@ankhorage/infra 3.2.0 → 4.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "3.2.0",
+  "version": "4.0.0",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -35,7 +35,7 @@
     "openapi"
   ],
   "dependencies": {
-    "@ankhorage/contracts": "^7.2.0",
+    "@ankhorage/contracts": "^8.0.0",
     "@ankhorage/supabase-vault": "^0.2.4"
   },
   "files": [
@@ -106,13 +106,13 @@
     "version-packages": "changeset version"
   },
   "devDependencies": {
-    "@ankhorage/ankh": "^0.4.0",
-    "@ankhorage/devtools": "^1.0.6",
-    "@ankhorage/paradox": "^0.1.10",
+    "@ankhorage/ankh": "^0.8.1",
+    "@ankhorage/devtools": "^1.2.1",
+    "@ankhorage/paradox": "^0.1.21",
     "@changesets/cli": "^2.31.0",
-    "@types/bun": "^1.3.13",
+    "@types/bun": "^1.3.14",
     "@types/node": "^25.6.0",
     "typescript": "^5.9.3"
   },
-  "packageManager": "bun@1.3.13"
+  "packageManager": "bun@1.3.14"
 }

package/src/adapters/minikube/auth/index.ts

@@ -1,13 +1,14 @@
-import type { InfraManifestInput } from '../../../types';
+import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';
 import { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';
-import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
 import { generateSupabaseAuthArtifacts } from './supabase';
+import { generateTargetAwareSupabaseOAuthRuntimeArtifacts } from './targetAwareOAuthRuntime';
 
 export function generateAuthProviderArtifacts(args: {
+  appManifest: InfrastructureGenerationOptions['appManifest'];
   manifest: InfraManifestInput;
   namespace: string;
 }): MinikubeAdapterArtifacts {
-  const { manifest, namespace } = args;
+  const { appManifest, manifest, namespace } = args;
   const { auth } = manifest;
 
   if (!auth) {
@@ -21,7 +22,10 @@ export function generateAuthProviderArtifacts(args: {
   }
 
   const providerArtifacts = generateSupabaseAuthArtifacts({ manifest, namespace });
-  const oauthArtifacts = generateSupabaseOAuthRuntimeArtifacts(manifest);
+  const oauthArtifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({
+    appManifest,
+    manifest,
+  });
 
   return {
     files: [...providerArtifacts.files, ...oauthArtifacts.files],

package/src/adapters/minikube/auth/targetAwareOAuthRuntime.test.ts

@@ -0,0 +1,83 @@
+import type { InfraManifest } from '@ankhorage/contracts';
+import { describe, expect, test } from 'bun:test';
+
+import { createAppManifest } from '../../../testSupport';
+import { generateTargetAwareSupabaseOAuthRuntimeArtifacts } from './targetAwareOAuthRuntime';
+
+describe('target-aware Supabase OAuth runtime', () => {
+  test('removes the legacy native redirect environment source', () => {
+    const artifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({
+      appManifest: undefined,
+      manifest: createOAuthManifest(),
+    });
+    const [lifecycle] = artifacts.providerLifecycle;
+    const command = lifecycle?.reconciliationCommands[0]?.command ?? '';
+
+    expect(command).toContain('http://127.0.0.1:*/auth/callback');
+    expect(command).toContain('http://localhost:*/auth/callback');
+    expect(command).not.toContain('OAUTH_NATIVE_REDIRECT_URLS');
+    expect(artifacts.warnings).toEqual([
+      'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
+    ]);
+  });
+
+  test('emits only the enabled native callback for a native-only app', () => {
+    const appManifest = {
+      ...createAppManifest('native-oauth'),
+      deploy: {
+        targets: {
+          web: { enabled: false },
+          android: {
+            enabled: true,
+            package: 'com.ankh.native',
+            scheme: 'ankh-native',
+          },
+          ios: {
+            enabled: false,
+            bundleIdentifier: 'com.ankh.native',
+          },
+        },
+      },
+    };
+    const artifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({
+      appManifest,
+      manifest: createOAuthManifest(),
+    });
+    const [lifecycle] = artifacts.providerLifecycle;
+    const command = lifecycle?.reconciliationCommands[0]?.command ?? '';
+    const status = lifecycle?.statusChecks[0]?.command ?? '';
+
+    expect(command).toContain("oauth_redirect_allow_list='ankh-native://auth/callback'");
+    expect(command).not.toContain('oauth_site_url');
+    expect(command).not.toContain('localhost:*');
+    expect(command).not.toContain('127.0.0.1:*');
+    expect(command).not.toContain('OAUTH_NATIVE_REDIRECT_URLS');
+    expect(status).toContain('app-callback: disabled (web target)');
+    expect(status).toContain('native-callbacks: ankh-native://auth/callback');
+    expect(artifacts.warnings).toEqual([]);
+  });
+});
+
+function createOAuthManifest(): InfraManifest {
+  return {
+    deployment: { target: 'minikube', monitoring: false },
+    auth: {
+      scope: 'global',
+      provider: 'supabase',
+      oauth: {
+        enabled: true,
+        callbackRoute: '/auth/callback',
+        providers: [
+          {
+            id: 'google',
+            enabled: true,
+            credentialsRef: 'auth/oauth/google',
+          },
+        ],
+      },
+    },
+    database: { provider: 'supabase', tier: 'dev' },
+    secretStore: { provider: 'supabase-vault' },
+    modules: [],
+  };
+}

