@ankhorage/infra 3.2.0 → 3.3.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @ankhorage/infra
 
+## 3.3.0
+
+### Minor Changes
+
+- 716f678: Derive Supabase OAuth redirect allowlists from canonical app deployment targets, using enabled Web state and stable Android/iOS schemes instead of a separate native redirect environment variable.
+
 ## 3.2.0
 
 ### Minor Changes

package/README.md

@@ -3,17 +3,23 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v2.0.1](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v3.2.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 
 ## Usage
 
-### Provider and CLI surface
+### Provider, CLI, and project API surface
 
-`@ankhorage/infra` owns infra command behavior.
+`@ankhorage/infra` owns infrastructure generation, project reconciliation,
+and generated lifecycle execution.
 
-The same shared command implementation backs both:
+The same owner implementation backs CLI consumers and the public
+`@ankhorage/infra/project` application-service boundary. Trusted hosts such
+as Studio should call that subpath instead of reproducing ledger, generated
+file, lifecycle-script, or port-forward configuration semantics.
+
+CLI entrypoints:
 
 - `ankh infra ...`
 - `bunx @ankhorage/infra ...`
@@ -26,12 +32,10 @@ Current command surface:
 - `up`
 - `down`
 
-`status` runs the generated live runtime status script for a project.
-
-Project resolution is project-aware:
-
-- pass `[project]`, or
-- omit it when cwd is already inside `apps/<project>`
+Project resolution for the CLI is workspace-aware: pass `[project]`, or
+omit it when cwd is already inside `apps/<project>`. Programmatic project
+operations accept an explicit project path and do not require Studio or a
+particular workspace layout.
 
 Source: `src/readme-usage.ts`
 

package/dist/adapters/minikube/auth/index.d.ts

@@ -1,6 +1,7 @@
-import type { InfraManifestInput } from '../../../types';
+import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';
 import { type MinikubeAdapterArtifacts } from '../contracts';
 export declare function generateAuthProviderArtifacts(args: {
+    appManifest: InfrastructureGenerationOptions['appManifest'];
     manifest: InfraManifestInput;
     namespace: string;
 }): MinikubeAdapterArtifacts;

package/dist/adapters/minikube/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAIrF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CA2B3B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAIrF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,WAAW,EAAE,+BAA+B,CAAC,aAAa,CAAC,CAAC;IAC5D,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CA8B3B"}

package/dist/adapters/minikube/auth/index.js

@@ -1,8 +1,8 @@
 import { emptyMinikubeArtifacts } from '../contracts';
-import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
 import { generateSupabaseAuthArtifacts } from './supabase';
+import { generateTargetAwareSupabaseOAuthRuntimeArtifacts } from './targetAwareOAuthRuntime';
 export function generateAuthProviderArtifacts(args) {
-    const { manifest, namespace } = args;
+    const { appManifest, manifest, namespace } = args;
     const { auth } = manifest;
     if (!auth) {
         return emptyMinikubeArtifacts();
@@ -11,7 +11,10 @@ export function generateAuthProviderArtifacts(args) {
         throw new Error(`Unsupported auth provider for minikube adapter: "${auth.provider}". Only "supabase" is currently supported.`);
     }
     const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });
-    const oauthArtifacts = generateSupabaseOAuthRuntimeArtifacts(manifest);
+    const oauthArtifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({
+        appManifest,
+        manifest,
+    });
     return {
         files: [...providerArtifacts.files, ...oauthArtifacts.files],
         resources: [...providerArtifacts.resources, ...oauthArtifacts.resources],

package/dist/adapters/minikube/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAiC,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,QAAQ,4CAA4C,CAC9G,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,qCAAqC,CAAC,QAAQ,CAAC,CAAC;IAEvE,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,iBAAiB,CAAC,SAAS,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC;QACxE,iBAAiB,EAAE;YACjB,GAAG,iBAAiB,CAAC,iBAAiB;YACtC,GAAG,cAAc,CAAC,iBAAiB;SACpC;QACD,UAAU,EAAE,CAAC,GAAG,iBAAiB,CAAC,UAAU,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;QAC3E,QAAQ,EAAE,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC;KACtE,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../types';\nimport { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';\nimport { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';\nimport { generateSupabaseAuthArtifacts } from './supabase';\n\nexport function generateAuthProviderArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n  const { auth } = manifest;\n\n  if (!auth) {\n    return emptyMinikubeArtifacts();\n  }\n\n  if (auth.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported auth provider for minikube adapter: \"${auth.provider}\". Only \"supabase\" is currently supported.`,\n    );\n  }\n\n  const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });\n  const oauthArtifacts = generateSupabaseOAuthRuntimeArtifacts(manifest);\n\n  return {\n    files: [...providerArtifacts.files, ...oauthArtifacts.files],\n    resources: [...providerArtifacts.resources, ...oauthArtifacts.resources],\n    providerLifecycle: [\n      ...providerArtifacts.providerLifecycle,\n      ...oauthArtifacts.providerLifecycle,\n    ],\n    envEntries: [...providerArtifacts.envEntries, ...oauthArtifacts.envEntries],\n    warnings: [...providerArtifacts.warnings, ...oauthArtifacts.warnings],\n  };\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAiC,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,gDAAgD,EAAE,MAAM,2BAA2B,CAAC;AAE7F,MAAM,UAAU,6BAA6B,CAAC,IAI7C;IACC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,QAAQ,4CAA4C,CAC9G,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,gDAAgD,CAAC;QACtE,WAAW;QACX,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,iBAAiB,CAAC,SAAS,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC;QACxE,iBAAiB,EAAE;YACjB,GAAG,iBAAiB,CAAC,iBAAiB;YACtC,GAAG,cAAc,CAAC,iBAAiB;SACpC;QACD,UAAU,EAAE,CAAC,GAAG,iBAAiB,CAAC,UAAU,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;QAC3E,QAAQ,EAAE,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC;KACtE,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';\nimport { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';\nimport { generateSupabaseAuthArtifacts } from './supabase';\nimport { generateTargetAwareSupabaseOAuthRuntimeArtifacts } from './targetAwareOAuthRuntime';\n\nexport function generateAuthProviderArtifacts(args: {\n  appManifest: InfrastructureGenerationOptions['appManifest'];\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { appManifest, manifest, namespace } = args;\n  const { auth } = manifest;\n\n  if (!auth) {\n    return emptyMinikubeArtifacts();\n  }\n\n  if (auth.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported auth provider for minikube adapter: \"${auth.provider}\". Only \"supabase\" is currently supported.`,\n    );\n  }\n\n  const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });\n  const oauthArtifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({\n    appManifest,\n    manifest,\n  });\n\n  return {\n    files: [...providerArtifacts.files, ...oauthArtifacts.files],\n    resources: [...providerArtifacts.resources, ...oauthArtifacts.resources],\n    providerLifecycle: [\n      ...providerArtifacts.providerLifecycle,\n      ...oauthArtifacts.providerLifecycle,\n    ],\n    envEntries: [...providerArtifacts.envEntries, ...oauthArtifacts.envEntries],\n    warnings: [...providerArtifacts.warnings, ...oauthArtifacts.warnings],\n  };\n}\n"]}

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.d.ts

@@ -0,0 +1,7 @@
+import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';
+import type { MinikubeAdapterArtifacts } from '../contracts';
+export declare function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args: {
+    readonly appManifest: InfrastructureGenerationOptions['appManifest'];
+    readonly manifest: InfraManifestInput;
+}): MinikubeAdapterArtifacts;
+//# sourceMappingURL=targetAwareOAuthRuntime.d.ts.map

