@ankhorage/infra 1.0.5 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ankhorage/infra
 
+## 1.1.0
+
+### Minor Changes
+
+- bd82fe0: Add canonical environment-aware Auth redirect configuration and reconcile Minikube GoTrue callback settings through a forced, bounded deployment rollout.
+
+## 1.0.6
+
+### Patch Changes
+
+- 296d006: update SUPABASE-VAULT
+
 ## 1.0.5
 
 ### Patch Changes

package/dist/adapters/minikube/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAGrF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CAe3B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAIrF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CA2B3B"}

package/dist/adapters/minikube/auth/index.js

@@ -1,4 +1,5 @@
 import { emptyMinikubeArtifacts } from '../contracts';
+import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
 import { generateSupabaseAuthArtifacts } from './supabase';
 export function generateAuthProviderArtifacts(args) {
     const { manifest, namespace } = args;
@@ -9,6 +10,17 @@ export function generateAuthProviderArtifacts(args) {
     if (auth.provider !== 'supabase') {
         throw new Error(`Unsupported auth provider for minikube adapter: "${auth.provider}". Only "supabase" is currently supported.`);
     }
-    return generateSupabaseAuthArtifacts({ manifest, namespace });
+    const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });
+    const oauthArtifacts = generateSupabaseOAuthRuntimeArtifacts(manifest);
+    return {
+        files: [...providerArtifacts.files, ...oauthArtifacts.files],
+        resources: [...providerArtifacts.resources, ...oauthArtifacts.resources],
+        providerLifecycle: [
+            ...providerArtifacts.providerLifecycle,
+            ...oauthArtifacts.providerLifecycle,
+        ],
+        envEntries: [...providerArtifacts.envEntries, ...oauthArtifacts.envEntries],
+        warnings: [...providerArtifacts.warnings, ...oauthArtifacts.warnings],
+    };
 }
 //# sourceMappingURL=index.js.map

package/dist/adapters/minikube/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAiC,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,QAAQ,4CAA4C,CAC9G,CAAC;IACJ,CAAC;IAED,OAAO,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../types';\nimport { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';\nimport { generateSupabaseAuthArtifacts } from './supabase';\n\nexport function generateAuthProviderArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n  const { auth } = manifest;\n\n  if (!auth) {\n    return emptyMinikubeArtifacts();\n  }\n\n  if (auth.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported auth provider for minikube adapter: \"${auth.provider}\". Only \"supabase\" is currently supported.`,\n    );\n  }\n\n  return generateSupabaseAuthArtifacts({ manifest, namespace });\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAiC,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,QAAQ,4CAA4C,CAC9G,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,qCAAqC,CAAC,QAAQ,CAAC,CAAC;IAEvE,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,iBAAiB,CAAC,SAAS,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC;QACxE,iBAAiB,EAAE;YACjB,GAAG,iBAAiB,CAAC,iBAAiB;YACtC,GAAG,cAAc,CAAC,iBAAiB;SACpC;QACD,UAAU,EAAE,CAAC,GAAG,iBAAiB,CAAC,UAAU,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;QAC3E,QAAQ,EAAE,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC;KACtE,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../types';\nimport { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';\nimport { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';\nimport { generateSupabaseAuthArtifacts } from './supabase';\n\nexport function generateAuthProviderArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n  const { auth } = manifest;\n\n  if (!auth) {\n    return emptyMinikubeArtifacts();\n  }\n\n  if (auth.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported auth provider for minikube adapter: \"${auth.provider}\". Only \"supabase\" is currently supported.`,\n    );\n  }\n\n  const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });\n  const oauthArtifacts = generateSupabaseOAuthRuntimeArtifacts(manifest);\n\n  return {\n    files: [...providerArtifacts.files, ...oauthArtifacts.files],\n    resources: [...providerArtifacts.resources, ...oauthArtifacts.resources],\n    providerLifecycle: [\n      ...providerArtifacts.providerLifecycle,\n      ...oauthArtifacts.providerLifecycle,\n    ],\n    envEntries: [...providerArtifacts.envEntries, ...oauthArtifacts.envEntries],\n    warnings: [...providerArtifacts.warnings, ...oauthArtifacts.warnings],\n  };\n}\n"]}

package/dist/adapters/minikube/auth/oauthRuntime.d.ts

@@ -0,0 +1,4 @@
+import type { InfraManifestInput } from '../../../types';
+import type { MinikubeAdapterArtifacts } from '../contracts';
+export declare function generateSupabaseOAuthRuntimeArtifacts(manifest: InfraManifestInput): MinikubeAdapterArtifacts;
+//# sourceMappingURL=oauthRuntime.d.ts.map

package/dist/adapters/minikube/auth/oauthRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRuntime.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/oauthRuntime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAA6B,MAAM,cAAc,CAAC;AAQxF,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,kBAAkB,GAC3B,wBAAwB,CAwB1B"}

package/dist/adapters/minikube/auth/oauthRuntime.js

@@ -0,0 +1,144 @@
+import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';
+export function generateSupabaseOAuthRuntimeArtifacts(manifest) {
+    const oauthRuntime = resolveOAuthRuntimeModel(manifest);
+    if (!oauthRuntime) {
+        return {
+            files: [],
+            resources: [],
+            providerLifecycle: [],
+            envEntries: [],
+            warnings: [],
+        };
+    }
+    return {
+        files: [
+            {
+                path: 'infra/minikube/auth/oauth-runtime.md',
+                content: getOAuthRuntimeGuide(oauthRuntime),
+            },
+        ],
+        resources: [],
+        providerLifecycle: [getOAuthProviderLifecycle(oauthRuntime)],
+        envEntries: [],
+        warnings: [],
+    };
+}
+function resolveOAuthRuntimeModel(manifest) {
+    const oauth = manifest.auth?.oauth;
+    if (!oauth?.enabled)
+        return null;
+    const providers = oauth.providers.filter((provider) => provider.enabled !== false);
+    if (providers.length === 0)
+        return null;
+    const callbackRoute = normalizeAuthCallbackRoute(oauth.callbackRoute);
+    const envPrefixes = providers.map((provider) => {
+        const prefix = provider.id
+            .trim()
+            .toUpperCase()
+            .replace(/[^A-Z0-9]+/gu, '_')
+            .replace(/^_+|_+$/gu, '');
+        if (!prefix) {
+            throw new Error(`OAuth provider "${provider.id}" cannot be mapped to GoTrue environment keys.`);
+        }
+        return prefix;
+    });
+    return {
+        callbackRoute,
+        envPrefixes,
+        localRedirectPatterns: getLocalAuthRedirectPatterns(callbackRoute),
+    };
+}
+function getOAuthProviderLifecycle(oauthRuntime) {
+    return {
+        id: 'supabase-auth',
+        namespace: 'supabase',
+        endpoints: [],
+        readinessChecks: [
+            {
+                label: 'GoTrue',
+                namespace: 'supabase',
+                resource: 'deployment/auth',
+                timeoutSeconds: 600,
+            },
+        ],
+        migrationCommands: [],
+        reconciliationCommands: [
+            {
+                label: 'OAuth redirect and runtime rollout reconciliation',
+                command: getOAuthRuntimeReconciliationCommand(oauthRuntime),
+            },
+        ],
+        statusChecks: [
+            {
+                label: 'OAuth redirect configuration',
+                command: getOAuthRuntimeStatusCommand(oauthRuntime),
+            },
+        ],
+    };
+}
+function getOAuthRuntimeReconciliationCommand(oauthRuntime) {
+    const localPatterns = oauthRuntime.localRedirectPatterns.join(',');
+    const providerRedirectAssignments = oauthRuntime.envPrefixes
+        .map((prefix) => `GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"`)
+        .join(' ');
+    const providerExports = oauthRuntime.envPrefixes
+        .map((prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"
+write_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI "\${oauth_provider_callback}"`)
+        .join('\n');
+    return `oauth_callback_route='${oauthRuntime.callbackRoute}'
+oauth_callback_path="\${oauth_callback_route#/}"
+oauth_site_url="\${SITE_URL%/}"
+oauth_provider_callback="\${API_EXTERNAL_URL%/}/callback"
+oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path},${localPatterns}"
+if [[ -n "\${OAUTH_NATIVE_REDIRECT_URLS:-}" ]]; then
+  oauth_redirect_allow_list="\${oauth_redirect_allow_list},\${OAUTH_NATIVE_REDIRECT_URLS}"
+fi
+export ADDITIONAL_REDIRECT_URLS="\${oauth_redirect_allow_list}"
+write_env_value ADDITIONAL_REDIRECT_URLS "\${oauth_redirect_allow_list}"
+${providerExports}
+kubectl --context "\${PROFILE}" -n supabase set env deployment/auth \\
+  API_EXTERNAL_URL="\${API_EXTERNAL_URL}" \\
+  GOTRUE_SITE_URL="\${SITE_URL}" \\
+  GOTRUE_URI_ALLOW_LIST="\${oauth_redirect_allow_list}" \\
+  GOTRUE_JWT_ISSUER="\${API_EXTERNAL_URL}" \\
+  ${providerRedirectAssignments} >/dev/null
+kubectl --context "\${PROFILE}" -n supabase rollout restart deployment/auth >/dev/null
+kubectl --context "\${PROFILE}" -n supabase rollout status deployment/auth --timeout=600s`;
+}
+function getOAuthRuntimeStatusCommand(oauthRuntime) {
+    return `oauth_callback_route='${oauthRuntime.callbackRoute}'
+oauth_callback_path="\${oauth_callback_route#/}"
+if [[ -n "\${API_EXTERNAL_URL:-}" ]]; then
+  echo "- provider supabase-auth/provider-callback: \${API_EXTERNAL_URL%/}/callback"
+else
+  echo "- provider supabase-auth/provider-callback: unavailable"
+fi
+if [[ -n "\${SITE_URL:-}" ]]; then
+  echo "- provider supabase-auth/app-callback: \${SITE_URL%/}/\${oauth_callback_path}"
+else
+  echo "- provider supabase-auth/app-callback: unavailable"
+fi
+echo "- provider supabase-auth/local-callback-patterns: ${oauthRuntime.localRedirectPatterns.join(',')}"`;
+}
+function getOAuthRuntimeGuide(oauthRuntime) {
+    const localPatterns = oauthRuntime.localRedirectPatterns
+        .map((pattern) => `- \`${pattern}\``)
+        .join('\n');
+    return `# Supabase OAuth Runtime Reconciliation
+
+The provider callback is derived from the active project gateway as
+\`\${API_EXTERNAL_URL%/}/callback\`, which resolves to the project-owned
+\`/auth/v1/callback\` endpoint. GoTrue-to-app redirects use the configured callback route
+\`${oauthRuntime.callbackRoute}\`.
+
+Local Minikube reconciliation adds only callback-scoped loopback patterns:
+
+${localPatterns}
+
+Native callback URIs may be supplied through \`OAUTH_NATIVE_REDIRECT_URLS\`. The generated
+provider lifecycle writes only redirect metadata, never OAuth client secrets. It updates the
+GoTrue deployment environment, forces \`deployment/auth\` to restart, and waits up to 600
+seconds for the rollout. A failed rollout stops Infra Up before its success message.
+`;
+}
+//# sourceMappingURL=oauthRuntime.js.map