package/src/adapters/minikube/auth/targetAwareOAuthRuntime.ts

@@ -0,0 +1,136 @@
+import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';
+import { resolveAuthTargetRedirectModel } from '../../../authTargetRedirects';
+import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';
+import type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';
+import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
+
+interface RedirectPolicy {
+  readonly callbackRoute: string;
+  readonly localPatterns: readonly string[];
+  readonly nativeRedirectUris: readonly string[];
+  readonly webEnabled: boolean;
+}
+
+export function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args: {
+  readonly appManifest: InfrastructureGenerationOptions['appManifest'];
+  readonly manifest: InfraManifestInput;
+}): MinikubeAdapterArtifacts {
+  const baseArtifacts = generateSupabaseOAuthRuntimeArtifacts(args.manifest);
+  if (!baseArtifacts.providerLifecycle.some((lifecycle) => lifecycle.id === 'supabase-auth')) {
+    return baseArtifacts;
+  }
+
+  const callbackRoute = normalizeAuthCallbackRoute(args.manifest.auth?.oauth?.callbackRoute ?? '');
+  const targets = resolveAuthTargetRedirectModel({
+    callbackRoute,
+    targets: args.appManifest?.deploy?.targets,
+  });
+  const policy: RedirectPolicy = {
+    callbackRoute,
+    localPatterns: targets.webEnabled ? getLocalAuthRedirectPatterns(callbackRoute) : [],
+    nativeRedirectUris: targets.nativeRedirectUris,
+    webEnabled: targets.webEnabled,
+  };
+
+  return {
+    ...baseArtifacts,
+    files: baseArtifacts.files.map((file) =>
+      file.path === 'infra/minikube/auth/oauth-runtime.md'
+        ? { ...file, content: getTargetAwareGuide(policy) }
+        : file,
+    ),
+    providerLifecycle: baseArtifacts.providerLifecycle.map((lifecycle) =>
+      lifecycle.id === 'supabase-auth' ? applyRedirectPolicy(lifecycle, policy) : lifecycle,
+    ),
+    warnings: [...baseArtifacts.warnings, ...targets.warnings],
+  };
+}
+
+function applyRedirectPolicy(
+  lifecycle: MinikubeProviderLifecycle,
+  policy: RedirectPolicy,
+): MinikubeProviderLifecycle {
+  return {
+    ...lifecycle,
+    reconciliationCommands: lifecycle.reconciliationCommands.map((entry) => ({
+      ...entry,
+      command: rewriteReconciliationCommand(entry.command, policy),
+    })),
+    statusChecks: lifecycle.statusChecks.map((entry) => ({
+      ...entry,
+      command: getTargetAwareStatusCommand(policy),
+    })),
+  };
+}
+
+function rewriteReconciliationCommand(command: string, policy: RedirectPolicy): string {
+  const legacyPatterns = getLocalAuthRedirectPatterns(policy.callbackRoute).join(',');
+  const legacyPolicy = `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path},${legacyPatterns}"
+if [[ -n "\${OAUTH_NATIVE_REDIRECT_URLS:-}" ]]; then
+  oauth_redirect_allow_list="\${oauth_redirect_allow_list},\${OAUTH_NATIVE_REDIRECT_URLS}"
+fi`;
+  const staticRedirects = [...policy.localPatterns, ...policy.nativeRedirectUris].join(',');
+  const suffix = staticRedirects ? `,${staticRedirects}` : '';
+  const canonicalPolicy = policy.webEnabled
+    ? `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path}${suffix}"`
+    : `oauth_redirect_allow_list='${staticRedirects}'`;
+  let rewritten = replaceOnce(command, legacyPolicy, canonicalPolicy);
+
+  if (!policy.webEnabled) {
+    rewritten = replaceOnce(rewritten, 'oauth_site_url="${SITE_URL%/}"\n', '');
+  }
+
+  return rewritten;
+}
+
+function getTargetAwareStatusCommand(policy: RedirectPolicy): string {
+  const appCallback = policy.webEnabled
