npm - @ankhorage/infra - Versions diffs - 4.1.8 → 4.1.10 - Mend

@ankhorage/infra 4.1.8 → 4.1.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/CHANGELOG.md +12 -0
package/README.md +1 -1
package/dist/adapters/minikube/authz/cerbos/index.js.map +1 -1
package/package.json +5 -5
package/src/adapters/minikube/authz/cerbos/index.ts +3 -3

package/CHANGELOG.md CHANGED Viewed

@@ -1,5 +1,17 @@
 # @ankhorage/infra
+## 4.1.10
+### Patch Changes
+- fb11cb2: Update Ankhorage dependencies: `@ankhorage/supabase-vault`.
+## 4.1.9
+### Patch Changes
+- 427552a: Update Ankhorage dependencies: `@ankhorage/contracts`.
 ## 4.1.8
 ### Patch Changes

package/README.md CHANGED Viewed

@@ -3,7 +3,7 @@
 # INFRA
-![license: MIT](././paradox/badges/license.svg) ![npm: v4.1.3](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v4.1.8](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 Executable infra provider and standalone CLI for Ankhorage project workflows.

package/dist/adapters/minikube/authz/cerbos/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/authz/cerbos/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAK5D,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,MAAM,UAAU,4BAA4B,CAAC,IAI5C;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC;IAEnC,MAAM,IAAI,GAAG,iCAAiC,CAAC;IAC/C,MAAM,YAAY,GAAG,cAAc,CAAC;IACpC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAElE,MAAM,WAAW,GAAG,iBAAiB,SAAS,yBAAyB,CAAC;IACxE,MAAM,SAAS,GAA8B;QAC3C,EAAE,EAAE,QAAQ;QACZ,SAAS;QACT,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAC/C,eAAe,EAAE;YACf;gBACE,KAAK,EAAE,QAAQ;gBACf,SAAS;gBACT,QAAQ,EAAE,mBAAmB;gBAC7B,cAAc,EAAE,GAAG;aACpB;SACF;QACD,iBAAiB,EAAE,EAAE;QACrB,sBAAsB,EAAE,EAAE;QAC1B,YAAY,EAAE,EAAE;KACjB,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,wBAAwB;gBACrC,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC;aACvC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,wBAAwB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;aACzD;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,yBAAyB;gBACtC,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC;aACxC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sBAAsB;gBACnC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;aACrC;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,wBAAwB;YACvC,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,yBAAyB;YACxC,GAAG,YAAY,sBAAsB;SACtC;QACD,iBAAiB,EAAE,CAAC,SAAS,CAAC;QAC9B,UAAU,EAAE,CAAC,cAAc,WAAW,EAAE,CAAC;QACzC,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO;;;;eAIM,SAAS;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAuD;IACvF,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,OAAO;SAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/C,OAAO,KAAK,KAAK,CAAC,GAAG;EACzB,QAAQ,EAAE,CAAC;IACT,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;eAIM,SAAS;;EAEtB,eAAe;CAChB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,OAAO;;;;eAIM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCvB,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO;;;;eAIM,SAAS;;;;;;;;CAQvB,CAAC;AACF,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACxF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,eAAe;IACf,SAAS;IACT,WAAW;IACX,cAAc;IACd,eAAe;CAChB,CAAC,CAAC;AA2BH,SAAS,sBAAsB,CAAC,MAA0B;IACxD,MAAM,OAAO,GAAwB;QACnC;YACE,GAAG,EAAE,0BAA0B;YAC/B,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;SAC9B;KACF,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,4BAA4B;YACjC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,6BAA6B;YAClC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAEjG,OAAO;;;;;EAKP,WAAW,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;CACtD,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7B,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;YACrC,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC;SACnE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;;;;;EAKP,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACjC,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3B,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;YACrC,aAAa,EAAE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;SACrE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,aAAa,EAAE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC;SACxE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;;;;;EAKP,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACjC,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,IAAoE;IACtF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/C,MAAM,KAAK,GAAG;QACZ,cAAc,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QACvC,wBAAwB;QACxB,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;KACpC,