@ankhorage/infra 4.1.12 → 5.1.0

package/dist/adapters/minikube/auth/oauthRuntime.js

@@ -1,138 +0,0 @@
-import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';
-export function generateSupabaseOAuthRuntimeArtifacts(manifest) {
-    const oauthRuntime = resolveOAuthRuntimeModel(manifest);
-    if (!oauthRuntime) {
-        return {
-            files: [],
-            resources: [],
-            providerLifecycle: [],
-            envEntries: [],
-            warnings: [],
-        };
-    }
-    return {
-        files: [
-            {
-                path: 'infra/minikube/auth/oauth-runtime.md',
-                content: getOAuthRuntimeGuide(oauthRuntime),
-            },
-        ],
-        resources: [],
-        providerLifecycle: [getOAuthProviderLifecycle(oauthRuntime)],
-        envEntries: [],
-        warnings: [],
-    };
-}
-function resolveOAuthRuntimeModel(manifest) {
-    const oauth = manifest.auth?.oauth;
-    if (!oauth?.enabled)
-        return null;
-    const providers = oauth.providers.filter((provider) => provider.enabled !== false);
-    if (providers.length === 0)
-        return null;
-    const callbackRoute = normalizeAuthCallbackRoute(oauth.callbackRoute);
-    const envPrefixes = providers.map((provider) => {
-        const prefix = provider.id
-            .trim()
-            .toUpperCase()
-            .replace(/[^A-Z0-9]+/gu, '_')
-            .replace(/^_+|_+$/gu, '');
-        if (!prefix) {
-            throw new Error(`OAuth provider "${provider.id}" cannot be mapped to GoTrue environment keys.`);
-        }
-        return prefix;
-    });
-    return {
-        callbackRoute,
-        envPrefixes,
-        localRedirectPatterns: getLocalAuthRedirectPatterns(callbackRoute),
-    };
-}
-function getOAuthProviderLifecycle(oauthRuntime) {
-    return {
-        id: 'supabase-auth',
-        namespace: 'supabase',
-        endpoints: [],
-        readinessChecks: [
-            {
-                label: 'GoTrue',
-                namespace: 'supabase',
-                resource: 'deployment/auth',
-                timeoutSeconds: 600,
-            },
-        ],
-        migrationCommands: [],
-        reconciliationCommands: [
-            {
-                label: 'OAuth redirect and runtime rollout reconciliation',
-                command: getOAuthRuntimeReconciliationCommand(oauthRuntime),
-            },
-        ],
-        statusChecks: [
-            {
-                label: 'OAuth redirect configuration',
-                command: getOAuthRuntimeStatusCommand(oauthRuntime),
-            },
-        ],
-    };
-}
-function getOAuthRuntimeReconciliationCommand(oauthRuntime) {
-    const localPatterns = oauthRuntime.localRedirectPatterns.join(',');
-    const providerExports = oauthRuntime.envPrefixes
-        .map((prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"
-write_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI "\${oauth_provider_callback}"`)
-        .join('\n');
-    return `oauth_callback_route='${oauthRuntime.callbackRoute}'
-oauth_callback_path="\${oauth_callback_route#/}"
-oauth_site_url="\${SITE_URL%/}"
-oauth_provider_callback="\${API_EXTERNAL_URL%/}/callback"
-oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path},${localPatterns}"
-if [[ -n "\${OAUTH_NATIVE_REDIRECT_URLS:-}" ]]; then
-  oauth_redirect_allow_list="\${oauth_redirect_allow_list},\${OAUTH_NATIVE_REDIRECT_URLS}"
-fi
-export ADDITIONAL_REDIRECT_URLS="\${oauth_redirect_allow_list}"
-write_env_value ADDITIONAL_REDIRECT_URLS "\${oauth_redirect_allow_list}"
-${providerExports}
-sync_supabase_secrets
-kubectl --context "\${PROFILE}" -n supabase rollout restart deployment/auth >/dev/null
-kubectl --context "\${PROFILE}" -n supabase rollout status deployment/auth --timeout=600s`;
-}
-function getOAuthRuntimeStatusCommand(oauthRuntime) {
-    return `oauth_callback_route='${oauthRuntime.callbackRoute}'
-oauth_callback_path="\${oauth_callback_route#/}"
-if [[ -n "\${API_EXTERNAL_URL:-}" ]]; then
-  echo "- provider supabase-auth/provider-callback: \${API_EXTERNAL_URL%/}/callback"
-else
-  echo "- provider supabase-auth/provider-callback: unavailable"
-fi
-if [[ -n "\${SITE_URL:-}" ]]; then
-  echo "- provider supabase-auth/app-callback: \${SITE_URL%/}/\${oauth_callback_path}"
-else
-  echo "- provider supabase-auth/app-callback: unavailable"
-fi
-echo "- provider supabase-auth/local-callback-patterns: ${oauthRuntime.localRedirectPatterns.join(',')}"`;
-}
-function getOAuthRuntimeGuide(oauthRuntime) {
-    const localPatterns = oauthRuntime.localRedirectPatterns
-        .map((pattern) => `- \`${pattern}\``)
-        .join('\n');
-    return `# Supabase OAuth Runtime Reconciliation
-
-The provider callback is derived from the active project gateway as
-\`\${API_EXTERNAL_URL%/}/callback\`, which resolves to the project-owned
-\`/auth/v1/callback\` endpoint. GoTrue-to-app redirects use the configured callback route
-\`${oauthRuntime.callbackRoute}\`.
