@ankhorage/infra 4.0.0 → 4.1.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ankhorage/infra
 
+## 4.1.1
+
+### Patch Changes
+
+- 591cecb: Derive Minikube app runtime resources and canonical forward groups from enabled app deployment targets, reconcile obsolete Web runtime resources and owned forwards during native-only upgrades, and retry transient post-restart forwarding failures so native apps can recover provider endpoints without a nonexistent app Service.
+
+## 4.1.0
+
+### Minor Changes
+
+- 66ef9aa: Add a provider-aware runtime port-forward lifecycle and export `ensureProjectInfrastructureRuntime` from `@ankhorage/infra/project`.
+
 ## 4.0.0
 
 ### Major Changes

package/README.md

@@ -3,7 +3,7 @@
 
 # INFRA
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v3.3.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v4.0.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Executable infra provider and standalone CLI for Ankhorage project workflows.
 
@@ -37,6 +37,11 @@ omit it when cwd is already inside `apps/<project>`. Programmatic project
 operations accept an explicit project path and do not require Studio or a
 particular workspace layout.
 
+Running applications can repair their provider-aware host endpoints through
+`ensureProjectInfrastructureRuntime()` from `@ankhorage/infra/project`. This
+operation only ensures the generated runtime port-forward group; it does not
+deploy, bootstrap, or reconcile infrastructure.
+
 Source: `src/readme-usage.ts`
 
 ```ts

package/dist/adapters/minikube/base/index.d.ts

@@ -5,6 +5,7 @@ export declare const APP_NAMESPACE = "app";
 export declare function generateMinikubeBaseArtifacts(args: {
     manifest: InfraManifestInput;
     appSlug: string;
+    appRuntimeEnabled: boolean;
     extraResources: string[];
     providerNamespaces: string[];
     providerLifecycle: MinikubeProviderLifecycle[];

package/dist/adapters/minikube/base/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAG9D,eAAO,MAAM,aAAa,QAAQ,CAAC;AAoDnC,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,2BAA2B,EAAE,CAoLhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAG9D,eAAO,MAAM,aAAa,QAAQ,CAAC;AAoDnC,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,2BAA2B,EAAE,CA8LhC"}

package/dist/adapters/minikube/base/index.js

@@ -18,7 +18,7 @@ const PORT_BUCKET_SIZE = 20;
 const PORT_BUCKET_COUNT = 1000;
 const PORT_REFERENCE_SLUG = 'my-app';
 export function generateMinikubeBaseArtifacts(args) {
-    const { manifest, appSlug, extraResources, providerNamespaces, providerLifecycle, extraEnvEntries, } = args;
+    const { manifest, appSlug, appRuntimeEnabled, extraResources, providerNamespaces, providerLifecycle, extraEnvEntries, } = args;
     const root = 'infra/minikube';
     const k8sRoot = `${root}/k8s`;
     const scriptsRoot = `${root}/scripts`;
@@ -50,6 +50,7 @@ export function generateMinikubeBaseArtifacts(args) {
             path: `${root}/README.md`,
             content: getReadmeMarkdown({
                 appSlug,
+                appRuntimeEnabled,
                 defaultAppImage,
                 monitoringEnabled,
                 authProvider,
@@ -91,32 +92,37 @@ export function generateMinikubeBaseArtifacts(args) {
             path: `${k8sRoot}/namespaces/${namespace}.yaml`,
             content: getNamespaceManifest(namespace),
         })),
-        {
-            path: `${k8sRoot}/app.configmap.yaml`,
-            content: getAppConfigMap({
-                appSlug,
-                authScope,
-                authProvider,
-                databaseProvider,
-                secretStoreProvider,
-                storageMetadata,
-                monitoringEnabled,
-                domain,
-            }),
-        },
-        {
-            path: `${k8sRoot}/app/deployment.yaml`,
-            content: getAppDeploymentManifest(defaultAppImage),
-        },
-        {
-            path: `${k8sRoot}/app/service.yaml`,
-            content: getAppServiceManifest(),
-        },
+        ...(appRuntimeEnabled
+            ? [
+                {
+                    path: `${k8sRoot}/app.configmap.yaml`,
+                    content: getAppConfigMap({
+                        appSlug,
+                        authScope,
+                        authProvider,
+                        databaseProvider,
