@ankhorage/studio 0.11.9 → 0.11.10

package/dist/host/auth/projectAuthHealthService.d.ts

@@ -1,13 +1,15 @@
 import type { ProjectAuthHealth } from '../../projectAuthHealth';
 import type { ProjectManager } from '../orchestrator/projectManager';
 import type { ProjectSecretService } from '../secrets/projectSecretService';
-type ProjectAuthHealthManager = Pick<ProjectManager, 'getProjectManifest' | 'getStudioManifest'>;
+type ProjectAuthHealthManager = Pick<ProjectManager, 'getInfrastructureStatus' | 'getProjectManifest' | 'getStudioManifest'>;
 export declare class ProjectAuthHealthService {
     private readonly projectManager;
     private readonly secretService;
+    private readonly workspaceRoot;
     constructor(options: {
         readonly projectManager: ProjectAuthHealthManager;
         readonly secretService: Pick<ProjectSecretService, 'list'>;
+        readonly workspaceRoot: string;
     });
     get(input: {
         readonly projectId: string;

package/dist/host/auth/projectAuthHealthService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectAuthHealthService.d.ts","sourceRoot":"","sources":["../../../src/host/auth/projectAuthHealthService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,KAAK,wBAAwB,GAAG,IAAI,CAAC,cAAc,EAAE,oBAAoB,GAAG,mBAAmB,CAAC,CAAC;AAEjG,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;gBAEvD,OAAO,EAAE;QACnB,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;QAClD,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;KAC5D;IAKK,GAAG,CAAC,KAAK,EAAE;QACf,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC,uBAAuB,CAAC;YA8BtB,oBAAoB;CAOnC;AAED,MAAM,MAAM,uBAAuB,GAC/B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;QACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC"}
+{"version":3,"file":"projectAuthHealthService.d.ts","sourceRoot":"","sources":["../../../src/host/auth/projectAuthHealthService.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAG5E,KAAK,wBAAwB,GAAG,IAAI,CAClC,cAAc,EACd,yBAAyB,GAAG,oBAAoB,GAAG,mBAAmB,CACvE,CAAC;AAEF,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;IACnE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,OAAO,EAAE;QACnB,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;QAClD,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QAC3D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC;IAMK,GAAG,CAAC,KAAK,EAAE;QACf,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC,uBAAuB,CAAC;YA8DtB,oBAAoB;CAOnC;AAOD,MAAM,MAAM,uBAAuB,GAC/B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;QACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC"}

