@ankhorage/infra 2.0.0 → 3.0.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ankhorage/infra
 
+## 3.0.0
+
+### Major Changes
+
+- e4549c9: Consume the canonical Contracts 6 module manifest boundary and require `infra.modules` instead of the removed legacy `infra.plugins` field.
+
+## 2.0.1
+
+### Patch Changes
+
+- 6ff65a4: Keep Supabase Auth runtime environment assignments declarative across OAuth reconciliation so repeated Minikube Infra Up runs can safely reapply the generated deployment.
+
 ## 2.0.0
 
 ### Major Changes

package/README.md

@@ -3,7 +3,7 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v1.1.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v2.0.1](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 

package/dist/adapters/minikube/auth/oauthRuntime.js

@@ -78,9 +78,6 @@ function getOAuthProviderLifecycle(oauthRuntime) {
 }
 function getOAuthRuntimeReconciliationCommand(oauthRuntime) {
     const localPatterns = oauthRuntime.localRedirectPatterns.join(',');
-    const providerRedirectAssignments = oauthRuntime.envPrefixes
-        .map((prefix) => `GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"`)
-        .join(' ');
     const providerExports = oauthRuntime.envPrefixes
         .map((prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"
 write_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI "\${oauth_provider_callback}"`)
@@ -96,12 +93,7 @@ fi
 export ADDITIONAL_REDIRECT_URLS="\${oauth_redirect_allow_list}"
 write_env_value ADDITIONAL_REDIRECT_URLS "\${oauth_redirect_allow_list}"
 ${providerExports}
-kubectl --context "\${PROFILE}" -n supabase set env deployment/auth \\
-  API_EXTERNAL_URL="\${API_EXTERNAL_URL}" \\
-  GOTRUE_SITE_URL="\${SITE_URL}" \\
-  GOTRUE_URI_ALLOW_LIST="\${oauth_redirect_allow_list}" \\
-  GOTRUE_JWT_ISSUER="\${API_EXTERNAL_URL}" \\
-  ${providerRedirectAssignments} >/dev/null
+sync_supabase_secrets
 kubectl --context "\${PROFILE}" -n supabase rollout restart deployment/auth >/dev/null
 kubectl --context "\${PROFILE}" -n supabase rollout status deployment/auth --timeout=600s`;
 }
@@ -136,9 +128,11 @@ Local Minikube reconciliation adds only callback-scoped loopback patterns:
 ${localPatterns}
 
 Native callback URIs may be supplied through \`OAUTH_NATIVE_REDIRECT_URLS\`. The generated
-provider lifecycle writes only redirect metadata, never OAuth client secrets. It updates the
-GoTrue deployment environment, forces \`deployment/auth\` to restart, and waits up to 600
-seconds for the rollout. A failed rollout stops Infra Up before its success message.
+provider lifecycle persists redirect metadata, re-syncs the canonical Supabase runtime
+ConfigMap and Secret sources, then forces \`deployment/auth\` to restart and waits up to 600
+seconds for the rollout. OAuth credential values remain sourced from trusted secret resolution
+and are never embedded in generated files. A failed rollout stops Infra Up before its success
+message.
 `;
 }
 //# sourceMappingURL=oauthRuntime.js.map