+    ? `if [[ -n "\${SITE_URL:-}" ]]; then
+  echo "- provider supabase-auth/app-callback: \${SITE_URL%/}/\${oauth_callback_path}"
+else
+  echo "- provider supabase-auth/app-callback: unavailable"
+fi`
+    : 'echo "- provider supabase-auth/app-callback: disabled (web target)"';
+  const localPatterns = policy.localPatterns.join(',') || 'none';
+  const nativeRedirects = policy.nativeRedirectUris.join(',') || 'none';
+
+  return `oauth_callback_route='${policy.callbackRoute}'
+oauth_callback_path="\${oauth_callback_route#/}"
+if [[ -n "\${API_EXTERNAL_URL:-}" ]]; then
+  echo "- provider supabase-auth/provider-callback: \${API_EXTERNAL_URL%/}/callback"
+else
+  echo "- provider supabase-auth/provider-callback: unavailable"
+fi
+${appCallback}
+echo "- provider supabase-auth/local-callback-patterns: ${localPatterns}"
+echo "- provider supabase-auth/native-callbacks: ${nativeRedirects}"`;
+}
+
+function getTargetAwareGuide(policy: RedirectPolicy): string {
+  const nativeRedirects = policy.nativeRedirectUris.length
+    ? policy.nativeRedirectUris.map((uri) => `- \`${uri}\``).join('\n')
+    : '- none';
+
+  return `# Supabase OAuth Runtime Reconciliation
+
+The provider callback remains project-owned. GoTrue-to-app redirects use the configured callback
+route \`${policy.callbackRoute}\` and are derived from \`AppManifest.deploy.targets\`.
+
+- Web target: ${policy.webEnabled ? 'enabled' : 'disabled'}
+- Native callbacks:
+${nativeRedirects}
+
+Local loopback patterns are emitted only for an enabled Web target. Native callbacks come only
+from enabled Android/iOS target schemes; no environment variable or slug-derived identity can add
+a native callback. Provider credential values remain sourced from trusted secret resolution.
+`;
+}
+
+function replaceOnce(value: string, search: string, replacement: string): string {
+  if (!value.includes(search)) {
+    throw new Error(
+      'Supabase OAuth redirect reconciliation template drifted from its canonical form.',
+    );
+  }
+  return value.replace(search, replacement);
+}

package/src/adapters/minikube/index.ts

@@ -1,4 +1,4 @@
-import { generateGeneratedApiDatabaseArtifacts } from '../../generatedApiDatabase';
+import { validateInfraApiSupport } from '../../infraValidation';
 import type {
   GeneratedPackageDependency,
   InfraManifestInput,
@@ -33,7 +33,11 @@ export function generateMinikubeInfra(
   const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);
   const namespace = APP_NAMESPACE;
 
-  const authArtifacts = generateAuthProviderArtifacts({ manifest, namespace });
+  const authArtifacts = generateAuthProviderArtifacts({
+    appManifest: options.appManifest,
+    manifest,
+    namespace,
+  });
   const authzArtifacts = generateAuthorizationArtifacts({
     manifest,
     namespace,
@@ -41,21 +45,6 @@ export function generateMinikubeInfra(
   });
   const storageArtifacts = generateStorageArtifacts({ manifest, namespace });
   const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });
-  const generatedApiDatabaseArtifacts = generateGeneratedApiDatabaseArtifacts({
-    generatedApis: options.appManifest?.generatedApis,
-    databaseProvider: manifest.database?.provider,
-  });
-  const generatedApiErrors = generatedApiDatabaseArtifacts.diagnostics.filter(
-    (diagnostic) => diagnostic.severity === 'error',
-  );
-
-  if (generatedApiErrors.length > 0) {
-    throw new Error(
-      `Generated API database definition is invalid:\n${generatedApiErrors
-        .map((diagnostic) => `- ${diagnostic.path ?? diagnostic.apiId}: ${diagnostic.message}`)
-        .join('\n')}`,
-    );
-  }
 