-
-Local Minikube reconciliation adds only callback-scoped loopback patterns:
-
-${localPatterns}
-
-Native callback URIs may be supplied through \`OAUTH_NATIVE_REDIRECT_URLS\`. The generated
-provider lifecycle persists redirect metadata, re-syncs the canonical Supabase runtime
-ConfigMap and Secret sources, then forces \`deployment/auth\` to restart and waits up to 600
-seconds for the rollout. OAuth credential values remain sourced from trusted secret resolution
-and are never embedded in generated files. A failed rollout stops Infra Up before its success
-message.
-`;
-}
-//# sourceMappingURL=oauthRuntime.js.map

package/dist/adapters/minikube/auth/oauthRuntime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauthRuntime.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/oauthRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAUlG,MAAM,UAAU,qCAAqC,CACnD,QAA4B;IAE5B,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;YACrB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,sCAAsC;gBAC5C,OAAO,EAAE,oBAAoB,CAAC,YAAY,CAAC;aAC5C;SACF;QACD,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC5D,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA4B;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE;aACvB,IAAI,EAAE;aACN,WAAW,EAAE;aACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,gDAAgD,CAC/E,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,aAAa;QACb,WAAW;QACX,qBAAqB,EAAE,4BAA4B,CAAC,aAAa,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAuC;IAEvC,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,UAAU;QACrB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE;YACf;gBACE,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,UAAU;gBACrB,QAAQ,EAAE,iBAAiB;gBAC3B,cAAc,EAAE,GAAG;aACpB;SACF;QACD,iBAAiB,EAAE,EAAE;QACrB,sBAAsB,EAAE;YACtB;gBACE,KAAK,EAAE,mDAAmD;gBAC1D,OAAO,EAAE,oCAAoC,CAAC,YAAY,CAAC;aAC5D;SACF;QACD,YAAY,EAAE;YACZ;gBACE,KAAK,EAAE,8BAA8B;gBACrC,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC;aACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAAC,YAAuC;IACnF,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,YAAY,CAAC,WAAW;SAC7C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,MAAM;kCAChB,MAAM,6CAA6C,CAChF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;2FAI+B,aAAa;;;;;;EAMtG,eAAe;;;0FAGyE,CAAC;AAC3F,CAAC;AAED,SAAS,4BAA4B,CAAC,YAAuC;IAC3E,OAAO,yBAAyB,YAAY,CAAC,aAAa;;;;;;;;;;;;0DAYF,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1G,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAuC;IACnE,MAAM,aAAa,GAAG,YAAY,CAAC,qBAAqB;SACrD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,IAAI,CAAC;SACpC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;IAKL,YAAY,CAAC,aAAa;;;;EAI5B,aAAa;;;;;;;;CAQd,CAAC;AACF,CAAC","sourcesContent":["import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';\nimport type { InfraManifestInput } from '../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';\n\ninterface SupabaseOAuthRuntimeModel {\n  callbackRoute: string;\n  envPrefixes: readonly string[];\n  localRedirectPatterns: readonly string[];\n}\n\nexport function generateSupabaseOAuthRuntimeArtifacts(\n  manifest: InfraManifestInput,\n): MinikubeAdapterArtifacts {\n  const oauthRuntime = resolveOAuthRuntimeModel(manifest);\n  if (!oauthRuntime) {\n    return {\n      files: [],\n      resources: [],\n      providerLifecycle: [],\n      envEntries: [],\n      warnings: [],\n    };\n  }\n\n  return {\n    files: [\n      {\n        path: 'infra/minikube/auth/oauth-runtime.md',\n        content: getOAuthRuntimeGuide(oauthRuntime),\n      },\n    ],\n    resources: [],\n    providerLifecycle: [getOAuthProviderLifecycle(oauthRuntime)],\n    envEntries: [],\n    warnings: [],\n  };\n}\n\nfunction resolveOAuthRuntimeModel(manifest: InfraManifestInput): SupabaseOAuthRuntimeModel | null {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return null;\n\n  const providers = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (providers.length === 0) return null;\n\n  const callbackRoute = normalizeAuthCallbackRoute(oauth.callbackRoute);\n  const envPrefixes = providers.map((provider) => {\n    const prefix = provider.id\n      .trim()\n      .toUpperCase()\n      .replace(/[^A-Z0-9]+/gu, '_')\n      .replace(/^_+|_+$/gu, '');\n    if (!prefix) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" cannot be mapped to GoTrue environment keys.