@ankhorage/infra 4.0.0 → 4.1.1

package/src/adapters/minikube/base/twoAppIsolation.integration.test.ts

@@ -7,6 +7,7 @@ import { promisify } from 'node:util';
 import { describe, expect, test } from 'bun:test';
 
 import { generateInfrastructure } from '../../../index';
+import { ensureProjectInfrastructureRuntime } from '../../../project/index';
 import { createAppManifest } from '../../../testSupport';
 import type { GeneratedInfrastructureFile, InfraManifestInput } from '../../../types';
 
@@ -16,14 +17,22 @@ const supabaseIsolationTest =
   process.env.ANKH_MINIKUBE_SUPABASE_ISOLATION === '1' ? test : test.skip;
 const TEST_TIMEOUT_MS = 1_800_000;
 const HTTP_TIMEOUT_MS = 60_000;
+const DIAGNOSTIC_TIMEOUT_MS = 60_000;
+const DIAGNOSTIC_OUTPUT_LIMIT = 20_000;
+const APP_ONLY_TEST_PROFILES = ['ankh-isolation-a', 'ankh-isolation-b'] as const;
+const SUPABASE_TEST_PROFILES = ['ankh-isolation-supa-a', 'ankh-isolation-supa-b'] as const;
+type TestOwnedMinikubeProfile =
+  | (typeof APP_ONLY_TEST_PROFILES)[number]
+  | (typeof SUPABASE_TEST_PROFILES)[number];
 
 describe('generated Minikube two-app isolation', () => {
   isolationTest(
     'runs two generated app profiles without sharing cluster resources',
     async () => {
+      await deleteTestOwnedMinikubeProfiles(APP_ONLY_TEST_PROFILES);
       const root = await mkdtemp(path.join(process.cwd(), '.tmp-minikube-isolation-'));
-      const first = await createGeneratedApp(root, 'ankh-isolation-a', 18181);
-      const second = await createGeneratedApp(root, 'ankh-isolation-b', 18182);
+      const first = await createGeneratedApp(root, APP_ONLY_TEST_PROFILES[0], 18181);
+      const second = await createGeneratedApp(root, APP_ONLY_TEST_PROFILES[1], 18182);
 
       try {
         await runScript(first.minikubeRoot, 'up.sh');
@@ -56,16 +65,18 @@ describe('generated Minikube two-app isolation', () => {
   supabaseIsolationTest(
     'runs two generated Supabase-backed profiles without shared runtime state',
     async () => {
+      await deleteTestOwnedMinikubeProfiles(SUPABASE_TEST_PROFILES);
       const root = await mkdtemp(path.join(process.cwd(), '.tmp-minikube-supabase-isolation-'));
       const [firstPorts, secondPorts] = await reserveSupabaseHostPortSets(2);
       if (!firstPorts || !secondPorts) {
         throw new Error('Expected two reserved Supabase host port sets.');
       }
-      const first = await createGeneratedSupabaseApp(root, 'ankh-isolation-supa-a', firstPorts);
-      const second = await createGeneratedSupabaseApp(root, 'ankh-isolation-supa-b', secondPorts);
+      const first = await createGeneratedSupabaseApp(root, SUPABASE_TEST_PROFILES[0], firstPorts);
+      const second = await createGeneratedSupabaseApp(root, SUPABASE_TEST_PROFILES[1], secondPorts);
 
       try {
         await runScript(first.minikubeRoot, 'up.sh');
+        await prepareSecondSupabaseProfile(first.slug, second.slug, root);
         await runScript(second.minikubeRoot, 'up.sh');
 
         await expectProfileOwnsAppNamespace(first.slug);
@@ -75,6 +86,7 @@ describe('generated Minikube two-app isolation', () => {
         await expectNoHostSupabaseComposeContainersFor(first.slug, second.slug);
 
         await expectSupabaseEndToEnd(first);
+        await expectRuntimePortForwardRecovery(first);
         const secondSession = await expectSupabaseEndToEnd(second);
 
         await runScript(second.minikubeRoot, 'down.sh');
@@ -97,6 +109,14 @@ describe('generated Minikube two-app isolation', () => {
   );
 });
 