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB,EAAE,MAAgB;IAC7D,OAAO,yBAAyB,SAAS,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,OAAO;SACX,OAAO,EAAE;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAGhC;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC;IAEjD,MAAM,MAAM,GAAG,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC7B,KAAK;YACL,SAAS;YACT,WAAW;YACX,WAAW;YACX,iBAAiB;SAClB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,WAAW;YAAE,SAAS;QACtC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,iBAAiB,GACrB,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QAElD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;SAC7B,IAAI,EAAE,CAAC;IACV,MAAM,gBAAgB,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;SACrD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,WAAW,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;SAC7B,IAAI,EAAE,CAAC;IAEV,OAAO;QACL,SAAS;QACT,YAAY,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE;QACxC,eAAe,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE;QAC9C,aAAa;QACb,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAwB;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAErD,MAAM,IAAI,GAAG,CAAC,OAAsB,EAAE,EAAE;QACtC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;gBAClE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;aAC/C,CAAC,CAAC;YAEH,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,SAAS,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,MAAkC;IACzD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,IAMtB;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAEzE,IACE,KAAK,CAAC,IAAI,KAAK,eAAe;QAC9B,KAAK,CAAC,IAAI,KAAK,eAAe;QAC9B,KAAK,CAAC,IAAI,KAAK,qBAAqB,EACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAmB,EAAE,UAAuB;IAC1D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAAC,SAA6B;IAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AAClD,CAAC","sourcesContent":["import type { AppManifest, NavigatorSpec, RouteDefinition } from '@ankhorage/contracts';\nimport { resolveAuthFlow } from '@ankhorage/contracts/auth';\n\nimport type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../../contracts';\n\nconst CERBOS_NAMESPACE = 'cerbos';\n\nexport function generateCerbosAuthzArtifacts(args: {\n manifest: InfraManifestInput;\n namespace: string;\n appManifest?: CerbosAppManifest;\n}): MinikubeAdapterArtifacts {\n const { manifest, appManifest } = args;\n const namespace = CERBOS_NAMESPACE;\n\n const root = 'infra/minikube/k8s/authz/cerbos';\n const resourceRoot = 'authz/cerbos';\n const intent = buildCerbosPolicyIntent({ manifest, appManifest });\n\n const endpointUrl = `http://cerbos.${namespace}.svc.cluster.local:3592`;\n const lifecycle: MinikubeProviderLifecycle = {\n id: 'cerbos',\n namespace,\n endpoints: [{ name: 'http', url: endpointUrl }],\n readinessChecks: [\n {\n label: 'cerbos',\n namespace,\n resource: 'deployment/cerbos',\n timeoutSeconds: 180,\n },\n ],\n migrationCommands: [],\n reconciliationCommands: [],\n statusChecks: [],\n };\n\n return {\n files: [\n {\n path: `${root}/cerbos.configmap.yaml`,\n content: getCerbosConfigMap(namespace),\n },\n {\n path: `${root}/cerbos.policy.configmap.yaml`,\n content: getCerbosPolicyConfigMap({ namespace, intent }),\n },\n {\n path: `${root}/cerbos.deployment.yaml`,\n content: getCerbosDeployment(namespace),\n },\n {\n path: `${root}/cerbos.service.yaml`,\n content: getCerbosService(namespace),\n },\n ],\n resources: [\n `${resourceRoot}/cerbos.configmap.yaml`,\n `${resourceRoot}/cerbos.policy.configmap.yaml`,\n `${resourceRoot}/cerbos.deployment.yaml`,\n `${resourceRoot}/cerbos.service.yaml`,\n ],\n providerLifecycle: [lifecycle],\n envEntries: [`CERBOS_URL=${endpointUrl}`],\n warnings: [],\n };\n}\n\nfunction getCerbosConfigMap(namespace: string) {\n return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cerbos-config\n namespace: ${namespace}\ndata:\n config.yaml: \|\n server:\n httpListenAddr: \":3592\"\n storage:\n driver: \"disk\"\n disk:\n directory: /policies\n`;\n}\n\nfunction getCerbosPolicyConfigMap(args: { namespace: string; intent: CerbosPolicyIntent }) {\n const { namespace, intent } = args;\n const entries = getCerbosPolicyEntries(intent);\n const renderedEntries = entries\n .map((entry) => {\n const indented = indentLines(entry.content, 4);\n return ` ${entry.key}: \|\n${indented}`;\n })\n .join('\\n');\n\n return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cerbos-policy\n namespace: ${namespace}\ndata:\n${renderedEntries}\n`;\n}\n\nfunction getCerbosDeployment(namespace: string) {\n return `apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: cerbos\n namespace: ${namespace}\n labels:\n