`,\n      );\n    }\n    return prefix;\n  });\n\n  return {\n    callbackRoute,\n    envPrefixes,\n    localRedirectPatterns: getLocalAuthRedirectPatterns(callbackRoute),\n  };\n}\n\nfunction getOAuthProviderLifecycle(\n  oauthRuntime: SupabaseOAuthRuntimeModel,\n): MinikubeProviderLifecycle {\n  return {\n    id: 'supabase-auth',\n    namespace: 'supabase',\n    endpoints: [],\n    readinessChecks: [\n      {\n        label: 'GoTrue',\n        namespace: 'supabase',\n        resource: 'deployment/auth',\n        timeoutSeconds: 600,\n      },\n    ],\n    migrationCommands: [],\n    reconciliationCommands: [\n      {\n        label: 'OAuth redirect and runtime rollout reconciliation',\n        command: getOAuthRuntimeReconciliationCommand(oauthRuntime),\n      },\n    ],\n    statusChecks: [\n      {\n        label: 'OAuth redirect configuration',\n        command: getOAuthRuntimeStatusCommand(oauthRuntime),\n      },\n    ],\n  };\n}\n\nfunction getOAuthRuntimeReconciliationCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns.join(',');\n  const providerExports = oauthRuntime.envPrefixes\n    .map(\n      (prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI=\"\\${oauth_provider_callback}\"\nwrite_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI \"\\${oauth_provider_callback}\"`,\n    )\n    .join('\\n');\n\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\noauth_site_url=\"\\${SITE_URL%/}\"\noauth_provider_callback=\"\\${API_EXTERNAL_URL%/}/callback\"\noauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path},${localPatterns}\"\nif [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n  oauth_redirect_allow_list=\"\\${oauth_redirect_allow_list},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\nfi\nexport ADDITIONAL_REDIRECT_URLS=\"\\${oauth_redirect_allow_list}\"\nwrite_env_value ADDITIONAL_REDIRECT_URLS \"\\${oauth_redirect_allow_list}\"\n${providerExports}\nsync_supabase_secrets\nkubectl --context \"\\${PROFILE}\" -n supabase rollout restart deployment/auth >/dev/null\nkubectl --context \"\\${PROFILE}\" -n supabase rollout status deployment/auth --timeout=600s`;\n}\n\nfunction getOAuthRuntimeStatusCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  return `oauth_callback_route='${oauthRuntime.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\nif [[ -n \"\\${API_EXTERNAL_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/provider-callback: \\${API_EXTERNAL_URL%/}/callback\"\nelse\n  echo \"- provider supabase-auth/provider-callback: unavailable\"\nfi\nif [[ -n \"\\${SITE_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/app-callback: \\${SITE_URL%/}/\\${oauth_callback_path}\"\nelse\n  echo \"- provider supabase-auth/app-callback: unavailable\"\nfi\necho \"- provider supabase-auth/local-callback-patterns: ${oauthRuntime.localRedirectPatterns.join(',')}\"`;\n}\n\nfunction getOAuthRuntimeGuide(oauthRuntime: SupabaseOAuthRuntimeModel): string {\n  const localPatterns = oauthRuntime.localRedirectPatterns\n    .map((pattern) => `- \\`${pattern}\\``)\n    .join('\\n');\n\n  return `# Supabase OAuth Runtime Reconciliation\n\nThe provider callback is derived from the active project gateway as\n\\`\\${API_EXTERNAL_URL%/}/callback\\`, which resolves to the project-owned\n\\`/auth/v1/callback\\` endpoint. GoTrue-to-app redirects use the configured callback route\n\\`${oauthRuntime.callbackRoute}\\`.\n\nLocal Minikube reconciliation adds only callback-scoped loopback patterns:\n\n${localPatterns}\n\nNative callback URIs may be supplied through \\`OAUTH_NATIVE_REDIRECT_URLS\\`. The generated\nprovider lifecycle persists redirect metadata, re-syncs the canonical Supabase runtime\nConfigMap and Secret sources, then forces \\`deployment/auth\\` to restart and waits up to 600\nseconds for the rollout. OAuth credential values remain sourced from trusted secret resolution\nand are never embedded in generated files. A failed rollout stops Infra Up before its success\nmessage.\n`;\n}\n"]}

