@ankhorage/infra 1.1.0 → 2.0.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ankhorage/infra
 
+## 2.0.1
+
+### Patch Changes
+
+- 6ff65a4: Keep Supabase Auth runtime environment assignments declarative across OAuth reconciliation so repeated Minikube Infra Up runs can safely reapply the generated deployment.
+
+## 2.0.0
+
+### Major Changes
+
+- a4dda40: Consume the canonical generated API desired-state contract, generate deterministic Supabase/Postgres database artifacts, and remove the obsolete generated API handler/OpenAPI artifact surface.
+
 ## 1.1.0
 
 ### Minor Changes

package/README.md

@@ -3,7 +3,7 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v1.0.4](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v1.1.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 
@@ -57,3 +57,6 @@ bunx @ankhorage/infra
 - [Export graph](././paradox/diagrams/export-graph.mmd)
 - [ankhorage-infra sequence](././paradox/diagrams/sequences/ankhorage-infra.mmd)
 - [createInfraSecretStoreAdapter sequence](././paradox/diagrams/sequences/create-infra-secret-store-adapter.mmd)
+- [getLocalAuthRedirectPatterns sequence](././paradox/diagrams/sequences/get-local-auth-redirect-patterns.mmd)
+- [normalizeAuthCallbackRoute sequence](././paradox/diagrams/sequences/normalize-auth-callback-route.mmd)
+- [resolveAuthRedirectConfiguration sequence](././paradox/diagrams/sequences/resolve-auth-redirect-configuration.mmd)

package/dist/adapters/minikube/auth/oauthRuntime.js

@@ -78,9 +78,6 @@ function getOAuthProviderLifecycle(oauthRuntime) {
 }
 function getOAuthRuntimeReconciliationCommand(oauthRuntime) {
     const localPatterns = oauthRuntime.localRedirectPatterns.join(',');
-    const providerRedirectAssignments = oauthRuntime.envPrefixes
-        .map((prefix) => `GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"`)
-        .join(' ');
     const providerExports = oauthRuntime.envPrefixes
         .map((prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"
 write_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI "\${oauth_provider_callback}"`)
@@ -96,12 +93,7 @@ fi
 export ADDITIONAL_REDIRECT_URLS="\${oauth_redirect_allow_list}"
 write_env_value ADDITIONAL_REDIRECT_URLS "\${oauth_redirect_allow_list}"
 ${providerExports}
-kubectl --context "\${PROFILE}" -n supabase set env deployment/auth \\
-  API_EXTERNAL_URL="\${API_EXTERNAL_URL}" \\
-  GOTRUE_SITE_URL="\${SITE_URL}" \\
-  GOTRUE_URI_ALLOW_LIST="\${oauth_redirect_allow_list}" \\
-  GOTRUE_JWT_ISSUER="\${API_EXTERNAL_URL}" \\
-  ${providerRedirectAssignments} >/dev/null
+sync_supabase_secrets
 kubectl --context "\${PROFILE}" -n supabase rollout restart deployment/auth >/dev/null
 kubectl --context "\${PROFILE}" -n supabase rollout status deployment/auth --timeout=600s`;
 }
@@ -136,9 +128,11 @@ Local Minikube reconciliation adds only callback-scoped loopback patterns:
 ${localPatterns}
 
 Native callback URIs may be supplied through \`OAUTH_NATIVE_REDIRECT_URLS\`. The generated
-provider lifecycle writes only redirect metadata, never OAuth client secrets. It updates the
-GoTrue deployment environment, forces \`deployment/auth\` to restart, and waits up to 600
-seconds for the rollout. A failed rollout stops Infra Up before its success message.
+provider lifecycle persists redirect metadata, re-syncs the canonical Supabase runtime
+ConfigMap and Secret sources, then forces \`deployment/auth\` to restart and waits up to 600
+seconds for the rollout. OAuth credential values remain sourced from trusted secret resolution
+and are never embedded in generated files. A failed rollout stops Infra Up before its success
+message.
 `;
 }
 //# sourceMappingURL=oauthRuntime.js.map