+                        secretStoreProvider,
+                        storageMetadata,
+                        monitoringEnabled,
+                        domain,
+                    }),
+                },
+                {
+                    path: `${k8sRoot}/app/deployment.yaml`,
+                    content: getAppDeploymentManifest(defaultAppImage),
+                },
+                {
+                    path: `${k8sRoot}/app/service.yaml`,
+                    content: getAppServiceManifest(),
+                },
+            ]
+            : []),
         ...supabaseResources,
         {
             path: `${k8sRoot}/kustomization.yaml`,
             content: getKustomizationManifest({
                 namespaceResources,
+                appRuntimeEnabled,
                 supabaseEnabled: supabaseKubernetesEnabled,
                 extraResources,
             }),
@@ -125,6 +131,7 @@ export function generateMinikubeBaseArtifacts(args) {
             path: `${scriptsRoot}/up.sh`,
             content: getUpScript({
                 appSlug,
+                appRuntimeEnabled,
                 defaultAppImage,
                 supabaseKubernetesEnabled,
                 profileModel,
@@ -144,6 +151,7 @@ export function generateMinikubeBaseArtifacts(args) {
             path: `${scriptsRoot}/port-forward.sh`,
             content: getPortForwardScript({
                 appSlug,
+                appRuntimeEnabled,
                 supabaseKubernetesEnabled,
                 supabaseHostPorts,
             }),
@@ -172,6 +180,7 @@ export function generateMinikubeBaseArtifacts(args) {
             path: `${scriptsRoot}/status.sh`,
             content: getStatusScript({
                 appSlug,
+                appRuntimeEnabled,
                 supabaseKubernetesEnabled,
                 profileModel,
                 supabaseHostPorts,
@@ -187,14 +196,12 @@ export function generateMinikubeBaseArtifacts(args) {
     ];
 }
 function getReadmeMarkdown(args) {
-    const { appSlug, defaultAppImage, monitoringEnabled, authProvider, authzEngine, extraResources, supabaseHostPorts, supabaseKubernetesEnabled, profileModel, oauthProviders, providerNamespaces, providerLifecycle, } = args;
+    const { appSlug, appRuntimeEnabled, defaultAppImage, monitoringEnabled, authProvider, authzEngine, extraResources, supabaseHostPorts, supabaseKubernetesEnabled, profileModel, oauthProviders, providerNamespaces, providerLifecycle, } = args;
     const resourceLines = [
         'namespaces/app.yaml',
         ...(supabaseKubernetesEnabled ? ['namespaces/supabase.yaml'] : []),
         ...providerNamespaces.map((namespace) => `namespaces/${namespace}.yaml`),
-        'app.configmap.yaml',
-        'app/deployment.yaml',
-        'app/service.yaml',
+        ...(appRuntimeEnabled ? ['app.configmap.yaml', 'app/deployment.yaml', 'app/service.yaml'] : []),
         ...(supabaseKubernetesEnabled
             ? [
                 'supabase/bootstrap.sql',
@@ -248,6 +255,13 @@ function getReadmeMarkdown(args) {
     const oauthDescription = oauthProviders.length > 0
         ? `\nConfigured OAuth providers are wired into GoTrue through generated \`GOTRUE_EXTERNAL_*\` runtime keys. The keys are named in \`.env.example\`; values must come from trusted secret resolution for the configured \`credentialsRef\` entries.\n`
         : '';
+    const runtimeForwardDescription = appRuntimeEnabled
+        ? supabaseKubernetesEnabled
+            ? '`app` and `supabase-gateway`'
+            : '`app`'
+        : supabaseKubernetesEnabled
+            ? '`supabase-gateway`'
+            : 'no host endpoints';
     return `# Minikube Infra
 
 This directory is generated from \`ankh.config.json\` (infra manifest).
@@ -255,7 +269,7 @@ This directory is generated from \`ankh.config.json\` (infra manifest).
 ## Ownership Model
 
 - App slug / Minikube profile: \`${appSlug}\`
-- App runtime namespace: \`${APP_NAMESPACE}\`
+- App runtime: \`${appRuntimeEnabled ? `deployment/app-runtime in namespace ${APP_NAMESPACE}` : 'disabled (no enabled Web deploy target)'}\`
 - Supabase namespace: \`${supabaseKubernetesEnabled ? SUPABASE_NAMESPACE : 'unused'}\`
 ${providerNamespaceLine}- Default app image: \`${defaultAppImage}\`
 
@@ -285,11 +299,18 @@ host-level Supabase Compose runtime.
