@ankhorage/infra 4.1.1 → 4.1.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "4.1.1",
+  "version": "4.1.3",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {

package/src/adapters/minikube/README.md

@@ -73,9 +73,12 @@ official Supabase Kubernetes distribution.
 
 - Default app image: `ankh/<slug>:dev`.
 - By default `up.sh` triggers `build-app-image.sh` (`APP_BUILD_ENABLED=true`) before apply.
-- `build-app-image.sh` runs `bunx expo export --platform web --clear`, then builds via
-  `app-image/Dockerfile`. Clearing the Expo/Metro cache ensures rotated `EXPO_PUBLIC_*`
-  values replace cached transforms before the browser bundle and Docker image are created.
+- `build-app-image.sh` requires the app's installed `node_modules/.bin/expo`, runs
+  `expo export --platform web --clear` through that pinned local CLI, then builds via
+  `app-image/Dockerfile`. Missing app dependencies fail with an explicit frozen-install
+  instruction; the script never resolves Expo through `bunx` or the network. Clearing the
+  Expo/Metro cache ensures rotated `EXPO_PUBLIC_*` values replace cached transforms before the
+  browser bundle and Docker image are created.
 - `up.sh` syncs runtime image using `APP_IMAGE_SYNC_STRATEGY`:
   - `docker-load` (default): loads existing local Docker image into the app profile.
   - `minikube-build`: builds exported web artifacts directly into the profile image store.

package/src/adapters/minikube/base/appImageBuild.test.ts

@@ -25,7 +25,7 @@ test('re-exports rotated public environment values before building the app image
     const buildScriptPath = path.join(scriptsRoot, 'build-app-image.sh');
     const dockerfilePath = path.join(infraRoot, 'app-image', 'Dockerfile');
     const metroCachePath = path.join(workspaceRoot, 'fake-metro-cache');
-    const bunxArgsPath = path.join(workspaceRoot, 'bunx-args');
+    const expoArgsPath = path.join(workspaceRoot, 'expo-args');
     const dockerArgsPath = path.join(workspaceRoot, 'docker-args');
     const exportDir = path.join(appRoot, '.ankh', 'web-export');
     const bundlePath = path.join(exportDir, '_expo', 'static', 'js', 'web', 'index-fixture.js');
@@ -49,14 +49,14 @@ test('re-exports rotated public environment values before building the app image
     await writeFile(dockerfilePath, 'FROM scratch\n', 'utf8');
     await writeFile(buildScriptPath, buildScript, 'utf8');
     await chmod(buildScriptPath, 0o755);
-    await writeFakeBunx(path.join(fakeBin, 'bunx'));
+    await writeFakeExpo(path.join(appRoot, 'node_modules', '.bin', 'expo'));
     await writeFakeDocker(path.join(fakeBin, 'docker'));
 
     await writePublicEnvironment(appRoot, infraRoot, PUBLIC_KEY_A);
     await runBuildScript({
       appRoot,
       buildScriptPath,
-      bunxArgsPath,
+      expoArgsPath,
       dockerArgsPath,
       fakeBin,
       metroCachePath,
@@ -70,7 +70,7 @@ test('re-exports rotated public environment values before building the app image
     await runBuildScript({
       appRoot,
       buildScriptPath,
-      bunxArgsPath,
+      expoArgsPath,
       dockerArgsPath,
       fakeBin,
       metroCachePath,
@@ -80,8 +80,7 @@ test('re-exports rotated public environment values before building the app image
     expect(secondBundle).toContain(PUBLIC_KEY_B);
     expect(secondBundle).not.toContain(PUBLIC_KEY_A);
     expect(secondBundle).not.toContain(PRIVATE_SERVICE_ROLE_KEY);
-    expect((await readFile(bunxArgsPath, 'utf8')).trim().split('\n')).toEqual([
-      'expo',
+    expect((await readFile(expoArgsPath, 'utf8')).trim().split('\n')).toEqual([
       'export',
       '--platform',
       'web',
@@ -98,6 +97,64 @@ test('re-exports rotated public environment values before building the app image
   }
 });
 