+async function deleteTestOwnedMinikubeProfiles(
+  profiles: readonly TestOwnedMinikubeProfile[],
+): Promise<void> {
+  for (const profile of profiles) {
+    await execFile('minikube', ['delete', '-p', profile], { timeout: TEST_TIMEOUT_MS });
+  }
+}
+
 async function createGeneratedApp(root: string, slug: string, appPort: number) {
   const appRoot = path.join(root, slug);
   const minikubeRoot = path.join(appRoot, 'infra', 'minikube');
@@ -305,11 +325,182 @@ async function writeGeneratedFiles(
 }
 
 async function runScript(minikubeRoot: string, scriptName: string) {
-  return execFile(path.join(minikubeRoot, 'scripts', scriptName), {
-    cwd: minikubeRoot,
-    env: process.env,
-    timeout: TEST_TIMEOUT_MS,
-  });
+  try {
+    return await execFile(path.join(minikubeRoot, 'scripts', scriptName), {
+      cwd: minikubeRoot,
+      env: process.env,
+      timeout: TEST_TIMEOUT_MS,
+    });
+  } catch (error) {
+    if (scriptName !== 'up.sh') throw error;
+    const diagnostics = await collectFailedUpDiagnostics(minikubeRoot);
+    throw new Error(
+      `Generated ${scriptName} failed:\n${formatUnknownError(error)}\n\n${diagnostics}`,
+      { cause: error },
+    );
+  }
+}
+
+async function prepareSecondSupabaseProfile(
+  sourceProfile: string,
+  targetProfile: string,
+  scratchRoot: string,
+): Promise<void> {
+  const imagesResult = await execFile(
+    'kubectl',
+    [
+      '--context',
+      sourceProfile,
+      '-n',
+      'supabase',
+      'get',
+      'deployments',
+      '-o',
+      'jsonpath={range .items[*].spec.template.spec.containers[*]}{.image}{"\\n"}{end}',
+    ],
+    { timeout: DIAGNOSTIC_TIMEOUT_MS },
+  );
+  const images = [
+    ...new Set(imagesResult.stdout.split(/\r?\n/u).map((image) => image.trim())),
+  ].filter(Boolean);
+  if (images.length === 0) {
+    throw new Error(`Expected Supabase runtime images in profile ${sourceProfile}.`);
+  }
+
+  await execFile(
+    'minikube',
+    ['start', '-p', targetProfile, `--driver=${process.env.MINIKUBE_DRIVER ?? 'docker'}`],
+    { timeout: TEST_TIMEOUT_MS },
+  );
+
+  const imageArchive = path.join(scratchRoot, 'supabase-image-transfer.tar');
+  try {
+    for (const image of images) {
+      await execFile('minikube', ['-p', sourceProfile, 'image', 'save', image, imageArchive], {
+        timeout: TEST_TIMEOUT_MS,
+      });
+      await execFile('minikube', ['-p', targetProfile, 'image', 'load', imageArchive], {
+        timeout: TEST_TIMEOUT_MS,
+      });
+      await rm(imageArchive, { force: true });
+    }
+  } finally {
+    await rm(imageArchive, { force: true });
+  }
+}
+
+async function collectFailedUpDiagnostics(minikubeRoot: string): Promise<string> {
+  let profile: string;
+  try {
+    profile = readRequiredEnv(await readGeneratedEnv(minikubeRoot), 'ANKH_APP_SLUG');
+  } catch (error) {
+    return `Unable to determine the failed Minikube profile: ${formatUnknownError(error)}`;
+  }
+
+  const commands: readonly DiagnosticCommand[] = [
+    {
+      label: 'Minikube status',
+      command: 'minikube',
+      args: ['-p', profile, 'status'],