app.kubernetes.io/name: cerbos\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/name: cerbos\n template:\n metadata:\n labels:\n app.kubernetes.io/name: cerbos\n spec:\n containers:\n - name: cerbos\n image: ghcr.io/cerbos/cerbos:0.40.0\n args:\n - server\n - --config=/config/config.yaml\n ports:\n - containerPort: 3592\n volumeMounts:\n - name: cerbos-config\n mountPath: /config\n - name: cerbos-policy\n mountPath: /policies\n volumes:\n - name: cerbos-config\n configMap:\n name: cerbos-config\n - name: cerbos-policy\n configMap:\n name: cerbos-policy\n`;\n}\n\nfunction getCerbosService(namespace: string) {\n return `apiVersion: v1\nkind: Service\nmetadata:\n name: cerbos\n namespace: ${namespace}\nspec:\n selector:\n app.kubernetes.io/name: cerbos\n ports:\n - name: http\n port: 3592\n targetPort: 3592\n`;\n}\n\nconst PUBLIC_GUARD_HINTS = new Set(['public', 'guest', 'anonymous', 'unauthenticated']);\nconst AUTH_GUARD_HINTS = new Set([\n 'auth',\n 'authenticated',\n 'private',\n 'protected',\n 'requiresauth',\n 'requires-auth',\n]);\n\ntype CerbosAppManifest = Pick<AppManifest, 'metadata' \| 'navigator' \| 'screens'> & {\n infra?: AppManifest['infra'];\n};\n\ntype AuthScope = NonNullable<InfraManifestInput['auth']>['scope'] \| 'none';\n\ninterface CerbosRouteIntent {\n name: string;\n guards: string[];\n screenId?: string;\n}\n\ninterface CerbosPolicyIntent {\n authScope: AuthScope;\n publicRoutes: string[];\n protectedRoutes: string[];\n publicScreens: string[];\n protectedScreens: string[];\n}\n\ninterface CerbosPolicyEntry {\n key: string;\n content: string;\n}\n\nfunction getCerbosPolicyEntries(intent: CerbosPolicyIntent): CerbosPolicyEntry[] {\n const entries: CerbosPolicyEntry[] = [\n {\n key: 'app.resource_policy.yaml',\n content: getAppPolicy(intent),\n },\n ];\n\n if (intent.publicRoutes.length > 0 \|\| intent.protectedRoutes.length > 0) {\n entries.push({\n key: 'route.resource_policy.yaml',\n content: getRoutePolicy(intent),\n });\n }\n\n if (intent.publicScreens.length > 0 \|\| intent.protectedScreens.length > 0) {\n entries.push({\n key: 'screen.resource_policy.yaml',\n content: getScreenPolicy(intent),\n });\n }\n\n return entries;\n}\n\nfunction getAppPolicy(intent: CerbosPolicyIntent): string {\n const roles = intent.authScope === 'global' ? ['authenticated'] : ['anonymous', 'authenticated'];\n\n return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n version: \"default\"\n resource: \"app\"\n rules:\n${indentLines(renderRule({ actions: ['*'], roles }), 4)}\n`;\n}\n\nfunction getRoutePolicy(intent: CerbosPolicyIntent): string {\n const rules: string[] = [];\n\n if (intent.publicRoutes.length > 0) {\n rules.push(\n renderRule({\n actions: ['view', 'navigate'],\n roles: ['anonymous', 'authenticated'],\n conditionExpr: getInConditionExpr('route', intent.publicRoutes),\n }),\n );\n }\n\n if (intent.protectedRoutes.length > 0) {\n rules.push(\n renderRule({\n actions: ['view', 'navigate'],\n roles: ['authenticated'],\n conditionExpr: getInConditionExpr('route', intent.protectedRoutes),\n }),\n );\n }\n\n return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n version: \"default\"\n resource: \"route\"\n rules:\n${indentLines(rules.join('\\n'), 4)}\n`;\n}\n\nfunction getScreenPolicy(intent: CerbosPolicyIntent): string {\n const rules: string[] = [];\n\n if (intent.publicScreens.length > 0) {\n rules.push(\n renderRule({\n actions: ['view', 'render'],\n roles: ['anonymous', 'authenticated'],\n conditionExpr: getInConditionExpr('screen_id', intent.publicScreens),\n }),\n );\n }\n\n if (intent.protectedScreens.length > 0) {\n rules.push(\n renderRule({\n actions: ['view', 'render'],\n roles: ['authenticated'],\n conditionExpr: getInConditionExpr('screen_id', intent.protectedScreens),\n }),\n );\n }\n\n return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n version: \"default\"\n resource: \"screen\"\n rules:\n${indentLines(rules.join('\\n'), 4)}\n`;\n}\n\nfunction renderRule(args: { actions: string[]; roles: string[]; conditionExpr?: string }): string {\n const { actions, roles, conditionExpr } = args;\n\n const lines = [\n `- actions: ${JSON.stringify(actions)}`,\n ' effect: EFFECT_ALLOW',\n ` roles: ${JSON.stringify(roles)}`,\n ];\n\n if (conditionExpr) {\n lines.push(' condition:');\n lines.push(' match:');\n lines.push(` expr: ${JSON.stringify(conditionExpr)}`);\n }\n\n return lines.join('\\n');\n}\n\nfunction getInConditionExpr(attribute: string, values: string[]): string {\n return `request.resource.attr.