@ankhorage/infra 4.1.10 → 5.0.0

package/src/commands.test.ts

@@ -1,219 +1,221 @@
+import type { AppManifest } from '@ankhorage/contracts';
+import type { InfraEnvironmentSpec, InfraLedger, InfraResult } from '@ankhorage/contracts/infra';
 import { describe, expect, test } from 'bun:test';
 
-import {
-  createProviderCommandDescriptors,
-  findInfraCommandByStandaloneName,
-  INFRA_COMMANDS,
-  renderRootHelp,
-  runInfraCommand,
-} from './commands.js';
-import { createCapturedCommandContext } from './testSupport.js';
-import { createAppManifest } from './testSupport.js';
-
-describe('infra command table', () => {
-  test('stays aligned across provider descriptors and standalone names', () => {
-    const providerDescriptors = createProviderCommandDescriptors();
-
-    expect(INFRA_COMMANDS.map((command) => command.standaloneName)).toEqual([
-      'validate',
-      'generate',
-      'status',
-      'up',
-      'down',
-    ]);
-    expect(providerDescriptors.map((command) => command.path.join(' '))).toEqual([
-      'validate',
-      'generate',
-      'status',
-      'up',
-      'down',
-    ]);
-    expect(JSON.stringify(providerDescriptors)).not.toContain('port-forward');
-    expect(JSON.stringify(providerDescriptors)).not.toContain('portForward');
-  });
-
-  test('root help only exposes the locked command surface', () => {
-    const help = renderRootHelp('0.2.1');
-
-    expect(help).toContain('validate');
-    expect(help).toContain('generate');
-    expect(help).toContain('status');
-    expect(help).toContain('up');
-    expect(help).toContain('down');
+import { INFRA_COMMANDS } from './cli/constants.js';
+import { createProviderCommandDescriptors } from './cli/createProviderCommandDescriptors.js';
+import { findInfraCommand } from './cli/findInfraCommand.js';
+import { renderInfraRootHelp } from './cli/renderInfraRootHelp.js';
+import { runInfraCommandAsync } from './cli/runInfraCommandAsync.js';
+import { createAppManifest, createCapturedCommandContext } from './testSupport.js';
+import type { InfraCommandServices, InfraLifecycleOperations } from './types/infraCli.js';
+import type { InfraDestroyOperationRequest } from './types/infraOrchestration.js';
+
+describe('canonical Infra commands', () => {
+  test('exposes the same locked eight-command surface everywhere', () => {
+    const names = ['validate', 'plan', 'generate', 'up', 'status', 'outputs', 'down', 'destroy'];
+    expect(INFRA_COMMANDS.map(({ standaloneName }) => standaloneName)).toEqual(names);
+    expect(createProviderCommandDescriptors().map(({ path }) => path.join(' '))).toEqual(names);
+    const help = renderInfraRootHelp('9.9.9');
+    for (const name of names) expect(help).toContain(name);
     expect(help).not.toContain('port-forward');
+    expect(help).not.toContain('reset');
   });
 
-  test('validate prints warnings without failing', async () => {
-    const command = findInfraCommandByStandaloneName('validate');
+  test('prints environment output format without resolving or exposing secret values', async () => {
     const captured = createCapturedCommandContext('/workspace');
-
-    if (command === null) {
-      throw new Error('validate command not found');
-    }
-
-    const result = await runInfraCommand(
-      {
-        argv: ['shop'],
-        command,
-        context: captured.context,
-      },
-      {
-        services: {
-          resolveProject() {
-            return Promise.resolve({
-              appsRoot: '/workspace/apps',
-              workspaceRoot: '/workspace',
-              manifestPath: '/workspace/apps/shop/ankh.config.json',
-              projectId: 'shop',
-              projectPath: '/workspace/apps/shop',
-              manifest: createAppManifest('shop', { modules: [] }),
-            });
-          },
-          validateInfraSupport() {
-            return ['warning-1'];
-          },
-        },
-      },
+    const command = requireCommand('outputs');
+    const result = await runInfraCommandAsync(
+      { argv: ['shop', '--format', 'env'], command, context: captured.context },
+      { services: createServices() },
     );
-
     expect(result.exitCode).toBe(0);
-    expect(captured.stdout.value).toContain('infraConfigSupport: warnings');
-    expect(captured.stderr.value).toContain('warning-1');
+    expect(captured.stdout.value).toBe("PUBLIC_URL='https://example.test'\n");
+    expect(captured.stderr.value).toContain('remains a reference and was not printed');
+    expect(`${captured.stdout.value}${captured.stderr.value}`).not.toContain('resolved-secret');
   });
 