package/dist/adapters/minikube/auth/oauthRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthRuntime.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/oauthRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAUlG,MAAM,UAAU,qCAAqC,CACnD,QAA4B;IAE5B,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;YACrB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,sCAAsC;gBAC5C,OAAO,EAAE,oBAAoB,CAAC,YAAY,CAAC;aAC5C;SACF;QACD,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC5D,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA4B;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE;aACvB,IAAI,EAAE;aACN,WAAW,EAAE;aACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,gDAAgD,CAC/E,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,aAAa;QACb,WAAW;QACX,qBAAqB,EAAE,4BAA4B,CAAC,aAAa,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAuC;IAEvC,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,UAAU;QACrB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE;YACf;gBACE,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,UAAU;gBACrB,QAAQ,EAAE,iBAAiB;gBAC3B,cAAc,EAAE,GAAG;aACpB;SACF;QACD,iBAAiB,EAAE,EAAE;QACrB,sBAAsB,EAAE;YACtB;gBACE,KAAK,EAAE,mDAAmD;gBAC1D,OAAO,EAAE,oCAAoC,CAAC,YAAY,CAAC;aAC5D;SACF;QACD,YAAY,EAAE;YACZ;gBACE,KAAK,EAAE,8BAA8B;gBACrC,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC;aACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAAC,YAAuC;IACnF,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,2BAA2B,GAAG,YAAY,CAAC,WAAW;SACzD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,MAAM,6CAA6C,CAAC;SACvF,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,eAAe,GAAG,YAAY,CAAC,WAAW;SAC7C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,MAAM;kCAChB,MAAM,6CAA6C,CAChF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;2FAI+B,aAAa;;;;;;EAMtG,eAAe;;;;;;IAMb,2BAA2B;;0FAE2D,CAAC;AAC3F,CAAC;AAED,SAAS,4BAA4B,CAAC,YAAuC;IAC3E,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;;;;;;;;;0DAYF,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1G,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAuC;IACnE,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB;SACrD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,IAAI,CAAC;SACpC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;IAKL,YAAY,CAAC,aAAa;;;;EAI5B,aAAa;;;;;;CAMd,CAAC;AACF,CAAC","sourcesContent":["import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';\nimport type { InfraManifestInput } from '../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';\n\ninterface SupabaseOAuthRuntimeModel {\n  callbackRoute: string;\n  envPrefixes: readonly string[];\n  localRedirectPatterns: readonly string[];\n}\n\nexport function generateSupabaseOAuthRuntimeArtifacts(\n  manifest: InfraManifestInput,\n): MinikubeAdapterArtifacts {\n  const oauthRuntime = resolveOAuthRuntimeModel(manifest);\n  if (!oauthRuntime) {\n    return {\n      files: [],\n      resources: [],\n      providerLifecycle: [],\n      envEntries: [],\n      warnings: [],\n    };\n  }\n\n  return {\n    files: [\n      {\n        path: 'infra/minikube/auth/oauth-runtime.md',\n        content: getOAuthRuntimeGuide(oauthRuntime),\n      },\n    ],\n    resources: [],\n    providerLifecycle: [getOAuthProviderLifecycle(oauthRuntime)],\n    envEntries: [],\n    warnings: [],\n  };\n}\n\nfunction resolveOAuthRuntimeModel(manifest: InfraManifestInput): SupabaseOAuthRuntimeModel | null {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return null;\n\n  const providers = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (providers.length === 0) return null;\n\n  const callbackRoute = normalizeAuthCallbackRoute(oauth.callbackRoute);\n  const envPrefixes = providers.map((provider) => {\n    const prefix = provider.id\n      .trim()\n      .toUpperCase()\n      .replace(/[^A-Z0-9]+/gu, '_')\n      .replace(/^_+|_+$/gu, '');\n    if (!prefix) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" cannot be mapped to GoTrue environment keys.`,\n      );\n    }\n    return prefix;\n  });\n\n  return {\n    callbackRoute,\n    envPrefixes,\n    localRedirectPatterns: getLocalAuthRedirectPatterns(callbackRoute),\n  };\n}\n\nfunction getOAuthProviderLifecycle(\n  oauthRuntime: SupabaseOAuthRuntimeModel,\n): MinikubeProviderLifecycle {\n  return {\n    id: 'supabase-auth',\n    namespace: 'supabase',\n    endpoints: [],\n    readinessChecks: [\n      {\n        label: 'GoTrue',\n        namespace: 'supabase',\n        resource: 'deployment/auth',\n        timeoutSeconds: 600,\n      },\n    ],\n    migrationCommands: [],\n    reconciliationCommands: [\n      {\n        label: 'OAuth redirect and runtime rollout reconciliation',\n        command: getOAuthRuntimeReconciliationCommand(oauthRuntime),\n      },\n    ],\n    statusChecks: [\n      {\n        label: 'OAuth redirect configuration',\n        command: getOAuthRuntimeStatusCommand(oauthRuntime),\n      },\n    ],\n  };\n}\n\nfunction getOAuthRuntimeReconciliationCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns.join(',');\n  const providerRedirectAssignments = oauthRuntime.envPrefixes\n    .map((prefix) => `GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI=\"\\${oauth_provider_callback}\"`)\n    .join(' ');\n  const providerExports = oauthRuntime.envPrefixes\n    .map(\n      (prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI=\"\\${oauth_provider_callback}\"\nwrite_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI \"\\${oauth_provider_callback}\"`,\n    )\n    .join('\\n');\n\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\noauth_site_url=\"\\${SITE_URL%/}\"\noauth_provider_callback=\"\\${API_EXTERNAL_URL%/}/callback\"\noauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path},${localPatterns}\"\nif [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n  oauth_redirect_allow_list=\"\\${oauth_redirect_allow_list},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\nfi\nexport ADDITIONAL_REDIRECT_URLS=\"\\${oauth_redirect_allow_list}\"\nwrite_env_value ADDITIONAL_REDIRECT_URLS \"\\${oauth_redirect_allow_list}\"\n${providerExports}\nkubectl --context \"\\${PROFILE}\" -n supabase set env deployment/auth \\\\\n  API_EXTERNAL_URL=\"\\${API_EXTERNAL_URL}\" \\\\\n  GOTRUE_SITE_URL=\"\\${SITE_URL}\" \\\\\n  GOTRUE_URI_ALLOW_LIST=\"\\${oauth_redirect_allow_list}\" \\\\\n  GOTRUE_JWT_ISSUER=\"\\${API_EXTERNAL_URL}\" \\\\\n  ${providerRedirectAssignments} >/dev/null\nkubectl --context \"\\${PROFILE}\" -n supabase rollout restart deployment/auth >/dev/null\nkubectl --context \"\\${PROFILE}\" -n supabase rollout status deployment/auth --timeout=600s`;\n}\n\nfunction getOAuthRuntimeStatusCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\nif [[ -n \"\\${API_EXTERNAL_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/provider-callback: \\${API_EXTERNAL_URL%/}/callback\"\nelse\n  echo \"- provider supabase-auth/provider-callback: unavailable\"\nfi\nif [[ -n \"\\${SITE_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/app-callback: \\${SITE_URL%/}/\\${oauth_callback_path}\"\nelse\n  echo \"- provider supabase-auth/app-callback: unavailable\"\nfi\necho \"- provider supabase-auth/local-callback-patterns: ${oauthRuntime.localRedirectPatterns.join(',')}\"`;\n}\n\nfunction getOAuthRuntimeGuide(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns\n    .map((pattern) => `- \\`${pattern}\\``)\n    .join('\\n');\n\n  return `# Supabase OAuth Runtime Reconciliation\n\nThe provider callback is derived from the active project gateway as\n\\`\\${API_EXTERNAL_URL%/}/callback\\`, which resolves to the project-owned\n\\`/auth/v1/callback\\` endpoint. GoTrue-to-app redirects use the configured callback route\n\\`${oauthRuntime.callbackRoute}\\`.\n\nLocal Minikube reconciliation adds only callback-scoped loopback patterns:\n\n${localPatterns}\n\nNative callback URIs may be supplied through \\`OAUTH_NATIVE_REDIRECT_URLS\\`. The generated\nprovider lifecycle writes only redirect metadata, never OAuth client secrets. It updates the\nGoTrue deployment environment, forces \\`deployment/auth\\` to restart, and waits up to 600\nseconds for the rollout. A failed rollout stops Infra Up before its success message.\n`;\n}\n"]}