+    },
+    {
+      label: 'Supabase pods',
+      command: 'kubectl',
+      args: ['--context', profile, '-n', 'supabase', 'get', 'pods', '-o', 'wide'],
+    },
+    {
+      label: 'Postgres deployment',
+      command: 'kubectl',
+      args: ['--context', profile, '-n', 'supabase', 'describe', 'deployment', 'postgres'],
+    },
+    {
+      label: 'Postgres pod',
+      command: 'kubectl',
+      args: [
+        '--context',
+        profile,
+        '-n',
+        'supabase',
+        'describe',
+        'pod',
+        '-l',
+        'app.kubernetes.io/name=supabase-postgres',
+      ],
+    },
+    {
+      label: 'Postgres logs',
+      command: 'kubectl',
+      args: [
+        '--context',
+        profile,
+        '-n',
+        'supabase',
+        'logs',
+        '-l',
+        'app.kubernetes.io/name=supabase-postgres',
+        '--all-containers=true',
+        '--tail=200',
+      ],
+    },
+    {
+      label: 'Supabase events',
+      command: 'kubectl',
+      args: ['--context', profile, '-n', 'supabase', 'get', 'events', '--sort-by=.lastTimestamp'],
+    },
+    {
+      label: 'Supabase volumes',
+      command: 'kubectl',
+      args: ['--context', profile, '-n', 'supabase', 'get', 'pvc,pv'],
+    },
+    {
+      label: 'Docker containers',
+      command: 'docker',
+      args: ['ps', '--format', '{{.Names}}\\t{{.Status}}\\t{{.Image}}'],
+    },
+  ];
+  const output: string[] = [];
+  for (const command of commands) {
+    output.push(await captureDiagnostic(command));
+  }
+  return `Bounded diagnostics for failed Minikube profile ${profile}:\n\n${output.join('\n\n')}`;
+}
+
+interface DiagnosticCommand {
+  readonly label: string;
+  readonly command: string;
+  readonly args: readonly string[];
+}
+
+async function captureDiagnostic(diagnostic: DiagnosticCommand): Promise<string> {
+  const renderedCommand = [diagnostic.command, ...diagnostic.args].join(' ');
+  try {
+    const result = await execFile(diagnostic.command, [...diagnostic.args], {
+      timeout: DIAGNOSTIC_TIMEOUT_MS,
+    });
+    const output = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join('\n');
+    return `${diagnostic.label}\n$ ${renderedCommand}\n${truncateDiagnostic(output || '(no output)')}`;
+  } catch (error) {
+    return `${diagnostic.label}\n$ ${renderedCommand}\n${truncateDiagnostic(
+      formatUnknownError(error),
+    )}`;
+  }
+}
+
+function formatUnknownError(error: unknown): string {
+  if (!(error instanceof Error)) return String(error);
+  const childProcessError = error as Error & { stderr?: unknown; stdout?: unknown };
+  return [
+    error.message,
+    typeof childProcessError.stdout === 'string' ? childProcessError.stdout.trim() : '',
+    typeof childProcessError.stderr === 'string' ? childProcessError.stderr.trim() : '',
+  ]
+    .filter(Boolean)
+    .join('\n');
+}
+
+function truncateDiagnostic(output: string): string {
+  if (output.length <= DIAGNOSTIC_OUTPUT_LIMIT) return output;
+  return `${output.slice(0, DIAGNOSTIC_OUTPUT_LIMIT)}\n... diagnostic output truncated ...`;
 }
 