package/dist/adapters/minikube/auth/supabase/index.d.ts

@@ -1,7 +0,0 @@
-import type { InfraManifestInput } from '../../../../types';
-import type { MinikubeAdapterArtifacts } from '../../contracts';
-export declare function generateSupabaseAuthArtifacts(args: {
-    manifest: InfraManifestInput;
-    namespace: string;
-}): MinikubeAdapterArtifacts;
-//# sourceMappingURL=index.d.ts.map

package/dist/adapters/minikube/auth/supabase/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAOhE,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CAiE3B"}

package/dist/adapters/minikube/auth/supabase/index.js

@@ -1,232 +0,0 @@
-import { getSupabaseProfileReconciliation, resolveSupabaseProfileModel, } from './profile';
-export function generateSupabaseAuthArtifacts(args) {
-    const { manifest, namespace } = args;
-    const root = 'infra/minikube/k8s/auth/supabase';
-    const resourceRoot = 'auth/supabase';
-    const docsRoot = 'infra/minikube/auth';
-    const generatedRoot = 'infra/minikube/supabase/generated';
-    const scope = manifest.auth?.scope ?? 'global';
-    const authzEngine = manifest.auth?.authorization?.engine ?? 'native';
-    const authzKind = manifest.auth?.authorization?.kind ?? 'RBAC';
-    const authFieldModel = resolveAuthFieldModel(manifest);
-    const profileModel = resolveSupabaseProfileModel(manifest);
-    const warnings = [];
-    if (scope !== 'global') {
-        warnings.push(`Auth scope "${scope}" is not fully modeled yet for Supabase. Baseline resources assume global auth.`);
-    }
-    return {
-        files: [
-            {
-                path: `${root}/supabase-auth.configmap.yaml`,
-                content: getSupabaseConfigMap({
-                    namespace,
-                    scope,
-                    authzEngine,
-                    authzKind,
-                    authFieldModel,
-                    profileModel,
-                }),
-            },
-            {
-                path: `${root}/app-runtime-auth.env.configmap.yaml`,
-                content: getRuntimeAuthEnvConfigMap({
-                    namespace,
-                    scope,
-                    authzEngine,
-                    authzKind,
-                    authFieldModel,
-                    profileModel,
-                }),
-            },
-            ...(profileModel.enabled
-                ? [
-                    {
-                        path: `${generatedRoot}/auth_profiles.sql`,
-                        content: getSupabaseProfileReconciliation(profileModel),
-                    },
-                ]
-                : []),
-            {
-                path: `${docsRoot}/supabase-runtime-wiring.md`,
-                content: getSupabaseRuntimeWiringGuide(profileModel),
-            },
-        ],
-        resources: [
-            `${resourceRoot}/supabase-auth.configmap.yaml`,
-            `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,
-        ],
-        providerLifecycle: [],
-        envEntries: ['EXPO_PUBLIC_SUPABASE_URL=', 'EXPO_PUBLIC_SUPABASE_ANON_KEY='],
-        warnings,
-    };
-}
-function getSupabaseConfigMap(args) {
-    const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
-    return `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: supabase-auth-config
-  namespace: ${namespace}
-data:
-  AUTH_PROVIDER: "supabase"
-  AUTH_SCOPE: "${scope}"
-  AUTHZ_ENGINE: "${authzEngine}"
-  AUTHZ_KIND: "${authzKind}"
-  AUTH_SIGN_IN_IDENTIFIERS: "${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}"
-  AUTH_SIGN_UP_REQUIRED_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}"
-  AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
-  AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
-  AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
-  AUTH_PROFILE_TABLE: "${escapeYamlDoubleQuoted(profileModel.table)}"