package/dist/host/auth/projectAuthHealthService.js

@@ -1,10 +1,14 @@
 import { analyzeProjectAuthHealth } from '../../projectAuthHealth';
+import { applyProjectAuthRuntimeDiagnostics } from '../../projectAuthRuntimeDiagnostics';
+import { observeProjectAuthRuntimeDiagnostics } from './projectAuthRuntimeDiagnostics';
 export class ProjectAuthHealthService {
     projectManager;
     secretService;
+    workspaceRoot;
     constructor(options) {
         this.projectManager = options.projectManager;
         this.secretService = options.secretService;
+        this.workspaceRoot = options.workspaceRoot;
     }
     async get(input) {
         let manifest;
@@ -24,15 +28,46 @@ export class ProjectAuthHealthService {
             projectId: input.projectId,
             environment: input.environment,
         });
-        return {
-            ok: true,
-            state: 'loaded',
-            data: analyzeProjectAuthHealth({
-                manifest,
-                secretMetadata: secretResult.ok ? secretResult.data : [],
-                secretStoreAvailable: secretResult.ok,
-            }),
-        };
+        const desiredHealth = analyzeProjectAuthHealth({
+            manifest,
+            secretMetadata: secretResult.ok ? secretResult.data : [],
+            secretStoreAvailable: secretResult.ok,
+        });
+        const oauth = manifest.infra.auth?.oauth;
+        if (!oauth?.enabled || !oauth.providers.some((provider) => provider.enabled === true)) {
+            return {
+                ok: true,
+                state: 'loaded',
+                data: desiredHealth,
+            };
+        }
+        try {
+            const infraStatus = await this.projectManager.getInfrastructureStatus(input.projectId);
+            const runtimeDiagnostics = await observeProjectAuthRuntimeDiagnostics({
+                rootPath: this.workspaceRoot,
+                projectId: input.projectId,
+                target: infraStatus.target,
+                generated: infraStatus.hasLedger,
+                environment: resolveAuthRedirectEnvironment(input.environment),
+                callbackRoute: oauth.callbackRoute,
+            });
+            return {
+                ok: true,
+                state: 'loaded',
+                data: applyProjectAuthRuntimeDiagnostics(desiredHealth, runtimeDiagnostics),
+            };
+        }
+        catch {
+            return {
+                ok: true,
+                state: 'loaded',
+                data: applyProjectAuthRuntimeDiagnostics(desiredHealth, {
+                    appCallbackTargets: [],
+                    redirectAllowList: [],
+                    rolloutStatus: 'unavailable',
+                }),
+            };
+        }
     }
     async readEditableManifest(projectId) {
         try {
@@ -43,4 +78,9 @@ export class ProjectAuthHealthService {
         }
     }
 }
+function resolveAuthRedirectEnvironment(environment) {
+    if (environment === 'preview' || environment === 'production')
+        return environment;
+    return 'local';
+}
 //# sourceMappingURL=projectAuthHealthService.js.map

package/dist/host/auth/projectAuthHealthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectAuthHealthService.js","sourceRoot":"","sources":["../../../src/host/auth/projectAuthHealthService.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAMnE,MAAM,OAAO,wBAAwB;IAClB,cAAc,CAA2B;IACzC,aAAa,CAAqC;IAEnE,YAAY,OAGX;QACC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAGT;QACC,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,+DAA+D;iBACzE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YACjD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,wBAAwB,CAAC;gBAC7B,QAAQ;gBACR,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACxD,oBAAoB,EAAE,YAAY,CAAC,EAAE;aACtC,CAAC;SACH,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,SAAiB;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"projectAuthHealthService.js","sourceRoot":"","sources":["../../../src/host/auth/projectAuthHealthService.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,kCAAkC,EAAE,MAAM,qCAAqC,CAAC;AAGzF,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AAOvF,MAAM,OAAO,wBAAwB;IAClB,cAAc,CAA2B;IACzC,aAAa,CAAqC;IAClD,aAAa,CAAS;IAEvC,YAAY,OAIX;QACC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAGT;QACC,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,+DAA+D;iBACzE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YACjD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,wBAAwB,CAAC;YAC7C,QAAQ;YACR,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YACxD,oBAAoB,EAAE,YAAY,CAAC,EAAE;SACtC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;QAEzC,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,aAAa;aACpB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvF,MAAM,kBAAkB,GAAG,MAAM,oCAAoC,CAAC;gBACpE,QAAQ,EAAE,IAAI,CAAC,aAAa;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,WAAW,EAAE,8BAA8B,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC9D,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;YAEH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,kCAAkC,CAAC,aAAa,EAAE,kBAAkB,CAAC;aAC5E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,kCAAkC,CAAC,aAAa,EAAE;oBACtD,kBAAkB,EAAE,EAAE;oBACtB,iBAAiB,EAAE,EAAE;oBACrB,aAAa,EAAE,aAAa;iBAC7B,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,SAAiB;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAED,SAAS,8BAA8B,CAAC,WAA+B;IACrE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,YAAY;QAAE,OAAO,WAAW,CAAC;IAClF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/host/auth/projectAuthRuntimeDiagnostics.d.ts