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"targetAwareOAuthRuntime.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/targetAwareOAuthRuntime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,KAAK,EAAE,wBAAwB,EAA6B,MAAM,cAAc,CAAC;AAUxF,wBAAgB,gDAAgD,CAAC,IAAI,EAAE;IACrE,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC,aAAa,CAAC,CAAC;IACrE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC,GAAG,wBAAwB,CA8B3B"}

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.js

@@ -0,0 +1,104 @@
+import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';
+import { resolveAuthTargetRedirectModel } from '../../../authTargetRedirects';
+import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
+export function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args) {
+    const baseArtifacts = generateSupabaseOAuthRuntimeArtifacts(args.manifest);
+    if (!baseArtifacts.providerLifecycle.some((lifecycle) => lifecycle.id === 'supabase-auth')) {
+        return baseArtifacts;
+    }
+    const callbackRoute = normalizeAuthCallbackRoute(args.manifest.auth?.oauth?.callbackRoute ?? '');
+    const targets = resolveAuthTargetRedirectModel({
+        callbackRoute,
+        targets: args.appManifest?.deploy?.targets,
+    });
+    const policy = {
+        callbackRoute,
+        localPatterns: targets.webEnabled ? getLocalAuthRedirectPatterns(callbackRoute) : [],
+        nativeRedirectUris: targets.nativeRedirectUris,
+        webEnabled: targets.webEnabled,
+    };
+    return {
+        ...baseArtifacts,
+        files: baseArtifacts.files.map((file) => file.path === 'infra/minikube/auth/oauth-runtime.md'
+            ? { ...file, content: getTargetAwareGuide(policy) }
+            : file),
+        providerLifecycle: baseArtifacts.providerLifecycle.map((lifecycle) => lifecycle.id === 'supabase-auth' ? applyRedirectPolicy(lifecycle, policy) : lifecycle),
+        warnings: [...baseArtifacts.warnings, ...targets.warnings],
+    };
+}
+function applyRedirectPolicy(lifecycle, policy) {
+    return {
+        ...lifecycle,
+        reconciliationCommands: lifecycle.reconciliationCommands.map((entry) => ({
+            ...entry,
+            command: rewriteReconciliationCommand(entry.command, policy),
+        })),
+        statusChecks: lifecycle.statusChecks.map((entry) => ({
+            ...entry,
+            command: getTargetAwareStatusCommand(policy),
+        })),
+    };
+}
+function rewriteReconciliationCommand(command, policy) {
+    const legacyPatterns = getLocalAuthRedirectPatterns(policy.callbackRoute).join(',');
+    const legacyPolicy = `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path},${legacyPatterns}"
+if [[ -n "\${OAUTH_NATIVE_REDIRECT_URLS:-}" ]]; then
+  oauth_redirect_allow_list="\${oauth_redirect_allow_list},\${OAUTH_NATIVE_REDIRECT_URLS}"
+fi`;
+    const staticRedirects = [...policy.localPatterns, ...policy.nativeRedirectUris].join(',');
+    const suffix = staticRedirects ? `,${staticRedirects}` : '';
+    const canonicalPolicy = policy.webEnabled
+        ? `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path}${suffix}"`
+        : `oauth_redirect_allow_list='${staticRedirects}'`;
+    let rewritten = replaceOnce(command, legacyPolicy, canonicalPolicy);
+    if (!policy.webEnabled) {
+        rewritten = replaceOnce(rewritten, 'oauth_site_url="${SITE_URL%/}"\n', '');
+    }
+    return rewritten;
+}
+function getTargetAwareStatusCommand(policy) {
+    const appCallback = policy.webEnabled
+        ? `if [[ -n "\${SITE_URL:-}" ]]; then
+  echo "- provider supabase-auth/app-callback: \${SITE_URL%/}/\${oauth_callback_path}"
+else
+  echo "- provider supabase-auth/app-callback: unavailable"
+fi`
+        : 'echo "- provider supabase-auth/app-callback: disabled (web target)"';
+    const localPatterns = policy.localPatterns.join(',') || 'none';
+    const nativeRedirects = policy.nativeRedirectUris.join(',') || 'none';
+    return `oauth_callback_route='${policy.callbackRoute}'
+oauth_callback_path="\${oauth_callback_route#/}"
+if [[ -n "\${API_EXTERNAL_URL:-}" ]]; then
+  echo "- provider supabase-auth/provider-callback: \${API_EXTERNAL_URL%/}/callback"
+else
+  echo "- provider supabase-auth/provider-callback: unavailable"
+fi
+${appCallback}
+echo "- provider supabase-auth/local-callback-patterns: ${localPatterns}"
+echo "- provider supabase-auth/native-callbacks: ${nativeRedirects}"`;
+}
+function getTargetAwareGuide(policy) {
+    const nativeRedirects = policy.nativeRedirectUris.length
+        ? policy.nativeRedirectUris.map((uri) => `- \`${uri}\``).join('\n')
+        : '- none';
+    return `# Supabase OAuth Runtime Reconciliation
+
+The provider callback remains project-owned. GoTrue-to-app redirects use the configured callback
+route \`${policy.callbackRoute}\` and are derived from \`AppManifest.deploy.targets\`.
+
+- Web target: ${policy.webEnabled ? 'enabled' : 'disabled'}
+- Native callbacks:
+${nativeRedirects}
+
+Local loopback patterns are emitted only for an enabled Web target. Native callbacks come only
+from enabled Android/iOS target schemes; no environment variable or slug-derived identity can add
+a native callback. Provider credential values remain sourced from trusted secret resolution.
+`;
+}
+function replaceOnce(value, search, replacement) {
+    if (!value.includes(search)) {
+        throw new Error('Supabase OAuth redirect reconciliation template drifted from its canonical form.');
+    }
+    return value.replace(search, replacement);
+}
+//# sourceMappingURL=targetAwareOAuthRuntime.js.map