${attribute} in ${JSON.stringify(values)}`;\n}\n\nfunction indentLines(content: string, spaces: number): string {\n const prefix = ' '.repeat(spaces);\n return content\n .trimEnd()\n .split('\\n')\n .map((line) => `${prefix}${line}`)\n .join('\\n');\n}\n\nfunction buildCerbosPolicyIntent(args: {\n manifest: InfraManifestInput;\n appManifest?: CerbosAppManifest;\n}): CerbosPolicyIntent {\n const { manifest, appManifest } = args;\n const authScope = manifest.auth?.scope ?? 'none';\n\n const routes = appManifest?.navigator ? flattenNavigatorRoutes(appManifest.navigator) : [];\n const flow = resolveAuthFlow(appManifest?.infra?.auth?.flow);\n const { signInRoute } = flow;\n const { signUpRoute } = flow;\n const { unauthorizedRoute } = flow;\n\n const publicRouteSet = new Set<string>();\n const protectedRouteSet = new Set<string>();\n\n for (const route of routes) {\n const isPublic = isPublicRoute({\n route,\n authScope,\n signInRoute,\n signUpRoute,\n unauthorizedRoute,\n });\n\n if (isPublic) {\n publicRouteSet.add(route.name);\n } else {\n protectedRouteSet.add(route.name);\n }\n }\n\n const screenVisibility = new Map<string, 'public' \| 'protected'>();\n for (const route of routes) {\n if (!route.screenId) continue;\n const isPublic = publicRouteSet.has(route.name);\n\n const current = screenVisibility.get(route.screenId);\n if (current === 'protected') continue;\n screenVisibility.set(route.screenId, isPublic ? 'public' : 'protected');\n }\n\n if (appManifest?.screens) {\n const defaultVisibility: 'public' \| 'protected' =\n authScope === 'global' ? 'protected' : 'public';\n\n for (const screenId of Object.keys(appManifest.screens)) {\n if (!screenVisibility.has(screenId)) {\n screenVisibility.set(screenId, defaultVisibility);\n }\n }\n }\n\n const publicScreens = [...screenVisibility.entries()]\n .filter(([, visibility]) => visibility === 'public')\n .map(([screenId]) => screenId)\n .sort();\n const protectedScreens = [...screenVisibility.entries()]\n .filter(([, visibility]) => visibility === 'protected')\n .map(([screenId]) => screenId)\n .sort();\n\n return {\n authScope,\n publicRoutes: [...publicRouteSet].sort(),\n protectedRoutes: [...protectedRouteSet].sort(),\n publicScreens,\n protectedScreens,\n };\n}\n\nfunction flattenNavigatorRoutes(navigator: NavigatorSpec): CerbosRouteIntent[] {\n const deduped = new Map<string, CerbosRouteIntent>();\n\n const walk = (current: NavigatorSpec) => {\n for (const route of current.routes) {\n const normalizedGuards = normalizeGuards(route.guards);\n const existing = deduped.get(route.name);\n deduped.set(route.name, {\n name: route.name,\n guards: unique([...(existing?.guards ?? []), ...normalizedGuards]),\n screenId: route.screenId ?? existing?.screenId,\n });\n\n if (route.navigator) {\n walk(route.navigator);\n }\n }\n };\n\n walk(navigator);\n return [...deduped.values()];\n}\n\nfunction normalizeGuards(guards?: RouteDefinition['guards']): string[] {\n return (guards ?? []).map((guard) => guard.trim().toLowerCase()).filter(Boolean);\n}\n\nfunction isPublicRoute(args: {\n route: CerbosRouteIntent;\n authScope: AuthScope;\n signInRoute?: string;\n signUpRoute?: string;\n unauthorizedRoute?: string;\n}): boolean {\n const { route, authScope, signInRoute, signUpRoute, unauthorizedRoute } = args;\n const guardSet = new Set(route.guards);\n const signInRouteName = authFlowPathToRouteName(signInRoute);\n const signUpRouteName = authFlowPathToRouteName(signUpRoute);\n const unauthorizedRouteName = authFlowPathToRouteName(unauthorizedRoute);\n\n if (\n route.name === signInRouteName \|\|\n route.name === signUpRouteName \|\|\n route.name === unauthorizedRouteName\n ) {\n return true;\n }\n\n if (hasAny(guardSet, PUBLIC_GUARD_HINTS)) {\n return true;\n }\n\n if (hasAny(guardSet, AUTH_GUARD_HINTS)) {\n return false;\n }\n\n switch (authScope) {\n case 'none':\n return true;\n case 'global':\n default:\n return false;\n }\n}\n\nfunction hasAny(values: Set<string>, candidates: Set<string>): boolean {\n for (const candidate of candidates) {\n if (values.has(candidate)) return true;\n }\n return false;\n}\n\nfunction unique(values: string[]): string[] {\n return [...new Set(values)];\n}\n\nfunction authFlowPathToRouteName(routePath: string \| undefined): string \| undefined {\n if (!routePath) {\n return undefined;\n }\n\n const normalized = routePath.trim().replace(/^\\/+/, '').replace(/\\/+$/, '');\n return normalized === '' ? 