+{"version":3,"file":"oauthRuntime.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/oauthRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAUlG,MAAM,UAAU,qCAAqC,CACnD,QAA4B;IAE5B,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;YACrB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,sCAAsC;gBAC5C,OAAO,EAAE,oBAAoB,CAAC,YAAY,CAAC;aAC5C;SACF;QACD,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC5D,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA4B;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE;aACvB,IAAI,EAAE;aACN,WAAW,EAAE;aACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,gDAAgD,CAC/E,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,aAAa;QACb,WAAW;QACX,qBAAqB,EAAE,4BAA4B,CAAC,aAAa,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAuC;IAEvC,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,UAAU;QACrB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE;YACf;gBACE,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,UAAU;gBACrB,QAAQ,EAAE,iBAAiB;gBAC3B,cAAc,EAAE,GAAG;aACpB;SACF;QACD,iBAAiB,EAAE,EAAE;QACrB,sBAAsB,EAAE;YACtB;gBACE,KAAK,EAAE,mDAAmD;gBAC1D,OAAO,EAAE,oCAAoC,CAAC,YAAY,CAAC;aAC5D;SACF;QACD,YAAY,EAAE;YACZ;gBACE,KAAK,EAAE,8BAA8B;gBACrC,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC;aACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAAC,YAAuC;IACnF,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,YAAY,CAAC,WAAW;SAC7C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,MAAM;kCAChB,MAAM,6CAA6C,CAChF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;2FAI+B,aAAa;;;;;;EAMtG,eAAe;;;0FAGyE,CAAC;AAC3F,CAAC;AAED,SAAS,4BAA4B,CAAC,YAAuC;IAC3E,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;;;;;;;;;0DAYF,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1G,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAuC;IACnE,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB;SACrD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,IAAI,CAAC;SACpC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;IAKL,YAAY,CAAC,aAAa;;;;EAI5B,aAAa;;;;;;;;CAQd,CAAC;AACF,CAAC","sourcesContent":["import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';\nimport type { InfraManifestInput } from '../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';\n\ninterface SupabaseOAuthRuntimeModel {\n  callbackRoute: string;\n  envPrefixes: readonly string[];\n  localRedirectPatterns: readonly string[];\n}\n\nexport function generateSupabaseOAuthRuntimeArtifacts(\n  manifest: InfraManifestInput,\n): MinikubeAdapterArtifacts {\n  const oauthRuntime = resolveOAuthRuntimeModel(manifest);\n  if (!oauthRuntime) {\n    return {\n      files: [],\n      resources: [],\n      providerLifecycle: [],\n      envEntries: [],\n      warnings: [],\n    };\n  }\n\n  return {\n    files: [\n      {\n        path: 'infra/minikube/auth/oauth-runtime.md',\n        content: getOAuthRuntimeGuide(oauthRuntime),\n      },\n    ],\n    resources: [],\n    providerLifecycle: [getOAuthProviderLifecycle(oauthRuntime)],\n    envEntries: [],\n    warnings: [],\n  };\n}\n\nfunction resolveOAuthRuntimeModel(manifest: InfraManifestInput): SupabaseOAuthRuntimeModel | null {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return null;\n\n  const providers = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (providers.length === 0) return null;\n\n  const callbackRoute = normalizeAuthCallbackRoute(oauth.callbackRoute);\n  const envPrefixes = providers.map((provider) => {\n    const prefix = provider.id\n      .trim()\n      .toUpperCase()\n      .replace(/[^A-Z0-9]+/gu, '_')\n      .replace(/^_+|_+$/gu, '');\n    if (!prefix) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" cannot be mapped to GoTrue environment keys.`,\n      );\n    }\n    return prefix;\n  });\n\n  return {\n    callbackRoute,\n    envPrefixes,\n    localRedirectPatterns: getLocalAuthRedirectPatterns(callbackRoute),\n  };\n}\n\nfunction getOAuthProviderLifecycle(\n  oauthRuntime: SupabaseOAuthRuntimeModel,\n): MinikubeProviderLifecycle {\n  return {\n    id: 'supabase-auth',\n    namespace: 'supabase',\n    endpoints: [],\n    readinessChecks: [\n      {\n        label: 'GoTrue',\n        namespace: 'supabase',\n        resource: 'deployment/auth',\n        timeoutSeconds: 600,\n      },\n    ],\n    migrationCommands: [],\n    reconciliationCommands: [\n      {\n        label: 'OAuth redirect and runtime rollout reconciliation',\n        command: getOAuthRuntimeReconciliationCommand(oauthRuntime),\n      },\n    ],\n    statusChecks: [\n      {\n        label: 'OAuth redirect configuration',\n        command: getOAuthRuntimeStatusCommand(oauthRuntime),\n      },\n    ],\n  };\n}\n\nfunction getOAuthRuntimeReconciliationCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns.join(',');\n  const providerExports = oauthRuntime.envPrefixes\n    .map(\n      (prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI=\"\\${oauth_provider_callback}\"\nwrite_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI \"\\${oauth_provider_callback}\"`,\n    )\n    .join('\\n');\n\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\noauth_site_url=\"\\${SITE_URL%/}\"\noauth_provider_callback=\"\\${API_EXTERNAL_URL%/}/callback\"\noauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path},${localPatterns}\"\nif [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n  oauth_redirect_allow_list=\"\\${oauth_redirect_allow_list},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\nfi\nexport ADDITIONAL_REDIRECT_URLS=\"\\${oauth_redirect_allow_list}\"\nwrite_env_value ADDITIONAL_REDIRECT_URLS \"\\${oauth_redirect_allow_list}\"\n${providerExports}\nsync_supabase_secrets\nkubectl --context \"\\${PROFILE}\" -n supabase rollout restart deployment/auth >/dev/null\nkubectl --context \"\\${PROFILE}\" -n supabase rollout status deployment/auth --timeout=600s`;\n}\n\nfunction getOAuthRuntimeStatusCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\nif [[ -n \"\\${API_EXTERNAL_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/provider-callback: \\${API_EXTERNAL_URL%/}/callback\"\nelse\n  echo \"- provider supabase-auth/provider-callback: unavailable\"\nfi\nif [[ -n \"\\${SITE_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/app-callback: \\${SITE_URL%/}/\\${oauth_callback_path}\"\nelse\n  echo \"- provider supabase-auth/app-callback: unavailable\"\nfi\necho \"- provider supabase-auth/local-callback-patterns: ${oauthRuntime.localRedirectPatterns.join(',')}\"`;\n}\n\nfunction getOAuthRuntimeGuide(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns\n    .map((pattern) => `- \\`${pattern}\\``)\n    .join('\\n');\n\n  return `# Supabase OAuth Runtime Reconciliation\n\nThe provider callback is derived from the active project gateway as\n\\`\\${API_EXTERNAL_URL%/}/callback\\`, which resolves to the project-owned\n\\`/auth/v1/callback\\` endpoint. GoTrue-to-app redirects use the configured callback route\n\\`${oauthRuntime.callbackRoute}\\`.\n\nLocal Minikube reconciliation adds only callback-scoped loopback patterns:\n\n${localPatterns}\n\nNative callback URIs may be supplied through \\`OAUTH_NATIVE_REDIRECT_URLS\\`. The generated\nprovider lifecycle persists redirect metadata, re-syncs the canonical Supabase runtime\nConfigMap and Secret sources, then forces \\`deployment/auth\\` to restart and waits up to 600\nseconds for the rollout. OAuth credential values remain sourced from trusted secret resolution\nand are never embedded in generated files. A failed rollout stops Infra Up before its success\nmessage.\n`;\n}\n"]}