 async function removeDockerImage(image: string): Promise<void> {
@@ -369,6 +560,78 @@ async function expectNoHostSupabaseComposeContainersFor(...slugs: string[]) {
   }
 }
 
+async function expectRuntimePortForwardRecovery(app: {
+  appRoot: string;
+  minikubeRoot: string;
+  slug: string;
+}): Promise<void> {
+  const appPidBefore = await readForwardPid(app.minikubeRoot, app.slug, 'app');
+  const gatewayPidBefore = await readForwardPid(app.minikubeRoot, app.slug, 'supabase-gateway');
+
+  await runPortForward(app.minikubeRoot, 'stop', 'supabase-gateway');
+  await runPortForward(app.minikubeRoot, 'stop', 'studio');
+  await runPortForward(app.minikubeRoot, 'stop', 'db-migration');
+
+  await ensureProjectInfrastructureRuntime({
+    projectId: app.slug,
+    projectPath: app.appRoot,
+    target: 'minikube',
+  });
+
+  expect(await readForwardPid(app.minikubeRoot, app.slug, 'app')).toBe(appPidBefore);
+  expect(await readForwardPid(app.minikubeRoot, app.slug, 'supabase-gateway')).not.toBe(
+    gatewayPidBefore,
+  );
+  await expectForwardPidMissing(app.minikubeRoot, app.slug, 'studio');
+  await expectForwardPidMissing(app.minikubeRoot, app.slug, 'db-migration');
+
+  const env = await readGeneratedEnv(app.minikubeRoot);
+  const gatewayUrl = readRequiredEnv(env, 'SUPABASE_PUBLIC_URL');
+  const anonKey = readRequiredEnv(env, 'SUPABASE_ANON_KEY');
+  const response = await fetch(`${gatewayUrl}/auth/v1/health`, {
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+    headers: {
+      apikey: anonKey,
+    },
+  });
+  expect(response.ok).toBe(true);
+}
+
+async function runPortForward(
+  minikubeRoot: string,
+  action: 'start' | 'status' | 'stop',
+  name: string,
+): Promise<void> {
+  await execFile(path.join(minikubeRoot, 'scripts', 'port-forward.sh'), [action, name], {
+    cwd: minikubeRoot,
+    env: process.env,
+    timeout: 60_000,
+  });
+}
+
+async function readForwardPid(minikubeRoot: string, slug: string, name: string): Promise<number> {
+  const value = await readFile(forwardPidPath(minikubeRoot, slug, name), 'utf8');
+  return Number.parseInt(value.trim(), 10);
+}
+
+async function expectForwardPidMissing(
+  minikubeRoot: string,
+  slug: string,
+  name: string,
+): Promise<void> {
+  let exists = true;
+  try {
+    await readFile(forwardPidPath(minikubeRoot, slug, name), 'utf8');
+  } catch {
+    exists = false;
+  }
+  expect(exists).toBe(false);
+}
+
+function forwardPidPath(minikubeRoot: string, slug: string, name: string): string {
+  return path.join(minikubeRoot, '.state', 'forwards', `${slug}-${name}.pid`);
+}
+
 interface SupabaseSessionFixture {
   readonly accessToken: string;
   readonly anonKey: string;