package/dist/adapters/minikube/auth/oauthRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRuntime.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/oauthRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAUlG,MAAM,UAAU,qCAAqC,CACnD,QAA4B;IAE5B,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;YACrB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,sCAAsC;gBAC5C,OAAO,EAAE,oBAAoB,CAAC,YAAY,CAAC;aAC5C;SACF;QACD,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC5D,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA4B;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE;aACvB,IAAI,EAAE;aACN,WAAW,EAAE;aACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,gDAAgD,CAC/E,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,aAAa;QACb,WAAW;QACX,qBAAqB,EAAE,4BAA4B,CAAC,aAAa,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAuC;IAEvC,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,UAAU;QACrB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE;YACf;gBACE,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,UAAU;gBACrB,QAAQ,EAAE,iBAAiB;gBAC3B,cAAc,EAAE,GAAG;aACpB;SACF;QACD,iBAAiB,EAAE,EAAE;QACrB,sBAAsB,EAAE;YACtB;gBACE,KAAK,EAAE,mDAAmD;gBAC1D,OAAO,EAAE,oCAAoC,CAAC,YAAY,CAAC;aAC5D;SACF;QACD,YAAY,EAAE;YACZ;gBACE,KAAK,EAAE,8BAA8B;gBACrC,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC;aACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAAC,YAAuC;IACnF,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,2BAA2B,GAAG,YAAY,CAAC,WAAW;SACzD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,MAAM,6CAA6C,CAAC;SACvF,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,eAAe,GAAG,YAAY,CAAC,WAAW;SAC7C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,MAAM;kCAChB,MAAM,6CAA6C,CAChF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;2FAI+B,aAAa;;;;;;EAMtG,eAAe;;;;;;IAMb,2BAA2B;;0FAE2D,CAAC;AAC3F,CAAC;AAED,SAAS,4BAA4B,CAAC,YAAuC;IAC3E,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;;;;;;;;;0DAYF,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1G,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAuC;IACnE,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB;SACrD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,IAAI,CAAC;SACpC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;IAKL,YAAY,CAAC,aAAa;;;;EAI5B,aAAa;;;;;;CAMd,CAAC;AACF,CAAC","sourcesContent":["import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';\nimport type { InfraManifestInput } from '../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';\n\ninterface SupabaseOAuthRuntimeModel {\n  callbackRoute: string;\n  envPrefixes: readonly string[];\n  localRedirectPatterns: readonly string[];\n}\n\nexport function generateSupabaseOAuthRuntimeArtifacts(\n  manifest: InfraManifestInput,\n): MinikubeAdapterArtifacts {\n  const oauthRuntime = resolveOAuthRuntimeModel(manifest);\n  if (!oauthRuntime) {\n    return {\n      files: [],\n      resources: [],\n      providerLifecycle: [],\n      envEntries: [],\n      warnings: [],\n    };\n  }\n\n  return {\n    files: [\n      {\n        path: 'infra/minikube/auth/oauth-runtime.md',\n        content: getOAuthRuntimeGuide(oauthRuntime),\n      },\n    ],\n    resources: [],\n    providerLifecycle: [getOAuthProviderLifecycle(oauthRuntime)],\n    envEntries: [],\n    warnings: [],\n  };\n}\n\nfunction resolveOAuthRuntimeModel(manifest: InfraManifestInput): SupabaseOAuthRuntimeModel | null {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return null;\n\n  const providers = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (providers.length === 0) return null;\n\n  const callbackRoute = normalizeAuthCallbackRoute(oauth.callbackRoute);\n  const envPrefixes = providers.map((provider) => {\n    const prefix = provider.id\n      .trim()\n      .toUpperCase()\n      .replace(/[^A-Z0-9]+/gu, '_')\n      .replace(/^_+|_+$/gu, '');\n    if (!prefix) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" cannot be mapped to GoTrue environment keys.`,\n      );\n    }\n    return prefix;\n  });\n\n  return {\n    callbackRoute,\n    envPrefixes,\n    localRedirectPatterns: getLocalAuthRedirectPatterns(callbackRoute),\n  };\n}\n\nfunction getOAuthProviderLifecycle(\n  oauthRuntime: SupabaseOAuthRuntimeModel,\n): MinikubeProviderLifecycle {\n  return {\n    id: 'supabase-auth',\n    namespace: 'supabase',\n    endpoints: [],\n    readinessChecks: [\n      {\n        label: 'GoTrue',\n        namespace: 'supabase',\n        resource: 'deployment/auth',\n        timeoutSeconds: 600,\n      },\n    ],\n    migrationCommands: [],\n    reconciliationCommands: [\n      {\n        label: 'OAuth redirect and runtime rollout reconciliation',\n        command: getOAuthRuntimeReconciliationCommand(oauthRuntime),\n      },\n    ],\n    statusChecks: [\n      {\n        label: 'OAuth redirect configuration',\n        command: getOAuthRuntimeStatusCommand(oauthRuntime),\n      },\n    ],\n  };\n}\n\nfunction getOAuthRuntimeReconciliationCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns.join(',');\n  const providerRedirectAssignments = oauthRuntime.envPrefixes\n    .map((prefix) => `GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI=\"\\${oauth_provider_callback}\"`)\n    .join(' ');\n  const providerExports = oauthRuntime.envPrefixes\n    .map(\n      (prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI=\"\\${oauth_provider_callback}\"\nwrite_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI \"\\${oauth_provider_callback}\"`,\n    )\n    .join('\\n');\n\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\noauth_site_url=\"\\${SITE_URL%/}\"\noauth_provider_callback=\"\\${API_EXTERNAL_URL%/}/callback\"\noauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path},${localPatterns}\"\nif [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n  oauth_redirect_allow_list=\"\\${oauth_redirect_allow_list},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\nfi\nexport ADDITIONAL_REDIRECT_URLS=\"\\${oauth_redirect_allow_list}\"\nwrite_env_value ADDITIONAL_REDIRECT_URLS \"\\${oauth_redirect_allow_list}\"\n${providerExports}\nkubectl --context \"\\${PROFILE}\" -n supabase set env deployment/auth \\\\\n  API_EXTERNAL_URL=\"\\${API_EXTERNAL_URL}\" \\\\\n  GOTRUE_SITE_URL=\"\\${SITE_URL}\" \\\\\n  GOTRUE_URI_ALLOW_LIST=\"\\${oauth_redirect_allow_list}\" \\\\\n  GOTRUE_JWT_ISSUER=\"\\${API_EXTERNAL_URL}\" \\\\\n  ${providerRedirectAssignments} >/dev/null\nkubectl --context \"\\${PROFILE}\" -n supabase rollout restart deployment/auth >/dev/null\nkubectl --context \"\\${PROFILE}\" -n supabase rollout status deployment/auth --timeout=600s`;\n}\n\nfunction getOAuthRuntimeStatusCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\nif [[ -n \"\\${API_EXTERNAL_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/provider-callback: \\${API_EXTERNAL_URL%/}/callback\"\nelse\n  echo \"- provider supabase-auth/provider-callback: unavailable\"\nfi\nif [[ -n \"\\${SITE_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/app-callback: \\${SITE_URL%/}/\\${oauth_callback_path}\"\nelse\n  echo \"- provider supabase-auth/app-callback: unavailable\"\nfi\necho \"- provider supabase-auth/local-callback-patterns: ${oauthRuntime.localRedirectPatterns.join(',')}\"`;\n}\n\nfunction getOAuthRuntimeGuide(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns\n    .map((pattern) => `- \\`${pattern}\\``)\n    .join('\\n');\n\n  return `# Supabase OAuth Runtime Reconciliation\n\nThe provider callback is derived from the active project gateway as\n\\`\\${API_EXTERNAL_URL%/}/callback\\`, which resolves to the project-owned\n\\`/auth/v1/callback\\` endpoint. GoTrue-to-app redirects use the configured callback route\n\\`${oauthRuntime.callbackRoute}\\`.\n\nLocal Minikube reconciliation adds only callback-scoped loopback patterns:\n\n${localPatterns}\n\nNative callback URIs may be supplied through \\`OAUTH_NATIVE_REDIRECT_URLS\\`. The generated\nprovider lifecycle writes only redirect metadata, never OAuth client secrets. It updates the\nGoTrue deployment environment, forces \\`deployment/auth\\` to restart, and waits up to 600\nseconds for the rollout. A failed rollout stops Infra Up before its success message.\n`;\n}\n"]}