-  AUTH_PROFILE_PRIMARY_KEY: "${profileModel.primaryKey}"
-  AUTH_PROFILE_CREATE_STRATEGY: "${profileModel.createStrategy}"
-  AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
-`;
-}
-function getRuntimeAuthEnvConfigMap(args) {
-    const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
-    return `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: app-runtime-auth-env
-  namespace: ${namespace}
-data:
-  AUTH_REQUIRED: "true"
-  AUTH_PROVIDER: "supabase"
-  AUTH_SCOPE: "${scope}"
-  AUTHZ_ENGINE: "${authzEngine}"
-  AUTHZ_KIND: "${authzKind}"
-  AUTH_SIGN_IN_IDENTIFIERS: "${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}"
-  AUTH_SIGN_UP_REQUIRED_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}"
-  AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
-  AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
-  AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
-  AUTH_PROFILE_TABLE: "${escapeYamlDoubleQuoted(profileModel.table)}"
-  AUTH_PROFILE_PRIMARY_KEY: "${profileModel.primaryKey}"
-  AUTH_PROFILE_CREATE_STRATEGY: "${profileModel.createStrategy}"
-  AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
-  AUTH_TOKEN_HEADER: "Authorization"
-  AUTH_TOKEN_PREFIX: "Bearer"
-`;
-}
-function getSupabaseRuntimeWiringGuide(profileModel) {
-    const profileSection = profileModel.enabled
-        ? `
-## App Profile Table
-
-Identity remains provider-owned in \`auth.users\`. App-facing profile data is generated in
-\`public.${profileModel.table}\` and linked through \`${profileModel.table}.id -> auth.users.id\`.
-
-The generated profile reconciliation:
-
-- creates the profile table
-- enables row-level security
-- allows signed-in users to read and update their own profile row
-- drops stale Ankhorage-managed profile columns that are no longer configured
-- creates a trigger for new auth users when \`AUTH_PROFILE_CREATE_STRATEGY=trigger\`
-`
-        : '';
-    return `# Supabase Runtime Wiring
-
-This file documents the runtime conventions generated by the minikube Supabase adapter.
-
-## Generated Kubernetes Objects
-
-- \`ConfigMap/supabase-auth-config\`: high-level auth metadata.
-- \`Secret/supabase-public-runtime\`: browser-safe Supabase URL and anon key material, generated by \`scripts/up.sh\` after local Supabase secrets exist.
-- \`ConfigMap/app-runtime-auth-env\`: auth runtime feature flags and authz metadata.
-
-## App Runtime Convention
-
-Your app runtime deployment should import both:
-
-- \`app-runtime-auth-env\` (configMap)
-- \`supabase-public-runtime\` (secret)
-
-For local Expo/Metro development, \`scripts/up.sh\` also writes the same browser-safe
-\`EXPO_PUBLIC_SUPABASE_URL\` and \`EXPO_PUBLIC_SUPABASE_ANON_KEY\` values to
-\`\${APP_SOURCE_DIR}/.env.local\`, preserving unrelated entries. Restart Expo after
-Infra Up so those public values are embedded into the client bundle.
-
-Example deployment fragment:
-
-\`\`\`yaml
-envFrom:
-  - configMapRef:
-      name: app-runtime-auth-env
-  - secretRef:
-      name: supabase-public-runtime
-\`\`\`
-
-The generated base deployment at \`k8s/app/deployment.yaml\` already includes this wiring
-with \`optional: true\` for auth sources.
-
-## Expected Environment Variables
-
-- \`AUTH_REQUIRED\`
-- \`AUTH_PROVIDER\`
-- \`AUTH_SCOPE\`
-- \`AUTHZ_ENGINE\`
-- \`AUTHZ_KIND\`
-- \`AUTH_SIGN_IN_IDENTIFIERS\`
-- \`AUTH_SIGN_UP_REQUIRED_FIELDS\`
-- \`AUTH_SIGN_UP_OPTIONAL_FIELDS\`
-- \`AUTH_SIGN_UP_POLICY\`
-- \`AUTH_PROFILE_FIELDS\`
-- \`AUTH_PROFILE_TABLE\`
-- \`AUTH_PROFILE_PRIMARY_KEY\`
-- \`AUTH_PROFILE_CREATE_STRATEGY\`
-- \`AUTH_PROFILE_UPDATE_STRATEGY\`
-- \`SUPABASE_URL\`
-- \`SUPABASE_ANON_KEY\`
-- \`EXPO_PUBLIC_SUPABASE_URL\`
-- \`EXPO_PUBLIC_SUPABASE_ANON_KEY\`
-${profileSection}
-## Runtime Secrets
-
-When Supabase is enabled, \`scripts/up.sh\` creates/updates \`Secret/supabase-public-runtime\`
-with browser-safe values for the app namespace and mirrors the Expo public values into the
-app \`.env.local\`. Privileged Supabase runtime secrets remain in the \`supabase\` namespace.
