@ankhorage/infra 4.1.0 → 4.1.2

package/src/adapters/minikube/base/portForwardRuntime.test.ts

@@ -4,6 +4,7 @@ import os from 'os';
 import path from 'path';
 
 import { generateInfrastructure } from '../../../index.js';
+import { ensureProjectInfrastructureRuntime } from '../../../project/index.js';
 import { createAppManifest } from '../../../testSupport.js';
 import type { InfraManifestInput } from '../../../types.js';
 
@@ -42,7 +43,11 @@ describe('generated Minikube runtime port-forward lifecycle', () => {
       expect(await readForwardPid(fixture, 'app')).toBe(appPid);
       await expectForwardPid(fixture, 'supabase-gateway', false);
 
-      const recovery = await runPortForward(fixture, 'start', 'runtime');
+      const recovery = await ensureProjectInfrastructureRuntime({
+        projectId: fixture.profile,
+        projectPath: fixture.rootPath,
+        target: 'minikube',
+      });
       expect(recovery.stdout).toContain(`app: running (pid ${appPid})`);
       expect(recovery.stdout).toContain('supabase-gateway: started');
       expect(await readForwardPid(fixture, 'app')).toBe(appPid);
@@ -76,24 +81,230 @@ describe('generated Minikube runtime port-forward lifecycle', () => {
     },
     { timeout: 15_000 },
   );
+
+  test(
+    'restores only the Supabase gateway for a native-only app without an app service',
+    async () => {
+      const appManifest = {
+        ...createAppManifest('native-runtime'),
+        deploy: {
+          targets: {
+            android: { enabled: true, package: 'com.ankh.nativeruntime' },
+          },
+        },
+      };
+      const fixture = await createPortForwardFixture(
+        createSupabaseManifest(),
+        'native-runtime',
+        appManifest,
+        'service/app-runtime',
+      );
+
+      const firstEnsure = await ensureProjectInfrastructureRuntime({
+        projectId: fixture.profile,
+        projectPath: fixture.rootPath,
+        target: 'minikube',
+      });
+      expect(firstEnsure.stdout).toContain('supabase-gateway: started');
+      expect(firstEnsure.stdout).not.toContain('app:');
+      const gatewayPid = await readForwardPid(fixture, 'supabase-gateway');
+
+      const repeatedEnsure = await ensureProjectInfrastructureRuntime({
+        projectId: fixture.profile,
+        projectPath: fixture.rootPath,
+        target: 'minikube',
+      });
+      expect(repeatedEnsure.stdout).toContain(`supabase-gateway: running (pid ${gatewayPid})`);
+      expect(await readForwardPid(fixture, 'supabase-gateway')).toBe(gatewayPid);
+      await expectForwardPid(fixture, 'app', false);
+    },
+    { timeout: 15_000 },
+  );
+
+  test(
+    'retries a transient forward that becomes reachable and then loses its stale pod',
+    async () => {
+      const appManifest = {
+        ...createAppManifest('native-runtime-retry'),
+        deploy: {
+          targets: {
+            android: { enabled: true, package: 'com.ankh.nativeruntimeretry' },
+          },
+        },
+      };
+      const fixture = await createPortForwardFixture(
+        createSupabaseManifest(),
+        'native-runtime-retry',
+        appManifest,
+        undefined,
+        1,
+        750,
+      );
+
+      const recovery = await ensureProjectInfrastructureRuntime({
+        projectId: fixture.profile,
+        projectPath: fixture.rootPath,
+        target: 'minikube',
+      });
+
+      expect(recovery.stdout).toContain(
+        'supabase-gateway: port-forward attempt 1 exited before readiness; retrying',
+      );
+      expect(recovery.stdout).toContain('supabase-gateway: started');
+      expect(Number.parseInt(await fs.readFile(fixture.forwardAttemptPath, 'utf8'), 10)).toBe(2);
+      await expectForwardPid(fixture, 'supabase-gateway', true);
+      await expectForwardPid(fixture, 'app', false);
+    },
+    { timeout: 15_000 },
+  );
+
+  test(
+    'cleans an owned app forward removed from the native-only active topology',
+    async () => {
+      const fixture = await createPortForwardFixture(
+        createSupabaseManifest(),