'index' : normalized;\n}\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/authz/cerbos/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAK5D,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,MAAM,UAAU,4BAA4B,CAAC,IAI5C;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC;IAEnC,MAAM,IAAI,GAAG,iCAAiC,CAAC;IAC/C,MAAM,YAAY,GAAG,cAAc,CAAC;IACpC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAElE,MAAM,WAAW,GAAG,iBAAiB,SAAS,yBAAyB,CAAC;IACxE,MAAM,SAAS,GAA8B;QAC3C,EAAE,EAAE,QAAQ;QACZ,SAAS;QACT,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAC/C,eAAe,EAAE;YACf;gBACE,KAAK,EAAE,QAAQ;gBACf,SAAS;gBACT,QAAQ,EAAE,mBAAmB;gBAC7B,cAAc,EAAE,GAAG;aACpB;SACF;QACD,iBAAiB,EAAE,EAAE;QACrB,sBAAsB,EAAE,EAAE;QAC1B,YAAY,EAAE,EAAE;KACjB,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,wBAAwB;gBACrC,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC;aACvC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,wBAAwB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;aACzD;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,yBAAyB;gBACtC,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC;aACxC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sBAAsB;gBACnC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;aACrC;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,wBAAwB;YACvC,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,yBAAyB;YACxC,GAAG,YAAY,sBAAsB;SACtC;QACD,iBAAiB,EAAE,CAAC,SAAS,CAAC;QAC9B,UAAU,EAAE,CAAC,cAAc,WAAW,EAAE,CAAC;QACzC,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO;;;;eAIM,SAAS;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAuD;IACvF,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,OAAO;SAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/C,OAAO,KAAK,KAAK,CAAC,GAAG;EACzB,QAAQ,EAAE,CAAC;IACT,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;eAIM,SAAS;;EAEtB,eAAe;CAChB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,OAAO;;;;eAIM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCvB,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO;;;;eAIM,SAAS;;;;;;;;CAQvB,CAAC;AACF,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACxF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,eAAe;IACf,SAAS;IACT,WAAW;IACX,cAAc;IACd,eAAe;CAChB,CAAC,CAAC;AA2BH,SAAS,sBAAsB,CAAC,MAA0B;IACxD,MAAM,OAAO,GAAwB;QACnC;YACE,GAAG,EAAE,0BAA0B;YAC/B,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;SAC9B;KACF,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,4BAA4B;YACjC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,6BAA6B;YAClC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAEjG,OAAO;;;;;EAKP,WAAW,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;CACtD,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7B,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;YACrC,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC;SACnE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;;;;;EAKP,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACjC,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3B,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;YACrC,aAAa,EAAE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;SACrE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,aAAa,EAAE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC;SACxE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;;;;;EAKP,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACjC,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,IAAoE;IACtF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/C,MAAM,KAAK,GAAG;QACZ,cAAc,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QACvC,wBAAwB;QACxB,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;KACpC,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB,EAAE,MAAgB;IAC7D,OAAO,yBAAyB,SAAS,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,OAAO;SACX,OAAO,EAAE;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAGhC;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC;IAEjD,MAAM,MAAM,GAAG,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC7B,KAAK;YACL,SAAS;YACT,WAAW;YACX,WAAW;YACX,iBAAiB;SAClB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,WAAW;YAAE,SAAS;QACtC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,iBAAiB,GACrB,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QAElD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;SAC7B,IAAI,EAAE,CAAC;IACV,MAAM,gBAAgB,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;SACrD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,WAAW,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;SAC7B,IAAI,EAAE,CAAC;IAEV,OAAO;QACL,SAAS;QACT,YAAY,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE;QACxC,eAAe,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE;QAC9C,aAAa;QACb,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAwB;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAErD,MAAM,IAAI,GAAG,CAAC,OAAsB,EAAE,EAAE;QACtC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;gBAClE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;aAC/C,CAAC,CAAC;YAEH,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,SAAS,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,MAAkC;IACzD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,IAMtB;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAEzE,IACE,KAAK,CAAC,IAAI,KAAK,eAAe;QAC9B,KAAK,CAAC,IAAI,KAAK,eAAe;QAC9B,KAAK,CAAC,IAAI,KAAK,qBAAqB,EACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAmB,EAAE,UAAuB;IAC1D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAAC,SAA6B;IAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AAClD,CAAC","sourcesContent":["import