   const extraResources = unique([
     ...authArtifacts.resources,
@@ -94,9 +83,6 @@ export function generateMinikubeInfra(
     ...authzArtifacts.warnings,
     ...storageArtifacts.warnings,
     ...secretStoreArtifacts.warnings,
-    ...generatedApiDatabaseArtifacts.diagnostics
-      .filter((diagnostic) => diagnostic.severity === 'warning')
-      .map((diagnostic) => diagnostic.message),
   ]);
 
   return {
@@ -106,7 +92,6 @@ export function generateMinikubeInfra(
       ...authzArtifacts.files,
       ...storageArtifacts.files,
       ...secretStoreArtifacts.files,
-      ...generatedApiDatabaseArtifacts.files,
     ],
     warnings,
     meta: {
@@ -147,7 +132,7 @@ function collectDependencies(manifest: InfraManifestInput): readonly GeneratedPa
 }
 
 function collectWarnings(manifest: InfraManifestInput): string[] {
-  const warnings: string[] = [];
+  const warnings = [...validateInfraApiSupport(manifest)];
 
   if (manifest.deployment?.monitoring) {
     warnings.push(

package/src/apiInfrastructure.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, test } from 'bun:test';
+
+import { generateInfrastructure } from './index';
+import { createAppManifest } from './testSupport';
+import type { InfraManifestInput } from './types';
+
+const DEPLOYMENT = { target: 'minikube', monitoring: false } as const;
+
+describe('canonical API infrastructure', () => {
+  test('treats external APIs as infrastructure no-ops', () => {
+    const manifest: InfraManifestInput = {
+      deployment: DEPLOYMENT,
+      modules: [],
+      apis: [
+        {
+          id: 'nutrition',
+          origin: 'external',
+          protocol: 'rest',
+          baseUrl: 'https://api.ankhorage.com/v1/nutrition',
+          endpoints: {},
+        },
+      ],
+    };
+
+    const result = generateInfrastructure(manifest, {
+      appManifest: createAppManifest('nutrition', manifest),
+    });
+
+    expect(result.warnings).not.toContainEqual(expect.stringContaining('infra.apis.nutrition'));
+    expect(listApiArtifactPaths(result.files)).toEqual([]);
+  });
+
+  test('warns for internal APIs without generating partial API infrastructure', () => {
+    const manifest: InfraManifestInput = {
+      deployment: DEPLOYMENT,
+      modules: [],
+      apis: [
+        {
+          id: 'orders',
+          origin: 'internal',
+          protocol: 'rest',
+          basePath: '/api/orders',
+          endpoints: {},
+        },
+      ],
+    };
+
+    const result = generateInfrastructure(manifest, {
+      appManifest: createAppManifest('orders', manifest),
+    });
+
+    expect(result.warnings).toContain(
+      'infra.apis.orders has origin "internal", but internal API provisioning is not supported in Phase 1; no API infrastructure will be generated.',
+    );
+    expect(listApiArtifactPaths(result.files)).toEqual([]);
+  });
+});
+
+function listApiArtifactPaths(files: readonly { readonly path: string }[]): readonly string[] {
+  return files
+    .map((file) => file.path)
+    .filter(
+      (path) =>
+        path.includes('generated-api') ||
+        path.includes('generated_api') ||
+        path.includes('/api/deployment') ||
+        path.includes('/api/service'),
+    );
+}