-  test('generate reports skipped studio results', async () => {
-    const command = findInfraCommandByStandaloneName('generate');
-    const captured = createCapturedCommandContext('/workspace');
-
-    if (command === null) {
-      throw new Error('generate command not found');
-    }
+  test('requires explicit destroy environment and exact project confirmation', async () => {
+    const command = requireCommand('destroy');
+    const missingEnvironment = createCapturedCommandContext('/workspace');
+    expect(
+      (
+        await runInfraCommandAsync(
+          { argv: ['shop'], command, context: missingEnvironment.context },
+          { services: createServices() },
+        )
+      ).exitCode,
+    ).toBe(1);
+    expect(missingEnvironment.stderr.value).toContain('requires --environment');
+
+    const wrongConfirmation = createCapturedCommandContext('/workspace');
+    expect(
+      (
+        await runInfraCommandAsync(
+          {
+            argv: ['shop', '--environment', 'local', '--confirm', 'other:local'],
+            command,
+            context: wrongConfirmation.context,
+          },
+          { services: createServices() },
+        )
+      ).exitCode,
+    ).toBe(1);
+    expect(wrongConfirmation.stderr.value).toContain('--confirm shop:local');
+  });
 
-    const result = await runInfraCommand(
+  test('maps explicit persistent deletion only to an owned persistent resource', async () => {
+    const requests: InfraDestroyOperationRequest[] = [];
+    const captured = createCapturedCommandContext('/workspace');
+    const result = await runInfraCommandAsync(
       {
-        argv: ['studio'],
-        command,
+        argv: [
+          'shop',
+          '--environment',
+          'local',
+          '--confirm',
+          'shop:local',
+          '--delete-resource',
+          'supabase:database',
+        ],
+        command: requireCommand('destroy'),
         context: captured.context,
       },
-      {
-        services: {
-          resolveProject() {
-            return Promise.resolve({
-              appsRoot: '/workspace/apps',
-              workspaceRoot: '/workspace',
-              manifestPath: '/workspace/apps/studio/ankh.config.json',
-              projectId: 'studio',
-              projectPath: '/workspace/apps/studio',
-              manifest: createAppManifest('studio', { modules: [] }),
-            });
-          },
-          syncProjectInfrastructure() {
-            return Promise.resolve({
-              generated: 0,
-              removed: 0,
-              warnings: [],
-              skipped: {
-                reason: 'apps/studio is the dashboard and is not a generated app target.',
-              },
-            });
-          },
-        },
-      },
+      { services: createServices(requests) },
     );
-
     expect(result.exitCode).toBe(0);
-    expect(captured.stdout.value).toContain('Skipped: apps/studio');
+    expect(requests[0]?.persistence).toEqual({
+      policy: 'delete',
+      confirmedResources: [ledger.resources[0].identity],
+    });
   });
+});
 