package/dist/adapters/minikube/auth/oauthRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthRuntime.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/oauthRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAUlG,MAAM,UAAU,qCAAqC,CACnD,QAA4B;IAE5B,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;YACrB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,sCAAsC;gBAC5C,OAAO,EAAE,oBAAoB,CAAC,YAAY,CAAC;aAC5C;SACF;QACD,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC5D,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA4B;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE;aACvB,IAAI,EAAE;aACN,WAAW,EAAE;aACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,gDAAgD,CAC/E,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,aAAa;QACb,WAAW;QACX,qBAAqB,EAAE,4BAA4B,CAAC,aAAa,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAuC;IAEvC,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,UAAU;QACrB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE;YACf;gBACE,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,UAAU;gBACrB,QAAQ,EAAE,iBAAiB;gBAC3B,cAAc,EAAE,GAAG;aACpB;SACF;QACD,iBAAiB,EAAE,EAAE;QACrB,sBAAsB,EAAE;YACtB;gBACE,KAAK,EAAE,mDAAmD;gBAC1D,OAAO,EAAE,oCAAoC,CAAC,YAAY,CAAC;aAC5D;SACF;QACD,YAAY,EAAE;YACZ;gBACE,KAAK,EAAE,8BAA8B;gBACrC,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC;aACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAAC,YAAuC;IACnF,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,2BAA2B,GAAG,YAAY,CAAC,WAAW;SACzD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,MAAM,6CAA6C,CAAC;SACvF,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,eAAe,GAAG,YAAY,CAAC,WAAW;SAC7C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,MAAM;kCAChB,MAAM,6CAA6C,CAChF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;2FAI+B,aAAa;;;;;;EAMtG,eAAe;;;;;;IAMb,2BAA2B;;0FAE2D,CAAC;AAC3F,CAAC;AAED,SAAS,4BAA4B,CAAC,YAAuC;IAC3E,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;;;;;;;;;0DAYF,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1G,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAuC;IACnE,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB;SACrD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,IAAI,CAAC;SACpC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;IAKL,YAAY,CAAC,aAAa;;;;EAI5B,aAAa;;;;;;CAMd,CAAC;AACF,CAAC","sourcesContent":["import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';\nimport type { InfraManifestInput } from '../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';\n\ninterface SupabaseOAuthRuntimeModel {\n  callbackRoute: string;\n  envPrefixes: readonly string[];\n  localRedirectPatterns: readonly string[];\n}\n\nexport function generateSupabaseOAuthRuntimeArtifacts(\n  manifest: InfraManifestInput,\n): MinikubeAdapterArtifacts {\n  const oauthRuntime = resolveOAuthRuntimeModel(manifest);\n  if (!oauthRuntime) {\n    return {\n      files: [],\n      resources: [],\n      providerLifecycle: [],\n      envEntries: [],\n      warnings: [],\n    };\n  }\n\n  return {\n    files: [\n      {\n        path: 'infra/minikube/auth/oauth-runtime.md',\n        content: getOAuthRuntimeGuide(oauthRuntime),\n      },\n    ],\n    resources: [],\n    providerLifecycle: [getOAuthProviderLifecycle(oauthRuntime)],\n    envEntries: [],\n    warnings: [],\n  };\n}\n\nfunction resolveOAuthRuntimeModel(manifest: InfraManifestInput): SupabaseOAuthRuntimeModel | null {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return null;\n\n  const providers = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (providers.length === 0) return null;\n\n  const callbackRoute = normalizeAuthCallbackRoute(oauth.callbackRoute);\n  const envPrefixes = providers.map((provider) => {\n    const prefix = provider.id\n      .trim()\n      .toUpperCase()\n      .replace(/[^A-Z0-9]+/gu, '_')\n      .replace(/^_+|_+$/gu, '');\n    if (!prefix) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" cannot be mapped to GoTrue environment keys.`,\n      );\n    }\n    return prefix;\n  });\n\n  return {\n    callbackRoute,\n    envPrefixes,\n    localRedirectPatterns: getLocalAuthRedirectPatterns(callbackRoute),\n  };\n}\n\nfunction getOAuthProviderLifecycle(\n  oauthRuntime: SupabaseOAuthRuntimeModel,\n): MinikubeProviderLifecycle {\n  return {\n    id: 'supabase-auth',\n    namespace: 'supabase',\n    endpoints: [],\n    readinessChecks: [\n      {\n        label: 'GoTrue',\n        namespace: 'supabase',\n        resource: 'deployment/auth',\n        timeoutSeconds: 600,\n      },\n    ],\n    migrationCommands: [],\n    reconciliationCommands: [\n      {\n        label: 'OAuth redirect and runtime rollout reconciliation',\n        command: getOAuthRuntimeReconciliationCommand(oauthRuntime),\n      },\n    ],\n    statusChecks: [\n      {\n        label: 'OAuth redirect configuration',\n        command: getOAuthRuntimeStatusCommand(oauthRuntime),\n      },\n    ],\n  };\n}\n\nfunction getOAuthRuntimeReconciliationCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns.join(',');\n  const providerRedirectAssignments = oauthRuntime.envPrefixes\n    .map((prefix) => `GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI=\"\\${oauth_provider_callback}\"`)\n    .join(' ');\n  const providerExports = oauthRuntime.envPrefixes\n    .map(\n      (prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI=\"\\${oauth_provider_callback}\"\nwrite_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI \"\\${oauth_provider_callback}\"`,\n    )\n    .join('\\n');\n\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\noauth_site_url=\"\\${SITE_URL%/}\"\noauth_provider_callback=\"\\${API_EXTERNAL_URL%/}/callback\"\noauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path},${localPatterns}\"\nif [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n  oauth_redirect_allow_list=\"\\${oauth_redirect_allow_list},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\nfi\nexport ADDITIONAL_REDIRECT_URLS=\"\\${oauth_redirect_allow_list}\"\nwrite_env_value ADDITIONAL_REDIRECT_URLS \"\\${oauth_redirect_allow_list}\"\n${providerExports}\nkubectl --context \"\\${PROFILE}\" -n supabase set env deployment/auth \\\\\n  API_EXTERNAL_URL=\"\\${API_EXTERNAL_URL}\" \\\\\n  GOTRUE_SITE_URL=\"\\${SITE_URL}\" \\\\\n  GOTRUE_URI_ALLOW_LIST=\"\\${oauth_redirect_allow_list}\" \\\\\n  GOTRUE_JWT_ISSUER=\"\\${API_EXTERNAL_URL}\" \\\\\n  ${providerRedirectAssignments} >/dev/null\nkubectl --context \"\\${PROFILE}\" -n supabase rollout restart deployment/auth >/dev/null\nkubectl --context \"\\${PROFILE}\" -n supabase rollout status deployment/auth --timeout=600s`;\n}\n\nfunction getOAuthRuntimeStatusCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\nif [[ -n \"\\${API_EXTERNAL_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/provider-callback: \\${API_EXTERNAL_URL%/}/callback\"\nelse\n  echo \"- provider supabase-auth/provider-callback: unavailable\"\nfi\nif [[ -n \"\\${SITE_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/app-callback: \\${SITE_URL%/}/\\${oauth_callback_path}\"\nelse\n  echo \"- provider supabase-auth/app-callback: unavailable\"\nfi\necho \"- provider supabase-auth/local-callback-patterns: ${oauthRuntime.localRedirectPatterns.join(',')}\"`;\n}\n\nfunction getOAuthRuntimeGuide(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns\n    .map((pattern) => `- \\`${pattern}\\``)\n    .join('\\n');\n\n  return `# Supabase OAuth Runtime Reconciliation\n\nThe provider callback is derived from the active project gateway as\n\\`\\${API_EXTERNAL_URL%/}/callback\\`, which resolves to the project-owned\n\\`/auth/v1/callback\\` endpoint. GoTrue-to-app redirects use the configured callback route\n\\`${oauthRuntime.callbackRoute}\\`.\n\nLocal Minikube reconciliation adds only callback-scoped loopback patterns:\n\n${localPatterns}\n\nNative callback URIs may be supplied through \\`OAUTH_NATIVE_REDIRECT_URLS\\`. The generated\nprovider lifecycle writes only redirect metadata, never OAuth client secrets. It updates the\nGoTrue deployment environment, forces \\`deployment/auth\\` to restart, and waits up to 600\nseconds for the rollout. A failed rollout stops Infra Up before its success message.\n`;\n}\n"]}
+{"version":3,"file":"oauthRuntime.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/oauthRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAUlG,MAAM,UAAU,qCAAqC,CACnD,QAA4B;IAE5B,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;YACrB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,sCAAsC;gBAC5C,OAAO,EAAE,oBAAoB,CAAC,YAAY,CAAC;aAC5C;SACF;QACD,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC5D,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA4B;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE;aACvB,IAAI,EAAE;aACN,WAAW,EAAE;aACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,gDAAgD,CAC/E,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,aAAa;QACb,WAAW;QACX,qBAAqB,EAAE,4BAA4B,CAAC,aAAa,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAuC;IAEvC,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,UAAU;QACrB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE;YACf;gBACE,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,UAAU;gBACrB,QAAQ,EAAE,iBAAiB;gBAC3B,cAAc,EAAE,GAAG;aACpB;SACF;QACD,iBAAiB,EAAE,EAAE;QACrB,sBAAsB,EAAE;YACtB;gBACE,KAAK,EAAE,mDAAmD;gBAC1D,OAAO,EAAE,oCAAoC,CAAC,YAAY,CAAC;aAC5D;SACF;QACD,YAAY,EAAE;YACZ;gBACE,KAAK,EAAE,8BAA8B;gBACrC,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC;aACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAAC,YAAuC;IACnF,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,YAAY,CAAC,WAAW;SAC7C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,MAAM;kCAChB,MAAM,6CAA6C,CAChF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;2FAI+B,aAAa;;;;;;EAMtG,eAAe;;;0FAGyE,CAAC;AAC3F,CAAC;AAED,SAAS,4BAA4B,CAAC,YAAuC;IAC3E,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;;;;;;;;;0DAYF,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1G,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAuC;IACnE,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB;SACrD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,IAAI,CAAC;SACpC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;IAKL,YAAY,CAAC,aAAa;;;;EAI5B,aAAa;;;;;;;;CAQd,CAAC;AACF,CAAC","sourcesContent":["import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';\nimport type { InfraManifestInput } from '../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';\n\ninterface SupabaseOAuthRuntimeModel {\n  