@ankhorage/studio 0.1.6 → 0.3.0

package/README.md

@@ -3,7 +3,7 @@
 
 # @ankhorage/studio
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v0.1.5](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v0.2.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Standalone Studio authoring package for Ankhorage apps.
 

package/dist/host/http/secretRoutes.d.ts

@@ -0,0 +1,7 @@
+import type { FastifyInstance } from 'fastify';
+import type { ProjectManager } from '../orchestrator/projectManager';
+export declare function registerProjectSecretRoutes(fastify: FastifyInstance, options: {
+    readonly projectManager: ProjectManager;
+    readonly workspaceRoot: string;
+}): void;
+//# sourceMappingURL=secretRoutes.d.ts.map

package/dist/host/http/secretRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretRoutes.d.ts","sourceRoot":"","sources":["../../../src/host/http/secretRoutes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAGrE,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE;IACP,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,GACA,IAAI,CAkJN"}

package/dist/host/http/secretRoutes.js

@@ -0,0 +1,165 @@
+import { ProjectSecretService } from '../secrets/projectSecretService';
+export function registerProjectSecretRoutes(fastify, options) {
+    const service = new ProjectSecretService(options);
+    fastify.get('/api/projects/:id/secrets', async (request, reply) => {
+        const { id } = request.params;
+        const query = request.query;
+        return sendSecretResult(reply, await service.list({
+            projectId: id,
+            environment: query.environment,
+            kind: query.kind,
+            provider: query.provider,
+        }));
+    });
+    fastify.get('/api/projects/:id/secrets/metadata', async (request, reply) => {
+        const { id } = request.params;
+        const query = request.query;
+        if (typeof query.ref !== 'string' || query.ref.trim().length === 0) {
+            return reply.status(400).send({
+                error: { code: 'invalid_reference', message: 'A secret ref query parameter is required.' },
+            });
+        }
+        return sendSecretResult(reply, await service.getMetadata({
+            projectId: id,
+            environment: query.environment,
+            ref: query.ref,
+        }));
+    });
+    fastify.post('/api/projects/:id/secrets', async (request, reply) => {
+        const { id } = request.params;
+        const body = asRecord(request.body);
+        const payload = readSecretPayload(body.payload);
+        if (!payload || typeof body.ref !== 'string' || typeof body.kind !== 'string') {
+            return reply.status(400).send({
+                error: {
+                    code: 'invalid_payload',
+                    message: 'Secret creation requires ref, kind, and a non-empty string payload object.',
+                },
+            });
+        }
+        return sendSecretResult(reply, await service.create({
+            projectId: id,
+            environment: readOptionalString(body.environment),
+            ref: body.ref,
+            kind: body.kind,
+            provider: readOptionalString(body.provider),
+            payload,
+        }));
+    });
+    fastify.put('/api/projects/:id/secrets', async (request, reply) => {
+        const { id } = request.params;
+        const body = asRecord(request.body);
+        const payload = readSecretPayload(body.payload);
+        if (!payload || typeof body.ref !== 'string') {
+            return reply.status(400).send({
+                error: {
+                    code: 'invalid_payload',
+                    message: 'Secret replacement requires ref and a complete non-empty string payload object.',
+                },
+            });
+        }
+        return sendSecretResult(reply, await service.replace({
+            projectId: id,
+            environment: readOptionalString(body.environment),
+            ref: body.ref,
+            payload,
+        }));
+    });
+    fastify.delete('/api/projects/:id/secrets', async (request, reply) => {
+        const { id } = request.params;
+        const query = request.query;
+        if (typeof query.ref !== 'string' || query.ref.trim().length === 0) {
+            return reply.status(400).send({
+                error: { code: 'invalid_reference', message: 'A secret ref query parameter is required.' },
+            });
+        }
+        return sendSecretResult(reply, await service.remove({
+            projectId: id,
+            environment: query.environment,
+            ref: query.ref,
+        }));
+    });
+    fastify.post('/api/projects/:id/auth/oauth/:providerId', async (request, reply) => {
+        const { id, providerId } = request.params;
+        const body = asRecord(request.body);
+        const payload = readSecretPayload(body.payload);
+        if (!payload) {
+            return reply.status(400).send({
+                error: {
+                    code: 'invalid_payload',
+                    message: 'OAuth configuration requires a complete non-empty credential payload.',
+                },
+            });
+        }
+        const result = await service.configureOAuthProvider({
+            projectId: id,
+            providerId,
+            payload,
+            environment: readOptionalString(body.environment),
+            credentialsRef: readOptionalString(body.credentialsRef),
+            enabled: typeof body.enabled === 'boolean' ? body.enabled : undefined,
+            label: readOptionalString(body.label),
+            scopes: readStringArray(body.scopes),
+            callbackRoute: readOptionalString(body.callbackRoute),
+        });
+        if (!result.ok) {
+            const status = result.state === 'secret_saved_manifest_failed' ? 409 : 400;
+            return reply.status(status).send(result);
+        }
+        return result;
+    });
+}
+function sendSecretResult(reply, result) {
+    if (result.ok)
+        return result;
+    const status = resolveErrorStatus(result.error.code);
+    return reply.status(status).send({
+        ok: false,
+        error: {
+            code: result.error.code,
+            message: result.error.message,
+        },
+    });
+}
+function resolveErrorStatus(code) {
+    if (code === 'not_found')
+        return 404;
+    if (code === 'conflict')
+        return 409;
+    if (code === 'permission_denied')
+        return 403;
+    if (code === 'unavailable' || code === 'provider_error')
+        return 503;
+    return 400;
+}
+function asRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : {};
+}
+function readOptionalString(value) {
+    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
+}
+function readStringArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const result = [];
+    for (const item of value) {
+        if (typeof item !== 'string')
+            return undefined;
+        const normalized = item.trim();
+        if (normalized)
+            result.push(normalized);
+    }
+    return result;
+}
+function readSecretPayload(value) {
+    const record = asRecord(value);
+    const entries = Object.entries(record);
+    if (entries.length === 0 ||
+        entries.some(([field, fieldValue]) => !field.trim() || typeof fieldValue !== 'string' || !fieldValue)) {
+        return null;
+    }
+    return Object.freeze(Object.fromEntries(entries));
+}
+//# sourceMappingURL=secretRoutes.js.map