+        'native-runtime-upgrade',
+        createNativeAppManifest('native-runtime-upgrade'),
+      );
+      const appPort = Number.parseInt(fixture.env.APP_PORT_FORWARD_LOCAL_PORT ?? '', 10);
+      const oldAppForward = Bun.spawn(
+        [
+          'kubectl',
+          '--context',
+          fixture.profile,
+          '-n',
+          'app',
+          'port-forward',
+          'service/app-runtime',
+          `${appPort}:80`,
+        ],
+        { env: fixture.env, stderr: 'ignore', stdout: 'ignore' },
+      );
+      await waitForHttpPort(appPort);
+      await writeForwardPid(fixture, 'app', oldAppForward.pid);
+
+      const cleanup = await runPortForward(fixture, 'stop', 'all');
+
+      expect(cleanup.stdout).toContain('app: stopped');
+      await oldAppForward.exited;
+      expect(isProcessRunning(oldAppForward.pid)).toBe(false);
+      await expectForwardPid(fixture, 'app', false);
+
+      const recovery = await runPortForward(fixture, 'start', 'runtime');
+      expect(recovery.stdout).toContain('supabase-gateway: started');
+      expect(recovery.stdout).not.toContain('app: started');
+      await expectForwardPid(fixture, 'app', false);
+      await expectForwardPid(fixture, 'supabase-gateway', true);
+    },
+    { timeout: 15_000 },
+  );
+
+  test(
+    'refuses to terminate a non-owned PID recorded as an obsolete app forward',
+    async () => {
+      const fixture = await createPortForwardFixture(
+        createSupabaseManifest(),
+        'native-runtime-non-owned',
+        createNativeAppManifest('native-runtime-non-owned'),
+      );
+      const appPort = Number.parseInt(fixture.env.APP_PORT_FORWARD_LOCAL_PORT ?? '', 10);
+      const nonOwnedProcess = Bun.spawn(['bun', fixture.serverScript, String(appPort)], {
+        env: fixture.env,
+        stderr: 'ignore',
+        stdout: 'ignore',
+      });
+
+      try {
+        await waitForHttpPort(appPort);
+        await writeForwardPid(fixture, 'app', nonOwnedProcess.pid);
+
+        const cleanup = await executePortForward(fixture, 'stop', 'all');
+
+        expect(cleanup.exitCode).not.toBe(0);
+        expect(cleanup.stdout).toContain(
+          `app: stale pid file pointed at non-owned live pid ${nonOwnedProcess.pid}`,
+        );
+        expect(cleanup.stdout).toContain(
+          `app: port occupied by non-owned process on local port ${appPort}`,
+        );
+        expect(isProcessRunning(nonOwnedProcess.pid)).toBe(true);
+        await expectForwardPid(fixture, 'app', false);
+      } finally {
+        nonOwnedProcess.kill();
+        await nonOwnedProcess.exited;
+      }
+    },
+    { timeout: 15_000 },
+  );
+
+  test('fails actionably when a generated Web app target is genuinely missing', async () => {
+    const fixture = await createPortForwardFixture(
+      createSupabaseManifest(),
+      'missing-web-runtime',
+      createAppManifest('missing-web-runtime'),
+      'service/app-runtime',
+    );
+
+    await expectFailureMessage(
+      ensureProjectInfrastructureRuntime({
+        projectId: fixture.profile,
+        projectPath: fixture.rootPath,
+        target: 'minikube',
+      }),
+      'app: target app/service/app-runtime not found',
+    );
+    await expectForwardPid(fixture, 'supabase-gateway', false);
+  });
+
+  test('fails actionably when a generated provider target is genuinely missing', async () => {
+    const appManifest = {
+      ...createAppManifest('missing-provider-runtime'),
+      deploy: {
+        targets: {
+          android: { enabled: true, package: 'com.ankh.missingprovider' },
+        },
+      },
+    };
+    const fixture = await createPortForwardFixture(
+      createSupabaseManifest(),
+      'missing-provider-runtime',
+      appManifest,
+      'service/gateway',
+    );
+
+    await expectFailureMessage(
+      ensureProjectInfrastructureRuntime({
+        projectId: fixture.profile,
+        projectPath: fixture.rootPath,
+        target: 'minikube',
+      }),
+      'supabase-gateway: target supabase/service/gateway not found',
+    );
+  });
 });
 