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"targetAwareOAuthRuntime.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/targetAwareOAuthRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,gBAAgB,CAAC;AASvE,MAAM,UAAU,gDAAgD,CAAC,IAGhE;IACC,MAAM,aAAa,GAAG,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,eAAe,CAAC,EAAE,CAAC;QAC3F,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC7C,aAAa;QACb,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO;KAC3C,CAAC,CAAC;IACH,MAAM,MAAM,GAAmB;QAC7B,aAAa;QACb,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;QACpF,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,OAAO;QACL,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,IAAI,CAAC,IAAI,KAAK,sCAAsC;YAClD,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE;YACnD,CAAC,CAAC,IAAI,CACT;QACD,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CACtF;QACD,QAAQ,EAAE,CAAC,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,SAAoC,EACpC,MAAsB;IAEtB,OAAO;QACL,GAAG,SAAS;QACZ,sBAAsB,EAAE,SAAS,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvE,GAAG,KAAK;YACR,OAAO,EAAE,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;SAC7D,CAAC,CAAC;QACH,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnD,GAAG,KAAK;YACR,OAAO,EAAE,2BAA2B,CAAC,MAAM,CAAC;SAC7C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAe,EAAE,MAAsB;IAC3E,MAAM,cAAc,GAAG,4BAA4B,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,MAAM,YAAY,GAAG,4FAA4F,cAAc;;;GAG9H,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU;QACvC,CAAC,CAAC,2FAA2F,MAAM,GAAG;QACtG,CAAC,CAAC,8BAA8B,eAAe,GAAG,CAAC;IACrD,IAAI,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IAEpE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAsB;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU;QACnC,CAAC,CAAC;;;;GAIH;QACC,CAAC,CAAC,qEAAqE,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IAEtE,OAAO,yBAAyB,MAAM,CAAC,aAAa;;;;;;;EAOpD,WAAW;0DAC6C,aAAa;mDACpB,eAAe,GAAG,CAAC;AACtE,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAsB;IACjD,MAAM,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC,MAAM;QACtD,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnE,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO;;;UAGC,MAAM,CAAC,aAAa;;gBAEd,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;;EAExD,eAAe;;;;;CAKhB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,WAAmB;IACrE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';\nimport { resolveAuthTargetRedirectModel } from '../../../authTargetRedirects';\nimport type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';\nimport { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';\n\ninterface RedirectPolicy {\n  readonly callbackRoute: string;\n  readonly localPatterns: readonly string[];\n  readonly nativeRedirectUris: readonly string[];\n  readonly webEnabled: boolean;\n}\n\nexport function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args: {\n  readonly appManifest: InfrastructureGenerationOptions['appManifest'];\n  readonly manifest: InfraManifestInput;\n}): MinikubeAdapterArtifacts {\n  const baseArtifacts = generateSupabaseOAuthRuntimeArtifacts(args.manifest);\n  if (!baseArtifacts.providerLifecycle.some((lifecycle) => lifecycle.id === 'supabase-auth')) {\n    return baseArtifacts;\n  }\n\n  const callbackRoute = normalizeAuthCallbackRoute(args.manifest.auth?.oauth?.callbackRoute ?? '');\n  const targets = resolveAuthTargetRedirectModel({\n    callbackRoute,\n    targets: args.appManifest?.deploy?.targets,\n  });\n  const policy: RedirectPolicy = {\n    callbackRoute,\n    localPatterns: targets.webEnabled ? getLocalAuthRedirectPatterns(callbackRoute) : [],\n    nativeRedirectUris: targets.nativeRedirectUris,\n    webEnabled: targets.webEnabled,\n  };\n\n  return {\n    ...baseArtifacts,\n    files: baseArtifacts.files.map((file) =>\n      file.path === 'infra/minikube/auth/oauth-runtime.md'\n        ? { ...file, content: getTargetAwareGuide(policy) }\n        : file,\n    ),\n    providerLifecycle: baseArtifacts.providerLifecycle.map((lifecycle) =>\n      lifecycle.id === 'supabase-auth' ? applyRedirectPolicy(lifecycle, policy) : lifecycle,\n    ),\n    warnings: [...baseArtifacts.warnings, ...targets.warnings],\n  };\n}\n\nfunction applyRedirectPolicy(\n  lifecycle: MinikubeProviderLifecycle,\n  policy: RedirectPolicy,\n): MinikubeProviderLifecycle {\n  return {\n    ...lifecycle,\n    reconciliationCommands: lifecycle.reconciliationCommands.map((entry) => ({\n      ...entry,\n      command: rewriteReconciliationCommand(entry.command, policy),\n    })),\n    statusChecks: lifecycle.statusChecks.map((entry) => ({\n      ...entry,\n      command: getTargetAwareStatusCommand(policy),\n    })),\n  };\n}\n\nfunction rewriteReconciliationCommand(command: string, policy: RedirectPolicy): string {\n  const legacyPatterns = getLocalAuthRedirectPatterns(policy.callbackRoute).join(',');\n  const legacyPolicy = `oauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path},${legacyPatterns}\"\nif [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n  oauth_redirect_allow_list=\"\\${oauth_redirect_allow_list},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\nfi`;\n  const staticRedirects = [...policy.localPatterns, ...policy.nativeRedirectUris].join(',');\n  const suffix = staticRedirects ? `,${staticRedirects}` : '';\n  const canonicalPolicy = policy.webEnabled\n    ? `oauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path}${suffix}\"`\n    : `oauth_redirect_allow_list='${staticRedirects}'`;\n  let rewritten = replaceOnce(command, legacyPolicy, canonicalPolicy);\n\n  if (!policy.webEnabled) {\n    rewritten = replaceOnce(rewritten, 'oauth_site_url=\"${SITE_URL%/}\"\\n', '');\n  }\n\n  return rewritten;\n}\n\nfunction getTargetAwareStatusCommand(policy: RedirectPolicy): string {\n  const appCallback = policy.webEnabled\n    ? `if [[ -n \"\\${SITE_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/app-callback: \\${SITE_URL%/}/\\${oauth_callback_path}\"\nelse\n  echo \"- provider supabase-auth/app-callback: unavailable\"\nfi`\n    : 'echo \"- provider supabase-auth/app-callback: disabled (web target)\"';\n  const localPatterns = policy.localPatterns.join(',') || 'none';\n  const nativeRedirects = policy.nativeRedirectUris.join(',') || 'none';\n\n  return `oauth_callback_route='${policy.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\nif [[ -n \"\\${API_EXTERNAL_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/provider-callback: \\${API_EXTERNAL_URL%/}/callback\"\nelse\n  echo \"- provider supabase-auth/provider-callback: unavailable\"\nfi\n${appCallback}\necho \"- provider supabase-auth/local-callback-patterns: ${localPatterns}\"\necho \"- provider supabase-auth/native-callbacks: ${nativeRedirects}\"`;\n}\n\nfunction getTargetAwareGuide(policy: RedirectPolicy): string {\n  const nativeRedirects = policy.nativeRedirectUris.length\n    ? policy.nativeRedirectUris.map((uri) => `- \\`${uri}\\``).join('\\n')\n    : '- none';\n\n  return `# Supabase OAuth Runtime Reconciliation\n\nThe provider callback remains project-owned. GoTrue-to-app redirects use the configured callback\nroute \\`${policy.callbackRoute}\\` and are derived from \\`AppManifest.deploy.targets\\`.\n\n- Web target: ${policy.webEnabled ? 'enabled' : 'disabled'}\n- Native callbacks:\n${nativeRedirects}\n\nLocal loopback patterns are emitted only for an enabled Web target. Native callbacks come only\nfrom enabled Android/iOS target schemes; no environment variable or slug-derived identity can add\na native callback. Provider credential values remain sourced from trusted secret resolution.\n`;\n}\n\nfunction replaceOnce(value: string, search: string, replacement: string): string {\n  if (!value.includes(search)) {\n    throw new Error(\n      'Supabase OAuth redirect reconciliation template drifted from its canonical form.',\n    );\n  }\n  return value.replace(search, replacement);\n}\n"]}

package/dist/adapters/minikube/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AAUrB,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAkGhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AAUrB,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,+BAAoC,GAC5C,8BAA8B,CAsGhC"}

package/dist/adapters/minikube/index.js

@@ -15,7 +15,11 @@ export function generateMinikubeInfra(manifest, options = {}) {
     }
     const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);
     const namespace = APP_NAMESPACE;
-    const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });
+    const authArtifacts = generateAuthProviderArtifacts({
+        appManifest: options.appManifest,
+        manifest,
+        namespace,
+    });
     const authzArtifacts = generateAuthorizationArtifacts({
         manifest,
         namespace,

