAIM,aAAa;;oBAER,OAAO;;oBAEP,aAAa;yBACR,kBAAkB;yBAClB,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;iBAC5C,SAAS;oBACN,YAAY;wBACR,gBAAgB;4BACZ,mBAAmB;EAC7C,YAAY,sBAAsB,sBAAsB,CAAC,MAAM,CAAC;CACjE,CAAC;AACF,CAAC;AAED,SAAS,8BAA8B,CACrC,QAA4B;IAE5B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IAChC,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,aAAa;SACd,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,uBAAuB,GAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU,CAAC;QAEvF,IAAI,CAAC,uBAAuB;YAAE,OAAO,IAAI,CAAC;QAE1C,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,aAAa;SACd,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,6BAA6B,CACpC,QAA4B;IAE5B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,aAAa,GAAG,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEvE,OAAO,KAAK,CAAC,SAAS;SACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC;SAChD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,kDAAkD,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,SAAS,GAAG,EAAE;aACjB,WAAW,EAAE;aACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;QACzF,CAAC;QAED,OAAO;YACL,EAAE;YACF,SAAS;YACT,cAAc;YACd,aAAa;SACd,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,2BAA2B,CAAC,QAA4B;IAC/D,MAAM,YAAY,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACxF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;IACrE,OAAO,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,UAA6B;IACrD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAIjC;IACC,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe;QAC5C,CAAC,CAAC;YACE,uCAAuC;YACvC,4BAA4B;YAC5B,wBAAwB;YACxB,oBAAoB;YACpB,oBAAoB;YACpB,wBAAwB;YACxB,wBAAwB;YACxB,uBAAuB;YACvB,oBAAoB;YACpB,uBAAuB;YACvB,sBAAsB;SACvB;QACH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,SAAS,GAAG;QAChB,GAAG,IAAI,CAAC,kBAAkB;QAC1B,oBAAoB;QACpB,qBAAqB;QACrB,kBAAkB;QAClB,GAAG,iBAAiB;QACpB,GAAG,IAAI,CAAC,cAAc;KACvB,CAAC;IACF,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhF,OAAO;;;EAGP,aAAa;CACd,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,eAAuB;IACvD,OAAO;;;;eAIM,aAAa;;;;;;;;;;;;;;;mBAeT,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BjC,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;;;;eAIM,aAAa;;;;;;;;;;;CAW3B,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,OAAO;QACL;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,wCAAwC;YACxD,OAAO,EAAE,gCAAgC,EAAE;SAC5C;QACD;YACE,IAAI,EAAE,GAAG,OAAO,6BAA6B;YAC7C,OAAO,EAAE,sBAAsB,CAAC,wBAAwB,EAAE,MAAM,CAAC;SAClE;QACD;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,2BAA2B,EAAE;SACvC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,2BAA2B,EAAE;SACvC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,wBAAwB;YACxC,OAAO,EAAE,0BAA0B,EAAE;SACtC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,yBAAyB;YACzC,OAAO,EAAE,2BAA2B,EAAE;SACvC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,qBAAqB;YACrC,OAAO,EAAE,uBAAuB,EAAE;SACnC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,gCAAgC;YAChD,OAAO,EAAE,0BAA0B,EAAE;SACtC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,8BAA8B;YAC9C,OAAO,EAAE,+BAA+B,EAAE;YAC1C,UAAU,EAAE,IAAI;SACjB;QACD;YACE,IAAI,EAAE,GAAG,OAAO,wBAAwB;YACxC,OAAO,EAAE,0BAA0B,EAAE;SACtC;QACD;YACE,IAAI,EAAE,GAAG,OAAO,uBAAuB;YACvC,OAAO,EAAE,yBAAyB,EAAE;SACrC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsER,CAAC;AACF,CAAC;AAED,SAAS,gCAAgC;IACvC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;CAShC,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAY;IACxD,OAAO;;;UAGC,IAAI;eACC,kBAAkB;;;;;;iBAMhB,IAAI;CACpB,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmE1C,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFAiC8C,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEtG,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,IAAI;;;;;;;+EAOwC,kBAAkB;;;;;;;;;;;;;;;;;;;;CAoBhG,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,QAAQ;;;;;;;;;iCASV,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0ClD,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO,GAAG,sBAAsB,CAAC,uBAAuB,EAAE,MAAM,CAAC;;;;;;eAMpD,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;wFAsB8C,kBAAkB;;oCAEtE,kBAAkB;;;;;;;;;;;;;;;;;;;;;wCAqBd,kBAAkB;;;;;;;;;;;;;CAazD,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,QAAQ;;;;;;;;CAQ1C,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,IAAI;;;;;;;;;iCASN,kBAAkB;;;;;;;;;;;;;;;;;CAiBlD,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA2Bc,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;uBAQlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;uBAuBlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;uBAuBlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;2BAwBd,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;2BAwBlB,kBAAkB;;;;;;;;;;;;2BAYlB,kBAAkB;;;;;;;;;;;;2BAYlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;0BAwBnB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;uBAwBrB,kBAAkB;;;;;;;;;;;;;;yBAchB,kBAAkB;;;;;;;;;;CAU1C,CAAC;AACF,CAAC;AAED,SAAS,+BAA+B;IACtC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BR,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDzC,CAAC;AACF,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO;;;;eAIM,kBAAkB;;;;;;;;;;;;;eAalB,kBAAkB;;;;;;;;;;;;;mBAad,eAAe,CAAC,MAAM;;;;;;;;;oCASL,kBAAkB;;uCAEf,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BxD,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,IASpB;IACC,MAAM,EACJ,OAAO,EACP,eAAe,EACf,yBAAyB,EACzB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,uBAAuB,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,cAAc,CAAC,CAAC;IACzE,MAAM,6BAA6B,GAAG,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;IAC1F,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;QACzD,OAAO;QACP,cAAc;QACd,mBAAmB;KACpB,CAAC,CAAC;IAEH,OAAO;;;;;;;;YAQG,OAAO;;;iBAGF,aAAa;sBACR,kBAAkB;4BACZ,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;4BAiB5C,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAwJzC,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0GAoD8D,iBAAiB,CAAC,OAAO;0FACzC,iBAAiB,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;gGAoBf,iBAAiB,CAAC,EAAE;;;;EAIlH,gBAAgB;;EAEhB,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BpB,uBAAuB;;;;;;;;8BAQK,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmJ9C,6BAA6B;;;4BAGH,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;6BAC3C,OAAO;;;;;2BAKT,eAAe;;;;;;;;;+DASqB,iBAAiB,CAAC,GAAG;+EACL,iBAAiB,CAAC,OAAO;qEACnC,iBAAiB,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCvF,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiGhB,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAkD;IAChF,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAE1C,OAAO;;;;;;YAMG,OAAO;;;;;;;;;6BASU,OAAO;;;;2BAIT,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDzC,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;;;;;;;;;;;;;;;;;;;;;CAqBR,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,IAI7B;IACC,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEvE,OAAO;;;;;;YAMG,OAAO;6BACU,OAAO;4BACR,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;+DACT,iBAAiB,CAAC,GAAG;;+EAEL,iBAAiB,CAAC,OAAO;;6EAE3B,iBAAiB,CAAC,MAAM;;qEAEhC,iBAAiB,CAAC,EAAE;;;;;;;;;4BAS7D,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;cAqB1D,aAAa;;;cAGb,kBAAkB;;;cAGlB,kBAAkB;;;cAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA8JF,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiH/C,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO;;;;;YAKG,OAAO;6BACU,OAAO;;;;;;;;;;;;;;;;;;;;;;;;CAwBnC,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,IAIvB;IACC,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IACxE,MAAM,eAAe,GAAG;QACtB,aAAa;QACb,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,kBAAkB;KACtB,CAAC;IACF,MAAM,sBAAsB,GAAG,eAAe;SAC3C,GAAG,CACF,CACE,SAAS,EACT,EAAE,CAAC,oDAAoD,SAAS;mEACL,SAAS,QAAQ,CAC/E;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,UAAU,GAAG,yBAAyB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACzE,MAAM,oBAAoB,GAAG,6CAA6C,eAAe,CAAC,IAAI,CAC5F,IAAI,CACL,mHAAmH,CAAC;IACrH,MAAM,qBAAqB,GAAG,oBAAoB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAE/E,OAAO;;;;;;YAMG,OAAO;6BACU,OAAO;;;;;;;;;;;;;;;;uEAgBmC,UAAU;UACvE,oBAAoB;;;;;;;;;;EAU5B,sBAAsB;QAChB,qBAAqB;CAC5B,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO;;;;;YAKG,OAAO;6BACU,OAAO;;;;;;;;;;;;;;;;;CAiBnC,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IAOxB;IACC,MAAM,EACJ,OAAO,EACP,yBAAyB,EACzB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,MAAM,UAAU,GAAG;QACjB,aAAa;QACb,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,kBAAkB;KACtB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAExE,OAAO;;;;;YAKG,OAAO;6BACU,OAAO;4BACR,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;4BAC5C,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;+EACY,iBAAiB,CAAC,OAAO;;;;;;;;4BAQ5E,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDAgCtB,kBAAkB;;;;;;;;;;uCAU7B,kBAAkB;;;mBAGtC,UAAU;;;;;;;;;wCASW,aAAa;uCACd,aAAa;;;EAGlD,oBAAoB;;;;4CAIsB,kBAAkB;2CACnB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+D5D,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAC/B,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,gBAAgB,CAAC;IACvE,OAAO;QACL,GAAG,EAAE,IAAI;QACT,OAAO,EAAE,IAAI,GAAG,CAAC;QACjB,MAAM,EAAE,IAAI,GAAG,CAAC;QAChB,EAAE,EAAE,IAAI,GAAG,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACpE,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { GeneratedInfrastructureFile } from '../../../types';\nimport type { InfraManifestInput } from '../../../types';\nimport type { ResolvedProfileModel } from '../auth/supabase/profile';\nimport { resolveSupabaseProfileModel } from '../auth/supabase/profile';\nimport type { MinikubeProviderLifecycle } from '../contracts';\n\nexport const APP_NAMESPACE = 'app';\nconst SUPABASE_NAMESPACE = 'supabase';\n\ninterface SupabaseHostPorts {\n  app: number;\n  gateway: number;\n  studio: number;\n  db: number;\n}\n\ninterface AppInfraStorageMetadata {\n  provider: 'supabase';\n  bucketsCsv: string;\n  defaultBucket: string;\n}\n\ninterface SupabaseImagePins {\n  postgres: string;\n  auth: string;\n  rest: string;\n  realtime: string;\n  storage: string;\n  imgproxy: string;\n  meta: string;\n  gateway: string;\n  studio: string;\n}\n\ninterface SupabaseOAuthProviderRuntime {\n  id: string;\n  envPrefix: string;\n  credentialsRef: string;\n  callbackRoute: string;\n}\n\nconst SUPABASE_IMAGES: SupabaseImagePins = {\n  postgres: 'supabase/postgres:17.6.1.136',\n  auth: 'supabase/gotrue:v2.189.0',\n  rest: 'postgrest/postgrest:v14.12',\n  realtime: 'supabase/realtime:v2.102.3',\n  storage: 'supabase/storage-api:v1.60.4',\n  imgproxy: 'darthsim/imgproxy:v3.30.1',\n  meta: 'supabase/postgres-meta:v0.96.6',\n  gateway: 'kong/kong:3.9.1',\n  studio: 'supabase/studio:2026.07.07-sha-a6a04f2',\n};\n\nconst PORT_BASE = 18080;\nconst PORT_BUCKET_SIZE = 20;\nconst PORT_BUCKET_COUNT = 1000;\nconst PORT_REFERENCE_SLUG = 'my-app';\n\nexport function generateMinikubeBaseArtifacts(args: {\n  manifest: InfraManifestInput;\n  appSlug: string;\n  extraResources: string[];\n  providerNamespaces: string[];\n  providerLifecycle: MinikubeProviderLifecycle[];\n  extraEnvEntries: string[];\n}): GeneratedInfrastructureFile[] {\n  const {\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  } = args;\n\n  const root = 'infra/minikube';\n  const k8sRoot = `${root}/k8s`;\n  const scriptsRoot = `${root}/scripts`;\n  const appImageRoot = `${root}/app-image`;\n  const defaultAppImage = getDefaultAppImage(appSlug);\n  const supabaseHostPorts = resolveSupabaseHostPorts(appSlug);\n\n  const authScope = manifest.auth?.scope ?? 'none';\n  const authProvider = manifest.auth?.provider ?? 'none';\n  const authzEngine = manifest.auth?.authorization?.engine ?? 'none';\n  const databaseProvider = manifest.database?.provider ?? 'none';\n  const secretStoreProvider = manifest.secretStore?.provider ?? 'none';\n  const storageMetadata = resolveAppInfraStorageMetadata(manifest);\n  const profileModel = resolveSupabaseProfileModel(manifest);\n  const oauthProviders = resolveSupabaseOAuthProviders(manifest);\n  const monitoringEnabled = manifest.deployment?.monitoring === true;\n  const domain = manifest.networking?.domain ?? '';\n  const supabaseKubernetesEnabled =\n    authProvider === 'supabase' ||\n    databaseProvider === 'supabase' ||\n    storageMetadata !== null ||\n    secretStoreProvider === 'supabase-vault';\n\n  const supabaseResources = supabaseKubernetesEnabled ? getSupabaseResourceFiles(k8sRoot) : [];\n  const namespaceResources = [\n    'namespaces/app.yaml',\n    ...(supabaseKubernetesEnabled ? ['namespaces/supabase.yaml'] : []),\n    ...providerNamespaces.map((namespace) => `namespaces/${namespace}.yaml`),\n  ];\n\n  return [\n    {\n      path: `${root}/README.md`,\n      content: getReadmeMarkdown({\n        appSlug,\n        defaultAppImage,\n        monitoringEnabled,\n        authProvider,\n        authzEngine,\n        extraResources,\n        supabaseHostPorts,\n        supabaseKubernetesEnabled,\n        profileModel,\n        oauthProviders,\n        providerNamespaces,\n        providerLifecycle,\n      }),\n    },\n    {\n      path: `${root}/.env.example`,\n      content: getEnvExample({\n        appSlug,\n        domain,\n        extraEnvEntries,\n        defaultAppImage,\n        supabaseHostPorts,\n        supabaseKubernetesEnabled,\n        oauthProviders,\n      }),\n    },\n    {\n      path: `${k8sRoot}/namespaces/app.yaml`,\n      content: getNamespaceManifest(APP_NAMESPACE),\n    },\n    ...(supabaseKubernetesEnabled\n      ? [\n          {\n            path: `${k8sRoot}/namespaces/supabase.yaml`,\n            content: getNamespaceManifest(SUPABASE_NAMESPACE),\n          },\n        ]\n      : []),\n    ...providerNamespaces.map((namespace) => ({\n      path: `${k8sRoot}/namespaces/${namespace}.yaml`,\n      content: getNamespaceManifest(namespace),\n    })),\n    {\n      path: `${k8sRoot}/app.configmap.yaml`,\n      content: getAppConfigMap({\n        appSlug,\n        authScope,\n        authProvider,\n        databaseProvider,\n        secretStoreProvider,\n        storageMetadata,\n        monitoringEnabled,\n        domain,\n      }),\n    },\n    {\n      path: `${k8sRoot}/app/deployment.yaml`,\n      content: getAppDeploymentManifest(defaultAppImage),\n    },\n    {\n      path: `${k8sRoot}/app/service.yaml`,\n      content: getAppServiceManifest(),\n    },\n    ...supabaseResources,\n    {\n      path: `${k8sRoot}/kustomization.yaml`,\n      content: getKustomizationManifest({\n        namespaceResources,\n        supabaseEnabled: supabaseKubernetesEnabled,\n        extraResources,\n      }),\n    },\n    {\n      path: `${scriptsRoot}/up.sh`,\n      content: getUpScript({\n        appSlug,\n        defaultAppImage,\n        supabaseKubernetesEnabled,\n        profileModel,\n        secretStoreProvider,\n        supabaseHostPorts,\n        oauthProviders,\n        providerLifecycle,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/build-app-image.sh`,\n      content: getBuildAppImageScript({ appSlug, defaultAppImage }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/port-forward.sh`,\n      content: getPortForwardScript({\n        appSlug,\n        supabaseKubernetesEnabled,\n        supabaseHostPorts,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/down.sh`,\n      content: getDownScript(appSlug),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/reset.sh`,\n      content: getResetScript({\n        appSlug,\n        supabaseKubernetesEnabled,\n        providerNamespaces,\n      }),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/destroy.sh`,\n      content: getDestroyScript(appSlug),\n      executable: true,\n    },\n    {\n      path: `${scriptsRoot}/status.sh`,\n      content: getStatusScript({\n        appSlug,\n        supabaseKubernetesEnabled,\n        profileModel,\n        supabaseHostPorts,\n        providerNamespaces,\n        providerLifecycle,\n      }),\n      executable: true,\n    },\n    {\n      path: `${appImageRoot}/Dockerfile`,\n      content: getAppImageDockerfile(),\n    },\n  ];\n}\n\nfunction getReadmeMarkdown(args: {\n  appSlug: string;\n  defaultAppImage: string;\n  monitoringEnabled: boolean;\n  authProvider: string;\n  authzEngine: string;\n  extraResources: string[];\n  supabaseHostPorts: SupabaseHostPorts;\n  supabaseKubernetesEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n  providerNamespaces: readonly string[];\n  providerLifecycle: readonly MinikubeProviderLifecycle[];\n}): string {\n  const {\n    appSlug,\n    defaultAppImage,\n    monitoringEnabled,\n    authProvider,\n    authzEngine,\n    extraResources,\n    supabaseHostPorts,\n    supabaseKubernetesEnabled,\n    profileModel,\n    oauthProviders,\n    providerNamespaces,\n    providerLifecycle,\n  } = args;\n  const resourceLines = [\n    'namespaces/app.yaml',\n    ...