-  test('status, up, and down use the runtime script service with the expected sequencing', async () => {
-    const events: string[] = [];
-    const status = findInfraCommandByStandaloneName('status');
-    const up = findInfraCommandByStandaloneName('up');
-    const down = findInfraCommandByStandaloneName('down');
-
-    if (status === null || up === null || down === null) {
-      throw new Error('missing infra commands');
-    }
-
-    const services = {
-      resolveProject() {
-        events.push('resolve-project');
-        return Promise.resolve({
-          appsRoot: '/workspace/apps',
-          workspaceRoot: '/workspace',
-          manifestPath: '/workspace/apps/shop/ankh.config.json',
-          projectId: 'shop',
-          projectPath: '/workspace/apps/shop',
-          manifest: createAppManifest('shop', {
-            deployment: { target: 'minikube', monitoring: false },
-            modules: [],
-          }),
-        });
+const desired = {
+  deployment: {
+    compute: { provider: 'local' },
+    runtime: { provider: 'docker-compose' },
+  },
+} as const satisfies InfraEnvironmentSpec;
+
+const ledger = {
+  schemaVersion: 1,
+  projectId: 'shop',
+  environment: 'local',
+  targets: [],
+  resources: [
+    {
+      identity: {
+        projectId: 'shop',
+        environment: 'local',
+        adapter: 'supabase',
+        resourceId: 'database',
       },
-      resolveProjectInfrastructureTarget() {
-        events.push('resolve-target');
-        return Promise.resolve('minikube');
+      persistent: true,
+      retention: 'retain',
+      dependsOn: [],
+    },
+  ],
+  outputs: [
+    {
+      owner: {
+        projectId: 'shop',
+        environment: 'local',
+        adapter: 'docker-compose',
+        resourceId: 'runtime',
       },
-      syncProjectInfrastructure() {
-        events.push('generate');
-        return Promise.resolve({ generated: 1, removed: 0, warnings: [] });
+      name: 'url',
+      visibility: 'public',
+      value: 'https://example.test',
+      environmentVariable: 'PUBLIC_URL',
+    },
+    {
+      owner: {
+        projectId: 'shop',
+        environment: 'local',
+        adapter: 'supabase-vault',
+        resourceId: 'vault',
       },
-      runProjectInfraScript(args: { readonly script: string }) {
-        events.push(`script:${args.script}`);
-        return Promise.resolve();
+      name: 'password',
+      visibility: 'secret',
+      reference: {
+        source: 'secret-store',
+        projectId: 'shop',
+        environment: 'local',
+        ref: 'database',
+        key: 'password',
       },
-    };
-
-    await runInfraCommand(
-      {
-        argv: ['shop'],
-        command: status,
-        context: createCapturedCommandContext('/workspace').context,
-      },
-      { services },
-    );
-    await runInfraCommand(
-      { argv: ['shop'], command: up, context: createCapturedCommandContext('/workspace').context },
-      { services },
-    );
-    await runInfraCommand(
-      {
-        argv: ['shop'],
-        command: down,
-        context: createCapturedCommandContext('/workspace').context,
-      },
-      { services },
-    );
-
-    expect(events).toEqual([
-      'resolve-project',
-      'resolve-target',
-      'script:status',
-      'resolve-project',
-      'generate',
-      'resolve-target',
-      'script:up',
-      'resolve-project',
-      'resolve-target',
-      'script:down',
-    ]);
+    },
+  ],
+  artifacts: [],
+} as const satisfies InfraLedger;
+
+function createServices(
+  destroyRequests: InfraDestroyOperationRequest[] = [],
+): Partial<InfraCommandServices> {
+  const manifest: AppManifest = createAppManifest('shop', {
+    environments: { local: desired },
+    modules: [],
   });
-
-  test('rejects extra arguments for a command', async () => {
-    const command = findInfraCommandByStandaloneName('validate');
-    const captured = createCapturedCommandContext('/workspace');
-
-    if (command === null) {
-      throw new Error('validate command not found');
-    }
-
-    const result = await runInfraCommand({
-      argv: ['shop', 'extra'],
-      command,
-      context: captured.context,
-    });
-
-    expect(result.exitCode).toBe(1);
-    expect(captured.stderr.value).toContain('accepts at most one project argument');
-  });
-});
+  return {
+    resolveProject: () =>
+      Promise.resolve({
+        appsRoot: '/workspace/apps',
+        workspaceRoot: '/workspace',
+        manifestPath: '/workspace/apps/shop/ankh.config.json',
+        projectId: 'shop',
+        projectPath: '/workspace/apps/shop',
+        manifest,
+      }),
+    readState: () => Promise.resolve({ schemaVersion: 1, desired, ledger }),
+    writeState: () => Promise.resolve(),
+    removeState: () => Promise.resolve(),
+    writeArtifacts: () => Promise.resolve({ written: 0, removed: 0 }),
+    createDependencies: () => ({
+      adapterResolver: { loadAsync: () => Promise.resolve({}) },
+      credentials: { resolveAsync: () => Promise.resolve(success({})) },
+      secrets: { resolveAsync: () => Promise.resolve(success('resolved-secret')) },
+    }),
+    operations: createOperations(destroyRequests),
+  };
+}
+
+function createOperations(
+  destroyRequests: InfraDestroyOperationRequest[],
+): InfraLifecycleOperations {
+  return {
+    validate: () => Promise.resolve(success({ environment: 'local' })),
+    plan: (request) =>
+      Promise.resolve(success({ projectId: request.projectId, environment: 'local', actions: [] })),
+    generate: () => Promise.resolve(success({ environment: 'local', artifacts: [], ledger })),
+    up: () =>
+      Promise.resolve(
+        success({ environment: 'local', targets: [], resources: [], outputs: [], ledger }),
+      ),
+    status: (request) =>
+      Promise.resolve(
+        success({
+          projectId: request.projectId,
+          environment: 'local',
+          state: 'ready',
+          resources: [],
+        }),
+      ),
+    outputs: () => success({ environment: 'local', outputs: ledger.outputs }),
+    down: () => Promise.resolve(success({ environment: 'local', ledger })),
+    destroy: (request) => {
+      destroyRequests.push(request);
+      return Promise.resolve(success({ environment: 'local', ledger: null }));
+    },
+  };
+}
+
+function requireCommand(name: string) {
+  const command = findInfraCommand(name);
+  if (command === null) throw new Error(`Missing command: ${name}`);
+  return command;
+}
+
+function success<T>(value: T): InfraResult<T> {
+  return { ok: true, value, diagnostics: [] };
+}