package/dist/adapters/minikube/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AAOnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC;IAEhC,MAAM,aAAa,GAAG,6BAA6B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;QAC1E,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa;QACjD,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,WAAW,CAAC,MAAM,CACzE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAChD,CAAC;IAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,kDAAkD,kBAAkB;aACjE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;aACtF,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG;QACxB,GAAG,aAAa,CAAC,iBAAiB;QAClC,GAAG,cAAc,CAAC,iBAAiB;QACnC,GAAG,gBAAgB,CAAC,iBAAiB;QACrC,GAAG,oBAAoB,CAAC,iBAAiB;KAC1C,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC;QAChC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;KACnE,CAAC,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,OAAO;QACP,cAAc;QACd,kBAAkB;QAClB,iBAAiB;QACjB,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,6BAA6B,CAAC,WAAW;aACzC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC;aACzD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;KAC3C,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,6BAA6B,CAAC,KAAK;SACvC;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kMAAkM,CACnM,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateGeneratedApiDatabaseArtifacts } from '../../generatedApiDatabase';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;\nconst BUILT_IN_NAMESPACES = new Set([APP_NAMESPACE, 'supabase']);\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);\n  const namespace = APP_NAMESPACE;\n\n  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const generatedApiDatabaseArtifacts = generateGeneratedApiDatabaseArtifacts({\n    generatedApis: options.appManifest?.generatedApis,\n    databaseProvider: manifest.database?.provider,\n  });\n  const generatedApiErrors = generatedApiDatabaseArtifacts.diagnostics.filter(\n    (diagnostic) => diagnostic.severity === 'error',\n  );\n\n  if (generatedApiErrors.length > 0) {\n    throw new Error(\n      `Generated API database definition is invalid:\\n${generatedApiErrors\n        .map((diagnostic) => `- ${diagnostic.path ?? diagnostic.apiId}: ${diagnostic.message}`)\n        .join('\\n')}`,\n    );\n  }\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const providerLifecycle = [\n    ...authArtifacts.providerLifecycle,\n    ...authzArtifacts.providerLifecycle,\n    ...storageArtifacts.providerLifecycle,\n    ...secretStoreArtifacts.providerLifecycle,\n  ];\n  const providerNamespaces = unique([\n    ...providerLifecycle.map((contribution) => contribution.namespace),\n  ]).filter((providerNamespace) => !BUILT_IN_NAMESPACES.has(providerNamespace));\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...generatedApiDatabaseArtifacts.diagnostics\n      .filter((diagnostic) => diagnostic.severity === 'warning')\n      .map((diagnostic) => diagnostic.message),\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...generatedApiDatabaseArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction validateCanonicalAppSlug(slug: string | undefined): string {\n  if (!slug) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug is required.',\n    );\n  }\n\n  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',\n    );\n  }\n\n  return slug;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/minikube/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AAOnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,UAA2C,EAAE;IAE7C,IAAI,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0EAA0E,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,WAAW,KAAK,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC;IAEhC,MAAM,aAAa,GAAG,6BAA6B,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ;QACR,SAAS;KACV,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,QAAQ;QACR,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;QAC1E,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa;QACjD,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ;KAC9C,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,WAAW,CAAC,MAAM,CACzE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAChD,CAAC;IAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,kDAAkD,kBAAkB;aACjE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;aACtF,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,GAAG,aAAa,CAAC,SAAS;QAC1B,GAAG,cAAc,CAAC,SAAS;QAC3B,GAAG,gBAAgB,CAAC,SAAS;QAC7B,GAAG,oBAAoB,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG;QACxB,GAAG,aAAa,CAAC,iBAAiB;QAClC,GAAG,cAAc,CAAC,iBAAiB;QACnC,GAAG,gBAAgB,CAAC,iBAAiB;QACrC,GAAG,oBAAoB,CAAC,iBAAiB;KAC1C,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC;QAChC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;KACnE,CAAC,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,aAAa,CAAC,UAAU;QAC3B,GAAG,cAAc,CAAC,UAAU;QAC5B,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,oBAAoB,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,QAAQ;QACR,OAAO;QACP,cAAc;QACd,kBAAkB;QAClB,iBAAiB;QACjB,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,GAAG,aAAa,CAAC,QAAQ;QACzB,GAAG,cAAc,CAAC,QAAQ;QAC1B,GAAG,gBAAgB,CAAC,QAAQ;QAC5B,GAAG,oBAAoB,CAAC,QAAQ;QAChC,GAAG,6BAA6B,CAAC,WAAW;aACzC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC;aACzD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;KAC3C,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,GAAG,aAAa,CAAC,KAAK;YACtB,GAAG,cAAc,CAAC,KAAK;YACvB,GAAG,gBAAgB,CAAC,KAAK;YACzB,GAAG,oBAAoB,CAAC,KAAK;YAC7B,GAAG,6BAA6B,CAAC,KAAK;SACvC;QACD,QAAQ;QACR,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACtC;QACD,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,0CAA0C;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kMAAkM,CACnM,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { generateGeneratedApiDatabaseArtifacts } from '../../generatedApiDatabase';\nimport type {\n  GeneratedPackageDependency,\n  InfraManifestInput,\n  InfrastructureGenerationOptions,\n  InfrastructureGenerationResult,\n} from '../../types';\nimport { generateAuthProviderArtifacts } from './auth';\nimport { generateAuthorizationArtifacts } from './authz';\nimport { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';\nimport { generateSecretStoreArtifacts } from './secrets';\nimport { generateStorageArtifacts } from './storage';\n\nconst CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;\nconst BUILT_IN_NAMESPACES = new Set([APP_NAMESPACE, 'supabase']);\n\nexport function generateMinikubeInfra(\n  manifest: InfraManifestInput,\n  options: InfrastructureGenerationOptions = {},\n): InfrastructureGenerationResult {\n  if (manifest.deployment?.target !== 'minikube') {\n    throw new Error(\n      `Minikube adapter only supports deployment target \"minikube\" (received \"${manifest.deployment?.target ?? 'undefined'}\").`,\n    );\n  }\n\n  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {\n    throw new Error(\n      `Unsupported database provider for minikube adapter: \"${manifest.database.provider}\". Only \"supabase\" is implemented.`,\n    );\n  }\n\n  const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);\n  const namespace = APP_NAMESPACE;\n\n  const authArtifacts = generateAuthProviderArtifacts({\n    appManifest: options.appManifest,\n    manifest,\n    namespace,\n  });\n  const authzArtifacts = generateAuthorizationArtifacts({\n    manifest,\n    namespace,\n    appManifest: options.appManifest,\n  });\n  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });\n  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });\n  const generatedApiDatabaseArtifacts = generateGeneratedApiDatabaseArtifacts({\n    generatedApis: options.appManifest?.generatedApis,\n    databaseProvider: manifest.database?.provider,\n  });\n  const generatedApiErrors = generatedApiDatabaseArtifacts.diagnostics.filter(\n    (diagnostic) => diagnostic.severity === 'error',\n  );\n\n  if (generatedApiErrors.length > 0) {\n    throw new Error(\n      `Generated API database definition is invalid:\\n${generatedApiErrors\n        .map((diagnostic) => `- ${diagnostic.path ?? diagnostic.apiId}: ${diagnostic.message}`)\n        .join('\\n')}`,\n    );\n  }\n\n  const extraResources = unique([\n    ...authArtifacts.resources,\n    ...authzArtifacts.resources,\n    ...storageArtifacts.resources,\n    ...secretStoreArtifacts.resources,\n  ]);\n  const providerLifecycle = [\n    ...authArtifacts.providerLifecycle,\n    ...authzArtifacts.providerLifecycle,\n    ...storageArtifacts.providerLifecycle,\n    ...secretStoreArtifacts.providerLifecycle,\n  ];\n  const providerNamespaces = unique([\n    ...providerLifecycle.map((contribution) => contribution.namespace),\n  ]).filter((providerNamespace) => !BUILT_IN_NAMESPACES.has(providerNamespace));\n  const extraEnvEntries = unique([\n    ...authArtifacts.envEntries,\n    ...authzArtifacts.envEntries,\n    ...storageArtifacts.envEntries,\n    ...secretStoreArtifacts.envEntries,\n  ]);\n\n  const baseFiles = generateMinikubeBaseArtifacts({\n    manifest,\n    appSlug,\n    extraResources,\n    providerNamespaces,\n    providerLifecycle,\n    extraEnvEntries,\n  });\n\n  const warnings = unique([\n    ...collectWarnings(manifest),\n    ...authArtifacts.warnings,\n    ...authzArtifacts.warnings,\n    ...storageArtifacts.warnings,\n    ...secretStoreArtifacts.warnings,\n    ...generatedApiDatabaseArtifacts.diagnostics\n      .filter((diagnostic) => diagnostic.severity === 'warning')\n      .map((diagnostic) => diagnostic.message),\n  ]);\n\n  return {\n    files: [\n      ...baseFiles,\n      ...authArtifacts.files,\n      ...authzArtifacts.files,\n      ...storageArtifacts.files,\n      ...secretStoreArtifacts.files,\n      ...generatedApiDatabaseArtifacts.files,\n    ],\n    warnings,\n    meta: {\n      target: 'minikube',\n      providers: collectProviders(manifest),\n    },\n    dependencies: collectDependencies(manifest),\n  };\n}\n\nfunction collectProviders(manifest: InfraManifestInput): string[] {\n  const providers = new Set<string>();\n\n  if (manifest.auth?.provider) providers.add(manifest.auth.provider);\n  if (manifest.auth?.authorization?.engine) {\n    providers.add(manifest.auth.authorization.engine);\n  }\n  if (manifest.database?.provider) providers.add(manifest.database.provider);\n  if (manifest.storage?.provider) providers.add(manifest.storage.provider);\n  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);\n  if (manifest.state?.provider) providers.add(manifest.state.provider);\n\n  return [...providers].sort();\n}\n\nfunction collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {\n  if (manifest.state?.provider !== 'legend') {\n    return [];\n  }\n\n  return [\n    {\n      name: '@ankhorage/state-legend',\n      version: '^0.1.0',\n      reason: 'Selected by infra.state.provider=legend.',\n    },\n  ];\n}\n\nfunction collectWarnings(manifest: InfraManifestInput): string[] {\n  const warnings: string[] = [];\n\n  if (manifest.deployment?.monitoring) {\n    warnings.push(\n      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',\n    );\n  }\n\n  if (manifest.networking?.cdn) {\n    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');\n  }\n\n  return warnings;\n}\n\nfunction validateCanonicalAppSlug(slug: string | undefined): string {\n  if (!slug) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug is required.',\n    );\n  }\n\n  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {\n    throw new Error(\n      'Cannot generate Minikube infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',\n    );\n  }\n\n  return slug;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n"]}