-`;
-}
-const DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];
-const DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];
-const DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];
-const DEFAULT_SIGN_UP_POLICY = 'autoSignIn';
-function resolveAuthFieldModel(manifest) {
-    const signInIdentifiers = normalizeFieldList(manifest.auth?.signIn?.identifiers, DEFAULT_SIGN_IN_IDENTIFIERS);
-    const signUpRequiredFields = normalizeFieldList(manifest.auth?.signUp?.requiredFields, DEFAULT_SIGN_UP_REQUIRED_FIELDS);
-    const signUpOptionalFields = normalizeFieldList(manifest.auth?.signUp?.optionalFields, DEFAULT_SIGN_UP_OPTIONAL_FIELDS).filter((field) => !signUpRequiredFields.includes(field));
-    const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;
-    const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, [
-        'email',
-        'firstName',
-        'lastName',
-    ]);
-    return {
-        signInIdentifiersCsv: signInIdentifiers.join(','),
-        signUpRequiredFieldsCsv: signUpRequiredFields.join(','),
-        signUpOptionalFieldsCsv: signUpOptionalFields.join(','),
-        signUpPolicy,
-        profileFieldsCsv: profileFields.join(','),
-    };
-}
-function normalizeFieldList(values, fallback) {
-    const source = values ?? fallback;
-    const next = [];
-    for (const value of source) {
-        const normalized = value.trim();
-        if (!normalized || next.includes(normalized)) {
-            continue;
-        }
-        next.push(normalized);
-    }
-    if (next.length > 0) {
-        return next;
-    }
-    return [...fallback];
-}
-function escapeYamlDoubleQuoted(value) {
-    return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
-}
-//# sourceMappingURL=index.js.map

package/dist/adapters/minikube/auth/supabase/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gCAAgC,EAEhC,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AAEnB,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAErC,MAAM,IAAI,GAAG,kCAAkC,CAAC;IAChD,MAAM,YAAY,GAAG,eAAe,CAAC;IACrC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,MAAM,aAAa,GAAG,mCAAmC,CAAC;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,QAAQ,CAAC;IACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,MAAM,CAAC;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,eAAe,KAAK,iFAAiF,CACtG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,oBAAoB,CAAC;oBAC5B,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sCAAsC;gBACnD,OAAO,EAAE,0BAA0B,CAAC;oBAClC,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD,GAAG,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,GAAG,aAAa,oBAAoB;wBAC1C,OAAO,EAAE,gCAAgC,CAAC,YAAY,CAAC;qBACxD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,IAAI,EAAE,GAAG,QAAQ,6BAA6B;gBAC9C,OAAO,EAAE,6BAA6B,CAAC,YAAY,CAAC;aACrD;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,sCAAsC;SACtD;QACD,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,CAAC,2BAA2B,EAAE,gCAAgC,CAAC;QAC3E,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAO7B;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;iBAGP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;CAC7D,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAAC,IAOnC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;;iBAIP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;;;CAG7D,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,YAAkC;IACvE,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO;QACzC,CAAC,CAAC;;;;WAIK,YAAY,CAAC,KAAK,2BAA2B,YAAY,CAAC,KAAK;;;;;;;;;CASzE;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuDP,cAAc;;;;;;CAMf,CAAC;AACF,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9C,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC9D,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAS5C,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAClC,2BAA2B,CAC5B,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IACnF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;QACvE,OAAO;QACP,WAAW;QACX,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,YAAY;QACZ,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAqC,EACrC,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\nimport {\n  getSupabaseProfileReconciliation,\n  type ResolvedProfileModel,\n  resolveSupabaseProfileModel,\n} from './profile';\n\nexport function generateSupabaseAuthArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n\n  const root = 'infra/minikube/k8s/auth/supabase';\n  const resourceRoot = 'auth/supabase';\n  const docsRoot = 'infra/minikube/auth';\n  const generatedRoot = 'infra/minikube/supabase/generated';\n  const scope = manifest.auth?.scope ?? 