@ankhorage/infra 4.1.12 → 5.1.0

package/dist/adapters/minikube/auth/supabase/profile.js

@@ -1,452 +0,0 @@
-import { createHash } from 'node:crypto';
-const DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];
-const DEFAULT_PROFILE_PRIMARY_KEY = 'authUserId';
-const DEFAULT_PROFILE_CREATE_STRATEGY = 'trigger';
-const DEFAULT_PROFILE_UPDATE_STRATEGY = 'api';
-const PROFILE_POLICY_VERSION = 1;
-const PROFILE_RECONCILER_VERSION = 1;
-const PROFILE_ARTIFACT_KEY = 'auth.profile';
-const MANAGED_PROFILE_COLUMNS = [
-    'email',
-    'display_name',
-    'first_name',
-    'last_name',
-    'avatar_url',
-    'username',
-    'phone',
-];
-export function resolveSupabaseProfileModel(manifest) {
-    const table = normalizeIdentifier(manifest.auth?.profile?.table ?? '');
-    const fields = normalizeFieldList(manifest.auth?.profile?.fields);
-    const primaryKey = manifest.auth?.profile?.primaryKey ?? DEFAULT_PROFILE_PRIMARY_KEY;
-    const createStrategy = manifest.auth?.profile?.createStrategy ?? DEFAULT_PROFILE_CREATE_STRATEGY;
-    const updateStrategy = manifest.auth?.profile?.updateStrategy ?? DEFAULT_PROFILE_UPDATE_STRATEGY;
-    const columns = resolveProfileColumns(fields);
-    const hash = table
-        ? getProfileDesiredStateHash({
-            table,
-            primaryKey,
-            createStrategy,
-            updateStrategy,
-            columns,
-        })
-        : '';
-    return {
-        enabled: table.length > 0,
-        table,
-        primaryKey,
-        createStrategy,
-        updateStrategy,
-        columns,
-        desiredStateHash: hash,
-    };
-}
-export function getSupabaseProfileReconciliation(profileModel) {
-    const table = quoteIdentifier(profileModel.table);
-    const functionName = quoteIdentifier(`handle_new_${profileModel.table}_user`);
-    const triggerName = quoteIdentifier(`on_auth_user_created_${profileModel.table}`);
-    const configuredColumns = new Set(profileModel.columns.map((column) => column.column));
-    const addColumnSql = profileModel.columns
-        .map((column) => `alter table public.${table} add column if not exists ${quoteIdentifier(column.column)} ${column.sqlType};`)
-        .join('\n');
-    const dropStaleManagedColumnSql = MANAGED_PROFILE_COLUMNS.filter((column) => !configuredColumns.has(column))
-        .map((column) => `alter table public.${table} drop column if exists ${quoteIdentifier(column)};`)
-        .join('\n');
-    const insertColumns = ['id', ...profileModel.columns.map((column) => column.column)]
-        .map(quoteIdentifier)
-        .join(', ');
-    const insertValues = ['new.id', ...profileModel.columns.map((column) => column.fromNewUser)].join(', ');
-    const updateAssignments = profileModel.columns
-        .filter((column) => column.field === 'email')
-        .map((column) => `${quoteIdentifier(column.column)} = excluded.${quoteIdentifier(column.column)}`);
-    const conflictUpdate = [...updateAssignments, 'updated_at = now()'].join(',\n    ');
-    const updateGrantColumns = profileModel.columns.map((column) => quoteIdentifier(column.column));
-    const updateGrantSql = updateGrantColumns.length > 0
-        ? `grant update (${updateGrantColumns.join(', ')}) on table public.${table} to authenticated;`
-        : '';
-    const triggerSql = profileModel.createStrategy === 'trigger'
-        ? `
-create or replace function public.${functionName}()
-returns trigger
-language plpgsql
-security definer
-set search_path = pg_catalog, pg_temp
-as $$
-begin
-  insert into public.${table} (${insertColumns})
-  values (${insertValues})
-  on conflict (id) do update set
-    ${conflictUpdate};
-
-  return new;
-end;
-$$;
-
-revoke execute on function public.${functionName}() from PUBLIC;
-revoke execute on function public.${functionName}() from anon;
-revoke execute on function public.${functionName}() from authenticated;
-
-drop trigger if exists ${triggerName} on auth.users;
-create trigger ${triggerName}
-  after insert on auth.users
-  for each row execute function public.${functionName}();
-`
-        : `
-drop trigger if exists ${triggerName} on auth.users;
-drop function if exists public.${functionName}();
-`;
-    return `-- Generated by @ankhorage/infra from manifest.auth.profile.
--- Desired-state reconciliation for local Supabase; not a migration-history entry.
