@ankhorage/infra 4.1.12 → 5.1.0

package/src/adapters/minikube/auth/oauthRuntime.ts

@@ -1,163 +0,0 @@
-import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';
-import type { InfraManifestInput } from '../../../types';
-import type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';
-
-interface SupabaseOAuthRuntimeModel {
-  callbackRoute: string;
-  envPrefixes: readonly string[];
-  localRedirectPatterns: readonly string[];
-}
-
-export function generateSupabaseOAuthRuntimeArtifacts(
-  manifest: InfraManifestInput,
-): MinikubeAdapterArtifacts {
-  const oauthRuntime = resolveOAuthRuntimeModel(manifest);
-  if (!oauthRuntime) {
-    return {
-      files: [],
-      resources: [],
-      providerLifecycle: [],
-      envEntries: [],
-      warnings: [],
-    };
-  }
-
-  return {
-    files: [
-      {
-        path: 'infra/minikube/auth/oauth-runtime.md',
-        content: getOAuthRuntimeGuide(oauthRuntime),
-      },
-    ],
-    resources: [],
-    providerLifecycle: [getOAuthProviderLifecycle(oauthRuntime)],
-    envEntries: [],
-    warnings: [],
-  };
-}
-
-function resolveOAuthRuntimeModel(manifest: InfraManifestInput): SupabaseOAuthRuntimeModel | null {
-  const oauth = manifest.auth?.oauth;
-  if (!oauth?.enabled) return null;
-
-  const providers = oauth.providers.filter((provider) => provider.enabled !== false);
-  if (providers.length === 0) return null;
-
-  const callbackRoute = normalizeAuthCallbackRoute(oauth.callbackRoute);
-  const envPrefixes = providers.map((provider) => {
-    const prefix = provider.id
-      .trim()
-      .toUpperCase()
-      .replace(/[^A-Z0-9]+/gu, '_')
-      .replace(/^_+|_+$/gu, '');
-    if (!prefix) {
-      throw new Error(
-        `OAuth provider "${provider.id}" cannot be mapped to GoTrue environment keys.`,
-      );
-    }
-    return prefix;
-  });
-
-  return {
-    callbackRoute,
-    envPrefixes,
-    localRedirectPatterns: getLocalAuthRedirectPatterns(callbackRoute),
-  };
-}
-
-function getOAuthProviderLifecycle(
-  oauthRuntime: SupabaseOAuthRuntimeModel,
-): MinikubeProviderLifecycle {
-  return {
-    id: 'supabase-auth',
-    namespace: 'supabase',
-    endpoints: [],
-    readinessChecks: [
-      {
-        label: 'GoTrue',
-        namespace: 'supabase',
-        resource: 'deployment/auth',
-        timeoutSeconds: 600,
-      },
-    ],
-    migrationCommands: [],
-    reconciliationCommands: [
-      {
-        label: 'OAuth redirect and runtime rollout reconciliation',
-        command: getOAuthRuntimeReconciliationCommand(oauthRuntime),
-      },
-    ],
-    statusChecks: [
-      {
-        label: 'OAuth redirect configuration',
-        command: getOAuthRuntimeStatusCommand(oauthRuntime),
-      },
-    ],
-  };
-}
-
-function getOAuthRuntimeReconciliationCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {
-  const localPatterns = oauthRuntime.localRedirectPatterns.join(',');
-  const providerExports = oauthRuntime.envPrefixes
-    .map(
-      (prefix) => `export GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI="\${oauth_provider_callback}"
-write_env_value GOTRUE_EXTERNAL_${prefix}_REDIRECT_URI "\${oauth_provider_callback}"`,
-    )
-    .join('\n');
-
-  return `oauth_callback_route='${oauthRuntime.callbackRoute}'
-oauth_callback_path="\${oauth_callback_route#/}"
-oauth_site_url="\${SITE_URL%/}"
-oauth_provider_callback="\${API_EXTERNAL_URL%/}/callback"
-oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path},${localPatterns}"
-if [[ -n "\${OAUTH_NATIVE_REDIRECT_URLS:-}" ]]; then
-  oauth_redirect_allow_list="\${oauth_redirect_allow_list},\${OAUTH_NATIVE_REDIRECT_URLS}"
-fi
-export ADDITIONAL_REDIRECT_URLS="\${oauth_redirect_allow_list}"
-write_env_value ADDITIONAL_REDIRECT_URLS "\${oauth_redirect_allow_list}"
-${providerExports}
-sync_supabase_secrets
-kubectl --context "\${PROFILE}" -n supabase rollout restart deployment/auth >/dev/null
-kubectl --context "\${PROFILE}" -n supabase rollout status deployment/auth --timeout=600s`;
-}
-
-function getOAuthRuntimeStatusCommand(oauthRuntime: SupabaseOAuthRuntimeModel): string {