package/dist/host/http/secretRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretRoutes.js","sourceRoot":"","sources":["../../../src/host/http/secretRoutes.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEvE,MAAM,UAAU,2BAA2B,CACzC,OAAwB,EACxB,OAGC;IAED,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QAChF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAIrB,CAAC;QAEF,OAAO,gBAAgB,CACrB,KAAK,EACL,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACzF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgD,CAAC;QACvE,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,2CAA2C,EAAE;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,gBAAgB,CACrB,KAAK,EACL,MAAM,OAAO,CAAC,WAAW,CAAC;YACxB,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACjF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,4EAA4E;iBACtF;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,gBAAgB,CACrB,KAAK,EACL,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;YACjD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC3C,OAAO;SACR,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QAChF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EACL,iFAAiF;iBACpF;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,gBAAgB,CACrB,KAAK,EACL,MAAM,OAAO,CAAC,OAAO,CAAC;YACpB,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;YACjD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO;SACR,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACnF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgD,CAAC;QACvE,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,2CAA2C,EAAE;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,gBAAgB,CACrB,KAAK,EACL,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CACV,0CAA0C,EAC1C,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACvC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAA4C,CAAC;QAChF,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,uEAAuE;iBACjF;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC;YAClD,SAAS,EAAE,EAAE;YACb,UAAU;YACV,OAAO;YACP,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;YACjD,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC;YACvD,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACrE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;YACrC,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YACpC,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,KAAK,8BAA8B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3E,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAQ,KAAmB,EAAE,MAAgC;IACpF,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAC/B,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;YACvB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;SAC9B;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,GAAG,CAAC;IACrC,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,GAAG,CAAC;IACpC,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,GAAG,CAAC;IAC7C,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,GAAG,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAA2B,EAAE,CAAC;QAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CACxF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAA2B,CAAC,CAAC;AAC9E,CAAC"}