package/dist/adapters/minikube/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AASrB,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAqFhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AAUrB,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAqFhC"}

package/dist/adapters/minikube/index.js

@@ -5,6 +5,7 @@ import { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';
 import { generateSecretStoreArtifacts } from './secrets';
 import { generateStorageArtifacts } from './storage';
 const CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
+const BUILT_IN_NAMESPACES = new Set([APP_NAMESPACE, 'supabase']);
 export function generateMinikubeInfra(manifest, options = {}) {
     if (manifest.deployment?.target !== 'minikube') {
         throw new Error(`Minikube adapter only supports deployment target "minikube" (received "${manifest.deployment?.target ?? 'undefined'}").`);
@@ -40,7 +41,7 @@ export function generateMinikubeInfra(manifest, options = {}) {
     ];
     const providerNamespaces = unique([
         ...providerLifecycle.map((contribution) => contribution.namespace),
-    ]);
+    ]).filter((providerNamespace) => !BUILT_IN_NAMESPACES.has(providerNamespace));
     const extraEnvEntries = unique([
         ...authArtifacts.envEntries,
         ...authzArtifacts.envEntries,

package/dist/adapters/minikube/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AAOxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAE3E,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC;IAEhC,MAAM,aAAa,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,kCAAkC,CAAC;QACtD,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI;QAC/B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG;QACxB,GAAG,aAAa,CAAC,iBAAiB;QAClC,GAAG,cAAc,CAAC,iBAAiB;QACnC,GAAG,gBAAgB,CAAC,iBAAiB;QACrC,GAAG,oBAAoB,CAAC,iBAAiB;KAC1C,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC;QAChC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;KACnE,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,OAAO;QACP,cAAc;QACd,kBAAkB;QAClB,iBAAiB;QACjB,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,YAAY,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,YAAY,CAAC,KAAK;SACtB;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kMAAkM,CACnM,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateApiInfrastructureArtifacts } from '../../apiArtifacts';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);\n  const namespace = APP_NAMESPACE;\n\n  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const apiArtifacts = generateApiInfrastructureArtifacts({\n    data: options.appManifest?.data,\n    databaseProvider: manifest.database?.provider,\n  });\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const providerLifecycle = [\n    ...authArtifacts.providerLifecycle,\n    ...authzArtifacts.providerLifecycle,\n    ...storageArtifacts.providerLifecycle,\n    ...secretStoreArtifacts.providerLifecycle,\n  ];\n  const providerNamespaces = unique([\n    ...providerLifecycle.map((contribution) => contribution.namespace),\n  ]);\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...apiArtifacts.warnings,\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...apiArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction validateCanonicalAppSlug(slug: string | undefined): string {\n  if (!slug) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug is required.',\n    );\n  }\n\n  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',\n    );\n  }\n\n  return slug;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AAOxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC;IAEhC,MAAM,aAAa,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,kCAAkC,CAAC;QACtD,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI;QAC/B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG;QACxB,GAAG,aAAa,CAAC,iBAAiB;QAClC,GAAG,cAAc,CAAC,iBAAiB;QACnC,GAAG,gBAAgB,CAAC,iBAAiB;QACrC,GAAG,oBAAoB,CAAC,iBAAiB;KAC1C,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC;QAChC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;KACnE,CAAC,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,OAAO;QACP,cAAc;QACd,kBAAkB;QAClB,iBAAiB;QACjB,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,YAAY,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,YAAY,CAAC,KAAK;SACtB;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kMAAkM,CACnM,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateApiInfrastructureArtifacts } from '../../apiArtifacts';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;\nconst BUILT_IN_NAMESPACES = new Set([APP_NAMESPACE, 'supabase']);\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);\n  const namespace = APP_NAMESPACE;\n\n  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const apiArtifacts = generateApiInfrastructureArtifacts({\n    data: options.appManifest?.data,\n    databaseProvider: manifest.database?.provider,\n  });\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const providerLifecycle = [\n    ...authArtifacts.providerLifecycle,\n    ...authzArtifacts.providerLifecycle,\n    ...storageArtifacts.providerLifecycle,\n    ...secretStoreArtifacts.providerLifecycle,\n  ];\n  const providerNamespaces = unique([\n    ...providerLifecycle.map((contribution) => contribution.namespace),\n  ]).filter((providerNamespace) => !BUILT_IN_NAMESPACES.has(providerNamespace));\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...apiArtifacts.warnings,\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...apiArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction validateCanonicalAppSlug(slug: string | undefined): string {\n  if (!slug) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug is required.',\n    );\n  }\n\n  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',\n    );\n  }\n\n  return slug;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}