 interface PortForwardFixture {
   readonly env: Record<string, string>;
+  readonly forwardAttemptPath: string;
   readonly processDirectory: string;
   readonly profile: string;
   readonly rootPath: string;
+  readonly serverScript: string;
   readonly scriptPath: string;
 }
 
 async function createPortForwardFixture(
   manifest: InfraManifestInput,
   profile: string,
+  appManifest = createAppManifest(profile),
+  missingResource?: string,
+  transientPortForwardFailures = 0,
+  transientPortForwardLifetimeMs = 0,
 ): Promise<PortForwardFixture> {
   const rootPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-port-forward-runtime-'));
   temporaryPaths.add(rootPath);
   const generated = generateInfrastructure(manifest, {
-    appManifest: createAppManifest(profile),
+    appManifest,
   });
   const generatedScript = generated.files.find(
     (file) => file.path === 'infra/minikube/scripts/port-forward.sh',
@@ -104,18 +315,23 @@ async function createPortForwardFixture(
 
   const scriptPath = path.join(rootPath, generatedScript.path);
   const fakeBin = path.join(rootPath, 'fake-bin');
+  const forwardAttemptPath = path.join(rootPath, 'forward-attempts');
   const processDirectory = path.join(rootPath, 'fake-processes');
   const serverScript = path.join(rootPath, 'forward-server.ts');
   await fs.mkdir(path.dirname(scriptPath), { recursive: true });
   await fs.mkdir(fakeBin, { recursive: true });
   await fs.mkdir(processDirectory, { recursive: true });
-  await fs.writeFile(scriptPath, generatedScript.content, 'utf8');
-  await fs.chmod(scriptPath, 0o755);
   await fs.writeFile(
     serverScript,
     [
       "const port = Number.parseInt(Bun.argv[2] ?? '', 10);",
-      "Bun.serve({ hostname: '127.0.0.1', port, fetch: () => new Response('ok') });",
+      "const lifetimeMs = Number.parseInt(Bun.argv[3] ?? '0', 10);",
+      "const server = Bun.serve({ hostname: '127.0.0.1', port, fetch: () => new Response('ok') });",
+      'if (lifetimeMs > 0) {',
+      '  await Bun.sleep(lifetimeMs);',
+      '  server.stop(true);',
+      '  process.exit(1);',
+      '}',
       'await new Promise(() => undefined);',
       '',
     ].join('\n'),
@@ -126,6 +342,9 @@ async function createPortForwardFixture(
     `#!/usr/bin/env bash
 set -euo pipefail
 if [[ " $* " == *" get "* ]]; then
+  if [[ -n "\${FAKE_MISSING_RESOURCE:-}" && " $* " == *" \${FAKE_MISSING_RESOURCE} "* ]]; then
+    exit 1
+  fi
   exit 0
 fi
 if [[ " $* " != *" port-forward "* ]]; then
@@ -133,6 +352,19 @@ if [[ " $* " != *" port-forward "* ]]; then
 fi
 endpoint="\${!#}"
 local_port="\${endpoint%%:*}"
+forward_attempt=0
+if [[ -f "\${FAKE_FORWARD_ATTEMPT_FILE}" ]]; then
+  forward_attempt="$(cat "\${FAKE_FORWARD_ATTEMPT_FILE}")"
+fi
+forward_attempt="$((forward_attempt + 1))"
+printf '%s\n' "\${forward_attempt}" > "\${FAKE_FORWARD_ATTEMPT_FILE}"
+if [[ "\${forward_attempt}" -le "\${FAKE_TRANSIENT_FORWARD_FAILURES}" ]]; then
+  if [[ "\${FAKE_TRANSIENT_FORWARD_LIFETIME_MS}" -gt 0 ]]; then
+    bun "\${FAKE_FORWARD_SERVER_SCRIPT}" "\${local_port}" "\${FAKE_TRANSIENT_FORWARD_LIFETIME_MS}" || true
+  fi
+  echo 'error: error upgrading connection: unable to upgrade connection: pod does not exist' >&2
+  exit 1
+fi
 printf 'kubectl %s\n' "$*" > "\${FAKE_PROCESS_DIRECTORY}/$$.command"
 exec bun "\${FAKE_FORWARD_SERVER_SCRIPT}" "\${local_port}"
 `,
@@ -162,29 +394,91 @@ fi
   );
 