-
-begin;
-
-create schema if not exists ankhorage_internal;
-
-create table if not exists ankhorage_internal.generated_schema_state (
-  artifact_key text primary key,
-  table_name text,
-  content_hash text not null,
-  applied_at timestamptz not null
-);
-
-alter table ankhorage_internal.generated_schema_state
-  add column if not exists table_name text;
-
-do $$
-declare
-  previous_table_name text;
-  has_previous_state boolean;
-begin
-  select table_name, true
-    into previous_table_name, has_previous_state
-    from ankhorage_internal.generated_schema_state
-    where artifact_key = '${PROFILE_ARTIFACT_KEY}';
-
-  if has_previous_state and previous_table_name is null then
-    raise exception 'existing auth.profile generated state is missing table identity; reset local Supabase or add an explicit cleanup migration before applying generated profile reconciliation';
-  end if;
-
-  if has_previous_state and previous_table_name <> '${escapeSqlLiteral(profileModel.table)}' then
-    raise exception 'profile.table changed from % to %; reset local Supabase or add an explicit cleanup migration before applying generated profile reconciliation', previous_table_name, '${escapeSqlLiteral(profileModel.table)}';
-  end if;
-end;
-$$;
-
-create table if not exists public.${table} (
-  id uuid primary key references auth.users(id) on delete cascade,
-  created_at timestamptz not null default now(),
-  updated_at timestamptz not null default now()
-);
-
-alter table public.${table} add column if not exists id uuid;
-alter table public.${table} add column if not exists created_at timestamptz not null default now();
-alter table public.${table} add column if not exists updated_at timestamptz not null default now();
-${addColumnSql}
-alter table public.${table} drop column if exists role;
-${dropStaleManagedColumnSql}
-
-do $$
-begin
-  if exists (
-    select 1
-    from pg_constraint c
-    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-      and c.contype = 'p'
-      and c.conkey <> array[
-        (
-          select a.attnum
-          from pg_attribute a
-          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-            and a.attname = 'id'
-            and not a.attisdropped
-        )
-      ]::smallint[]
-  ) then
-    raise exception 'profile table public.${escapeSqlLiteral(profileModel.table)} has a primary key that is not exactly id';
-  end if;
-
-  if not exists (
-    select 1
-    from pg_constraint
-    where conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-      and contype = 'p'
-  ) then
-    alter table public.${table}
-      add constraint ${quoteIdentifier(`${profileModel.table}_pkey`)} primary key (id);
-  end if;
-end;
-$$;
-
-do $$
-begin
-  if exists (
-    select 1
-    from pg_constraint c
-    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-      and c.contype = 'f'
-      and c.confrelid = 'auth.users'::regclass
-      and c.conkey && array[
-        (
-          select a.attnum
-          from pg_attribute a
-          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-            and a.attname = 'id'
-            and not a.attisdropped
-        )
-      ]::smallint[]
-      and (
-        c.confdeltype <> 'c'
-        or c.conkey <> array[
-          (
-            select a.attnum
-            from pg_attribute a
-            where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-              and a.attname = 'id'
-              and not a.attisdropped
-          )
-        ]::smallint[]
-        or c.confkey <> array[
-          (
-            select a.attnum
-            from pg_attribute a
-            where a.attrelid = 'auth.users'::regclass
-              and a.attname = 'id'
-              and not a.attisdropped
-          )
-        ]::smallint[]
-      )
-  ) then
-    raise exception 'profile table public.${escapeSqlLiteral(profileModel.table)} has an auth.users foreign key that is not exactly id -> auth.users(id) on delete cascade';
-  end if;
-
-  if not exists (
-    select 1
-    from pg_constraint c
-    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-      and c.confrelid = 'auth.users'::regclass
-      and c.contype = 'f'
-      and c.confdeltype = 'c'
-      and c.conkey = array[
-        (
-          select a.attnum
-          from pg_attribute a
-          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-            and a.attname = 'id'
-            and not a.attisdropped
-        )
-      ]::smallint[]
-      and c.confkey = array[
-        (
-          select a.attnum
-          from pg_attribute a
-          where a.attrelid = 'auth.users'::regclass
-            and a.attname = 'id'
-            and not a.attisdropped
-        )
-      ]::smallint[]
-  ) then
-    alter table public.${table}
-      add constraint ${quoteIdentifier(`${profileModel.table}_id_auth_users_fkey`)}
-      foreign key (id) references auth.users(id) on delete cascade;
-  end if;
-end;
-$$;
-
-do $$
-begin
-  if not exists (
-    select 1
-    from information_schema.columns c
-    where c.table_schema = 'public'
-      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'
-      and c.column_name = 'id'
-      and c.udt_name = 'uuid'
-      and c.is_nullable = 'NO'
-  ) then
-    raise exception 'profile id column must be uuid not null';
-  end if;
-
-  if not exists (
-    select 1
-    from information_schema.columns c
-    where c.table_schema = 'public'
-      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'
-      and c.column_name = 'created_at'
-      and c.data_type = 'timestamp with time zone'
-      and c.is_nullable = 'NO'
-      and c.column_default = 'now()'
-  ) then
-    raise exception 'profile created_at column must be timestamptz not null default now()';
-  end if;
-
-  if not exists (
-    select 1
-    from information_schema.columns c
-    where c.table_schema = 'public'
-      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'
-      and c.column_name = 'updated_at'
-      and c.data_type = 'timestamp with time zone'
-      and c.is_nullable = 'NO'
-      and c.column_default = 'now()'
-  ) then
-    raise exception 'profile updated_at column must be timestamptz not null default now()';
-  end if;
-end;
-$$;
-
-alter table public.${table} enable row level security;
-
-revoke all on table public.${table} from anon, authenticated;
-grant select on table public.${table} to authenticated;
-${updateGrantSql}
-
-drop policy if exists ${quoteIdentifier(`${profileModel.table}_select_own`)} on public.${table};
-create policy ${quoteIdentifier(`${profileModel.table}_select_own`)}
-  on public.${table}
-  for select
-  to authenticated
-  using ((select auth.uid()) = id);
-
-drop policy if exists ${quoteIdentifier(`${profileModel.table}_update_own`)} on public.${table};
-create policy ${quoteIdentifier(`${profileModel.table}_update_own`)}
-  on public.${table}