package/dist/authTargetRedirects.d.ts

@@ -0,0 +1,12 @@
+import type { AppDeployTargets } from '@ankhorage/contracts/deploy';
+interface AuthTargetRedirectModel {
+    readonly nativeRedirectUris: readonly string[];
+    readonly warnings: readonly string[];
+    readonly webEnabled: boolean;
+}
+export declare function resolveAuthTargetRedirectModel(args: {
+    readonly callbackRoute: string;
+    readonly targets: AppDeployTargets | undefined;
+}): AuthTargetRedirectModel;
+export {};
+//# sourceMappingURL=authTargetRedirects.d.ts.map

package/dist/authTargetRedirects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authTargetRedirects.d.ts","sourceRoot":"","sources":["../src/authTargetRedirects.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAChD,GAAG,uBAAuB,CAkC1B"}

package/dist/authTargetRedirects.js

@@ -0,0 +1,32 @@
+export function resolveAuthTargetRedirectModel(args) {
+    if (args.targets === undefined) {
+        return {
+            nativeRedirectUris: [],
+            warnings: [
+                'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
+            ],
+            webEnabled: true,
+        };
+    }
+    const callbackPath = args.callbackRoute.replace(/^\/+/u, '');
+    const nativeRedirectUris = [];
+    const warnings = [];
+    for (const [targetId, target] of [
+        ['android', args.targets.android],
+        ['ios', args.targets.ios],
+    ]) {
+        if (target?.enabled !== true)
+            continue;
+        if (target.scheme === undefined) {
+            warnings.push(`OAuth ${targetId} target is enabled but deploy.targets.${targetId}.scheme is missing; native callback omitted.`);
+            continue;
+        }
+        nativeRedirectUris.push(`${target.scheme}://${callbackPath}`);
+    }
+    return {
+        nativeRedirectUris: [...new Set(nativeRedirectUris)],
+        warnings,
+        webEnabled: args.targets.web?.enabled === true,
+    };
+}
+//# sourceMappingURL=authTargetRedirects.js.map

package/dist/authTargetRedirects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authTargetRedirects.js","sourceRoot":"","sources":["../src/authTargetRedirects.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,8BAA8B,CAAC,IAG9C;IACC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,kBAAkB,EAAE,EAAE;YACtB,QAAQ,EAAE;gBACR,8GAA8G;aAC/G;YACD,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI;QAC/B,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACjC,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;KACjB,EAAE,CAAC;QACX,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;YAAE,SAAS;QACvC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CACX,SAAS,QAAQ,yCAAyC,QAAQ,8CAA8C,CACjH,CAAC;YACF,SAAS;QACX,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,MAAM,YAAY,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACL,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI;KAC/C,CAAC;AACJ,CAAC","sourcesContent":["import type { AppDeployTargets } from '@ankhorage/contracts/deploy';\n\ninterface AuthTargetRedirectModel {\n  readonly nativeRedirectUris: readonly string[];\n  readonly warnings: readonly string[];\n  readonly webEnabled: boolean;\n}\n\nexport function resolveAuthTargetRedirectModel(args: {\n  readonly callbackRoute: string;\n  readonly targets: AppDeployTargets | undefined;\n}): AuthTargetRedirectModel {\n  if (args.targets === undefined) {\n    return {\n      nativeRedirectUris: [],\n      warnings: [\n        'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',\n      ],\n      webEnabled: true,\n    };\n  }\n\n  const callbackPath = args.callbackRoute.replace(/^\\/+/u, '');\n  const nativeRedirectUris: string[] = [];\n  const warnings: string[] = [];\n\n  for (const [targetId, target] of [\n    ['android', args.targets.android],\n    ['ios', args.targets.ios],\n  ] as const) {\n    if (target?.enabled !== true) continue;\n    if (target.scheme === undefined) {\n      warnings.push(\n        `OAuth ${targetId} target is enabled but deploy.targets.${targetId}.scheme is missing; native callback omitted.`,\n      );\n      continue;\n    }\n    nativeRedirectUris.push(`${target.scheme}://${callbackPath}`);\n  }\n\n  return {\n    nativeRedirectUris: [...new Set(nativeRedirectUris)],\n    warnings,\n    webEnabled: args.targets.web?.enabled === true,\n  };\n}\n"]}