package/dist/project.js

@@ -52,7 +52,7 @@ function createFallbackManifest(projectId) {
         themes: [],
         activeThemeId: 'default',
         infra: {
-            plugins: [],
+            modules: [],
         },
         navigator: {
             type: 'stack',
@@ -142,7 +142,7 @@ function isAppManifestMetadata(value) {
         (value.updated === undefined || typeof value.updated === 'string'));
 }
 function isInfraManifestRecord(value) {
-    return isRecord(value) && Array.isArray(value.plugins);
+    return isRecord(value) && Array.isArray(value.modules);
 }
 function isNavigatorSpec(value) {
     return (isRecord(value) &&

package/dist/project.js.map

@@ -1 +1 @@
-{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAwC,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAWxB,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAGzC;IACC,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC;QACvC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,YAAY,SAAS,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QACzC,YAAY;QACZ,SAAS;QACT,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,WAAW;QACX,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,SAAiB;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE5D,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,OAAO;QACL,QAAQ,EAAE;YACR,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,SAAS;SACnB;QACD,MAAM,EAAE,EAAE;QACV,aAAa,EAAE,SAAS;QACxB,KAAK,EAAE;YACL,OAAO,EAAE,EAAE;SACZ;QACD,SAAS,EAAE;YACT,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SAC/C;QACD,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE;YACR,YAAY,EAAE;gBACZ,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,CAAC,IAAI,CAAC;aAChB;SACF;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAIlC;IACC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAEjE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,YAAY,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,EACrF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,IAAI,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAE1C,SAAS,CAAC;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,WAAW,GAAG,UAAU,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,QAAgB;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB;IAClD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,IACE,SAAS,KAAK,GAAG;QACjB,SAAS,KAAK,IAAI;QAClB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1B,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EACxB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,2CAA2C,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACrC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC;QAChC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACvB,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;QAC9D,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC;QAClE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC;QACxE,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import { APP_CATEGORIES, type AppManifest, type NavigatorSpec } from '@ankhorage/contracts';\nimport { promises as fs } from 'fs';\nimport path from 'path';\n\nexport interface ResolvedInfraProject {\n  readonly appsRoot: string;\n  readonly manifest: AppManifest;\n  readonly manifestPath: string;\n  readonly projectId: string;\n  readonly projectPath: string;\n  readonly workspaceRoot: string;\n}\n\nexport async function resolveInfraProject(options: {\n  readonly cwd: string;\n  readonly projectId?: string;\n}): Promise<ResolvedInfraProject> {\n  const workspaceRoot = await findWorkspaceRoot(options.cwd);\n  if (workspaceRoot === null) {\n    throw new Error(`Could not find an Ankh workspace root from cwd: ${options.cwd}`);\n  }\n\n  const appsRoot = path.join(workspaceRoot, 'apps');\n  const projectId =\n    options.projectId === undefined\n      ? inferProjectId(options.cwd, appsRoot)\n      : validateExplicitProjectId(options.projectId);\n  if (projectId === null) {\n    throw new Error(\n      'Could not infer a project from cwd. Pass a project id or run the command inside apps/<project>.',\n    );\n  }\n\n  const projectPath = resolveProjectPath(appsRoot, projectId);\n  if (!(await pathExists(projectPath))) {\n    throw new Error(`Project '${projectId}' not found.`);\n  }\n\n  const manifestPath = path.join(projectPath, 'ankh.config.json');\n  const manifest = await readProjectManifest({\n    manifestPath,\n    projectId,\n    projectPath,\n  });\n\n  return {\n    appsRoot,\n    manifest,\n    manifestPath,\n    projectId,\n    projectPath,\n    workspaceRoot,\n  };\n}\n\nfunction resolveProjectPath(appsRoot: string, projectId: string): string {\n  const projectPath = path.resolve(appsRoot, projectId);\n  const appsRootPath = `${path.resolve(appsRoot)}${path.sep}`;\n\n  if (!projectPath.startsWith(appsRootPath)) {\n    throw new Error('Security check failed while resolving the project path.');\n  }\n\n  return projectPath;\n}\n\nfunction createFallbackManifest(projectId: string): AppManifest {\n  return {\n    metadata: {\n      name: projectId,\n      slug: projectId,\n      version: '0.0.0',\n      category: 'developer_tools',\n      themeId: 'default',\n    },\n    themes: [],\n    activeThemeId: 'default',\n    infra: {\n      plugins: [],\n    },\n    navigator: {\n      type: 'stack',\n      routes: [{ name: 'index', screenId: 'index' }],\n    },\n    screens: {},\n    settings: {\n      localization: {\n        defaultLocale: 'en',\n        locales: ['en'],\n      },\n    },\n  };\n}\n\nasync function readProjectManifest(args: {\n  readonly manifestPath: string;\n  readonly projectId: string;\n  readonly projectPath: string;\n}): Promise<AppManifest> {\n  if (!(await pathExists(args.manifestPath))) {\n    return createFallbackManifest(args.projectId);\n  }\n\n  const rawManifest = await fs.readFile(args.manifestPath, 'utf8');\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(rawManifest);\n  } catch (error) {\n    throw new Error(\n      `Project manifest is not valid JSON: ${args.manifestPath}: ${getErrorMessage(error)}`,\n      { cause: error },\n    );\n  }\n\n  if (!isAppManifest(parsed)) {\n    throw new Error(`Project manifest has an invalid shape: ${args.manifestPath}`);\n  }\n\n  return parsed;\n}\n\nasync function findWorkspaceRoot(startPath: string): Promise<string | null> {\n  let currentPath = path.resolve(startPath);\n\n  for (;;) {\n    const appsRoot = path.join(currentPath, 'apps');\n    if (await isDirectory(appsRoot)) {\n      return currentPath;\n    }\n\n    const parentPath = path.dirname(currentPath);\n    if (parentPath === currentPath) {\n      return null;\n    }\n\n    currentPath = parentPath;\n  }\n}\n\nfunction inferProjectId(cwd: string, appsRoot: string): string | null {\n  const relativePath = path.relative(path.resolve(appsRoot), path.resolve(cwd));\n  if (relativePath === '' || relativePath.startsWith('..') || path.isAbsolute(relativePath)) {\n    return null;\n  }\n\n  const [projectId] = relativePath.split(path.sep);\n  return projectId === undefined || projectId.length === 0 ? null : path.basename(projectId);\n}\n\nfunction validateExplicitProjectId(projectId: string): string {\n  if (projectId.trim().length === 0) {\n    throw new Error('Invalid project id: expected a single safe project segment.');\n  }\n\n  if (\n    projectId === '.' ||\n    projectId === '..' ||\n    path.isAbsolute(projectId) ||\n    projectId.includes('/') ||\n    projectId.includes('\\\\')\n  ) {\n    throw new Error(`Invalid project id: ${projectId}. Expected a single safe project segment.`);\n  }\n\n  return projectId;\n}\n\nfunction isAppManifest(value: unknown): value is AppManifest {\n  if (!isRecord(value)) {\n    return false;\n  }\n\n  return (\n    isAppManifestMetadata(value.metadata) &&\n    Array.isArray(value.themes) &&\n    typeof value.activeThemeId === 'string' &&\n    isInfraManifestRecord(value.infra) &&\n    isNavigatorSpec(value.navigator) &&\n    isRecord(value.screens) &&\n    isSettingsRecord(value.settings)\n  );\n}\n\nfunction isAppManifestMetadata(value: unknown): value is AppManifest['metadata'] {\n  return (\n    isRecord(value) &&\n    typeof value.name === 'string' &&\n    typeof value.slug === 'string' &&\n    typeof value.version === 'string' &&\n    APP_CATEGORIES.some((category) => category === value.category) &&\n    typeof value.themeId === 'string' &&\n    (value.created === undefined || typeof value.created === 'string') &&\n    (value.updated === undefined || typeof value.updated === 'string')\n  );\n}\n\nfunction isInfraManifestRecord(value: unknown): value is AppManifest['infra'] {\n  return isRecord(value) && Array.isArray(value.plugins);\n}\n\nfunction isNavigatorSpec(value: unknown): value is NavigatorSpec {\n  return (\n    isRecord(value) &&\n    typeof value.type === 'string' &&\n    Array.isArray(value.routes) &&\n    (value.initialRouteName === undefined || typeof value.initialRouteName === 'string')\n  );\n}\n\nfunction isSettingsRecord(value: unknown): value is AppManifest['settings'] {\n  return (\n    isRecord(value) &&\n    (value.apiBaseUrl === undefined || typeof value.apiBaseUrl === 'string') &&\n    isLocalizationRecord(value.localization)\n  );\n}\n\nfunction isLocalizationRecord(value: unknown): value is AppManifest['settings']['localization'] {\n  return (\n    isRecord(value) &&\n    typeof value.defaultLocale === 'string' &&\n    Array.isArray(value.locales) &&\n    value.locales.every((locale) => typeof locale === 'string')\n  );\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\nasync function isDirectory(filePath: string): Promise<boolean> {\n  try {\n    const stat = await fs.stat(filePath);\n    return stat.isDirectory();\n  } catch {\n    return false;\n  }\n}\n\nasync function pathExists(filePath: string): Promise<boolean> {\n  try {\n    await fs.access(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction getErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n"]}