(supabaseKubernetesEnabled ? ['namespaces/supabase.yaml'] : []),\n    ...providerNamespaces.map((namespace) => `namespaces/${namespace}.yaml`),\n    'app.configmap.yaml',\n    'app/deployment.yaml',\n    'app/service.yaml',\n    ...(supabaseKubernetesEnabled\n      ? [\n          'supabase/bootstrap.sql',\n          'supabase/postgres.init.configmap.yaml',\n          'supabase/postgres.pvc.yaml',\n          'supabase/postgres.yaml',\n          'supabase/auth.yaml',\n          'supabase/rest.yaml',\n          'supabase/realtime.yaml',\n          'supabase/storage.yaml',\n          'supabase/imgproxy.yaml',\n          'supabase/meta.yaml',\n          'supabase/gateway.template.yml',\n          'supabase/kong-entrypoint.sh',\n          'supabase/gateway.yaml',\n          'supabase/studio.yaml',\n        ]\n      : []),\n    ...extraResources,\n  ]\n    .map((resource) => `- \\`k8s/${resource}\\``)\n    .join('\\n');\n\n  const resetNamespaces = [\n    APP_NAMESPACE,\n    ...(supabaseKubernetesEnabled ? [SUPABASE_NAMESPACE] : []),\n    ...providerNamespaces,\n  ];\n  const resetDescription = `deletes and recreates namespaces ${resetNamespaces\n    .map((namespace) => `\\`${namespace}\\``)\n    .join(\n      ', ',\n    )} inside the existing profile. This removes app-owned Kubernetes state and provider-owned PVC data for reset namespaces`;\n  const providerNamespaceLine =\n    providerNamespaces.length > 0\n      ? `- Provider namespaces: \\`${providerNamespaces.join('`, `')}\\`\\n`\n      : '';\n  const providerLifecycleLines =\n    providerLifecycle.length > 0\n      ? `\\n## Provider Lifecycle Contributions\\n\\n${providerLifecycle\n          .map((provider) => {\n            const readiness =\n              provider.readinessChecks.length > 0\n                ? provider.readinessChecks\n                    .map((check) => `\\`${check.resource}\\` in namespace \\`${check.namespace}\\``)\n                    .join(', ')\n                : 'none';\n            const endpoints =\n              provider.endpoints.length > 0\n                ? provider.endpoints\n                    .map((endpoint) => `\\`${endpoint.name}\\` = \\`${endpoint.url}\\``)\n                    .join(', ')\n                : 'none';\n            return `- \\`${provider.id}\\`: namespace \\`${provider.namespace}\\`; readiness ${readiness}; endpoints ${endpoints}`;\n          })\n          .join('\\n')}\\n`\n      : '';\n  const oauthDescription =\n    oauthProviders.length > 0\n      ? `\\nConfigured OAuth providers are wired into GoTrue through generated \\`GOTRUE_EXTERNAL_*\\` runtime keys. The keys are named in \\`.env.example\\`; values must come from trusted secret resolution for the configured \\`credentialsRef\\` entries.\\n`\n      : '';\n\n  return `# Minikube Infra\n\nThis directory is generated from \\`ankh.config.json\\` (infra manifest).\n\n## Ownership Model\n\n- App slug / Minikube profile: \\`${appSlug}\\`\n- App runtime namespace: \\`${APP_NAMESPACE}\\`\n- Supabase namespace: \\`${supabaseKubernetesEnabled ? SUPABASE_NAMESPACE : 'unused'}\\`\n${providerNamespaceLine}- Default app image: \\`${defaultAppImage}\\`\n\nOne app owns one complete Minikube profile. Provider-owned workloads are separated by\nKubernetes namespace inside that profile. There is no shared \\`minikube\\` profile and no\nhost-level Supabase Compose runtime.\n\n## Quick Start\n\n1. Copy env template:\n   \\`\\`\\`bash\n   cp .env.example .env\n   \\`\\`\\`\n2. Adjust optional values in \\`.env\\`; missing Supabase development secrets are generated by \\`up.sh\\`.\n3. Start infra:\n   \\`\\`\\`bash\n   ./scripts/up.sh\n   \\`\\`\\`\n4. Check status:\n   \\`\\`\\`bash\n   ./scripts/status.sh\n   \\`\\`\\`\n5. Stop the app-owned cluster without deleting data:\n   \\`\\`\\`bash\n   ./scripts/down.sh\n   \\`\\`\\`\n\n## Lifecycle Semantics\n\n- \\`up.sh\\`: starts \\`minikube -p ${appSlug}\\`, deploys provider namespaces, runs migrations with \\`supabase migration up --db-url \"$SUPABASE_DB_URL\"\\`, starts slug-owned port-forwards, and deploys the app runtime.\n- \\`down.sh\\`: stops slug-owned port-forwards, then stops \\`minikube -p ${appSlug}\\`. Persistent data remains in the profile.\n- \\`reset.sh\\`: requires \\`ANKH_RESET_CONFIRM=${appSlug}\\`; ${resetDescription}. It does not delete the Minikube profile.\n- \\`destroy.sh\\`: deletes only \\`minikube -p ${appSlug}\\`.\n\n## Generated Resources\n\n${resourceLines}\n\n## Supabase Runtime\n\nSupabase runtime ownership is Kubernetes. Migration authoring/history remains Supabase\nmigration files. Migration execution targets the Kubernetes Postgres endpoint through\n\\`supabase migration up --db-url \"$SUPABASE_DB_URL\"\\`.\n\nSupabase manifests are generated from the current official Supabase self-hosting Docker\ntopology, service documentation, environment-variable contracts, and pinned official images.\nKubernetes/Helm is treated as community-driven upstream guidance, not an official\ndistribution copied by this generator.\n${oauthDescription}\n\nPinned images:\n\n- Postgres: \\`${SUPABASE_IMAGES.postgres}\\`\n- Auth: \\`${SUPABASE_IMAGES.auth}\\`\n- PostgREST: \\`${SUPABASE_IMAGES.rest}\\`\n- Realtime: \\`${SUPABASE_IMAGES.realtime}\\`\n- Storage: \\`${SUPABASE_IMAGES.storage}\\`\n- Gateway: \\`${SUPABASE_IMAGES.gateway}\\`\n- Studio: \\`${SUPABASE_IMAGES.studio}\\`\n\n## Host URLs\n\n- App: \\`http://127.0.0.1:${supabaseHostPorts.app}\\`\n- Supabase gateway: \\`http://127.0.0.1:${supabaseHostPorts.gateway}\\`\n- Studio: \\`http://127.0.0.1:${supabaseHostPorts.studio}\\`\n- DB migration endpoint: \\`127.0.0.1:${supabaseHostPorts.db}\\`\n\n## Runtime Conventions\n\n- Monitoring requested: \\`${monitoringEnabled ? 'true' : 'false'}\\`\n- Auth provider: \\`${authProvider}\\`\n- Authorization engine: \\`${authzEngine}\\`\n${profileModel.enabled ? '- Generated profile reconciliation lives in `supabase/generated/auth_profiles.sql` and records checksum state in `ankhorage_internal.generated_schema_state`.\\n' : ''}\n${providerLifecycleLines}\n`;\n}\n\nfunction getEnvExample(args: {\n  appSlug: string;\n  domain: string;\n  extraEnvEntries: string[];\n  defaultAppImage: string;\n  supabaseHostPorts: SupabaseHostPorts;\n  supabaseKubernetesEnabled: boolean;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n}): string {\n  const { appSlug, domain, extraEnvEntries, defaultAppImage, supabaseHostPorts, oauthProviders } =\n    args;\n\n  const baseEntries = [\n    '# App-owned Minikube profile configuration',\n    `ANKH_APP_SLUG=${appSlug}`,\n    'MINIKUBE_DRIVER=docker',\n    'APP_BUILD_ENABLED=true',\n    'APP_SOURCE_DIR=',\n    'APP_WEB_EXPORT_DIR=.ankh/web-export',\n    `APP_IMAGE=${defaultAppImage}`,\n    'APP_IMAGE_SYNC_STRATEGY=docker-load',\n    'APP_IMAGE_CLEANUP_ON_DESTROY=true',\n    'APP_IMAGE_CLEANUP_MINIKUBE=true',\n    'APP_IMAGE_CLEANUP_DOCKER=true',\n    `APP_PORT_FORWARD_LOCAL_PORT=${supabaseHostPorts.app}`,\n    'APP_PORT_FORWARD_REMOTE_PORT=80',\n    `SUPABASE_GATEWAY_FORWARD_LOCAL_PORT=${supabaseHostPorts.gateway}`,\n    'SUPABASE_GATEWAY_FORWARD_REMOTE_PORT=8000',\n    `SUPABASE_STUDIO_FORWARD_LOCAL_PORT=${supabaseHostPorts.studio}`,\n    'SUPABASE_STUDIO_FORWARD_REMOTE_PORT=3000',\n    `SUPABASE_DB_FORWARD_LOCAL_PORT=${supabaseHostPorts.db}`,\n    'SUPABASE_DB_FORWARD_REMOTE_PORT=5432',\n    'APP_REPLICAS=1',\n    'APP_FORCE_ROLLOUT_RESTART=true',\n    '',\n    '# Optional private registry auth for APP_IMAGE',\n    'APP_IMAGE_PULL_SECRET_NAME=',\n    'APP_IMAGE_PULL_SECRET_SERVER=ghcr.io',\n    'APP_IMAGE_PULL_SECRET_USERNAME=',\n    'APP_IMAGE_PULL_SECRET_PASSWORD=',\n    'APP_IMAGE_PULL_SECRET_EMAIL=',\n    '',\n    '# Optional app networking domain',\n    `APP_DOMAIN=${domain}`,\n    '',\n    '# Supabase Kubernetes runtime secrets',\n    'POSTGRES_PASSWORD=',\n    'JWT_SECRET=',\n    'SUPABASE_ANON_KEY=',\n    'SUPABASE_SERVICE_ROLE_KEY=',\n    'SUPABASE_PUBLISHABLE_KEY=',\n    'SUPABASE_SECRET_KEY=',\n    'DASHBOARD_USERNAME=supabase',\n    'DASHBOARD_PASSWORD=',\n    'SECRET_KEY_BASE=',\n    'REALTIME_DB_ENC_KEY=',\n    'PG_META_CRYPTO_KEY=',\n    'S3_PROTOCOL_ACCESS_KEY_ID=',\n    'S3_PROTOCOL_ACCESS_KEY_SECRET=',\n    'JWT_EXPIRY=3600',\n    'SITE_URL=',\n    'OAUTH_NATIVE_REDIRECT_URLS=',\n    'ADDITIONAL_REDIRECT_URLS=',\n    'SUPABASE_PUBLIC_URL=',\n    'API_EXTERNAL_URL=',\n    'ENABLE_EMAIL_SIGNUP=true',\n    'ENABLE_EMAIL_AUTOCONFIRM=true',\n    'SMTP_ADMIN_EMAIL=admin@example.com',\n    'SMTP_HOST=localhost',\n    'SMTP_PORT=2500',\n    'SMTP_USER=',\n    'SMTP_PASS=',\n    'SMTP_SENDER_NAME=Ankhorage',\n    'PGRST_DB_SCHEMAS=public,storage,graphql_public',\n    'PGRST_DB_MAX_ROWS=1000',\n    'PGRST_DB_EXTRA_SEARCH_PATH=public',\n    'GLOBAL_S3_BUCKET=stub',\n    'STORAGE_TENANT_ID=stub',\n    'REGION=stub',\n    'SUPABASE_DB_URL=',\n    'EXPO_PUBLIC_SUPABASE_URL=',\n    'EXPO_PUBLIC_SUPABASE_ANON_KEY=',\n    ...getOAuthEnvExampleEntries(oauthProviders),\n    '',\n    '# Adapter-provided runtime keys',\n  ];\n\n  const merged = [...baseEntries, ...extraEnvEntries];\n  const unique: string[] = [];\n  for (const entry of merged) {\n    if (!unique.includes(entry)) unique.push(entry);\n  }\n\n  return `${unique.join('\\n')}\\n`;\n}\n\nfunction getOAuthEnvExampleEntries(providers: readonly SupabaseOAuthProviderRuntime[]): string[] {\n  if (providers.length === 0) return [];\n\n  return [\n    '',\n    '# OAuth provider runtime values resolved from trusted credentialsRef entries',\n    ...providers.flatMap((provider) => [\n      `# ${provider.id}: ${provider.credentialsRef}`,\n      `GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID=`,\n      `GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET=`,\n      `GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI=`,\n    ]),\n  ];\n}\n\nfunction getOAuthScriptEnvDefaults(providers: readonly SupabaseOAuthProviderRuntime[]): string {\n  if (providers.length === 0) return '';\n\n  return providers\n    .map(\n      (\n        provider,\n      ) => `  export GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID=\"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID:-}\"\n  export GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET=\"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET:-}\"\n  export GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI=\"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI:-\\${API_EXTERNAL_URL}/callback}\"`,\n    )\n    .join('\\n');\n}\n\nfunction getOAuthRuntimeSecretLines(providers: readonly SupabaseOAuthProviderRuntime[]): string {\n  if (providers.length === 0) return '';\n\n  return providers\n    .map(\n      (provider) => `GOTRUE_EXTERNAL_${provider.envPrefix}_ENABLED=true\nGOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID=\\${GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID}\nGOTRUE_EXTERNAL_${provider.envPrefix}_SECRET=\\${GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET}\nGOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI=\\${GOTRUE_EXTERNAL_${provider.envPrefix}_REDIRECT_URI}`,\n    )\n    .join('\\n');\n}\n\nfunction getOAuthRuntimeValidationScript(\n  providers: readonly SupabaseOAuthProviderRuntime[],\n): string {\n  if (providers.length === 0) return '';\n\n  const checks = providers\n    .map(\n      (\n        provider,\n      ) => `  if [[ -z \"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID:-}\" || -z \"\\${GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET:-}\" ]]; then\n    echo \"OAuth provider ${provider.id} requires trusted runtime values GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID and GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET from credentialsRef ${provider.credentialsRef}.\"\n    exit 1\n  fi`,\n    )\n    .join('\\n');\n\n  return `\n  # OAuth provider secrets must be resolved by trusted host code before Kubernetes sync.\n${checks}`;\n}\n\nfunction getSupabaseOAuthCallbackRoute(providers: readonly SupabaseOAuthProviderRuntime[]): string {\n  return providers[0]?.callbackRoute ?? '/auth/callback';\n}\n\nfunction getOAuthVaultResolutionScript(args: {\n  appSlug: string;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n  secretStoreProvider: string;\n}): string {\n  const { appSlug, oauthProviders, secretStoreProvider } = args;\n  if (secretStoreProvider !== 'supabase-vault' || oauthProviders.length === 0) {\n    return `\nresolve_oauth_credentials_from_vault() {\n  return 0\n}\n`;\n  }\n\n  const lines = oauthProviders\n    .map((provider) => {\n      const ref = escapeSingleQuotedSql(provider.credentialsRef);\n      const idKey = `GOTRUE_EXTERNAL_${provider.envPrefix}_CLIENT_ID`;\n      const secretKey = `GOTRUE_EXTERNAL_${provider.envPrefix}_SECRET`;\n\n      return `  if [[ -z \"\\${${idKey}:-}\" || -z \"\\${${secretKey}:-}\" ]]; then\n    local resolved_client_id resolved_client_secret\n    resolved_client_id=\"$(resolve_vault_secret_field '${ref}' 'clientId')\"\n    resolved_client_secret=\"$(resolve_vault_secret_field '${ref}' 'clientSecret')\"\n    if [[ -n \"\\${resolved_client_id}\" ]]; then\n      export ${idKey}=\"\\${resolved_client_id}\"\n    fi\n    if [[ -n \"\\${resolved_client_secret}\" ]]; then\n      export ${secretKey}=\"\\${resolved_client_secret}\"\n    fi\n  fi`;\n    })\n    .join('\\n');\n\n  return `\nresolve_vault_secret_field() {\n  local ref=\"\\${1}\"\n  local field=\"\\${2}\"\n  psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -Atq -c \"select coalesce(decrypted.decrypted_secret::jsonb ->> '\\${field}', '') from ankh_secret_store.secret_metadata metadata join vault.decrypted_secrets decrypted on decrypted.id = metadata.vault_secret_id where metadata.project_id = '${escapeSingleQuotedSql(\n    appSlug,\n  )}' and metadata.environment = 'local' and metadata.secret_ref = '\\${ref}' limit 1;\" 2>/dev/null || true\n}\n\nresolve_oauth_credentials_from_vault() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n${lines}\n}\n`;\n}\n\nfunction escapeSingleQuotedSql(value: string): string {\n  return value.replace(/'/gu, \"''\");\n}\n\nfunction escapeShellDoubleQuoted(value: string): string {\n  return value.replace(/[\"\\\\$`]/gu, (char) => `\\\\${char}`);\n}\n\nfunction getProviderLifecycleStageScripts(\n  providerLifecycle: readonly MinikubeProviderLifecycle[],\n): string {\n  return `${getProviderLifecycleCommandFunction({\n    functionName: 'run_provider_migrations',\n    emptyReturn: 'return 0',\n    commands: providerLifecycle.flatMap((provider) =>\n      provider.migrationCommands.map((command) => ({\n        providerId: provider.id,\n        label: command.label,\n        command: command.command,\n      })),\n    ),\n  })}\n\n${getProviderLifecycleCommandFunction({\n  functionName: 'run_provider_reconciliation',\n  emptyReturn: 'return 0',\n  commands: providerLifecycle.flatMap((provider) =>\n    provider.reconciliationCommands.map((command) => ({\n      providerId: provider.id,\n      label: command.label,\n      command: command.command,\n    })),\n  ),\n})}\n\n${getProviderReadinessFunction(providerLifecycle)}`;\n}\n\nfunction getProviderLifecycleCommandFunction(args: {\n  functionName: string;\n  emptyReturn: string;\n  commands: readonly { providerId: string; label: string; command: string }[];\n}): string {\n  if (args.commands.length === 0) {\n    return `${args.functionName}() {\n  ${args.emptyReturn}\n}`;\n  }\n\n  const body = args.commands\n    .map(\n      (command) => `  echo \"Running provider ${escapeShellDoubleQuoted(\n        command.providerId,\n      )} ${escapeShellDoubleQuoted(command.label)}.\"\n${indentShellBlock(command.command.trim(), 2)}`,\n    )\n    .join('\\n\\n');\n\n  return `${args.functionName}() {\n${body}\n}`;\n}\n\nfunction getProviderReadinessFunction(\n  providerLifecycle: readonly MinikubeProviderLifecycle[],\n): string {\n  const checks = providerLifecycle.flatMap((provider) =>\n    provider.readinessChecks.map((check) => ({ providerId: provider.id, ...check })),\n  );\n\n  if (checks.length === 0) {\n    return `wait_for_provider_readiness() {\n  return 0\n}`;\n  }\n\n  const body = checks\n    .map(\n      (check) =>\n        `  kubectl --context \"\\${PROFILE}\" -n \"${escapeShellDoubleQuoted(\n          check.namespace,\n        )}\" rollout status \"${escapeShellDoubleQuoted(\n          check.resource,\n        )}\" --timeout=${check.timeoutSeconds}s`,\n    )\n    .join('\\n');\n\n  return `wait_for_provider_readiness() {\n${body}\n}`;\n}\n\nfunction getProviderStatusScript(providerLifecycle: readonly MinikubeProviderLifecycle[]): string {\n  if (providerLifecycle.length === 0) {\n    return '';\n  }\n\n  return providerLifecycle\n    .map((provider) => {\n      const endpointLines = provider.endpoints\n        .map(\n          (endpoint) =>\n            `  echo \"- provider ${escapeShellDoubleQuoted(\n              provider.id,\n            )} endpoint/${escapeShellDoubleQuoted(endpoint.name)}: ${escapeShellDoubleQuoted(\n              endpoint.url,\n            )}\"`,\n        )\n        .join('\\n');\n      const readinessLines = provider.readinessChecks\n        .map(\n          (check) => `  if kubectl --context \"\\${PROFILE}\" -n \"${escapeShellDoubleQuoted(\n            check.namespace,\n          )}\" rollout status \"${escapeShellDoubleQuoted(\n            check.resource,\n          )}\" --timeout=5s >/dev/null 2>&1; then\n    echo \"- provider ${escapeShellDoubleQuoted(provider.id)}/${escapeShellDoubleQuoted(\n      check.label,\n    )}: ready\"\n  else\n    echo \"- provider ${escapeShellDoubleQuoted(provider.id)}/${escapeShellDoubleQuoted(\n      check.label,\n    )}: not ready\"\n  fi`,\n        )\n        .join('\\n');\n      const customStatusLines = provider.statusChecks\n        .map(\n          (check) => `  echo \"Running provider ${escapeShellDoubleQuoted(\n            provider.id,\n          )} status check ${escapeShellDoubleQuoted(check.label)}.