 
 ## Lifecycle Semantics
 
-- \`up.sh\`: starts \`minikube -p ${appSlug}\`, deploys provider namespaces, runs migrations with CLI telemetry disabled for that command, starts slug-owned port-forwards, and deploys the app runtime.
+- \`up.sh\`: starts \`minikube -p ${appSlug}\`, deploys provider namespaces, runs migrations with CLI telemetry disabled for that command, starts slug-owned port-forwards${appRuntimeEnabled ? ', and deploys the Web app runtime' : ''}.
 - \`down.sh\`: stops slug-owned port-forwards, then stops \`minikube -p ${appSlug}\`. Persistent data remains in the profile.
 - \`reset.sh\`: requires \`ANKH_RESET_CONFIRM=${appSlug}\`; ${resetDescription}. It does not delete the Minikube profile.
 - \`destroy.sh\`: deletes only \`minikube -p ${appSlug}\`.
 
+### Port-forward groups
+
+- \`./scripts/port-forward.sh start runtime\` idempotently ensures ${runtimeForwardDescription}, the generated host endpoints required by the running application. The same group supports \`stop\` and \`status\`.
+- \`runtime\` excludes \`studio\` and \`db-migration\`, which are operational/bootstrap endpoints.
+- \`all\` retains every generated forward, including operational/bootstrap endpoints.
+- Concrete targets remain available for individual lifecycle control.
+
 ## Generated Resources
 
 ${resourceLines}
@@ -324,8 +345,7 @@ Pinned images:
 
 ## Host URLs
 
-- App: \`http://127.0.0.1:${supabaseHostPorts.app}\`
-- Supabase gateway: \`http://127.0.0.1:${supabaseHostPorts.gateway}\`
+${appRuntimeEnabled ? `- App: \`http://127.0.0.1:${supabaseHostPorts.app}\`\n` : ''}- Supabase gateway: \`http://127.0.0.1:${supabaseHostPorts.gateway}\`
 - Studio: \`http://127.0.0.1:${supabaseHostPorts.studio}\`
 - DB migration endpoint: \`127.0.0.1:${supabaseHostPorts.db}\`
 
@@ -741,9 +761,9 @@ function getKustomizationManifest(args) {
         : [];
     const resources = [
         ...args.namespaceResources,
-        'app.configmap.yaml',
-        'app/deployment.yaml',
-        'app/service.yaml',
+        ...(args.appRuntimeEnabled
+            ? ['app.configmap.yaml', 'app/deployment.yaml', 'app/service.yaml']
+            : []),
         ...supabaseResources,
         ...args.extraResources,
     ];
@@ -1997,7 +2017,7 @@ spec:
 `;
 }
 function getUpScript(args) {
-    const { appSlug, defaultAppImage, supabaseKubernetesEnabled, profileModel, secretStoreProvider, supabaseHostPorts, oauthProviders, providerLifecycle, } = args;
+    const { appSlug, appRuntimeEnabled, defaultAppImage, supabaseKubernetesEnabled, profileModel, secretStoreProvider, supabaseHostPorts, oauthProviders, providerLifecycle, } = args;
     const oauthEnvDefaults = getOAuthScriptEnvDefaults(oauthProviders);
     const oauthRuntimeSecretLines = getOAuthRuntimeSecretLines(oauthProviders);