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAwC,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAWxB,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAGzC;IACC,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC;QACvC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,YAAY,SAAS,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QACzC,YAAY;QACZ,SAAS;QACT,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,WAAW;QACX,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,SAAiB;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE5D,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,OAAO;QACL,QAAQ,EAAE;YACR,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,SAAS;SACnB;QACD,MAAM,EAAE,EAAE;QACV,aAAa,EAAE,SAAS;QACxB,KAAK,EAAE;YACL,OAAO,EAAE,EAAE;SACZ;QACD,SAAS,EAAE;YACT,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SAC/C;QACD,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE;YACR,YAAY,EAAE;gBACZ,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,CAAC,IAAI,CAAC;aAChB;SACF;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAIlC;IACC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAEjE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,YAAY,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,EACrF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,IAAI,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAE1C,SAAS,CAAC;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,WAAW,GAAG,UAAU,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,QAAgB;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB;IAClD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,IACE,SAAS,KAAK,GAAG;QACjB,SAAS,KAAK,IAAI;QAClB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1B,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EACxB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,2CAA2C,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACrC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC;QAChC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACvB,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;QAC9D,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC;QAClE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC;QACxE,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import { APP_CATEGORIES, type AppManifest, type NavigatorSpec } from '@ankhorage/contracts';\nimport { promises as fs } from 'fs';\nimport path from 'path';\n\nexport interface ResolvedInfraProject {\n  readonly appsRoot: string;\n  readonly manifest: AppManifest;\n  readonly manifestPath: string;\n  readonly projectId: string;\n  readonly projectPath: string;\n  readonly workspaceRoot: string;\n}\n\nexport async function resolveInfraProject(options: {\n  readonly cwd: string;\n  readonly projectId?: string;\n}): Promise<ResolvedInfraProject> {\n  const workspaceRoot = await findWorkspaceRoot(options.cwd);\n  if (workspaceRoot === null) {\n    throw new Error(`Could not find an Ankh workspace root from cwd: ${options.cwd}`);\n  }\n\n  const appsRoot = path.join(workspaceRoot, 'apps');\n  const projectId =\n    options.projectId === undefined\n      ? inferProjectId(options.cwd, appsRoot)\n      : validateExplicitProjectId(options.projectId);\n  if (projectId === null) {\n    throw new Error(\n      'Could not infer a project from cwd. Pass a project id or run the command inside apps/<project>.',\n    );\n  }\n\n  const projectPath = resolveProjectPath(appsRoot, projectId);\n  if (!(await pathExists(projectPath))) {\n    throw new Error(`Project '${projectId}' not found.`);\n  }\n\n  const manifestPath = path.join(projectPath, 'ankh.config.json');\n  const manifest = await readProjectManifest({\n    manifestPath,\n    projectId,\n    projectPath,\n  });\n\n  return {\n    appsRoot,\n    manifest,\n    manifestPath,\n    projectId,\n    projectPath,\n    workspaceRoot,\n  };\n}\n\nfunction resolveProjectPath(appsRoot: string, projectId: string): string {\n  const projectPath = path.resolve(appsRoot, projectId);\n  const appsRootPath = `${path.resolve(appsRoot)}${path.sep}`;\n\n  if (!projectPath.startsWith(appsRootPath)) {\n    throw new Error('Security check failed while resolving the project path.');\n  }\n\n  return projectPath;\n}\n\nfunction createFallbackManifest(projectId: string): AppManifest {\n  return {\n    metadata: {\n      name: projectId,\n      slug: projectId,\n      version: '0.0.0',\n      category: 'developer_tools',\n      themeId: 'default',\n    },\n    themes: [],\n    activeThemeId: 'default',\n    infra: {\n      modules: [],\n    },\n    navigator: {\n      type: 'stack',\n      routes: [{ name: 'index', screenId: 'index' }],\n    },\n    screens: {},\n    settings: {\n      localization: {\n        defaultLocale: 'en',\n        locales: ['en'],\n      },\n    },\n  };\n}\n\nasync function readProjectManifest(args: {\n  readonly manifestPath: string;\n  readonly projectId: string;\n  readonly projectPath: string;\n}): Promise<AppManifest> {\n  if (!(await pathExists(args.manifestPath))) {\n    return createFallbackManifest(args.projectId);\n  }\n\n  const rawManifest = await fs.readFile(args.manifestPath, 'utf8');\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(rawManifest);\n  } catch (error) {\n    throw new Error(\n      `Project manifest is not valid JSON: ${args.manifestPath}: ${getErrorMessage(error)}`,\n      { cause: error },\n    );\n  }\n\n  if (!isAppManifest(parsed)) {\n    throw new Error(`Project manifest has an invalid shape: ${args.manifestPath}`);\n  }\n\n  return parsed;\n}\n\nasync function findWorkspaceRoot(startPath: string): Promise<string | null> {\n  let currentPath = path.resolve(startPath);\n\n  for (;;) {\n    const appsRoot = path.join(currentPath, 'apps');\n    if (await isDirectory(appsRoot)) {\n      return currentPath;\n    }\n\n    const parentPath = path.dirname(currentPath);\n    if (parentPath === currentPath) {\n      return null;\n    }\n\n    currentPath = parentPath;\n  }\n}\n\nfunction inferProjectId(cwd: string, appsRoot: string): string | null {\n  const relativePath = path.relative(path.resolve(appsRoot), path.resolve(cwd));\n  if (relativePath === '' || relativePath.startsWith('..') || path.isAbsolute(relativePath)) {\n    return null;\n  }\n\n  const [projectId] = relativePath.split(path.sep);\n  return projectId === undefined || projectId.length === 0 ? null : path.basename(projectId);\n}\n\nfunction validateExplicitProjectId(projectId: string): string {\n  if (projectId.trim().length === 0) {\n    throw new Error('Invalid project id: expected a single safe project segment.');\n  }\n\n  if (\n    projectId === '.' ||\n    projectId === '..' ||\n    path.isAbsolute(projectId) ||\n    projectId.includes('/') ||\n    projectId.includes('\\\\')\n  ) {\n    throw new Error(`Invalid project id: ${projectId}. Expected a single safe project segment.`);\n  }\n\n  return projectId;\n}\n\nfunction isAppManifest(value: unknown): value is AppManifest {\n  if (!isRecord(value)) {\n    return false;\n  }\n\n  return (\n    isAppManifestMetadata(value.metadata) &&\n    Array.isArray(value.themes) &&\n    typeof value.activeThemeId === 'string' &&\n    isInfraManifestRecord(value.infra) &&\n    isNavigatorSpec(value.navigator) &&\n    isRecord(value.screens) &&\n    isSettingsRecord(value.settings)\n  );\n}\n\nfunction isAppManifestMetadata(value: unknown): value is AppManifest['metadata'] {\n  return (\n    isRecord(value) &&\n    typeof value.name === 'string' &&\n    typeof value.slug === 'string' &&\n    typeof value.version === 'string' &&\n    APP_CATEGORIES.some((category) => category === value.category) &&\n    typeof value.themeId === 'string' &&\n    (value.created === undefined || typeof value.created === 'string') &&\n    (value.updated === undefined || typeof value.updated === 'string')\n  );\n}\n\nfunction isInfraManifestRecord(value: unknown): value is AppManifest['infra'] {\n  return isRecord(value) && Array.isArray(value.modules);\n}\n\nfunction isNavigatorSpec(value: unknown): value is NavigatorSpec {\n  return (\n    isRecord(value) &&\n    typeof value.type === 'string' &&\n    Array.isArray(value.routes) &&\n    (value.initialRouteName === undefined || typeof value.initialRouteName === 'string')\n  );\n}\n\nfunction isSettingsRecord(value: unknown): value is AppManifest['settings'] {\n  return (\n    isRecord(value) &&\n    (value.apiBaseUrl === undefined || typeof value.apiBaseUrl === 'string') &&\n    isLocalizationRecord(value.localization)\n  );\n}\n\nfunction isLocalizationRecord(value: unknown): value is AppManifest['settings']['localization'] {\n  return (\n    isRecord(value) &&\n    typeof value.defaultLocale === 'string' &&\n    Array.isArray(value.locales) &&\n    value.locales.every((locale) => typeof locale === 'string')\n  );\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\nasync function isDirectory(filePath: string): Promise<boolean> {\n  try {\n    const stat = await fs.stat(filePath);\n    return stat.isDirectory();\n  } catch {\n    return false;\n  }\n}\n\nasync function pathExists(filePath: string): Promise<boolean> {\n  try {\n    await fs.access(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction getErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n"]}

