@ankhorage/infra 3.1.1 → 3.3.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ankhorage/infra
 
+## 3.3.0
+
+### Minor Changes
+
+- 716f678: Derive Supabase OAuth redirect allowlists from canonical app deployment targets, using enabled Web state and stable Android/iOS schemes instead of a separate native redirect environment variable.
+
+## 3.2.0
+
+### Minor Changes
+
+- f4ffc4b: Expose canonical project inspection, filtered generated runtime-environment access, and trusted project database URL resolution through `@ankhorage/infra/project`.
+
 ## 3.1.1
 
 ### Patch Changes

package/README.md

@@ -3,17 +3,23 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v2.0.1](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v3.2.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 
 ## Usage
 
-### Provider and CLI surface
+### Provider, CLI, and project API surface
 
-`@ankhorage/infra` owns infra command behavior.
+`@ankhorage/infra` owns infrastructure generation, project reconciliation,
+and generated lifecycle execution.
 
-The same shared command implementation backs both:
+The same owner implementation backs CLI consumers and the public
+`@ankhorage/infra/project` application-service boundary. Trusted hosts such
+as Studio should call that subpath instead of reproducing ledger, generated
+file, lifecycle-script, or port-forward configuration semantics.
+
+CLI entrypoints:
 
 - `ankh infra ...`
 - `bunx @ankhorage/infra ...`
@@ -26,12 +32,10 @@ Current command surface:
 - `up`
 - `down`
 
-`status` runs the generated live runtime status script for a project.
-
-Project resolution is project-aware:
-
-- pass `[project]`, or
-- omit it when cwd is already inside `apps/<project>`
+Project resolution for the CLI is workspace-aware: pass `[project]`, or
+omit it when cwd is already inside `apps/<project>`. Programmatic project
+operations accept an explicit project path and do not require Studio or a
+particular workspace layout.
 
 Source: `src/readme-usage.ts`
 

package/dist/adapters/minikube/auth/index.d.ts

@@ -1,6 +1,7 @@
-import type { InfraManifestInput } from '../../../types';
+import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';
 import { type MinikubeAdapterArtifacts } from '../contracts';
 export declare function generateAuthProviderArtifacts(args: {
+    appManifest: InfrastructureGenerationOptions['appManifest'];
     manifest: InfraManifestInput;
     namespace: string;
 }): MinikubeAdapterArtifacts;

package/dist/adapters/minikube/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAIrF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CA2B3B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAIrF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,WAAW,EAAE,+BAA+B,CAAC,aAAa,CAAC,CAAC;IAC5D,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CA8B3B"}

package/dist/adapters/minikube/auth/index.js

@@ -1,8 +1,8 @@
 import { emptyMinikubeArtifacts } from '../contracts';
-import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
 import { generateSupabaseAuthArtifacts } from './supabase';
+import { generateTargetAwareSupabaseOAuthRuntimeArtifacts } from './targetAwareOAuthRuntime';
 export function generateAuthProviderArtifacts(args) {
-    const { manifest, namespace } = args;
+    const { appManifest, manifest, namespace } = args;
     const { auth } = manifest;
     if (!auth) {
         return emptyMinikubeArtifacts();
@@ -11,7 +11,10 @@ export function generateAuthProviderArtifacts(args) {
         throw new Error(`Unsupported auth provider for minikube adapter: "${auth.provider}". Only "supabase" is currently supported.`);
     }
     const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });
-    const oauthArtifacts = generateSupabaseOAuthRuntimeArtifacts(manifest);
+    const oauthArtifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({
+        appManifest,
+        manifest,
+    });
     return {
         files: [...providerArtifacts.files, ...oauthArtifacts.files],
         resources: [...providerArtifacts.resources, ...oauthArtifacts.resources],

package/dist/adapters/minikube/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAiC,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,QAAQ,4CAA4C,CAC9G,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,qCAAqC,CAAC,QAAQ,CAAC,CAAC;IAEvE,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,iBAAiB,CAAC,SAAS,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC;QACxE,iBAAiB,EAAE;YACjB,GAAG,iBAAiB,CAAC,iBAAiB;YACtC,GAAG,cAAc,CAAC,iBAAiB;SACpC;QACD,UAAU,EAAE,CAAC,GAAG,iBAAiB,CAAC,UAAU,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;QAC3E,QAAQ,EAAE,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC;KACtE,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../types';\nimport { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';\nimport { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';\nimport { generateSupabaseAuthArtifacts } from './supabase';\n\nexport function generateAuthProviderArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n  const { auth } = manifest;\n\n  if (!auth) {\n    return emptyMinikubeArtifacts();\n  }\n\n  if (auth.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported auth provider for minikube adapter: \"${auth.provider}\". Only \"supabase\" is currently supported.`,\n    );\n  }\n\n  const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });\n  const oauthArtifacts = generateSupabaseOAuthRuntimeArtifacts(manifest);\n\n  return {\n    files: [...providerArtifacts.files, ...oauthArtifacts.files],\n    resources: [...providerArtifacts.resources, ...oauthArtifacts.resources],\n    providerLifecycle: [\n      ...providerArtifacts.providerLifecycle,\n      ...oauthArtifacts.providerLifecycle,\n    ],\n    envEntries: [...providerArtifacts.envEntries, ...oauthArtifacts.envEntries],\n    warnings: [...providerArtifacts.warnings, ...oauthArtifacts.warnings],\n  };\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAiC,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,gDAAgD,EAAE,MAAM,2BAA2B,CAAC;AAE7F,MAAM,UAAU,6BAA6B,CAAC,IAI7C;IACC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,QAAQ,4CAA4C,CAC9G,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,gDAAgD,CAAC;QACtE,WAAW;QACX,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,iBAAiB,CAAC,SAAS,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC;QACxE,iBAAiB,EAAE;YACjB,GAAG,iBAAiB,CAAC,iBAAiB;YACtC,GAAG,cAAc,CAAC,iBAAiB;SACpC;QACD,UAAU,EAAE,CAAC,GAAG,iBAAiB,CAAC,UAAU,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;QAC3E,QAAQ,EAAE,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC;KACtE,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';\nimport { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';\nimport { generateSupabaseAuthArtifacts } from './supabase';\nimport { generateTargetAwareSupabaseOAuthRuntimeArtifacts } from './targetAwareOAuthRuntime';\n\nexport function generateAuthProviderArtifacts(args: {\n  appManifest: InfrastructureGenerationOptions['appManifest'];\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { appManifest, manifest, namespace } = args;\n  const { auth } = manifest;\n\n  if (!auth) {\n    return emptyMinikubeArtifacts();\n  }\n\n  if (auth.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported auth provider for minikube adapter: \"${auth.provider}\". Only \"supabase\" is currently supported.`,\n    );\n  }\n\n  const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });\n  const oauthArtifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({\n    appManifest,\n    manifest,\n  });\n\n  return {\n    files: [...providerArtifacts.files, ...oauthArtifacts.files],\n    resources: [...providerArtifacts.resources, ...oauthArtifacts.resources],\n    providerLifecycle: [\n      ...providerArtifacts.providerLifecycle,\n      ...oauthArtifacts.providerLifecycle,\n    ],\n    envEntries: [...providerArtifacts.envEntries, ...oauthArtifacts.envEntries],\n    warnings: [...providerArtifacts.warnings, ...oauthArtifacts.warnings],\n  };\n}\n"]}