package/dist/authRedirects.d.ts

@@ -0,0 +1,19 @@
+export type AuthRedirectEnvironment = 'local' | 'preview' | 'production';
+export interface ResolveAuthRedirectConfigurationInput {
+    environment: AuthRedirectEnvironment;
+    gatewayOrigin: string;
+    siteOrigin: string;
+    callbackRoute: string;
+    webOrigins?: readonly string[];
+    nativeRedirectUris?: readonly string[];
+}
+export interface AuthRedirectConfiguration {
+    providerCallbackUrl: string;
+    siteUrl: string;
+    redirectAllowList: readonly string[];
+    serializedRedirectAllowList: string;
+}
+export declare function resolveAuthRedirectConfiguration(input: ResolveAuthRedirectConfigurationInput): AuthRedirectConfiguration;
+export declare function getLocalAuthRedirectPatterns(callbackRoute: string): readonly string[];
+export declare function normalizeAuthCallbackRoute(callbackRoute: string): string;
+//# sourceMappingURL=authRedirects.d.ts.map

package/dist/authRedirects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authRedirects.d.ts","sourceRoot":"","sources":["../src/authRedirects.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;AAEzE,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,uBAAuB,CAAC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,yBAAyB;IACxC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,2BAA2B,EAAE,MAAM,CAAC;CACrC;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,qCAAqC,GAC3C,yBAAyB,CAyB3B;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAGrF;AAED,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/authRedirects.js

@@ -0,0 +1,80 @@
+export function resolveAuthRedirectConfiguration(input) {
+    const gatewayOrigin = normalizeWebOrigin(input.gatewayOrigin, 'gatewayOrigin');
+    const siteUrl = normalizeWebOrigin(input.siteOrigin, 'siteOrigin');
+    const callbackRoute = normalizeCallbackRoute(input.callbackRoute);
+    const webOrigins = unique([
+        siteUrl,
+        ...(input.webOrigins ?? []).map((origin) => normalizeWebOrigin(origin, 'webOrigins')),
+    ]);
+    const nativeRedirectUris = unique((input.nativeRedirectUris ?? []).map((uri) => normalizeNativeRedirectUri(uri)));
+    const redirectAllowList = unique([
+        ...webOrigins,
+        ...webOrigins.map((origin) => `${origin}${callbackRoute}`),
+        ...(input.environment === 'local' ? getLocalAuthRedirectPatterns(callbackRoute) : []),
+        ...nativeRedirectUris,
+    ]);
+    return {
+        providerCallbackUrl: `${gatewayOrigin}/auth/v1/callback`,
+        siteUrl,
+        redirectAllowList,
+        serializedRedirectAllowList: redirectAllowList.join(','),
+    };
+}
+export function getLocalAuthRedirectPatterns(callbackRoute) {
+    const normalizedRoute = normalizeCallbackRoute(callbackRoute);
+    return [`http://127.0.0.1:*${normalizedRoute}`, `http://localhost:*${normalizedRoute}`];
+}
+export function normalizeAuthCallbackRoute(callbackRoute) {
+    return normalizeCallbackRoute(callbackRoute);
+}
+function normalizeCallbackRoute(callbackRoute) {
+    const trimmed = callbackRoute.trim();
+    if (!trimmed) {
+        throw new Error('Auth callback route must not be empty.');
+    }
+    const withLeadingSlash = trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+    const normalized = withLeadingSlash.replace(/\/{2,}/gu, '/');
+    if (normalized.includes('?') || normalized.includes('#')) {
+        throw new Error('Auth callback route must not include a query string or fragment.');
+    }
+    return normalized;
+}
+function normalizeWebOrigin(value, field) {
+    const parsed = parseUrl(value, field);
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`${field} must use http or https.`);
+    }
+    if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+        throw new Error(`${field} must be a canonical origin without credentials, query, or fragment.`);
+    }
+    if (parsed.pathname !== '/' && parsed.pathname !== '') {
+        throw new Error(`${field} must not include a path.`);
+    }
+    return parsed.origin;
+}
+function normalizeNativeRedirectUri(value) {
+    const parsed = parseUrl(value, 'nativeRedirectUris');
+    if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
+        throw new Error('nativeRedirectUris must use a non-HTTP application scheme.');
+    }
+    if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+        throw new Error('nativeRedirectUris must not include credentials, query strings, or fragments.');
+    }
+    return parsed.toString();
+}
+function parseUrl(value, field) {
+    const trimmed = value.trim();
+    if (!trimmed) {
+        throw new Error(`${field} must not contain empty values.`);
+    }
+    try {
+        return new URL(trimmed);
+    }
+    catch {
+        throw new Error(`${field} contains an invalid URL.`);
+    }
+}
+function unique(values) {
+    return [...new Set(values)];
+}
+//# sourceMappingURL=authRedirects.js.map