package/dist/types.d.ts

@@ -30,7 +30,7 @@ export interface InfrastructureGenerationOptions {
     /**
      * Optional app-level context used by provider/engine-specific generators.
      */
-    readonly appManifest?: Pick<AppManifest, 'generatedApis' | 'infra' | 'metadata' | 'navigator' | 'screens' | 'settings'>;
+    readonly appManifest?: Pick<AppManifest, 'deploy' | 'generatedApis' | 'infra' | 'metadata' | 'navigator' | 'screens' | 'settings'>;
 }
 export interface InfraGenerationInput {
     /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEvE,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACvD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAC9D;AAED,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CACzB,WAAW,EACX,eAAe,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAC9E,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC;CACpD;AAED,MAAM,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AACrE,MAAM,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AACnE,MAAM,MAAM,aAAa,GAAG,2BAA2B,CAAC;AACxD,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,KAAK,oBAAoB,GAAG,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;AAE3F,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEvE,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACvD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAC9D;AAED,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CACzB,WAAW,EACX,QAAQ,GAAG,eAAe,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CACzF,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC;CACpD;AAED,MAAM,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AACrE,MAAM,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AACnE,MAAM,MAAM,aAAa,GAAG,2BAA2B,CAAC;AACxD,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,KAAK,oBAAoB,GAAG,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;AAE3F,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C,CAAC"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { AppManifest, InfraManifest } from '@ankhorage/contracts';\n\nexport interface GeneratedInfrastructureFile {\n  /**\n   * Path relative to the target app root.\n   */\n  readonly path: string;\n  readonly content: string;\n  readonly executable?: boolean;\n}\n\nexport interface GeneratedPackageDependency {\n  readonly name: string;\n  readonly version: string;\n  readonly reason: string;\n}\n\nexport interface InfrastructureGenerationMeta {\n  readonly target: NonNullable<InfraManifest['deployment']>['target'];\n  readonly providers: readonly string[];\n}\n\nexport interface InfrastructureGenerationResult {\n  readonly files: readonly GeneratedInfrastructureFile[];\n  readonly warnings: readonly string[];\n  readonly meta: InfrastructureGenerationMeta;\n  readonly dependencies: readonly GeneratedPackageDependency[];\n}\n\nexport interface InfrastructureGenerationOptions {\n  /**\n   * Optional namespace hint from caller context, such as app slug or project id.\n   */\n  readonly namespaceHint?: string;\n  /**\n   * Optional app-level context used by provider/engine-specific generators.\n   */\n  readonly appManifest?: Pick<\n    AppManifest,\n    'generatedApis' | 'infra' | 'metadata' | 'navigator' | 'screens' | 'settings'\n  >;\n}\n\nexport interface InfraGenerationInput {\n  /**\n   * Infra manifest section from an app manifest.\n   */\n  readonly manifest: InfraManifestInput;\n  /**\n   * Optional root used by callers that want to keep output intent alongside generation.\n   * The generator itself still returns relative file paths and does not write to disk.\n   */\n  readonly outputRoot?: string;\n  readonly options?: InfrastructureGenerationOptions;\n}\n\nexport type InfraGenerationOptions = InfrastructureGenerationOptions;\nexport type InfraGenerationResult = InfrastructureGenerationResult;\nexport type GeneratedFile = GeneratedInfrastructureFile;\nexport type PackageDependency = GeneratedPackageDependency;\n\nexport interface InfraDiagnostic {\n  readonly severity: 'warning';\n  readonly message: string;\n}\n\ntype InfraStorageProvider = NonNullable<InfraManifest['storage']>['provider'] | 'supabase';\n\ninterface InfraStorageSpecInput {\n  readonly provider: InfraStorageProvider;\n  readonly buckets: readonly string[];\n}\n\n/**\n * Infra-local manifest input type.\n *\n * This is intentionally broader than `@ankhorage/contracts` to allow adapters to support\n * additional providers before the shared contracts package officially includes them.\n */\nexport type InfraManifestInput = Omit<InfraManifest, 'storage'> & {\n  readonly storage?: InfraStorageSpecInput;\n};\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { AppManifest, InfraManifest } from '@ankhorage/contracts';\n\nexport interface GeneratedInfrastructureFile {\n  /**\n   * Path relative to the target app root.\n   */\n  readonly path: string;\n  readonly content: string;\n  readonly executable?: boolean;\n}\n\nexport interface GeneratedPackageDependency {\n  readonly name: string;\n  readonly version: string;\n  readonly reason: string;\n}\n\nexport interface InfrastructureGenerationMeta {\n  readonly target: NonNullable<InfraManifest['deployment']>['target'];\n  readonly providers: readonly string[];\n}\n\nexport interface InfrastructureGenerationResult {\n  readonly files: readonly GeneratedInfrastructureFile[];\n  readonly warnings: readonly string[];\n  readonly meta: InfrastructureGenerationMeta;\n  readonly dependencies: readonly GeneratedPackageDependency[];\n}\n\nexport interface InfrastructureGenerationOptions {\n  /**\n   * Optional namespace hint from caller context, such as app slug or project id.\n   */\n  readonly namespaceHint?: string;\n  /**\n   * Optional app-level context used by provider/engine-specific generators.\n   */\n  readonly appManifest?: Pick<\n    AppManifest,\n    'deploy' | 'generatedApis' | 'infra' | 'metadata' | 'navigator' | 'screens' | 'settings'\n  >;\n}\n\nexport interface InfraGenerationInput {\n  /**\n   * Infra manifest section from an app manifest.\n   */\n  readonly manifest: InfraManifestInput;\n  /**\n   * Optional root used by callers that want to keep output intent alongside generation.\n   * The generator itself still returns relative file paths and does not write to disk.\n   */\n  readonly outputRoot?: string;\n  readonly options?: InfrastructureGenerationOptions;\n}\n\nexport type InfraGenerationOptions = InfrastructureGenerationOptions;\nexport type InfraGenerationResult = InfrastructureGenerationResult;\nexport type GeneratedFile = GeneratedInfrastructureFile;\nexport type PackageDependency = GeneratedPackageDependency;\n\nexport interface InfraDiagnostic {\n  readonly severity: 'warning';\n  readonly message: string;\n}\n\ntype InfraStorageProvider = NonNullable<InfraManifest['storage']>['provider'] | 'supabase';\n\ninterface InfraStorageSpecInput {\n  readonly provider: InfraStorageProvider;\n  readonly buckets: readonly string[];\n}\n\n/**\n * Infra-local manifest input type.\n *\n * This is intentionally broader than `@ankhorage/contracts` to allow adapters to support\n * additional providers before the shared contracts package officially includes them.\n */\nexport type InfraManifestInput = Omit<InfraManifest, 'storage'> & {\n  readonly storage?: InfraStorageSpecInput;\n};\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -35,7 +35,7 @@
     "openapi"
   ],
   "dependencies": {
-    "@ankhorage/contracts": "^7.2.0",
+    "@ankhorage/contracts": "^7.7.0",
     "@ankhorage/supabase-vault": "^0.2.4"
   },
   "files": [