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.d.ts

@@ -0,0 +1,7 @@
+import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';
+import type { MinikubeAdapterArtifacts } from '../contracts';
+export declare function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args: {
+    readonly appManifest: InfrastructureGenerationOptions['appManifest'];
+    readonly manifest: InfraManifestInput;
+}): MinikubeAdapterArtifacts;
+//# sourceMappingURL=targetAwareOAuthRuntime.d.ts.map

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"targetAwareOAuthRuntime.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/targetAwareOAuthRuntime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,KAAK,EAAE,wBAAwB,EAA6B,MAAM,cAAc,CAAC;AAUxF,wBAAgB,gDAAgD,CAAC,IAAI,EAAE;IACrE,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC,aAAa,CAAC,CAAC;IACrE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC,GAAG,wBAAwB,CA8B3B"}

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.js

@@ -0,0 +1,104 @@
+import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';
+import { resolveAuthTargetRedirectModel } from '../../../authTargetRedirects';
+import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
+export function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args) {
+    const baseArtifacts = generateSupabaseOAuthRuntimeArtifacts(args.manifest);
+    if (!baseArtifacts.providerLifecycle.some((lifecycle) => lifecycle.id === 'supabase-auth')) {
+        return baseArtifacts;
+    }
+    const callbackRoute = normalizeAuthCallbackRoute(args.manifest.auth?.oauth?.callbackRoute ?? '');
+    const targets = resolveAuthTargetRedirectModel({
+        callbackRoute,
+        targets: args.appManifest?.deploy?.targets,
+    });
+    const policy = {
+        callbackRoute,
+        localPatterns: targets.webEnabled ? getLocalAuthRedirectPatterns(callbackRoute) : [],
+        nativeRedirectUris: targets.nativeRedirectUris,
+        webEnabled: targets.webEnabled,
+    };
+    return {
+        ...baseArtifacts,
+        files: baseArtifacts.files.map((file) => file.path === 'infra/minikube/auth/oauth-runtime.md'
+            ? { ...file, content: getTargetAwareGuide(policy) }
+            : file),
+        providerLifecycle: baseArtifacts.providerLifecycle.map((lifecycle) => lifecycle.id === 'supabase-auth' ? applyRedirectPolicy(lifecycle, policy) : lifecycle),
+        warnings: [...baseArtifacts.warnings, ...targets.warnings],
+    };
+}
+function applyRedirectPolicy(lifecycle, policy) {
+    return {
+        ...lifecycle,
+        reconciliationCommands: lifecycle.reconciliationCommands.map((entry) => ({
+            ...entry,
+            command: rewriteReconciliationCommand(entry.command, policy),
+        })),
+        statusChecks: lifecycle.statusChecks.map((entry) => ({
+            ...entry,
+            command: getTargetAwareStatusCommand(policy),
+        })),
+    };
+}
+function rewriteReconciliationCommand(command, policy) {
+    const legacyPatterns = getLocalAuthRedirectPatterns(policy.callbackRoute).join(',');
+    const legacyPolicy = `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path},${legacyPatterns}"
+if [[ -n "\${OAUTH_NATIVE_REDIRECT_URLS:-}" ]]; then
+  oauth_redirect_allow_list="\${oauth_redirect_allow_list},\${OAUTH_NATIVE_REDIRECT_URLS}"
+fi`;
+    const staticRedirects = [...policy.localPatterns, ...policy.nativeRedirectUris].join(',');
+    const suffix = staticRedirects ? `,${staticRedirects}` : '';
+    const canonicalPolicy = policy.webEnabled
+        ? `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path}${suffix}"`
+        : `oauth_redirect_allow_list='${staticRedirects}'`;
+    let rewritten = replaceOnce(command, legacyPolicy, canonicalPolicy);
+    if (!policy.webEnabled) {
+        rewritten = replaceOnce(rewritten, 'oauth_site_url="${SITE_URL%/}"\n', '');
+    }
+    return rewritten;
+}
+function getTargetAwareStatusCommand(policy) {
+    const appCallback = policy.webEnabled
+        ? `if [[ -n "\${SITE_URL:-}" ]]; then
+  echo "- provider supabase-auth/app-callback: \${SITE_URL%/}/\${oauth_callback_path}"
+else
+  echo "- provider supabase-auth/app-callback: unavailable"
+fi`
+        : 'echo "- provider supabase-auth/app-callback: disabled (web target)"';
+    const localPatterns = policy.localPatterns.join(',') || 'none';
+    const nativeRedirects = policy.nativeRedirectUris.join(',') || 'none';
+    return `oauth_callback_route='${policy.callbackRoute}'
+oauth_callback_path="\${oauth_callback_route#/}"
+if [[ -n "\${API_EXTERNAL_URL:-}" ]]; then
+  echo "- provider supabase-auth/provider-callback: \${API_EXTERNAL_URL%/}/callback"
+else
+  echo "- provider supabase-auth/provider-callback: unavailable"
+fi
+${appCallback}
+echo "- provider supabase-auth/local-callback-patterns: ${localPatterns}"
+echo "- provider supabase-auth/native-callbacks: ${nativeRedirects}"`;
+}
+function getTargetAwareGuide(policy) {
+    const nativeRedirects = policy.nativeRedirectUris.length
+        ? policy.nativeRedirectUris.map((uri) => `- \`${uri}\``).join('\n')
+        : '- none';
+    return `# Supabase OAuth Runtime Reconciliation
+
+The provider callback remains project-owned. GoTrue-to-app redirects use the configured callback
+route \`${policy.callbackRoute}\` and are derived from \`AppManifest.deploy.targets\`.
+
+- Web target: ${policy.webEnabled ? 'enabled' : 'disabled'}
+- Native callbacks:
+${nativeRedirects}
+
+Local loopback patterns are emitted only for an enabled Web target. Native callbacks come only
+from enabled Android/iOS target schemes; no environment variable or slug-derived identity can add
+a native callback. Provider credential values remain sourced from trusted secret resolution.
+`;
+}
+function replaceOnce(value, search, replacement) {
+    if (!value.includes(search)) {
+        throw new Error('Supabase OAuth redirect reconciliation template drifted from its canonical form.');
+    }
+    return value.replace(search, replacement);
+}
+//# sourceMappingURL=targetAwareOAuthRuntime.js.map