-  return `oauth_callback_route='${oauthRuntime.callbackRoute}'
-oauth_callback_path="\${oauth_callback_route#/}"
-if [[ -n "\${API_EXTERNAL_URL:-}" ]]; then
-  echo "- provider supabase-auth/provider-callback: \${API_EXTERNAL_URL%/}/callback"
-else
-  echo "- provider supabase-auth/provider-callback: unavailable"
-fi
-if [[ -n "\${SITE_URL:-}" ]]; then
-  echo "- provider supabase-auth/app-callback: \${SITE_URL%/}/\${oauth_callback_path}"
-else
-  echo "- provider supabase-auth/app-callback: unavailable"
-fi
-echo "- provider supabase-auth/local-callback-patterns: ${oauthRuntime.localRedirectPatterns.join(',')}"`;
-}
-
-function getOAuthRuntimeGuide(oauthRuntime: SupabaseOAuthRuntimeModel): string {
-  const localPatterns = oauthRuntime.localRedirectPatterns
-    .map((pattern) => `- \`${pattern}\``)
-    .join('\n');
-
-  return `# Supabase OAuth Runtime Reconciliation
-
-The provider callback is derived from the active project gateway as
-\`\${API_EXTERNAL_URL%/}/callback\`, which resolves to the project-owned
-\`/auth/v1/callback\` endpoint. GoTrue-to-app redirects use the configured callback route
-\`${oauthRuntime.callbackRoute}\`.
-
-Local Minikube reconciliation adds only callback-scoped loopback patterns:
-
-${localPatterns}
-
-Native callback URIs may be supplied through \`OAUTH_NATIVE_REDIRECT_URLS\`. The generated
-provider lifecycle persists redirect metadata, re-syncs the canonical Supabase runtime
-ConfigMap and Secret sources, then forces \`deployment/auth\` to restart and waits up to 600
-seconds for the rollout. OAuth credential values remain sourced from trusted secret resolution
-and are never embedded in generated files. A failed rollout stops Infra Up before its success
-message.
-`;
-}

package/src/adapters/minikube/auth/supabase/index.test.ts

@@ -1,227 +0,0 @@
-import type { InfraManifest } from '@ankhorage/contracts';
-import { describe, expect, test } from 'bun:test';
-
-import { generateSupabaseAuthArtifacts } from './index';
-
-describe('generateSupabaseAuthArtifacts profile tables', () => {
-  test('generates profile metadata env vars and SQL migration when profile table is declared', () => {
-    const artifacts = generateSupabaseAuthArtifacts({
-      namespace: 'scan-app',
-      manifest: createManifest({
-        profile: {
-          fields: ['email', 'displayName', 'avatarUrl'],
-          table: 'profiles',
-          primaryKey: 'authUserId',
-          createStrategy: 'trigger',
-          updateStrategy: 'api',
-        },
-      }),
-    });
-
-    const runtimeConfig = artifacts.files.find(
-      (file) =>
-        file.path === 'infra/minikube/k8s/auth/supabase/app-runtime-auth.env.configmap.yaml',
-    );
-    expect(runtimeConfig?.content).toContain('AUTH_PROFILE_TABLE: "profiles"');
-    expect(runtimeConfig?.content).toContain('AUTH_PROFILE_PRIMARY_KEY: "authUserId"');
-    expect(runtimeConfig?.content).toContain('AUTH_PROFILE_CREATE_STRATEGY: "trigger"');
-    expect(runtimeConfig?.content).toContain('AUTH_PROFILE_UPDATE_STRATEGY: "api"');
-
-    const reconciliation = artifacts.files.find(
-      (file) => file.path === 'infra/minikube/supabase/generated/auth_profiles.sql',
-    );
-    expect(reconciliation?.content).toContain('begin;');
-    expect(reconciliation?.content).toContain('commit;');
-    expect(reconciliation?.content).toContain('create table if not exists public."profiles"');
-    expect(reconciliation?.content).toContain(
-      'id uuid primary key references auth.users(id) on delete cascade',
-    );
-    expect(reconciliation?.content).toContain(
-      'alter table public."profiles" add column if not exists "display_name" text',
-    );
-    expect(reconciliation?.content).toContain(
-      'alter table public."profiles" add column if not exists "avatar_url" text',
-    );
-    expect(reconciliation?.content).toContain(
-      'alter table public."profiles" drop column if exists role',
-    );
-    expect(reconciliation?.content).toContain(
-      'alter table public."profiles" drop column if exists "first_name"',
-    );
-    expect(reconciliation?.content).toContain(