type { AppManifest, NavigatorNode, RouteDefinition } from '@ankhorage/contracts';\nimport { resolveAuthFlow } from '@ankhorage/contracts/auth';\n\nimport type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../../contracts';\n\nconst CERBOS_NAMESPACE = 'cerbos';\n\nexport function generateCerbosAuthzArtifacts(args: {\n manifest: InfraManifestInput;\n namespace: string;\n appManifest?: CerbosAppManifest;\n}): MinikubeAdapterArtifacts {\n const { manifest, appManifest } = args;\n const namespace = CERBOS_NAMESPACE;\n\n const root = 'infra/minikube/k8s/authz/cerbos';\n const resourceRoot = 'authz/cerbos';\n const intent = buildCerbosPolicyIntent({ manifest, appManifest });\n\n const endpointUrl = `http://cerbos.${namespace}.svc.cluster.local:3592`;\n const lifecycle: MinikubeProviderLifecycle = {\n id: 'cerbos',\n namespace,\n endpoints: [{ name: 'http', url: endpointUrl }],\n readinessChecks: [\n {\n label: 'cerbos',\n namespace,\n resource: 'deployment/cerbos',\n timeoutSeconds: 180,\n },\n ],\n migrationCommands: [],\n reconciliationCommands: [],\n statusChecks: [],\n };\n\n return {\n files: [\n {\n path: `${root}/cerbos.configmap.yaml`,\n content: getCerbosConfigMap(namespace),\n },\n {\n path: `${root}/cerbos.policy.configmap.yaml`,\n content: getCerbosPolicyConfigMap({ namespace, intent }),\n },\n {\n path: `${root}/cerbos.deployment.yaml`,\n content: getCerbosDeployment(namespace),\n },\n {\n path: `${root}/cerbos.service.yaml`,\n content: getCerbosService(namespace),\n },\n ],\n resources: [\n `${resourceRoot}/cerbos.configmap.yaml`,\n `${resourceRoot}/cerbos.policy.configmap.yaml`,\n `${resourceRoot}/cerbos.deployment.yaml`,\n `${resourceRoot}/cerbos.service.yaml`,\n ],\n providerLifecycle: [lifecycle],\n envEntries: [`CERBOS_URL=${endpointUrl}`],\n warnings: [],\n };\n}\n\nfunction getCerbosConfigMap(namespace: string) {\n return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cerbos-config\n namespace: ${namespace}\ndata:\n config.yaml: \|\n server:\n httpListenAddr: \":3592\"\n storage:\n driver: \"disk\"\n disk:\n directory: /policies\n`;\n}\n\nfunction getCerbosPolicyConfigMap(args: { namespace: string; intent: CerbosPolicyIntent }) {\n const { namespace, intent } = args;\n const entries = getCerbosPolicyEntries(intent);\n const renderedEntries = entries\n .map((entry) => {\n const indented = indentLines(entry.content, 4);\n return ` ${entry.key}: \|\n${indented}`;\n })\n .join('\\n');\n\n return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cerbos-policy\n namespace: ${namespace}\ndata:\n${renderedEntries}\n`;\n}\n\nfunction getCerbosDeployment(namespace: string) {\n return `apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: cerbos\n namespace: ${namespace}\n labels:\n app.kubernetes.io/name: cerbos\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/name: cerbos\n template:\n metadata:\n labels:\n app.kubernetes.io/name: cerbos\n spec:\n containers:\n - name: cerbos\n image: ghcr.io/cerbos/cerbos:0.40.0\n args:\n - server\n - --config=/config/config.yaml\n ports:\n - containerPort: 3592\n volumeMounts:\n - name: cerbos-config\n mountPath: /config\n - name: cerbos-policy\n mountPath: /policies\n volumes:\n - name: cerbos-config\n configMap:\n name: cerbos-config\n - name: cerbos-policy\n configMap:\n name: cerbos-policy\n`;\n}\n\nfunction getCerbosService(namespace: string) {\n return `apiVersion: v1\nkind: Service\nmetadata:\n name: cerbos\n namespace: ${namespace}\nspec:\n selector:\n app.kubernetes.io/name: cerbos\n ports:\n - name: http\n port: 3592\n targetPort: 3592\n`;\n}\n\nconst PUBLIC_GUARD_HINTS = new Set(['public', 'guest', 'anonymous', 'unauthenticated']);\nconst AUTH_GUARD_HINTS = new Set([\n 'auth',\n 'authenticated',\n 'private',\n 'protected',\n 'requiresauth',\n 'requires-auth',\n]);\n\ntype CerbosAppManifest = Pick<AppManifest, 'metadata' \| 'navigator' \| 'screens'> & {\n infra?: AppManifest['infra'];\n};\n\ntype AuthScope = NonNullable<InfraManifestInput['auth']>['scope'] \| 'none';\n\ninterface CerbosRouteIntent {\n name: string;\n guards: string[];\n