package/dist/authRedirects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authRedirects.js","sourceRoot":"","sources":["../src/authRedirects.ts"],"names":[],"mappings":"AAkBA,MAAM,UAAU,gCAAgC,CAC9C,KAA4C;IAE5C,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC;QACxB,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;KACtF,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,CAC/B,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAC/E,CAAC;IAEF,MAAM,iBAAiB,GAAG,MAAM,CAAC;QAC/B,GAAG,UAAU;QACb,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,aAAa,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,kBAAkB;KACtB,CAAC,CAAC;IAEH,OAAO;QACL,mBAAmB,EAAE,GAAG,aAAa,mBAAmB;QACxD,OAAO;QACP,iBAAiB;QACjB,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,aAAqB;IAChE,MAAM,eAAe,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAC9D,OAAO,CAAC,qBAAqB,eAAe,EAAE,EAAE,qBAAqB,eAAe,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,aAAqB;IAC9D,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,sBAAsB,CAAC,aAAqB;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,KAAa;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sEAAsE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,KAAa;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAyB;IACvC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["export type AuthRedirectEnvironment = 'local' | 'preview' | 'production';\n\nexport interface ResolveAuthRedirectConfigurationInput {\n  environment: AuthRedirectEnvironment;\n  gatewayOrigin: string;\n  siteOrigin: string;\n  callbackRoute: string;\n  webOrigins?: readonly string[];\n  nativeRedirectUris?: readonly string[];\n}\n\nexport interface AuthRedirectConfiguration {\n  providerCallbackUrl: string;\n  siteUrl: string;\n  redirectAllowList: readonly string[];\n  serializedRedirectAllowList: string;\n}\n\nexport function resolveAuthRedirectConfiguration(\n  input: ResolveAuthRedirectConfigurationInput,\n): AuthRedirectConfiguration {\n  const gatewayOrigin = normalizeWebOrigin(input.gatewayOrigin, 'gatewayOrigin');\n  const siteUrl = normalizeWebOrigin(input.siteOrigin, 'siteOrigin');\n  const callbackRoute = normalizeCallbackRoute(input.callbackRoute);\n  const webOrigins = unique([\n    siteUrl,\n    ...(input.webOrigins ?? []).map((origin) => normalizeWebOrigin(origin, 'webOrigins')),\n  ]);\n  const nativeRedirectUris = unique(\n    (input.nativeRedirectUris ?? []).map((uri) => normalizeNativeRedirectUri(uri)),\n  );\n\n  const redirectAllowList = unique([\n    ...webOrigins,\n    ...webOrigins.map((origin) => `${origin}${callbackRoute}`),\n    ...(input.environment === 'local' ? getLocalAuthRedirectPatterns(callbackRoute) : []),\n    ...nativeRedirectUris,\n  ]);\n\n  return {\n    providerCallbackUrl: `${gatewayOrigin}/auth/v1/callback`,\n    siteUrl,\n    redirectAllowList,\n    serializedRedirectAllowList: redirectAllowList.join(','),\n  };\n}\n\nexport function getLocalAuthRedirectPatterns(callbackRoute: string): readonly string[] {\n  const normalizedRoute = normalizeCallbackRoute(callbackRoute);\n  return [`http://127.0.0.1:*${normalizedRoute}`, `http://localhost:*${normalizedRoute}`];\n}\n\nexport function normalizeAuthCallbackRoute(callbackRoute: string): string {\n  return normalizeCallbackRoute(callbackRoute);\n}\n\nfunction normalizeCallbackRoute(callbackRoute: string): string {\n  const trimmed = callbackRoute.trim();\n  if (!trimmed) {\n    throw new Error('Auth callback route must not be empty.');\n  }\n\n  const withLeadingSlash = trimmed.startsWith('/') ? trimmed : `/${trimmed}`;\n  const normalized = withLeadingSlash.replace(/\\/{2,}/gu, '/');\n  if (normalized.includes('?') || normalized.includes('#')) {\n    throw new Error('Auth callback route must not include a query string or fragment.');\n  }\n  return normalized;\n}\n\nfunction normalizeWebOrigin(value: string, field: string): string {\n  const parsed = parseUrl(value, field);\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    throw new Error(`${field} must use http or https.`);\n  }\n  if (parsed.username || parsed.password || parsed.search || parsed.hash) {\n    throw new Error(`${field} must be a canonical origin without credentials, query, or fragment.`);\n  }\n  if (parsed.pathname !== '/' && parsed.pathname !== '') {\n    throw new Error(`${field} must not include a path.`);\n  }\n  return parsed.origin;\n}\n\nfunction normalizeNativeRedirectUri(value: string): string {\n  const parsed = parseUrl(value, 'nativeRedirectUris');\n  if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {\n    throw new Error('nativeRedirectUris must use a non-HTTP application scheme.');\n  }\n  if (parsed.username || parsed.password || parsed.search || parsed.hash) {\n    throw new Error(\n      'nativeRedirectUris must not include credentials, query strings, or fragments.',\n    );\n  }\n  return parsed.toString();\n}\n\nfunction parseUrl(value: string, field: string): URL {\n  const trimmed = value.trim();\n  if (!trimmed) {\n    throw new Error(`${field} must not contain empty values.`);\n  }\n\n  try {\n    return new URL(trimmed);\n  } catch {\n    throw new Error(`${field} contains an invalid URL.`);\n  }\n}\n\nfunction unique(values: readonly string[]): string[] {\n  return [...new Set(values)];\n}\n"]}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import type { InfraGenerationInput, InfraManifestInput, InfrastructureGenerationOptions, InfrastructureGenerationResult } from './types';
 export type { ApiInfrastructureArtifacts } from './apiArtifacts';
 export { generateApiInfrastructureArtifacts } from './apiArtifacts';
+export { type AuthRedirectConfiguration, type AuthRedirectEnvironment, getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute, resolveAuthRedirectConfiguration, type ResolveAuthRedirectConfigurationInput, } from './authRedirects';
 export { createInfraSecretStoreAdapter, type CreateInfraSecretStoreAdapterInput, type InfraSecretStoreProviders, } from './secretStore';
 export type { GeneratedFile, GeneratedInfrastructureFile, GeneratedPackageDependency, InfraDiagnostic, InfraGenerationInput, InfraGenerationOptions, InfraGenerationResult, InfraManifestInput, InfrastructureGenerationMeta, InfrastructureGenerationOptions, InfrastructureGenerationResult, PackageDependency, } from './types';
 export declare function generateInfra(input: InfraGenerationInput): InfrastructureGenerationResult;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kCAAkC,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,aAAa,EACb,2BAA2B,EAC3B,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAEjB,wBAAgB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,8BAA8B,CAEzF;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAUhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kCAAkC,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,4BAA4B,EAC5B,0BAA0B,EAC1B,gCAAgC,EAChC,KAAK,qCAAqC,GAC3C,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,aAAa,EACb,2BAA2B,EAC3B,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAEjB,wBAAgB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,8BAA8B,CAEzF;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAUhC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 import { generateMinikubeInfra } from './adapters/minikube';
 export { generateApiInfrastructureArtifacts } from './apiArtifacts';
+export { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute, resolveAuthRedirectConfiguration, } from './authRedirects';
 export { createInfraSecretStoreAdapter, } from './secretStore';
 export function generateInfra(input) {
     return generateInfrastructure(input.manifest, input.options ?? {});

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAS5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,6BAA6B,GAG9B,MAAM,eAAe,CAAC;AAgBvB,MAAM,UAAU,aAAa,CAAC,KAA2B;IACvD,OAAO,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC","sourcesContent":["import { generateMinikubeInfra } from './adapters/minikube';\nimport type {\n  InfraGenerationInput,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from './types';\n\nexport type { ApiInfrastructureArtifacts } from './apiArtifacts';\nexport { generateApiInfrastructureArtifacts } from './apiArtifacts';\nexport {\n  createInfraSecretStoreAdapter,\n  type CreateInfraSecretStoreAdapterInput,\n  type InfraSecretStoreProviders,\n} from './secretStore';\nexport type {\n  GeneratedFile,\n  GeneratedInfrastructureFile,\n  GeneratedPackageDependency,\n  InfraDiagnostic,\n  InfraGenerationInput,\n  InfraGenerationOptions,\n  InfraGenerationResult,\n  InfraManifestInput,\n  InfrastructureGenerationMeta,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n  PackageDependency,\n} from './types';\n\nexport function generateInfra(input: InfraGenerationInput): InfrastructureGenerationResult {\n  return generateInfrastructure(input.manifest, input.options ?? {});\n}\n\nexport function generateInfrastructure(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (!manifest.deployment) {\n    throw new Error('Deployment configuration is missing.');\n  }\n\n  if (manifest.deployment.target !== 'minikube') {\n    throw new Error(`Unsupported deployment target: ${manifest.deployment.target}`);\n  }\n\n  return generateMinikubeInfra(manifest, options);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAS5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAGL,4BAA4B,EAC5B,0BAA0B,EAC1B,gCAAgC,GAEjC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,6BAA6B,GAG9B,MAAM,eAAe,CAAC;AAgBvB,MAAM,UAAU,aAAa,CAAC,KAA2B;IACvD,OAAO,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC","sourcesContent":["import { generateMinikubeInfra } from './adapters/minikube';\nimport type {\n  InfraGenerationInput,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from './types';\n\nexport type { ApiInfrastructureArtifacts } from './apiArtifacts';\nexport { generateApiInfrastructureArtifacts } from './apiArtifacts';\nexport {\n  type AuthRedirectConfiguration,\n  type AuthRedirectEnvironment,\n  getLocalAuthRedirectPatterns,\n  normalizeAuthCallbackRoute,\n  resolveAuthRedirectConfiguration,\n  type ResolveAuthRedirectConfigurationInput,\n} from './authRedirects';\nexport {\n  createInfraSecretStoreAdapter,\n  type CreateInfraSecretStoreAdapterInput,\n  type InfraSecretStoreProviders,\n} from './secretStore';\nexport type {\n  GeneratedFile,\n  GeneratedInfrastructureFile,\n  GeneratedPackageDependency,\n  InfraDiagnostic,\n  InfraGenerationInput,\n  InfraGenerationOptions,\n  InfraGenerationResult,\n  InfraManifestInput,\n  InfrastructureGenerationMeta,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n  PackageDependency,\n} from './types';\n\nexport function generateInfra(input: InfraGenerationInput): InfrastructureGenerationResult {\n  return generateInfrastructure(input.manifest, input.options ?? {});\n}\n\nexport function generateInfrastructure(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (!manifest.deployment) {\n    throw new Error('Deployment configuration is missing.');\n  }\n\n  if (manifest.deployment.target !== 'minikube') {\n    throw new Error(`Unsupported deployment target: ${manifest.deployment.target}`);\n  }\n\n  return generateMinikubeInfra(manifest, options);\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "1.0.5",
+  "version": "1.1.0",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -36,7 +36,7 @@
   ],
   "dependencies": {
     "@ankhorage/contracts": "^2.1.0",
-    "@ankhorage/supabase-vault": "^0.2.3"
+    "@ankhorage/supabase-vault": "^0.2.4"
   },
   "files": [
     "dist",

package/src/adapters/minikube/auth/index.ts

@@ -1,5 +1,6 @@
 import type { InfraManifestInput } from '../../../types';
 import { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';
+import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
 import { generateSupabaseAuthArtifacts } from './supabase';
 
 export function generateAuthProviderArtifacts(args: {
@@ -19,5 +20,17 @@ export function generateAuthProviderArtifacts(args: {
     );
   }
 