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"targetAwareOAuthRuntime.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/targetAwareOAuthRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,gBAAgB,CAAC;AASvE,MAAM,UAAU,gDAAgD,CAAC,IAGhE;IACC,MAAM,aAAa,GAAG,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,eAAe,CAAC,EAAE,CAAC;QAC3F,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC7C,aAAa;QACb,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO;KAC3C,CAAC,CAAC;IACH,MAAM,MAAM,GAAmB;QAC7B,aAAa;QACb,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;QACpF,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,OAAO;QACL,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,IAAI,CAAC,IAAI,KAAK,sCAAsC;YAClD,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE;YACnD,CAAC,CAAC,IAAI,CACT;QACD,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CACtF;QACD,QAAQ,EAAE,CAAC,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,SAAoC,EACpC,MAAsB;IAEtB,OAAO;QACL,GAAG,SAAS;QACZ,sBAAsB,EAAE,SAAS,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvE,GAAG,KAAK;YACR,OAAO,EAAE,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;SAC7D,CAAC,CAAC;QACH,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnD,GAAG,KAAK;YACR,OAAO,EAAE,2BAA2B,CAAC,MAAM,CAAC;SAC7C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAe,EAAE,MAAsB;IAC3E,MAAM,cAAc,GAAG,4BAA4B,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,MAAM,YAAY,GAAG,4FAA4F,cAAc;;;GAG9H,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU;QACvC,CAAC,CAAC,2FAA2F,MAAM,GAAG;QACtG,CAAC,CAAC,8BAA8B,eAAe,GAAG,CAAC;IACrD,IAAI,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IAEpE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAsB;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU;QACnC,CAAC,CAAC;;;;GAIH;QACC,CAAC,CAAC,qEAAqE,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IAEtE,OAAO,yBAAyB,MAAM,CAAC,aAAa;;;;;;;EAOpD,WAAW;0DAC6C,aAAa;mDACpB,eAAe,GAAG,CAAC;AACtE,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAsB;IACjD,MAAM,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC,MAAM;QACtD,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnE,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO;;;UAGC,MAAM,CAAC,aAAa;;gBAEd,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;;EAExD,eAAe;;;;;CAKhB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,WAAmB;IACrE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';\nimport { resolveAuthTargetRedirectModel } from '../../../authTargetRedirects';\nimport type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';\nimport { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';\n\ninterface RedirectPolicy {\n  readonly callbackRoute: string;\n  readonly localPatterns: readonly string[];\n  readonly nativeRedirectUris: readonly string[];\n  readonly webEnabled: boolean;\n}\n\nexport function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args: {\n  readonly appManifest: InfrastructureGenerationOptions['appManifest'];\n  readonly manifest: InfraManifestInput;\n}): MinikubeAdapterArtifacts {\n  const baseArtifacts = generateSupabaseOAuthRuntimeArtifacts(args.manifest);\n  if (!baseArtifacts.providerLifecycle.some((lifecycle) => lifecycle.id === 'supabase-auth')) {\n    return baseArtifacts;\n  }\n\n  const callbackRoute = normalizeAuthCallbackRoute(args.manifest.auth?.oauth?.callbackRoute ?? '');\n  const targets = resolveAuthTargetRedirectModel({\n    callbackRoute,\n    targets: args.appManifest?.deploy?.targets,\n  });\n  const policy: RedirectPolicy = {\n    callbackRoute,\n    localPatterns: targets.webEnabled ? getLocalAuthRedirectPatterns(callbackRoute) : [],\n    nativeRedirectUris: targets.nativeRedirectUris,\n    webEnabled: targets.webEnabled,\n  };\n\n  return {\n    ...baseArtifacts,\n    files: baseArtifacts.files.map((file) =>\n      file.path === 'infra/minikube/auth/oauth-runtime.md'\n        ? { ...file, content: getTargetAwareGuide(policy) }\n        : file,\n    ),\n    providerLifecycle: baseArtifacts.providerLifecycle.map((lifecycle) =>\n      lifecycle.id === 'supabase-auth' ? applyRedirectPolicy(lifecycle, policy) : lifecycle,\n    ),\n    warnings: [...baseArtifacts.warnings, ...targets.warnings],\n  };\n}\n\nfunction applyRedirectPolicy(\n  lifecycle: MinikubeProviderLifecycle,\n  policy: RedirectPolicy,\n): MinikubeProviderLifecycle {\n  return {\n    ...lifecycle,\n    reconciliationCommands: lifecycle.reconciliationCommands.map((entry) => ({\n      ...entry,\n      command: rewriteReconciliationCommand(entry.command, policy),\n    })),\n    statusChecks: lifecycle.statusChecks.map((entry) => ({\n      ...entry,\n      command: getTargetAwareStatusCommand(policy),\n    })),\n  };\n}\n\nfunction rewriteReconciliationCommand(command: string, policy: RedirectPolicy): string {\n  const legacyPatterns = getLocalAuthRedirectPatterns(policy.callbackRoute).join(',');\n  const legacyPolicy = `oauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path},${legacyPatterns}\"\nif [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n  oauth_redirect_allow_list=\"\\${oauth_redirect_allow_list},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\nfi`;\n  const staticRedirects = [...policy.localPatterns, ...policy.nativeRedirectUris].join(',');\n  const suffix = staticRedirects ? `,${staticRedirects}` : '';\n  const canonicalPolicy = policy.webEnabled\n    ? `oauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path}${suffix}\"`\n    : `oauth_redirect_allow_list='${staticRedirects}'`;\n  let rewritten = replaceOnce(command, legacyPolicy, canonicalPolicy);\n\n  if (!policy.webEnabled) {\n    rewritten = replaceOnce(rewritten, 'oauth_site_url=\"${SITE_URL%/}\"\\n', '');\n  }\n\n  return rewritten;\n}\n\nfunction getTargetAwareStatusCommand(policy: RedirectPolicy): string {\n  const appCallback = policy.webEnabled\n    ? `if [[ -n \"\\${SITE_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/app-callback: \\${SITE_URL%/}/\\${oauth_callback_path}\"\nelse\n  echo \"- provider supabase-auth/app-callback: unavailable\"\nfi`\n    : 'echo \"- provider supabase-auth/app-callback: disabled (web target)\"';\n  const localPatterns = policy.localPatterns.join(',') || 'none';\n  const nativeRedirects = policy.nativeRedirectUris.join(',') || 'none';\n\n  return `oauth_callback_route='${policy.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\nif [[ -n \"\\${API_EXTERNAL_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/provider-callback: \\${API_EXTERNAL_URL%/}/callback\"\nelse\n  echo \"- provider supabase-auth/provider-callback: unavailable\"\nfi\n${appCallback}\necho \"- provider supabase-auth/local-callback-patterns: ${localPatterns}\"\necho \"- provider supabase-auth/native-callbacks: ${nativeRedirects}\"`;\n}\n\nfunction getTargetAwareGuide(policy: RedirectPolicy): string {\n  const nativeRedirects = policy.nativeRedirectUris.length\n    ? policy.nativeRedirectUris.map((uri) => `- \\`${uri}\\``).join('\\n')\n    : '- none';\n\n  return `# Supabase OAuth Runtime Reconciliation\n\nThe provider callback remains project-owned. GoTrue-to-app redirects use the configured callback\nroute \\`${policy.callbackRoute}\\` and are derived from \\`AppManifest.deploy.targets\\`.\n\n- Web target: ${policy.webEnabled ? 'enabled' : 'disabled'}\n- Native callbacks:\n${nativeRedirects}\n\nLocal loopback patterns are emitted only for an enabled Web target. Native callbacks come only\nfrom enabled Android/iOS target schemes; no environment variable or slug-derived identity can add\na native callback. Provider credential values remain sourced from trusted secret resolution.\n`;\n}\n\nfunction replaceOnce(value: string, search: string, replacement: string): string {\n  if (!value.includes(search)) {\n    throw new Error(\n      'Supabase OAuth redirect reconciliation template drifted from its canonical form.',\n    );\n  }\n  return value.replace(search, replacement);\n}\n"]}