-      'alter table public."profiles" enable row level security',
-    );
-    expect(reconciliation?.content).toContain(
-      'revoke all on table public."profiles" from anon, authenticated',
-    );
-    expect(reconciliation?.content).toContain(
-      'grant select on table public."profiles" to authenticated',
-    );
-    expect(reconciliation?.content).toContain(
-      'grant update ("email", "display_name", "avatar_url") on table public."profiles" to authenticated',
-    );
-    expect(reconciliation?.content).not.toContain('role text not null');
-    expect(reconciliation?.content).not.toContain('grant update ("role")');
-    expect(reconciliation?.content).toContain('create policy "profiles_select_own"');
-    expect(reconciliation?.content).toContain('to authenticated');
-    expect(reconciliation?.content).toContain('create policy "profiles_update_own"');
-    expect(reconciliation?.content).toContain('using ((select auth.uid()) = id)');
-    expect(reconciliation?.content).toContain('create schema if not exists ankhorage_internal');
-    expect(reconciliation?.content).toContain('ankhorage_internal.generated_schema_state');
-    expect(reconciliation?.content).toContain('table_name text');
-    expect(reconciliation?.content).toContain('profile.table changed from % to %');
-    expect(reconciliation?.content).toContain(
-      'existing auth.profile generated state is missing table identity',
-    );
-    expect(reconciliation?.content).toContain("'auth.profile'");
-    expect(reconciliation?.content).toContain('create trigger "on_auth_user_created_profiles"');
-    expect(reconciliation?.content).toContain('after insert on auth.users');
-    expect(reconciliation?.content).toContain(
-      'execute function public."handle_new_profiles_user"()',
-    );
-    expect(reconciliation?.content).toContain(
-      'revoke execute on function public."handle_new_profiles_user"() from PUBLIC',
-    );
-    expect(reconciliation?.content).toContain('set search_path = pg_catalog, pg_temp');
-    expect(reconciliation?.content).not.toContain('set search_path = public, auth, pg_temp');
-    expect(reconciliation?.content).not.toContain('create table if not exists public.users');
-  });
-
-  test('does not generate profile reconciliation when profile table is omitted', () => {
-    const artifacts = generateSupabaseAuthArtifacts({
-      namespace: 'scan-app',
-      manifest: createManifest({
-        profile: {
-          fields: ['email', 'displayName'],
-        },
-      }),
-    });
-
-    expect(artifacts.files.some((file) => file.path.includes('supabase/generated'))).toBe(false);
-    expect(artifacts.files.some((file) => file.path.includes('supabase/migrations'))).toBe(false);
-  });
-
-  test('preserves an explicitly empty profile field list', () => {
-    const artifacts = generateSupabaseAuthArtifacts({
-      namespace: 'scan-app',
-      manifest: createManifest({
-        profile: {
-          fields: [],
-          table: 'profiles',
-        },
-      }),
-    });
-
-    const reconciliation = artifacts.files.find(
-      (file) => file.path === 'infra/minikube/supabase/generated/auth_profiles.sql',
-    );
-
-    expect(reconciliation?.content).not.toContain('add column if not exists "email"');
-    expect(reconciliation?.content).not.toContain('grant update (');
-    expect(reconciliation?.content).toContain(
-      'alter table public."profiles" drop column if exists "email"',
-    );
-    expect(reconciliation?.content).toContain(
-      'alter table public."profiles" drop column if exists "first_name"',
-    );
-  });
-
-  test('rejects unsupported configured profile fields', () => {
-    expect(() =>
-      generateSupabaseAuthArtifacts({
-        namespace: 'scan-app',
-        manifest: createManifest({
-          profile: {
-            fields: ['email', 'bio'],
-            table: 'profiles',
-          },
-        }),
-      }),
-    ).toThrow('Unsupported Supabase profile field "bio"');
-  });
-
-  test('rejects blank configured profile fields', () => {
-    expect(() =>
-      generateSupabaseAuthArtifacts({
-        namespace: 'scan-app',