package/dist/host/index.d.ts

@@ -1,10 +1,14 @@
 export { createStudioHost, type CreateStudioHostOptions, type StudioHost, } from './createStudioHost';
+export { registerProjectSecretRoutes } from './http/secretRoutes';
 export { isOriginAllowed } from './http/security';
 export { createStudioHostServer, startStudioHostServer, type StartStudioHostServerOptions, } from './http/server';
 export { ModuleManager } from './orchestrator/moduleManager';
 export { ProjectManager } from './orchestrator/projectManager';
 export { assertProjectId, getAppsRoot, getProjectPath } from './orchestrator/projectPaths';
 export { ProjectStore, type ProjectSummary } from './orchestrator/projectStore';
+export { type BunSupabaseVaultClient, createBunSupabaseVaultClient, } from './secrets/bunSupabaseVaultClient';
+export { configureManifestOAuthProvider, type ConfigureOAuthProviderInput, type ConfigureOAuthProviderResult, ProjectSecretService, type ProjectSecretServiceOptions, } from './secrets/projectSecretService';
+export { resolveProjectSecretDatabaseUrl } from './secrets/resolveProjectSecretDatabaseUrl';
 export { getProjectTemplate, getTemplateSummaries } from './templateRegistry';
 export { resolveWorkspaceRoot } from './utils/workspaceRoot';
 //# sourceMappingURL=index.d.ts.map

package/dist/host/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,KAAK,sBAAsB,EAC3B,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,EAC9B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/host/index.js

@@ -1,10 +1,14 @@
 export { createStudioHost, } from './createStudioHost';
+export { registerProjectSecretRoutes } from './http/secretRoutes';
 export { isOriginAllowed } from './http/security';
 export { createStudioHostServer, startStudioHostServer, } from './http/server';
 export { ModuleManager } from './orchestrator/moduleManager';
 export { ProjectManager } from './orchestrator/projectManager';
 export { assertProjectId, getAppsRoot, getProjectPath } from './orchestrator/projectPaths';
 export { ProjectStore } from './orchestrator/projectStore';
+export { createBunSupabaseVaultClient, } from './secrets/bunSupabaseVaultClient';
+export { configureManifestOAuthProvider, ProjectSecretService, } from './secrets/projectSecretService';
+export { resolveProjectSecretDatabaseUrl } from './secrets/resolveProjectSecretDatabaseUrl';
 export { getProjectTemplate, getTemplateSummaries } from './templateRegistry';
 export { resolveWorkspaceRoot } from './utils/workspaceRoot';
 //# sourceMappingURL=index.js.map

package/dist/host/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAEtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAuB,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAEtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAuB,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAEL,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,EAG9B,oBAAoB,GAErB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/host/secrets/bunSupabaseVaultClient.d.ts

@@ -0,0 +1,12 @@
+import type { SupabaseVaultSqlClient } from '@ankhorage/supabase-vault';
+export interface BunSupabaseVaultClient extends SupabaseVaultSqlClient {
+    close(): Promise<void>;
+}
+/**
+ * Trusted server-only PostgreSQL transport for the Supabase Vault adapter.
+ *
+ * The connection URL must come from Studio host configuration or the generated local Supabase
+ * environment. It must never be read from an application manifest or exposed to browser code.
+ */
+export declare function createBunSupabaseVaultClient(databaseUrl: string): BunSupabaseVaultClient;
+//# sourceMappingURL=bunSupabaseVaultClient.d.ts.map

package/dist/host/secrets/bunSupabaseVaultClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bunSupabaseVaultClient.d.ts","sourceRoot":"","sources":["../../../src/host/secrets/bunSupabaseVaultClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,sBAAsB,EAEvB,MAAM,2BAA2B,CAAC;AAGnC,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,sBAAsB,CAyCxF"}