-  return generateSupabaseAuthArtifacts({ manifest, namespace });
+  const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });
+  const oauthArtifacts = generateSupabaseOAuthRuntimeArtifacts(manifest);
+
+  return {
+    files: [...providerArtifacts.files, ...oauthArtifacts.files],
+    resources: [...providerArtifacts.resources, ...oauthArtifacts.resources],
+    providerLifecycle: [
+      ...providerArtifacts.providerLifecycle,
+      ...oauthArtifacts.providerLifecycle,
+    ],
+    envEntries: [...providerArtifacts.envEntries, ...oauthArtifacts.envEntries],
+    warnings: [...providerArtifacts.warnings, ...oauthArtifacts.warnings],
+  };
 }

package/src/adapters/minikube/auth/oauthRuntime.ts

@@ -0,0 +1,169 @@
+import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';
+import type { InfraManifestInput } from '../../../types';
+import type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';
+
+interface SupabaseOAuthRuntimeModel {
+  callbackRoute: string;
+  envPrefixes: readonly string[];
+  localRedirectPatterns: readonly string[];
+}
+
+export function generateSupabaseOAuthRuntimeArtifacts(
+  manifest: InfraManifestInput,
+): MinikubeAdapterArtifacts {
+  const oauthRuntime = resolveOAuthRuntimeModel(manifest);
+  if (!oauthRuntime) {
+    return {
+      files: [],
+      resources: [],
+      providerLifecycle: [],
+      envEntries: [],
+      warnings: [],
+    };
+  }
+
+  return {
+    files: [
+      {
+        path: 'infra/minikube/auth/oauth-runtime.md',
+        content: getOAuthRuntimeGuide(oauthRuntime),
+      },
+    ],
+    resources: [],
+    providerLifecycle: [getOAuthProviderLifecycle(oauthRuntime)],
+    envEntries: [],
+    warnings: [],
+  };
+}
+
+function resolveOAuthRuntimeModel(manifest: InfraManifestInput): SupabaseOAuthRuntimeModel | null {
+  const oauth = manifest.auth?.oauth;
+  if (!oauth?.enabled) return null;
+
+  const providers = oauth.providers.filter((provider) => provider.enabled !== false);
+  if (providers.length === 0) return null;
+
+  const callbackRoute = normalizeAuthCallbackRoute(oauth.callbackRoute);
+  const envPrefixes = providers.map((provider) => {
+    const prefix = provider.id
+      .trim()
+      .toUpperCase()
+      .replace(/[^A-Z0-9]+/gu, '_')
+      .replace(/^_+|_+$/gu, '');
+    if (!prefix) {
+      throw new Error(
+        `OAuth provider "${provider.id}" cannot be mapped to GoTrue environment keys.`,
+      );
+    }
+    return prefix;
+  });
+
+  return {
+    callbackRoute,
+    envPrefixes,
+    localRedirectPatterns: getLocalAuthRedirectPatterns(callbackRoute),
+  };
+}
+
+function getOAuthProviderLifecycle(
+  oauthRuntime: SupabaseOAuthRuntimeModel,
+): MinikubeProviderLifecycle {
+  return {
+    id: 'supabase-auth',
+    namespace: 'supabase',
+    endpoints: [],
+    readinessChecks: [
+      {
+        label: 'GoTrue',
+        namespace: 'supabase',
+        resource: 'deployment/auth',
+        timeoutSeconds: 600,
+      },
+    ],
+    migrationCommands: [],
+    reconciliationCommands: [
+      {
+        label: 'OAuth redirect and runtime rollout reconciliation',
+        command: getOAuthRuntimeReconciliationCommand(oauthRuntime),
+      },
+    ],
+    statusChecks: [
+      {
+        label: 'OAuth redirect configuration',
+        command: getOAuthRuntimeStatusCommand(oauthRuntime),
+      },
+    ],
+  };
+}
+
+function getOAuthRuntimeReconciliationCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {
+  const localPatterns = oauthRuntime.localRedirectPatterns.join(',');
+  const providerRedirectAssignments = oauthRuntime.envPrefixes
+    .map((prefix) => `GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"`)
+    .join(' ');
+  const providerExports = oauthRuntime.envPrefixes
+    .map(
+      (prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"
+write_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI "\${oauth_provider_callback}"`,
+    )
+    .join('\n');
+
+  return `oauth_callback_route='${oauthRuntime.callbackRoute}'
+oauth_callback_path="\${oauth_callback_route#/}"
+oauth_site_url="\${SITE_URL%/}"
+oauth_provider_callback="\${API_EXTERNAL_URL%/}/callback"
+oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path},${localPatterns}"
+if [[ -n "\${OAUTH_NATIVE_REDIRECT_URLS:-}" ]]; then
+  oauth_redirect_allow_list="\${oauth_redirect_allow_list},\${OAUTH_NATIVE_REDIRECT_URLS}"
+fi
+export ADDITIONAL_REDIRECT_URLS="\${oauth_redirect_allow_list}"
+write_env_value ADDITIONAL_REDIRECT_URLS "\${oauth_redirect_allow_list}"
+${providerExports}
+kubectl --context "\${PROFILE}" -n supabase set env deployment/auth \\
+  API_EXTERNAL_URL="\${API_EXTERNAL_URL}" \\
+  GOTRUE_SITE_URL="\${SITE_URL}" \\
+  GOTRUE_URI_ALLOW_LIST="\${oauth_redirect_allow_list}" \\
+  GOTRUE_JWT_ISSUER="\${API_EXTERNAL_URL}" \\
+  ${providerRedirectAssignments} >/dev/null
+kubectl --context "\${PROFILE}" -n supabase rollout restart deployment/auth >/dev/null
+kubectl --context "\${PROFILE}" -n supabase rollout status deployment/auth --timeout=600s`;
+}
+
+function getOAuthRuntimeStatusCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {
+  return `oauth_callback_route='${oauthRuntime.callbackRoute}'
+oauth_callback_path="\${oauth_callback_route#/}"
+if [[ -n "\${API_EXTERNAL_URL:-}" ]]; then
+  echo "- provider supabase-auth/provider-callback: \${API_EXTERNAL_URL%/}/callback"
+else
+  echo "- provider supabase-auth/provider-callback: unavailable"
+fi
+if [[ -n "\${SITE_URL:-}" ]]; then
+  echo "- provider supabase-auth/app-callback: \${SITE_URL%/}/\${oauth_callback_path}"
+else
+  echo "- provider supabase-auth/app-callback: unavailable"
+fi
+echo "- provider supabase-auth/local-callback-patterns: ${oauthRuntime.localRedirectPatterns.join(',')}"`;
+}
+
+function getOAuthRuntimeGuide(oauthRuntime: SupabaseOAuthRuntimeModel): string {
+  const localPatterns = oauthRuntime.localRedirectPatterns
+    .map((pattern) => `- \`${pattern}\``)
+    .join('\n');
+
+  return `# Supabase OAuth Runtime Reconciliation
+
+The provider callback is derived from the active project gateway as
+\`\${API_EXTERNAL_URL%/}/callback\`, which resolves to the project-owned
+\`/auth/v1/callback\` endpoint. GoTrue-to-app redirects use the configured callback route
+\`${oauthRuntime.callbackRoute}\`.
+
+Local Minikube reconciliation adds only callback-scoped loopback patterns:
+
+${localPatterns}
+
+Native callback URIs may be supplied through \`OAUTH_NATIVE_REDIRECT_URLS\`. The generated
+provider lifecycle writes only redirect metadata, never OAuth client secrets. It updates the
+GoTrue deployment environment, forces \`deployment/auth\` to restart, and waits up to 600
+seconds for the rollout. A failed rollout stops Infra Up before its success message.
+`;
+}