\"\n${indentShellBlock(check.command.trim(), 2)}`,\n        )\n        .join('\\n');\n\n      return [endpointLines, readinessLines, customStatusLines].filter(Boolean).join('\\n');\n    })\n    .filter(Boolean)\n    .join('\\n');\n}\n\nfunction indentShellBlock(value: string, spaces: number): string {\n  const indent = ' '.repeat(spaces);\n  return value\n    .split('\\n')\n    .map((line) => `${indent}${line}`)\n    .join('\\n');\n}\n\nfunction getNamespaceManifest(namespace: string): string {\n  return `apiVersion: v1\nkind: Namespace\nmetadata:\n  name: ${namespace}\n  labels:\n    app.kubernetes.io/part-of: ankhorage\n    ankhorage.io/namespace-role: ${namespace}\n`;\n}\n\nfunction getAppConfigMap(args: {\n  appSlug: string;\n  authScope: string;\n  authProvider: string;\n  databaseProvider: string;\n  secretStoreProvider: string;\n  storageMetadata: AppInfraStorageMetadata | null;\n  monitoringEnabled: boolean;\n  domain: string;\n}): string {\n  const {\n    appSlug,\n    authScope,\n    authProvider,\n    databaseProvider,\n    secretStoreProvider,\n    storageMetadata,\n    monitoringEnabled,\n    domain,\n  } = args;\n\n  const storageLines = storageMetadata\n    ? `  STORAGE_PROVIDER: \"${storageMetadata.provider}\"\n  STORAGE_BUCKETS: \"${escapeYamlDoubleQuoted(storageMetadata.bucketsCsv)}\"\n  STORAGE_DEFAULT_BUCKET: \"${escapeYamlDoubleQuoted(storageMetadata.defaultBucket)}\"\n`\n    : '';\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-infra-config\n  namespace: ${APP_NAMESPACE}\ndata:\n  ANKH_APP_SLUG: \"${appSlug}\"\n  DEPLOYMENT_TARGET: \"minikube\"\n  APP_NAMESPACE: \"${APP_NAMESPACE}\"\n  SUPABASE_NAMESPACE: \"${SUPABASE_NAMESPACE}\"\n  MONITORING_ENABLED: \"${monitoringEnabled ? 'true' : 'false'}\"\n  AUTH_SCOPE: \"${authScope}\"\n  AUTH_PROVIDER: \"${authProvider}\"\n  DATABASE_PROVIDER: \"${databaseProvider}\"\n  SECRET_STORE_PROVIDER: \"${secretStoreProvider}\"\n${storageLines}  NETWORK_DOMAIN: \"${escapeYamlDoubleQuoted(domain)}\"\n`;\n}\n\nfunction resolveAppInfraStorageMetadata(\n  manifest: InfraManifestInput,\n): AppInfraStorageMetadata | null {\n  const spec = manifest.storage;\n  if (!spec) return null;\n\n  const buckets = normalizeBuckets(spec.buckets);\n  if (buckets.length === 0) return null;\n  const [defaultBucket] = buckets;\n  if (!defaultBucket) return null;\n\n  if (spec.provider === 'supabase') {\n    return {\n      provider: 'supabase',\n      bucketsCsv: buckets.join(','),\n      defaultBucket,\n    };\n  }\n\n  if (spec.provider === 'auto') {\n    const shouldResolveToSupabase =\n      manifest.database?.provider === 'supabase' || manifest.auth?.provider === 'supabase';\n\n    if (!shouldResolveToSupabase) return null;\n\n    return {\n      provider: 'supabase',\n      bucketsCsv: buckets.join(','),\n      defaultBucket,\n    };\n  }\n\n  return null;\n}\n\nfunction resolveSupabaseOAuthProviders(\n  manifest: InfraManifestInput,\n): readonly SupabaseOAuthProviderRuntime[] {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return [];\n  const callbackRoute = normalizeOAuthCallbackRoute(oauth.callbackRoute);\n\n  return oauth.providers\n    .filter((provider) => provider.enabled !== false)\n    .map((provider) => {\n      const id = provider.id.trim();\n      const credentialsRef = provider.credentialsRef?.trim();\n      if (!credentialsRef) {\n        throw new Error(`OAuth provider \"${id}\" is enabled but does not define credentialsRef.`);\n      }\n\n      const envPrefix = id\n        .toUpperCase()\n        .replace(/[^A-Z0-9]+/gu, '_')\n        .replace(/^_+|_+$/gu, '');\n      if (!envPrefix) {\n        throw new Error(`OAuth provider \"${id}\" cannot be mapped to GoTrue environment keys.`);\n      }\n\n      return {\n        id,\n        envPrefix,\n        credentialsRef,\n        callbackRoute,\n      };\n    });\n}\n\nfunction normalizeOAuthCallbackRoute(rawRoute: string | undefined): string {\n  const trimmedRoute = rawRoute?.trim();\n  const route = trimmedRoute && trimmedRoute.length > 0 ? trimmedRoute : '/auth/callback';\n  const withLeadingSlash = route.startsWith('/') ? route : `/${route}`;\n  return withLeadingSlash.replace(/\\/+/gu, '/');\n}\n\nfunction normalizeBuckets(rawBuckets: readonly string[]): string[] {\n  const normalized: string[] = [];\n  const seen = new Set<string>();\n\n  for (const raw of rawBuckets) {\n    const bucket = raw.trim();\n    if (!bucket) continue;\n    if (seen.has(bucket)) continue;\n    seen.add(bucket);\n    normalized.push(bucket);\n  }\n\n  return normalized;\n}\n\nfunction getKustomizationManifest(args: {\n  namespaceResources: string[];\n  supabaseEnabled: boolean;\n  extraResources: string[];\n}): string {\n  const supabaseResources = args.supabaseEnabled\n    ? [\n        'supabase/postgres.init.configmap.yaml',\n        'supabase/postgres.pvc.yaml',\n        'supabase/postgres.yaml',\n        'supabase/auth.yaml',\n        'supabase/rest.yaml',\n        'supabase/realtime.yaml',\n        'supabase/imgproxy.yaml',\n        'supabase/storage.yaml',\n        'supabase/meta.yaml',\n        'supabase/gateway.yaml',\n        'supabase/studio.yaml',\n      ]\n    : [];\n  const resources = [\n    ...args.namespaceResources,\n    'app.configmap.yaml',\n    'app/deployment.yaml',\n    'app/service.yaml',\n    ...supabaseResources,\n    ...args.extraResources,\n  ];\n  const resourceLines = resources.map((resource) => `  - ${resource}`).join('\\n');\n\n  return `apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n${resourceLines}\n`;\n}\n\nfunction getAppDeploymentManifest(defaultAppImage: string): string {\n  return `apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: app-runtime\n  namespace: ${APP_NAMESPACE}\n  labels:\n    app.kubernetes.io/name: app-runtime\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: app-runtime\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: app-runtime\n    spec:\n      containers:\n        - name: app\n          image: ${defaultAppImage}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 8080\n              name: http\n          envFrom:\n            - configMapRef:\n                name: app-infra-config\n            - configMapRef:\n                name: app-runtime-auth-env\n                optional: true\n            - configMapRef:\n                name: app-runtime-storage-env\n                optional: true\n            - secretRef:\n                name: supabase-public-runtime\n                optional: true\n          readinessProbe:\n            httpGet:\n              path: /\n              port: http\n            initialDelaySeconds: 5\n            periodSeconds: 10\n          livenessProbe:\n            httpGet:\n              path: /\n              port: http\n            initialDelaySeconds: 15\n            periodSeconds: 20\n`;\n}\n\nfunction getAppServiceManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: app-runtime\n  namespace: ${APP_NAMESPACE}\n  labels:\n    app.kubernetes.io/name: app-runtime\nspec:\n  type: ClusterIP\n  selector:\n    app.kubernetes.io/name: app-runtime\n  ports:\n    - name: http\n      port: 80\n      targetPort: http\n`;\n}\n\nfunction getSupabaseResourceFiles(k8sRoot: string): GeneratedInfrastructureFile[] {\n  return [\n    {\n      path: `${k8sRoot}/supabase/bootstrap.sql`,\n      content: getSupabaseBootstrapSql(),\n    },\n    {\n      path: `${k8sRoot}/supabase/postgres.init.configmap.yaml`,\n      content: getSupabasePostgresInitConfigMap(),\n    },\n    {\n      path: `${k8sRoot}/supabase/postgres.pvc.yaml`,\n      content: getSupabasePvcManifest('supabase-postgres-data', '20Gi'),\n    },\n    {\n      path: `${k8sRoot}/supabase/postgres.yaml`,\n      content: getSupabasePostgresManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/auth.yaml`,\n      content: getSupabaseAuthManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/rest.yaml`,\n      content: getSupabaseRestManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/realtime.yaml`,\n      content: getSupabaseRealtimeManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/storage.yaml`,\n      content: getSupabaseStorageManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/imgproxy.yaml`,\n      content: getSupabaseImgproxyManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/meta.yaml`,\n      content: getSupabaseMetaManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/gateway.template.yml`,\n      content: getSupabaseGatewayTemplate(),\n    },\n    {\n      path: `${k8sRoot}/supabase/kong-entrypoint.sh`,\n      content: getSupabaseKongEntrypointScript(),\n      executable: true,\n    },\n    {\n      path: `${k8sRoot}/supabase/gateway.yaml`,\n      content: getSupabaseGatewayManifest(),\n    },\n    {\n      path: `${k8sRoot}/supabase/studio.yaml`,\n      content: getSupabaseStudioManifest(),\n    },\n  ];\n}\n\nfunction getSupabaseBootstrapSql(): string {\n  return `-- Generated from the official Supabase self-hosting Docker database bootstrap contract.\n-- Applied by scripts/up.sh after Postgres is ready and before Supabase services start.\n\\\\set pgpass \\`echo \"$POSTGRES_PASSWORD\"\\`\n\\\\set jwt_secret \\`echo \"$JWT_SECRET\"\\`\n\\\\set jwt_exp \\`echo \"$JWT_EXP\"\\`\n\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'anon') THEN\n    CREATE ROLE anon NOLOGIN NOINHERIT;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticated') THEN\n    CREATE ROLE authenticated NOLOGIN NOINHERIT;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'service_role') THEN\n    CREATE ROLE service_role NOLOGIN NOINHERIT BYPASSRLS;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticator') THEN\n    CREATE ROLE authenticator NOINHERIT LOGIN;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_admin') THEN\n    CREATE ROLE supabase_admin LOGIN CREATEROLE CREATEDB REPLICATION BYPASSRLS;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_auth_admin') THEN\n    CREATE ROLE supabase_auth_admin LOGIN CREATEROLE;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_storage_admin') THEN\n    CREATE ROLE supabase_storage_admin LOGIN CREATEROLE;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'supabase_functions_admin') THEN\n    CREATE ROLE supabase_functions_admin LOGIN CREATEROLE;\n  END IF;\n  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'pgbouncer') THEN\n    CREATE ROLE pgbouncer LOGIN;\n  END IF;\nEND\n$$;\n\nALTER ROLE authenticator WITH PASSWORD :'pgpass';\nALTER ROLE pgbouncer WITH PASSWORD :'pgpass';\nALTER ROLE supabase_auth_admin WITH PASSWORD :'pgpass';\nALTER ROLE supabase_functions_admin WITH PASSWORD :'pgpass';\nALTER ROLE supabase_storage_admin WITH PASSWORD :'pgpass';\nALTER ROLE supabase_admin WITH PASSWORD :'pgpass';\n\nGRANT anon, authenticated, service_role TO authenticator;\nGRANT anon, authenticated, service_role TO supabase_storage_admin;\nGRANT postgres TO supabase_auth_admin;\nGRANT postgres TO supabase_storage_admin;\nGRANT postgres TO supabase_functions_admin;\nGRANT pg_monitor TO supabase_admin;\n\nCREATE SCHEMA IF NOT EXISTS auth AUTHORIZATION supabase_auth_admin;\nCREATE SCHEMA IF NOT EXISTS storage AUTHORIZATION supabase_storage_admin;\nCREATE SCHEMA IF NOT EXISTS graphql_public;\nCREATE SCHEMA IF NOT EXISTS _realtime AUTHORIZATION supabase_admin;\n\nGRANT USAGE ON SCHEMA public, graphql_public TO anon, authenticated, service_role;\nGRANT USAGE ON SCHEMA auth TO supabase_auth_admin;\nGRANT USAGE ON SCHEMA storage TO supabase_storage_admin, anon, authenticated, service_role;\nGRANT USAGE ON SCHEMA _realtime TO supabase_admin;\n\nALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO anon, authenticated, service_role;\nALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO anon, authenticated, service_role;\n\nALTER DATABASE postgres SET \"app.settings.jwt_secret\" TO :'jwt_secret';\nALTER DATABASE postgres SET \"app.settings.jwt_exp\" TO :'jwt_exp';\n\nSELECT 'CREATE DATABASE _supabase WITH OWNER supabase_admin'\nWHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '_supabase')\\\\gexec\n`;\n}\n\nfunction getSupabasePostgresInitConfigMap(): string {\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-postgres-init\n  namespace: ${SUPABASE_NAMESPACE}\ndata:\n  99-ankhorage-local-dev-extensions.sql: |\n    -- Local Minikube bootstrap for extension setup performed before runtime migrations.\n    alter role postgres with superuser;\n    grant pg_read_server_files to postgres;\n    grant pg_read_server_files to supabase_admin;\n    grant execute on function pg_read_file(text) to public;\n    grant execute on function pg_read_file(text, bigint, bigint) to public;\n`;\n}\n\nfunction getSupabasePvcManifest(name: string, size: string): string {\n  return `apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n  name: ${name}\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  accessModes:\n    - ReadWriteOnce\n  resources:\n    requests:\n      storage: ${size}\n`;\n}\n\nfunction getSupabasePostgresManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: postgres\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-postgres\n  ports:\n    - name: postgres\n      port: 5432\n      targetPort: postgres\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: postgres\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-postgres\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-postgres\n    spec:\n      containers:\n        - name: postgres\n          image: ${SUPABASE_IMAGES.postgres}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 5432\n              name: postgres\n          env:\n            - name: POSTGRES_USER\n              value: postgres\n            - name: POSTGRES_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: PGPASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: POSTGRES_DB\n              value: postgres\n            - name: PGDATABASE\n              value: postgres\n            - name: PGPORT\n              value: \"5432\"\n            - name: POSTGRES_PORT\n              value: \"5432\"\n            - name: POSTGRES_HOST\n              value: /var/run/postgresql\n            - name: JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: JWT_EXP\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: JWT_EXPIRY\n          volumeMounts:\n            - name: data\n              mountPath: /var/lib/postgresql/data\n            - name: init-scripts\n              mountPath: /docker-entrypoint-initdb.d/99-ankhorage-local-dev-extensions.sql\n              subPath: 99-ankhorage-local-dev-extensions.sql\n          readinessProbe:\n            exec:\n              command: [\"pg_isready\", \"-U\", \"postgres\"]\n            initialDelaySeconds: 15\n            periodSeconds: 5\n          livenessProbe:\n            exec:\n              command: [\"pg_isready\", \"-U\", \"postgres\"]\n            initialDelaySeconds: 30\n            periodSeconds: 10\n          args:\n            - postgres\n            - -c\n            - config_file=/etc/postgresql/postgresql.conf\n            - -c\n            - log_min_messages=fatal\n      volumes:\n        - name: data\n          persistentVolumeClaim:\n            claimName: supabase-postgres-data\n        - name: init-scripts\n          configMap:\n            name: supabase-postgres-init\n`;\n}\n\nfunction getSupabaseAuthManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: auth\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-auth\n  ports:\n    - name: http\n      port: 9999\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: auth\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-auth\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-auth\n    spec:\n      containers:\n        - name: auth\n          image: ${SUPABASE_IMAGES.auth}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 9999\n              name: http\n          env:\n            - name: GOTRUE_API_HOST\n              value: \"0.0.0.0\"\n            - name: GOTRUE_API_PORT\n              value: \"9999\"\n            - name: API_EXTERNAL_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: API_EXTERNAL_URL\n            - name: GOTRUE_SITE_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SITE_URL\n            - name: GOTRUE_URI_ALLOW_LIST\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: ADDITIONAL_REDIRECT_URLS\n            - name: GOTRUE_JWT_ISSUER\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: API_EXTERNAL_URL\n            - name: GOTRUE_DB_DRIVER\n              value: postgres\n            - name: GOTRUE_DB_DATABASE_URL\n              value: \"postgres://supabase_auth_admin:$(POSTGRES_PASSWORD)@postgres.