     const oauthValidation = getOAuthRuntimeValidationScript(oauthProviders);
@@ -2009,6 +2029,14 @@ function getUpScript(args) {
         secretStoreProvider,
     });
     const supabaseMigrationCommand = getSupabaseMigrationCommandScript();
+    const disabledAppRuntimeReconciliation = appRuntimeEnabled
+        ? ''
+        : `reconcile_disabled_app_runtime() {
+  kubectl --context "\${PROFILE}" -n "\${APP_NAMESPACE}" delete deployment/app-runtime service/app-runtime configmap/app-infra-config --ignore-not-found
+  "\${PORT_FORWARD_SCRIPT}" stop obsolete
+}
+`;
+    const reconcileDisabledAppRuntime = appRuntimeEnabled ? '' : 'reconcile_disabled_app_runtime';
     return `#!/usr/bin/env bash
 set -Eeuo pipefail
 
@@ -2023,6 +2051,7 @@ DRIVER="\${MINIKUBE_DRIVER:-}"
 APP_NAMESPACE="${APP_NAMESPACE}"
 SUPABASE_NAMESPACE="${SUPABASE_NAMESPACE}"
 SUPABASE_RUNTIME_ENABLED="${supabaseKubernetesEnabled ? 'true' : 'false'}"
+APP_RUNTIME_ENABLED="${appRuntimeEnabled ? 'true' : 'false'}"
 APP_BUILD_ENABLED="\${APP_BUILD_ENABLED:-}"
 APP_SOURCE_DIR="\${APP_SOURCE_DIR:-}"
 APP_WEB_EXPORT_DIR="\${APP_WEB_EXPORT_DIR:-}"
@@ -2453,6 +2482,7 @@ apply_namespace_manifests() {
   done
 }
 
+${disabledAppRuntimeReconciliation}
 ${providerLifecycleStageScripts}
 
 load_env_file_preserving_process_env
@@ -2526,7 +2556,7 @@ else
   kubectl --context "\${PROFILE}" apply -k "\${K8S_DIR}"
 fi
 
-if [[ "\${APP_BUILD_ENABLED}" == "true" ]]; then
+if [[ "\${APP_RUNTIME_ENABLED}" == "true" && "\${APP_BUILD_ENABLED}" == "true" ]]; then
   if [[ ! -x "\${BUILD_SCRIPT}" ]]; then
     echo "Missing build helper script: \${BUILD_SCRIPT}"
     exit 1
@@ -2541,6 +2571,7 @@ else
   EXPORT_DIR="\${APP_SOURCE_DIR}/\${APP_WEB_EXPORT_DIR}"
 fi
 
+if [[ "\${APP_RUNTIME_ENABLED}" == "true" ]]; then
 case "\${APP_IMAGE_SYNC_STRATEGY}" in
   minikube-build)
     if [[ ! -f "\${EXPORT_DIR}/index.html" ]]; then
@@ -2562,15 +2593,18 @@ case "\${APP_IMAGE_SYNC_STRATEGY}" in
     exit 1
     ;;
 esac
+fi
 
 if [[ "\${SUPABASE_RUNTIME_ENABLED}" == "true" ]]; then
   kubectl --context "\${PROFILE}" apply -k "\${K8S_DIR}"
 fi
 
+${reconcileDisabledAppRuntime}
 wait_for_provider_readiness
 run_provider_migrations
 run_provider_reconciliation
 
+if [[ "\${APP_RUNTIME_ENABLED}" == "true" ]]; then
 if [[ -n "\${APP_IMAGE_PULL_SECRET_NAME}" ]]; then
   if [[ -z "\${APP_IMAGE_PULL_SECRET_USERNAME}" || -z "\${APP_IMAGE_PULL_SECRET_PASSWORD}" ]]; then
     echo "APP_IMAGE_PULL_SECRET_NAME is set, but username/password are missing."
@@ -2602,6 +2636,7 @@ fi
 
 kubectl --context "\${PROFILE}" -n "\${APP_NAMESPACE}" rollout status deployment/app-runtime --timeout=180s >/dev/null
 "\${PORT_FORWARD_SCRIPT}" start app >/dev/null
+fi
 
 trap - ERR
 echo "Minikube infrastructure for '\${PROFILE}' is running."