-  for update
-  to authenticated
-  using ((select auth.uid()) = id)
-  with check ((select auth.uid()) = id);
-${triggerSql}
-insert into ankhorage_internal.generated_schema_state (
-  artifact_key,
-  table_name,
-  content_hash,
-  applied_at
-)
-values (
-  '${PROFILE_ARTIFACT_KEY}',
-  '${escapeSqlLiteral(profileModel.table)}',
-  '${profileModel.desiredStateHash}',
-  now()
-)
-on conflict (artifact_key)
-do update set
-  table_name = excluded.table_name,
-  content_hash = excluded.content_hash,
-  applied_at = excluded.applied_at;
-
-commit;
-`;
-}
-function mapProfileFieldToColumn(field) {
-    switch (field) {
-        case 'email':
-            return { field, column: 'email', sqlType: 'text', fromNewUser: 'new.email' };
-        case 'displayName':
-            return {
-                field,
-                column: 'display_name',
-                sqlType: 'text',
-                fromNewUser: "coalesce(new.raw_user_meta_data->>'displayName', new.raw_user_meta_data->>'display_name', split_part(new.email, '@', 1))",
-            };
-        case 'firstName':
-            return {
-                field,
-                column: 'first_name',
-                sqlType: 'text',
-                fromNewUser: "coalesce(new.raw_user_meta_data->>'firstName', new.raw_user_meta_data->>'first_name')",
-            };
-        case 'lastName':
-            return {
-                field,
-                column: 'last_name',
-                sqlType: 'text',
-                fromNewUser: "coalesce(new.raw_user_meta_data->>'lastName', new.raw_user_meta_data->>'last_name')",
-            };
-        case 'avatarUrl':
-            return {
-                field,
-                column: 'avatar_url',
-                sqlType: 'text',
-                fromNewUser: "coalesce(new.raw_user_meta_data->>'avatarUrl', new.raw_user_meta_data->>'avatar_url')",
-            };
-        case 'username':
-            return {
-                field,
-                column: 'username',
-                sqlType: 'text',
-                fromNewUser: "new.raw_user_meta_data->>'username'",
-            };
-        case 'phone':
-            return { field, column: 'phone', sqlType: 'text', fromNewUser: 'new.phone' };
-        default:
-            return null;
-    }
-}
-function quoteIdentifier(value) {
-    return `"${value.replaceAll('"', '""')}"`;
-}
-function getProfileDesiredStateHash(args) {
-    const state = {
-        artifactKey: PROFILE_ARTIFACT_KEY,
-        table: args.table,
-        primaryKey: args.primaryKey,
-        createStrategy: args.createStrategy,
-        updateStrategy: args.updateStrategy,
-        managedColumns: args.columns.map((column) => ({
-            field: column.field,
-            column: column.column,
-            sqlType: column.sqlType,
-        })),
-        policyVersion: PROFILE_POLICY_VERSION,
-        reconcilerVersion: PROFILE_RECONCILER_VERSION,
-    };
-    return createHash('sha256').update(JSON.stringify(state)).digest('hex');
-}
-function resolveProfileColumns(fields) {
-    const columns = new Map();
-    for (const field of fields) {
-        const column = mapProfileFieldToColumn(field);
-        if (!column) {
-            throw new Error(`Unsupported Supabase profile field "${field}". Supported fields: ${getSupportedProfileFields().join(', ')}.`);
-        }
-        if (columns.has(column.column)) {
-            continue;
-        }
-        columns.set(column.column, column);
-    }
-    return [...columns.values()].sort((left, right) => MANAGED_PROFILE_COLUMNS.indexOf(left.column) -
-        MANAGED_PROFILE_COLUMNS.indexOf(right.column));
-}
-function normalizeFieldList(values) {
-    const source = values ?? DEFAULT_PROFILE_FIELDS;
-    const next = [];
-    for (const value of source) {
-        const normalized = value.trim();
-        if (!normalized) {
-            throw new Error('Invalid Supabase profile field "". Profile fields must be non-empty.');
-        }
-        if (next.includes(normalized)) {
-            continue;
-        }
-        next.push(normalized);
-    }
-    return next;
-}
-function getSupportedProfileFields() {
-    return ['email', 'displayName', 'firstName', 'lastName', 'avatarUrl', 'username', 'phone'];
-}
-function normalizeIdentifier(value) {
-    const trimmed = value.trim();
-    if (!trimmed)
-        return '';
-    if (trimmed === 'users') {
-        throw new Error('Invalid Supabase profile table identifier "users". public.users is reserved for identity conflict detection; use a dedicated profile table such as "profiles".');
-    }
-    if (!/^[a-z_][a-z0-9_]*$/.test(trimmed)) {
-        throw new Error(`Invalid Supabase profile table identifier "${trimmed}". Use snake_case letters, numbers, and underscores.`);
-    }
-    return trimmed;
-}
-function escapeSqlLiteral(value) {
-    return value.replaceAll("'", "''");
-}
-//# sourceMappingURL=profile.js.map

package/dist/adapters/minikube/auth/supabase/profile.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,2BAA2B,GAAG,YAAY,CAAC;AACjD,MAAM,+BAA+B,GAAG,SAAS,CAAC;AAClD,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAC9C,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAE5C,MAAM,uBAAuB,GAAG;IAC9B,OAAO;IACP,cAAc;IACd,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,UAAU;IACV,OAAO;CACC,CAAC;AAmBX,MAAM,UAAU,2BAA2B,CAAC,QAA4B;IACtE,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,IAAI,2BAA2B,CAAC;IACrF,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,IAAI,+BAA+B,CAAC;IACjG,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,IAAI,+BAA+B,CAAC;IACjG,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,0BAA0B,CAAC;YACzB,KAAK;YACL,UAAU;YACV,cAAc;YACd,cAAc;YACd,OAAO;SACR,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,cAAc;QACd,cAAc;QACd,OAAO;QACP,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,YAAkC;IACjF,MAAM,KAAK,GAAG,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,eAAe,CAAC,cAAc,YAAY,CAAC,KAAK,OAAO,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,eAAe,CAAC,wBAAwB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACvF,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO;SACtC,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CACT,sBAAsB,KAAK,6BAA6B,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,CAC9G;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,MAAM,CAC9D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAC3C;SACE,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,KAAK,0BAA0B,eAAe,CAAC,MAAM,CAAC,GAAG,CAC5F;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SACjF,GAAG,CAAC,eAAe,CAAC;SACpB,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAC/F,IAAI,CACL,CAAC;IACF,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO;SAC3C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAC5C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;IACJ,MAAM,cAAc,GAAG,CAAC,GAAG,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpF,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,MAAM,cAAc,GAClB,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,KAAK,oBAAoB;QAC9F,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GACd,YAAY,CAAC,cAAc,KAAK,SAAS;QACvC,CAAC,CAAC;oCAC4B,YAAY;;;;;;;uBAOzB,KAAK,KAAK,aAAa;YAClC,YAAY;;MAElB,cAAc;;;;;;oCAMgB,YAAY;oCACZ,YAAY;oCACZ,YAAY;;yBAEvB,WAAW;iBACnB,WAAW;;yCAEa,YAAY;CACpD;QACK,CAAC,CAAC;yBACiB,WAAW;iCACH,YAAY;CAC5C,CAAC;IAEA,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;4BAyBmB,oBAAoB;;;;;;sDAMM,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;6LACmG,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;oCAK7L,KAAK;;;;;;qBAMpB,KAAK;qBACL,KAAK;qBACL,KAAK;EACxB,YAAY;qBACO,KAAK;EACxB,yBAAyB;;;;;;;iCAOM,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;uCAM9B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;4CAM/B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;+BAMjD,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;yBAG1C,KAAK;uBACP,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,OAAO,CAAC;;;;;;;;;;iCAUnC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;uCAO9B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;yCAWlC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;4CAgBjC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;iCAM/C,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;uCAQ9B,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;yBAelD,KAAK;uBACP,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,qBAAqB,CAAC;;;;;;;;;;;;4BAYtD,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;4BAYpC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;;;4BAapC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;;;;;;;;;;;qBAW3C,KAAK;;6BAEG,KAAK;+BACH,KAAK;EAClC,cAAc;;wBAEQ,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC,cAAc,KAAK;gBAC9E,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC;cACrD,KAAK;;;;;wBAKK,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC,cAAc,KAAK;gBAC9E,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC;cACrD,KAAK;;;;;EAKjB,UAAU;;;;;;;;KAQP,oBAAoB;KACpB,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC;KACpC,YAAY,CAAC,gBAAgB;;;;;;;;;;CAUjC,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAC/E,KAAK,aAAa;YAChB,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,0HAA0H;aAC7H,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,uFAAuF;aAC1F,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,qFAAqF;aACxF,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,uFAAuF;aAC1F,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,qCAAqC;aACnD,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAC/E;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED,SAAS,0BAA0B,CAAC,IAMnC;IACC,MAAM,KAAK,GAAG;QACZ,WAAW,EAAE,oBAAoB;QACjC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,aAAa,EAAE,sBAAsB;QACrC,iBAAiB,EAAE,0BAA0B;KAC9C,CAAC;IAEF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAyB;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,wBAAwB,yBAAyB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC/B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAkD,CAAC;QACxF,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAkD,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAqC;IAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,sBAAsB,CAAC;IAChD,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,gKAAgK,CACjK,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,8CAA8C,OAAO,sDAAsD,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import { createHash } from 'node:crypto';\n\nimport type { InfraManifestInput } from '../../../../types';\n\nconst DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];\nconst DEFAULT_PROFILE_PRIMARY_KEY = 'authUserId';\nconst DEFAULT_PROFILE_CREATE_STRATEGY = 'trigger';\nconst DEFAULT_PROFILE_UPDATE_STRATEGY = 'api';\nconst PROFILE_POLICY_VERSION = 1;\nconst PROFILE_RECONCILER_VERSION = 1;\nconst PROFILE_ARTIFACT_KEY = 'auth.profile';\n\nconst MANAGED_PROFILE_COLUMNS = [\n  'email',\n  'display_name',\n  'first_name',\n  'last_name',\n  'avatar_url',\n  'username',\n  'phone',\n] as const;\n\ninterface ProfileColumnSpec {\n  readonly field: string;\n  readonly column: string;\n  readonly sqlType: string;\n  readonly fromNewUser: string;\n}\n\nexport interface ResolvedProfileModel {\n  readonly enabled: boolean;\n  readonly table: string;\n  readonly primaryKey: string;\n  readonly createStrategy: string;\n  readonly updateStrategy: string;\n  readonly columns: readonly ProfileColumnSpec[];\n  readonly desiredStateHash: string;\n}\n\nexport function resolveSupabaseProfileModel(manifest: InfraManifestInput): ResolvedProfileModel {\n  const table = normalizeIdentifier(manifest.auth?.profile?.table ?? '');\n  const fields = normalizeFieldList(manifest.auth?.profile?.fields);\n  const primaryKey = manifest.auth?.profile?.primaryKey ?? DEFAULT_PROFILE_PRIMARY_KEY;\n  const createStrategy = manifest.auth?.profile?.createStrategy ?? DEFAULT_PROFILE_CREATE_STRATEGY;\n  const updateStrategy = manifest.auth?.profile?.updateStrategy ?? DEFAULT_PROFILE_UPDATE_STRATEGY;\n  const columns = resolveProfileColumns(fields);\n\n  const hash = table\n    ? getProfileDesiredStateHash({\n        table,\n        primaryKey,\n        createStrategy,\n        updateStrategy,\n        columns,\n      })\n    : '';\n\n  return {\n    enabled: table.length > 0,\n    table,\n    primaryKey,\n    createStrategy,\n    updateStrategy,\n    columns,\n    desiredStateHash: hash,\n  };\n}\n\nexport function getSupabaseProfileReconciliation(profileModel: ResolvedProfileModel): string {\n  const table = quoteIdentifier(profileModel.table);\n  const functionName = quoteIdentifier(`handle_new_${profileModel.table}_user`);\n  const triggerName = quoteIdentifier(`on_auth_user_created_${profileModel.table}`);\n  const configuredColumns = new Set(profileModel.columns.map((column) => column.column));\n  const addColumnSql = profileModel.columns\n    .map(\n      (column) =>\n        `alter table public.${table} add column if not exists ${quoteIdentifier(column.column)} ${column.sqlType};`,\n    )\n    .join('\\n');\n  const dropStaleManagedColumnSql = MANAGED_PROFILE_COLUMNS.filter(\n    (column) => !configuredColumns.has(column),\n  )\n    .map(\n      (column) => `alter table public.${table} drop column if exists ${quoteIdentifier(column)};`,\n    )\n    .join('\\n');\n  const insertColumns = ['id', ...profileModel.columns.map((column) => column.column)]\n    .map(quoteIdentifier)\n    .join(', ');\n  const insertValues = ['new.id', ...profileModel.columns.map((column) => column.fromNewUser)].join(\n    ', ',\n  );\n  const updateAssignments = profileModel.columns\n    .filter((column) => column.field === 'email')\n    .map(\n      (column) => `${quoteIdentifier(column.column)} = excluded.