+test('fails before global or network Expo resolution when app dependencies are missing', async () => {
+  const workspaceRoot = await mkdtemp(path.join(tmpdir(), 'ankh-infra-app-image-missing-expo-'));
+
+  try {
+    const appRoot = path.join(workspaceRoot, 'apps', APP_SLUG);
+    const infraRoot = path.join(appRoot, 'infra', 'minikube');
+    const scriptsRoot = path.join(infraRoot, 'scripts');
+    const fakeBin = path.join(workspaceRoot, 'bin');
+    const buildScriptPath = path.join(scriptsRoot, 'build-app-image.sh');
+    const dockerfilePath = path.join(infraRoot, 'app-image', 'Dockerfile');
+    const fallbackMarkerPath = path.join(workspaceRoot, 'forbidden-expo-fallback');
+    const generated = generateInfrastructure(
+      {
+        deployment: { target: 'minikube', monitoring: false },
+        modules: [],
+      },
+      { appManifest: createAppManifest(APP_SLUG) },
+    );
+    const buildScript = getGeneratedFile(
+      generated.files,
+      'infra/minikube/scripts/build-app-image.sh',
+    );
+
+    await mkdir(path.dirname(dockerfilePath), { recursive: true });
+    await mkdir(fakeBin, { recursive: true });
+    await mkdir(scriptsRoot, { recursive: true });
+    await writeFile(path.join(appRoot, 'package.json'), '{}\n', 'utf8');
+    await writeFile(dockerfilePath, 'FROM scratch\n', 'utf8');
+    await writeFile(buildScriptPath, buildScript, 'utf8');
+    await chmod(buildScriptPath, 0o755);
+    await writeFakeDocker(path.join(fakeBin, 'docker'));
+    await writeForbiddenExpoFallback(path.join(fakeBin, 'bunx'));
+    await writeForbiddenExpoFallback(path.join(fakeBin, 'expo'));
+
+    const result = await executeBuildScript({
+      appRoot,
+      buildScriptPath,
+      dockerArgsPath: path.join(workspaceRoot, 'docker-args'),
+      expoArgsPath: path.join(workspaceRoot, 'expo-args'),
+      fakeBin,
+      fallbackMarkerPath,
+      metroCachePath: path.join(workspaceRoot, 'fake-metro-cache'),
+    });
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain(
+      `App-owned Expo CLI is missing: ${appRoot}/node_modules/.bin/expo`,
+    );
+    expect(result.stderr).toContain(
+      `Run 'bun install --frozen-lockfile' in ${appRoot} before building the app image.`,
+    );
+    expect(buildScript).not.toContain('bunx');
+    expect(await Bun.file(fallbackMarkerPath).exists()).toBe(false);
+  } finally {
+    await rm(workspaceRoot, { recursive: true, force: true });
+  }
+});
+
 async function writePublicEnvironment(
   appRoot: string,
   infraRoot: string,
@@ -122,19 +179,20 @@ SUPABASE_SERVICE_ROLE_KEY=${PRIVATE_SERVICE_ROLE_KEY}
   );
 }
 
-async function writeFakeBunx(filePath: string): Promise<void> {
+async function writeFakeExpo(filePath: string): Promise<void> {
+  await mkdir(path.dirname(filePath), { recursive: true });
   await writeFile(
     filePath,
     `#!/usr/bin/env bash
 set -euo pipefail
 
-printf '%s\\n' "$@" > "\${FAKE_BUNX_ARGS_PATH:?}"
+printf '%s\\n' "$@" > "\${FAKE_EXPO_ARGS_PATH:?}"
 
-if [[ "\${1:-}" != "expo" || "\${2:-}" != "export" ]]; then
+if [[ "\${1:-}" != "export" ]]; then
   echo "Expected expo export invocation." >&2
   exit 64
 fi
-shift 2
+shift
 
 clear_cache=false
 output_dir=""
@@ -208,20 +266,38 @@ fi
   await chmod(filePath, 0o755);
 }
 
-async function runBuildScript(args: {
+async function writeForbiddenExpoFallback(filePath: string): Promise<void> {
+  await writeFile(
+    filePath,
+    `#!/usr/bin/env bash
+set -euo pipefail
+
+: > "\${FAKE_FALLBACK_MARKER_PATH:?}"
+exit 86
+`,
+    'utf8',
+  );
+  await chmod(filePath, 0o755);
+}
+
+async function executeBuildScript(args: {
   appRoot: string;
   buildScriptPath: string;
-  bunxArgsPath: string;
+  expoArgsPath: string;
   dockerArgsPath: string;
   fakeBin: string;
+  fallbackMarkerPath?: string;
   metroCachePath: string;
-}): Promise<void> {
+}): Promise<{ exitCode: number | null; stderr: string; stdout: string }> {
   const child = spawn('bash', [args.buildScriptPath], {
     cwd: args.appRoot,
     env: {
       ...process.env,
-      FAKE_BUNX_ARGS_PATH: args.bunxArgsPath,
       FAKE_DOCKER_ARGS_PATH: args.dockerArgsPath,
+      FAKE_EXPO_ARGS_PATH: args.expoArgsPath,
+      ...(args.fallbackMarkerPath === undefined
+        ? {}
+        : { FAKE_FALLBACK_MARKER_PATH: args.fallbackMarkerPath }),
       FAKE_METRO_CACHE_PATH: args.metroCachePath,
       PATH: `${args.fakeBin}:${process.env.PATH ?? ''}`,
     },
@@ -237,6 +313,19 @@ async function runBuildScript(args: {
     exitCodePromise,
   ]);
 