${SUPABASE_NAMESPACE}.svc.cluster.local:5432/postgres?search_path=auth&sslmode=disable\"\n            - name: GOTRUE_JWT_AUD\n              value: authenticated\n            - name: GOTRUE_JWT_DEFAULT_GROUP_NAME\n              value: authenticated\n            - name: GOTRUE_JWT_ADMIN_ROLES\n              value: service_role\n            - name: GOTRUE_JWT_EXP\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: JWT_EXPIRY\n            - name: GOTRUE_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: GOTRUE_EXTERNAL_EMAIL_ENABLED\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: ENABLE_EMAIL_SIGNUP\n            - name: GOTRUE_MAILER_AUTOCONFIRM\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: ENABLE_EMAIL_AUTOCONFIRM\n            - name: GOTRUE_SMTP_ADMIN_EMAIL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_ADMIN_EMAIL\n            - name: GOTRUE_SMTP_HOST\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_HOST\n            - name: GOTRUE_SMTP_PORT\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_PORT\n            - name: GOTRUE_SMTP_USER\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SMTP_USER\n            - name: GOTRUE_SMTP_PASS\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SMTP_PASS\n            - name: GOTRUE_SMTP_SENDER_NAME\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SMTP_SENDER_NAME\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n          readinessProbe:\n            httpGet:\n              path: /health\n              port: http\n            initialDelaySeconds: 10\n            periodSeconds: 10\n`;\n}\n\nfunction getSupabaseRestManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: rest\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-rest\n  ports:\n    - name: http\n      port: 3000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: rest\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-rest\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-rest\n    spec:\n      containers:\n        - name: rest\n          image: ${SUPABASE_IMAGES.rest}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 3000\n              name: http\n          env:\n            - name: PGRST_DB_URI\n              value: \"postgres://authenticator:$(POSTGRES_PASSWORD)@postgres.${SUPABASE_NAMESPACE}.svc.cluster.local:5432/postgres\"\n            - name: PGRST_DB_SCHEMAS\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: PGRST_DB_SCHEMAS\n            - name: PGRST_DB_ANON_ROLE\n              value: anon\n            - name: PGRST_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: PGRST_DB_USE_LEGACY_GUCS\n              value: \"false\"\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n`;\n}\n\nfunction getSupabaseRealtimeManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: realtime\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-realtime\n  ports:\n    - name: http\n      port: 4000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: realtime\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-realtime\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-realtime\n    spec:\n      containers:\n        - name: realtime\n          image: ${SUPABASE_IMAGES.realtime}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 4000\n              name: http\n          env:\n            - name: PORT\n              value: \"4000\"\n            - name: DB_HOST\n              value: \"postgres.${SUPABASE_NAMESPACE}.svc.cluster.local\"\n            - name: DB_PORT\n              value: \"5432\"\n            - name: DB_NAME\n              value: postgres\n            - name: DB_USER\n              value: supabase_admin\n            - name: DB_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: API_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: SECRET_KEY_BASE\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SECRET_KEY_BASE\n            - name: DB_AFTER_CONNECT_QUERY\n              value: \"SET search_path TO _realtime\"\n            - name: DB_ENC_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: REALTIME_DB_ENC_KEY\n            - name: METRICS_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: APP_NAME\n              value: realtime\n            - name: SEED_SELF_HOST\n              value: \"true\"\n            - name: RUN_JANITOR\n              value: \"true\"\n            - name: DISABLE_HEALTHCHECK_LOGGING\n              value: \"true\"\n`;\n}\n\nfunction getSupabaseStorageManifest(): string {\n  return `${getSupabasePvcManifest('supabase-storage-data', '10Gi')}\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: storage\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-storage\n  ports:\n    - name: http\n      port: 5000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: storage\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-storage\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-storage\n    spec:\n      containers:\n        - name: storage\n          image: ${SUPABASE_IMAGES.storage}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 5000\n              name: http\n          env:\n            - name: ANON_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_ANON_KEY\n            - name: SERVICE_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_SERVICE_ROLE_KEY\n            - name: AUTH_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n            - name: DATABASE_URL\n              value: \"postgres://supabase_storage_admin:$(POSTGRES_PASSWORD)@postgres.${SUPABASE_NAMESPACE}.svc.cluster.local:5432/postgres?search_path=storage&sslmode=disable\"\n            - name: POSTGREST_URL\n              value: \"http://rest.${SUPABASE_NAMESPACE}.svc.cluster.local:3000\"\n            - name: STORAGE_BACKEND\n              value: file\n            - name: STORAGE_PUBLIC_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SUPABASE_PUBLIC_URL\n            - name: REQUEST_ALLOW_X_FORWARDED_PATH\n              value: \"true\"\n            - name: FILE_SIZE_LIMIT\n              value: \"52428800\"\n            - name: FILE_STORAGE_BACKEND_PATH\n              value: /var/lib/storage\n            - name: TENANT_ID\n              value: stub\n            - name: REGION\n              value: local\n            - name: GLOBAL_S3_BUCKET\n              value: local\n            - name: IMGPROXY_URL\n              value: \"http://imgproxy.${SUPABASE_NAMESPACE}.svc.cluster.local:5001\"\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n          volumeMounts:\n            - name: storage\n              mountPath: /var/lib/storage\n      volumes:\n        - name: storage\n          persistentVolumeClaim:\n            claimName: supabase-storage-data\n`;\n}\n\nfunction getSupabaseImgproxyManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: imgproxy\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-imgproxy\n  ports:\n    - name: http\n      port: 5001\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: imgproxy\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-imgproxy\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-imgproxy\n    spec:\n      containers:\n        - name: imgproxy\n          image: ${SUPABASE_IMAGES.imgproxy}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 5001\n              name: http\n          env:\n            - name: IMGPROXY_BIND\n              value: \":5001\"\n`;\n}\n\nfunction getSupabaseMetaManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: meta\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-meta\n  ports:\n    - name: http\n      port: 8080\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: meta\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-meta\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-meta\n    spec:\n      containers:\n        - name: meta\n          image: ${SUPABASE_IMAGES.meta}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 8080\n              name: http\n          env:\n            - name: PG_META_PORT\n              value: \"8080\"\n            - name: PG_META_DB_HOST\n              value: \"postgres.${SUPABASE_NAMESPACE}.svc.cluster.local\"\n            - name: PG_META_DB_PORT\n              value: \"5432\"\n            - name: PG_META_DB_NAME\n              value: postgres\n            - name: PG_META_DB_USER\n              value: postgres\n            - name: PG_META_DB_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: POSTGRES_PASSWORD\n            - name: CRYPTO_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: PG_META_CRYPTO_KEY\n`;\n}\n\nfunction getSupabaseGatewayTemplate(): string {\n  return `_format_version: '2.1'\n_transform: true\n\nconsumers:\n  - username: DASHBOARD\n  - username: anon\n    keyauth_credentials:\n      - key: $SUPABASE_ANON_KEY\n      - key: $SUPABASE_PUBLISHABLE_KEY\n  - username: service_role\n    keyauth_credentials:\n      - key: $SUPABASE_SERVICE_KEY\n      - key: $SUPABASE_SECRET_KEY\n\nacls:\n  - consumer: anon\n    group: anon\n  - consumer: service_role\n    group: admin\n\nbasicauth_credentials:\n  - consumer: DASHBOARD\n    username: '$DASHBOARD_USERNAME'\n    password: '$DASHBOARD_PASSWORD'\n\nservices:\n  - name: auth-v1-open\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/verify\n    routes:\n      - name: auth-v1-open\n        strip_path: true\n        paths: [/auth/v1/verify]\n    plugins:\n      - name: cors\n  - name: auth-v1-open-callback\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/callback\n    routes:\n      - name: auth-v1-open-callback\n        strip_path: true\n        paths: [/auth/v1/callback]\n    plugins:\n      - name: cors\n  - name: auth-v1-open-authorize\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/authorize\n    routes:\n      - name: auth-v1-open-authorize\n        strip_path: true\n        paths: [/auth/v1/authorize]\n    plugins:\n      - name: cors\n  - name: auth-v1-open-jwks\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/.well-known/jwks.json\n    routes:\n      - name: auth-v1-open-jwks\n        strip_path: true\n        paths: [/auth/v1/.well-known/jwks.json]\n    plugins:\n      - name: cors\n  - name: auth-v1\n    url: http://auth.${SUPABASE_NAMESPACE}.svc.cluster.local:9999/\n    routes:\n      - name: auth-v1-all\n        strip_path: true\n        paths: [/auth/v1/]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: rest-v1\n    url: http://rest.${SUPABASE_NAMESPACE}.svc.cluster.local:3000/\n    routes:\n      - name: rest-v1-all\n        strip_path: true\n        paths: [/rest/v1/]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: graphql-v1\n    url: http://rest.${SUPABASE_NAMESPACE}.svc.cluster.local:3000/rpc/graphql\n    routes:\n      - name: graphql-v1-all\n        strip_path: true\n        paths: [/graphql/v1]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Content-Profile: graphql_public\"\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: realtime-v1-ws\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/socket\n    protocol: ws\n    routes:\n      - name: realtime-v1-ws\n        strip_path: true\n        paths: [/realtime/v1/]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"x-api-key:$LUA_RT_WS_EXPR\"\n          replace:\n            querystring:\n              - \"apikey:$LUA_RT_WS_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: realtime-v1-rest-openapi\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/api/openapi\n    protocol: http\n    routes:\n      - name: realtime-v1-rest-openapi\n        strip_path: true\n        paths: [/realtime/v1/api/openapi]\n    plugins:\n      - name: request-termination\n        config:\n          status_code: 403\n          message: \"Access is forbidden.\"\n  - name: realtime-v1-rest-tenants\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/api/tenants\n    protocol: http\n    routes:\n      - name: realtime-v1-rest-tenants\n        strip_path: true\n        paths: [/realtime/v1/api/tenants]\n    plugins:\n      - name: request-termination\n        config:\n          status_code: 403\n          message: \"Access is forbidden.\"\n  - name: realtime-v1-rest\n    url: http://realtime.${SUPABASE_NAMESPACE}.svc.cluster.local:4000/api\n    protocol: http\n    routes:\n      - name: realtime-v1-rest\n        strip_path: true\n        paths: [/realtime/v1/api]\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin, anon]\n  - name: storage-v1\n    url: http://storage.${SUPABASE_NAMESPACE}.svc.cluster.local:5000/\n    routes:\n      - name: storage-v1-all\n        strip_path: true\n        paths: [/storage/v1/]\n    plugins:\n      - name: cors\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n          replace:\n            headers:\n              - \"Authorization: $LUA_AUTH_EXPR\"\n      - name: post-function\n        config:\n          access:\n            - |\n              local auth = kong.request.get_header(\"authorization\")\n              if auth == nil or auth == \"\" or auth:find(\"^%s*$\") then\n                kong.service.request.clear_header(\"authorization\")\n              end\n  - name: meta\n    url: http://meta.${SUPABASE_NAMESPACE}.svc.cluster.local:8080/\n    routes:\n      - name: meta-all\n        strip_path: true\n        paths: [/pg/]\n    plugins:\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow: [admin]\n  - name: dashboard\n    url: http://studio.${SUPABASE_NAMESPACE}.svc.cluster.local:3000/\n    routes:\n      - name: dashboard-all\n        strip_path: true\n        paths: [/]\n    plugins:\n      - name: cors\n      - name: basic-auth\n        config:\n          hide_credentials: true\n`;\n}\n\nfunction getSupabaseKongEntrypointScript(): string {\n  return `#!/bin/sh\nset -eu\n\nif [ -n \"\\${SUPABASE_SECRET_KEY:-}\" ] && [ -n \"\\${SUPABASE_PUBLISHABLE_KEY:-}\" ]; then\n  export LUA_AUTH_EXPR=\"\\\\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or (headers.apikey == '\\${SUPABASE_SECRET_KEY}' and 'Bearer \\${SERVICE_ROLE_KEY_ASYMMETRIC:-}') or (headers.apikey == '\\${SUPABASE_PUBLISHABLE_KEY}' and 'Bearer \\${ANON_KEY_ASYMMETRIC:-}') or headers.apikey)\"\n  export LUA_RT_WS_EXPR=\"\\\\$((query_params.apikey == '\\${SUPABASE_SECRET_KEY}' and '\\${SERVICE_ROLE_KEY_ASYMMETRIC:-}') or (query_params.apikey == '\\${SUPABASE_PUBLISHABLE_KEY}' and '\\${ANON_KEY_ASYMMETRIC:-}') or query_params.apikey)\"\nelse\n  export LUA_AUTH_EXPR=\"\\\\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or headers.apikey)\"\n  export LUA_RT_WS_EXPR=\"\\\\$(query_params.apikey)\"\nfi\n\nawk '{\n  result = \"\"\n  rest = $0\n  while (match(rest, /\\\\$[A-Za-z_][A-Za-z_0-9]*/)) {\n    varname = substr(rest, RSTART + 1, RLENGTH - 1)\n    if (varname in ENVIRON) {\n      result = result substr(rest, 1, RSTART - 1) ENVIRON[varname]\n    } else {\n      result = result substr(rest, 1, RSTART + RLENGTH - 1)\n    }\n    rest = substr(rest, RSTART + RLENGTH)\n  }\n  print result rest\n}' /home/kong/temp.yml > \"\\${KONG_DECLARATIVE_CONFIG}\"\n\nsed -i '/^[[:space:]]*- key:[[:space:]]*$/d' \"\\${KONG_DECLARATIVE_CONFIG}\"\n\nexec /entrypoint.sh kong docker-start\n`;\n}\n\nfunction getSupabaseGatewayManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: gateway\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-gateway\n  ports:\n    - name: http\n      port: 8000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: gateway\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-gateway\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-gateway\n    spec:\n      containers:\n        - name: gateway\n          image: ${SUPABASE_IMAGES.gateway}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 8000\n              name: http\n          env:\n            - name: KONG_DATABASE\n              value: \"off\"\n            - name: KONG_DECLARATIVE_CONFIG\n              value: /usr/local/kong/kong.yml\n            - name: KONG_ROUTER_FLAVOR\n              value: expressions\n            - name: KONG_DNS_ORDER\n              value: LAST,A,CNAME\n            - name: KONG_DNS_NOT_FOUND_TTL\n              value: \"1\"\n            - name: KONG_PLUGINS\n              value: request-transformer,cors,key-auth,acl,basic-auth,request-termination,ip-restriction,post-function\n            - name: KONG_PROXY_LISTEN\n              value: \"0.0.0.0:8000\"\n            - name: SUPABASE_SERVICE_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_SERVICE_ROLE_KEY\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n          volumeMounts:\n            - name: config\n              mountPath: /home/kong/temp.yml\n              subPath: temp.yml\n              readOnly: true\n            - name: entrypoint\n              mountPath: /home/kong/kong-entrypoint.sh\n              subPath: kong-entrypoint.sh\n              readOnly: true\n          command: [\"/bin/sh\", \"/home/kong/kong-entrypoint.sh\"]\n          readinessProbe:\n            exec:\n              command: [\"kong\", \"health\"]\n            initialDelaySeconds: 10\n            periodSeconds: 10\n      volumes:\n        - name: config\n          configMap:\n            name: supabase-gateway-config\n        - name: entrypoint\n          configMap:\n            name: supabase-kong-entrypoint\n            defaultMode: 0755\n`;\n}\n\nfunction getSupabaseStudioManifest(): string {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: studio\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  selector:\n    app.kubernetes.io/name: supabase-studio\n  ports:\n    - name: http\n      port: 3000\n      targetPort: http\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: studio\n  namespace: ${SUPABASE_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: supabase-studio\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: supabase-studio\n    spec:\n      containers:\n        - name: studio\n          image: ${SUPABASE_IMAGES.studio}\n          imagePullPolicy: IfNotPresent\n          ports:\n            - containerPort: 3000\n              name: http\n          env:\n            - name: HOSTNAME\n              value: \"0.0.0.0\"\n            - name: STUDIO_PG_META_URL\n              value: \"http://meta.