@@ -0,0 +1,28 @@
+import type { AuthRedirectEnvironment } from '@ankhorage/infra';
+import type { ProjectAuthRuntimeDiagnostics, ProjectAuthRuntimeRolloutStatus } from '../../projectAuthRuntimeDiagnostics';
+export interface ProjectAuthRedirectRuntime {
+    readonly providerRedirectUrl: string;
+    readonly siteUrl: string;
+    readonly appCallbackTargets: readonly string[];
+    readonly redirectAllowList: readonly string[];
+}
+export interface ParsedProjectAuthRuntimeStatus {
+    readonly rolloutStatus: ProjectAuthRuntimeRolloutStatus;
+    readonly providerRedirectUrl?: string;
+    readonly appCallbackUrl?: string;
+}
+export declare function observeProjectAuthRuntimeDiagnostics(input: {
+    readonly rootPath: string;
+    readonly projectId: string;
+    readonly target: string | null;
+    readonly generated: boolean;
+    readonly environment: AuthRedirectEnvironment;
+    readonly callbackRoute: string;
+}): Promise<ProjectAuthRuntimeDiagnostics>;
+export declare function resolveProjectAuthRedirectRuntime(input: {
+    readonly environment: AuthRedirectEnvironment;
+    readonly callbackRoute: string;
+    readonly infraEnvironment: Readonly<Record<string, string | undefined>>;
+}): ProjectAuthRedirectRuntime;
+export declare function parseProjectAuthRuntimeStatus(stdout: string): ParsedProjectAuthRuntimeStatus;
+//# sourceMappingURL=projectAuthRuntimeDiagnostics.d.ts.map

package/dist/host/auth/projectAuthRuntimeDiagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectAuthRuntimeDiagnostics.d.ts","sourceRoot":"","sources":["../../../src/host/auth/projectAuthRuntimeDiagnostics.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,KAAK,EACV,6BAA6B,EAC7B,+BAA+B,EAChC,MAAM,qCAAqC,CAAC;AAa7C,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,aAAa,EAAE,+BAA+B,CAAC;IACxD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAmFzC;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACzE,GAAG,0BAA0B,CA+B7B;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,8BAA8B,CAiB5F"}