package/dist/adapters/minikube/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AAUrB,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAkGhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AAUrB,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAsGhC"}

package/dist/adapters/minikube/index.js

@@ -15,7 +15,11 @@ export function generateMinikubeInfra(manifest, options = {}) {
     }
     const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);
     const namespace = APP_NAMESPACE;
-    const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });
+    const authArtifacts = generateAuthProviderArtifacts({
+        appManifest: options.appManifest,
+        manifest,
+        namespace,
+    });
     const authzArtifacts = generateAuthorizationArtifacts({
         manifest,
         namespace,

package/dist/adapters/minikube/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AAOnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC;IAEhC,MAAM,aAAa,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;QAC1E,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa;QACjD,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,WAAW,CAAC,MAAM,CACzE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAChD,CAAC;IAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,kDAAkD,kBAAkB;aACjE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;aACtF,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG;QACxB,GAAG,aAAa,CAAC,iBAAiB;QAClC,GAAG,cAAc,CAAC,iBAAiB;QACnC,GAAG,gBAAgB,CAAC,iBAAiB;QACrC,GAAG,oBAAoB,CAAC,iBAAiB;KAC1C,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC;QAChC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;KACnE,CAAC,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,OAAO;QACP,cAAc;QACd,kBAAkB;QAClB,iBAAiB;QACjB,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,6BAA6B,CAAC,WAAW;aACzC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC;aACzD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;KAC3C,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,6BAA6B,CAAC,KAAK;SACvC;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kMAAkM,CACnM,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateGeneratedApiDatabaseArtifacts } from '../../generatedApiDatabase';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;\nconst BUILT_IN_NAMESPACES = new Set([APP_NAMESPACE, 'supabase']);\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);\n  const namespace = APP_NAMESPACE;\n\n  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const generatedApiDatabaseArtifacts = generateGeneratedApiDatabaseArtifacts({\n    generatedApis: options.appManifest?.generatedApis,\n    databaseProvider: manifest.database?.provider,\n  });\n  const generatedApiErrors = generatedApiDatabaseArtifacts.diagnostics.filter(\n    (diagnostic) => diagnostic.severity === 'error',\n  );\n\n  if (generatedApiErrors.length > 0) {\n    throw new Error(\n      `Generated API database definition is invalid:\\n${generatedApiErrors\n        .map((diagnostic) => `- ${diagnostic.path ?? diagnostic.apiId}: ${diagnostic.message}`)\n        .join('\\n')}`,\n    );\n  }\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const providerLifecycle = [\n    ...authArtifacts.providerLifecycle,\n    ...authzArtifacts.providerLifecycle,\n    ...storageArtifacts.providerLifecycle,\n    ...secretStoreArtifacts.providerLifecycle,\n  ];\n  const providerNamespaces = unique([\n    ...providerLifecycle.map((contribution) => contribution.namespace),\n  ]).filter((providerNamespace) => !BUILT_IN_NAMESPACES.has(providerNamespace));\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...generatedApiDatabaseArtifacts.diagnostics\n      .filter((diagnostic) => diagnostic.severity === 'warning')\n      .map((diagnostic) => diagnostic.message),\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...generatedApiDatabaseArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction validateCanonicalAppSlug(slug: string | undefined): string {\n  if (!slug) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug is required.',\n    );\n  }\n\n  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',\n    );\n  }\n\n  return slug;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AAOnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC;IAEhC,MAAM,aAAa,GAAG,6BAA6B,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ;QACR,SAAS;KACV,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;QAC1E,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa;QACjD,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,WAAW,CAAC,MAAM,CACzE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAChD,CAAC;IAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,kDAAkD,kBAAkB;aACjE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;aACtF,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG;QACxB,GAAG,aAAa,CAAC,iBAAiB;QAClC,GAAG,cAAc,CAAC,iBAAiB;QACnC,GAAG,gBAAgB,CAAC,iBAAiB;QACrC,GAAG,oBAAoB,CAAC,iBAAiB;KAC1C,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC;QAChC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;KACnE,CAAC,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,OAAO;QACP,cAAc;QACd,kBAAkB;QAClB,iBAAiB;QACjB,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,6BAA6B,CAAC,WAAW;aACzC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC;aACzD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;KAC3C,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,6BAA6B,CAAC,KAAK;SACvC;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kMAAkM,CACnM,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateGeneratedApiDatabaseArtifacts } from '../../generatedApiDatabase';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;\nconst BUILT_IN_NAMESPACES = new Set([APP_NAMESPACE, 'supabase']);\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);\n  const namespace = APP_NAMESPACE;\n\n  const authArtifacts = generateAuthProviderArtifacts({\n    appManifest: options.appManifest,\n    manifest,\n    namespace,\n  });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const generatedApiDatabaseArtifacts = generateGeneratedApiDatabaseArtifacts({\n    generatedApis: options.appManifest?.generatedApis,\n    databaseProvider: manifest.database?.provider,\n  });\n  const generatedApiErrors = generatedApiDatabaseArtifacts.diagnostics.filter(\n    (diagnostic) => diagnostic.severity === 'error',\n  );\n\n  if (generatedApiErrors.length > 0) {\n    throw new Error(\n      `Generated API database definition is invalid:\\n${generatedApiErrors\n        .map((diagnostic) => `- ${diagnostic.path ?? diagnostic.apiId}: ${diagnostic.message}`)\n        .join('\\n')}`,\n    );\n  }\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const providerLifecycle = [\n    ...authArtifacts.providerLifecycle,\n    ...authzArtifacts.providerLifecycle,\n    ...storageArtifacts.providerLifecycle,\n    ...secretStoreArtifacts.providerLifecycle,\n  ];\n  const providerNamespaces = unique([\n    ...providerLifecycle.map((contribution) => contribution.namespace),\n  ]).filter((providerNamespace) => !BUILT_IN_NAMESPACES.has(providerNamespace));\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...generatedApiDatabaseArtifacts.diagnostics\n      .filter((diagnostic) => diagnostic.severity === 'warning')\n      .map((diagnostic) => diagnostic.message),\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...generatedApiDatabaseArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction validateCanonicalAppSlug(slug: string | undefined): string {\n  if (!slug) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug is required.',\n    );\n  }\n\n  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',\n    );\n  }\n\n  return slug;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}

package/dist/authTargetRedirects.d.ts

@@ -0,0 +1,12 @@
+import type { AppDeployTargets } from '@ankhorage/contracts/deploy';
+interface AuthTargetRedirectModel {
+    readonly nativeRedirectUris: readonly string[];
+    readonly warnings: readonly string[];
+    readonly webEnabled: boolean;
+}
+export declare function resolveAuthTargetRedirectModel(args: {
+    readonly callbackRoute: string;
+    readonly targets: AppDeployTargets | undefined;
+}): AuthTargetRedirectModel;
+export {};
+//# sourceMappingURL=authTargetRedirects.d.ts.map

package/dist/authTargetRedirects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authTargetRedirects.d.ts","sourceRoot":"","sources":["../src/authTargetRedirects.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAChD,GAAG,uBAAuB,CAkC1B"}