screenId?: string;\n}\n\ninterface CerbosPolicyIntent {\n authScope: AuthScope;\n publicRoutes: string[];\n protectedRoutes: string[];\n publicScreens: string[];\n protectedScreens: string[];\n}\n\ninterface CerbosPolicyEntry {\n key: string;\n content: string;\n}\n\nfunction getCerbosPolicyEntries(intent: CerbosPolicyIntent): CerbosPolicyEntry[] {\n const entries: CerbosPolicyEntry[] = [\n {\n key: 'app.resource_policy.yaml',\n content: getAppPolicy(intent),\n },\n ];\n\n if (intent.publicRoutes.length > 0 \|\| intent.protectedRoutes.length > 0) {\n entries.push({\n key: 'route.resource_policy.yaml',\n content: getRoutePolicy(intent),\n });\n }\n\n if (intent.publicScreens.length > 0 \|\| intent.protectedScreens.length > 0) {\n entries.push({\n key: 'screen.resource_policy.yaml',\n content: getScreenPolicy(intent),\n });\n }\n\n return entries;\n}\n\nfunction getAppPolicy(intent: CerbosPolicyIntent): string {\n const roles = intent.authScope === 'global' ? ['authenticated'] : ['anonymous', 'authenticated'];\n\n return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n version: \"default\"\n resource: \"app\"\n rules:\n${indentLines(renderRule({ actions: ['*'], roles }), 4)}\n`;\n}\n\nfunction getRoutePolicy(intent: CerbosPolicyIntent): string {\n const rules: string[] = [];\n\n if (intent.publicRoutes.length > 0) {\n rules.push(\n renderRule({\n actions: ['view', 'navigate'],\n roles: ['anonymous', 'authenticated'],\n conditionExpr: getInConditionExpr('route', intent.publicRoutes),\n }),\n );\n }\n\n if (intent.protectedRoutes.length > 0) {\n rules.push(\n renderRule({\n actions: ['view', 'navigate'],\n roles: ['authenticated'],\n conditionExpr: getInConditionExpr('route', intent.protectedRoutes),\n }),\n );\n }\n\n return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n version: \"default\"\n resource: \"route\"\n rules:\n${indentLines(rules.join('\\n'), 4)}\n`;\n}\n\nfunction getScreenPolicy(intent: CerbosPolicyIntent): string {\n const rules: string[] = [];\n\n if (intent.publicScreens.length > 0) {\n rules.push(\n renderRule({\n actions: ['view', 'render'],\n roles: ['anonymous', 'authenticated'],\n conditionExpr: getInConditionExpr('screen_id', intent.publicScreens),\n }),\n );\n }\n\n if (intent.protectedScreens.length > 0) {\n rules.push(\n renderRule({\n actions: ['view', 'render'],\n roles: ['authenticated'],\n conditionExpr: getInConditionExpr('screen_id', intent.protectedScreens),\n }),\n );\n }\n\n return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n version: \"default\"\n resource: \"screen\"\n rules:\n${indentLines(rules.join('\\n'), 4)}\n`;\n}\n\nfunction renderRule(args: { actions: string[]; roles: string[]; conditionExpr?: string }): string {\n const { actions, roles, conditionExpr } = args;\n\n const lines = [\n `- actions: ${JSON.stringify(actions)}`,\n ' effect: EFFECT_ALLOW',\n ` roles: ${JSON.stringify(roles)}`,\n ];\n\n if (conditionExpr) {\n lines.push(' condition:');\n lines.push(' match:');\n lines.push(` expr: ${JSON.stringify(conditionExpr)}`);\n }\n\n return lines.join('\\n');\n}\n\nfunction getInConditionExpr(attribute: string, values: string[]): string {\n return `request.resource.attr.${attribute} in ${JSON.stringify(values)}`;\n}\n\nfunction indentLines(content: string, spaces: number): string {\n const prefix = ' '.repeat(spaces);\n return content\n .trimEnd()\n .split('\\n')\n .map((line) => `${prefix}${line}`)\n .join('\\n');\n}\n\nfunction buildCerbosPolicyIntent(args: {\n manifest: InfraManifestInput;\n appManifest?: CerbosAppManifest;\n}): CerbosPolicyIntent {\n const { manifest, appManifest } = args;\n const authScope = manifest.auth?.scope ?? 'none';\n\n const routes = appManifest?.navigator ? flattenNavigatorRoutes(appManifest.navigator) : [];\n const flow = resolveAuthFlow(appManifest?.infra?.auth?.flow);\n const { signInRoute } = flow;\n const { signUpRoute } = flow;\n const { unauthorizedRoute } = flow;\n\n const publicRouteSet = new Set<string>();\n const protectedRouteSet = new Set<string>();\n\n for (const route of routes) {\n const isPublic = isPublicRoute({\n route,\n authScope,\n signInRoute,\n signUpRoute,\n unauthorizedRoute,\n });\n\n if (isPublic) {\n publicRouteSet.add(route.name);\n } else {\n protectedRouteSet.add(route.name);\n }\n }\n\n const screenVisibility = new Map<string, 'public' \| 'protected'>();\n for (const route of routes) {\n if (!route.screenId) continue;\n const isPublic = publicRouteSet.has(route.name);\n\n const current = screenVisibility.get(route.screenId);\n if (current === 'protected') continue;\n screenVisibility.set(route.screenId, isPublic ? 