package/src/adapters/minikube/base/upgradeReconciliation.test.ts

@@ -0,0 +1,135 @@
+import { afterEach, describe, expect, test } from 'bun:test';
+import { promises as fs } from 'fs';
+import os from 'os';
+import path from 'path';
+
+import { generateInfrastructure } from '../../../index.js';
+import { createAppManifest } from '../../../testSupport.js';
+
+const temporaryPaths = new Set<string>();
+
+afterEach(async () => {
+  await Promise.all(
+    [...temporaryPaths].map((rootPath) => fs.rm(rootPath, { force: true, recursive: true })),
+  );
+  temporaryPaths.clear();
+});
+
+describe('generated native-only Minikube upgrade reconciliation', () => {
+  test('deletes exact stale app resources idempotently after applying desired topology', async () => {
+    const profile = 'native-upgrade-reconcile';
+    const rootPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-native-upgrade-'));
+    temporaryPaths.add(rootPath);
+    const generated = generateInfrastructure(
+      { deployment: { target: 'minikube', monitoring: false }, modules: [] },
+      {
+        appManifest: {
+          ...createAppManifest(profile),
+          deploy: {
+            targets: {
+              android: { enabled: true, package: 'com.ankh.nativeupgradereconcile' },
+            },
+          },
+        },
+      },
+    );
+
+    for (const file of generated.files) {
+      const filePath = path.join(rootPath, file.path);
+      await fs.mkdir(path.dirname(filePath), { recursive: true });
+      await fs.writeFile(filePath, file.content, 'utf8');
+      if (file.executable === true) await fs.chmod(filePath, 0o755);
+    }
+
+    const fakeBin = path.join(rootPath, 'fake-bin');
+    const kubectlLog = path.join(rootPath, 'kubectl.log');
+    const resourceState = path.join(rootPath, 'app-runtime-resources');
+    await fs.mkdir(fakeBin, { recursive: true });
+    await fs.writeFile(
+      resourceState,
+      ['deployment/app-runtime', 'service/app-runtime', 'configmap/app-infra-config', ''].join(
+        '\n',
+      ),
+      'utf8',
+    );
+    await writeExecutable(
+      path.join(fakeBin, 'minikube'),
+      `#!/usr/bin/env bash
+set -euo pipefail
+if [[ " $* " == *" status "* ]]; then
+  echo Running
+  exit 0
+fi
+exit 1
+`,
+    );
+    await writeExecutable(
+      path.join(fakeBin, 'kubectl'),
+      `#!/usr/bin/env bash
+set -euo pipefail
+printf '%s\n' "$*" >> "\${FAKE_KUBECTL_LOG}"
+if [[ " $* " == *" apply -k "* ]]; then
+  exit 0
+fi
+if [[ " $* " == *" delete "* ]]; then
+  expected='delete deployment/app-runtime service/app-runtime configmap/app-infra-config --ignore-not-found'
+  if [[ " $* " != *" \${expected} "* ]]; then
+    echo "unexpected cleanup identity: $*" >&2
+    exit 1
+  fi
+  : > "\${FAKE_RESOURCE_STATE}"
+  exit 0
+fi
+exit 1
+`,
+    );
+
+    const upScript = path.join(rootPath, 'infra/minikube/scripts/up.sh');
+    const env = {
+      ...process.env,
+      ANKH_APP_SLUG: profile,
+      FAKE_KUBECTL_LOG: kubectlLog,
+      FAKE_RESOURCE_STATE: resourceState,
+      PATH: `${fakeBin}:${process.env.PATH ?? ''}`,
+    };
+
+    const first = await runScript(upScript, env);
+    const second = await runScript(upScript, env);
+    const commands = (await fs.readFile(kubectlLog, 'utf8')).trim().split('\n');
+    const exactDelete = `--context ${profile} -n app delete deployment/app-runtime service/app-runtime configmap/app-infra-config --ignore-not-found`;
+
+    expect(first.stdout).toContain(`Minikube infrastructure for '${profile}' is running.`);
+    expect(second.stdout).toContain(`Minikube infrastructure for '${profile}' is running.`);
+    expect(commands).toHaveLength(4);
+    expect(commands[0]).toContain(`--context ${profile} apply -k `);
+    expect(commands[1]).toBe(exactDelete);
+    expect(commands[2]).toContain(`--context ${profile} apply -k `);
+    expect(commands[3]).toBe(exactDelete);
+    expect(await fs.readFile(resourceState, 'utf8')).toBe('');
+  });
+});
+
+async function runScript(
+  scriptPath: string,
+  env: Record<string, string | undefined>,
+): Promise<{ readonly stderr: string; readonly stdout: string }> {
+  const process = Bun.spawn(['bash', scriptPath], {
+    env,
+    stderr: 'pipe',
+    stdout: 'pipe',
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    process.exited,
+    new Response(process.stdout).text(),
+    new Response(process.stderr).text(),
+  ]);
+  if (exitCode !== 0) {
+    throw new Error(`Generated up.sh failed (${exitCode}): ${stdout}${stderr}`);
+  }
+  return { stderr, stdout };
+}
+
+async function writeExecutable(filePath: string, content: string): Promise<void> {
+  await fs.writeFile(filePath, content, 'utf8');
+  await fs.chmod(filePath, 0o755);
+}

package/src/adapters/minikube/index.ts

@@ -31,6 +31,9 @@ export function generateMinikubeInfra(
   }
 
   const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);
+  const appRuntimeEnabled =
+    options.appManifest?.deploy === undefined ||
+    options.appManifest.deploy.targets.web?.enabled === true;
   const namespace = APP_NAMESPACE;
 
   const authArtifacts = generateAuthProviderArtifacts({
@@ -75,6 +78,7 @@ export function generateMinikubeInfra(
     providerNamespaces,
     providerLifecycle,
     extraEnvEntries,
+    appRuntimeEnabled,
   });
 
   const warnings = unique([

package/src/project/index.test.ts

@@ -5,6 +5,7 @@ import path from 'path';
 
 import { createAppManifest } from '../testSupport.js';
 import {
+  ensureProjectInfrastructureRuntime,
   inspectProjectInfrastructure,
   readProjectInfrastructureEnvironment,
   resolveProjectInfrastructureDatabaseUrl,
@@ -78,6 +79,39 @@ describe('@ankhorage/infra/project', () => {
     });
   });
 