+  return { exitCode, stderr, stdout };
+}
+
+async function runBuildScript(args: {
+  appRoot: string;
+  buildScriptPath: string;
+  expoArgsPath: string;
+  dockerArgsPath: string;
+  fakeBin: string;
+  metroCachePath: string;
+}): Promise<void> {
+  const { exitCode, stderr, stdout } = await executeBuildScript(args);
+
   if (exitCode !== 0) {
     throw new Error(
       `Generated build script exited with ${String(exitCode)}. stdout=${stdout} stderr=${stderr}`,

package/src/adapters/minikube/base/index.test.ts

@@ -169,6 +169,9 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
     expect(postgres).toContain('config_file=/etc/postgresql/postgresql.conf');
     expect(gatewayTemplate).toContain('keyauth_credentials');
     expect(gatewayTemplate).toContain('request-transformer');
+    expect(gatewayTemplate).toContain('_format_version: "2.1"');
+    expect(gatewayTemplate).toContain('username: "$DASHBOARD_USERNAME"');
+    expect(gatewayTemplate).toContain('password: "$DASHBOARD_PASSWORD"');
     expect(kongEntrypoint).toContain('LUA_AUTH_EXPR');
     expect(auth).toContain('name: GOTRUE_JWT_EXP');
     expect(auth).toContain('key: JWT_EXPIRY');
@@ -268,6 +271,7 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
     expect(kustomization).toContain('namespaces/cerbos.yaml');
     expect(readme).toContain('- Provider namespaces: `cerbos`');
     expect(readme).toContain('## Provider Lifecycle Contributions');
+    expect(readme).not.toContain('\n\n\n## Provider Lifecycle Contributions');
     expect(readme).toContain('`cerbos`: namespace `cerbos`');
     expect(readme).toContain('`deployment/cerbos` in namespace `cerbos`');
     expect(readme).toContain('`http` = `http://cerbos.cerbos.svc.cluster.local:3592`');
@@ -329,9 +333,11 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
       },
     );
     const envExample = getFile(result.files, 'infra/minikube/.env.example');
+    const readme = getFile(result.files, 'infra/minikube/README.md');
     const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
 
     expect(envExample).toContain('# google: auth/oauth/google');
+    expect(readme).not.toContain('credentialsRef` entries.\n\n\nPinned images:');
     expect(envExample).toContain('GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID=');
     expect(envExample).toContain('GOTRUE_EXTERNAL_GOOGLE_SECRET=');
     expect(upScript).toContain('GOTRUE_EXTERNAL_GOOGLE_ENABLED=true');
@@ -392,12 +398,16 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
       ),
     );
     expect(upScript).not.toContain('SUPABASE_SERVICE_ROLE_KEY" "${SUPABASE_SERVICE_ROLE_KEY}"');
+    expect(buildScript).toContain('EXPO_CLI="${APP_SOURCE_DIR}/node_modules/.bin/expo"');
     expect(buildScript).toContain(
-      'bunx expo export --platform web --clear --output-dir "${APP_WEB_EXPORT_DIR}"',
+      '"${EXPO_CLI}" export --platform web --clear --output-dir "${APP_WEB_EXPORT_DIR}"',
     );
+    expect(buildScript).not.toContain('bunx');
     expect(readme).toContain(
-      '`build-app-image.sh` clears the Expo/Metro bundler cache before every web export.',
+      '`build-app-image.sh` requires the app-installed `node_modules/.bin/expo` and never resolves',
     );
+    expect(readme).toContain('Expo globally or through the network.');
+    expect(readme).toContain('It clears the Expo/Metro bundler cache before every web');
   });
 
   test('starts Supabase schema owners before app migrations and profile reconciliation', () => {