   const ports = reserveAvailablePorts(4);
+  const env = {
+    ...process.env,
+    ANKH_APP_SLUG: profile,
+    APP_PORT_FORWARD_LOCAL_PORT: String(ports[0]),
+    SUPABASE_GATEWAY_FORWARD_LOCAL_PORT: String(ports[1]),
+    SUPABASE_STUDIO_FORWARD_LOCAL_PORT: String(ports[2]),
+    SUPABASE_DB_FORWARD_LOCAL_PORT: String(ports[3]),
+    FAKE_FORWARD_ATTEMPT_FILE: forwardAttemptPath,
+    FAKE_FORWARD_SERVER_SCRIPT: serverScript,
+    FAKE_PROCESS_DIRECTORY: processDirectory,
+    FAKE_TRANSIENT_FORWARD_FAILURES: String(transientPortForwardFailures),
+    FAKE_TRANSIENT_FORWARD_LIFETIME_MS: String(transientPortForwardLifetimeMs),
+    ...(missingResource ? { FAKE_MISSING_RESOURCE: missingResource } : {}),
+    PATH: `${fakeBin}:${process.env.PATH ?? ''}`,
+  };
+  const injectedEnvironment = Object.entries(env)
+    .filter(([key]) =>
+      [
+        'ANKH_APP_SLUG',
+        'APP_PORT_FORWARD_LOCAL_PORT',
+        'SUPABASE_GATEWAY_FORWARD_LOCAL_PORT',
+        'SUPABASE_STUDIO_FORWARD_LOCAL_PORT',
+        'SUPABASE_DB_FORWARD_LOCAL_PORT',
+        'FAKE_FORWARD_ATTEMPT_FILE',
+        'FAKE_FORWARD_SERVER_SCRIPT',
+        'FAKE_PROCESS_DIRECTORY',
+        'FAKE_TRANSIENT_FORWARD_FAILURES',
+        'FAKE_TRANSIENT_FORWARD_LIFETIME_MS',
+        'FAKE_MISSING_RESOURCE',
+        'PATH',
+      ].includes(key),
+    )
+    .map(([key, value]) => `export ${key}=${shellQuote(value)}`)
+    .join('\n');
+  await fs.writeFile(
+    scriptPath,
+    generatedScript.content.replace(
+      '#!/usr/bin/env bash\n',
+      `#!/usr/bin/env bash\n${injectedEnvironment}\n`,
+    ),
+    'utf8',
+  );
+  await fs.chmod(scriptPath, 0o755);
   return {
-    env: {
-      ...process.env,
-      ANKH_APP_SLUG: profile,
-      APP_PORT_FORWARD_LOCAL_PORT: String(ports[0]),
-      SUPABASE_GATEWAY_FORWARD_LOCAL_PORT: String(ports[1]),
-      SUPABASE_STUDIO_FORWARD_LOCAL_PORT: String(ports[2]),
-      SUPABASE_DB_FORWARD_LOCAL_PORT: String(ports[3]),
-      FAKE_FORWARD_SERVER_SCRIPT: serverScript,
-      FAKE_PROCESS_DIRECTORY: processDirectory,
-      PATH: `${fakeBin}:${process.env.PATH ?? ''}`,
-    },
+    env,
+    forwardAttemptPath,
     processDirectory,
     profile,
     rootPath,
+    serverScript,
     scriptPath,
   };
 }
 