${quoteIdentifier(column.column)}`,\n    );\n  const conflictUpdate = [...updateAssignments, 'updated_at = now()'].join(',\\n    ');\n  const updateGrantColumns = profileModel.columns.map((column) => quoteIdentifier(column.column));\n  const updateGrantSql =\n    updateGrantColumns.length > 0\n      ? `grant update (${updateGrantColumns.join(', ')}) on table public.${table} to authenticated;`\n      : '';\n  const triggerSql =\n    profileModel.createStrategy === 'trigger'\n      ? `\ncreate or replace function public.${functionName}()\nreturns trigger\nlanguage plpgsql\nsecurity definer\nset search_path = pg_catalog, pg_temp\nas $$\nbegin\n  insert into public.${table} (${insertColumns})\n  values (${insertValues})\n  on conflict (id) do update set\n    ${conflictUpdate};\n\n  return new;\nend;\n$$;\n\nrevoke execute on function public.${functionName}() from PUBLIC;\nrevoke execute on function public.${functionName}() from anon;\nrevoke execute on function public.${functionName}() from authenticated;\n\ndrop trigger if exists ${triggerName} on auth.users;\ncreate trigger ${triggerName}\n  after insert on auth.users\n  for each row execute function public.${functionName}();\n`\n      : `\ndrop trigger if exists ${triggerName} on auth.users;\ndrop function if exists public.${functionName}();\n`;\n\n  return `-- Generated by @ankhorage/infra from manifest.auth.profile.\n-- Desired-state reconciliation for local Supabase; not a migration-history entry.\n\nbegin;\n\ncreate schema if not exists ankhorage_internal;\n\ncreate table if not exists ankhorage_internal.generated_schema_state (\n  artifact_key text primary key,\n  table_name text,\n  content_hash text not null,\n  applied_at timestamptz not null\n);\n\nalter table ankhorage_internal.generated_schema_state\n  add column if not exists table_name text;\n\ndo $$\ndeclare\n  previous_table_name text;\n  has_previous_state boolean;\nbegin\n  select table_name, true\n    into previous_table_name, has_previous_state\n    from ankhorage_internal.generated_schema_state\n    where artifact_key = '${PROFILE_ARTIFACT_KEY}';\n\n  if has_previous_state and previous_table_name is null then\n    raise exception 'existing auth.profile generated state is missing table identity; reset local Supabase or add an explicit cleanup migration before applying generated profile reconciliation';\n  end if;\n\n  if has_previous_state and previous_table_name <> '${escapeSqlLiteral(profileModel.table)}' then\n    raise exception 'profile.table changed from % to %; reset local Supabase or add an explicit cleanup migration before applying generated profile reconciliation', previous_table_name, '${escapeSqlLiteral(profileModel.table)}';\n  end if;\nend;\n$$;\n\ncreate table if not exists public.${table} (\n  id uuid primary key references auth.users(id) on delete cascade,\n  created_at timestamptz not null default now(),\n  updated_at timestamptz not null default now()\n);\n\nalter table public.${table} add column if not exists id uuid;\nalter table public.${table} add column if not exists created_at timestamptz not null default now();\nalter table public.${table} add column if not exists updated_at timestamptz not null default now();\n${addColumnSql}\nalter table public.${table} drop column if exists role;\n${dropStaleManagedColumnSql}\n\ndo $$\nbegin\n  if exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and c.contype = 'p'\n      and c.conkey <> array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n  ) then\n    raise exception 'profile table public.${escapeSqlLiteral(profileModel.table)} has a primary key that is not exactly id';\n  end if;\n\n  if not exists (\n    select 1\n    from pg_constraint\n    where conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and contype = 'p'\n  ) then\n    alter table public.${table}\n      add constraint ${quoteIdentifier(`${profileModel.table}_pkey`)} primary key (id);\n  end if;\nend;\n$$;\n\ndo $$\nbegin\n  if exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and c.contype = 'f'\n      and c.confrelid = 'auth.users'::regclass\n      and c.conkey && array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n      and (\n        c.confdeltype <> 'c'\n        or c.conkey <> array[\n          (\n            select a.attnum\n            from pg_attribute a\n            where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n              and a.attname = 'id'\n              and not a.attisdropped\n          )\n        ]::smallint[]\n        or c.confkey <> array[\n          (\n            select a.attnum\n            from pg_attribute a\n            where a.attrelid = 'auth.users'::regclass\n              and a.attname = 'id'\n              and not a.attisdropped\n          )\n        ]::smallint[]\n      )\n  ) then\n    raise exception 'profile table public.${escapeSqlLiteral(profileModel.table)} has an auth.users foreign key that is not exactly id -> auth.users(id) on delete cascade';\n  end if;\n\n  if not exists (\n    select 1\n    from pg_constraint c\n    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n      and c.confrelid = 'auth.users'::regclass\n      and c.contype = 'f'\n      and c.confdeltype = 'c'\n      and c.conkey = array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n      and c.confkey = array[\n        (\n          select a.attnum\n          from pg_attribute a\n          where a.attrelid = 'auth.users'::regclass\n            and a.attname = 'id'\n            and not a.attisdropped\n        )\n      ]::smallint[]\n  ) then\n    alter table public.${table}\n      add constraint ${quoteIdentifier(`${profileModel.table}_id_auth_users_fkey`)}\n      foreign key (id) references auth.users(id) on delete cascade;\n  end if;\nend;\n$$;\n\ndo $$\nbegin\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'\n      and c.column_name = 'id'\n      and c.udt_name = 'uuid'\n      and c.is_nullable = 'NO'\n  ) then\n    raise exception 'profile id column must be uuid not null';\n  end if;\n\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'\n      and c.column_name = 'created_at'\n      and c.data_type = 'timestamp with time zone'\n      and c.is_nullable = 'NO'\n      and c.column_default = 'now()'\n  ) then\n    raise exception 'profile created_at column must be timestamptz not null default now()';\n  end if;\n\n  if not exists (\n    select 1\n    from information_schema.columns c\n    where c.table_schema = 'public'\n      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'\n      and c.column_name = 'updated_at'\n      and c.data_type = 'timestamp with time zone'\n      and c.is_nullable = 'NO'\n      and c.column_default = 'now()'\n  ) then\n    raise exception 'profile updated_at column must be timestamptz not null default now()';\n  end if;\nend;\n$$;\n\nalter table public.${table} enable row level security;\n\nrevoke all on table public.