@@ -2710,7 +2745,37 @@ CMD ["nginx", "-g", "daemon off;"]
 `;
 }
 function getPortForwardScript(args) {
-    const { appSlug, supabaseKubernetesEnabled, supabaseHostPorts } = args;
+    const { appSlug, appRuntimeEnabled, supabaseKubernetesEnabled, supabaseHostPorts } = args;
+    const runtimeForwardNames = [
+        ...(appRuntimeEnabled ? ['app'] : []),
+        ...(supabaseKubernetesEnabled ? ['supabase-gateway'] : []),
+    ];
+    const allForwardNames = [
+        ...runtimeForwardNames,
+        ...(supabaseKubernetesEnabled ? ['studio', 'db-migration'] : []),
+    ];
+    const managedForwardNames = ['app', 'supabase-gateway', 'studio', 'db-migration'];
+    const obsoleteForwardNames = managedForwardNames.filter((name) => !allForwardNames.includes(name));
+    const appTargetCase = `    app)
+      echo "${APP_NAMESPACE} service/app-runtime \${APP_PORT_FORWARD_LOCAL_PORT} \${APP_PORT_FORWARD_REMOTE_PORT}"
+      ;;`;
+    const supabaseTargetCases = `    supabase-gateway)
+      echo "${SUPABASE_NAMESPACE} service/gateway \${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT} \${SUPABASE_GATEWAY_FORWARD_REMOTE_PORT}"
+      ;;
+    studio)
+      echo "${SUPABASE_NAMESPACE} service/studio \${SUPABASE_STUDIO_FORWARD_LOCAL_PORT} \${SUPABASE_STUDIO_FORWARD_REMOTE_PORT}"
+      ;;
+    db-migration)
+      echo "${SUPABASE_NAMESPACE} service/postgres \${SUPABASE_DB_FORWARD_LOCAL_PORT} \${SUPABASE_DB_FORWARD_REMOTE_PORT}"
+      ;;`;
+    const concreteForwardNames = [
+        ...(appRuntimeEnabled ? ['app'] : []),
+        ...(supabaseKubernetesEnabled ? ['supabase-gateway', 'studio', 'db-migration'] : []),
+    ];
+    const forwardUsage = [...concreteForwardNames, 'runtime', 'all'].join('|');
+    const forwardNamesDescription = concreteForwardNames.length > 0
+        ? `${concreteForwardNames.join(', ')}, runtime, or all`
+        : 'runtime or all';
     return `#!/usr/bin/env bash
 set -euo pipefail
 
@@ -2720,6 +2785,7 @@ STATE_DIR="\${ROOT_DIR}/.state/forwards"
 APP_SLUG="${appSlug}"
 PROFILE="\${ANKH_APP_SLUG:-${appSlug}}"
 SUPABASE_RUNTIME_ENABLED="${supabaseKubernetesEnabled ? 'true' : 'false'}"
+APP_RUNTIME_ENABLED="${appRuntimeEnabled ? 'true' : 'false'}"
 APP_PORT_FORWARD_LOCAL_PORT="\${APP_PORT_FORWARD_LOCAL_PORT:-${supabaseHostPorts.app}}"
 APP_PORT_FORWARD_REMOTE_PORT="\${APP_PORT_FORWARD_REMOTE_PORT:-80}"
 SUPABASE_GATEWAY_FORWARD_LOCAL_PORT="\${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT:-${supabaseHostPorts.gateway}}"
@@ -2728,6 +2794,10 @@ SUPABASE_STUDIO_FORWARD_LOCAL_PORT="\${SUPABASE_STUDIO_FORWARD_LOCAL_PORT:-${sup
 SUPABASE_STUDIO_FORWARD_REMOTE_PORT="\${SUPABASE_STUDIO_FORWARD_REMOTE_PORT:-3000}"
 SUPABASE_DB_FORWARD_LOCAL_PORT="\${SUPABASE_DB_FORWARD_LOCAL_PORT:-${supabaseHostPorts.db}}"
 SUPABASE_DB_FORWARD_REMOTE_PORT="\${SUPABASE_DB_FORWARD_REMOTE_PORT:-5432}"
+RUNTIME_FORWARD_NAMES=(${runtimeForwardNames.join(' ')})
+ALL_FORWARD_NAMES=(${allForwardNames.join(' ')})
+MANAGED_FORWARD_NAMES=(${managedForwardNames.join(' ')})
+OBSOLETE_FORWARD_NAMES=(${obsoleteForwardNames.join(' ')})
 
 if [[ -f "\${ROOT_DIR}/.env" ]]; then
   set -a
@@ -2736,6 +2806,7 @@ if [[ -f "\${ROOT_DIR}/.env" ]]; then
   set +a
 fi
 SUPABASE_RUNTIME_ENABLED="${supabaseKubernetesEnabled ? 'true' : 'false'}"
+APP_RUNTIME_ENABLED="${appRuntimeEnabled ? 'true' : 'false'}"
 
 if [[ "\${PROFILE}" != "\${APP_SLUG}" ]]; then
   echo "ANKH_APP_SLUG must remain the generated canonical slug '\${APP_SLUG}' for this infra directory."