callbackRoute: string;\n  envPrefixes: readonly string[];\n  localRedirectPatterns: readonly string[];\n}\n\nexport function generateSupabaseOAuthRuntimeArtifacts(\n  manifest: InfraManifestInput,\n): MinikubeAdapterArtifacts {\n  const oauthRuntime = resolveOAuthRuntimeModel(manifest);\n  if (!oauthRuntime) {\n    return {\n      files: [],\n      resources: [],\n      providerLifecycle: [],\n      envEntries: [],\n      warnings: [],\n    };\n  }\n\n  return {\n    files: [\n      {\n        path: 'infra/minikube/auth/oauth-runtime.md',\n        content: getOAuthRuntimeGuide(oauthRuntime),\n      },\n    ],\n    resources: [],\n    providerLifecycle: [getOAuthProviderLifecycle(oauthRuntime)],\n    envEntries: [],\n    warnings: [],\n  };\n}\n\nfunction resolveOAuthRuntimeModel(manifest: InfraManifestInput): SupabaseOAuthRuntimeModel | null {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return null;\n\n  const providers = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (providers.length === 0) return null;\n\n  const callbackRoute = normalizeAuthCallbackRoute(oauth.callbackRoute);\n  const envPrefixes = providers.map((provider) => {\n    const prefix = provider.id\n      .trim()\n      .toUpperCase()\n      .replace(/[^A-Z0-9]+/gu, '_')\n      .replace(/^_+|_+$/gu, '');\n    if (!prefix) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" cannot be mapped to GoTrue environment keys.`,\n      );\n    }\n    return prefix;\n  });\n\n  return {\n    callbackRoute,\n    envPrefixes,\n    localRedirectPatterns: getLocalAuthRedirectPatterns(callbackRoute),\n  };\n}\n\nfunction getOAuthProviderLifecycle(\n  oauthRuntime: SupabaseOAuthRuntimeModel,\n): MinikubeProviderLifecycle {\n  return {\n    id: 'supabase-auth',\n    namespace: 'supabase',\n    endpoints: [],\n    readinessChecks: [\n      {\n        label: 'GoTrue',\n        namespace: 'supabase',\n        resource: 'deployment/auth',\n        timeoutSeconds: 600,\n      },\n    ],\n    migrationCommands: [],\n    reconciliationCommands: [\n      {\n        label: 'OAuth redirect and runtime rollout reconciliation',\n        command: getOAuthRuntimeReconciliationCommand(oauthRuntime),\n      },\n    ],\n    statusChecks: [\n      {\n        label: 'OAuth redirect configuration',\n        command: getOAuthRuntimeStatusCommand(oauthRuntime),\n      },\n    ],\n  };\n}\n\nfunction getOAuthRuntimeReconciliationCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns.join(',');\n  const providerExports = oauthRuntime.envPrefixes\n    .map(\n      (prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI=\"\\${oauth_provider_callback}\"\nwrite_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI \"\\${oauth_provider_callback}\"`,\n    )\n    .join('\\n');\n\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\noauth_site_url=\"\\${SITE_URL%/}\"\noauth_provider_callback=\"\\${API_EXTERNAL_URL%/}/callback\"\noauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path},${localPatterns}\"\nif [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n  oauth_redirect_allow_list=\"\\${oauth_redirect_allow_list},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\nfi\nexport ADDITIONAL_REDIRECT_URLS=\"\\${oauth_redirect_allow_list}\"\nwrite_env_value ADDITIONAL_REDIRECT_URLS \"\\${oauth_redirect_allow_list}\"\n${providerExports}\nsync_supabase_secrets\nkubectl --context \"\\${PROFILE}\" -n supabase rollout restart deployment/auth >/dev/null\nkubectl --context \"\\${PROFILE}\" -n supabase rollout status deployment/auth --timeout=600s`;\n}\n\nfunction getOAuthRuntimeStatusCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\nif [[ -n \"\\${API_EXTERNAL_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/provider-callback: \\${API_EXTERNAL_URL%/}/callback\"\nelse\n  echo \"- provider supabase-auth/provider-callback: unavailable\"\nfi\nif [[ -n \"\\${SITE_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/app-callback: \\${SITE_URL%/}/\\${oauth_callback_path}\"\nelse\n  echo \"- provider supabase-auth/app-callback: unavailable\"\nfi\necho \"- provider supabase-auth/local-callback-patterns: ${oauthRuntime.localRedirectPatterns.join(',')}\"`;\n}\n\nfunction getOAuthRuntimeGuide(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns\n    .map((pattern) => `- \\`${pattern}\\``)\n    .join('\\n');\n\n  return `# Supabase OAuth Runtime Reconciliation\n\nThe provider callback is derived from the active project gateway as\n\\`\\${API_EXTERNAL_URL%/}/callback\\`, which resolves to the project-owned\n\\`/auth/v1/callback\\` endpoint. GoTrue-to-app redirects use the configured callback route\n\\`${oauthRuntime.callbackRoute}\\`.\n\nLocal Minikube reconciliation adds only callback-scoped loopback patterns:\n\n${localPatterns}\n\nNative callback URIs may be supplied through \\`OAUTH_NATIVE_REDIRECT_URLS\\`. The generated\nprovider lifecycle persists redirect metadata, re-syncs the canonical Supabase runtime\nConfigMap and Secret sources, then forces \\`deployment/auth\\` to restart and waits up to 600\nseconds for the rollout. OAuth credential values remain sourced from trusted secret resolution\nand are never embedded in generated files. A failed rollout stops Infra Up before its success\nmessage.\n`;\n}\n"]}