${SUPABASE_NAMESPACE}.svc.cluster.local:8080\"\n            - name: SUPABASE_URL\n              value: \"http://gateway.${SUPABASE_NAMESPACE}.svc.cluster.local:8000\"\n            - name: SUPABASE_PUBLIC_URL\n              valueFrom:\n                configMapKeyRef:\n                  name: supabase-runtime-config\n                  key: SUPABASE_PUBLIC_URL\n            - name: SUPABASE_ANON_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_ANON_KEY\n            - name: SUPABASE_SERVICE_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: SUPABASE_SERVICE_ROLE_KEY\n            - name: AUTH_JWT_SECRET\n              valueFrom:\n                secretKeyRef:\n                  name: supabase-runtime-secrets\n                  key: JWT_SECRET\n          envFrom:\n            - secretRef:\n                name: supabase-runtime-secrets\n            - configMapRef:\n                name: supabase-runtime-config\n`;\n}\n\nfunction getUpScript(args: {\n  appSlug: string;\n  defaultAppImage: string;\n  supabaseKubernetesEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n  secretStoreProvider: string;\n  supabaseHostPorts: SupabaseHostPorts;\n  oauthProviders: readonly SupabaseOAuthProviderRuntime[];\n  providerLifecycle: readonly MinikubeProviderLifecycle[];\n}): string {\n  const {\n    appSlug,\n    defaultAppImage,\n    supabaseKubernetesEnabled,\n    profileModel,\n    secretStoreProvider,\n    supabaseHostPorts,\n    oauthProviders,\n    providerLifecycle,\n  } = args;\n  const oauthEnvDefaults = getOAuthScriptEnvDefaults(oauthProviders);\n  const oauthRuntimeSecretLines = getOAuthRuntimeSecretLines(oauthProviders);\n  const oauthValidation = getOAuthRuntimeValidationScript(oauthProviders);\n  const oauthCallbackRoute = getSupabaseOAuthCallbackRoute(oauthProviders);\n  const providerLifecycleStageScripts = getProviderLifecycleStageScripts(providerLifecycle);\n  const oauthVaultResolution = getOAuthVaultResolutionScript({\n    appSlug,\n    oauthProviders,\n    secretStoreProvider,\n  });\n\n  return `#!/usr/bin/env bash\nset -Eeuo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nK8S_DIR=\"\\${ROOT_DIR}/k8s\"\nBUILD_SCRIPT=\"\\${SCRIPT_DIR}/build-app-image.sh\"\nPORT_FORWARD_SCRIPT=\"\\${SCRIPT_DIR}/port-forward.sh\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-}\"\nDRIVER=\"\\${MINIKUBE_DRIVER:-}\"\nAPP_NAMESPACE=\"${APP_NAMESPACE}\"\nSUPABASE_NAMESPACE=\"${SUPABASE_NAMESPACE}\"\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-}\"\nAPP_IMAGE_SYNC_STRATEGY=\"\\${APP_IMAGE_SYNC_STRATEGY:-}\"\nAPP_REPLICAS=\"\\${APP_REPLICAS:-}\"\nAPP_FORCE_ROLLOUT_RESTART=\"\\${APP_FORCE_ROLLOUT_RESTART:-}\"\nAPP_IMAGE_PULL_SECRET_NAME=\"\\${APP_IMAGE_PULL_SECRET_NAME:-}\"\nAPP_IMAGE_PULL_SECRET_SERVER=\"\\${APP_IMAGE_PULL_SECRET_SERVER:-}\"\nAPP_IMAGE_PULL_SECRET_USERNAME=\"\\${APP_IMAGE_PULL_SECRET_USERNAME:-}\"\nAPP_IMAGE_PULL_SECRET_PASSWORD=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD:-}\"\nAPP_IMAGE_PULL_SECRET_EMAIL=\"\\${APP_IMAGE_PULL_SECRET_EMAIL:-}\"\nAPP_PORT_FORWARD_LOCAL_PORT=\"\\${APP_PORT_FORWARD_LOCAL_PORT:-}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-}\"\nSUPABASE_DB_FORWARD_LOCAL_PORT=\"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-}\"\nSUPABASE_DB_URL=\"\\${SUPABASE_DB_URL:-}\"\nSUPABASE_PROFILE_ENABLED=\"${profileModel.enabled ? 'true' : 'false'}\"\nSUPABASE_PROFILE_RECONCILE_FILE=\"\\${ROOT_DIR}/supabase/generated/auth_profiles.sql\"\n\nrequire_command() {\n  if ! command -v \"\\${1}\" >/dev/null 2>&1; then\n    echo \"\\${1} is required but not installed.\"\n    exit 1\n  fi\n}\n\nload_env_file_preserving_process_env() {\n  local line trimmed key value current\n  if [[ ! -f \"\\${ROOT_DIR}/.env\" ]]; then\n    return 0\n  fi\n\n  while IFS= read -r line || [[ -n \"\\${line}\" ]]; do\n    trimmed=\"$(printf '%s' \"\\${line}\" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')\"\n    if [[ -z \"\\${trimmed}\" || \"\\${trimmed}\" == \\\\#* || \"\\${trimmed}\" != *=* ]]; then\n      continue\n    fi\n\n    key=\"\\${trimmed%%=*}\"\n    value=\"\\${trimmed#*=}\"\n    key=\"\\${key//[[:space:]]/}\"\n    value=\"$(printf '%s' \"\\${value}\" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')\"\n    value=\"\\${value%\\\\\"}\"\n    value=\"\\${value#\\\\\"}\"\n    value=\"\\${value%\\\\'}\"\n    value=\"\\${value#\\\\'}\"\n    current=\"\\${!key:-}\"\n    if [[ -n \"\\${current}\" ]]; then\n      continue\n    fi\n    export \"\\${key}=\\${value}\"\n  done < \"\\${ROOT_DIR}/.env\"\n}\n\nenv_file_value() {\n  local key=\"\\${1}\"\n  if [[ ! -f \"\\${ROOT_DIR}/.env\" ]]; then\n    return 0\n  fi\n  awk -F= -v key=\"\\${key}\" '$1 == key { value = substr($0, index($0, \"=\") + 1) } END { print value }' \"\\${ROOT_DIR}/.env\"\n}\n\nenv_file_has_key() {\n  local key=\"\\${1}\"\n  if [[ ! -f \"\\${ROOT_DIR}/.env\" ]]; then\n    return 1\n  fi\n  awk -F= -v key=\"\\${key}\" '$1 == key { found = 1 } END { exit found ? 0 : 1 }' \"\\${ROOT_DIR}/.env\"\n}\n\nwrite_env_value() {\n  local key=\"\\${1}\"\n  local value=\"\\${2}\"\n  local tmp_env\n  mkdir -p \"\\${ROOT_DIR}\"\n  touch \"\\${ROOT_DIR}/.env\"\n  tmp_env=\"$(mktemp)\"\n  awk -F= -v key=\"\\${key}\" -v value=\"\\${value}\" '\n    $1 == key {\n      print key \"=\" value\n      found = 1\n      next\n    }\n    { print }\n    END {\n      if (!found) print key \"=\" value\n    }\n  ' \"\\${ROOT_DIR}/.env\" > \"\\${tmp_env}\"\n  mv \"\\${tmp_env}\" \"\\${ROOT_DIR}/.env\"\n}\n\nwrite_key_value_file_value() {\n  local file_path=\"\\${1}\"\n  local key=\"\\${2}\"\n  local value=\"\\${3}\"\n  local tmp_env\n  mkdir -p \"$(dirname \"\\${file_path}\")\"\n  touch \"\\${file_path}\"\n  tmp_env=\"$(mktemp)\"\n  awk -F= -v key=\"\\${key}\" -v value=\"\\${value}\" '\n    $1 == key {\n      print key \"=\" value\n      found = 1\n      next\n    }\n    { print }\n    END {\n      if (!found) print key \"=\" value\n    }\n  ' \"\\${file_path}\" > \"\\${tmp_env}\"\n  mv \"\\${tmp_env}\" \"\\${file_path}\"\n}\n\nsync_app_public_supabase_env() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  if [[ -z \"\\${APP_SOURCE_DIR:-}\" ]]; then\n    echo \"APP_SOURCE_DIR is required to write app Supabase public environment.\"\n    exit 1\n  fi\n\n  local app_env_file=\"\\${APP_SOURCE_DIR}/.env.local\"\n  write_key_value_file_value \"\\${app_env_file}\" \"EXPO_PUBLIC_SUPABASE_URL\" \"\\${EXPO_PUBLIC_SUPABASE_URL}\"\n  write_key_value_file_value \"\\${app_env_file}\" \"EXPO_PUBLIC_SUPABASE_ANON_KEY\" \"\\${EXPO_PUBLIC_SUPABASE_ANON_KEY}\"\n}\n\nset_required_env_default() {\n  local key=\"\\${1}\"\n  local value=\"\\${2}\"\n  local current=\"\\${!key:-}\"\n  if [[ -n \"\\${current}\" ]]; then\n    write_env_value \"\\${key}\" \"\\${current}\"\n    return 0\n  fi\n\n  current=\"$(env_file_value \"\\${key}\")\"\n  if [[ -n \"\\${current}\" ]]; then\n    export \"\\${key}=\\${current}\"\n    return 0\n  fi\n\n  write_env_value \"\\${key}\" \"\\${value}\"\n  export \"\\${key}=\\${value}\"\n}\n\nset_optional_env_default() {\n  local key=\"\\${1}\"\n  local value=\"\\${2}\"\n  local current=\"\\${!key:-}\"\n  if env_file_has_key \"\\${key}\"; then\n    export \"\\${key}=\\${current}\"\n    return 0\n  fi\n  if [[ -n \"\\${current}\" ]]; then\n    write_env_value \"\\${key}\" \"\\${current}\"\n    return 0\n  fi\n  write_env_value \"\\${key}\" \"\\${value}\"\n  export \"\\${key}=\\${value}\"\n}\n\nset_env_default() {\n  set_required_env_default \"\\${1}\" \"\\${2}\"\n}\n\nderive_additional_redirect_urls() {\n  local callback_route=\"${oauthCallbackRoute}\"\n  local callback_path=\"\\${callback_route#/}\"\n  local site_url_without_slash=\"\\${SITE_URL%/}\"\n  local urls=\"\\${site_url_without_slash},\\${site_url_without_slash}/\\${callback_path}\"\n  if [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n    urls=\"\\${urls},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\n  fi\n  printf '%s' \"\\${urls}\"\n}\n\nrandom_base64() {\n  openssl rand -base64 \"\\${1}\" | tr -d '\\\\n'\n}\n\nrandom_hex() {\n  openssl rand -hex \"\\${1}\" | tr -d '\\\\n'\n}\n\nbase64url() {\n  openssl base64 -A | tr '+/' '-_' | tr -d '='\n}\n\ngenerate_supabase_jwt() {\n  local role=\"\\${1}\"\n  local iat exp header payload signature\n  iat=\"$(date +%s)\"\n  exp=\"$((iat + 315360000))\"\n  header=\"$(printf '{\"alg\":\"HS256\",\"typ\":\"JWT\"}' | base64url)\"\n  payload=\"$(printf '{\"role\":\"%s\",\"iss\":\"supabase-demo\",\"iat\":%s,\"exp\":%s}' \"\\${role}\" \"\\${iat}\" \"\\${exp}\" | base64url)\"\n  signature=\"$(printf '%s.%s' \"\\${header}\" \"\\${payload}\" | openssl dgst -binary -sha256 -hmac \"\\${JWT_SECRET}\" | base64url)\"\n  printf '%s.%s.%s' \"\\${header}\" \"\\${payload}\" \"\\${signature}\"\n}\n\nensure_supabase_runtime_env() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  require_command openssl\n\n  set_required_env_default POSTGRES_PASSWORD \"$(random_hex 32)\"\n  set_required_env_default JWT_SECRET \"$(random_base64 48)\"\n  set_required_env_default SUPABASE_ANON_KEY \"$(generate_supabase_jwt anon)\"\n  set_required_env_default SUPABASE_SERVICE_ROLE_KEY \"$(generate_supabase_jwt service_role)\"\n  set_required_env_default DASHBOARD_USERNAME \"supabase\"\n  set_required_env_default DASHBOARD_PASSWORD \"$(random_base64 24)\"\n  set_required_env_default SECRET_KEY_BASE \"$(random_base64 48)\"\n  set_required_env_default REALTIME_DB_ENC_KEY \"$(random_hex 8)\"\n  set_required_env_default PG_META_CRYPTO_KEY \"$(random_base64 32)\"\n  set_required_env_default S3_PROTOCOL_ACCESS_KEY_ID \"$(random_hex 16)\"\n  set_required_env_default S3_PROTOCOL_ACCESS_KEY_SECRET \"$(random_hex 32)\"\n  set_required_env_default JWT_EXPIRY \"3600\"\n  set_required_env_default SUPABASE_GATEWAY_FORWARD_LOCAL_PORT \"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\n  set_required_env_default APP_PORT_FORWARD_LOCAL_PORT \"\\${APP_PORT_FORWARD_LOCAL_PORT:-${supabaseHostPorts.app}}\"\n  set_required_env_default SUPABASE_PUBLIC_URL \"http://127.0.0.1:\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT}\"\n  set_required_env_default API_EXTERNAL_URL \"\\${SUPABASE_PUBLIC_URL}/auth/v1\"\n  set_required_env_default SITE_URL \"http://127.0.0.1:\\${APP_PORT_FORWARD_LOCAL_PORT}\"\n  export OAUTH_NATIVE_REDIRECT_URLS=\"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\"\n  set_required_env_default ADDITIONAL_REDIRECT_URLS \"$(derive_additional_redirect_urls)\"\n  set_required_env_default ENABLE_EMAIL_SIGNUP \"true\"\n  set_required_env_default ENABLE_EMAIL_AUTOCONFIRM \"true\"\n  set_required_env_default SMTP_ADMIN_EMAIL \"admin@example.com\"\n  set_required_env_default SMTP_HOST \"localhost\"\n  set_required_env_default SMTP_PORT \"2500\"\n  set_optional_env_default SMTP_USER \"\"\n  set_optional_env_default SMTP_PASS \"\"\n  set_required_env_default SMTP_SENDER_NAME \"Ankhorage\"\n  set_required_env_default PGRST_DB_SCHEMAS \"public,storage,graphql_public\"\n  set_required_env_default PGRST_DB_MAX_ROWS \"1000\"\n  set_required_env_default PGRST_DB_EXTRA_SEARCH_PATH \"public\"\n  set_required_env_default GLOBAL_S3_BUCKET \"stub\"\n  set_required_env_default STORAGE_TENANT_ID \"stub\"\n  set_required_env_default REGION \"stub\"\n  set_required_env_default SUPABASE_DB_FORWARD_LOCAL_PORT \"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-${supabaseHostPorts.db}}\"\n  set_required_env_default SUPABASE_DB_URL \"postgres://postgres:\\${POSTGRES_PASSWORD}@127.0.0.1:\\${SUPABASE_DB_FORWARD_LOCAL_PORT}/postgres?sslmode=disable\"\n  set_required_env_default EXPO_PUBLIC_SUPABASE_URL \"\\${SUPABASE_PUBLIC_URL}\"\n  set_required_env_default EXPO_PUBLIC_SUPABASE_ANON_KEY \"\\${SUPABASE_ANON_KEY}\"\n${oauthEnvDefaults}\n}\n${oauthVaultResolution}\n\nsync_supabase_secrets() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  local tmp_runtime tmp_public\n  tmp_runtime=\"$(mktemp)\"\n  tmp_public=\"$(mktemp)\"\n  trap 'rm -f \"\\${tmp_runtime}\" \"\\${tmp_public}\"' EXIT\n\n  cat > \"\\${tmp_runtime}\" <<EOF\nPOSTGRES_PASSWORD=\\${POSTGRES_PASSWORD}\nJWT_SECRET=\\${JWT_SECRET}\nSUPABASE_ANON_KEY=\\${SUPABASE_ANON_KEY}\nSUPABASE_SERVICE_ROLE_KEY=\\${SUPABASE_SERVICE_ROLE_KEY}\nSUPABASE_PUBLISHABLE_KEY=\\${SUPABASE_PUBLISHABLE_KEY:-}\nSUPABASE_SECRET_KEY=\\${SUPABASE_SECRET_KEY:-}\nDASHBOARD_USERNAME=\\${DASHBOARD_USERNAME:-supabase}\nDASHBOARD_PASSWORD=\\${DASHBOARD_PASSWORD:-}\nSMTP_USER=\\${SMTP_USER:-}\nSMTP_PASS=\\${SMTP_PASS:-}\nSECRET_KEY_BASE=\\${SECRET_KEY_BASE}\nREALTIME_DB_ENC_KEY=\\${REALTIME_DB_ENC_KEY}\nPG_META_CRYPTO_KEY=\\${PG_META_CRYPTO_KEY}\nS3_PROTOCOL_ACCESS_KEY_ID=\\${S3_PROTOCOL_ACCESS_KEY_ID}\nS3_PROTOCOL_ACCESS_KEY_SECRET=\\${S3_PROTOCOL_ACCESS_KEY_SECRET}\n${oauthRuntimeSecretLines}\nEOF\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create secret generic supabase-runtime-secrets --from-env-file=\"\\${tmp_runtime}\" --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n\n  cat > \"\\${tmp_public}\" <<EOF\nEXPO_PUBLIC_SUPABASE_URL=\\${EXPO_PUBLIC_SUPABASE_URL}\nEXPO_PUBLIC_SUPABASE_ANON_KEY=\\${EXPO_PUBLIC_SUPABASE_ANON_KEY}\nSUPABASE_URL=http://gateway.