@@ -2755,20 +2826,10 @@ pid_file_for() {
 
 target_for() {
   case "\${1}" in
-    app)
-      echo "${APP_NAMESPACE} service/app-runtime \${APP_PORT_FORWARD_LOCAL_PORT} \${APP_PORT_FORWARD_REMOTE_PORT}"
-      ;;
-    supabase-gateway)
-      echo "${SUPABASE_NAMESPACE} service/gateway \${SUPABASE_GATEWAY_FORWARD_LOCAL_PORT} \${SUPABASE_GATEWAY_FORWARD_REMOTE_PORT}"
-      ;;
-    studio)
-      echo "${SUPABASE_NAMESPACE} service/studio \${SUPABASE_STUDIO_FORWARD_LOCAL_PORT} \${SUPABASE_STUDIO_FORWARD_REMOTE_PORT}"
-      ;;
-    db-migration)
-      echo "${SUPABASE_NAMESPACE} service/postgres \${SUPABASE_DB_FORWARD_LOCAL_PORT} \${SUPABASE_DB_FORWARD_REMOTE_PORT}"
-      ;;
+${appTargetCase}
+${supabaseTargetCases}
     *)
-      echo "Unknown forward '\${1}'. Use app, supabase-gateway, studio, db-migration, or all." >&2
+      echo "Unknown forward '\${1}'. Use ${forwardNamesDescription}." >&2
       return 1
       ;;
   esac
@@ -2904,6 +2965,11 @@ start_forward() {
   pid_file="$(pid_file_for "\${name}")"
   read -r namespace resource local_port remote_port <<<"$(target_for "\${name}")"
 
+  if [[ "\${name}" == "app" && "\${APP_RUNTIME_ENABLED}" != "true" ]]; then
+    echo "\${name}: skipped (Web app runtime disabled)"
+    return 0
+  fi
+
   if [[ -f "\${pid_file}" ]]; then
     local existing_pid
     existing_pid="$(cat "\${pid_file}")"
@@ -2933,28 +2999,52 @@ start_forward() {
     return 1
   fi
 
-  nohup kubectl --context "\${PROFILE}" -n "\${namespace}" port-forward "\${resource}" "\${local_port}:\${remote_port}" >"\${STATE_DIR}/\${PROFILE}-\${name}.log" 2>&1 &
-  local pid="$!"
-  echo "\${pid}" > "\${pid_file}"
+  for start_attempt in {1..5}; do
+    nohup kubectl --context "\${PROFILE}" -n "\${namespace}" port-forward "\${resource}" "\${local_port}:\${remote_port}" >"\${STATE_DIR}/\${PROFILE}-\${name}.log" 2>&1 &
+    local pid="$!"
+    echo "\${pid}" > "\${pid_file}"
 
-  for attempt in {1..40}; do
-    if ! is_pid_running "\${pid}"; then
-      echo "\${name}: failed to start local port \${local_port} for \${namespace}/\${resource}:\${remote_port}"
-      print_forward_log_tail "\${name}"
+    for readiness_attempt in {1..20}; do
+      if ! is_pid_running "\${pid}"; then
+        rm -f "\${pid_file}"
+        if [[ "\${start_attempt}" -lt 5 ]]; then
+          echo "\${name}: port-forward attempt \${start_attempt} exited before readiness; retrying"
+          sleep 2
+          break
+        fi
+
+        echo "\${name}: failed to start local port \${local_port} for \${namespace}/\${resource}:\${remote_port} after \${start_attempt} attempts"
+        print_forward_log_tail "\${name}"
+        return 1
+      fi
+      if is_port_accepting "\${local_port}"; then
+        sleep 1
+        if is_pid_running "\${pid}" && is_port_accepting "\${local_port}"; then
+          sleep 0.5
+          if is_pid_running "\${pid}"; then
+            echo "\${name}: started (pid \${pid}, local port \${local_port})"
+            return 0
+          fi
+        fi
+      fi
+      sleep 0.5
+    done
+
+    if [[ -f "\${pid_file}" ]]; then
+      terminate_forward_process "\${name}" "\${pid}" "\${namespace}" "\${resource}" "\${local_port}" "\${remote_port}" || return 1
       rm -f "\${pid_file}"
-      return 1
-    fi
-    if is_port_accepting "\${local_port}"; then
-      echo "\${name}: started (pid \${pid}, local port \${local_port})"