package/src/adapters/minikube/base/index.ts

@@ -331,7 +331,7 @@ function getReadmeMarkdown(args: {
       : '';
   const providerLifecycleLines =
     providerLifecycle.length > 0
-      ? `\n## Provider Lifecycle Contributions\n\n${providerLifecycle
+      ? `## Provider Lifecycle Contributions\n\n${providerLifecycle
           .map((provider) => {
             const readiness =
               provider.readinessChecks.length > 0
@@ -347,11 +347,11 @@ function getReadmeMarkdown(args: {
                 : 'none';
             return `- \`${provider.id}\`: namespace \`${provider.namespace}\`; readiness ${readiness}; endpoints ${endpoints}`;
           })
-          .join('\n')}\n`
+          .join('\n')}`
       : '';
   const oauthDescription =
     oauthProviders.length > 0
-      ? `\nConfigured OAuth providers are wired into GoTrue through generated \`GOTRUE_EXTERNAL_*\` runtime keys. The keys are named in \`.env.example\`; values must come from trusted secret resolution for the configured \`credentialsRef\` entries.\n`
+      ? `\nConfigured OAuth providers are wired into GoTrue through generated \`GOTRUE_EXTERNAL_*\` runtime keys. The keys are named in \`.env.example\`; values must come from trusted secret resolution for the configured \`credentialsRef\` entries.`
       : '';
 
   const runtimeForwardDescription = appRuntimeEnabled
@@ -451,10 +451,12 @@ ${appRuntimeEnabled ? `- App: \`http://127.0.0.1:${supabaseHostPorts.app}\`\n` :
 
 ## App Image Export
 
-\`build-app-image.sh\` clears the Expo/Metro bundler cache before every web export. Expo
-inlines \`EXPO_PUBLIC_*\` values into the browser bundle, so cache invalidation ensures a
-rotated browser-safe Supabase URL or anon key replaces the previous value before the Docker
-image is built. Privileged Supabase credentials are not written to the app's public env file.
+\`build-app-image.sh\` requires the app-installed \`node_modules/.bin/expo\` and never resolves
+Expo globally or through the network. It clears the Expo/Metro bundler cache before every web
+export. Expo inlines \`EXPO_PUBLIC_*\` values into the browser bundle, so cache invalidation
+ensures a rotated browser-safe Supabase URL or anon key replaces the previous value before the
+Docker image is built. Privileged Supabase credentials are not written to the app's public env
+file.
 
 ## Runtime Conventions
 
@@ -1835,7 +1837,7 @@ spec:
 }
 
 function getSupabaseGatewayTemplate(): string {
-  return `_format_version: '2.1'
+  return `_format_version: "2.1"
 _transform: true
 
 consumers:
@@ -1857,8 +1859,8 @@ acls:
 
 basicauth_credentials:
   - consumer: DASHBOARD
-    username: '$DASHBOARD_USERNAME'
-    password: '$DASHBOARD_PASSWORD'
+    username: "$DASHBOARD_USERNAME"
+    password: "$DASHBOARD_PASSWORD"
 
 services:
   - name: auth-v1-open
@@ -2958,29 +2960,31 @@ if [[ "\${APP_BUILD_ENABLED}" != "true" ]]; then
   exit 0
 fi
 
-if ! command -v docker >/dev/null 2>&1; then
-  echo "docker is required to build app image."
+if [[ ! -f "\${APP_SOURCE_DIR}/package.json" ]]; then
+  echo "APP_SOURCE_DIR does not look like an app root: \${APP_SOURCE_DIR}"
   exit 1
 fi
 
-if ! command -v bunx >/dev/null 2>&1; then
-  echo "bunx is required to export the app for container image build."
+if [[ ! -f "\${DOCKERFILE_PATH}" ]]; then
+  echo "Dockerfile for app image build is missing: \${DOCKERFILE_PATH}"
   exit 1
 fi
 
-if [[ ! -f "\${APP_SOURCE_DIR}/package.json" ]]; then
-  echo "APP_SOURCE_DIR does not look like an app root: \${APP_SOURCE_DIR}"
+EXPO_CLI="\${APP_SOURCE_DIR}/node_modules/.bin/expo"
+if [[ ! -x "\${EXPO_CLI}" ]]; then
+  echo "App-owned Expo CLI is missing: \${EXPO_CLI}" >&2
+  echo "Run 'bun install --frozen-lockfile' in \${APP_SOURCE_DIR} before building the app image." >&2
   exit 1
 fi
 
-if [[ ! -f "\${DOCKERFILE_PATH}" ]]; then
-  echo "Dockerfile for app image build is missing: \${DOCKERFILE_PATH}"
+if ! command -v docker >/dev/null 2>&1; then
+  echo "docker is required to build app image."
   exit 1
 fi
 
 (
   cd "\${APP_SOURCE_DIR}"
-  bunx expo export --platform web --clear --output-dir "\${APP_WEB_EXPORT_DIR}"
+  "\${EXPO_CLI}" export --platform web --clear --output-dir "\${APP_WEB_EXPORT_DIR}"
 )
 
 if [[ "\${APP_WEB_EXPORT_DIR}" = /* ]]; then