${SUPABASE_NAMESPACE}.svc.cluster.local:8000\nSUPABASE_ANON_KEY=\\${SUPABASE_ANON_KEY}\nEOF\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" create secret generic supabase-public-runtime --from-env-file=\"\\${tmp_public}\" --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" apply -f -\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create configmap supabase-runtime-config \\\n    --from-literal=SUPABASE_PUBLIC_URL=\"\\${SUPABASE_PUBLIC_URL}\" \\\n    --from-literal=API_EXTERNAL_URL=\"\\${API_EXTERNAL_URL}\" \\\n    --from-literal=SITE_URL=\"\\${SITE_URL}\" \\\n    --from-literal=ADDITIONAL_REDIRECT_URLS=\"\\${ADDITIONAL_REDIRECT_URLS}\" \\\n    --from-literal=JWT_EXPIRY=\"\\${JWT_EXPIRY}\" \\\n    --from-literal=ENABLE_EMAIL_SIGNUP=\"\\${ENABLE_EMAIL_SIGNUP}\" \\\n    --from-literal=ENABLE_EMAIL_AUTOCONFIRM=\"\\${ENABLE_EMAIL_AUTOCONFIRM}\" \\\n    --from-literal=SMTP_ADMIN_EMAIL=\"\\${SMTP_ADMIN_EMAIL}\" \\\n    --from-literal=SMTP_HOST=\"\\${SMTP_HOST}\" \\\n    --from-literal=SMTP_PORT=\"\\${SMTP_PORT}\" \\\n    --from-literal=SMTP_SENDER_NAME=\"\\${SMTP_SENDER_NAME}\" \\\n    --from-literal=PGRST_DB_SCHEMAS=\"\\${PGRST_DB_SCHEMAS}\" \\\n    --from-literal=PGRST_DB_MAX_ROWS=\"\\${PGRST_DB_MAX_ROWS}\" \\\n    --from-literal=PGRST_DB_EXTRA_SEARCH_PATH=\"\\${PGRST_DB_EXTRA_SEARCH_PATH}\" \\\n    --from-literal=GLOBAL_S3_BUCKET=\"\\${GLOBAL_S3_BUCKET}\" \\\n    --from-literal=STORAGE_TENANT_ID=\"\\${STORAGE_TENANT_ID}\" \\\n    --from-literal=REGION=\"\\${REGION}\" \\\n    --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create configmap supabase-gateway-config \\\n    --from-file=temp.yml=\"\\${K8S_DIR}/supabase/gateway.template.yml\" \\\n    --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" create configmap supabase-kong-entrypoint \\\n    --from-file=kong-entrypoint.sh=\"\\${K8S_DIR}/supabase/kong-entrypoint.sh\" \\\n    --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" apply -f -\n\n  rm -f \"\\${tmp_runtime}\" \"\\${tmp_public}\"\n  trap - EXIT\n}\n\ndocker_load_image_to_minikube() {\n  if command -v docker >/dev/null 2>&1 && docker image inspect \"\\${APP_IMAGE}\" >/dev/null 2>&1; then\n    minikube -p \"\\${PROFILE}\" image load --daemon=true --overwrite=true \"\\${APP_IMAGE}\" >/dev/null\n    return 0\n  fi\n\n  return 1\n}\n\nrun_supabase_migrations() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  export SUPABASE_DB_URL PGSSLMODE=disable\n\n  if [[ -d \"\\${ROOT_DIR}/supabase/migrations\" ]]; then\n    require_command supabase\n    (\n      cd \"\\${ROOT_DIR}\"\n      supabase migration up --db-url \"\\${SUPABASE_DB_URL}\"\n    )\n  fi\n}\n\nreconcile_supabase_profile() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n  if [[ \"\\${SUPABASE_PROFILE_ENABLED}\" == \"true\" && -f \"\\${SUPABASE_PROFILE_RECONCILE_FILE}\" ]]; then\n    psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${SUPABASE_PROFILE_RECONCILE_FILE}\"\n  fi\n}\n\nreload_postgrest_schema() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -c \"notify pgrst, 'reload schema';\"\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout restart deployment/rest >/dev/null\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/rest --timeout=600s\n}\n\nbootstrap_supabase_vault_migration() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n  if [[ -f \"\\${ROOT_DIR}/supabase/migrations/202607120001_ankhorage_supabase_vault.sql\" ]]; then\n    kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" exec deployment/postgres -- psql -U postgres -d postgres -v ON_ERROR_STOP=1 -q -c \"alter role postgres with superuser;\"\n    kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" exec deployment/postgres -- psql -U postgres -d postgres -v ON_ERROR_STOP=1 -q -c \"create schema if not exists vault; grant pg_read_server_files to postgres; grant pg_read_server_files to supabase_admin; grant execute on function pg_read_file(text) to public; grant execute on function pg_read_file(text, bigint, bigint) to public;\"\n    psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${ROOT_DIR}/supabase/migrations/202607120001_ankhorage_supabase_vault.sql\"\n  fi\n}\n\nbootstrap_supabase_database() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  require_command psql\n  export POSTGRES_PASSWORD JWT_SECRET JWT_EXP=\"\\${JWT_EXPIRY}\" POSTGRES_USER=postgres\n  psql \"\\${SUPABASE_DB_URL}\" -v ON_ERROR_STOP=1 -q -f \"\\${K8S_DIR}/supabase/bootstrap.sql\"\n}\n\nwait_for_supabase_database() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  require_command psql\n  if ! \"\\${PORT_FORWARD_SCRIPT}\" start db-migration; then\n    echo \"Failed to start db-migration port-forward for Supabase bootstrap.\"\n    \"\\${PORT_FORWARD_SCRIPT}\" status db-migration || true\n    exit 1\n  fi\n  for attempt in {1..60}; do\n    if PGPASSWORD=\"\\${POSTGRES_PASSWORD}\" psql -h 127.0.0.1 -p \"\\${SUPABASE_DB_FORWARD_LOCAL_PORT}\" -U postgres -d postgres -v ON_ERROR_STOP=1 -Atq -c 'select 1' >/dev/null 2>&1; then\n      return 0\n    fi\n    sleep 2\n  done\n\n  echo \"Postgres did not accept SQL connections as postgres before bootstrap.\"\n  \"\\${PORT_FORWARD_SCRIPT}\" status db-migration || true\n  exit 1\n}\n\napply_supabase_runtime_workloads() {\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    return 0\n  fi\n\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/auth.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/rest.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/realtime.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/imgproxy.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/storage.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/meta.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/gateway.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/studio.yaml\"\n}\n\napply_namespace_manifests() {\n  local namespace_manifest\n  for namespace_manifest in \"\\${K8S_DIR}\"/namespaces/*.yaml; do\n    kubectl --context \"\\${PROFILE}\" apply -f \"\\${namespace_manifest}\"\n  done\n}\n\n${providerLifecycleStageScripts}\n\nload_env_file_preserving_process_env\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nDRIVER=\"\\${MINIKUBE_DRIVER:-docker}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-true}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-$(cd \"\\${ROOT_DIR}/../..\" && pwd)}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-.ankh/web-export}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-${defaultAppImage}}\"\nAPP_IMAGE_SYNC_STRATEGY=\"\\${APP_IMAGE_SYNC_STRATEGY:-docker-load}\"\nAPP_REPLICAS=\"\\${APP_REPLICAS:-1}\"\nAPP_FORCE_ROLLOUT_RESTART=\"\\${APP_FORCE_ROLLOUT_RESTART:-true}\"\nAPP_IMAGE_PULL_SECRET_NAME=\"\\${APP_IMAGE_PULL_SECRET_NAME:-}\"\nAPP_IMAGE_PULL_SECRET_SERVER=\"\\${APP_IMAGE_PULL_SECRET_SERVER:-ghcr.io}\"\nAPP_IMAGE_PULL_SECRET_USERNAME=\"\\${APP_IMAGE_PULL_SECRET_USERNAME:-}\"\nAPP_IMAGE_PULL_SECRET_PASSWORD=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD:-}\"\nAPP_IMAGE_PULL_SECRET_EMAIL=\"\\${APP_IMAGE_PULL_SECRET_EMAIL:-}\"\nAPP_PORT_FORWARD_LOCAL_PORT=\"\\${APP_PORT_FORWARD_LOCAL_PORT:-${supabaseHostPorts.app}}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\nSUPABASE_DB_FORWARD_LOCAL_PORT=\"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-${supabaseHostPorts.db}}\"\nSUPABASE_DB_URL=\"\\${SUPABASE_DB_URL:-}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\ncleanup_failed_up() {\n  \"\\${PORT_FORWARD_SCRIPT}\" stop all >/dev/null 2>&1 || true\n}\n\ntrap cleanup_failed_up ERR\n\nrequire_command minikube\nrequire_command kubectl\nensure_supabase_runtime_env\nsync_app_public_supabase_env\n\nHOST_STATUS=\"$(minikube -p \"\\${PROFILE}\" status --format='{{.Host}}' 2>/dev/null || true)\"\nif [[ \"\\${HOST_STATUS}\" != \"Running\" ]]; then\n  minikube start -p \"\\${PROFILE}\" --driver=\"\\${DRIVER}\"\nfi\n\nif [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n  apply_namespace_manifests\n  sync_supabase_secrets\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/postgres.init.configmap.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/postgres.pvc.yaml\"\n  kubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/supabase/postgres.yaml\"\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/postgres --timeout=900s\n  wait_for_supabase_database\n  bootstrap_supabase_database\n  bootstrap_supabase_vault_migration\n  resolve_oauth_credentials_from_vault\n${oauthValidation}\n  sync_supabase_secrets\n  apply_supabase_runtime_workloads\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/auth --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/rest --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/realtime --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/storage --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/gateway --timeout=600s\n  kubectl --context \"\\${PROFILE}\" -n \"\\${SUPABASE_NAMESPACE}\" rollout status deployment/studio --timeout=600s\n  run_supabase_migrations\n  reconcile_supabase_profile\n  reload_postgrest_schema\n  \"\\${PORT_FORWARD_SCRIPT}\" start supabase-gateway >/dev/null\n  \"\\${PORT_FORWARD_SCRIPT}\" start studio >/dev/null\nelse\n  kubectl --context \"\\${PROFILE}\" apply -k \"\\${K8S_DIR}\"\nfi\n\nif [[ \"\\${APP_BUILD_ENABLED}\" == \"true\" ]]; then\n  if [[ ! -x \"\\${BUILD_SCRIPT}\" ]]; then\n    echo \"Missing build helper script: \\${BUILD_SCRIPT}\"\n    exit 1\n  fi\n\n  \"\\${BUILD_SCRIPT}\"\nfi\n\nif [[ \"\\${APP_WEB_EXPORT_DIR}\" = /* ]]; then\n  EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR}\"\nelse\n  EXPORT_DIR=\"\\${APP_SOURCE_DIR}/\\${APP_WEB_EXPORT_DIR}\"\nfi\n\ncase \"\\${APP_IMAGE_SYNC_STRATEGY}\" in\n  minikube-build)\n    if [[ ! -f \"\\${EXPORT_DIR}/index.html\" ]]; then\n      echo \"Expected web export output not found at \\${EXPORT_DIR}/index.html\"\n      exit 1\n    fi\n    minikube -p \"\\${PROFILE}\" image build -t \"\\${APP_IMAGE}\" -f \"\\${ROOT_DIR}/app-image/Dockerfile\" \"\\${EXPORT_DIR}\" >/dev/null\n    ;;\n  docker-load)\n    if ! docker_load_image_to_minikube; then\n      echo \"Skipping docker-load image sync; local Docker image \\${APP_IMAGE} not found.\"\n    fi\n    ;;\n  none)\n    echo \"Skipping local image sync (APP_IMAGE_SYNC_STRATEGY=none).\"\n    ;;\n  *)\n    echo \"Unsupported APP_IMAGE_SYNC_STRATEGY=\\${APP_IMAGE_SYNC_STRATEGY}. Use minikube-build, docker-load, or none.\"\n    exit 1\n    ;;\nesac\n\nif [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n  kubectl --context \"\\${PROFILE}\" apply -k \"\\${K8S_DIR}\"\nfi\n\nwait_for_provider_readiness\nrun_provider_migrations\nrun_provider_reconciliation\n\nif [[ -n \"\\${APP_IMAGE_PULL_SECRET_NAME}\" ]]; then\n  if [[ -z \"\\${APP_IMAGE_PULL_SECRET_USERNAME}\" || -z \"\\${APP_IMAGE_PULL_SECRET_PASSWORD}\" ]]; then\n    echo \"APP_IMAGE_PULL_SECRET_NAME is set, but username/password are missing.\"\n    exit 1\n  fi\n\n  SECRET_EMAIL_ARG=()\n  if [[ -n \"\\${APP_IMAGE_PULL_SECRET_EMAIL}\" ]]; then\n    SECRET_EMAIL_ARG=(--docker-email=\"\\${APP_IMAGE_PULL_SECRET_EMAIL}\")\n  fi\n\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" create secret docker-registry \"\\${APP_IMAGE_PULL_SECRET_NAME}\" --docker-server=\"\\${APP_IMAGE_PULL_SECRET_SERVER}\" --docker-username=\"\\${APP_IMAGE_PULL_SECRET_USERNAME}\" --docker-password=\"\\${APP_IMAGE_PULL_SECRET_PASSWORD}\" \"\\${SECRET_EMAIL_ARG[@]}\" --dry-run=client -o yaml | kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" apply -f -\n\n  PULL_SECRET_PATCH=\"$(cat <<EOF\n{\"spec\":{\"template\":{\"spec\":{\"imagePullSecrets\":[{\"name\":\"\\${APP_IMAGE_PULL_SECRET_NAME}\"}]}}}}\nEOF\n)\"\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" patch deployment app-runtime --type=merge --patch \"\\${PULL_SECRET_PATCH}\" >/dev/null\nelse\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" patch deployment app-runtime --type=json --patch='[{\"op\":\"remove\",\"path\":\"/spec/template/spec/imagePullSecrets\"}]' >/dev/null 2>&1 || true\nfi\n\nkubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" set image deployment/app-runtime app=\"\\${APP_IMAGE}\" >/dev/null\nkubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" scale deployment/app-runtime --replicas=\"\\${APP_REPLICAS}\" >/dev/null\n\nif [[ \"\\${APP_FORCE_ROLLOUT_RESTART}\" == \"true\" ]]; then\n  kubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" rollout restart deployment/app-runtime >/dev/null\nfi\n\nkubectl --context \"\\${PROFILE}\" -n \"\\${APP_NAMESPACE}\" rollout status deployment/app-runtime --timeout=180s >/dev/null\n\"\\${PORT_FORWARD_SCRIPT}\" start app >/dev/null\n\ntrap - ERR\necho \"Minikube infrastructure for '\\${PROFILE}' is running.\"\n`;\n}\n\nfunction getBuildAppImageScript(args: { appSlug: string; defaultAppImage: string }): string {\n  const { appSlug, defaultAppImage } = args;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nDOCKERFILE_PATH=\"\\${ROOT_DIR}/app-image/Dockerfile\"\nAPP_SLUG=\"${appSlug}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nAPP_BUILD_ENABLED=\"\\${APP_BUILD_ENABLED:-true}\"\nAPP_SOURCE_DIR=\"\\${APP_SOURCE_DIR:-$(cd \"\\${ROOT_DIR}/../..\" && pwd)}\"\nAPP_WEB_EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR:-.ankh/web-export}\"\nAPP_IMAGE=\"\\${APP_IMAGE:-${defaultAppImage}}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\nif [[ \"\\${APP_BUILD_ENABLED}\" != \"true\" ]]; then\n  echo \"Skipping app image build (APP_BUILD_ENABLED=\\${APP_BUILD_ENABLED}).\"\n  exit 0\nfi\n\nif ! command -v docker >/dev/null 2>&1; then\n  echo \"docker is required to build app image.\"\n  exit 1\nfi\n\nif ! command -v bunx >/dev/null 2>&1; then\n  echo \"bunx is required to export the app for container image build.\"\n  exit 1\nfi\n\nif [[ ! -f \"\\${APP_SOURCE_DIR}/package.json\" ]]; then\n  echo \"APP_SOURCE_DIR does not look like an app root: \\${APP_SOURCE_DIR}\"\n  exit 1\nfi\n\nif [[ ! -f \"\\${DOCKERFILE_PATH}\" ]]; then\n  echo \"Dockerfile for app image build is missing: \\${DOCKERFILE_PATH}\"\n  exit 1\nfi\n\n(\n  cd \"\\${APP_SOURCE_DIR}\"\n  bunx expo export --platform web --output-dir \"\\${APP_WEB_EXPORT_DIR}\"\n)\n\nif [[ \"\\${APP_WEB_EXPORT_DIR}\" = /* ]]; then\n  EXPORT_DIR=\"\\${APP_WEB_EXPORT_DIR}\"\nelse\n  EXPORT_DIR=\"\\${APP_SOURCE_DIR}/\\${APP_WEB_EXPORT_DIR}\"\nfi\n\nif [[ ! -f \"\\${EXPORT_DIR}/index.html\" ]]; then\n  echo \"Expected web export output not found at \\${EXPORT_DIR}/index.html\"\n  exit 1\nfi\n\ndocker build -t \"\\${APP_IMAGE}\" \\\n  --label \"ankhorage.kind=generated-app\" \\\n  --label \"ankhorage.app_slug=\\${PROFILE}\" \\\n  --label \"ankhorage.image=\\${APP_IMAGE}\" \\\n  -f \"\\${DOCKERFILE_PATH}\" \\\n  \"\\${EXPORT_DIR}\"\necho \"Built app image: \\${APP_IMAGE} (profile: \\${PROFILE})\"\n`;\n}\n\nfunction getAppImageDockerfile(): string {\n  return `FROM nginx:1.27-alpine\n\nRUN cat <<'EOF' > /etc/nginx/conf.d/default.conf\nserver {\n  listen 8080;\n  absolute_redirect off;\n  server_name _;\n  root /usr/share/nginx/html;\n  index index.html;\n\n  location / {\n    try_files $uri $uri/ /index.html;\n  }\n}\nEOF\n\nCOPY . /usr/share/nginx/html\n\nEXPOSE 8080\n\nCMD [\"nginx\", \"-g\", \"daemon off;\"]\n`;\n}\n\nfunction getPortForwardScript(args: {\n  appSlug: string;\n  supabaseKubernetesEnabled: boolean;\n  supabaseHostPorts: SupabaseHostPorts;\n}): string {\n  const { appSlug, supabaseKubernetesEnabled, supabaseHostPorts } = args;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nSTATE_DIR=\"\\${ROOT_DIR}/.state/forwards\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nAPP_PORT_FORWARD_LOCAL_PORT=\"\\${APP_PORT_FORWARD_LOCAL_PORT:-${supabaseHostPorts.app}}\"\nAPP_PORT_FORWARD_REMOTE_PORT=\"\\${APP_PORT_FORWARD_REMOTE_PORT:-80}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\nSUPABASE_GATEWAY_FORWARD_REMOTE_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_REMOTE_PORT:-8000}\"\nSUPABASE_STUDIO_FORWARD_LOCAL_PORT=\"\\${SUPABASE_STUDIO_FORWARD_LOCAL_PORT:-${supabaseHostPorts.studio}}\"\nSUPABASE_STUDIO_FORWARD_REMOTE_PORT=\"\\${SUPABASE_STUDIO_FORWARD_REMOTE_PORT:-3000}\"\nSUPABASE_DB_FORWARD_LOCAL_PORT=\"\\${SUPABASE_DB_FORWARD_LOCAL_PORT:-${supabaseHostPorts.db}}\"\nSUPABASE_DB_FORWARD_REMOTE_PORT=\"\\${SUPABASE_DB_FORWARD_REMOTE_PORT:-5432}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"kubectl is required but not installed.\"\n  exit 1\nfi\n\nmkdir -p \"\\${STATE_DIR}\"\n\npid_file_for() {\n  echo \"\\${STATE_DIR}/\\${PROFILE}-\\${1}.pid\"\n}\n\ntarget_for() {\n  case \"\\${1}\" in\n    app)\n      echo \"${APP_NAMESPACE} service/app-runtime \\${APP_PORT_FORWARD_LOCAL_PORT} \\${APP_PORT_FORWARD_REMOTE_PORT}\"\n      ;;\n    supabase-gateway)\n      echo \"${SUPABASE_NAMESPACE} service/gateway \\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT} \\${SUPABASE_GATEWAY_FORWARD_REMOTE_PORT}\"\n      ;;\n    studio)\n      echo \"${SUPABASE_NAMESPACE} service/studio \\${SUPABASE_STUDIO_FORWARD_LOCAL_PORT} \\${SUPABASE_STUDIO_FORWARD_REMOTE_PORT}\"\n      ;;\n    db-migration)\n      echo \"${SUPABASE_NAMESPACE} service/postgres \\${SUPABASE_DB_FORWARD_LOCAL_PORT} \\${SUPABASE_DB_FORWARD_REMOTE_PORT}\"\n      ;;\n    *)\n      echo \"Unknown forward '\\${1}'. Use app, supabase-gateway, studio, db-migration, or all.