-        manifest: createManifest({
-          profile: {
-            fields: ['email', '  '],
-            table: 'profiles',
-          },
-        }),
-      }),
-    ).toThrow('Profile fields must be non-empty');
-  });
-
-  test('uses a stable desired-state hash and canonical managed column ordering', () => {
-    const first = generateSupabaseAuthArtifacts({
-      namespace: 'scan-app',
-      manifest: createManifest({
-        profile: {
-          fields: ['avatarUrl', 'email', 'displayName'],
-          table: 'profiles',
-        },
-      }),
-    });
-    const second = generateSupabaseAuthArtifacts({
-      namespace: 'scan-app',
-      manifest: createManifest({
-        profile: {
-          fields: ['displayName', 'avatarUrl', 'email'],
-          table: 'profiles',
-        },
-      }),
-    });
-
-    const firstSql = first.files.find(
-      (file) => file.path === 'infra/minikube/supabase/generated/auth_profiles.sql',
-    )?.content;
-    const secondSql = second.files.find(
-      (file) => file.path === 'infra/minikube/supabase/generated/auth_profiles.sql',
-    )?.content;
-
-    expect(firstSql).toBe(secondSql);
-    expect(firstSql?.indexOf('"email"')).toBeLessThan(firstSql?.indexOf('"display_name"') ?? -1);
-    expect(firstSql?.indexOf('"display_name"')).toBeLessThan(
-      firstSql?.indexOf('"avatar_url"') ?? -1,
-    );
-  });
-
-  test('rejects public.users as a generated profile table before SQL is emitted', () => {
-    expect(() =>
-      generateSupabaseAuthArtifacts({
-        namespace: 'scan-app',
-        manifest: createManifest({
-          profile: {
-            fields: ['email'],
-            table: 'users',
-          },
-        }),
-      }),
-    ).toThrow('Invalid Supabase profile table identifier "users"');
-  });
-});
-
-function createManifest(auth: Pick<NonNullable<InfraManifest['auth']>, 'profile'>): InfraManifest {
-  return {
-    deployment: {
-      target: 'minikube',
-      monitoring: false,
-    },
-    auth: {
-      scope: 'global',
-      provider: 'supabase',
-      authorization: {
-        kind: 'RBAC',
-        engine: 'native',
-      },
-      ...auth,
-    },
-    database: {
-      provider: 'supabase',
-      tier: 'dev',
-    },
-    modules: [],
-  };
-}

package/src/adapters/minikube/auth/supabase/index.ts

@@ -1,293 +0,0 @@
-import type { InfraManifestInput } from '../../../../types';
-import type { MinikubeAdapterArtifacts } from '../../contracts';
-import {
-  getSupabaseProfileReconciliation,
-  type ResolvedProfileModel,
-  resolveSupabaseProfileModel,
-} from './profile';
-
-export function generateSupabaseAuthArtifacts(args: {
-  manifest: InfraManifestInput;
-  namespace: string;
-}): MinikubeAdapterArtifacts {
-  const { manifest, namespace } = args;
-
-  const root = 'infra/minikube/k8s/auth/supabase';
-  const resourceRoot = 'auth/supabase';
-  const docsRoot = 'infra/minikube/auth';
-  const generatedRoot = 'infra/minikube/supabase/generated';
-  const scope = manifest.auth?.scope ?? 'global';
-  const authzEngine = manifest.auth?.authorization?.engine ?? 'native';
-  const authzKind = manifest.auth?.authorization?.kind ?? 'RBAC';
-  const authFieldModel = resolveAuthFieldModel(manifest);
-  const profileModel = resolveSupabaseProfileModel(manifest);
-
-  const warnings: string[] = [];
-  if (scope !== 'global') {
-    warnings.push(
-      `Auth scope "${scope}" is not fully modeled yet for Supabase. Baseline resources assume global auth.`,
-    );
-  }
-
-  return {
-    files: [
-      {
-        path: `${root}/supabase-auth.configmap.yaml`,
-        content: getSupabaseConfigMap({
-          namespace,
-          scope,
-          authzEngine,
-          authzKind,
-          authFieldModel,
-          profileModel,
-        }),
-      },
-      {
-        path: `${root}/app-runtime-auth.env.configmap.yaml`,
-        content: getRuntimeAuthEnvConfigMap({
-          namespace,
-          scope,
-          authzEngine,
-          authzKind,
-          authFieldModel,
-          profileModel,
-        }),
-      },
-      ...(profileModel.enabled
-        ? [