+function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+
+async function expectFailureMessage(promise: Promise<unknown>, expected: string): Promise<void> {
+  try {
+    await promise;
+    throw new Error('Expected runtime ensure to fail.');
+  } catch (error) {
+    expect(error instanceof Error ? error.message : String(error)).toContain(expected);
+  }
+}
+
 async function runPortForward(
   fixture: PortForwardFixture,
   action: string,
   name: string,
+): Promise<{ readonly exitCode: number; readonly stderr: string; readonly stdout: string }> {
+  const result = await executePortForward(fixture, action, name);
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `port-forward ${action} ${name} failed (${result.exitCode}): ${result.stdout}${result.stderr}`,
+    );
+  }
+  return result;
+}
+
+async function executePortForward(
+  fixture: PortForwardFixture,
+  action: string,
+  name: string,
 ): Promise<{ readonly exitCode: number; readonly stderr: string; readonly stdout: string }> {
   const process = Bun.spawn(['bash', fixture.scriptPath, action, name], {
     env: fixture.env,
@@ -196,12 +490,43 @@ async function runPortForward(
     new Response(process.stdout).text(),
     new Response(process.stderr).text(),
   ]);
-  if (exitCode !== 0) {
-    throw new Error(`port-forward ${action} ${name} failed (${exitCode}): ${stdout}${stderr}`);
-  }
   return { exitCode, stderr, stdout };
 }
 
+async function writeForwardPid(
+  fixture: PortForwardFixture,
+  name: string,
+  pid: number,
+): Promise<void> {
+  const pidPath = forwardPidPath(fixture, name);
+  await fs.mkdir(path.dirname(pidPath), { recursive: true });
+  await fs.writeFile(pidPath, `${pid}\n`, 'utf8');
+}
+
+async function waitForHttpPort(port: number): Promise<void> {
+  for (let attempt = 0; attempt < 40; attempt += 1) {
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}`, {
+        signal: AbortSignal.timeout(250),
+      });
+      if (response.ok) return;
+    } catch {
+      // The fixture process may still be binding its port.
+    }
+    await Bun.sleep(50);
+  }
+  throw new Error(`Timed out waiting for fixture port ${port}.`);
+}
+
+function isProcessRunning(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 async function readForwardPid(fixture: PortForwardFixture, name: string): Promise<number> {
   const value = await fs.readFile(forwardPidPath(fixture, name), 'utf8');
   return Number.parseInt(value.trim(), 10);
@@ -286,3 +611,14 @@ function createSupabaseManifest(): InfraManifestInput {
     modules: [],
   };
 }
+
+function createNativeAppManifest(profile: string) {
+  return {
+    ...createAppManifest(profile),
+    deploy: {
+      targets: {
+        android: { enabled: true, package: `com.ankh.${profile.replaceAll('-', '')}` },
+      },
+    },
+  };
+}