package/dist/host/auth/projectAuthRuntimeDiagnostics.js

@@ -0,0 +1,192 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { resolveAuthRedirectConfiguration } from '@ankhorage/infra';
+import { runProjectInfraScriptCapture } from '../orchestrator/infraRuntime';
+import { getProjectPath } from '../orchestrator/projectPaths';
+const SAFE_INFRA_ENV_KEYS = new Set([
+    'API_EXTERNAL_URL',
+    'APP_PORT_FORWARD_LOCAL_PORT',
+    'EXPO_PUBLIC_SUPABASE_URL',
+    'OAUTH_NATIVE_REDIRECT_URLS',
+    'SITE_URL',
+    'SUPABASE_GATEWAY_FORWARD_LOCAL_PORT',
+]);
+export async function observeProjectAuthRuntimeDiagnostics(input) {
+    if (!input.generated || !input.target) {
+        return {
+            appCallbackTargets: [],
+            redirectAllowList: [],
+            rolloutStatus: 'not-generated',
+        };
+    }
+    const diagnostics = [];
+    let expected = null;
+    try {
+        const environment = await readSafeGeneratedInfraEnvironment({
+            rootPath: input.rootPath,
+            projectId: input.projectId,
+            target: input.target,
+        });
+        expected = resolveProjectAuthRedirectRuntime({
+            environment: input.environment,
+            callbackRoute: input.callbackRoute,
+            infraEnvironment: environment,
+        });
+    }
+    catch {
+        diagnostics.push({
+            code: 'auth_redirect_configuration_unavailable',
+            severity: 'warning',
+            message: 'Canonical Auth callback diagnostics could not be derived from generated Infra.',
+            path: 'infra.auth.oauth',
+        });
+    }
+    let observed = { rolloutStatus: 'unavailable' };
+    try {
+        const status = await runProjectInfraScriptCapture({
+            rootPath: input.rootPath,
+            projectId: input.projectId,
+            target: input.target,
+            script: 'status',
+        });
+        observed = parseProjectAuthRuntimeStatus(status.stdout);
+    }
+    catch {
+        // The public health result deliberately reports only a bounded state, never script output.
+    }
+    if (expected?.providerRedirectUrl &&
+        observed.providerRedirectUrl &&
+        expected.providerRedirectUrl !== observed.providerRedirectUrl) {
+        diagnostics.push({
+            code: 'auth_runtime_provider_callback_stale',
+            severity: 'error',
+            message: 'The running Auth provider callback does not match generated Infra configuration.',
+            path: 'infra.auth.oauth.providerCallback',
+        });
+    }
+    const expectedAppCallbackUrl = expected?.appCallbackTargets.find(isExactWebCallbackUrl);
+    if (expectedAppCallbackUrl &&
+        observed.appCallbackUrl &&
+        expectedAppCallbackUrl !== observed.appCallbackUrl) {
+        diagnostics.push({
+            code: 'auth_runtime_app_callback_stale',
+            severity: 'error',
+            message: 'The running Auth app callback does not match generated Infra configuration.',
+            path: 'infra.auth.oauth.callbackRoute',
+        });
+    }
+    return {
+        ...(expected?.providerRedirectUrl
+            ? { providerRedirectUrl: expected.providerRedirectUrl }
+            : observed.providerRedirectUrl
+                ? { providerRedirectUrl: observed.providerRedirectUrl }
+                : {}),
+        appCallbackTargets: expected?.appCallbackTargets ?? [],
+        redirectAllowList: expected?.redirectAllowList ?? [],
+        rolloutStatus: observed.rolloutStatus,
+        diagnostics,
+    };
+}
+export function resolveProjectAuthRedirectRuntime(input) {
+    const siteOrigin = resolveOrigin(input.infraEnvironment.SITE_URL, input.infraEnvironment.APP_PORT_FORWARD_LOCAL_PORT);
+    const gatewayOrigin = resolveOrigin(input.infraEnvironment.API_EXTERNAL_URL ?? input.infraEnvironment.EXPO_PUBLIC_SUPABASE_URL, input.infraEnvironment.SUPABASE_GATEWAY_FORWARD_LOCAL_PORT);
+    if (!siteOrigin || !gatewayOrigin) {
+        throw new Error('Generated Infra does not expose canonical app and gateway origins.');
+    }
+    const configuration = resolveAuthRedirectConfiguration({
+        environment: input.environment,
+        gatewayOrigin,
+        siteOrigin,
+        callbackRoute: input.callbackRoute,
+        webOrigins: [siteOrigin],
+        nativeRedirectUris: splitCommaSeparated(input.infraEnvironment.OAUTH_NATIVE_REDIRECT_URLS),
+    });
+    return {
+        providerRedirectUrl: configuration.providerCallbackUrl,
+        siteUrl: configuration.siteUrl,
+        appCallbackTargets: configuration.redirectAllowList.filter((target) => target !== configuration.siteUrl),
+        redirectAllowList: configuration.redirectAllowList,
+    };
+}
+export function parseProjectAuthRuntimeStatus(stdout) {
+    const providerRedirectUrl = readSafeStatusValue(stdout, /provider\s+supabase-auth\/provider-callback:\s*([^\r\n]+)/iu);
+    const appCallbackUrl = readSafeStatusValue(stdout, /provider\s+supabase-auth\/app-callback:\s*([^\r\n]+)/iu);
+    const readiness = /provider\s+supabase-auth\/GoTrue:\s*(not ready|ready)\b/iu.exec(stdout)?.[1];
+    return {
+        rolloutStatus: readiness === 'ready' ? 'ready' : readiness === 'not ready' ? 'not-ready' : 'unavailable',
+        ...(providerRedirectUrl ? { providerRedirectUrl } : {}),
+        ...(appCallbackUrl ? { appCallbackUrl } : {}),
+    };
+}
+async function readSafeGeneratedInfraEnvironment(input) {
+    const projectPath = getProjectPath(input.rootPath, input.projectId);
+    const infraRoot = path.join(projectPath, 'infra', input.target);
+    const envPath = path.join(infraRoot, '.env');
+    const fallbackPath = path.join(infraRoot, '.env.example');
+    const sourcePath = (await exists(envPath)) ? envPath : fallbackPath;
+    const content = await fs.readFile(sourcePath, 'utf8');
+    const environment = {};
+    for (const line of content.split(/\r?\n/u)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const separatorIndex = trimmed.indexOf('=');
+        if (separatorIndex <= 0)
+            continue;
+        const key = trimmed.slice(0, separatorIndex).trim();
+        if (!SAFE_INFRA_ENV_KEYS.has(key))
+            continue;
+        environment[key] = trimmed
+            .slice(separatorIndex + 1)
+            .trim()
+            .replace(/^['"]|['"]$/g, '');
+    }
+    return environment;
+}
+function resolveOrigin(value, portValue) {
+    if (value?.trim()) {
+        try {
+            return new URL(value.trim()).origin;
+        }
+        catch {
+            return null;
+        }
+    }
+    const port = parsePort(portValue);
+    return port === null ? null : `http://127.0.0.1:${port}`;
+}
+function parsePort(value) {
+    if (!value)
+        return null;
+    const port = Number.parseInt(value, 10);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        return null;
+    return port;
+}
+function splitCommaSeparated(value) {
+    if (!value)
+        return [];
+    return value
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+function readSafeStatusValue(stdout, pattern) {
+    const value = pattern.exec(stdout)?.[1]?.trim();
+    if (!value || value.length > 2048 || /\s/u.test(value))
+        return undefined;
+    return value;
+}
+function isExactWebCallbackUrl(value) {
+    return /^https?:\/\//u.test(value) && !value.includes('*');
+}
+async function exists(filePath) {
+    try {
+        await fs.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=projectAuthRuntimeDiagnostics.js.map