package/src/adapters/minikube/auth/index.ts

@@ -1,13 +1,14 @@
-import type { InfraManifestInput } from '../../../types';
+import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';
 import { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';
-import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
 import { generateSupabaseAuthArtifacts } from './supabase';
+import { generateTargetAwareSupabaseOAuthRuntimeArtifacts } from './targetAwareOAuthRuntime';
 
 export function generateAuthProviderArtifacts(args: {
+  appManifest: InfrastructureGenerationOptions['appManifest'];
   manifest: InfraManifestInput;
   namespace: string;
 }): MinikubeAdapterArtifacts {
-  const { manifest, namespace } = args;
+  const { appManifest, manifest, namespace } = args;
   const { auth } = manifest;
 
   if (!auth) {
@@ -21,7 +22,10 @@ export function generateAuthProviderArtifacts(args: {
   }
 
   const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });
-  const oauthArtifacts = generateSupabaseOAuthRuntimeArtifacts(manifest);
+  const oauthArtifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({
+    appManifest,
+    manifest,
+  });
 
   return {
     files: [...providerArtifacts.files, ...oauthArtifacts.files],

package/src/adapters/minikube/auth/targetAwareOAuthRuntime.test.ts

@@ -0,0 +1,83 @@
+import type { InfraManifest } from '@ankhorage/contracts';
+import { describe, expect, test } from 'bun:test';
+
+import { createAppManifest } from '../../../testSupport';
+import { generateTargetAwareSupabaseOAuthRuntimeArtifacts } from './targetAwareOAuthRuntime';
+
+describe('target-aware Supabase OAuth runtime', () => {
+  test('removes the legacy native redirect environment source', () => {
+    const artifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({
+      appManifest: undefined,
+      manifest: createOAuthManifest(),
+    });
+    const [lifecycle] = artifacts.providerLifecycle;
+    const command = lifecycle?.reconciliationCommands[0]?.command ?? '';
+
+    expect(command).toContain('http://127.0.0.1:*/auth/callback');
+    expect(command).toContain('http://localhost:*/auth/callback');
+    expect(command).not.toContain('OAUTH_NATIVE_REDIRECT_URLS');
+    expect(artifacts.warnings).toEqual([
+      'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
+    ]);
+  });
+
+  test('emits only the enabled native callback for a native-only app', () => {
+    const appManifest = {
+      ...createAppManifest('native-oauth'),
+      deploy: {
+        targets: {
+          web: { enabled: false },
+          android: {
+            enabled: true,
+            package: 'com.ankh.native',
+            scheme: 'ankh-native',
+          },
+          ios: {
+            enabled: false,
+            bundleIdentifier: 'com.ankh.native',
+          },
+        },
+      },
+    };
+    const artifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({
+      appManifest,
+      manifest: createOAuthManifest(),
+    });
+    const [lifecycle] = artifacts.providerLifecycle;
+    const command = lifecycle?.reconciliationCommands[0]?.command ?? '';
+    const status = lifecycle?.statusChecks[0]?.command ?? '';
+
+    expect(command).toContain("oauth_redirect_allow_list='ankh-native://auth/callback'");
+    expect(command).not.toContain('oauth_site_url');
+    expect(command).not.toContain('localhost:*');
+    expect(command).not.toContain('127.0.0.1:*');
+    expect(command).not.toContain('OAUTH_NATIVE_REDIRECT_URLS');
+    expect(status).toContain('app-callback: disabled (web target)');
+    expect(status).toContain('native-callbacks: ankh-native://auth/callback');
+    expect(artifacts.warnings).toEqual([]);
+  });
+});
+
+function createOAuthManifest(): InfraManifest {
+  return {
+    deployment: { target: 'minikube', monitoring: false },
+    auth: {
+      scope: 'global',
+      provider: 'supabase',
+      oauth: {
+        enabled: true,
+        callbackRoute: '/auth/callback',
+        providers: [
+          {
+            id: 'google',
+            enabled: true,
+            credentialsRef: 'auth/oauth/google',
+          },
+        ],
+      },
+    },
+    database: { provider: 'supabase', tier: 'dev' },
+    secretStore: { provider: 'supabase-vault' },
+    modules: [],
+  };
+}

package/src/adapters/minikube/auth/targetAwareOAuthRuntime.ts

@@ -0,0 +1,136 @@
+import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';
+import { resolveAuthTargetRedirectModel } from '../../../authTargetRedirects';
+import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';
+import type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';
+import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
+
+interface RedirectPolicy {
+  readonly callbackRoute: string;
+  readonly localPatterns: readonly string[];
+  readonly nativeRedirectUris: readonly string[];
+  readonly webEnabled: boolean;
+}
+
+export function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args: {
+  readonly appManifest: InfrastructureGenerationOptions['appManifest'];
+  readonly manifest: InfraManifestInput;
+}): MinikubeAdapterArtifacts {
+  const baseArtifacts = generateSupabaseOAuthRuntimeArtifacts(args.manifest);
+  if (!baseArtifacts.providerLifecycle.some((lifecycle) => lifecycle.id === 'supabase-auth')) {
+    return baseArtifacts;
+  }
+
+  const callbackRoute = normalizeAuthCallbackRoute(args.manifest.auth?.oauth?.callbackRoute ?? '');
+  const targets = resolveAuthTargetRedirectModel({
+    callbackRoute,
+    targets: args.appManifest?.deploy?.targets,
+  });
+  const policy: RedirectPolicy = {
+    callbackRoute,
+    localPatterns: targets.webEnabled ? getLocalAuthRedirectPatterns(callbackRoute) : [],
+    nativeRedirectUris: targets.nativeRedirectUris,
+    webEnabled: targets.webEnabled,
+  };
+
+  return {
+    ...baseArtifacts,
+    files: baseArtifacts.files.map((file) =>
+      file.path === 'infra/minikube/auth/oauth-runtime.md'
+        ? { ...file, content: getTargetAwareGuide(policy) }
+        : file,
+    ),
+    providerLifecycle: baseArtifacts.providerLifecycle.map((lifecycle) =>
+      lifecycle.id === 'supabase-auth' ? applyRedirectPolicy(lifecycle, policy) : lifecycle,
+    ),
+    warnings: [...baseArtifacts.warnings, ...targets.warnings],
+  };
+}
+
+function applyRedirectPolicy(
+  lifecycle: MinikubeProviderLifecycle,
+  policy: RedirectPolicy,
+): MinikubeProviderLifecycle {
+  return {
+    ...lifecycle,
+    reconciliationCommands: lifecycle.reconciliationCommands.map((entry) => ({
+      ...entry,
+      command: rewriteReconciliationCommand(entry.command, policy),
+    })),
+    statusChecks: lifecycle.statusChecks.map((entry) => ({
+      ...entry,
+      command: getTargetAwareStatusCommand(policy),
+    })),
+  };
+}
+
+function rewriteReconciliationCommand(command: string, policy: RedirectPolicy): string {
+  const legacyPatterns = getLocalAuthRedirectPatterns(policy.callbackRoute).join(',');
+  const legacyPolicy = `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path},${legacyPatterns}"
+if [[ -n "\${OAUTH_NATIVE_REDIRECT_URLS:-}" ]]; then
+  oauth_redirect_allow_list="\${oauth_redirect_allow_list},\${OAUTH_NATIVE_REDIRECT_URLS}"
+fi`;
+  const staticRedirects = [...policy.localPatterns, ...policy.nativeRedirectUris].join(',');
+  const suffix = staticRedirects ? `,${staticRedirects}` : '';
+  const canonicalPolicy = policy.webEnabled
+    ? `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path}${suffix}"`
+    : `oauth_redirect_allow_list='${staticRedirects}'`;
+  let rewritten = replaceOnce(command, legacyPolicy, canonicalPolicy);
+
+  if (!policy.webEnabled) {
+    rewritten = replaceOnce(rewritten, 'oauth_site_url="${SITE_URL%/}"\n', '');
+  }
+
+  return rewritten;
+}
+
+function getTargetAwareStatusCommand(policy: RedirectPolicy): string {
+  const appCallback = policy.webEnabled
+    ? `if [[ -n "\${SITE_URL:-}" ]]; then
+  echo "- provider supabase-auth/app-callback: \${SITE_URL%/}/\${oauth_callback_path}"
+else
+  echo "- provider supabase-auth/app-callback: unavailable"
+fi`
+    : 'echo "- provider supabase-auth/app-callback: disabled (web target)"';
+  const localPatterns = policy.localPatterns.join(',') || 'none';
+  const nativeRedirects = policy.nativeRedirectUris.join(',') || 'none';
+
+  return `oauth_callback_route='${policy.callbackRoute}'
+oauth_callback_path="\${oauth_callback_route#/}"
+if [[ -n "\${API_EXTERNAL_URL:-}" ]]; then
+  echo "- provider supabase-auth/provider-callback: \${API_EXTERNAL_URL%/}/callback"
+else
+  echo "- provider supabase-auth/provider-callback: unavailable"
+fi
+${appCallback}
+echo "- provider supabase-auth/local-callback-patterns: ${localPatterns}"
+echo "- provider supabase-auth/native-callbacks: ${nativeRedirects}"`;
+}
+
+function getTargetAwareGuide(policy: RedirectPolicy): string {
+  const nativeRedirects = policy.nativeRedirectUris.length
+    ? policy.nativeRedirectUris.map((uri) => `- \`${uri}\``).join('\n')
+    : '- none';
+
+  return `# Supabase OAuth Runtime Reconciliation
+
+The provider callback remains project-owned. GoTrue-to-app redirects use the configured callback
+route \`${policy.callbackRoute}\` and are derived from \`AppManifest.deploy.targets\`.
+
+- Web target: ${policy.webEnabled ? 'enabled' : 'disabled'}
+- Native callbacks:
+${nativeRedirects}
+
+Local loopback patterns are emitted only for an enabled Web target. Native callbacks come only
+from enabled Android/iOS target schemes; no environment variable or slug-derived identity can add
+a native callback. Provider credential values remain sourced from trusted secret resolution.
+`;
+}
+
+function replaceOnce(value: string, search: string, replacement: string): string {
+  if (!value.includes(search)) {
+    throw new Error(
+      'Supabase OAuth redirect reconciliation template drifted from its canonical form.',
+    );
+  }
+  return value.replace(search, replacement);
+}