package/dist/authTargetRedirects.js

@@ -0,0 +1,32 @@
+export function resolveAuthTargetRedirectModel(args) {
+    if (args.targets === undefined) {
+        return {
+            nativeRedirectUris: [],
+            warnings: [
+                'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
+            ],
+            webEnabled: true,
+        };
+    }
+    const callbackPath = args.callbackRoute.replace(/^\/+/u, '');
+    const nativeRedirectUris = [];
+    const warnings = [];
+    for (const [targetId, target] of [
+        ['android', args.targets.android],
+        ['ios', args.targets.ios],
+    ]) {
+        if (target?.enabled !== true)
+            continue;
+        if (target.scheme === undefined) {
+            warnings.push(`OAuth ${targetId} target is enabled but deploy.targets.${targetId}.scheme is missing; native callback omitted.`);
+            continue;
+        }
+        nativeRedirectUris.push(`${target.scheme}://${callbackPath}`);
+    }
+    return {
+        nativeRedirectUris: [...new Set(nativeRedirectUris)],
+        warnings,
+        webEnabled: args.targets.web?.enabled === true,
+    };
+}
+//# sourceMappingURL=authTargetRedirects.js.map

package/dist/authTargetRedirects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authTargetRedirects.js","sourceRoot":"","sources":["../src/authTargetRedirects.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,8BAA8B,CAAC,IAG9C;IACC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,kBAAkB,EAAE,EAAE;YACtB,QAAQ,EAAE;gBACR,8GAA8G;aAC/G;YACD,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI;QAC/B,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACjC,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;KACjB,EAAE,CAAC;QACX,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;YAAE,SAAS;QACvC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CACX,SAAS,QAAQ,yCAAyC,QAAQ,8CAA8C,CACjH,CAAC;YACF,SAAS;QACX,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,MAAM,YAAY,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACL,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI;KAC/C,CAAC;AACJ,CAAC","sourcesContent":["import type { AppDeployTargets } from '@ankhorage/contracts/deploy';\n\ninterface AuthTargetRedirectModel {\n  readonly nativeRedirectUris: readonly string[];\n  readonly warnings: readonly string[];\n  readonly webEnabled: boolean;\n}\n\nexport function resolveAuthTargetRedirectModel(args: {\n  readonly callbackRoute: string;\n  readonly targets: AppDeployTargets | undefined;\n}): AuthTargetRedirectModel {\n  if (args.targets === undefined) {\n    return {\n      nativeRedirectUris: [],\n      warnings: [\n        'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',\n      ],\n      webEnabled: true,\n    };\n  }\n\n  const callbackPath = args.callbackRoute.replace(/^\\/+/u, '');\n  const nativeRedirectUris: string[] = [];\n  const warnings: string[] = [];\n\n  for (const [targetId, target] of [\n    ['android', args.targets.android],\n    ['ios', args.targets.ios],\n  ] as const) {\n    if (target?.enabled !== true) continue;\n    if (target.scheme === undefined) {\n      warnings.push(\n        `OAuth ${targetId} target is enabled but deploy.targets.${targetId}.scheme is missing; native callback omitted.`,\n      );\n      continue;\n    }\n    nativeRedirectUris.push(`${target.scheme}://${callbackPath}`);\n  }\n\n  return {\n    nativeRedirectUris: [...new Set(nativeRedirectUris)],\n    warnings,\n    webEnabled: args.targets.web?.enabled === true,\n  };\n}\n"]}

package/dist/project/index.d.ts

@@ -1,4 +1,6 @@
 export { type ResolvedInfraProject, resolveInfraProject as resolveInfraWorkspaceProject, } from '../project.js';
-export { type InfraSyncResult, resolveProjectInfrastructureTarget, syncProjectInfrastructure, } from '../projectInfrastructure.js';
+export { resolveProjectInfrastructureDatabaseUrl } from '../projectDatabase.js';
+export { readProjectInfrastructureEnvironment } from '../projectEnvironment.js';
+export { type InfraProjectInspection, type InfraSyncResult, inspectProjectInfrastructure, resolveProjectInfrastructureTarget, syncProjectInfrastructure, } from '../projectInfrastructure.js';
 export { type InfraLifecycleScript, type InfraPortForwardInfo, InfraScriptExecutionError, type InfraScriptOutput, resolveProjectInfrastructurePortForward, runProjectInfrastructureLifecycle, } from '../runtime.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/project/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,oBAAoB,EACzB,mBAAmB,IAAI,4BAA4B,GACpD,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,eAAe,EACpB,kCAAkC,EAClC,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,uCAAuC,EACvC,iCAAiC,GAClC,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,oBAAoB,EACzB,mBAAmB,IAAI,4BAA4B,GACpD,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,uCAAuC,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,4BAA4B,EAC5B,kCAAkC,EAClC,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,uCAAuC,EACvC,iCAAiC,GAClC,MAAM,eAAe,CAAC"}

package/dist/project/index.js

@@ -1,4 +1,6 @@
 export { resolveInfraProject as resolveInfraWorkspaceProject, } from '../project.js';
-export { resolveProjectInfrastructureTarget, syncProjectInfrastructure, } from '../projectInfrastructure.js';
+export { resolveProjectInfrastructureDatabaseUrl } from '../projectDatabase.js';
+export { readProjectInfrastructureEnvironment } from '../projectEnvironment.js';
+export { inspectProjectInfrastructure, resolveProjectInfrastructureTarget, syncProjectInfrastructure, } from '../projectInfrastructure.js';
 export { InfraScriptExecutionError, resolveProjectInfrastructurePortForward, runProjectInfrastructureLifecycle, } from '../runtime.js';
 //# sourceMappingURL=index.js.map