package/dist/testSupport.js

@@ -40,7 +40,7 @@ export async function createWorkspaceFixture(args = {}) {
         rootPath,
     };
 }
-export function createAppManifest(projectId, infra = { plugins: [] }) {
+export function createAppManifest(projectId, infra = { modules: [] }) {
     return {
         metadata: {
             name: projectId,

package/dist/testSupport.js.map

@@ -1 +1 @@
-{"version":3,"file":"testSupport.js","sourceRoot":"","sources":["../src/testSupport.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAUxB,MAAM,UAAU,4BAA4B,CAC1C,GAAW,EACX,OAAO,GAAG,OAAO;IAEjB,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM;QACN,MAAM;QACN,OAAO,EAAE;YACP,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO;YACP,WAAW,CAAC,IAAY;gBACtB,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;YACvB,CAAC;YACD,WAAW,CAAC,IAAY;gBACtB,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;YACvB,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAII,EAAE;IAON,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEnD,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9D,MAAM,CACP,CAAC;IAEF,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QACzC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAC1C,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAC7E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,SAAS;QACT,WAAW;QACX,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,QAA8B,EAAE,OAAO,EAAE,EAAE,EAAE;IAE7C,OAAO;QACL,QAAQ,EAAE;YACR,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,SAAS;SACnB;QACD,MAAM,EAAE,EAAE;QACV,aAAa,EAAE,SAAS;QACxB,KAAK;QACL,SAAS,EAAE;YACT,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SAC/C;QACD,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE;YACR,YAAY,EAAE;gBACZ,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,CAAC,IAAI,CAAC;aAChB;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AppManifest } from '@ankhorage/contracts';\nimport { promises as fs } from 'fs';\nimport os from 'os';\nimport path from 'path';\n\nimport type { InfraCommandContext } from './commandContext.js';\n\nexport interface CapturedCommandContext {\n  readonly context: InfraCommandContext;\n  readonly stderr: { value: string };\n  readonly stdout: { value: string };\n}\n\nexport function createCapturedCommandContext(\n  cwd: string,\n  version = '0.2.1',\n): CapturedCommandContext {\n  const stdout = { value: '' };\n  const stderr = { value: '' };\n\n  return {\n    stdout,\n    stderr,\n    context: {\n      cwd,\n      env: process.env,\n      version,\n      writeStdout(text: string) {\n        stdout.value += text;\n      },\n      writeStderr(text: string) {\n        stderr.value += text;\n      },\n    },\n  };\n}\n\nexport async function createWorkspaceFixture(\n  args: {\n    readonly manifest?: AppManifest;\n    readonly manifestFile?: 'invalid-json' | 'missing';\n    readonly projectId?: string;\n  } = {},\n): Promise<{\n  readonly appsRoot: string;\n  readonly projectId: string;\n  readonly projectPath: string;\n  readonly rootPath: string;\n}> {\n  const rootPath = await fs.mkdtemp(path.join(os.tmpdir(), 'ankhorage-infra-'));\n  const appsRoot = path.join(rootPath, 'apps');\n  const projectId = args.projectId ?? 'shop';\n  const projectPath = path.join(appsRoot, projectId);\n\n  await fs.mkdir(projectPath, { recursive: true });\n  await fs.writeFile(\n    path.join(projectPath, 'package.json'),\n    JSON.stringify({ name: projectId, version: '1.0.0' }, null, 2),\n    'utf8',\n  );\n\n  if (args.manifestFile === 'invalid-json') {\n    await fs.writeFile(path.join(projectPath, 'ankh.config.json'), '{invalid', 'utf8');\n  } else if (args.manifestFile !== 'missing') {\n    await fs.writeFile(\n      path.join(projectPath, 'ankh.config.json'),\n      `${JSON.stringify(args.manifest ?? createAppManifest(projectId), null, 2)}\\n`,\n      'utf8',\n    );\n  }\n\n  return {\n    appsRoot,\n    projectId,\n    projectPath,\n    rootPath,\n  };\n}\n\nexport function createAppManifest(\n  projectId: string,\n  infra: AppManifest['infra'] = { plugins: [] },\n): AppManifest {\n  return {\n    metadata: {\n      name: projectId,\n      slug: projectId,\n      version: '1.0.0',\n      category: 'developer_tools',\n      themeId: 'default',\n    },\n    themes: [],\n    activeThemeId: 'default',\n    infra,\n    navigator: {\n      type: 'stack',\n      routes: [{ name: 'index', screenId: 'index' }],\n    },\n    screens: {},\n    settings: {\n      localization: {\n        defaultLocale: 'en',\n        locales: ['en'],\n      },\n    },\n  };\n}\n"]}
+{"version":3,"file":"testSupport.js","sourceRoot":"","sources":["../src/testSupport.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAUxB,MAAM,UAAU,4BAA4B,CAC1C,GAAW,EACX,OAAO,GAAG,OAAO;IAEjB,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM;QACN,MAAM;QACN,OAAO,EAAE;YACP,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO;YACP,WAAW,CAAC,IAAY;gBACtB,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;YACvB,CAAC;YACD,WAAW,CAAC,IAAY;gBACtB,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;YACvB,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAII,EAAE;IAON,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEnD,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9D,MAAM,CACP,CAAC;IAEF,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QACzC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAC1C,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAC7E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,SAAS;QACT,WAAW;QACX,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,QAA8B,EAAE,OAAO,EAAE,EAAE,EAAE;IAE7C,OAAO;QACL,QAAQ,EAAE;YACR,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,SAAS;SACnB;QACD,MAAM,EAAE,EAAE;QACV,aAAa,EAAE,SAAS;QACxB,KAAK;QACL,SAAS,EAAE;YACT,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SAC/C;QACD,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE;YACR,YAAY,EAAE;gBACZ,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,CAAC,IAAI,CAAC;aAChB;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AppManifest } from '@ankhorage/contracts';\nimport { promises as fs } from 'fs';\nimport os from 'os';\nimport path from 'path';\n\nimport type { InfraCommandContext } from './commandContext.js';\n\nexport interface CapturedCommandContext {\n  readonly context: InfraCommandContext;\n  readonly stderr: { value: string };\n  readonly stdout: { value: string };\n}\n\nexport function createCapturedCommandContext(\n  cwd: string,\n  version = '0.2.1',\n): CapturedCommandContext {\n  const stdout = { value: '' };\n  const stderr = { value: '' };\n\n  return {\n    stdout,\n    stderr,\n    context: {\n      cwd,\n      env: process.env,\n      version,\n      writeStdout(text: string) {\n        stdout.value += text;\n      },\n      writeStderr(text: string) {\n        stderr.value += text;\n      },\n    },\n  };\n}\n\nexport async function createWorkspaceFixture(\n  args: {\n    readonly manifest?: AppManifest;\n    readonly manifestFile?: 'invalid-json' | 'missing';\n    readonly projectId?: string;\n  } = {},\n): Promise<{\n  readonly appsRoot: string;\n  readonly projectId: string;\n  readonly projectPath: string;\n  readonly rootPath: string;\n}> {\n  const rootPath = await fs.mkdtemp(path.join(os.tmpdir(), 'ankhorage-infra-'));\n  const appsRoot = path.join(rootPath, 'apps');\n  const projectId = args.projectId ?? 'shop';\n  const projectPath = path.join(appsRoot, projectId);\n\n  await fs.mkdir(projectPath, { recursive: true });\n  await fs.writeFile(\n    path.join(projectPath, 'package.json'),\n    JSON.stringify({ name: projectId, version: '1.0.0' }, null, 2),\n    'utf8',\n  );\n\n  if (args.manifestFile === 'invalid-json') {\n    await fs.writeFile(path.join(projectPath, 'ankh.config.json'), '{invalid', 'utf8');\n  } else if (args.manifestFile !== 'missing') {\n    await fs.writeFile(\n      path.join(projectPath, 'ankh.config.json'),\n      `${JSON.stringify(args.manifest ?? createAppManifest(projectId), null, 2)}\\n`,\n      'utf8',\n    );\n  }\n\n  return {\n    appsRoot,\n    projectId,\n    projectPath,\n    rootPath,\n  };\n}\n\nexport function createAppManifest(\n  projectId: string,\n  infra: AppManifest['infra'] = { modules: [] },\n): AppManifest {\n  return {\n    metadata: {\n      name: projectId,\n      slug: projectId,\n      version: '1.0.0',\n      category: 'developer_tools',\n      themeId: 'default',\n    },\n    themes: [],\n    activeThemeId: 'default',\n    infra,\n    navigator: {\n      type: 'stack',\n      routes: [{ name: 'index', screenId: 'index' }],\n    },\n    screens: {},\n    settings: {\n      localization: {\n        defaultLocale: 'en',\n        locales: ['en'],\n      },\n    },\n  };\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -35,7 +35,7 @@
     "openapi"
   ],
   "dependencies": {
-    "@ankhorage/contracts": "^4.0.2",
+    "@ankhorage/contracts": "^6.0.0",
     "@ankhorage/supabase-vault": "^0.2.4"
   },
   "files": [

package/src/adapters/minikube/auth/oauthRuntime.ts

@@ -98,9 +98,6 @@ function getOAuthProviderLifecycle(
 
 function getOAuthRuntimeReconciliationCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {
   const localPatterns = oauthRuntime.localRedirectPatterns.join(',');
-  const providerRedirectAssignments = oauthRuntime.envPrefixes
-    .map((prefix) => `GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"`)
-    .join(' ');
   const providerExports = oauthRuntime.envPrefixes
     .map(
       (prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"
@@ -119,12 +116,7 @@ fi
 export ADDITIONAL_REDIRECT_URLS="\${oauth_redirect_allow_list}"
 write_env_value ADDITIONAL_REDIRECT_URLS "\${oauth_redirect_allow_list}"
 ${providerExports}
-kubectl --context "\${PROFILE}" -n supabase set env deployment/auth \\
-  API_EXTERNAL_URL="\${API_EXTERNAL_URL}" \\
-  GOTRUE_SITE_URL="\${SITE_URL}" \\
-  GOTRUE_URI_ALLOW_LIST="\${oauth_redirect_allow_list}" \\
-  GOTRUE_JWT_ISSUER="\${API_EXTERNAL_URL}" \\
-  ${providerRedirectAssignments} >/dev/null
+sync_supabase_secrets
 kubectl --context "\${PROFILE}" -n supabase rollout restart deployment/auth >/dev/null
 kubectl --context "\${PROFILE}" -n supabase rollout status deployment/auth --timeout=600s`;
 }
@@ -162,8 +154,10 @@ Local Minikube reconciliation adds only callback-scoped loopback patterns:
 ${localPatterns}
 