package/src/authTargetRedirects.test.ts

@@ -0,0 +1,62 @@
+import type { AppDeployTargets } from '@ankhorage/contracts/deploy';
+import { describe, expect, test } from 'bun:test';
+
+import { resolveAuthTargetRedirectModel } from './authTargetRedirects';
+
+describe('resolveAuthTargetRedirectModel', () => {
+  test('derives enabled native callbacks and deduplicates shared schemes', () => {
+    const targets: AppDeployTargets = {
+      web: { enabled: true },
+      android: {
+        enabled: true,
+        package: 'com.ankh.demo',
+        scheme: 'ankh-demo',
+      },
+      ios: {
+        enabled: true,
+        bundleIdentifier: 'com.ankh.demo',
+        scheme: 'ankh-demo',
+      },
+    };
+
+    expect(resolveAuthTargetRedirectModel({ callbackRoute: '/auth/callback', targets })).toEqual({
+      nativeRedirectUris: ['ankh-demo://auth/callback'],
+      warnings: [],
+      webEnabled: true,
+    });
+  });
+
+  test('omits disabled targets and warns instead of guessing missing native schemes', () => {
+    const targets: AppDeployTargets = {
+      web: { enabled: false },
+      android: {
+        enabled: false,
+        package: 'com.ankh.demo',
+      },
+      ios: {
+        enabled: true,
+        bundleIdentifier: 'com.ankh.demo',
+      },
+    };
+
+    const result = resolveAuthTargetRedirectModel({ callbackRoute: '/auth/callback', targets });
+
+    expect(result.nativeRedirectUris).toEqual([]);
+    expect(result.webEnabled).toBe(false);
+    expect(result.warnings).toEqual([
+      'OAuth ios target is enabled but deploy.targets.ios.scheme is missing; native callback omitted.',
+    ]);
+  });
+
+  test('keeps the pre-target manifest path Web-only and explicit', () => {
+    expect(
+      resolveAuthTargetRedirectModel({ callbackRoute: '/auth/callback', targets: undefined }),
+    ).toEqual({
+      nativeRedirectUris: [],
+      warnings: [
+        'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
+      ],
+      webEnabled: true,
+    });
+  });
+});

package/src/authTargetRedirects.ts

@@ -0,0 +1,46 @@
+import type { AppDeployTargets } from '@ankhorage/contracts/deploy';
+
+interface AuthTargetRedirectModel {
+  readonly nativeRedirectUris: readonly string[];
+  readonly warnings: readonly string[];
+  readonly webEnabled: boolean;
+}
+
+export function resolveAuthTargetRedirectModel(args: {
+  readonly callbackRoute: string;
+  readonly targets: AppDeployTargets | undefined;
+}): AuthTargetRedirectModel {
+  if (args.targets === undefined) {
+    return {
+      nativeRedirectUris: [],
+      warnings: [
+        'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
+      ],
+      webEnabled: true,
+    };
+  }
+
+  const callbackPath = args.callbackRoute.replace(/^\/+/u, '');
+  const nativeRedirectUris: string[] = [];
+  const warnings: string[] = [];
+
+  for (const [targetId, target] of [
+    ['android', args.targets.android],
+    ['ios', args.targets.ios],
+  ] as const) {
+    if (target?.enabled !== true) continue;
+    if (target.scheme === undefined) {
+      warnings.push(
+        `OAuth ${targetId} target is enabled but deploy.targets.${targetId}.scheme is missing; native callback omitted.`,
+      );
+      continue;
+    }
+    nativeRedirectUris.push(`${target.scheme}://${callbackPath}`);
+  }
+
+  return {
+    nativeRedirectUris: [...new Set(nativeRedirectUris)],
+    warnings,
+    webEnabled: args.targets.web?.enabled === true,
+  };
+}