package/dist/adapters/minikube/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AAUrB,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAqFhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AAUrB,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAkGhC"}

package/dist/adapters/minikube/index.js

@@ -1,4 +1,4 @@
-import { generateApiInfrastructureArtifacts } from '../../apiArtifacts';
+import { generateGeneratedApiDatabaseArtifacts } from '../../generatedApiDatabase';
 import { generateAuthProviderArtifacts } from './auth';
 import { generateAuthorizationArtifacts } from './authz';
 import { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';
@@ -23,10 +23,16 @@ export function generateMinikubeInfra(manifest, options = {}) {
     });
     const storageArtifacts = generateStorageArtifacts({ manifest, namespace });
     const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });
-    const apiArtifacts = generateApiInfrastructureArtifacts({
-        data: options.appManifest?.data,
+    const generatedApiDatabaseArtifacts = generateGeneratedApiDatabaseArtifacts({
+        generatedApis: options.appManifest?.generatedApis,
         databaseProvider: manifest.database?.provider,
     });
+    const generatedApiErrors = generatedApiDatabaseArtifacts.diagnostics.filter((diagnostic) => diagnostic.severity === 'error');
+    if (generatedApiErrors.length > 0) {
+        throw new Error(`Generated API database definition is invalid:\n${generatedApiErrors
+            .map((diagnostic) => `- ${diagnostic.path ?? diagnostic.apiId}: ${diagnostic.message}`)
+            .join('\n')}`);
+    }
     const extraResources = unique([
         ...authArtifacts.resources,
         ...authzArtifacts.resources,
@@ -62,7 +68,9 @@ export function generateMinikubeInfra(manifest, options = {}) {
         ...authzArtifacts.warnings,
         ...storageArtifacts.warnings,
         ...secretStoreArtifacts.warnings,
-        ...apiArtifacts.warnings,
+        ...generatedApiDatabaseArtifacts.diagnostics
+            .filter((diagnostic) => diagnostic.severity === 'warning')
+            .map((diagnostic) => diagnostic.message),
     ]);
     return {
         files: [
@@ -71,7 +79,7 @@ export function generateMinikubeInfra(manifest, options = {}) {
             ...authzArtifacts.files,
             ...storageArtifacts.files,
             ...secretStoreArtifacts.files,
-            ...apiArtifacts.files,
+            ...generatedApiDatabaseArtifacts.files,
         ],
         warnings,
         meta: {