${table} from anon, authenticated;\ngrant select on table public.${table} to authenticated;\n${updateGrantSql}\n\ndrop policy if exists ${quoteIdentifier(`${profileModel.table}_select_own`)} on public.${table};\ncreate policy ${quoteIdentifier(`${profileModel.table}_select_own`)}\n  on public.${table}\n  for select\n  to authenticated\n  using ((select auth.uid()) = id);\n\ndrop policy if exists ${quoteIdentifier(`${profileModel.table}_update_own`)} on public.${table};\ncreate policy ${quoteIdentifier(`${profileModel.table}_update_own`)}\n  on public.${table}\n  for update\n  to authenticated\n  using ((select auth.uid()) = id)\n  with check ((select auth.uid()) = id);\n${triggerSql}\ninsert into ankhorage_internal.generated_schema_state (\n  artifact_key,\n  table_name,\n  content_hash,\n  applied_at\n)\nvalues (\n  '${PROFILE_ARTIFACT_KEY}',\n  '${escapeSqlLiteral(profileModel.table)}',\n  '${profileModel.desiredStateHash}',\n  now()\n)\non conflict (artifact_key)\ndo update set\n  table_name = excluded.table_name,\n  content_hash = excluded.content_hash,\n  applied_at = excluded.applied_at;\n\ncommit;\n`;\n}\n\nfunction mapProfileFieldToColumn(field: string): ProfileColumnSpec | null {\n  switch (field) {\n    case 'email':\n      return { field, column: 'email', sqlType: 'text', fromNewUser: 'new.email' };\n    case 'displayName':\n      return {\n        field,\n        column: 'display_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'displayName', new.raw_user_meta_data->>'display_name', split_part(new.email, '@', 1))\",\n      };\n    case 'firstName':\n      return {\n        field,\n        column: 'first_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'firstName', new.raw_user_meta_data->>'first_name')\",\n      };\n    case 'lastName':\n      return {\n        field,\n        column: 'last_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'lastName', new.raw_user_meta_data->>'last_name')\",\n      };\n    case 'avatarUrl':\n      return {\n        field,\n        column: 'avatar_url',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'avatarUrl', new.raw_user_meta_data->>'avatar_url')\",\n      };\n    case 'username':\n      return {\n        field,\n        column: 'username',\n        sqlType: 'text',\n        fromNewUser: \"new.raw_user_meta_data->>'username'\",\n      };\n    case 'phone':\n      return { field, column: 'phone', sqlType: 'text', fromNewUser: 'new.phone' };\n    default:\n      return null;\n  }\n}\n\nfunction quoteIdentifier(value: string): string {\n  return `\"${value.replaceAll('\"', '\"\"')}\"`;\n}\n\nfunction getProfileDesiredStateHash(args: {\n  readonly table: string;\n  readonly primaryKey: string;\n  readonly createStrategy: string;\n  readonly updateStrategy: string;\n  readonly columns: readonly ProfileColumnSpec[];\n}): string {\n  const state = {\n    artifactKey: PROFILE_ARTIFACT_KEY,\n    table: args.table,\n    primaryKey: args.primaryKey,\n    createStrategy: args.createStrategy,\n    updateStrategy: args.updateStrategy,\n    managedColumns: args.columns.map((column) => ({\n      field: column.field,\n      column: column.column,\n      sqlType: column.sqlType,\n    })),\n    policyVersion: PROFILE_POLICY_VERSION,\n    reconcilerVersion: PROFILE_RECONCILER_VERSION,\n  };\n\n  return createHash('sha256').update(JSON.stringify(state)).digest('hex');\n}\n\nfunction resolveProfileColumns(fields: readonly string[]): ProfileColumnSpec[] {\n  const columns = new Map<string, ProfileColumnSpec>();\n\n  for (const field of fields) {\n    const column = mapProfileFieldToColumn(field);\n    if (!column) {\n      throw new Error(\n        `Unsupported Supabase profile field \"${field}\". Supported fields: ${getSupportedProfileFields().join(', ')}.`,\n      );\n    }\n\n    if (columns.has(column.column)) {\n      continue;\n    }\n    columns.set(column.column, column);\n  }\n\n  return [...columns.values()].sort(\n    (left, right) =>\n      MANAGED_PROFILE_COLUMNS.indexOf(left.column as (typeof MANAGED_PROFILE_COLUMNS)[number]) -\n      MANAGED_PROFILE_COLUMNS.indexOf(right.column as (typeof MANAGED_PROFILE_COLUMNS)[number]),\n  );\n}\n\nfunction normalizeFieldList(values: readonly string[] | undefined): string[] {\n  const source = values ?? DEFAULT_PROFILE_FIELDS;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized) {\n      throw new Error('Invalid Supabase profile field \"\". Profile fields must be non-empty.');\n    }\n\n    if (next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  return next;\n}\n\nfunction getSupportedProfileFields(): string[] {\n  return ['email', 'displayName', 'firstName', 'lastName', 'avatarUrl', 'username', 'phone'];\n}\n\nfunction normalizeIdentifier(value: string): string {\n  const trimmed = value.trim();\n  if (!trimmed) return '';\n\n  if (trimmed === 'users') {\n    throw new Error(\n      'Invalid Supabase profile table identifier \"users\". public.users is reserved for identity conflict detection; use a dedicated profile table such as \"profiles\".',\n    );\n  }\n\n  if (!/^[a-z_][a-z0-9_]*$/.test(trimmed)) {\n    throw new Error(\n      `Invalid Supabase profile table identifier \"${trimmed}\". Use snake_case letters, numbers, and underscores.`,\n    );\n  }\n\n  return trimmed;\n}\n\nfunction escapeSqlLiteral(value: string): string {\n  return value.replaceAll(\"'\", \"''\");\n}\n"]}

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.d.ts

@@ -1,7 +0,0 @@
-import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';
-import type { MinikubeAdapterArtifacts } from '../contracts';
-export declare function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args: {
-    readonly appManifest: InfrastructureGenerationOptions['appManifest'];
-    readonly manifest: InfraManifestInput;
-}): MinikubeAdapterArtifacts;
-//# sourceMappingURL=targetAwareOAuthRuntime.d.ts.map

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"targetAwareOAuthRuntime.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/targetAwareOAuthRuntime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,KAAK,EAAE,wBAAwB,EAA6B,MAAM,cAAc,CAAC;AAUxF,wBAAgB,gDAAgD,CAAC,IAAI,EAAE;IACrE,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC,aAAa,CAAC,CAAC;IACrE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC,GAAG,wBAAwB,CA8B3B"}

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.js

@@ -1,104 +0,0 @@
-import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';
-import { resolveAuthTargetRedirectModel } from '../../../authTargetRedirects';
-import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
-export function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args) {
-    const baseArtifacts = generateSupabaseOAuthRuntimeArtifacts(args.manifest);
-    if (!baseArtifacts.providerLifecycle.some((lifecycle) => lifecycle.id === 'supabase-auth')) {