package/src/adapters/minikube/base/upgradeReconciliation.test.ts

@@ -0,0 +1,135 @@
+import { afterEach, describe, expect, test } from 'bun:test';
+import { promises as fs } from 'fs';
+import os from 'os';
+import path from 'path';
+
+import { generateInfrastructure } from '../../../index.js';
+import { createAppManifest } from '../../../testSupport.js';
+
+const temporaryPaths = new Set<string>();
+
+afterEach(async () => {
+  await Promise.all(
+    [...temporaryPaths].map((rootPath) => fs.rm(rootPath, { force: true, recursive: true })),
+  );
+  temporaryPaths.clear();
+});
+
+describe('generated native-only Minikube upgrade reconciliation', () => {
+  test('deletes exact stale app resources idempotently after applying desired topology', async () => {
+    const profile = 'native-upgrade-reconcile';
+    const rootPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-native-upgrade-'));
+    temporaryPaths.add(rootPath);
+    const generated = generateInfrastructure(
+      { deployment: { target: 'minikube', monitoring: false }, modules: [] },
+      {
+        appManifest: {
+          ...createAppManifest(profile),
+          deploy: {
+            targets: {
+              android: { enabled: true, package: 'com.ankh.nativeupgradereconcile' },
+            },
+          },
+        },
+      },
+    );
+
+    for (const file of generated.files) {
+      const filePath = path.join(rootPath, file.path);
+      await fs.mkdir(path.dirname(filePath), { recursive: true });
+      await fs.writeFile(filePath, file.content, 'utf8');
+      if (file.executable === true) await fs.chmod(filePath, 0o755);
+    }
+
+    const fakeBin = path.join(rootPath, 'fake-bin');
+    const kubectlLog = path.join(rootPath, 'kubectl.log');
+    const resourceState = path.join(rootPath, 'app-runtime-resources');
+    await fs.mkdir(fakeBin, { recursive: true });
+    await fs.writeFile(
+      resourceState,
+      ['deployment/app-runtime', 'service/app-runtime', 'configmap/app-infra-config', ''].join(
+        '\n',
+      ),
+      'utf8',
+    );
+    await writeExecutable(
+      path.join(fakeBin, 'minikube'),
+      `#!/usr/bin/env bash
+set -euo pipefail
+if [[ " $* " == *" status "* ]]; then
+  echo Running
+  exit 0
+fi
+exit 1
+`,
+    );
+    await writeExecutable(
+      path.join(fakeBin, 'kubectl'),
+      `#!/usr/bin/env bash
+set -euo pipefail
+printf '%s\n' "$*" >> "\${FAKE_KUBECTL_LOG}"
+if [[ " $* " == *" apply -k "* ]]; then
+  exit 0
+fi
+if [[ " $* " == *" delete "* ]]; then
+  expected='delete deployment/app-runtime service/app-runtime configmap/app-infra-config --ignore-not-found'
+  if [[ " $* " != *" \${expected} "* ]]; then
+    echo "unexpected cleanup identity: $*" >&2
+    exit 1
+  fi
+  : > "\${FAKE_RESOURCE_STATE}"
+  exit 0
+fi
+exit 1
+`,
+    );
+
+    const upScript = path.join(rootPath, 'infra/minikube/scripts/up.sh');
+    const env = {
+      ...process.env,
+      ANKH_APP_SLUG: profile,
+      FAKE_KUBECTL_LOG: kubectlLog,
+      FAKE_RESOURCE_STATE: resourceState,
+      PATH: `${fakeBin}:${process.env.PATH ?? ''}`,
+    };
+
+    const first = await runScript(upScript, env);
+    const second = await runScript(upScript, env);
+    const commands = (await fs.readFile(kubectlLog, 'utf8')).trim().split('\n');
+    const exactDelete = `--context ${profile} -n app delete deployment/app-runtime service/app-runtime configmap/app-infra-config --ignore-not-found`;
+
+    expect(first.stdout).toContain(`Minikube infrastructure for '${profile}' is running.`);
+    expect(second.stdout).toContain(`Minikube infrastructure for '${profile}' is running.`);
+    expect(commands).toHaveLength(4);
+    expect(commands[0]).toContain(`--context ${profile} apply -k `);
+    expect(commands[1]).toBe(exactDelete);
+    expect(commands[2]).toContain(`--context ${profile} apply -k `);
+    expect(commands[3]).toBe(exactDelete);
+    expect(await fs.readFile(resourceState, 'utf8')).toBe('');
+  });
+});
+
+async function runScript(
+  scriptPath: string,
+  env: Record<string, string | undefined>,
+): Promise<{ readonly stderr: string; readonly stdout: string }> {
+  const process = Bun.spawn(['bash', scriptPath], {
+    env,
+    stderr: 'pipe',
+    stdout: 'pipe',
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    process.exited,
+    new Response(process.stdout).text(),
+    new Response(process.stderr).text(),
+  ]);
+  if (exitCode !== 0) {
+    throw new Error(`Generated up.sh failed (${exitCode}): ${stdout}${stderr}`);
+  }
+  return { stderr, stdout };
+}
+
+async function writeExecutable(filePath: string, content: string): Promise<void> {
+  await fs.writeFile(filePath, content, 'utf8');
+  await fs.chmod(filePath, 0o755);
+}

package/src/adapters/minikube/index.ts

@@ -31,6 +31,9 @@ export function generateMinikubeInfra(
   }
 
   const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);
+  const appRuntimeEnabled =
+    options.appManifest?.deploy === undefined ||
+    options.appManifest.deploy.targets.web?.enabled === true;
   const namespace = APP_NAMESPACE;
 
   const authArtifacts = generateAuthProviderArtifacts({
@@ -75,6 +78,7 @@ export function generateMinikubeInfra(
     providerNamespaces,
     providerLifecycle,
     extraEnvEntries,
+    appRuntimeEnabled,
   });
 
   const warnings = unique([