package/dist/adapters/minikube/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AAOxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC;IAEhC,MAAM,aAAa,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,kCAAkC,CAAC;QACtD,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI;QAC/B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG;QACxB,GAAG,aAAa,CAAC,iBAAiB;QAClC,GAAG,cAAc,CAAC,iBAAiB;QACnC,GAAG,gBAAgB,CAAC,iBAAiB;QACrC,GAAG,oBAAoB,CAAC,iBAAiB;KAC1C,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC;QAChC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;KACnE,CAAC,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,OAAO;QACP,cAAc;QACd,kBAAkB;QAClB,iBAAiB;QACjB,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,YAAY,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,YAAY,CAAC,KAAK;SACtB;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kMAAkM,CACnM,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateApiInfrastructureArtifacts } from '../../apiArtifacts';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;\nconst BUILT_IN_NAMESPACES = new Set([APP_NAMESPACE, 'supabase']);\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);\n  const namespace = APP_NAMESPACE;\n\n  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const apiArtifacts = generateApiInfrastructureArtifacts({\n    data: options.appManifest?.data,\n    databaseProvider: manifest.database?.provider,\n  });\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const providerLifecycle = [\n    ...authArtifacts.providerLifecycle,\n    ...authzArtifacts.providerLifecycle,\n    ...storageArtifacts.providerLifecycle,\n    ...secretStoreArtifacts.providerLifecycle,\n  ];\n  const providerNamespaces = unique([\n    ...providerLifecycle.map((contribution) => contribution.namespace),\n  ]).filter((providerNamespace) => !BUILT_IN_NAMESPACES.has(providerNamespace));\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...apiArtifacts.warnings,\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...apiArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction validateCanonicalAppSlug(slug: string | undefined): string {\n  if (!slug) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug is required.',\n    );\n  }\n\n  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',\n    );\n  }\n\n  return slug;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AAOnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC;IAEhC,MAAM,aAAa,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;QAC1E,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa;QACjD,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,WAAW,CAAC,MAAM,CACzE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAChD,CAAC;IAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,kDAAkD,kBAAkB;aACjE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;aACtF,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG;QACxB,GAAG,aAAa,CAAC,iBAAiB;QAClC,GAAG,cAAc,CAAC,iBAAiB;QACnC,GAAG,gBAAgB,CAAC,iBAAiB;QACrC,GAAG,oBAAoB,CAAC,iBAAiB;KAC1C,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC;QAChC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;KACnE,CAAC,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,OAAO;QACP,cAAc;QACd,kBAAkB;QAClB,iBAAiB;QACjB,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,6BAA6B,CAAC,WAAW;aACzC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC;aACzD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;KAC3C,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,6BAA6B,CAAC,KAAK;SACvC;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kMAAkM,CACnM,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateGeneratedApiDatabaseArtifacts } from '../../generatedApiDatabase';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;\nconst BUILT_IN_NAMESPACES = new Set([APP_NAMESPACE, 'supabase']);\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);\n  const namespace = APP_NAMESPACE;\n\n  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const generatedApiDatabaseArtifacts = generateGeneratedApiDatabaseArtifacts({\n    generatedApis: options.appManifest?.generatedApis,\n    databaseProvider: manifest.database?.provider,\n  });\n  const generatedApiErrors = generatedApiDatabaseArtifacts.diagnostics.filter(\n    (diagnostic) => diagnostic.severity === 'error',\n  );\n\n  if (generatedApiErrors.length > 0) {\n    throw new Error(\n      `Generated API database definition is invalid:\\n${generatedApiErrors\n        .map((diagnostic) => `- ${diagnostic.path ?? diagnostic.apiId}: ${diagnostic.message}`)\n        .join('\\n')}`,\n    );\n  }\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const providerLifecycle = [\n    ...authArtifacts.providerLifecycle,\n    ...authzArtifacts.providerLifecycle,\n    ...storageArtifacts.providerLifecycle,\n    ...secretStoreArtifacts.providerLifecycle,\n  ];\n  const providerNamespaces = unique([\n    ...providerLifecycle.map((contribution) => contribution.namespace),\n  ]).filter((providerNamespace) => !BUILT_IN_NAMESPACES.has(providerNamespace));\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...generatedApiDatabaseArtifacts.diagnostics\n      .filter((diagnostic) => diagnostic.severity === 'warning')\n      .map((diagnostic) => diagnostic.message),\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...generatedApiDatabaseArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction validateCanonicalAppSlug(slug: string | undefined): string {\n  if (!slug) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug is required.',\n    );\n  }\n\n  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',\n    );\n  }\n\n  return slug;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}

package/dist/generatedApiDatabase.d.ts

@@ -0,0 +1,20 @@
+import type { GeneratedApiRegistry } from '@ankhorage/contracts';
+import type { GeneratedInfrastructureFile } from './types';
+export type GeneratedApiDatabaseDiagnosticCode = 'duplicate-field' | 'duplicate-resource-id' | 'duplicate-target' | 'invalid-default' | 'invalid-identifier' | 'invalid-primary-key' | 'invalid-seed' | 'registry-id-mismatch' | 'unsupported-policy' | 'unsupported-provider';
+export interface GeneratedApiDatabaseDiagnostic {
+    readonly code: GeneratedApiDatabaseDiagnosticCode;
+    readonly severity: 'error' | 'warning';
+    readonly apiId: string;
+    readonly resourceId?: string;
+    readonly path?: string;
+    readonly message: string;
+}
+export interface GeneratedApiDatabaseArtifacts {
+    readonly files: readonly GeneratedInfrastructureFile[];
+    readonly diagnostics: readonly GeneratedApiDatabaseDiagnostic[];
+}
+export declare function generateGeneratedApiDatabaseArtifacts(args: {
+    readonly generatedApis: GeneratedApiRegistry | undefined;
+    readonly databaseProvider: string | undefined;
+}): GeneratedApiDatabaseArtifacts;
+//# sourceMappingURL=generatedApiDatabase.d.ts.map