+  test('ensures the generated runtime port-forward group through the owner API', async () => {
+    const projectPath = await createProjectFixture();
+    const scriptPath = path.join(projectPath, 'infra', 'minikube', 'scripts', 'port-forward.sh');
+    await fs.writeFile(scriptPath, '#!/usr/bin/env bash\nprintf \'%s\' "$*"\n', 'utf8');
+
+    const result = await ensureProjectInfrastructureRuntime({
+      projectId: 'example',
+      projectPath,
+      target: 'minikube',
+    });
+
+    expect(result).toEqual({ stdout: 'start runtime', stderr: '' });
+  });
+
+  test('reports actionable runtime-forward failures without reconciling infrastructure', async () => {
+    const projectPath = await createProjectFixture();
+    const scriptPath = path.join(projectPath, 'infra', 'minikube', 'scripts', 'port-forward.sh');
+    await fs.writeFile(
+      scriptPath,
+      '#!/usr/bin/env bash\necho "app: target app/service/app-runtime not found"\nexit 1\n',
+      'utf8',
+    );
+
+    await expectRejectMessage(
+      ensureProjectInfrastructureRuntime({
+        projectId: 'example',
+        projectPath,
+        target: 'minikube',
+      }),
+      "Failed to ensure infrastructure runtime for project 'example': app: target app/service/app-runtime not found",
+    );
+  });
+
   test('reads only requested runtime environment values from the generated fallback', async () => {
     const projectPath = await createProjectFixture();
     const result = await readProjectInfrastructureEnvironment({
@@ -147,3 +181,15 @@ describe('@ankhorage/infra/project', () => {
     });
   });
 });
+
+async function expectRejectMessage(
+  promise: Promise<unknown>,
+  expectedMessage: string,
+): Promise<void> {
+  try {
+    await promise;
+    throw new Error('Expected operation to reject.');
+  } catch (error) {
+    expect(error instanceof Error ? error.message : String(error)).toContain(expectedMessage);
+  }
+}

package/src/project/index.ts

@@ -12,6 +12,7 @@ export {
   syncProjectInfrastructure,
 } from '../projectInfrastructure.js';
 export {
+  ensureProjectInfrastructureRuntime,
   type InfraLifecycleScript,
   type InfraPortForwardInfo,
   InfraScriptExecutionError,

package/src/readme-usage.ts

@@ -29,6 +29,11 @@ import { runCli } from './cli/bin.js';
  * operations accept an explicit project path and do not require Studio or a
  * particular workspace layout.
  *
+ * Running applications can repair their provider-aware host endpoints through
+ * `ensureProjectInfrastructureRuntime()` from `@ankhorage/infra/project`. This
+ * operation only ensures the generated runtime port-forward group; it does not
+ * deploy, bootstrap, or reconcile infrastructure.
+ *
  * @usage
  */
 await runCli(['--help']);

package/src/runtime.ts

@@ -85,6 +85,37 @@ export async function resolveProjectInfrastructurePortForward(args: {
   };
 }
 
+/** Ensures the generated host forwards required by a running application are active. */
+export async function ensureProjectInfrastructureRuntime(args: {
+  readonly projectId: string;
+  readonly projectPath: string;
+  readonly target: string;
+}): Promise<InfraScriptOutput> {
+  try {
+    return await runProjectInfrastructureLifecycle({
+      args: ['start', 'runtime'],
+      projectId: args.projectId,
+      projectPath: args.projectPath,
+      script: 'port-forward',
+      target: args.target,
+    });
+  } catch (error) {
+    if (!(error instanceof InfraScriptExecutionError)) {
+      throw error;
+    }
+
+    const detail = error.stderr.trim() || error.stdout.trim();
+    throw new InfraScriptExecutionError({
+      exitCode: error.exitCode,
+      message: `Failed to ensure infrastructure runtime for project '${args.projectId}'${
+        detail.length > 0 ? `: ${detail}` : '.'
+      }`,
+      stderr: error.stderr,
+      stdout: error.stdout,
+    });
+  }
+}
+
 export async function runProjectInfraScript(args: {
   readonly context: InfraCommandContext;
   readonly projectId: string;