'global';\n  const authzEngine = manifest.auth?.authorization?.engine ?? 'native';\n  const authzKind = manifest.auth?.authorization?.kind ?? 'RBAC';\n  const authFieldModel = resolveAuthFieldModel(manifest);\n  const profileModel = resolveSupabaseProfileModel(manifest);\n\n  const warnings: string[] = [];\n  if (scope !== 'global') {\n    warnings.push(\n      `Auth scope \"${scope}\" is not fully modeled yet for Supabase. Baseline resources assume global auth.`,\n    );\n  }\n\n  return {\n    files: [\n      {\n        path: `${root}/supabase-auth.configmap.yaml`,\n        content: getSupabaseConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      {\n        path: `${root}/app-runtime-auth.env.configmap.yaml`,\n        content: getRuntimeAuthEnvConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      ...(profileModel.enabled\n        ? [\n            {\n              path: `${generatedRoot}/auth_profiles.sql`,\n              content: getSupabaseProfileReconciliation(profileModel),\n            },\n          ]\n        : []),\n      {\n        path: `${docsRoot}/supabase-runtime-wiring.md`,\n        content: getSupabaseRuntimeWiringGuide(profileModel),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/supabase-auth.configmap.yaml`,\n      `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,\n    ],\n    providerLifecycle: [],\n    envEntries: ['EXPO_PUBLIC_SUPABASE_URL=', 'EXPO_PUBLIC_SUPABASE_ANON_KEY='],\n    warnings,\n  };\n}\n\nfunction getSupabaseConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-auth-config\n  namespace: ${namespace}\ndata:\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n`;\n}\n\nfunction getRuntimeAuthEnvConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-runtime-auth-env\n  namespace: ${namespace}\ndata:\n  AUTH_REQUIRED: \"true\"\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n  AUTH_TOKEN_HEADER: \"Authorization\"\n  AUTH_TOKEN_PREFIX: \"Bearer\"\n`;\n}\n\nfunction getSupabaseRuntimeWiringGuide(profileModel: ResolvedProfileModel) {\n  const profileSection = profileModel.enabled\n    ? `\n## App Profile Table\n\nIdentity remains provider-owned in \\`auth.users\\`. App-facing profile data is generated in\n\\`public.${profileModel.table}\\` and linked through \\`${profileModel.table}.id -> auth.users.id\\`.\n\nThe generated profile reconciliation:\n\n- creates the profile table\n- enables row-level security\n- allows signed-in users to read and update their own profile row\n- drops stale Ankhorage-managed profile columns that are no longer configured\n- creates a trigger for new auth users when \\`AUTH_PROFILE_CREATE_STRATEGY=trigger\\`\n`\n    : '';\n\n  return `# Supabase Runtime Wiring\n\nThis file documents the runtime conventions generated by the minikube Supabase adapter.\n\n## Generated Kubernetes Objects\n\n- \\`ConfigMap/supabase-auth-config\\`: high-level auth metadata.\n- \\`Secret/supabase-public-runtime\\`: browser-safe Supabase URL and anon key material, generated by \\`scripts/up.sh\\` after local Supabase secrets exist.\n- \\`ConfigMap/app-runtime-auth-env\\`: auth runtime feature flags and authz metadata.\n\n## App Runtime Convention\n\nYour app runtime deployment should import both:\n\n- \\`app-runtime-auth-env\\` (configMap)\n- \\`supabase-public-runtime\\` (secret)\n\nFor local Expo/Metro development, \\`scripts/up.sh\\` also writes the same browser-safe\n\\`EXPO_PUBLIC_SUPABASE_URL\\` and \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\` values to\n\\`\\${APP_SOURCE_DIR}/.env.local\\`, preserving unrelated entries. Restart Expo after\nInfra Up so those public values are embedded into the client bundle.