-            {
-              path: `${generatedRoot}/auth_profiles.sql`,
-              content: getSupabaseProfileReconciliation(profileModel),
-            },
-          ]
-        : []),
-      {
-        path: `${docsRoot}/supabase-runtime-wiring.md`,
-        content: getSupabaseRuntimeWiringGuide(profileModel),
-      },
-    ],
-    resources: [
-      `${resourceRoot}/supabase-auth.configmap.yaml`,
-      `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,
-    ],
-    providerLifecycle: [],
-    envEntries: ['EXPO_PUBLIC_SUPABASE_URL=', 'EXPO_PUBLIC_SUPABASE_ANON_KEY='],
-    warnings,
-  };
-}
-
-function getSupabaseConfigMap(args: {
-  namespace: string;
-  scope: string;
-  authzEngine: string;
-  authzKind: string;
-  authFieldModel: ResolvedAuthFieldModel;
-  profileModel: ResolvedProfileModel;
-}) {
-  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
-
-  return `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: supabase-auth-config
-  namespace: ${namespace}
-data:
-  AUTH_PROVIDER: "supabase"
-  AUTH_SCOPE: "${scope}"
-  AUTHZ_ENGINE: "${authzEngine}"
-  AUTHZ_KIND: "${authzKind}"
-  AUTH_SIGN_IN_IDENTIFIERS: "${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}"
-  AUTH_SIGN_UP_REQUIRED_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}"
-  AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
-  AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
-  AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
-  AUTH_PROFILE_TABLE: "${escapeYamlDoubleQuoted(profileModel.table)}"
-  AUTH_PROFILE_PRIMARY_KEY: "${profileModel.primaryKey}"
-  AUTH_PROFILE_CREATE_STRATEGY: "${profileModel.createStrategy}"
-  AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
-`;
-}
-
-function getRuntimeAuthEnvConfigMap(args: {
-  namespace: string;
-  scope: string;
-  authzEngine: string;
-  authzKind: string;
-  authFieldModel: ResolvedAuthFieldModel;
-  profileModel: ResolvedProfileModel;
-}) {
-  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
-
-  return `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: app-runtime-auth-env
-  namespace: ${namespace}
-data:
-  AUTH_REQUIRED: "true"
-  AUTH_PROVIDER: "supabase"
-  AUTH_SCOPE: "${scope}"
-  AUTHZ_ENGINE: "${authzEngine}"
-  AUTHZ_KIND: "${authzKind}"
-  AUTH_SIGN_IN_IDENTIFIERS: "${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}"
-  AUTH_SIGN_UP_REQUIRED_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}"
-  AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
-  AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
-  AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
-  AUTH_PROFILE_TABLE: "${escapeYamlDoubleQuoted(profileModel.table)}"
-  AUTH_PROFILE_PRIMARY_KEY: "${profileModel.primaryKey}"
-  AUTH_PROFILE_CREATE_STRATEGY: "${profileModel.createStrategy}"
-  AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
-  AUTH_TOKEN_HEADER: "Authorization"
-  AUTH_TOKEN_PREFIX: "Bearer"
-`;
-}
-
-function getSupabaseRuntimeWiringGuide(profileModel: ResolvedProfileModel) {
-  const profileSection = profileModel.enabled
-    ? `
-## App Profile Table
-
-Identity remains provider-owned in \`auth.users\`. App-facing profile data is generated in
-\`public.${profileModel.table}\` and linked through \`${profileModel.table}.id -> auth.users.id\`.
-
-The generated profile reconciliation:
-
-- creates the profile table
-- enables row-level security
-- allows signed-in users to read and update their own profile row
-- drops stale Ankhorage-managed profile columns that are no longer configured
-- creates a trigger for new auth users when \`AUTH_PROFILE_CREATE_STRATEGY=trigger\`
-`
-    : '';
-
-  return `# Supabase Runtime Wiring
-
-This file documents the runtime conventions generated by the minikube Supabase adapter.
-
-## Generated Kubernetes Objects
-
-- \`ConfigMap/supabase-auth-config\`: high-level auth metadata.
-- \`Secret/supabase-public-runtime\`: browser-safe Supabase URL and anon key material, generated by \`scripts/up.sh\` after local Supabase secrets exist.
-- \`ConfigMap/app-runtime-auth-env\`: auth runtime feature flags and authz metadata.