package/dist/generatedApiDatabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generatedApiDatabase.d.ts","sourceRoot":"","sources":["../src/generatedApiDatabase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAKV,oBAAoB,EAGrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,MAAM,MAAM,kCAAkC,GAC1C,iBAAiB,GACjB,uBAAuB,GACvB,kBAAkB,GAClB,iBAAiB,GACjB,oBAAoB,GACpB,qBAAqB,GACrB,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,sBAAsB,CAAC;AAE3B,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,kCAAkC,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACvD,QAAQ,CAAC,WAAW,EAAE,SAAS,8BAA8B,EAAE,CAAC;CACjE;AAmBD,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,QAAQ,CAAC,aAAa,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C,GAAG,6BAA6B,CA2ChC"}

package/dist/generatedApiDatabase.js

@@ -0,0 +1,343 @@
+const DEFAULT_DATABASE_SCHEMA = 'public';
+const SQL_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function generateGeneratedApiDatabaseArtifacts(args) {
+    const contexts = listGeneratedResources(args.generatedApis);
+    if (contexts.length === 0)
+        return { files: [], diagnostics: [] };
+    const diagnostics = validateGeneratedApiDatabaseState(args.generatedApis ?? {}, contexts, args.databaseProvider);
+    if (diagnostics.some((diagnostic) => diagnostic.severity === 'error')) {
+        return { files: [], diagnostics };
+    }
+    const seedEntries = contexts.map(createSeedEntry);
+    const metadata = contexts.map((context) => ({
+        apiId: context.api.id,
+        database: context.api.database,
+        auth: context.api.auth ?? null,
+        resourceId: context.resource.id,
+        operations: context.resource.operations,
+        collection: context.resource.collection,
+        policies: context.resource.policies ?? [],
+    }));
+    return {
+        files: [
+            jsonFile('infra/minikube/db/generated-api-resources.json', metadata),
+            jsonFile('infra/minikube/db/generated-api-seed.json', seedEntries),
+            {
+                path: 'infra/minikube/db/migrations/001_generated_api_resources.sql',
+                content: generateMigrationSql(contexts),
+            },
+            {
+                path: 'infra/minikube/db/seeds/001_generated_api_seed.sql',
+                content: generateSeedSql(seedEntries),
+            },
+            {
+                path: 'infra/minikube/db/README.md',
+                content: generateReadme(contexts),
+            },
+        ],
+        diagnostics,
+    };
+}
+function listGeneratedResources(registry) {
+    return Object.values(registry ?? {})
+        .sort((left, right) => left.id.localeCompare(right.id))
+        .flatMap((api) => [...api.resources]
+        .sort((left, right) => left.id.localeCompare(right.id))
+        .map((resource) => ({ api, resource, seed: resource.seed ?? [] })));
+}
+function validateGeneratedApiDatabaseState(registry, contexts, databaseProvider) {
+    const diagnostics = [];
+    const targets = new Map();
+    const resourceIdsByApi = new Map();
+    if (databaseProvider !== 'supabase') {
+        diagnostics.push({
+            code: 'unsupported-provider',
+            severity: 'error',
+            apiId: contexts[0]?.api.id ?? 'generated-api',
+            path: 'infra.database.provider',
+            message: 'Generated API database resources currently require the supabase provider.',
+        });
+    }
+    for (const [registryId, api] of Object.entries(registry)) {
+        if (registryId !== api.id) {
+            diagnostics.push({
+                code: 'registry-id-mismatch',
+                severity: 'error',
+                apiId: api.id,
+                path: `generatedApis.${registryId}.id`,
+                message: `Generated API registry key '${registryId}' does not match definition id '${api.id}'.`,
+            });
+        }
+    }
+    for (const context of contexts) {
+        const { api, resource } = context;
+        const resourceIds = resourceIdsByApi.get(api.id) ?? new Set();
+        if (resourceIds.has(resource.id)) {
+            diagnostics.push(resourceDiagnostic(context, 'duplicate-resource-id', 'id', `Resource ID '${resource.id}' is duplicated.`));
+        }
+        resourceIds.add(resource.id);
+        resourceIdsByApi.set(api.id, resourceIds);
+        validateIdentifier(context, 'collection.name', resource.collection.name, diagnostics);
+        validateIdentifier(context, 'collection.schema', resource.collection.schema ?? DEFAULT_DATABASE_SCHEMA, diagnostics);
+        validateFields(context, diagnostics);
+        validatePrimaryKey(context, diagnostics);
+        validateSeeds(context, diagnostics);
+        const target = `${resource.collection.schema ?? DEFAULT_DATABASE_SCHEMA}.${resource.collection.name}`;
+        const previous = targets.get(target);
+        if (previous !== undefined) {
+            diagnostics.push(resourceDiagnostic(context, 'duplicate-target', 'collection', `Database target '${target}' is already owned by ${previous.api.id}/${previous.resource.id}.`));
+        }
+        else {
+            targets.set(target, context);
+        }
+        if ((resource.policies?.length ?? 0) > 0) {
+            diagnostics.push(resourceDiagnostic(context, 'unsupported-policy', 'policies', 'Policy references enable RLS, but the canonical contract does not yet contain provider-owned SQL policy expressions; no CREATE POLICY statement is emitted.', 'warning'));
+        }
+    }
+    return diagnostics;
+}
+function validateFields(context, diagnostics) {
+    const fieldNames = new Set();
+    for (const field of context.resource.collection.fields) {
+        validateIdentifier(context, `collection.fields.${field.name}.name`, field.name, diagnostics);
+        if (fieldNames.has(field.name)) {
+            diagnostics.push(resourceDiagnostic(context, 'duplicate-field', `collection.fields.${field.name}`, `Field '${field.name}' is duplicated.`));
+        }
+        fieldNames.add(field.name);
+        if (!isCompatibleDefault(field)) {
+            diagnostics.push(resourceDiagnostic(context, 'invalid-default', `collection.fields.${field.name}.defaultValue`, `Default value for '${field.name}' is incompatible with field type '${field.type}'.`));
+        }
+    }
+}
+function validatePrimaryKey(context, diagnostics) {
+    const { primaryKey } = context.resource.collection;
+    if (primaryKey === undefined)
+        return;
+    validateIdentifier(context, 'collection.primaryKey', primaryKey, diagnostics);
+    if (!context.resource.collection.fields.some((field) => field.name === primaryKey)) {
+        diagnostics.push(resourceDiagnostic(context, 'invalid-primary-key', 'collection.primaryKey', `Primary key '${primaryKey}' must reference a declared field.`));
+    }
+}
+function validateSeeds(context, diagnostics) {
+    const fields = new Map(context.resource.collection.fields.map((field) => [field.name, field]));
+    const { primaryKey } = context.resource.collection;
+    context.seed.forEach((record, index) => {
+        for (const key of Object.keys(record)) {
+            if (!fields.has(key)) {
+                diagnostics.push(resourceDiagnostic(context, 'invalid-seed', `seed.${index}.${key}`, `Seed field '${key}' is not declared by the collection.`));
+            }
+        }
+        for (const field of fields.values()) {
+            const value = record[field.name];
+            const generatedUuidPrimaryKey = field.name === primaryKey && field.type === 'uuid' && value === undefined;
+            const requiresNonNullValue = field.required === true || field.name === primaryKey;
+            if (value === undefined) {
+                if (requiresNonNullValue && field.defaultValue === undefined && !generatedUuidPrimaryKey) {
+                    diagnostics.push(resourceDiagnostic(context, 'invalid-seed', `seed.${index}.${field.name}`, `Seed record is missing required field '${field.name}'.`));
+                }
+                continue;
+            }
+            if (value === null) {
+                if (requiresNonNullValue) {
+                    diagnostics.push(resourceDiagnostic(context, 'invalid-seed', `seed.${index}.${field.name}`, `Seed field '${field.name}' cannot be null.`));
+                }
+                continue;