package/src/adapters/minikube/index.ts

@@ -33,7 +33,11 @@ export function generateMinikubeInfra(
   const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);
   const namespace = APP_NAMESPACE;
 
-  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });
+  const authArtifacts = generateAuthProviderArtifacts({
+    appManifest: options.appManifest,
+    manifest,
+    namespace,
+  });
   const authzArtifacts = generateAuthorizationArtifacts({
     manifest,
     namespace,

package/src/authTargetRedirects.test.ts

@@ -0,0 +1,62 @@
+import type { AppDeployTargets } from '@ankhorage/contracts/deploy';
+import { describe, expect, test } from 'bun:test';
+
+import { resolveAuthTargetRedirectModel } from './authTargetRedirects';
+
+describe('resolveAuthTargetRedirectModel', () => {
+  test('derives enabled native callbacks and deduplicates shared schemes', () => {
+    const targets: AppDeployTargets = {
+      web: { enabled: true },
+      android: {
+        enabled: true,
+        package: 'com.ankh.demo',
+        scheme: 'ankh-demo',
+      },
+      ios: {
+        enabled: true,
+        bundleIdentifier: 'com.ankh.demo',
+        scheme: 'ankh-demo',
+      },
+    };
+
+    expect(resolveAuthTargetRedirectModel({ callbackRoute: '/auth/callback', targets })).toEqual({
+      nativeRedirectUris: ['ankh-demo://auth/callback'],
+      warnings: [],
+      webEnabled: true,
+    });
+  });
+
+  test('omits disabled targets and warns instead of guessing missing native schemes', () => {
+    const targets: AppDeployTargets = {
+      web: { enabled: false },
+      android: {
+        enabled: false,
+        package: 'com.ankh.demo',
+      },
+      ios: {
+        enabled: true,
+        bundleIdentifier: 'com.ankh.demo',
+      },
+    };
+
+    const result = resolveAuthTargetRedirectModel({ callbackRoute: '/auth/callback', targets });
+
+    expect(result.nativeRedirectUris).toEqual([]);
+    expect(result.webEnabled).toBe(false);
+    expect(result.warnings).toEqual([
+      'OAuth ios target is enabled but deploy.targets.ios.scheme is missing; native callback omitted.',
+    ]);
+  });
+
+  test('keeps the pre-target manifest path Web-only and explicit', () => {
+    expect(
+      resolveAuthTargetRedirectModel({ callbackRoute: '/auth/callback', targets: undefined }),
+    ).toEqual({
+      nativeRedirectUris: [],
+      warnings: [
+        'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
+      ],
+      webEnabled: true,
+    });
+  });
+});

package/src/authTargetRedirects.ts

@@ -0,0 +1,46 @@
+import type { AppDeployTargets } from '@ankhorage/contracts/deploy';
+
+interface AuthTargetRedirectModel {
+  readonly nativeRedirectUris: readonly string[];
+  readonly warnings: readonly string[];
+  readonly webEnabled: boolean;
+}
+
+export function resolveAuthTargetRedirectModel(args: {
+  readonly callbackRoute: string;
+  readonly targets: AppDeployTargets | undefined;
+}): AuthTargetRedirectModel {
+  if (args.targets === undefined) {
+    return {
+      nativeRedirectUris: [],
+      warnings: [
+        'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
+      ],
+      webEnabled: true,
+    };
+  }
+
+  const callbackPath = args.callbackRoute.replace(/^\/+/u, '');
+  const nativeRedirectUris: string[] = [];
+  const warnings: string[] = [];
+
+  for (const [targetId, target] of [
+    ['android', args.targets.android],
+    ['ios', args.targets.ios],
+  ] as const) {
+    if (target?.enabled !== true) continue;
+    if (target.scheme === undefined) {
+      warnings.push(
+        `OAuth ${targetId} target is enabled but deploy.targets.${targetId}.scheme is missing; native callback omitted.`,
+      );
+      continue;
+    }
+    nativeRedirectUris.push(`${target.scheme}://${callbackPath}`);
+  }
+
+  return {
+    nativeRedirectUris: [...new Set(nativeRedirectUris)],
+    warnings,
+    webEnabled: args.targets.web?.enabled === true,
+  };
+}

package/src/types.ts

@@ -37,7 +37,7 @@ export interface InfrastructureGenerationOptions {
    */
   readonly appManifest?: Pick<
     AppManifest,
-    'generatedApis' | 'infra' | 'metadata' | 'navigator' | 'screens' | 'settings'
+    'deploy' | 'generatedApis' | 'infra' | 'metadata' | 'navigator' | 'screens' | 'settings'
   >;
 }