-
-## App Runtime Convention
-
-Your app runtime deployment should import both:
-
-- \`app-runtime-auth-env\` (configMap)
-- \`supabase-public-runtime\` (secret)
-
-For local Expo/Metro development, \`scripts/up.sh\` also writes the same browser-safe
-\`EXPO_PUBLIC_SUPABASE_URL\` and \`EXPO_PUBLIC_SUPABASE_ANON_KEY\` values to
-\`\${APP_SOURCE_DIR}/.env.local\`, preserving unrelated entries. Restart Expo after
-Infra Up so those public values are embedded into the client bundle.
-
-Example deployment fragment:
-
-\`\`\`yaml
-envFrom:
-  - configMapRef:
-      name: app-runtime-auth-env
-  - secretRef:
-      name: supabase-public-runtime
-\`\`\`
-
-The generated base deployment at \`k8s/app/deployment.yaml\` already includes this wiring
-with \`optional: true\` for auth sources.
-
-## Expected Environment Variables
-
-- \`AUTH_REQUIRED\`
-- \`AUTH_PROVIDER\`
-- \`AUTH_SCOPE\`
-- \`AUTHZ_ENGINE\`
-- \`AUTHZ_KIND\`
-- \`AUTH_SIGN_IN_IDENTIFIERS\`
-- \`AUTH_SIGN_UP_REQUIRED_FIELDS\`
-- \`AUTH_SIGN_UP_OPTIONAL_FIELDS\`
-- \`AUTH_SIGN_UP_POLICY\`
-- \`AUTH_PROFILE_FIELDS\`
-- \`AUTH_PROFILE_TABLE\`
-- \`AUTH_PROFILE_PRIMARY_KEY\`
-- \`AUTH_PROFILE_CREATE_STRATEGY\`
-- \`AUTH_PROFILE_UPDATE_STRATEGY\`
-- \`SUPABASE_URL\`
-- \`SUPABASE_ANON_KEY\`
-- \`EXPO_PUBLIC_SUPABASE_URL\`
-- \`EXPO_PUBLIC_SUPABASE_ANON_KEY\`
-${profileSection}
-## Runtime Secrets
-
-When Supabase is enabled, \`scripts/up.sh\` creates/updates \`Secret/supabase-public-runtime\`
-with browser-safe values for the app namespace and mirrors the Expo public values into the
-app \`.env.local\`. Privileged Supabase runtime secrets remain in the \`supabase\` namespace.
-`;
-}
-
-const DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];
-const DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];
-const DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];
-const DEFAULT_SIGN_UP_POLICY = 'autoSignIn';
-interface ResolvedAuthFieldModel {
-  signInIdentifiersCsv: string;
-  signUpRequiredFieldsCsv: string;
-  signUpOptionalFieldsCsv: string;
-  signUpPolicy: string;
-  profileFieldsCsv: string;
-}
-
-function resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {
-  const signInIdentifiers = normalizeFieldList(
-    manifest.auth?.signIn?.identifiers,
-    DEFAULT_SIGN_IN_IDENTIFIERS,
-  );
-  const signUpRequiredFields = normalizeFieldList(
-    manifest.auth?.signUp?.requiredFields,
-    DEFAULT_SIGN_UP_REQUIRED_FIELDS,
-  );
-  const signUpOptionalFields = normalizeFieldList(
-    manifest.auth?.signUp?.optionalFields,
-    DEFAULT_SIGN_UP_OPTIONAL_FIELDS,
-  ).filter((field) => !signUpRequiredFields.includes(field));
-  const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;
-  const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, [
-    'email',
-    'firstName',
-    'lastName',
-  ]);
-
-  return {
-    signInIdentifiersCsv: signInIdentifiers.join(','),
-    signUpRequiredFieldsCsv: signUpRequiredFields.join(','),
-    signUpOptionalFieldsCsv: signUpOptionalFields.join(','),
-    signUpPolicy,
-    profileFieldsCsv: profileFields.join(','),
-  };
-}
-
-function normalizeFieldList(
-  values: readonly string[] | undefined,
-  fallback: readonly string[],
-): string[] {
-  const source = values ?? fallback;
-  const next: string[] = [];
-
-  for (const value of source) {
-    const normalized = value.trim();
-    if (!normalized || next.includes(normalized)) {
-      continue;
-    }
-    next.push(normalized);
-  }
-
-  if (next.length > 0) {
-    return next;
-  }
-
-  return [...fallback];
-}
-
-function escapeYamlDoubleQuoted(value: string): string {
-  return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
-}