package/dist/host/secrets/bunSupabaseVaultClient.js

@@ -0,0 +1,43 @@
+import { SQL } from 'bun';
+/**
+ * Trusted server-only PostgreSQL transport for the Supabase Vault adapter.
+ *
+ * The connection URL must come from Studio host configuration or the generated local Supabase
+ * environment. It must never be read from an application manifest or exposed to browser code.
+ */
+export function createBunSupabaseVaultClient(databaseUrl) {
+    const normalizedUrl = databaseUrl.trim();
+    if (!normalizedUrl) {
+        throw new Error('Supabase Vault requires a trusted PostgreSQL database URL.');
+    }
+    const sql = new SQL(normalizedUrl, {
+        adapter: 'postgres',
+        max: 4,
+        connectionTimeout: 10,
+    });
+    const query = async (statement, parameters = []) => {
+        const rawRows = await sql.unsafe(statement, [...parameters]);
+        return { rows: assertRows(rawRows) };
+    };
+    return {
+        query,
+        transaction(operation) {
+            return sql.begin((transaction) => operation({
+                async query(statement, parameters = []) {
+                    const rawRows = await transaction.unsafe(statement, [...parameters]);
+                    return { rows: assertRows(rawRows) };
+                },
+            }));
+        },
+        close() {
+            return sql.close({ timeout: 5 });
+        },
+    };
+}
+function assertRows(value) {
+    if (!Array.isArray(value)) {
+        throw new Error('Supabase Vault query returned an unexpected result shape.');
+    }
+    return value;
+}
+//# sourceMappingURL=bunSupabaseVaultClient.js.map

package/dist/host/secrets/bunSupabaseVaultClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bunSupabaseVaultClient.js","sourceRoot":"","sources":["../../../src/host/secrets/bunSupabaseVaultClient.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAM1B;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,WAAmB;IAC9D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE;QACjC,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,CAAC;QACN,iBAAiB,EAAE,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,KAAK,EACjB,SAAiB,EACjB,aAAiC,EAAE,EACM,EAAE;QAC3C,MAAM,OAAO,GAAY,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAO,OAAO,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,WAAW,CACT,SAAmE;YAEnE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAC/B,SAAS,CAAC;gBACR,KAAK,CAAC,KAAK,CACT,SAAiB,EACjB,aAAiC,EAAE;oBAEnC,MAAM,OAAO,GAAY,MAAM,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;oBAC9E,OAAO,EAAE,IAAI,EAAE,UAAU,CAAO,OAAO,CAAC,EAAE,CAAC;gBAC7C,CAAC;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK;YACH,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAuC,KAAc;IACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,KAAwB,CAAC;AAClC,CAAC"}