+            }
+            if (!isCompatibleFieldValue(field, value)) {
+                diagnostics.push(resourceDiagnostic(context, 'invalid-seed', `seed.${index}.${field.name}`, `Seed value for '${field.name}' is incompatible with field type '${field.type}'.`));
+            }
+        }
+    });
+}
+function validateIdentifier(context, path, value, diagnostics) {
+    if (SQL_IDENTIFIER_RE.test(value))
+        return;
+    diagnostics.push(resourceDiagnostic(context, 'invalid-identifier', path, `Database identifier '${value}' must match ${SQL_IDENTIFIER_RE.source}.`));
+}
+function resourceDiagnostic(context, code, path, message, severity = 'error') {
+    return {
+        code,
+        severity,
+        apiId: context.api.id,
+        resourceId: context.resource.id,
+        path: `generatedApis.${context.api.id}.resources.${context.resource.id}.${path}`,
+        message,
+    };
+}
+function isCompatibleDefault(field) {
+    const value = field.defaultValue;
+    if (value === undefined || value === null)
+        return true;
+    return isCompatibleFieldValue(field, value);
+}
+function isCompatibleFieldValue(field, value) {
+    switch (field.type) {
+        case 'boolean':
+            return typeof value === 'boolean';
+        case 'number':
+            return typeof value === 'number' && Number.isFinite(value);
+        case 'text':
+            return typeof value === 'string';
+        case 'datetime':
+            return typeof value === 'string' && Number.isFinite(Date.parse(value));
+        case 'uuid':
+            return typeof value === 'string' && UUID_RE.test(value);
+        case 'json':
+            return true;
+    }
+}
+function createSeedEntry(context) {
+    return {
+        apiId: context.api.id,
+        resourceId: context.resource.id,
+        collection: context.resource.collection,
+        records: context.seed.map((record, index) => materializeSeedRecord(context, record, index)),
+    };
+}
+function materializeSeedRecord(context, record, index) {
+    const { primaryKey } = context.resource.collection;
+    if (primaryKey === undefined || record[primaryKey] !== undefined)
+        return record;
+    const primaryKeyField = context.resource.collection.fields.find((field) => field.name === primaryKey);
+    if (primaryKeyField?.type !== 'uuid')
+        return record;
+    return {
+        ...record,
+        [primaryKey]: createDeterministicSeedUuid(context.api.id, context.resource.id, index),
+    };
+}
+function generateMigrationSql(contexts) {
+    const statements = contexts.flatMap((context) => {
+        const schema = quoteIdentifier(context.resource.collection.schema ?? DEFAULT_DATABASE_SCHEMA);
+        const table = quoteIdentifier(context.resource.collection.name);
+        const columns = context.resource.collection.fields.map((field) => formatColumn(field, field.name === context.resource.collection.primaryKey));
+        const rls = (context.resource.policies?.length ?? 0) > 0
+            ? [`alter table ${schema}.${table} enable row level security;`]
+            : [];
+        return [
+            `create schema if not exists ${schema};`,
+            `create table if not exists ${schema}.${table} (\n  ${columns.join(',\n  ')}\n);`,
+            ...rls,
+        ];
+    });
+    return [
+        '-- Generated from canonical GeneratedApiDefinition resources.',
+        '-- No HTTP/GraphQL service or Kubernetes API workload is generated here.',
+        'create extension if not exists pgcrypto;',
+        '',
+        ...statements,
+        '',
+    ].join('\n');
+}
+function generateSeedSql(entries) {
+    const statements = entries.flatMap((entry) => createSeedStatements(entry));
+    return [
+        '-- Generated from canonical generated API seed records.',
+        ...(statements.length === 0 ? ['-- No generated API seed records configured.'] : statements),
+        '',
+    ].join('\n');
+}
+function createSeedStatements(entry) {
+    if (entry.records.length === 0)
+        return [];
+    const fields = entry.collection.fields.filter((field) => entry.records.some((record) => record[field.name] !== undefined));
+    if (fields.length === 0)
+        return [];
+    const schema = quoteIdentifier(entry.collection.schema ?? DEFAULT_DATABASE_SCHEMA);
+    const table = quoteIdentifier(entry.collection.name);
+    const values = entry.records
+        .map((record) => `(${fields.map((field) => formatSeedValue(field, record[field.name])).join(', ')})`)
+        .join(',\n  ');
+    const conflict = entry.collection.primaryKey === undefined
+        ? 'on conflict do nothing'
+        : `on conflict (${quoteIdentifier(entry.collection.primaryKey)}) do nothing`;
+    return [
+        `insert into ${schema}.${table} (${fields.map((field) => quoteIdentifier(field.name)).join(', ')}) values\n  ${values}\n${conflict};`,
+    ];
+}
+function formatSeedValue(field, value) {
+    if (value === undefined)
+        return 'default';
+    return formatFieldValue(field, value);
+}
+function formatColumn(field, primaryKey) {
+    const defaultValue = formatDefault(field, primaryKey);
+    const primaryKeyClause = primaryKey ? ' primary key' : '';
+    const required = field.required === true && !primaryKey ? ' not null' : '';
+    const unique = field.unique === true && !primaryKey ? ' unique' : '';
+    return `${quoteIdentifier(field.name)} ${mapFieldType(field.type)}${defaultValue}${primaryKeyClause}${required}${unique}`;
+}
+function mapFieldType(type) {
+    if (type === 'uuid')
+        return 'uuid';
+    if (type === 'text')
+        return 'text';
+    if (type === 'number')
+        return 'numeric';
+    if (type === 'boolean')
+        return 'boolean';
+    if (type === 'datetime')
+        return 'timestamptz';
+    return 'jsonb';
+}
+function formatDefault(field, primaryKey) {
+    if (primaryKey && field.type === 'uuid' && field.defaultValue === undefined) {
+        return ' default gen_random_uuid()';
+    }
+    if (field.defaultValue === undefined)
+        return '';
+    return ` default ${formatFieldValue(field, field.defaultValue)}`;
+}
+function formatFieldValue(field, value) {
+    if (value === null)
+        return 'null';
+    if (field.type === 'json') {
+        return `'${escapeString(JSON.stringify(value))}'::jsonb`;
+    }
+    return formatValue(value);
+}
+function formatValue(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'string')
+        return `'${escapeString(value)}'`;
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? String(value) : 'null';
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    return `'${escapeString(JSON.stringify(value))}'::jsonb`;
+}
+function generateReadme(contexts) {
+    const resources = contexts
+        .map((context) => {
+        const { collection } = context.resource;
+        return `- \`${context.api.id}/${context.resource.id}\` -> \`${collection.schema ?? DEFAULT_DATABASE_SCHEMA}.${collection.name}\``;
+    })
+        .join('\n');
+    return `# Generated API Database Artifacts\n\nThese files materialize canonical generated API resources into Supabase/Postgres database infrastructure.\n\n${resources}\n\nNo HTTP/GraphQL server, Docker image, application handler, OpenAPI document, Kubernetes Deployment or Service is generated by this bridge.\n`;
+}
+function jsonFile(path, value) {
+    return { path, content: `${JSON.stringify(value, null, 2)}\n` };
+}
+function quoteIdentifier(identifier) {
+    return `"${identifier.replaceAll('"', '""')}"`;
+}
+function escapeString(value) {
+    return value.replaceAll("'", "''");
+}
+function createDeterministicSeedUuid(apiId, resourceId, index) {
+    const input = `${apiId}:${resourceId}:${index}`;
+    const hex = `${hashHex(input, 0)}${hashHex(input, 1)}${hashHex(input, 2)}${hashHex(input, 3)}`;
+    const variant = ((Number.parseInt(hex.charAt(16), 16) & 0x3) | 0x8).toString(16);
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-${variant}${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+function hashHex(input, salt) {
+    let hash = 2166136261 ^ salt;
+    for (const char of input) {
+        hash ^= char.charCodeAt(0);
+        hash = Math.imul(hash, 16777619);
+    }
+    return (hash >>> 0).toString(16).padStart(8, '0');
+}
+//# sourceMappingURL=generatedApiDatabase.js.map