\n\nExample deployment fragment:\n\n\\`\\`\\`yaml\nenvFrom:\n  - configMapRef:\n      name: app-runtime-auth-env\n  - secretRef:\n      name: supabase-public-runtime\n\\`\\`\\`\n\nThe generated base deployment at \\`k8s/app/deployment.yaml\\` already includes this wiring\nwith \\`optional: true\\` for auth sources.\n\n## Expected Environment Variables\n\n- \\`AUTH_REQUIRED\\`\n- \\`AUTH_PROVIDER\\`\n- \\`AUTH_SCOPE\\`\n- \\`AUTHZ_ENGINE\\`\n- \\`AUTHZ_KIND\\`\n- \\`AUTH_SIGN_IN_IDENTIFIERS\\`\n- \\`AUTH_SIGN_UP_REQUIRED_FIELDS\\`\n- \\`AUTH_SIGN_UP_OPTIONAL_FIELDS\\`\n- \\`AUTH_SIGN_UP_POLICY\\`\n- \\`AUTH_PROFILE_FIELDS\\`\n- \\`AUTH_PROFILE_TABLE\\`\n- \\`AUTH_PROFILE_PRIMARY_KEY\\`\n- \\`AUTH_PROFILE_CREATE_STRATEGY\\`\n- \\`AUTH_PROFILE_UPDATE_STRATEGY\\`\n- \\`SUPABASE_URL\\`\n- \\`SUPABASE_ANON_KEY\\`\n- \\`EXPO_PUBLIC_SUPABASE_URL\\`\n- \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\`\n${profileSection}\n## Runtime Secrets\n\nWhen Supabase is enabled, \\`scripts/up.sh\\` creates/updates \\`Secret/supabase-public-runtime\\`\nwith browser-safe values for the app namespace and mirrors the Expo public values into the\napp \\`.env.local\\`. Privileged Supabase runtime secrets remain in the \\`supabase\\` namespace.\n`;\n}\n\nconst DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];\nconst DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];\nconst DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];\nconst DEFAULT_SIGN_UP_POLICY = 'autoSignIn';\ninterface ResolvedAuthFieldModel {\n  signInIdentifiersCsv: string;\n  signUpRequiredFieldsCsv: string;\n  signUpOptionalFieldsCsv: string;\n  signUpPolicy: string;\n  profileFieldsCsv: string;\n}\n\nfunction resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {\n  const signInIdentifiers = normalizeFieldList(\n    manifest.auth?.signIn?.identifiers,\n    DEFAULT_SIGN_IN_IDENTIFIERS,\n  );\n  const signUpRequiredFields = normalizeFieldList(\n    manifest.auth?.signUp?.requiredFields,\n    DEFAULT_SIGN_UP_REQUIRED_FIELDS,\n  );\n  const signUpOptionalFields = normalizeFieldList(\n    manifest.auth?.signUp?.optionalFields,\n    DEFAULT_SIGN_UP_OPTIONAL_FIELDS,\n  ).filter((field) => !signUpRequiredFields.includes(field));\n  const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;\n  const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, [\n    'email',\n    'firstName',\n    'lastName',\n  ]);\n\n  return {\n    signInIdentifiersCsv: signInIdentifiers.join(','),\n    signUpRequiredFieldsCsv: signUpRequiredFields.join(','),\n    signUpOptionalFieldsCsv: signUpOptionalFields.join(','),\n    signUpPolicy,\n    profileFieldsCsv: profileFields.join(','),\n  };\n}\n\nfunction normalizeFieldList(\n  values: readonly string[] | undefined,\n  fallback: readonly string[],\n): string[] {\n  const source = values ?? fallback;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized || next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  if (next.length > 0) {\n    return next;\n  }\n\n  return [...fallback];\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}

package/dist/adapters/minikube/auth/supabase/profile.d.ts

@@ -1,20 +0,0 @@
-import type { InfraManifestInput } from '../../../../types';
-interface ProfileColumnSpec {
-    readonly field: string;
-    readonly column: string;
-    readonly sqlType: string;
-    readonly fromNewUser: string;
-}
-export interface ResolvedProfileModel {
-    readonly enabled: boolean;
-    readonly table: string;
-    readonly primaryKey: string;
-    readonly createStrategy: string;
-    readonly updateStrategy: string;
-    readonly columns: readonly ProfileColumnSpec[];
-    readonly desiredStateHash: string;
-}
-export declare function resolveSupabaseProfileModel(manifest: InfraManifestInput): ResolvedProfileModel;
-export declare function getSupabaseProfileReconciliation(profileModel: ResolvedProfileModel): string;
-export {};
-//# sourceMappingURL=profile.d.ts.map

package/dist/adapters/minikube/auth/supabase/profile.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/profile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAoB5D,UAAU,iBAAiB;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,oBAAoB,CA2B9F;AAED,wBAAgB,gCAAgC,CAAC,YAAY,EAAE,oBAAoB,GAAG,MAAM,CAoT3F"}