package/dist/host/secrets/projectSecretService.d.ts

@@ -0,0 +1,81 @@
+import { type AppManifest, type AuthOAuthProviderConfig, type AuthOAuthProviderId } from '@ankhorage/contracts';
+import { type SecretMetadata, type SecretPayload, type SecretStoreResult } from '@ankhorage/contracts/secrets';
+import type { ProjectManager } from '../orchestrator/projectManager';
+import { type BunSupabaseVaultClient } from './bunSupabaseVaultClient';
+export interface ProjectSecretServiceOptions {
+    readonly projectManager: ProjectManager;
+    readonly workspaceRoot: string;
+    readonly createClient?: (databaseUrl: string) => BunSupabaseVaultClient;
+    readonly resolveDatabaseUrl?: (projectPath: string) => Promise<string>;
+}
+export interface ConfigureOAuthProviderInput {
+    readonly projectId: string;
+    readonly environment?: string;
+    readonly providerId: AuthOAuthProviderId;
+    readonly payload: SecretPayload;
+    readonly credentialsRef?: string;
+    readonly enabled?: boolean;
+    readonly label?: string;
+    readonly scopes?: readonly string[];
+    readonly callbackRoute?: string;
+}
+export type ConfigureOAuthProviderResult = {
+    readonly ok: true;
+    readonly state: 'saved';
+    readonly metadata: SecretMetadata;
+    readonly credentialsRef: string;
+} | {
+    readonly ok: false;
+    readonly state: 'secret_write_failed' | 'secret_saved_manifest_failed';
+    readonly error: {
+        readonly code: string;
+        readonly message: string;
+    };
+    readonly metadata?: SecretMetadata;
+    readonly credentialsRef?: string;
+};
+export declare class ProjectSecretService {
+    private readonly projectManager;
+    private readonly workspaceRoot;
+    private readonly createClient;
+    private readonly resolveDatabaseUrl;
+    constructor(options: ProjectSecretServiceOptions);
+    list(input: {
+        readonly projectId: string;
+        readonly environment?: string;
+        readonly kind?: string;
+        readonly provider?: string;
+    }): Promise<SecretStoreResult<readonly SecretMetadata[]>>;
+    getMetadata(input: {
+        readonly projectId: string;
+        readonly environment?: string;
+        readonly ref: string;
+    }): Promise<SecretStoreResult<SecretMetadata>>;
+    create(input: {
+        readonly projectId: string;
+        readonly environment?: string;
+        readonly ref: string;
+        readonly kind: string;
+        readonly provider?: string;
+        readonly payload: SecretPayload;
+    }): Promise<SecretStoreResult<SecretMetadata>>;
+    replace(input: {
+        readonly projectId: string;
+        readonly environment?: string;
+        readonly ref: string;
+        readonly payload: SecretPayload;
+    }): Promise<SecretStoreResult<SecretMetadata>>;
+    remove(input: {
+        readonly projectId: string;
+        readonly environment?: string;
+        readonly ref: string;
+    }): Promise<SecretStoreResult>;
+    configureOAuthProvider(input: ConfigureOAuthProviderInput): Promise<ConfigureOAuthProviderResult>;
+    private readEditableManifest;
+    private withAdapter;
+}
+export declare function configureManifestOAuthProvider(manifest: AppManifest, input: {
+    readonly provider: AuthOAuthProviderConfig;
+    readonly callbackRoute?: string;
+}): AppManifest;
+//# sourceMappingURL=projectSecretService.d.ts.map

package/dist/host/secrets/projectSecretService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectSecretService.d.ts","sourceRoot":"","sources":["../../../src/host/secrets/projectSecretService.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EAEzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,aAAa,EAGlB,KAAK,iBAAiB,EACvB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAC;AAGlC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,sBAAsB,CAAC;IACxE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,4BAA4B,GACpC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,8BAA8B,CAAC;IACvE,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkD;IAC/E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2C;gBAElE,OAAO,EAAE,2BAA2B;IAShD,IAAI,CAAC,KAAK,EAAE;QACV,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,iBAAiB,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAUzD,WAAW,CAAC,KAAK,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAS9C,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;KACjC,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAY9C,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;KACjC,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAU9C,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IASxB,sBAAsB,CAC1B,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,4BAA4B,CAAC;YA+F1B,oBAAoB;YAQpB,WAAW;CA0C1B;AAED,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,WAAW,EACrB,KAAK,EAAE;IACL,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,GACA,WAAW,CAiCb"}