'public' : 'protected');\n }\n\n if (appManifest?.screens) {\n const defaultVisibility: 'public' \| 'protected' =\n authScope === 'global' ? 'protected' : 'public';\n\n for (const screenId of Object.keys(appManifest.screens)) {\n if (!screenVisibility.has(screenId)) {\n screenVisibility.set(screenId, defaultVisibility);\n }\n }\n }\n\n const publicScreens = [...screenVisibility.entries()]\n .filter(([, visibility]) => visibility === 'public')\n .map(([screenId]) => screenId)\n .sort();\n const protectedScreens = [...screenVisibility.entries()]\n .filter(([, visibility]) => visibility === 'protected')\n .map(([screenId]) => screenId)\n .sort();\n\n return {\n authScope,\n publicRoutes: [...publicRouteSet].sort(),\n protectedRoutes: [...protectedRouteSet].sort(),\n publicScreens,\n protectedScreens,\n };\n}\n\nfunction flattenNavigatorRoutes(navigator: NavigatorNode): CerbosRouteIntent[] {\n const deduped = new Map<string, CerbosRouteIntent>();\n\n const walk = (current: NavigatorNode) => {\n for (const route of current.routes) {\n const normalizedGuards = normalizeGuards(route.guards);\n const existing = deduped.get(route.name);\n deduped.set(route.name, {\n name: route.name,\n guards: unique([...(existing?.guards ?? []), ...normalizedGuards]),\n screenId: route.screenId ?? existing?.screenId,\n });\n\n if (route.navigator) {\n walk(route.navigator);\n }\n }\n };\n\n walk(navigator);\n return [...deduped.values()];\n}\n\nfunction normalizeGuards(guards?: RouteDefinition['guards']): string[] {\n return (guards ?? []).map((guard) => guard.trim().toLowerCase()).filter(Boolean);\n}\n\nfunction isPublicRoute(args: {\n route: CerbosRouteIntent;\n authScope: AuthScope;\n signInRoute?: string;\n signUpRoute?: string;\n unauthorizedRoute?: string;\n}): boolean {\n const { route, authScope, signInRoute, signUpRoute, unauthorizedRoute } = args;\n const guardSet = new Set(route.guards);\n const signInRouteName = authFlowPathToRouteName(signInRoute);\n const signUpRouteName = authFlowPathToRouteName(signUpRoute);\n const unauthorizedRouteName = authFlowPathToRouteName(unauthorizedRoute);\n\n if (\n route.name === signInRouteName \|\|\n route.name === signUpRouteName \|\|\n route.name === unauthorizedRouteName\n ) {\n return true;\n }\n\n if (hasAny(guardSet, PUBLIC_GUARD_HINTS)) {\n return true;\n }\n\n if (hasAny(guardSet, AUTH_GUARD_HINTS)) {\n return false;\n }\n\n switch (authScope) {\n case 'none':\n return true;\n case 'global':\n default:\n return false;\n }\n}\n\nfunction hasAny(values: Set<string>, candidates: Set<string>): boolean {\n for (const candidate of candidates) {\n if (values.has(candidate)) return true;\n }\n return false;\n}\n\nfunction unique(values: string[]): string[] {\n return [...new Set(values)];\n}\n\nfunction authFlowPathToRouteName(routePath: string \| undefined): string \| undefined {\n if (!routePath) {\n return undefined;\n }\n\n const normalized = routePath.trim().replace(/^\\/+/, '').replace(/\\/+$/, '');\n return normalized === '' ? 'index' : normalized;\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "4.1.8",
+  "version": "4.1.10",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -35,8 +35,8 @@
     "openapi"
   ],
   "dependencies": {
-    "@ankhorage/contracts": "^8.2.0",
-    "@ankhorage/supabase-vault": "^0.2.8"
+    "@ankhorage/contracts": "^11.0.0",
+    "@ankhorage/supabase-vault": "^0.2.9"
   },
   "files": [
     "dist",
@@ -106,8 +106,8 @@
     "knip:check": "ankhorage-knip"
   },
   "devDependencies": {
-    "@ankhorage/ankh": "^0.8.10",
-    "@ankhorage/devtools": "^1.11.0",
+    "@ankhorage/ankh": "^0.8.11",
+    "@ankhorage/devtools": "^1.11.1",
     "@ankhorage/paradox": "^0.1.24",
     "@types/bun": "^1.4.1",
     "@types/node": "^25.6.0",

package/src/adapters/minikube/authz/cerbos/index.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { AppManifest, NavigatorSpec, RouteDefinition } from '@ankhorage/contracts';
+import type { AppManifest, NavigatorNode, RouteDefinition } from '@ankhorage/contracts';
 import { resolveAuthFlow } from '@ankhorage/contracts/auth';
 import type { InfraManifestInput } from '../../../../types';
@@ -400,10 +400,10 @@ function buildCerbosPolicyIntent(args: {
   };
 }
-function flattenNavigatorRoutes(navigator: NavigatorSpec): CerbosRouteIntent[] {
+function flattenNavigatorRoutes(navigator: NavigatorNode): CerbosRouteIntent[] {
   const deduped = new Map<string, CerbosRouteIntent>();
-  const walk = (current: NavigatorSpec) => {
+  const walk = (current: NavigatorNode) => {
     for (const route of current.routes) {
       const normalizedGuards = normalizeGuards(route.guards);
       const existing = deduped.get(route.name);