 Native callback URIs may be supplied through \`OAUTH_NATIVE_REDIRECT_URLS\`. The generated
-provider lifecycle writes only redirect metadata, never OAuth client secrets. It updates the
-GoTrue deployment environment, forces \`deployment/auth\` to restart, and waits up to 600
-seconds for the rollout. A failed rollout stops Infra Up before its success message.
+provider lifecycle persists redirect metadata, re-syncs the canonical Supabase runtime
+ConfigMap and Secret sources, then forces \`deployment/auth\` to restart and waits up to 600
+seconds for the rollout. OAuth credential values remain sourced from trusted secret resolution
+and are never embedded in generated files. A failed rollout stops Infra Up before its success
+message.
 `;
 }

package/src/adapters/minikube/auth/supabase/index.test.ts

@@ -222,6 +222,6 @@ function createManifest(auth: Pick<NonNullable<InfraManifest['auth']>, 'profile'
       provider: 'supabase',
       tier: 'dev',
     },
-    plugins: [],
+    modules: [],
   };
 }

package/src/adapters/minikube/auth/supabase/oauthRuntime.test.ts

@@ -12,6 +12,7 @@ describe('Supabase OAuth runtime reconciliation', () => {
     const command = lifecycle?.reconciliationCommands[0]?.command ?? '';
     const statusCommand = lifecycle?.statusChecks[0]?.command ?? '';
     const guide = getFile(artifacts.files, 'infra/minikube/auth/oauth-runtime.md');
+    const normalizedGuide = guide.replace(/\s+/gu, ' ');
 
     expect(lifecycle?.id).toBe('supabase-auth');
     expect(lifecycle?.namespace).toBe('supabase');
@@ -28,10 +29,11 @@ describe('Supabase OAuth runtime reconciliation', () => {
     expect(command).toContain('http://localhost:*/auth/callback');
     expect(command).toContain('OAUTH_NATIVE_REDIRECT_URLS');
     expect(command).toContain('GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI="${oauth_provider_callback}"');
-    expect(command).toContain('GOTRUE_URI_ALLOW_LIST="${oauth_redirect_allow_list}"');
+    expect(command).toContain('sync_supabase_secrets');
+    expect(command).not.toContain('set env deployment/auth');
     expect(command).toContain('rollout restart deployment/auth');
     expect(command).toContain('rollout status deployment/auth --timeout=600s');
-    expect(command.indexOf('set env deployment/auth')).toBeLessThan(
+    expect(command.indexOf('sync_supabase_secrets')).toBeLessThan(
       command.indexOf('rollout restart deployment/auth'),
     );
     expect(command.indexOf('rollout restart deployment/auth')).toBeLessThan(
@@ -41,15 +43,19 @@ describe('Supabase OAuth runtime reconciliation', () => {
     expect(command).not.toContain('GOTRUE_EXTERNAL_GOOGLE_SECRET=');
     expect(statusCommand).toContain('provider supabase-auth/provider-callback');
     expect(statusCommand).toContain('provider supabase-auth/app-callback');
-    expect(guide).toContain('Supabase OAuth Runtime Reconciliation');
-    expect(guide).toContain('A failed rollout stops Infra Up before its success message.');
+    expect(normalizedGuide).toContain('Supabase OAuth Runtime Reconciliation');
+    expect(normalizedGuide).toContain('re-syncs the canonical Supabase runtime');
+    expect(normalizedGuide).toContain(
+      'A failed rollout stops Infra Up before its success message.',
+    );
   });
 
-  test('integrates reconciliation after generated runtime resources without duplicate namespaces', () => {
+  test('keeps Auth deployment environment declarative across reconciliation', () => {
     const result = generateInfrastructure(createOAuthManifest(), {
       appManifest: createAppManifest('oauth-app'),
     });
     const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
+    const authManifest = getFile(result.files, 'infra/minikube/k8s/supabase/auth.yaml');
     const kustomization = getFile(result.files, 'infra/minikube/k8s/kustomization.yaml');
     const statusScript = getFile(result.files, 'infra/minikube/scripts/status.sh');
 
@@ -57,15 +63,20 @@ describe('Supabase OAuth runtime reconciliation', () => {
     expect(upScript).toContain(
       'Running provider supabase-auth OAuth redirect and runtime rollout reconciliation.',
     );
-    expect(upScript).toContain(
+    expect(upScript).not.toContain(
       'kubectl --context "${PROFILE}" -n supabase set env deployment/auth',
     );
+    expect(upScript).toContain('sync_supabase_secrets');
     expect(upScript).toContain(
       'kubectl --context "${PROFILE}" -n supabase rollout restart deployment/auth',
     );
     expect(upScript).toContain(
       'kubectl --context "${PROFILE}" -n supabase rollout status deployment/auth --timeout=600s',
     );
+    expect(authManifest).toContain('name: API_EXTERNAL_URL\n              valueFrom:');
+    expect(authManifest).toContain('name: GOTRUE_SITE_URL\n              valueFrom:');
+    expect(authManifest).toContain('name: GOTRUE_URI_ALLOW_LIST\n              valueFrom:');
+    expect(authManifest).toContain('name: GOTRUE_JWT_ISSUER\n              valueFrom:');
     expect(upScript.lastIndexOf('run_provider_reconciliation')).toBeLessThan(
       upScript.lastIndexOf('echo "Minikube infrastructure for \'${PROFILE}\' is running."'),
     );
@@ -126,7 +137,7 @@ function createOAuthManifest(): InfraManifest {
     secretStore: {
       provider: 'supabase-vault',
     },
-    plugins: [],
+    modules: [],
   };
 }
 

package/src/adapters/minikube/auth/supabase/profile.integration.test.ts

@@ -1023,6 +1023,6 @@ function createManifest(args: {
     networking: {
       cdn: false,
     },
-    plugins: [],
+    modules: [],
   };
 }

package/src/adapters/minikube/auth/supabase/providerAssignments.test.ts

@@ -21,7 +21,7 @@ test('keeps multiple provider redirect assignments as separate shell arguments',
     },
     database: { provider: 'supabase', tier: 'dev' },
     secretStore: { provider: 'supabase-vault' },
-    plugins: [],
+    modules: [],
   };
   const result = generateInfrastructure(manifest, {
     appManifest: createAppManifest('multi-oauth'),

package/src/adapters/minikube/base/appImageBuild.test.ts

@@ -33,7 +33,7 @@ test('re-exports rotated public environment values before building the app image
       {
         deployment: { target: 'minikube', monitoring: false },
         auth: { scope: 'global', provider: 'supabase' },
-        plugins: [],
+        modules: [],
       },
       { appManifest: createAppManifest(APP_SLUG) },
     );

package/src/adapters/minikube/base/index.test.ts

@@ -101,7 +101,7 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
           target: 'minikube',
           monitoring: false,
         },
-        plugins: [],
+        modules: [],
       },
       {
         appManifest: createAppManifest('frontend-only'),
@@ -508,7 +508,7 @@ function createSupabaseManifest(): InfraManifestInput {
       provider: 'supabase',
       buckets: ['assets'],
     },
-    plugins: [],
+    modules: [],
   };
 }
 