package/dist/host/secrets/projectSecretService.js

@@ -0,0 +1,240 @@
+import { DEFAULT_AUTH_FLOW, } from '@ankhorage/contracts';
+import { normalizeSecretRef, } from '@ankhorage/contracts/secrets';
+import { createInfraSecretStoreAdapter } from '@ankhorage/infra';
+import { getSupabaseOAuthProviderDefinition, validateSupabaseOAuthSecretPayload, } from '@ankhorage/supabase-auth';
+import { getProjectPath } from '../orchestrator/projectPaths';
+import { createBunSupabaseVaultClient, } from './bunSupabaseVaultClient';
+import { resolveProjectSecretDatabaseUrl } from './resolveProjectSecretDatabaseUrl';
+export class ProjectSecretService {
+    projectManager;
+    workspaceRoot;
+    createClient;
+    resolveDatabaseUrl;
+    constructor(options) {
+        this.projectManager = options.projectManager;
+        this.workspaceRoot = options.workspaceRoot;
+        this.createClient = options.createClient ?? createBunSupabaseVaultClient;
+        this.resolveDatabaseUrl =
+            options.resolveDatabaseUrl ??
+                ((projectPath) => resolveProjectSecretDatabaseUrl({ projectPath }));
+    }
+    list(input) {
+        return this.withAdapter(input.projectId, (adapter) => adapter.list({
+            scope: createScope(input.projectId, input.environment),
+            ...(input.kind ? { kind: input.kind } : {}),
+            ...(input.provider ? { provider: input.provider } : {}),
+        }));
+    }
+    getMetadata(input) {
+        return this.withAdapter(input.projectId, (adapter) => adapter.getMetadata({
+            scope: createScope(input.projectId, input.environment),
+            ref: input.ref,
+        }));
+    }
+    create(input) {
+        return this.withAdapter(input.projectId, (adapter) => adapter.create({
+            scope: createScope(input.projectId, input.environment),
+            ref: input.ref,
+            kind: input.kind,
+            ...(input.provider ? { provider: input.provider } : {}),
+            payload: input.payload,
+        }));
+    }
+    replace(input) {
+        return this.withAdapter(input.projectId, (adapter) => adapter.replace({
+            scope: createScope(input.projectId, input.environment),
+            ref: input.ref,
+            payload: input.payload,
+        }));
+    }
+    remove(input) {
+        return this.withAdapter(input.projectId, (adapter) => adapter.remove({
+            scope: createScope(input.projectId, input.environment),
+            ref: input.ref,
+        }));
+    }
+    async configureOAuthProvider(input) {
+        const definition = getSupabaseOAuthProviderDefinition(input.providerId);
+        if (!definition) {
+            return {
+                ok: false,
+                state: 'secret_write_failed',
+                error: {
+                    code: 'invalid_config',
+                    message: `OAuth provider "${input.providerId}" is not supported by the current Supabase provider registry.`,
+                },
+            };
+        }
+        const payloadResult = validateSupabaseOAuthSecretPayload(input.providerId, input.payload);
+        if (!payloadResult.ok) {
+            return {
+                ok: false,
+                state: 'secret_write_failed',
+                error: toPublicError(payloadResult.error),
+            };
+        }
+        const refResult = normalizeSecretRef(input.credentialsRef ?? `auth/oauth/${definition.id}`);
+        if (!refResult.ok) {
+            return {
+                ok: false,
+                state: 'secret_write_failed',
+                error: toPublicError(refResult.error),
+            };
+        }
+        const scope = createScope(input.projectId, input.environment);
+        const secretResult = await this.withAdapter(input.projectId, async (adapter) => {
+            const existing = await adapter.getMetadata({ scope, ref: refResult.data });
+            if (existing.ok) {
+                return adapter.replace({ scope, ref: refResult.data, payload: payloadResult.data });
+            }
+            if (existing.error.code !== 'not_found')
+                return existing;
+            return adapter.create({
+                scope,
+                ref: refResult.data,
+                kind: 'oauth',
+                provider: definition.id,
+                payload: payloadResult.data,
+            });
+        });
+        if (!secretResult.ok) {
+            return {
+                ok: false,
+                state: 'secret_write_failed',
+                error: toPublicError(secretResult.error),
+            };
+        }
+        const manifest = await this.readEditableManifest(input.projectId);
+        const nextManifest = configureManifestOAuthProvider(manifest, {