package/src/adapters/minikube/auth/supabase/oauthRuntime.test.ts

@@ -0,0 +1,143 @@
+import type { InfraManifest } from '@ankhorage/contracts';
+import { describe, expect, test } from 'bun:test';
+
+import { generateInfrastructure } from '../../../../index';
+import { createAppManifest } from '../../../../testSupport';
+import { generateSupabaseOAuthRuntimeArtifacts } from '../oauthRuntime';
+
+describe('Supabase OAuth runtime reconciliation', () => {
+  test('contributes callback-scoped local redirects and a bounded GoTrue restart', () => {
+    const artifacts = generateSupabaseOAuthRuntimeArtifacts(createOAuthManifest());
+    const [lifecycle] = artifacts.providerLifecycle;
+    const command = lifecycle?.reconciliationCommands[0]?.command ?? '';
+    const statusCommand = lifecycle?.statusChecks[0]?.command ?? '';
+    const guide = getFile(artifacts.files, 'infra/minikube/auth/oauth-runtime.md');
+
+    expect(lifecycle?.id).toBe('supabase-auth');
+    expect(lifecycle?.namespace).toBe('supabase');
+    expect(lifecycle?.readinessChecks).toEqual([
+      {
+        label: 'GoTrue',
+        namespace: 'supabase',
+        resource: 'deployment/auth',
+        timeoutSeconds: 600,
+      },
+    ]);
+    expect(command).toContain('oauth_provider_callback="${API_EXTERNAL_URL%/}/callback"');
+    expect(command).toContain('http://127.0.0.1:*/auth/callback');
+    expect(command).toContain('http://localhost:*/auth/callback');
+    expect(command).toContain('OAUTH_NATIVE_REDIRECT_URLS');
+    expect(command).toContain('GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI="${oauth_provider_callback}"');
+    expect(command).toContain('GOTRUE_URI_ALLOW_LIST="${oauth_redirect_allow_list}"');
+    expect(command).toContain('rollout restart deployment/auth');
+    expect(command).toContain('rollout status deployment/auth --timeout=600s');
+    expect(command.indexOf('set env deployment/auth')).toBeLessThan(
+      command.indexOf('rollout restart deployment/auth'),
+    );
+    expect(command.indexOf('rollout restart deployment/auth')).toBeLessThan(
+      command.indexOf('rollout status deployment/auth'),
+    );
+    expect(command).not.toContain('clientSecret');
+    expect(command).not.toContain('GOTRUE_EXTERNAL_GOOGLE_SECRET=');
+    expect(statusCommand).toContain('provider supabase-auth/provider-callback');
+    expect(statusCommand).toContain('provider supabase-auth/app-callback');
+    expect(guide).toContain('Supabase OAuth Runtime Reconciliation');
+    expect(guide).toContain('A failed rollout stops Infra Up before its success message.');
+  });
+
+  test('integrates reconciliation after generated runtime resources without duplicate namespaces', () => {
+    const result = generateInfrastructure(createOAuthManifest(), {
+      appManifest: createAppManifest('oauth-app'),
+    });
+    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
+    const kustomization = getFile(result.files, 'infra/minikube/k8s/kustomization.yaml');
+    const statusScript = getFile(result.files, 'infra/minikube/scripts/status.sh');
+
+    expect(kustomization.match(/namespaces\/supabase\.yaml/gu)).toHaveLength(1);
+    expect(upScript).toContain(
+      'Running provider supabase-auth OAuth redirect and runtime rollout reconciliation.',
+    );
+    expect(upScript).toContain(
+      'kubectl --context "${PROFILE}" -n supabase set env deployment/auth',
+    );
+    expect(upScript).toContain(
+      'kubectl --context "${PROFILE}" -n supabase rollout restart deployment/auth',
+    );
+    expect(upScript).toContain(
+      'kubectl --context "${PROFILE}" -n supabase rollout status deployment/auth --timeout=600s',
+    );
+    expect(upScript.lastIndexOf('run_provider_reconciliation')).toBeLessThan(
+      upScript.lastIndexOf('echo "Minikube infrastructure for \'${PROFILE}\' is running."'),
+    );
+    expect(upScript.indexOf('credentialsRef auth/oauth/google')).toBeLessThan(
+      upScript.lastIndexOf('run_provider_reconciliation'),
+    );
+    expect(statusScript).toContain('provider supabase-auth/local-callback-patterns');
+  });
+
+  test('keeps canonical port groups distinct for concurrent projects', () => {
+    const first = generateInfrastructure(createOAuthManifest(), {
+      appManifest: createAppManifest('oauth-one'),
+    });
+    const second = generateInfrastructure(createOAuthManifest(), {
+      appManifest: createAppManifest('oauth-two'),
+    });
+
+    const firstEnv = getFile(first.files, 'infra/minikube/.env.example');
+    const secondEnv = getFile(second.files, 'infra/minikube/.env.example');
+    const firstGatewayPort = readEnvValue(firstEnv, 'SUPABASE_GATEWAY_FORWARD_LOCAL_PORT');
+    const secondGatewayPort = readEnvValue(secondEnv, 'SUPABASE_GATEWAY_FORWARD_LOCAL_PORT');
+    const firstAppPort = readEnvValue(firstEnv, 'APP_PORT_FORWARD_LOCAL_PORT');
+    const secondAppPort = readEnvValue(secondEnv, 'APP_PORT_FORWARD_LOCAL_PORT');
+
+    expect(firstGatewayPort).not.toBe(secondGatewayPort);
+    expect(firstAppPort).not.toBe(secondAppPort);
+    expect(`http://127.0.0.1:${firstGatewayPort}/auth/v1/callback`).not.toBe(
+      `http://127.0.0.1:${secondGatewayPort}/auth/v1/callback`,
+    );
+  });
+});
+
+function createOAuthManifest(): InfraManifest {
+  return {
+    deployment: {
+      target: 'minikube',
+      monitoring: false,
+    },
+    auth: {
+      scope: 'global',
+      provider: 'supabase',
+      oauth: {
+        enabled: true,
+        callbackRoute: '/auth/callback',
+        providers: [
+          {
+            id: 'google',
+            enabled: true,
+            credentialsRef: 'auth/oauth/google',
+          },
+        ],
+      },
+    },
+    database: {
+      provider: 'supabase',
+      tier: 'dev',
+    },
+    secretStore: {
+      provider: 'supabase-vault',
+    },
+    plugins: [],
+  };
+}
+
+function getFile(files: readonly { path: string; content: string }[], path: string): string {
+  const file = files.find((candidate) => candidate.path === path);
+  if (!file) throw new Error(`Missing generated file: ${path}`);
+  return file.content;
+}
+
+function readEnvValue(content: string, key: string): string {
+  const line = content.split('\n').find((candidate) => candidate.startsWith(`${key}=`));
+  if (!line) throw new Error(`Missing generated env key: ${key}`);
+  return line.slice(key.length + 1);
+}

package/src/adapters/minikube/auth/supabase/providerAssignments.test.ts

@@ -0,0 +1,36 @@
+import type { InfraManifest } from '@ankhorage/contracts';
+import { expect, test } from 'bun:test';
+
+import { generateInfrastructure } from '../../../../index';
+import { createAppManifest } from '../../../../testSupport';
+
+test('keeps multiple provider redirect assignments as separate shell arguments', () => {
+  const manifest: InfraManifest = {
+    deployment: { target: 'minikube', monitoring: false },
+    auth: {
+      scope: 'global',
+      provider: 'supabase',
+      oauth: {
+        enabled: true,
+        callbackRoute: '/auth/callback',
+        providers: [
+          { id: 'google', enabled: true, credentialsRef: 'auth/oauth/google' },
+          { id: 'apple', enabled: true, credentialsRef: 'auth/oauth/apple' },
+        ],
+      },
+    },
+    database: { provider: 'supabase', tier: 'dev' },
+    secretStore: { provider: 'supabase-vault' },
+    plugins: [],
+  };
+  const result = generateInfrastructure(manifest, {
+    appManifest: createAppManifest('multi-oauth'),
+  });
+  const upScript = result.files.find(
+    (file) => file.path === 'infra/minikube/scripts/up.sh',
+  )?.content;
+
+  expect(upScript).toContain('GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI="${oauth_provider_callback}"');
+  expect(upScript).toContain('GOTRUE_EXTERNAL_APPLE_REDIRECT_URI="${oauth_provider_callback}"');
+  expect(upScript).not.toContain('\\  GOTRUE_EXTERNAL_APPLE_REDIRECT_URI');
+});