package/src/{packageMetadata.ts → constants.ts}

@@ -11,14 +11,17 @@ export const INFRA_PACKAGE_VERSION = packageJson.version;
 export const INFRA_COMMAND_CATEGORY = 'infra' as const satisfies AnkhCommandCategory;
 export const INFRA_CAPABILITIES = [
   'infra.validate',
+  'infra.plan',
   'infra.generate',
-  'infra.status',
   'infra.up',
+  'infra.status',
+  'infra.outputs',
   'infra.down',
+  'infra.destroy',
 ] as const satisfies readonly AnkhCapabilityId[];
 
 export const INFRA_PACKAGE_METADATA = {
   category: INFRA_COMMAND_CATEGORY,
-  provider: './dist/ankh.provider.js',
+  provider: './dist/cli/index.js',
   capabilities: INFRA_CAPABILITIES,
 } as const satisfies AnkhPackageMetadata;

package/src/environmentLifecycle.test.ts

@@ -0,0 +1,193 @@
+import type {
+  InfraAdapterDescriptor,
+  InfraComputeAdapter,
+  InfraEnvironmentSpec,
+  InfraResult,
+  InfraRuntimeAdapter,
+  InfraServiceAdapter,
+} from '@ankhorage/contracts/infra';
+import { INFRA_ADAPTER_CATALOG } from '@ankhorage/contracts/infra';
+import { describe, expect, it } from 'bun:test';
+
+import type { InfraAdapterPackageResolver } from './features/environment-lifecycle/application/ports/outbound/infraAdapterPackage';
+import { resolveInfraAdaptersAsync } from './features/environment-lifecycle/application/use-cases/resolveInfraAdaptersAsync';
+import { resolveInfraEnvironment } from './features/environment-lifecycle/domain/resolveInfraEnvironment';
+
+const local = {
+  deployment: { compute: { provider: 'local' }, runtime: { provider: 'docker-compose' } },
+  database: { provider: 'supabase' },
+  auth: { provider: 'supabase' },
+  authz: { provider: 'cerbos', kind: 'ABAC' },
+} as const satisfies InfraEnvironmentSpec;
+const manifest = { environments: { local, preview: local }, modules: [] } as const;
+
+describe('environment safety', () => {
+  it('defaults only to local and requires explicit destroy selection', () => {
+    expect(resolveInfraEnvironment({ manifest, operation: 'up' })).toMatchObject({
+      ok: true,
+      value: { id: 'local' },
+    });
+    expect(resolveInfraEnvironment({ manifest, operation: 'destroy' })).toMatchObject({
+      ok: false,
+      diagnostics: [{ code: 'infra-environment-required' }],
+    });
+  });
+
+  it('accepts configured explicit environments and rejects unknown or absent ones', () => {
+    expect(
+      resolveInfraEnvironment({ manifest, operation: 'up', environment: 'preview' }),
+    ).toMatchObject({ ok: true, value: { id: 'preview' } });
+    expect(
+      resolveInfraEnvironment({ manifest, operation: 'status', environment: 'production' }),
+    ).toMatchObject({ ok: false, diagnostics: [{ code: 'infra-environment-unconfigured' }] });
+    expect(
+      resolveInfraEnvironment({ manifest, operation: 'status', environment: 'staging' }),
+    ).toMatchObject({ ok: false, diagnostics: [{ code: 'infra-environment-invalid' }] });
+  });
+});
+
+describe('selected adapter resolution', () => {
+  it('loads only selected packages and deduplicates the Supabase platform', async () => {
+    const requested: string[] = [];
+    const resolver = createResolver(requested);
+    const result = await resolveInfraAdaptersAsync(local, resolver);
+
+    expect(result.ok).toBe(true);
+    expect(requested).toEqual([
+      '@ankhorage/local',
+      '@ankhorage/docker-compose',
+      '@ankhorage/supabase',
+      '@ankhorage/cerbos',
+    ]);
+    if (!result.ok) throw new Error('Expected adapters.');
+    expect(result.value.services.map(({ descriptor }) => descriptor.id)).toEqual([
+      'supabase',
+      'cerbos',
+    ]);
+  });
+
+  it('fails closed for unavailable and malformed selected packages', async () => {
+    const missing = await resolveInfraAdaptersAsync(local, {
+      loadAsync: () => Promise.reject(new Error('missing')),
+    });
+    expect(missing.ok).toBe(false);
+    expect(
+      missing.diagnostics.every(({ code }) => code === 'infra-adapter-package-unavailable'),
+    ).toBe(true);
+
+    const malformed = await resolveInfraAdaptersAsync(local, {
+      loadAsync: () => Promise.resolve({ createInfraAdapter: () => ({}) }),
+    });
+    expect(malformed.ok).toBe(false);