package/dist/project/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,IAAI,4BAA4B,GACpD,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,kCAAkC,EAClC,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGL,yBAAyB,EAEzB,uCAAuC,EACvC,iCAAiC,GAClC,MAAM,eAAe,CAAC","sourcesContent":["export {\n  type ResolvedInfraProject,\n  resolveInfraProject as resolveInfraWorkspaceProject,\n} from '../project.js';\nexport {\n  type InfraSyncResult,\n  resolveProjectInfrastructureTarget,\n  syncProjectInfrastructure,\n} from '../projectInfrastructure.js';\nexport {\n  type InfraLifecycleScript,\n  type InfraPortForwardInfo,\n  InfraScriptExecutionError,\n  type InfraScriptOutput,\n  resolveProjectInfrastructurePortForward,\n  runProjectInfrastructureLifecycle,\n} from '../runtime.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,IAAI,4BAA4B,GACpD,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,uCAAuC,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAGL,4BAA4B,EAC5B,kCAAkC,EAClC,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGL,yBAAyB,EAEzB,uCAAuC,EACvC,iCAAiC,GAClC,MAAM,eAAe,CAAC","sourcesContent":["export {\n  type ResolvedInfraProject,\n  resolveInfraProject as resolveInfraWorkspaceProject,\n} from '../project.js';\nexport { resolveProjectInfrastructureDatabaseUrl } from '../projectDatabase.js';\nexport { readProjectInfrastructureEnvironment } from '../projectEnvironment.js';\nexport {\n  type InfraProjectInspection,\n  type InfraSyncResult,\n  inspectProjectInfrastructure,\n  resolveProjectInfrastructureTarget,\n  syncProjectInfrastructure,\n} from '../projectInfrastructure.js';\nexport {\n  type InfraLifecycleScript,\n  type InfraPortForwardInfo,\n  InfraScriptExecutionError,\n  type InfraScriptOutput,\n  resolveProjectInfrastructurePortForward,\n  runProjectInfrastructureLifecycle,\n} from '../runtime.js';\n"]}

package/dist/projectDatabase.d.ts

@@ -0,0 +1,5 @@
+export declare function resolveProjectInfrastructureDatabaseUrl(args: {
+    readonly projectPath: string;
+    readonly target: string;
+}): Promise<string | null>;
+//# sourceMappingURL=projectDatabase.d.ts.map

package/dist/projectDatabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectDatabase.d.ts","sourceRoot":"","sources":["../src/projectDatabase.ts"],"names":[],"mappings":"AAUA,wBAAsB,uCAAuC,CAAC,IAAI,EAAE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAazB"}

package/dist/projectDatabase.js

@@ -0,0 +1,22 @@
+import { readProjectInfrastructureEnvironment } from './projectEnvironment.js';
+const DATABASE_URL_KEYS = [
+    'ANKH_SECRET_STORE_DATABASE_URL',
+    'SUPABASE_DB_URL',
+    'POSTGRES_URL',
+    'DB_URL',
+    'DATABASE_URL',
+];
+export async function resolveProjectInfrastructureDatabaseUrl(args) {
+    const environment = await readProjectInfrastructureEnvironment({
+        keys: DATABASE_URL_KEYS,
+        projectPath: args.projectPath,
+        target: args.target,
+    });
+    for (const key of DATABASE_URL_KEYS) {
+        const value = environment[key]?.trim();
+        if (value)
+            return value;
+    }
+    return null;
+}
+//# sourceMappingURL=projectDatabase.js.map

package/dist/projectDatabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectDatabase.js","sourceRoot":"","sources":["../src/projectDatabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAE/E,MAAM,iBAAiB,GAAG;IACxB,gCAAgC;IAChC,iBAAiB;IACjB,cAAc;IACd,QAAQ;IACR,cAAc;CACN,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,IAG7D;IACC,MAAM,WAAW,GAAG,MAAM,oCAAoC,CAAC;QAC7D,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { readProjectInfrastructureEnvironment } from './projectEnvironment.js';\n\nconst DATABASE_URL_KEYS = [\n  'ANKH_SECRET_STORE_DATABASE_URL',\n  'SUPABASE_DB_URL',\n  'POSTGRES_URL',\n  'DB_URL',\n  'DATABASE_URL',\n] as const;\n\nexport async function resolveProjectInfrastructureDatabaseUrl(args: {\n  readonly projectPath: string;\n  readonly target: string;\n}): Promise<string | null> {\n  const environment = await readProjectInfrastructureEnvironment({\n    keys: DATABASE_URL_KEYS,\n    projectPath: args.projectPath,\n    target: args.target,\n  });\n\n  for (const key of DATABASE_URL_KEYS) {\n    const value = environment[key]?.trim();\n    if (value) return value;\n  }\n\n  return null;\n}\n"]}

package/dist/projectEnvironment.d.ts

@@ -0,0 +1,6 @@
+export declare function readProjectInfrastructureEnvironment(args: {
+    readonly keys: readonly string[];
+    readonly projectPath: string;
+    readonly target: string;
+}): Promise<Readonly<Record<string, string>>>;
+//# sourceMappingURL=projectEnvironment.d.ts.map

package/dist/projectEnvironment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectEnvironment.d.ts","sourceRoot":"","sources":["../src/projectEnvironment.ts"],"names":[],"mappings":"AAGA,wBAAsB,oCAAoC,CAAC,IAAI,EAAE;IAC/D,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAc5C"}