\" >&2\n      return 1\n      ;;\n  esac\n}\n\nis_pid_running() {\n  local pid=\"\\${1}\"\n  [[ -n \"\\${pid}\" ]] && kill -0 \"\\${pid}\" >/dev/null 2>&1\n}\n\nis_port_accepting() {\n  local port=\"\\${1}\"\n  (echo >/dev/tcp/127.0.0.1/\"\\${port}\") >/dev/null 2>&1\n}\n\nprint_forward_log_tail() {\n  local name=\"\\${1}\"\n  local log_file=\"\\${STATE_DIR}/\\${PROFILE}-\\${name}.log\"\n  if [[ -s \"\\${log_file}\" ]]; then\n    echo \"\\${name}: recent kubectl port-forward log:\"\n    tail -n 20 \"\\${log_file}\"\n  fi\n}\n\nprocess_command_for_pid() {\n  local pid=\"\\${1}\"\n  ps -p \"\\${pid}\" -o command= 2>/dev/null || true\n}\n\nprocess_name_for_pid() {\n  local pid=\"\\${1}\"\n  ps -p \"\\${pid}\" -o comm= 2>/dev/null || true\n}\n\nis_owned_forward_process() {\n  local pid=\"\\${1}\"\n  local namespace=\"\\${2}\"\n  local resource=\"\\${3}\"\n  local local_port=\"\\${4}\"\n  local remote_port=\"\\${5}\"\n  local command\n  local process_name\n  command=\"$(process_command_for_pid \"\\${pid}\")\"\n  process_name=\"$(process_name_for_pid \"\\${pid}\")\"\n\n  case \"\\${process_name}\" in\n    *kubectl) ;;\n    *) return 1 ;;\n  esac\n\n  case \"\\${command}\" in\n    *\"kubectl --context \\${PROFILE} -n \\${namespace} port-forward \\${resource} \\${local_port}:\\${remote_port}\"*)\n      return 0\n      ;;\n    *)\n      return 1\n      ;;\n  esac\n}\n\nhandle_non_owned_forward_pid() {\n  local name=\"\\${1}\"\n  local pid=\"\\${2}\"\n  local pid_file=\"\\${3}\"\n  local local_port=\"\\${4}\"\n  echo \"\\${name}: stale pid file pointed at non-owned live pid \\${pid}; removing ownership record \\${pid_file}\"\n  rm -f \"\\${pid_file}\"\n\n  if is_port_accepting \"\\${local_port}\"; then\n    echo \"\\${name}: port occupied by non-owned process on local port \\${local_port}\"\n    return 1\n  fi\n\n  return 0\n}\n\nterminate_forward_process() {\n  local name=\"\\${1}\"\n  local pid=\"\\${2}\"\n  local namespace=\"\\${3}\"\n  local resource=\"\\${4}\"\n  local local_port=\"\\${5}\"\n  local remote_port=\"\\${6}\"\n\n  if [[ -z \"\\${pid}\" ]]; then\n    return 0\n  fi\n\n  if is_pid_running \"\\${pid}\" && ! is_owned_forward_process \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n    echo \"\\${name}: refusing to terminate non-owned live pid \\${pid}\"\n    return 1\n  fi\n\n  if is_pid_running \"\\${pid}\"; then\n    kill \"\\${pid}\" >/dev/null 2>&1 || true\n    for attempt in {1..20}; do\n      if ! is_pid_running \"\\${pid}\"; then\n        break\n      fi\n      sleep 0.25\n    done\n  fi\n\n  if is_pid_running \"\\${pid}\"; then\n    kill -KILL \"\\${pid}\" >/dev/null 2>&1 || true\n    for attempt in {1..20}; do\n      if ! is_pid_running \"\\${pid}\"; then\n        break\n      fi\n      sleep 0.25\n    done\n  fi\n\n  if is_pid_running \"\\${pid}\"; then\n    echo \"\\${name}: failed to stop owned port-forward pid \\${pid}\"\n    return 1\n  fi\n\n  for attempt in {1..20}; do\n    if ! is_port_accepting \"\\${local_port}\"; then\n      return 0\n    fi\n    sleep 0.25\n  done\n\n  echo \"\\${name}: owned port-forward pid \\${pid} stopped, but local port \\${local_port} is still accepting connections\"\n  return 1\n}\n\nstart_forward() {\n  local name=\"\\${1}\"\n  local pid_file\n  pid_file=\"$(pid_file_for \"\\${name}\")\"\n  read -r namespace resource local_port remote_port <<<\"$(target_for \"\\${name}\")\"\n\n  if [[ -f \"\\${pid_file}\" ]]; then\n    local existing_pid\n    existing_pid=\"$(cat \"\\${pid_file}\")\"\n    if is_pid_running \"\\${existing_pid}\"; then\n      if ! is_owned_forward_process \"\\${existing_pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n        handle_non_owned_forward_pid \"\\${name}\" \"\\${existing_pid}\" \"\\${pid_file}\" \"\\${local_port}\" || return 1\n      elif is_port_accepting \"\\${local_port}\"; then\n        echo \"\\${name}: running (pid \\${existing_pid})\"\n        return 0\n      else\n        echo \"\\${name}: stale running pid \\${existing_pid} was not accepting local port \\${local_port}; restarting\"\n        terminate_forward_process \"\\${name}\" \"\\${existing_pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\" || return 1\n        rm -f \"\\${pid_file}\"\n      fi\n    else\n      rm -f \"\\${pid_file}\"\n    fi\n  fi\n\n  if [[ \"\\${namespace}\" == \"${SUPABASE_NAMESPACE}\" && \"\\${SUPABASE_RUNTIME_ENABLED}\" != \"true\" ]]; then\n    echo \"\\${name}: skipped (Supabase Kubernetes disabled)\"\n    return 0\n  fi\n\n  if ! kubectl --context \"\\${PROFILE}\" -n \"\\${namespace}\" get \"\\${resource}\" >/dev/null 2>&1; then\n    echo \"\\${name}: target \\${namespace}/\\${resource} not found\"\n    return 1\n  fi\n\n  nohup kubectl --context \"\\${PROFILE}\" -n \"\\${namespace}\" port-forward \"\\${resource}\" \"\\${local_port}:\\${remote_port}\" >\"\\${STATE_DIR}/\\${PROFILE}-\\${name}.log\" 2>&1 &\n  local pid=\"$!\"\n  echo \"\\${pid}\" > \"\\${pid_file}\"\n\n  for attempt in {1..40}; do\n    if ! is_pid_running \"\\${pid}\"; then\n      echo \"\\${name}: failed to start local port \\${local_port} for \\${namespace}/\\${resource}:\\${remote_port}\"\n      print_forward_log_tail \"\\${name}\"\n      rm -f \"\\${pid_file}\"\n      return 1\n    fi\n    if is_port_accepting \"\\${local_port}\"; then\n      echo \"\\${name}: started (pid \\${pid}, local port \\${local_port})\"\n      return 0\n    fi\n    sleep 0.5\n  done\n\n  echo \"\\${name}: did not become ready on local port \\${local_port} for \\${namespace}/\\${resource}:\\${remote_port}\"\n  print_forward_log_tail \"\\${name}\"\n  terminate_forward_process \"\\${name}\" \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\" || return 1\n  rm -f \"\\${pid_file}\"\n  return 1\n}\n\nstop_forward() {\n  local name=\"\\${1}\"\n  local pid_file\n  pid_file=\"$(pid_file_for \"\\${name}\")\"\n  read -r namespace resource local_port remote_port <<<\"$(target_for \"\\${name}\")\"\n  if [[ ! -f \"\\${pid_file}\" ]]; then\n    echo \"\\${name}: stopped\"\n    return 0\n  fi\n\n  local pid\n  pid=\"$(cat \"\\${pid_file}\")\"\n  if is_pid_running \"\\${pid}\" && ! is_owned_forward_process \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n    handle_non_owned_forward_pid \"\\${name}\" \"\\${pid}\" \"\\${pid_file}\" \"\\${local_port}\" || return 1\n    echo \"\\${name}: stopped\"\n    return 0\n  fi\n\n  terminate_forward_process \"\\${name}\" \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\" || return 1\n  rm -f \"\\${pid_file}\"\n  echo \"\\${name}: stopped\"\n}\n\nstatus_forward() {\n  local name=\"\\${1}\"\n  local pid_file\n  pid_file=\"$(pid_file_for \"\\${name}\")\"\n  if [[ ! -f \"\\${pid_file}\" ]]; then\n    echo \"\\${name}: stopped\"\n    return 0\n  fi\n\n  local pid\n  pid=\"$(cat \"\\${pid_file}\")\"\n  if is_pid_running \"\\${pid}\"; then\n    read -r namespace resource local_port remote_port <<<\"$(target_for \"\\${name}\")\"\n    if ! is_owned_forward_process \"\\${pid}\" \"\\${namespace}\" \"\\${resource}\" \"\\${local_port}\" \"\\${remote_port}\"; then\n      echo \"\\${name}: stale_pid_non_owned=\\${pid}\"\n      rm -f \"\\${pid_file}\"\n      return 0\n    fi\n    if is_port_accepting \"\\${local_port}\"; then\n      echo \"\\${name}: running pid=\\${pid} url=127.0.0.1:\\${local_port} target=\\${namespace}/\\${resource}:\\${remote_port}\"\n      return 0\n    fi\n    echo \"\\${name}: not ready pid=\\${pid} url=127.0.0.1:\\${local_port} target=\\${namespace}/\\${resource}:\\${remote_port}\"\n    return 0\n  fi\n\n  echo \"\\${name}: crashed stale_pid=\\${pid}\"\n  rm -f \"\\${pid_file}\"\n}\n\nfor_each_forward() {\n  local action=\"\\${1}\"\n  \"\\${action}_forward\" app\n  if [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n    \"\\${action}_forward\" supabase-gateway\n    \"\\${action}_forward\" studio\n    \"\\${action}_forward\" db-migration\n  fi\n}\n\nACTION=\"\\${1:-start}\"\nNAME=\"\\${2:-all}\"\n\ncase \"\\${ACTION}:\\${NAME}\" in\n  start:all) for_each_forward start ;;\n  stop:all) for_each_forward stop ;;\n  status:all) for_each_forward status ;;\n  start:*) start_forward \"\\${NAME}\" ;;\n  stop:*) stop_forward \"\\${NAME}\" ;;\n  status:*) status_forward \"\\${NAME}\" ;;\n  *)\n    echo \"Usage: ./scripts/port-forward.sh {start|stop|status} {app|supabase-gateway|studio|db-migration|all}\"\n    exit 1\n    ;;\nesac\n`;\n}\n\nfunction getDownScript(appSlug: string): string {\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" stop all >/dev/null || true\n\nif command -v minikube >/dev/null 2>&1; then\n  minikube stop -p \"\\${PROFILE}\"\nelse\n  echo \"minikube is required but not installed.\"\n  exit 1\nfi\n\necho \"Stopped Minikube profile '\\${PROFILE}'. Persistent data remains in the profile.\"\n`;\n}\n\nfunction getResetScript(args: {\n  appSlug: string;\n  supabaseKubernetesEnabled: boolean;\n  providerNamespaces: readonly string[];\n}): string {\n  const { appSlug, supabaseKubernetesEnabled, providerNamespaces } = args;\n  const resetNamespaces = [\n    APP_NAMESPACE,\n    ...(supabaseKubernetesEnabled ? [SUPABASE_NAMESPACE] : []),\n    ...providerNamespaces,\n  ];\n  const resetNamespaceCommands = resetNamespaces\n    .map(\n      (\n        namespace,\n      ) => `kubectl --context \"\\${PROFILE}\" delete namespace ${namespace} --ignore-not-found\nkubectl --context \"\\${PROFILE}\" apply -f \"\\${K8S_DIR}/namespaces/${namespace}.yaml\"`,\n    )\n    .join('\\n');\n  const resetScope = `Kubernetes namespaces ${resetNamespaces.join(', ')}`;\n  const resetDataDescription = `reset.sh deletes and recreates namespaces ${resetNamespaces.join(\n    ', ',\n  )}. This resets app workloads and provider-owned data in those namespaces. It does not delete the Minikube profile.`;\n  const completionDescription = `Reset namespaces ${resetNamespaces.join(', ')}`;\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nK8S_DIR=\"\\${ROOT_DIR}/k8s\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nCONFIRM=\"\\${ANKH_RESET_CONFIRM:-}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\nif [[ \"\\${CONFIRM}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"Refusing reset. Set ANKH_RESET_CONFIRM=\\${APP_SLUG} to reset ${resetScope} inside profile '\\${PROFILE}'.\"\n  echo \"${resetDataDescription}\"\n  exit 1\nfi\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"kubectl is required but not installed.\"\n  exit 1\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" stop all >/dev/null || true\n${resetNamespaceCommands}\necho \"${completionDescription} for profile '\\${PROFILE}'. Run ./scripts/up.sh to recreate runtime secrets, migrations, forwards, and app rollout.\"\n`;\n}\n\nfunction getDestroyScript(appSlug: string): string {\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" stop all >/dev/null || true\nminikube delete -p \"\\${PROFILE}\"\necho \"Deleted Minikube profile '\\${PROFILE}'.\"\n`;\n}\n\nfunction getStatusScript(args: {\n  appSlug: string;\n  supabaseKubernetesEnabled: boolean;\n  profileModel: ResolvedProfileModel;\n  supabaseHostPorts: SupabaseHostPorts;\n  providerNamespaces: readonly string[];\n  providerLifecycle: readonly MinikubeProviderLifecycle[];\n}): string {\n  const {\n    appSlug,\n    supabaseKubernetesEnabled,\n    profileModel,\n    supabaseHostPorts,\n    providerNamespaces,\n    providerLifecycle,\n  } = args;\n  const namespaces = [\n    APP_NAMESPACE,\n    ...(supabaseKubernetesEnabled ? [SUPABASE_NAMESPACE] : []),\n    ...providerNamespaces,\n  ].join(' ');\n  const providerStatusScript = getProviderStatusScript(providerLifecycle);\n\n  return `#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"\\${BASH_SOURCE[0]}\")\" && pwd)\"\nROOT_DIR=\"$(cd \"\\${SCRIPT_DIR}/..\" && pwd)\"\nAPP_SLUG=\"${appSlug}\"\nPROFILE=\"\\${ANKH_APP_SLUG:-${appSlug}}\"\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\nSUPABASE_PROFILE_ENABLED=\"${profileModel.enabled ? 'true' : 'false'}\"\nSUPABASE_GATEWAY_FORWARD_LOCAL_PORT=\"\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}\"\n\nif [[ -f \"\\${ROOT_DIR}/.env\" ]]; then\n  set -a\n  # shellcheck disable=SC1090\n  source \"\\${ROOT_DIR}/.env\"\n  set +a\nfi\nSUPABASE_RUNTIME_ENABLED=\"${supabaseKubernetesEnabled ? 'true' : 'false'}\"\n\nif [[ \"\\${PROFILE}\" != \"\\${APP_SLUG}\" ]]; then\n  echo \"ANKH_APP_SLUG must remain the generated canonical slug '\\${APP_SLUG}' for this infra directory.\"\n  exit 1\nfi\n\necho \"Infra status for profile: \\${PROFILE}\"\n\nif ! command -v minikube >/dev/null 2>&1; then\n  echo \"- minikube: missing\"\n  exit 1\nfi\n\nHOST_STATUS=\"$(minikube -p \"\\${PROFILE}\" status --format='{{.Host}}' 2>/dev/null || true)\"\necho \"- minikube host: \\${HOST_STATUS:-missing}\"\n\nif [[ \"\\${HOST_STATUS}\" != \"Running\" ]]; then\n  echo \"- cluster: stopped\"\n  \"\\${SCRIPT_DIR}/port-forward.sh\" status all || true\n  exit 0\nfi\n\nif ! command -v kubectl >/dev/null 2>&1; then\n  echo \"- kubectl: missing\"\n  exit 1\nfi\n\ncheck_secret_key() {\n  local secret=\"\\${1}\"\n  local key=\"\\${2}\"\n  local encoded\n  encoded=\"$(kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} get secret \"\\${secret}\" -o \"jsonpath={.data.\\${key}}\" 2>/dev/null || true)\"\n  if [[ -n \"\\${encoded}\" ]]; then\n    echo \"- secret/\\${secret}:\\${key}: present\"\n  else\n    echo \"- secret/\\${secret}:\\${key}: missing\"\n  fi\n}\n\npostgres_query() {\n  local sql=\"\\${1}\"\n  kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} exec deployment/postgres -- psql -U postgres -d postgres -Atq -c \"\\${sql}\" 2>/dev/null || true\n}\n\nfor namespace in ${namespaces}; do\n  if kubectl --context \"\\${PROFILE}\" get namespace \"\\${namespace}\" >/dev/null 2>&1; then\n    echo \"- namespace/\\${namespace}: present\"\n    kubectl --context \"\\${PROFILE}\" -n \"\\${namespace}\" get pods\n  else\n    echo \"- namespace/\\${namespace}: missing\"\n  fi\ndone\n\nif kubectl --context \"\\${PROFILE}\" -n ${APP_NAMESPACE} get deployment app-runtime >/dev/null 2>&1; then\n  kubectl --context \"\\${PROFILE}\" -n ${APP_NAMESPACE} rollout status deployment/app-runtime --timeout=5s >/dev/null 2>&1 && echo \"- app-runtime: ready\" || echo \"- app-runtime: not ready\"\nfi\n\n${providerStatusScript}\n\nif [[ \"\\${SUPABASE_RUNTIME_ENABLED}\" == \"true\" ]]; then\n  for deployment in postgres auth rest realtime storage gateway studio; do\n    if kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} get deployment \"\\${deployment}\" >/dev/null 2>&1; then\n      kubectl --context \"\\${PROFILE}\" -n ${SUPABASE_NAMESPACE} rollout status \"deployment/\\${deployment}\" --timeout=5s >/dev/null 2>&1 && echo \"- supabase/\\${deployment}: ready\" || echo \"- supabase/\\${deployment}: not ready\"\n    else\n      echo \"- supabase/\\${deployment}: missing\"\n    fi\n  done\n\n  for key in POSTGRES_PASSWORD JWT_SECRET SUPABASE_ANON_KEY SUPABASE_SERVICE_ROLE_KEY SECRET_KEY_BASE REALTIME_DB_ENC_KEY PG_META_CRYPTO_KEY; do\n    check_secret_key supabase-runtime-secrets \"\\${key}\"\n  done\n\n  db_check=\"$(postgres_query 'select 1')\"\n  if [[ \"\\${db_check}\" == \"1\" ]]; then\n    echo \"- postgres connectivity: ok\"\n  else\n    echo \"- postgres connectivity: failed\"\n  fi\n\n  migration_count=\"$(postgres_query \"select count(*) from supabase_migrations.schema_migrations\" || true)\"\n  if [[ \"\\${migration_count}\" =~ ^[0-9]+$ ]]; then\n    echo \"- migration history: \\${migration_count} applied\"\n  else\n    echo \"- migration history: unavailable\"\n  fi\n\n  if [[ \"\\${SUPABASE_PROFILE_ENABLED}\" == \"true\" ]]; then\n    profile_state=\"$(postgres_query \"select count(*) from ankhorage_internal.generated_schema_state where artifact_key = 'auth.profile'\" || true)\"\n    if [[ \"\\${profile_state}\" =~ ^[1-9][0-9]*$ ]]; then\n      echo \"- profile reconciliation: applied\"\n    else\n      echo \"- profile reconciliation: missing\"\n    fi\n  else\n    state_table=\"$(postgres_query \"select to_regclass('ankhorage_internal.generated_schema_state') is not null\" || true)\"\n    if [[ \"\\${state_table}\" != \"t\" ]]; then\n      echo \"- profile reconciliation: disabled\"\n    else\n      profile_state=\"$(postgres_query \"select coalesce((select case when table_name is null then 'stale-state-missing-table-name' when to_regclass(format('public.%I', table_name)) is null then 'stale-state-missing-table:' || table_name else 'stale-state-table-present:' || table_name end from ankhorage_internal.generated_schema_state where artifact_key = 'auth.profile'), 'disabled')\" || true)\"\n      if [[ \"\\${profile_state}\" == \"disabled\" ]]; then\n        echo \"- profile reconciliation: disabled\"\n      else\n        echo \"- profile reconciliation: unexpected \\${profile_state}\"\n      fi\n    fi\n  fi\n\n  vault_state=\"$(postgres_query \"select exists(select 1 from pg_namespace where nspname = 'vault')\" || true)\"\n  if [[ \"\\${vault_state}\" == \"t\" ]]; then\n    echo \"- vault schema: present\"\n  else\n    echo \"- vault schema: absent\"\n  fi\n\n  if command -v curl >/dev/null 2>&1; then\n    public_url=\"\\${SUPABASE_PUBLIC_URL:-http://127.0.0.1:\\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT}}\"\n    if curl -fsS \"\\${public_url}/auth/v1/health\" >/dev/null 2>&1; then\n      echo \"- supabase public endpoint: ok (\\${public_url})\"\n    else\n      echo \"- supabase public endpoint: unavailable (\\${public_url})\"\n    fi\n  fi\nfi\n\n\"\\${SCRIPT_DIR}/port-forward.sh\" status all || true\n`;\n}\n\nfunction getDefaultAppImage(appSlug: string): string {\n  return `ankh/${appSlug}:dev`;\n}\n\nfunction resolveSupabaseHostPorts(appSlug: string): SupabaseHostPorts {\n  const base = PORT_BASE + resolvePortBucket(appSlug) * PORT_BUCKET_SIZE;\n  return {\n    app: base,\n    gateway: base + 1,\n    studio: base + 2,\n    db: base + 3,\n  };\n}\n\nfunction resolvePortBucket(appSlug: string): number {\n  const rawBucket = hashSlug(appSlug) - hashSlug(PORT_REFERENCE_SLUG);\n  return (rawBucket + PORT_BUCKET_COUNT) % PORT_BUCKET_COUNT;\n}\n\nfunction hashSlug(value: string): number {\n  let hash = 0;\n  for (const char of value) {\n    hash = (hash * 31 + char.charCodeAt(0)) % PORT_BUCKET_COUNT;\n  }\n  return hash;\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {

package/src/adapters/minikube/README.md

@@ -69,6 +69,11 @@ The app namespace receives only browser-safe Supabase URL and anon key material
 `Secret/supabase-public-runtime`. Privileged Supabase runtime credentials remain in
 `Secret/supabase-runtime-secrets` in namespace `supabase`.
 
+For local Expo/Metro development, `up.sh` also mirrors only the browser-safe
+`EXPO_PUBLIC_SUPABASE_URL` and `EXPO_PUBLIC_SUPABASE_ANON_KEY` values into the generated
+app root `.env.local`, preserving unrelated entries. Restart Expo after Infra Up so the
+client bundle sees the refreshed public Supabase values.
+
 ## Practical Selector Rule
 
 When building config UI or pickers, only show currently supported values from adapter-owned

package/src/adapters/minikube/appRuntimeServing.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from 'bun:test';
+
+import { generateInfrastructure } from '../../index';
+import { createAppManifest } from '../../testSupport';
+
+describe('generated Minikube app runtime serving', () => {
+  test('keeps nginx redirects relative so port-forwarded browser origins are preserved', () => {
+    const result = generateInfrastructure(
+      {
+        deployment: {
+          target: 'minikube',
+          monitoring: false,
+        },
+      },
+      {
+        appManifest: createAppManifest('forwarded-origin'),
+      },
+    );
+    const dockerfile = result.files.find(
+      (file) => file.path === 'infra/minikube/app-image/Dockerfile',
+    );
+
+    expect(dockerfile).toBeDefined();
+    expect(dockerfile?.content).toContain('listen 8080;\n  absolute_redirect off;');
+    expect(dockerfile?.content).toContain('try_files $uri $uri/ /index.html;');
+    expect(dockerfile?.content).not.toContain('port_in_redirect off;');
+  });
+});

package/src/adapters/minikube/auth/supabase/index.ts

@@ -178,6 +178,11 @@ Your app runtime deployment should import both:
 - \`app-runtime-auth-env\` (configMap)
 - \`supabase-public-runtime\` (secret)
 
+For local Expo/Metro development, \`scripts/up.sh\` also writes the same browser-safe
+\`EXPO_PUBLIC_SUPABASE_URL\` and \`EXPO_PUBLIC_SUPABASE_ANON_KEY\` values to
+\`\${APP_SOURCE_DIR}/.env.local\`, preserving unrelated entries. Restart Expo after
+Infra Up so those public values are embedded into the client bundle.
+
 Example deployment fragment:
 
 \`\`\`yaml
@@ -215,8 +220,8 @@ ${profileSection}
 ## Runtime Secrets
 
 When Supabase is enabled, \`scripts/up.sh\` creates/updates \`Secret/supabase-public-runtime\`
-with browser-safe values for the app namespace. Privileged Supabase runtime secrets remain in
-the \`supabase\` namespace.
+with browser-safe values for the app namespace and mirrors the Expo public values into the
+app \`.env.local\`. Privileged Supabase runtime secrets remain in the \`supabase\` namespace.
 `;
 }
 

package/src/adapters/minikube/base/index.test.ts

@@ -333,6 +333,27 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
     expect(upScript).toContain('set_optional_env_default SMTP_USER ""');
   });
 
+  test('syncs browser-safe Supabase env into the generated app env.local before build', () => {
+    const result = generateInfrastructure(createSupabaseManifest(), {
+      appManifest: createAppManifest('books'),
+    });
+    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
+
+    expect(upScript).toContain('sync_app_public_supabase_env()');
+    expect(upScript).toContain('local app_env_file="${APP_SOURCE_DIR}/.env.local"');
+    expect(upScript).toContain(
+      'write_key_value_file_value "${app_env_file}" "EXPO_PUBLIC_SUPABASE_URL" "${EXPO_PUBLIC_SUPABASE_URL}"',
+    );
+    expect(upScript).toContain(
+      'write_key_value_file_value "${app_env_file}" "EXPO_PUBLIC_SUPABASE_ANON_KEY" "${EXPO_PUBLIC_SUPABASE_ANON_KEY}"',
+    );
+    expect(upScript).toContain('ensure_supabase_runtime_env\nsync_app_public_supabase_env');
+    expect(upScript.lastIndexOf('sync_app_public_supabase_env')).toBeLessThan(
+      upScript.indexOf('if [[ "${APP_BUILD_ENABLED}" == "true" ]]'),
+    );
+    expect(upScript).not.toContain('SUPABASE_SERVICE_ROLE_KEY" "${SUPABASE_SERVICE_ROLE_KEY}"');
+  });
+
   test('starts Supabase schema owners before app migrations and profile reconciliation', () => {
     const result = generateInfrastructure(createSupabaseManifest(), {
       appManifest: createAppManifest('scanner'),

package/src/adapters/minikube/base/index.ts

@@ -2372,6 +2372,43 @@ write_env_value() {
   mv "\${tmp_env}" "\${ROOT_DIR}/.env"
 }
 
+write_key_value_file_value() {
+  local file_path="\${1}"
+  local key="\${2}"
+  local value="\${3}"
+  local tmp_env
+  mkdir -p "$(dirname "\${file_path}")"
+  touch "\${file_path}"
+  tmp_env="$(mktemp)"
+  awk -F= -v key="\${key}" -v value="\${value}" '
+    $1 == key {
+      print key "=" value
+      found = 1
+      next
+    }
+    { print }
+    END {
+      if (!found) print key "=" value
+    }
+  ' "\${file_path}" > "\${tmp_env}"
+  mv "\${tmp_env}" "\${file_path}"
+}
+
+sync_app_public_supabase_env() {
+  if [[ "\${SUPABASE_RUNTIME_ENABLED}" != "true" ]]; then
+    return 0
+  fi
+
+  if [[ -z "\${APP_SOURCE_DIR:-}" ]]; then
+    echo "APP_SOURCE_DIR is required to write app Supabase public environment."
+    exit 1
+  fi
+
+  local app_env_file="\${APP_SOURCE_DIR}/.env.local"
+  write_key_value_file_value "\${app_env_file}" "EXPO_PUBLIC_SUPABASE_URL" "\${EXPO_PUBLIC_SUPABASE_URL}"
+  write_key_value_file_value "\${app_env_file}" "EXPO_PUBLIC_SUPABASE_ANON_KEY" "\${EXPO_PUBLIC_SUPABASE_ANON_KEY}"
+}
+
 set_required_env_default() {
   local key="\${1}"
   local value="\${2}"
@@ -2711,6 +2748,7 @@ trap cleanup_failed_up ERR
 require_command minikube
 require_command kubectl
 ensure_supabase_runtime_env
+sync_app_public_supabase_env
 
 HOST_STATUS="$(minikube -p "\${PROFILE}" status --format='{{.Host}}' 2>/dev/null || true)"
 if [[ "\${HOST_STATUS}" != "Running" ]]; then
@@ -2914,6 +2952,7 @@ function getAppImageDockerfile(): string {
 RUN cat <<'EOF' > /etc/nginx/conf.d/default.conf
 server {
   listen 8080;
+  absolute_redirect off;
   server_name _;
   root /usr/share/nginx/html;
   index index.html;

package/src/index.test.ts

@@ -100,6 +100,7 @@ describe('generateInfrastructure', () => {
 
     const runtimeGuide = getFile(result.files, 'infra/minikube/auth/supabase-runtime-wiring.md');
     expect(runtimeGuide).toContain('supabase-public-runtime');
+    expect(runtimeGuide).toContain('${APP_SOURCE_DIR}/.env.local');
     expect(runtimeGuide).not.toContain('SUPABASE_SERVICE_ROLE_KEY');
   });