+    expect(malformed.diagnostics.every(({ code }) => code === 'infra-adapter-module-invalid')).toBe(
+      true,
+    );
+  });
+
+  it('rejects a factory that throws or returns another valid adapter identity', async () => {
+    const throwing = await resolveInfraAdaptersAsync(local, {
+      loadAsync(packageName) {
+        const descriptor = descriptorForPackage(packageName);
+        return Promise.resolve({
+          infraAdapterDescriptor: descriptor,
+          createInfraAdapter: () => {
+            throw new Error('secret provider detail');
+          },
+        });
+      },
+    });
+    expect(throwing.ok).toBe(false);
+    expect(throwing.diagnostics[0]).toMatchObject({ code: 'infra-local-adapter-invalid' });
+    expect(throwing.diagnostics[0]?.message).not.toContain('secret provider detail');
+
+    const mismatched = await resolveInfraAdaptersAsync(local, {
+      loadAsync(packageName) {
+        const descriptor = descriptorForPackage(packageName);
+        return Promise.resolve({
+          infraAdapterDescriptor: descriptor,
+          createInfraAdapter: () =>
+            descriptor.id === 'local'
+              ? createComputeAdapter(INFRA_ADAPTER_CATALOG.hetzner)
+              : createAdapter(descriptor),
+        });
+      },
+    });
+    expect(mismatched.ok).toBe(false);
+    expect(mismatched.diagnostics[0]).toMatchObject({ code: 'infra-local-adapter-invalid' });
+  });
+});
+
+function createResolver(requested: string[]): InfraAdapterPackageResolver {
+  return {
+    loadAsync(packageName) {
+      requested.push(packageName);
+      const descriptor = descriptorForPackage(packageName);
+      return Promise.resolve({
+        infraAdapterDescriptor: descriptor,
+        createInfraAdapter: () => createAdapter(descriptor),
+      });
+    },
+  };
+}
+
+function descriptorForPackage(packageName: string): InfraAdapterDescriptor {
+  const descriptor = Object.values(INFRA_ADAPTER_CATALOG).find(
+    ({ package: candidate }) => candidate === packageName,
+  );
+  if (descriptor === undefined) throw new Error('Unexpected package.');
+  return descriptor;
+}
+
+function createAdapter(descriptor: InfraAdapterDescriptor): unknown {
+  if (descriptor.kind === 'compute') return createComputeAdapter(descriptor);
+  if (descriptor.kind === 'runtime') return createRuntimeAdapter(descriptor);
+  return createServiceAdapter(descriptor);
+}
+
+function createComputeAdapter(descriptor: InfraAdapterDescriptor): InfraComputeAdapter {
+  return {
+    descriptor: descriptor as InfraComputeAdapter['descriptor'],
+    validateAsync: successNull,
+    inspectAsync: () => Promise.resolve(success({ resources: [], outputs: [], targets: [] })),
+    planAsync: successEmpty,
+    ensureAsync: () => Promise.resolve(success({ resources: [], outputs: [], targets: [] })),
+    statusAsync: successEmpty,
+    destroyAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+  };
+}
+
+function createRuntimeAdapter(descriptor: InfraAdapterDescriptor): InfraRuntimeAdapter {
+  return {
+    descriptor: descriptor as InfraRuntimeAdapter['descriptor'],
+    validateAsync: successNull,
+    planAsync: successEmpty,
+    ensureAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+    statusAsync: successEmpty,
+    suspendAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+    destroyAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+  };
+}
+
+function createServiceAdapter(descriptor: InfraAdapterDescriptor): InfraServiceAdapter {
+  return {
+    descriptor: descriptor as InfraServiceAdapter['descriptor'],
+    validateAsync: successNull,
+    planAsync: successEmpty,
+    desiredWorkloadsAsync: successEmpty,
+    reconcileAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+    statusAsync: successEmpty,
+    destroyAsync: () => Promise.resolve(success({ resources: [], outputs: [] })),
+  };
+}
+
+function successNull(): Promise<InfraResult<null>> {
+  return Promise.resolve(success(null));
+}
+
+function successEmpty<T>(): Promise<InfraResult<readonly T[]>> {
+  return Promise.resolve(success([]));
+}
+
+function success<T>(value: T): InfraResult<T> {
+  return { ok: true, value, diagnostics: [] };
+}