-        return baseArtifacts;
-    }
-    const callbackRoute = normalizeAuthCallbackRoute(args.manifest.auth?.oauth?.callbackRoute ?? '');
-    const targets = resolveAuthTargetRedirectModel({
-        callbackRoute,
-        targets: args.appManifest?.deploy?.targets,
-    });
-    const policy = {
-        callbackRoute,
-        localPatterns: targets.webEnabled ? getLocalAuthRedirectPatterns(callbackRoute) : [],
-        nativeRedirectUris: targets.nativeRedirectUris,
-        webEnabled: targets.webEnabled,
-    };
-    return {
-        ...baseArtifacts,
-        files: baseArtifacts.files.map((file) => file.path === 'infra/minikube/auth/oauth-runtime.md'
-            ? { ...file, content: getTargetAwareGuide(policy) }
-            : file),
-        providerLifecycle: baseArtifacts.providerLifecycle.map((lifecycle) => lifecycle.id === 'supabase-auth' ? applyRedirectPolicy(lifecycle, policy) : lifecycle),
-        warnings: [...baseArtifacts.warnings, ...targets.warnings],
-    };
-}
-function applyRedirectPolicy(lifecycle, policy) {
-    return {
-        ...lifecycle,
-        reconciliationCommands: lifecycle.reconciliationCommands.map((entry) => ({
-            ...entry,
-            command: rewriteReconciliationCommand(entry.command, policy),
-        })),
-        statusChecks: lifecycle.statusChecks.map((entry) => ({
-            ...entry,
-            command: getTargetAwareStatusCommand(policy),
-        })),
-    };
-}
-function rewriteReconciliationCommand(command, policy) {
-    const legacyPatterns = getLocalAuthRedirectPatterns(policy.callbackRoute).join(',');
-    const legacyPolicy = `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path},${legacyPatterns}"
-if [[ -n "\${OAUTH_NATIVE_REDIRECT_URLS:-}" ]]; then
-  oauth_redirect_allow_list="\${oauth_redirect_allow_list},\${OAUTH_NATIVE_REDIRECT_URLS}"
-fi`;
-    const staticRedirects = [...policy.localPatterns, ...policy.nativeRedirectUris].join(',');
-    const suffix = staticRedirects ? `,${staticRedirects}` : '';
-    const canonicalPolicy = policy.webEnabled
-        ? `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path}${suffix}"`
-        : `oauth_redirect_allow_list='${staticRedirects}'`;
-    let rewritten = replaceOnce(command, legacyPolicy, canonicalPolicy);
-    if (!policy.webEnabled) {
-        rewritten = replaceOnce(rewritten, 'oauth_site_url="${SITE_URL%/}"\n', '');
-    }
-    return rewritten;
-}
-function getTargetAwareStatusCommand(policy) {
-    const appCallback = policy.webEnabled
-        ? `if [[ -n "\${SITE_URL:-}" ]]; then
-  echo "- provider supabase-auth/app-callback: \${SITE_URL%/}/\${oauth_callback_path}"
-else
-  echo "- provider supabase-auth/app-callback: unavailable"
-fi`
-        : 'echo "- provider supabase-auth/app-callback: disabled (web target)"';
-    const localPatterns = policy.localPatterns.join(',') || 'none';
-    const nativeRedirects = policy.nativeRedirectUris.join(',') || 'none';
-    return `oauth_callback_route='${policy.callbackRoute}'
-oauth_callback_path="\${oauth_callback_route#/}"
-if [[ -n "\${API_EXTERNAL_URL:-}" ]]; then
-  echo "- provider supabase-auth/provider-callback: \${API_EXTERNAL_URL%/}/callback"
-else
-  echo "- provider supabase-auth/provider-callback: unavailable"
-fi
-${appCallback}
-echo "- provider supabase-auth/local-callback-patterns: ${localPatterns}"
-echo "- provider supabase-auth/native-callbacks: ${nativeRedirects}"`;
-}
-function getTargetAwareGuide(policy) {
-    const nativeRedirects = policy.nativeRedirectUris.length
-        ? policy.nativeRedirectUris.map((uri) => `- \`${uri}\``).join('\n')
-        : '- none';
-    return `# Supabase OAuth Runtime Reconciliation
-
-The provider callback remains project-owned. GoTrue-to-app redirects use the configured callback
-route \`${policy.callbackRoute}\` and are derived from \`AppManifest.deploy.targets\`.
-
-- Web target: ${policy.webEnabled ? 'enabled' : 'disabled'}
-- Native callbacks:
-${nativeRedirects}
-
-Local loopback patterns are emitted only for an enabled Web target. Native callbacks come only
-from enabled Android/iOS target schemes; no environment variable or slug-derived identity can add
-a native callback. Provider credential values remain sourced from trusted secret resolution.
-`;
-}
-function replaceOnce(value, search, replacement) {
-    if (!value.includes(search)) {
-        throw new Error('Supabase OAuth redirect reconciliation template drifted from its canonical form.');
-    }
-    return value.replace(search, replacement);
-}
-//# sourceMappingURL=targetAwareOAuthRuntime.js.map

package/dist/adapters/minikube/auth/targetAwareOAuthRuntime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"targetAwareOAuthRuntime.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/auth/targetAwareOAuthRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,gBAAgB,CAAC;AASvE,MAAM,UAAU,gDAAgD,CAAC,IAGhE;IACC,MAAM,aAAa,GAAG,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,eAAe,CAAC,EAAE,CAAC;QAC3F,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC7C,aAAa;QACb,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO;KAC3C,CAAC,CAAC;IACH,MAAM,MAAM,GAAmB;QAC7B,aAAa;QACb,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;QACpF,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,OAAO;QACL,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,IAAI,CAAC,IAAI,KAAK,sCAAsC;YAClD,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE;YACnD,CAAC,CAAC,IAAI,CACT;QACD,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CACtF;QACD,QAAQ,EAAE,CAAC,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,SAAoC,EACpC,MAAsB;IAEtB,OAAO;QACL,GAAG,SAAS;QACZ,sBAAsB,EAAE,SAAS,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvE,GAAG,KAAK;YACR,OAAO,EAAE,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;SAC7D,CAAC,CAAC;QACH,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnD,GAAG,KAAK;YACR,OAAO,EAAE,2BAA2B,CAAC,MAAM,CAAC;SAC7C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAe,EAAE,MAAsB;IAC3E,MAAM,cAAc,GAAG,4BAA4B,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,MAAM,YAAY,GAAG,4FAA4F,cAAc;;;GAG9H,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU;QACvC,CAAC,CAAC,2FAA2F,MAAM,GAAG;QACtG,CAAC,CAAC,8BAA8B,eAAe,GAAG,CAAC;IACrD,IAAI,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IAEpE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAsB;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU;QACnC,CAAC,CAAC;;;;GAIH;QACC,CAAC,CAAC,qEAAqE,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IAEtE,OAAO,yBAAyB,MAAM,CAAC,aAAa;;;;;;;EAOpD,WAAW;0DAC6C,aAAa;mDACpB,eAAe,GAAG,CAAC;AACtE,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAsB;IACjD,MAAM,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC,MAAM;QACtD,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnE,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO;;;UAGC,MAAM,CAAC,aAAa;;gBAEd,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;;EAExD,eAAe;;;;;CAKhB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,WAAmB;IACrE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';\nimport { resolveAuthTargetRedirectModel } from '../../../authTargetRedirects';\nimport type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';\nimport { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';\n\ninterface RedirectPolicy {\n  readonly callbackRoute: string;\n  readonly localPatterns: readonly string[];\n  readonly nativeRedirectUris: readonly string[];\n  readonly webEnabled: boolean;\n}\n\nexport function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args: {\n  readonly appManifest: InfrastructureGenerationOptions['appManifest'];\n  readonly manifest: InfraManifestInput;\n}): MinikubeAdapterArtifacts {\n  const baseArtifacts = generateSupabaseOAuthRuntimeArtifacts(args.manifest);\n  if (!baseArtifacts.providerLifecycle.some((lifecycle) => lifecycle.id === 'supabase-auth')) {\n    return baseArtifacts;\n  }\n\n  const callbackRoute = normalizeAuthCallbackRoute(args.manifest.auth?.oauth?.callbackRoute ?? '');\n  const targets = resolveAuthTargetRedirectModel({\n    callbackRoute,\n    targets: args.appManifest?.deploy?.targets,\n  });\n  const policy: RedirectPolicy = {\n    callbackRoute,\n    localPatterns: targets.webEnabled ? getLocalAuthRedirectPatterns(callbackRoute) : [],\n    nativeRedirectUris: targets.nativeRedirectUris,\n    webEnabled: targets.webEnabled,\n  };\n\n  return {\n    ...baseArtifacts,\n    files: baseArtifacts.files.map((file) =>\n      file.path === 'infra/minikube/auth/oauth-runtime.md'\n        ? { ...file, content: getTargetAwareGuide(policy) }\n        : file,\n    ),\n    providerLifecycle: baseArtifacts.providerLifecycle.map((lifecycle) =>\n      lifecycle.id === 'supabase-auth' ? applyRedirectPolicy(lifecycle, policy) : lifecycle,\n    ),\n    warnings: [...baseArtifacts.warnings, ...targets.warnings],\n  };\n}\n\nfunction applyRedirectPolicy(\n  lifecycle: MinikubeProviderLifecycle,\n  policy: RedirectPolicy,\n): MinikubeProviderLifecycle {\n  return {\n    ...lifecycle,\n    reconciliationCommands: lifecycle.reconciliationCommands.map((entry) => ({\n      ...entry,\n      command: rewriteReconciliationCommand(entry.command, policy),\n    })),\n    statusChecks: lifecycle.statusChecks.map((entry) => ({\n      ...entry,\n      command: getTargetAwareStatusCommand(policy),\n    })),\n  };\n}\n\nfunction rewriteReconciliationCommand(command: string, policy: RedirectPolicy): string {\n  const legacyPatterns = getLocalAuthRedirectPatterns(policy.callbackRoute).join(',');\n  const legacyPolicy = `oauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path},${legacyPatterns}\"\nif [[ -n \"\\${OAUTH_NATIVE_REDIRECT_URLS:-}\" ]]; then\n  oauth_redirect_allow_list=\"\\${oauth_redirect_allow_list},\\${OAUTH_NATIVE_REDIRECT_URLS}\"\nfi`;\n  const staticRedirects = [...policy.localPatterns, ...policy.nativeRedirectUris].join(',');\n  const suffix = staticRedirects ? `,${staticRedirects}` : '';\n  const canonicalPolicy = policy.webEnabled\n    ? `oauth_redirect_allow_list=\"\\${oauth_site_url},\\${oauth_site_url}/\\${oauth_callback_path}${suffix}\"`\n    : `oauth_redirect_allow_list='${staticRedirects}'`;\n  let rewritten = replaceOnce(command, legacyPolicy, canonicalPolicy);\n\n  if (!policy.webEnabled) {\n    rewritten = replaceOnce(rewritten, 'oauth_site_url=\"${SITE_URL%/}\"\\n', '');\n  }\n\n  return rewritten;\n}\n\nfunction getTargetAwareStatusCommand(policy: RedirectPolicy): string {\n  const appCallback = policy.webEnabled\n    ? `if [[ -n \"\\${SITE_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/app-callback: \\${SITE_URL%/}/\\${oauth_callback_path}\"\nelse\n  echo \"- provider supabase-auth/app-callback: unavailable\"\nfi`\n    : 'echo \"- provider supabase-auth/app-callback: disabled (web target)\"';\n  const localPatterns = policy.localPatterns.join(',') || 'none';\n  const nativeRedirects = policy.nativeRedirectUris.join(',') || 'none';\n\n  return `oauth_callback_route='${policy.callbackRoute}'\noauth_callback_path=\"\\${oauth_callback_route#/}\"\nif [[ -n \"\\${API_EXTERNAL_URL:-}\" ]]; then\n  echo \"- provider supabase-auth/provider-callback: \\${API_EXTERNAL_URL%/}/callback\"\nelse\n  echo \"- provider supabase-auth/provider-callback: unavailable\"\nfi\n${appCallback}\necho \"- provider supabase-auth/local-callback-patterns: ${localPatterns}\"\necho \"- provider supabase-auth/native-callbacks: ${nativeRedirects}\"`;\n}\n\nfunction getTargetAwareGuide(policy: RedirectPolicy): string {\n  const nativeRedirects = policy.nativeRedirectUris.length\n    ? policy.nativeRedirectUris.map((uri) => `- \\`${uri}\\``).join('\\n')\n    : '- none';\n\n  return `# Supabase OAuth Runtime Reconciliation\n\nThe provider callback remains project-owned. GoTrue-to-app redirects use the configured callback\nroute \\`${policy.callbackRoute}\\` and are derived from \\`AppManifest.deploy.targets\\`.\n\n- Web target: ${policy.webEnabled ? 'enabled' : 'disabled'}\n- Native callbacks:\n${nativeRedirects}\n\nLocal loopback patterns are emitted only for an enabled Web target. Native callbacks come only\nfrom enabled Android/iOS target schemes; no environment variable or slug-derived identity can add\na native callback. Provider credential values remain sourced from trusted secret resolution.\n`;\n}\n\nfunction replaceOnce(value: string, search: string, replacement: string): string {\n  if (!value.includes(search)) {\n    throw new Error(\n      'Supabase OAuth redirect reconciliation template drifted from its canonical form.',\n    );\n  }\n  return value.replace(search, replacement);\n}\n"]}

package/dist/adapters/minikube/authz/cerbos/index.d.ts

@@ -1,13 +0,0 @@
-import type { AppManifest } from '@ankhorage/contracts';
-import type { InfraManifestInput } from '../../../../types';
-import type { MinikubeAdapterArtifacts } from '../../contracts';
-export declare function generateCerbosAuthzArtifacts(args: {
-    manifest: InfraManifestInput;
-    namespace: string;
-    appManifest?: CerbosAppManifest;
-}): MinikubeAdapterArtifacts;
-type CerbosAppManifest = Pick<AppManifest, 'metadata' | 'navigator' | 'screens'> & {
-    infra?: AppManifest['infra'];
-};
-export {};
-//# sourceMappingURL=index.d.ts.map

package/dist/adapters/minikube/authz/cerbos/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/authz/cerbos/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAkC,MAAM,sBAAsB,CAAC;AAGxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAA6B,MAAM,iBAAiB,CAAC;AAI3F,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC,GAAG,wBAAwB,CAuD3B;AA2GD,KAAK,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC,GAAG;IACjF,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;CAC9B,CAAC"}