package/dist/host/auth/projectAuthRuntimeDiagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectAuthRuntimeDiagnostics.js","sourceRoot":"","sources":["../../../src/host/auth/projectAuthRuntimeDiagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,gCAAgC,EAAE,MAAM,kBAAkB,CAAC;AAOpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,kBAAkB;IAClB,6BAA6B;IAC7B,0BAA0B;IAC1B,4BAA4B;IAC5B,UAAU;IACV,qCAAqC;CACtC,CAAC,CAAC;AAeH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAO1D;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO;YACL,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;YACrB,aAAa,EAAE,eAAe;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAA4B,EAAE,CAAC;IAChD,IAAI,QAAQ,GAAsC,IAAI,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,iCAAiC,CAAC;YAC1D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,QAAQ,GAAG,iCAAiC,CAAC;YAC3C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,gBAAgB,EAAE,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,yCAAyC;YAC/C,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,gFAAgF;YACzF,IAAI,EAAE,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,GAAmC,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,QAAQ,GAAG,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;IAC7F,CAAC;IAED,IACE,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,CAAC,mBAAmB;QAC5B,QAAQ,CAAC,mBAAmB,KAAK,QAAQ,CAAC,mBAAmB,EAC7D,CAAC;QACD,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,sCAAsC;YAC5C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,kFAAkF;YAC3F,IAAI,EAAE,mCAAmC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,sBAAsB,GAAG,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACxF,IACE,sBAAsB;QACtB,QAAQ,CAAC,cAAc;QACvB,sBAAsB,KAAK,QAAQ,CAAC,cAAc,EAClD,CAAC;QACD,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,iCAAiC;YACvC,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,6EAA6E;YACtF,IAAI,EAAE,gCAAgC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,GAAG,CAAC,QAAQ,EAAE,mBAAmB;YAC/B,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,EAAE;YACvD,CAAC,CAAC,QAAQ,CAAC,mBAAmB;gBAC5B,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;QACT,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,IAAI,EAAE;QACtD,iBAAiB,EAAE,QAAQ,EAAE,iBAAiB,IAAI,EAAE;QACpD,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAIjD;IACC,MAAM,UAAU,GAAG,aAAa,CAC9B,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAC/B,KAAK,CAAC,gBAAgB,CAAC,2BAA2B,CACnD,CAAC;IACF,MAAM,aAAa,GAAG,aAAa,CACjC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,CAAC,wBAAwB,EAC1F,KAAK,CAAC,gBAAgB,CAAC,mCAAmC,CAC3D,CAAC;IAEF,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,aAAa,GAAG,gCAAgC,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa;QACb,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,CAAC,UAAU,CAAC;QACxB,kBAAkB,EAAE,mBAAmB,CAAC,KAAK,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;KAC3F,CAAC,CAAC;IAEH,OAAO;QACL,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,kBAAkB,EAAE,aAAa,CAAC,iBAAiB,CAAC,MAAM,CACxD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,CAC7C;QACD,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,mBAAmB,GAAG,mBAAmB,CAC7C,MAAM,EACN,6DAA6D,CAC9D,CAAC;IACF,MAAM,cAAc,GAAG,mBAAmB,CACxC,MAAM,EACN,wDAAwD,CACzD,CAAC;IACF,MAAM,SAAS,GAAG,2DAA2D,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhG,OAAO;QACL,aAAa,EACX,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa;QAC3F,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAIhD;IACC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,WAAW,GAA2B,EAAE,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,cAAc,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO;aACvB,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;aACzB,IAAI,EAAE;aACN,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,SAA6B;IAC7E,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAyB;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,OAAe;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/host/http/authRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authRoutes.d.ts","sourceRoot":"","sources":["../../../src/host/http/authRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAM7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAGrE,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE;IAAE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACpF,IAAI,CA8BN"}
+{"version":3,"file":"authRoutes.d.ts","sourceRoot":"","sources":["../../../src/host/http/authRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAM7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAGrE,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE;IAAE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACpF,IAAI,CA+BN"}