package/src/adapters/minikube/base/twoAppIsolation.integration.test.ts

@@ -140,7 +140,7 @@ function generateAppOnlyInfrastructure(slug: string) {
       target: 'minikube',
       monitoring: false,
     },
-    plugins: [],
+    modules: [],
   };
 
   return generateInfrastructure(manifest, {
@@ -280,7 +280,7 @@ function generateSupabaseInfrastructure(slug: string) {
     secretStore: {
       provider: 'supabase-vault',
     },
-    plugins: [],
+    modules: [],
   };
 
   return generateInfrastructure(manifest, {

package/src/adapters/minikube/secrets/index.test.ts

@@ -14,7 +14,7 @@ function createManifest(overrides: Partial<InfraManifestInput> = {}): InfraManif
     secretStore: {
       provider: 'supabase-vault',
     },
-    plugins: [],
+    modules: [],
     ...overrides,
   };
 }

package/src/commands.test.ts

@@ -66,7 +66,7 @@ describe('infra command table', () => {
               manifestPath: '/workspace/apps/shop/ankh.config.json',
               projectId: 'shop',
               projectPath: '/workspace/apps/shop',
-              manifest: createAppManifest('shop', { plugins: [] }),
+              manifest: createAppManifest('shop', { modules: [] }),
             });
           },
           validateInfraSupport() {
@@ -104,7 +104,7 @@ describe('infra command table', () => {
               manifestPath: '/workspace/apps/studio/ankh.config.json',
               projectId: 'studio',
               projectPath: '/workspace/apps/studio',
-              manifest: createAppManifest('studio', { plugins: [] }),
+              manifest: createAppManifest('studio', { modules: [] }),
             });
           },
           syncProjectInfrastructure() {
@@ -146,7 +146,7 @@ describe('infra command table', () => {
           projectPath: '/workspace/apps/shop',
           manifest: createAppManifest('shop', {
             deployment: { target: 'minikube', monitoring: false },
-            plugins: [],
+            modules: [],
           }),
         });
       },

package/src/generatedApiDatabase.test.ts

@@ -327,7 +327,7 @@ describe('generated API database bridge', () => {
     const infra: InfraManifestInput = {
       deployment: { target: 'minikube', monitoring: false },
       database: { provider: 'supabase', tier: 'dev' },
-      plugins: [],
+      modules: [],
     };
     const appManifest = {
       ...createAppManifest('catalog', infra),

package/src/index.test.ts

@@ -42,7 +42,7 @@ describe('generateInfrastructure', () => {
         domain: 'alpha.local',
         cdn: false,
       },
-      plugins: [],
+      modules: [],
     };
 
     const result = generateInfrastructure(manifest, { appManifest: createAppManifest('alpha') });
@@ -125,7 +125,7 @@ describe('generateInfrastructure', () => {
         provider: 'supabase',
         buckets: ['assets', ' assets ', '', 'assets', 'uploads'],
       },
-      plugins: [],
+      modules: [],
     };
 
     const result = generateInfrastructure(manifest, {
@@ -163,7 +163,7 @@ describe('generateInfrastructure', () => {
         provider: 'supabase',
         tier: 'dev',
       },
-      plugins: [],
+      modules: [],
     };
 
     const appManifest: Pick<AppManifest, 'metadata' | 'navigator' | 'screens' | 'settings'> = {
@@ -237,7 +237,7 @@ describe('generateInfrastructure', () => {
 
   test('throws for missing deployment', () => {
     const manifest: InfraManifestInput = {
-      plugins: [],
+      modules: [],
     };
 
     expect(() => generateInfrastructure(manifest)).toThrow('Deployment configuration is missing.');
@@ -249,7 +249,7 @@ describe('generateInfrastructure', () => {
         target: 'kubernetes',
         monitoring: false,
       },
-      plugins: [],
+      modules: [],
     };
 
     expect(() => generateInfrastructure(manifest)).toThrow(
@@ -267,7 +267,7 @@ describe('generateInfrastructure', () => {
         provider: 'supabase',
         tier: 'dev',
       },
-      plugins: [],
+      modules: [],
     };
 
     expect(() => generateInfrastructure(manifest, { namespaceHint: 'shop' })).toThrow(

package/src/minikubeImageLifecycle.test.ts

@@ -11,7 +11,7 @@ describe('minikube generated app image lifecycle', () => {
         target: 'minikube',
         monitoring: false,
       },
-      plugins: [],
+      modules: [],
     };
 
     const result = generateInfrastructure(manifest, { appManifest: createAppManifest('shop') });

package/src/project.test.ts

@@ -58,7 +58,7 @@ describe('resolveInfraProject', () => {
 
     expect(project.manifest.metadata.name).toBe('shop');
     expect(project.manifest.metadata.slug).toBe('shop');
-    expect(project.manifest.infra.plugins).toEqual([]);
+    expect(project.manifest.infra.modules).toEqual([]);
   });
 
   test('rejects malformed manifest JSON', async () => {
@@ -186,7 +186,7 @@ describe('resolveInfraProject', () => {
         monitoring: false,
         target: 'minikube',
       },
-      plugins: [],
+      modules: [],
     });
     const fixture = await createWorkspaceFixture({
       manifest,

package/src/project.ts

@@ -76,7 +76,7 @@ function createFallbackManifest(projectId: string): AppManifest {
     themes: [],
     activeThemeId: 'default',
     infra: {
-      plugins: [],
+      modules: [],
     },
     navigator: {
       type: 'stack',
@@ -196,7 +196,7 @@ function isAppManifestMetadata(value: unknown): value is AppManifest['metadata']
 }
 
 function isInfraManifestRecord(value: unknown): value is AppManifest['infra'] {
-  return isRecord(value) && Array.isArray(value.plugins);
+  return isRecord(value) && Array.isArray(value.modules);
 }
 
 function isNavigatorSpec(value: unknown): value is NavigatorSpec {

package/src/projectInfrastructure.test.ts

@@ -29,7 +29,7 @@ describe('project infrastructure sync', () => {
       projectPath,
       manifest: createAppManifest('shop', {
         deployment: { target: 'minikube', monitoring: false },
-        plugins: [],
+        modules: [],
       }),
       generateInfrastructureImpl() {
         return {
@@ -77,7 +77,7 @@ describe('project infrastructure sync', () => {
 
     const manifest = createAppManifest('shop', {
       deployment: { target: 'minikube', monitoring: false },
-      plugins: [],
+      modules: [],
     });
 
     await syncProjectInfrastructure({
@@ -141,7 +141,7 @@ describe('project infrastructure sync', () => {
     const result = await syncProjectInfrastructure({
       projectId: 'shop',
       projectPath,
-      manifest: createAppManifest('shop', { plugins: [] }),
+      manifest: createAppManifest('shop', { modules: [] }),
     });
 
     expect(result.generated).toBe(0);
@@ -158,7 +158,7 @@ describe('project infrastructure sync', () => {
       projectPath,
       manifest: createAppManifest('studio', {
         deployment: { target: 'minikube', monitoring: false },
-        plugins: [],
+        modules: [],
       }),
     });
 
@@ -183,7 +183,7 @@ describe('project infrastructure sync', () => {
     );
 
     const target = await resolveProjectInfrastructureTarget({
-      manifest: createAppManifest('shop', { plugins: [] }),
+      manifest: createAppManifest('shop', { modules: [] }),
       projectPath,
     });
 

package/src/testSupport.ts

@@ -79,7 +79,7 @@ export async function createWorkspaceFixture(
 
 export function createAppManifest(
   projectId: string,
-  infra: AppManifest['infra'] = { plugins: [] },
+  infra: AppManifest['infra'] = { modules: [] },
 ): AppManifest {
   return {
     metadata: {