package/src/adapters/minikube/index.ts

@@ -12,6 +12,7 @@ import { generateSecretStoreArtifacts } from './secrets';
 import { generateStorageArtifacts } from './storage';
 
 const CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
+const BUILT_IN_NAMESPACES = new Set([APP_NAMESPACE, 'supabase']);
 
 export function generateMinikubeInfra(
   manifest: InfraManifestInput,
@@ -59,7 +60,7 @@ export function generateMinikubeInfra(
   ];
   const providerNamespaces = unique([
     ...providerLifecycle.map((contribution) => contribution.namespace),
-  ]);
+  ]).filter((providerNamespace) => !BUILT_IN_NAMESPACES.has(providerNamespace));
   const extraEnvEntries = unique([
     ...authArtifacts.envEntries,
     ...authzArtifacts.envEntries,

package/src/authRedirects.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, test } from 'bun:test';
+
+import { getLocalAuthRedirectPatterns, resolveAuthRedirectConfiguration } from './authRedirects';
+
+describe('resolveAuthRedirectConfiguration', () => {
+  test('derives an exact provider callback and local browser callback policy', () => {
+    const config = resolveAuthRedirectConfiguration({
+      environment: 'local',
+      gatewayOrigin: 'http://127.0.0.1:18081/',
+      siteOrigin: 'http://127.0.0.1:18080/',
+      callbackRoute: 'auth/callback',
+      webOrigins: ['http://localhost:8081'],
+      nativeRedirectUris: ['ankh-demo://auth/callback'],
+    });
+
+    expect(config.providerCallbackUrl).toBe('http://127.0.0.1:18081/auth/v1/callback');
+    expect(config.siteUrl).toBe('http://127.0.0.1:18080');
+    expect(config.redirectAllowList).toEqual([
+      'http://127.0.0.1:18080',
+      'http://localhost:8081',
+      'http://127.0.0.1:18080/auth/callback',
+      'http://localhost:8081/auth/callback',
+      'http://127.0.0.1:*/auth/callback',
+      'http://localhost:*/auth/callback',
+      'ankh-demo://auth/callback',
+    ]);
+  });
+
+  test('never leaks local wildcard policy into preview or production', () => {
+    for (const environment of ['preview', 'production'] as const) {
+      const config = resolveAuthRedirectConfiguration({
+        environment,
+        gatewayOrigin: 'https://api.example.test',
+        siteOrigin: 'https://app.example.test',
+        callbackRoute: '/auth/callback',
+      });
+
+      expect(config.redirectAllowList).toEqual([
+        'https://app.example.test',
+        'https://app.example.test/auth/callback',
+      ]);
+      expect(config.serializedRedirectAllowList).not.toContain('localhost');
+      expect(config.serializedRedirectAllowList).not.toContain('127.0.0.1');
+      expect(config.serializedRedirectAllowList).not.toContain('*');
+    }
+  });
+
+  test('normalizes callback routes and rejects unsafe origins', () => {
+    expect(getLocalAuthRedirectPatterns('//auth//callback')).toEqual([
+      'http://127.0.0.1:*/auth/callback',
+      'http://localhost:*/auth/callback',
+    ]);
+
+    expect(() =>
+      resolveAuthRedirectConfiguration({
+        environment: 'production',
+        gatewayOrigin: 'https://user:secret@example.test',
+        siteOrigin: 'https://app.example.test',
+        callbackRoute: '/auth/callback',
+      }),
+    ).toThrow('gatewayOrigin must be a canonical origin');
+  });
+});

package/src/authRedirects.ts

@@ -0,0 +1,113 @@
+export type AuthRedirectEnvironment = 'local' | 'preview' | 'production';
+
+export interface ResolveAuthRedirectConfigurationInput {
+  environment: AuthRedirectEnvironment;
+  gatewayOrigin: string;
+  siteOrigin: string;
+  callbackRoute: string;
+  webOrigins?: readonly string[];
+  nativeRedirectUris?: readonly string[];
+}
+
+export interface AuthRedirectConfiguration {
+  providerCallbackUrl: string;
+  siteUrl: string;
+  redirectAllowList: readonly string[];
+  serializedRedirectAllowList: string;
+}
+
+export function resolveAuthRedirectConfiguration(
+  input: ResolveAuthRedirectConfigurationInput,
+): AuthRedirectConfiguration {
+  const gatewayOrigin = normalizeWebOrigin(input.gatewayOrigin, 'gatewayOrigin');
+  const siteUrl = normalizeWebOrigin(input.siteOrigin, 'siteOrigin');
+  const callbackRoute = normalizeCallbackRoute(input.callbackRoute);
+  const webOrigins = unique([
+    siteUrl,
+    ...(input.webOrigins ?? []).map((origin) => normalizeWebOrigin(origin, 'webOrigins')),
+  ]);
+  const nativeRedirectUris = unique(
+    (input.nativeRedirectUris ?? []).map((uri) => normalizeNativeRedirectUri(uri)),
+  );
+
+  const redirectAllowList = unique([
+    ...webOrigins,
+    ...webOrigins.map((origin) => `${origin}${callbackRoute}`),
+    ...(input.environment === 'local' ? getLocalAuthRedirectPatterns(callbackRoute) : []),
+    ...nativeRedirectUris,
+  ]);
+
+  return {
+    providerCallbackUrl: `${gatewayOrigin}/auth/v1/callback`,
+    siteUrl,
+    redirectAllowList,
+    serializedRedirectAllowList: redirectAllowList.join(','),
+  };
+}
+
+export function getLocalAuthRedirectPatterns(callbackRoute: string): readonly string[] {
+  const normalizedRoute = normalizeCallbackRoute(callbackRoute);
+  return [`http://127.0.0.1:*${normalizedRoute}`, `http://localhost:*${normalizedRoute}`];
+}
+
+export function normalizeAuthCallbackRoute(callbackRoute: string): string {
+  return normalizeCallbackRoute(callbackRoute);
+}
+
+function normalizeCallbackRoute(callbackRoute: string): string {
+  const trimmed = callbackRoute.trim();
+  if (!trimmed) {
+    throw new Error('Auth callback route must not be empty.');
+  }
+
+  const withLeadingSlash = trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+  const normalized = withLeadingSlash.replace(/\/{2,}/gu, '/');
+  if (normalized.includes('?') || normalized.includes('#')) {
+    throw new Error('Auth callback route must not include a query string or fragment.');
+  }
+  return normalized;
+}
+
+function normalizeWebOrigin(value: string, field: string): string {
+  const parsed = parseUrl(value, field);
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`${field} must use http or https.`);
+  }
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new Error(`${field} must be a canonical origin without credentials, query, or fragment.`);
+  }
+  if (parsed.pathname !== '/' && parsed.pathname !== '') {
+    throw new Error(`${field} must not include a path.`);
+  }
+  return parsed.origin;
+}
+
+function normalizeNativeRedirectUri(value: string): string {
+  const parsed = parseUrl(value, 'nativeRedirectUris');
+  if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
+    throw new Error('nativeRedirectUris must use a non-HTTP application scheme.');
+  }
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new Error(
+      'nativeRedirectUris must not include credentials, query strings, or fragments.',
+    );
+  }
+  return parsed.toString();
+}
+
+function parseUrl(value: string, field: string): URL {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    throw new Error(`${field} must not contain empty values.`);
+  }
+
+  try {
+    return new URL(trimmed);
+  } catch {
+    throw new Error(`${field} contains an invalid URL.`);
+  }
+}
+
+function unique(values: readonly string[]): string[] {
+  return [...new Set(values)];
+}

package/src/index.ts

@@ -8,6 +8,14 @@ import type {
 
 export type { ApiInfrastructureArtifacts } from './apiArtifacts';
 export { generateApiInfrastructureArtifacts } from './apiArtifacts';
+export {
+  type AuthRedirectConfiguration,
+  type AuthRedirectEnvironment,
+  getLocalAuthRedirectPatterns,
+  normalizeAuthCallbackRoute,
+  resolveAuthRedirectConfiguration,
+  type ResolveAuthRedirectConfigurationInput,
+} from './authRedirects';
 export {
   createInfraSecretStoreAdapter,
   type CreateInfraSecretStoreAdapterInput,