package/dist/host/http/authRoutes.js

@@ -5,6 +5,7 @@ export function registerProjectAuthRoutes(fastify, options) {
         ? null
         : new ProjectAuthHealthService({
             projectManager: options.projectManager,
+            workspaceRoot: options.workspaceRoot,
             secretService: new ProjectSecretService({
                 projectManager: options.projectManager,
                 workspaceRoot: options.workspaceRoot,

package/dist/host/http/authRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"authRoutes.js","sourceRoot":"","sources":["../../../src/host/http/authRoutes.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,OAAwB,EACxB,OAAqF;IAErF,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,KAAK,SAAS;QACjC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,wBAAwB,CAAC;YAC3B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,IAAI,oBAAoB,CAAC;gBACtC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC;SACH,CAAC,CAAC;IAET,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACpF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAiC,CAAC;QACxD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,2DAA2D;iBACrE;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,2BAA2B,CAChC,KAAK,EACL,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAC3E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAmB,EAAE,MAA+B;IACvF,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE7B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"authRoutes.js","sourceRoot":"","sources":["../../../src/host/http/authRoutes.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,OAAwB,EACxB,OAAqF;IAErF,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,KAAK,SAAS;QACjC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,wBAAwB,CAAC;YAC3B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,aAAa,EAAE,IAAI,oBAAoB,CAAC;gBACtC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC;SACH,CAAC,CAAC;IAET,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACpF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAiC,CAAC;QACxD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,2DAA2D;iBACrE;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,2BAA2B,CAChC,KAAK,EACL,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAC3E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAmB,EAAE,MAA+B;IACvF,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE7B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/projectAuthRuntimeDiagnostics.d.ts