package/src/generatedApiLedgerCleanup.test.ts

@@ -0,0 +1,72 @@
+import { expect, test } from 'bun:test';
+import { promises as fs } from 'fs';
+import os from 'os';
+import path from 'path';
+
+import { syncProjectInfrastructure } from './projectInfrastructure';
+import { createAppManifest } from './testSupport';
+
+const OBSOLETE_FILES = [
+  'infra/minikube/db/generated-api-resources.json',
+  'infra/minikube/db/migrations/001_generated_api_resources.sql',
+] as const;
+
+test('removes obsolete generated API database artifacts tracked by the infra ledger', async () => {
+  const projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-api-cleanup-'));
+
+  try {
+    await writeObsoleteArtifacts(projectPath);
+    const manifest = createAppManifest('shop', {
+      deployment: { target: 'minikube', monitoring: false },
+      modules: [],
+    });
+    const result = await syncProjectInfrastructure({
+      projectId: 'shop',
+      projectPath,
+      manifest,
+      generateInfrastructureImpl: () => ({
+        files: [],
+        warnings: [],
+        meta: { target: 'minikube', providers: [] },
+        dependencies: [],
+      }),
+    });
+
+    expect(result.removed).toBe(OBSOLETE_FILES.length);
+    for (const filePath of OBSOLETE_FILES) {
+      expect(await pathExists(path.join(projectPath, filePath))).toBe(false);
+    }
+  } finally {
+    await fs.rm(projectPath, { force: true, recursive: true });
+  }
+});
+
+async function writeObsoleteArtifacts(projectPath: string): Promise<void> {
+  for (const filePath of OBSOLETE_FILES) {
+    const absolutePath = path.join(projectPath, filePath);
+    await fs.mkdir(path.dirname(absolutePath), { recursive: true });
+    await fs.writeFile(absolutePath, 'obsolete', 'utf8');
+  }
+
+  await fs.mkdir(path.join(projectPath, '.ankh'), { recursive: true });
+  await fs.writeFile(
+    path.join(projectPath, '.ankh/infra-ledger.json'),
+    JSON.stringify({
+      schemaVersion: 1,
+      generatedAt: new Date().toISOString(),
+      target: 'minikube',
+      files: OBSOLETE_FILES,
+      warnings: [],
+    }),
+    'utf8',
+  );
+}
+
+async function pathExists(filePath: string): Promise<boolean> {
+  try {
+    await fs.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/index.ts

@@ -14,12 +14,6 @@ export {
   resolveAuthRedirectConfiguration,
   type ResolveAuthRedirectConfigurationInput,
 } from './authRedirects';
-export {
-  type GeneratedApiDatabaseArtifacts,
-  type GeneratedApiDatabaseDiagnostic,
-  type GeneratedApiDatabaseDiagnosticCode,
-  generateGeneratedApiDatabaseArtifacts,
-} from './generatedApiDatabase';
 export {
   createInfraSecretStoreAdapter,
   type CreateInfraSecretStoreAdapterInput,

package/src/infraApiValidation.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, test } from 'bun:test';
+
+import { validateInfraSupport } from './infraValidation';
+import type { InfraManifestInput } from './types';
+
+describe('canonical API support validation', () => {
+  test('does not warn for external APIs', () => {
+    const manifest: InfraManifestInput = {
+      modules: [],
+      apis: [
+        {
+          id: 'nutrition',
+          origin: 'external',
+          protocol: 'rest',
+          baseUrl: 'https://api.ankhorage.com/v1/nutrition',
+          endpoints: {},
+        },
+      ],
+    };
+
+    expect(validateInfraSupport(manifest)).toEqual([]);
+  });
+
+  test('reports every internal API as unsupported without treating it as invalid', () => {
+    const manifest: InfraManifestInput = {
+      modules: [],
+      apis: [
+        {
+          id: 'orders',
+          origin: 'internal',
+          protocol: 'rest',
+          basePath: '/api/orders',
+          endpoints: {},
+        },
+      ],
+    };
+
+    expect(validateInfraSupport(manifest)).toEqual([
+      'infra.apis.orders has origin "internal", but internal API provisioning is not supported in Phase 1; no API infrastructure will be generated.',
+    ]);
+  });
+});

package/src/infraValidation.ts

@@ -9,7 +9,7 @@ import {
 import type { InfraManifestInput } from './types.js';
 
 export function validateInfraSupport(manifest: InfraManifestInput): readonly string[] {
-  const warnings: string[] = [];
+  const warnings: string[] = [...validateInfraApiSupport(manifest)];
 
   const deploymentTarget = manifest.deployment?.target;
   if (deploymentTarget !== undefined && !isSupported(deploymentTarget, DEPLOYMENT_TARGETS)) {
@@ -69,6 +69,15 @@ export function validateInfraSupport(manifest: InfraManifestInput): readonly str
   return warnings;
 }
 
+export function validateInfraApiSupport(manifest: InfraManifestInput): readonly string[] {
+  return (manifest.apis ?? [])
+    .filter((api) => api.origin === 'internal')
+    .map(
+      (api) =>
+        `infra.apis.${api.id} has origin "internal", but internal API provisioning is not supported in Phase 1; no API infrastructure will be generated.`,
+    );
+}
+
 function warningForUnsupportedValue(args: {
   readonly path: string;
   readonly value: string;