+            provider: {
+                id: definition.id,
+                label: normalizeOptionalText(input.label) ?? definition.label,
+                enabled: input.enabled ?? true,
+                scopes: normalizeScopes(input.scopes ?? definition.defaultScopes),
+                credentialsRef: refResult.data,
+            },
+            callbackRoute: input.callbackRoute,
+        });
+        try {
+            await this.projectManager.saveStudioManifest({
+                projectId: input.projectId,
+                manifest: nextManifest,
+            });
+        }
+        catch {
+            return {
+                ok: false,
+                state: 'secret_saved_manifest_failed',
+                metadata: secretResult.data,
+                credentialsRef: refResult.data,
+                error: {
+                    code: 'manifest_write_failed',
+                    message: 'OAuth credentials were saved, but the manifest update failed. Retry the manifest save or remove the stored secret explicitly.',
+                },
+            };
+        }
+        return {
+            ok: true,
+            state: 'saved',
+            metadata: secretResult.data,
+            credentialsRef: refResult.data,
+        };
+    }
+    async readEditableManifest(projectId) {
+        try {
+            return await this.projectManager.getStudioManifest(projectId);
+        }
+        catch {
+            return this.projectManager.getProjectManifest(projectId);
+        }
+    }
+    async withAdapter(projectId, operation) {
+        let client = null;
+        try {
+            const manifest = await this.readEditableManifest(projectId);
+            const projectPath = getProjectPath(this.workspaceRoot, projectId);
+            const databaseUrl = await this.resolveDatabaseUrl(projectPath);
+            client = this.createClient(databaseUrl);
+            const adapter = createInfraSecretStoreAdapter({
+                manifest: manifest.infra,
+                providers: {
+                    supabaseVault: { client },
+                },
+            });
+            if (!adapter) {
+                return {
+                    ok: false,
+                    error: {
+                        code: 'invalid_config',
+                        message: 'This project does not configure infra.secretStore.provider.',
+                    },
+                };
+            }
+            return await operation(adapter);
+        }
+        catch {
+            return {
+                ok: false,
+                error: {
+                    code: 'unavailable',
+                    message: 'The project secret store is unavailable. Verify local Supabase is running and the trusted database URL is configured.',
+                },
+            };
+        }
+        finally {
+            await client?.close();
+        }
+    }
+}
+export function configureManifestOAuthProvider(manifest, input) {
+    const currentAuth = manifest.infra.auth;
+    const currentOAuth = currentAuth?.oauth;
+    const existingCallbackRoute = currentOAuth ? currentOAuth.callbackRoute : undefined;
+    const callbackRoute = normalizeOptionalText(input.callbackRoute) ??
+        normalizeOptionalText(existingCallbackRoute) ??
+        '/auth/callback';
+    const providers = [...(currentOAuth?.providers ?? [])];
+    const existingIndex = providers.findIndex((provider) => provider.id === input.provider.id);
+    if (existingIndex >= 0)
+        providers[existingIndex] = input.provider;
+    else
+        providers.push(input.provider);
+    return {
+        ...manifest,
+        infra: {
+            ...manifest.infra,
+            auth: {
+                ...(currentAuth ?? {
+                    provider: 'supabase',
+                    scope: 'global',
+                    flow: { ...DEFAULT_AUTH_FLOW },
+                    signIn: { identifiers: ['email'] },
+                }),
+                oauth: {
+                    enabled: true,
+                    callbackRoute,
+                    providers,
+                },
+            },
+        },
+    };
+}
+function createScope(projectId, environment = 'local') {
+    return {
+        projectId,
+        environment: normalizeOptionalText(environment) ?? 'local',
+    };
+}
+function normalizeScopes(scopes) {
+    return [...new Set(scopes.map((scope) => scope.trim()).filter(Boolean))];
+}
+function normalizeOptionalText(value) {
+    const normalized = value?.trim();
+    if (!normalized)
+        return undefined;
+    return normalized;
+}
+function toPublicError(error) {
+    return { code: error.code, message: error.message };
+}
+//# sourceMappingURL=projectSecretService.js.map