@@ -0,0 +1,11 @@
+import type { ProjectAuthDiagnostic, ProjectAuthHealth } from './projectAuthHealth';
+export type ProjectAuthRuntimeRolloutStatus = 'ready' | 'not-ready' | 'unavailable' | 'not-generated';
+export interface ProjectAuthRuntimeDiagnostics {
+    readonly providerRedirectUrl?: string;
+    readonly appCallbackTargets: readonly string[];
+    readonly redirectAllowList: readonly string[];
+    readonly rolloutStatus: ProjectAuthRuntimeRolloutStatus;
+    readonly diagnostics?: readonly ProjectAuthDiagnostic[];
+}
+export declare function applyProjectAuthRuntimeDiagnostics(health: ProjectAuthHealth, runtime: ProjectAuthRuntimeDiagnostics): ProjectAuthHealth;
+//# sourceMappingURL=projectAuthRuntimeDiagnostics.d.ts.map

package/dist/projectAuthRuntimeDiagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectAuthRuntimeDiagnostics.d.ts","sourceRoot":"","sources":["../src/projectAuthRuntimeDiagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EAErB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,+BAA+B,GACzC,OAAO,GAAG,WAAW,GAAG,aAAa,GAAG,eAAe,CAAC;AAE1D,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,+BAA+B,CAAC;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACzD;AAED,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,6BAA6B,GACrC,iBAAiB,CA6BnB"}

package/dist/projectAuthRuntimeDiagnostics.js

@@ -0,0 +1,97 @@
+export function applyProjectAuthRuntimeDiagnostics(health, runtime) {
+    const diagnostics = [
+        ...health.diagnostics,
+        ...runtime.appCallbackTargets.map((target, index) => ({
+            code: 'app_callback_target',
+            severity: 'info',
+            message: `Enabled app callback target: ${target}`,
+            path: `infra.auth.oauth.callbackTargets[${index}]`,
+        })),
+        ...runtime.redirectAllowList.map((target, index) => ({
+            code: 'redirect_allow_list_entry',
+            severity: 'info',
+            message: `Auth redirect allowlist entry: ${target}`,
+            path: `infra.auth.oauth.redirectAllowList[${index}]`,
+        })),
+        resolveRolloutDiagnostic(runtime.rolloutStatus),
+        ...(runtime.diagnostics ?? []),
+    ];
+    const sortedDiagnostics = sortDiagnostics(uniqueDiagnostics(diagnostics));
+    return {
+        ...health,
+        status: resolveHealthStatus(sortedDiagnostics),
+        diagnostics: sortedDiagnostics,
+        callbackUrls: {
+            ...health.callbackUrls,
+            ...(runtime.providerRedirectUrl ? { providerRedirectUrl: runtime.providerRedirectUrl } : {}),
+        },
+    };
+}
+function resolveRolloutDiagnostic(status) {
+    switch (status) {
+        case 'ready':
+            return {
+                code: 'auth_runtime_ready',
+                severity: 'info',
+                message: 'The running Auth deployment reports ready.',
+                path: 'infra.auth.runtime',
+            };
+        case 'not-ready':
+            return {
+                code: 'auth_runtime_not_ready',
+                severity: 'error',
+                message: 'The running Auth deployment is not ready.',
+                path: 'infra.auth.runtime',
+            };
+        case 'not-generated':
+            return {
+                code: 'auth_runtime_not_generated',
+                severity: 'warning',
+                message: 'Auth runtime diagnostics are unavailable until infrastructure is generated.',
+                path: 'infra.auth.runtime',
+            };
+        case 'unavailable':
+            return {
+                code: 'auth_runtime_unavailable',
+                severity: 'warning',
+                message: 'The generated infrastructure could not report Auth runtime readiness.',
+                path: 'infra.auth.runtime',
+            };
+    }
+}
+function resolveHealthStatus(diagnostics) {
+    if (diagnostics.some((diagnostic) => diagnostic.severity === 'error'))
+        return 'error';
+    if (diagnostics.some((diagnostic) => diagnostic.severity === 'warning'))
+        return 'warning';
+    return 'healthy';
+}
+function sortDiagnostics(diagnostics) {
+    const severityRank = {
+        error: 0,
+        warning: 1,
+        info: 2,
+    };
+    return [...diagnostics].sort((left, right) => severityRank[left.severity] - severityRank[right.severity] ||
+        left.code.localeCompare(right.code) ||
+        (left.path ?? '').localeCompare(right.path ?? '') ||
+        (left.providerId ?? '').localeCompare(right.providerId ?? ''));
+}
+function uniqueDiagnostics(diagnostics) {
+    const seen = new Set();
+    return diagnostics.filter((diagnostic) => {
+        const key = [
+            diagnostic.code,
+            diagnostic.severity,
+            diagnostic.message,
+            diagnostic.path ?? '',
+            diagnostic.providerId ?? '',
+            diagnostic.credentialsRef ?? '',
+        ].join('\u0000');
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+//# sourceMappingURL=projectAuthRuntimeDiagnostics.js.map

package/dist/projectAuthRuntimeDiagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectAuthRuntimeDiagnostics.js","sourceRoot":"","sources":["../src/projectAuthRuntimeDiagnostics.ts"],"names":[],"mappings":"AAkBA,MAAM,UAAU,kCAAkC,CAChD,MAAyB,EACzB,OAAsC;IAEtC,MAAM,WAAW,GAAG;QAClB,GAAG,MAAM,CAAC,WAAW;QACrB,GAAG,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,MAAe;YACzB,OAAO,EAAE,gCAAgC,MAAM,EAAE;YACjD,IAAI,EAAE,oCAAoC,KAAK,GAAG;SACnD,CAAC,CAAC;QACH,GAAG,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,MAAe;YACzB,OAAO,EAAE,kCAAkC,MAAM,EAAE;YACnD,IAAI,EAAE,sCAAsC,KAAK,GAAG;SACrD,CAAC,CAAC;QACH,wBAAwB,CAAC,OAAO,CAAC,aAAa,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;KAC/B,CAAC;IACF,MAAM,iBAAiB,GAAG,eAAe,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1E,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;QAC9C,WAAW,EAAE,iBAAiB;QAC9B,YAAY,EAAE;YACZ,GAAG,MAAM,CAAC,YAAY;YACtB,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAuC;IACvE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,4CAA4C;gBACrD,IAAI,EAAE,oBAAoB;aAC3B,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,2CAA2C;gBACpD,IAAI,EAAE,oBAAoB;aAC3B,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,IAAI,EAAE,4BAA4B;gBAClC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,6EAA6E;gBACtF,IAAI,EAAE,oBAAoB;aAC3B,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO;gBACL,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,uEAAuE;gBAChF,IAAI,EAAE,oBAAoB;aAC3B,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAA6C;IAE7C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACtF,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CACtB,WAA6C;IAE7C,MAAM,YAAY,GAAkD;QAClE,KAAK,EAAE,CAAC;QACR,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,CAAC;KACR,CAAC;IAEF,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QACnC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QACjD,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,WAA6C;IAE7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG;YACV,UAAU,CAAC,IAAI;YACf,UAAU,CAAC,QAAQ;YACnB,UAAU,CAAC,OAAO;YAClB,UAAU,CAAC,IAAI,IAAI,EAAE;YACrB,UAAU,CAAC,UAAU,IAAI,EAAE;YAC3B,UAAU,CAAC,cAAc,IAAI,EAAE;SAChC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/studio",
-  "version": "0.11.9",
+  "version": "0.11.10",
   "description": "Studio authoring package for Ankhorage apps",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/studio#readme",
@@ -231,7 +231,7 @@
     "@ankhorage/color-theory": "^0.0.8",
     "@ankhorage/contracts": "^4.0.1",
     "@ankhorage/expo-runtime": "^0.0.11",
-    "@ankhorage/infra": "^1.0.6",
+    "@ankhorage/infra": "^1.1.0",
     "@ankhorage/orchestrator": "^0.2.4",
     "@ankhorage/orchestrator-module-expo-google-fonts": "^0.1.2",
     "@ankhorage/orchestrator-module-expo-localization": "^0.1.5",