-      return 0
+
+      if [[ "\${start_attempt}" -lt 5 ]]; then
+        echo "\${name}: port-forward attempt \${start_attempt} did not become ready; retrying"
+        sleep 2
+      else
+        echo "\${name}: did not become ready on local port \${local_port} for \${namespace}/\${resource}:\${remote_port} after \${start_attempt} attempts"
+        print_forward_log_tail "\${name}"
+        return 1
+      fi
     fi
-    sleep 0.5
   done
 
-  echo "\${name}: did not become ready on local port \${local_port} for \${namespace}/\${resource}:\${remote_port}"
-  print_forward_log_tail "\${name}"
-  terminate_forward_process "\${name}" "\${pid}" "\${namespace}" "\${resource}" "\${local_port}" "\${remote_port}" || return 1
-  rm -f "\${pid_file}"
   return 1
 }
 
@@ -3013,26 +3103,34 @@ status_forward() {
 
 for_each_forward() {
   local action="\${1}"
-  "\${action}_forward" app
-  if [[ "\${SUPABASE_RUNTIME_ENABLED}" == "true" ]]; then
-    "\${action}_forward" supabase-gateway
-    "\${action}_forward" studio
-    "\${action}_forward" db-migration
-  fi
+  shift
+  local name
+  while [[ "\${#}" -gt 0 ]]; do
+    name="\${1}"
+    shift
+    "\${action}_forward" "\${name}"
+  done
 }
 
 ACTION="\${1:-start}"
 NAME="\${2:-all}"
 
 case "\${ACTION}:\${NAME}" in
-  start:all) for_each_forward start ;;
-  stop:all) for_each_forward stop ;;
-  status:all) for_each_forward status ;;
+  start:runtime) for_each_forward start ${runtimeForwardNames.join(' ')} ;;
+  stop:runtime)
+    for_each_forward stop ${runtimeForwardNames.join(' ')}
+    for_each_forward stop ${obsoleteForwardNames.join(' ')}
+    ;;
+  status:runtime) for_each_forward status ${runtimeForwardNames.join(' ')} ;;
+  start:all) for_each_forward start ${allForwardNames.join(' ')} ;;
+  stop:all) for_each_forward stop ${managedForwardNames.join(' ')} ;;
+  status:all) for_each_forward status ${allForwardNames.join(' ')} ;;
+  stop:obsolete) for_each_forward stop ${obsoleteForwardNames.join(' ')} ;;
   start:*) start_forward "\${NAME}" ;;
   stop:*) stop_forward "\${NAME}" ;;
   status:*) status_forward "\${NAME}" ;;
   *)
-    echo "Usage: ./scripts/port-forward.sh {start|stop|status} {app|supabase-gateway|studio|db-migration|all}"
+    echo "Usage: ./scripts/port-forward.sh {start|stop|status} {${forwardUsage}}"
     exit 1
     ;;
 esac
@@ -3150,7 +3248,7 @@ echo "Deleted Minikube profile '\${PROFILE}'."
 `;
 }
 function getStatusScript(args) {
-    const { appSlug, supabaseKubernetesEnabled, profileModel, supabaseHostPorts, providerNamespaces, providerLifecycle, } = args;
+    const { appSlug, appRuntimeEnabled, supabaseKubernetesEnabled, profileModel, supabaseHostPorts, providerNamespaces, providerLifecycle, } = args;
     const namespaces = [
         APP_NAMESPACE,
         ...(supabaseKubernetesEnabled ? [SUPABASE_NAMESPACE] : []),
@@ -3228,7 +3326,7 @@ for namespace in ${namespaces}; do
   fi
 done
 
-if kubectl --context "\${PROFILE}" -n ${APP_NAMESPACE} get deployment app-runtime >/dev/null 2>&1; then
+if [[ "${appRuntimeEnabled ? 'true' : 'false'}" == "true" ]] && kubectl --context "\${PROFILE}" -n ${APP_NAMESPACE} get deployment app-runtime >/dev/null 2>&1; then
   kubectl --context "\${PROFILE}" -n ${APP_NAMESPACE} rollout status deployment/app-runtime --timeout=5s >/dev/null 2>&1 && echo "- app-runtime: ready" || echo "- app-runtime: not ready"
 fi