package/dist/projectEnvironment.js

@@ -0,0 +1,45 @@
+import { promises as fs } from 'fs';
+import path from 'path';
+export async function readProjectInfrastructureEnvironment(args) {
+    const infraRoot = path.join(args.projectPath, 'infra', args.target);
+    const envPath = path.join(infraRoot, '.env');
+    const fallbackPath = path.join(infraRoot, '.env.example');
+    const sourcePath = (await pathExists(envPath)) ? envPath : fallbackPath;
+    const environment = await readEnvironmentFile(sourcePath);
+    const selected = {};
+    for (const key of new Set(args.keys)) {
+        const value = environment.get(key);
+        if (value !== undefined)
+            selected[key] = value;
+    }
+    return selected;
+}
+async function readEnvironmentFile(filePath) {
+    const out = new Map();
+    const content = await fs.readFile(filePath, 'utf8');
+    for (const line of content.split(/\r?\n/u)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const separator = trimmed.indexOf('=');
+        if (separator <= 0)
+            continue;
+        const key = trimmed.slice(0, separator).trim();
+        const value = trimmed
+            .slice(separator + 1)
+            .trim()
+            .replace(/^['"]|['"]$/g, '');
+        out.set(key, value);
+    }
+    return out;
+}
+async function pathExists(filePath) {
+    try {
+        await fs.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=projectEnvironment.js.map

package/dist/projectEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectEnvironment.js","sourceRoot":"","sources":["../src/projectEnvironment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,IAI1D;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEpD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,IAAI,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,OAAO;aAClB,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;aACpB,IAAI,EAAE;aACN,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { promises as fs } from 'fs';\nimport path from 'path';\n\nexport async function readProjectInfrastructureEnvironment(args: {\n  readonly keys: readonly string[];\n  readonly projectPath: string;\n  readonly target: string;\n}): Promise<Readonly<Record<string, string>>> {\n  const infraRoot = path.join(args.projectPath, 'infra', args.target);\n  const envPath = path.join(infraRoot, '.env');\n  const fallbackPath = path.join(infraRoot, '.env.example');\n  const sourcePath = (await pathExists(envPath)) ? envPath : fallbackPath;\n  const environment = await readEnvironmentFile(sourcePath);\n  const selected: Record<string, string> = {};\n\n  for (const key of new Set(args.keys)) {\n    const value = environment.get(key);\n    if (value !== undefined) selected[key] = value;\n  }\n\n  return selected;\n}\n\nasync function readEnvironmentFile(filePath: string): Promise<Map<string, string>> {\n  const out = new Map<string, string>();\n  const content = await fs.readFile(filePath, 'utf8');\n\n  for (const line of content.split(/\\r?\\n/u)) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n    const separator = trimmed.indexOf('=');\n    if (separator <= 0) continue;\n    const key = trimmed.slice(0, separator).trim();\n    const value = trimmed\n      .slice(separator + 1)\n      .trim()\n      .replace(/^['\"]|['\"]$/g, '');\n    out.set(key, value);\n  }\n\n  return out;\n}\n\nasync function pathExists(filePath: string): Promise<boolean> {\n  try {\n    await fs.access(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n"]}

package/dist/projectInfrastructure.d.ts

@@ -8,12 +8,28 @@ export interface InfraSyncResult {
         readonly reason: string;
     };
 }
+export interface InfraProjectInspection {
+    readonly generated: boolean;
+    readonly generatedAt: string | null;
+    readonly hasDeployment: boolean;
+    readonly target: string | null;
+    readonly trackedFiles: number;
+    readonly warnings: readonly string[];
+    readonly skipped?: {
+        readonly reason: string;
+    };
+}
 export declare function syncProjectInfrastructure(args: {
     readonly generateInfrastructureImpl?: typeof generateInfrastructure;
     readonly manifest: AppManifest;
     readonly projectId: string;
     readonly projectPath: string;
 }): Promise<InfraSyncResult>;
+export declare function inspectProjectInfrastructure(args: {
+    readonly manifest: AppManifest;
+    readonly projectId: string;
+    readonly projectPath: string;
+}): Promise<InfraProjectInspection>;
 export declare function resolveProjectInfrastructureTarget(args: {
     readonly manifest: AppManifest;
     readonly projectPath: string;

package/dist/projectInfrastructure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectInfrastructure.d.ts","sourceRoot":"","sources":["../src/projectInfrastructure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAIxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAcpD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC,eAAe,CAAC,CAiE3B;AAED,wBAAsB,kCAAkC,CAAC,IAAI,EAAE;IAC7D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQzB;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUhF"}
+{"version":3,"file":"projectInfrastructure.d.ts","sourceRoot":"","sources":["../src/projectInfrastructure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAIxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAcpD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC,eAAe,CAAC,CAiE3B;AAED,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA0BlC;AAED,wBAAsB,kCAAkC,CAAC,IAAI,EAAE;IAC7D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQzB;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUhF"}

package/dist/projectInfrastructure.js

@@ -57,6 +57,31 @@ export async function syncProjectInfrastructure(args) {
         warnings: combinedWarnings,
     };
 }
+export async function inspectProjectInfrastructure(args) {
+    const supportWarnings = validateInfraSupport(args.manifest.infra);
+    if (args.projectId === STUDIO_PROJECT_ID) {
+        return {
+            generated: false,
+            generatedAt: null,
+            hasDeployment: false,
+            target: null,
+            trackedFiles: 0,
+            warnings: supportWarnings,
+            skipped: {
+                reason: 'apps/studio is the dashboard and is not a generated app target.',
+            },
+        };
+    }
+    const ledger = await readInfraLedger(args.projectPath);
+    return {
+        generated: ledger !== null,
+        generatedAt: ledger?.generatedAt ?? null,
+        hasDeployment: args.manifest.infra.deployment !== undefined,
+        target: args.manifest.infra.deployment?.target ?? ledger?.target ?? null,
+        trackedFiles: ledger?.files.length ?? 0,
+        warnings: uniqueStrings([...supportWarnings, ...(ledger?.warnings ?? [])]),
+    };
+}
 export async function resolveProjectInfrastructureTarget(args) {
     const manifestTarget = args.manifest.infra.deployment?.target;
     if (manifestTarget !== undefined) {