@ankhorage/infra 4.1.12 → 5.0.0

package/src/adapters/minikube/base/index.test.ts

@@ -1,693 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-
-import { generateInfrastructure } from '../../../index';
-import { createAppManifest } from '../../../testSupport';
-import type { InfraManifestInput } from '../../../types';
-
-describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
-  test('uses the canonical app slug as the only Minikube profile identity', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      namespaceHint: 'ignored',
-      appManifest: createAppManifest('chess'),
-    });
-    const envExample = getFile(result.files, 'infra/minikube/.env.example');
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-    const downScript = getFile(result.files, 'infra/minikube/scripts/down.sh');
-    const destroyScript = getFile(result.files, 'infra/minikube/scripts/destroy.sh');
-
-    expect(envExample).toContain('ANKH_APP_SLUG=chess');
-    expect(envExample).not.toContain('MINIKUBE_PROFILE=');
-    expect(upScript).toContain('PROFILE="${ANKH_APP_SLUG:-chess}"');
-    expect(upScript).toContain('minikube start -p "${PROFILE}"');
-    expect(upScript).not.toContain('PROFILE="${MINIKUBE_PROFILE:-minikube}"');
-    expect(downScript).toContain('minikube stop -p "${PROFILE}"');
-    expect(destroyScript).toContain('minikube delete -p "${PROFILE}"');
-  });
-
-  test('generates fixed app and supabase namespaces instead of slug namespaces', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('uwm'),
-    });
-    const paths = result.files.map((file) => file.path);
-    const appNamespace = getFile(result.files, 'infra/minikube/k8s/namespaces/app.yaml');
-    const supabaseNamespace = getFile(result.files, 'infra/minikube/k8s/namespaces/supabase.yaml');
-    const appDeployment = getFile(result.files, 'infra/minikube/k8s/app/deployment.yaml');
-    const postgres = getFile(result.files, 'infra/minikube/k8s/supabase/postgres.yaml');
-
-    expect(paths).toContain('infra/minikube/k8s/namespaces/app.yaml');
-    expect(paths).toContain('infra/minikube/k8s/namespaces/supabase.yaml');
-    expect(paths).not.toContain('infra/minikube/k8s/namespace.yaml');
-    expect(appNamespace).toContain('name: app');
-    expect(supabaseNamespace).toContain('name: supabase');
-    expect(appDeployment).toContain('namespace: app');
-    expect(appDeployment).toContain('name: supabase-public-runtime');
-    expect(postgres).toContain('namespace: supabase');
-  });
-
-  test('removes host-level Supabase runtime ownership from generated files', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('scanner'),
-    });
-    const serialized = JSON.stringify(result.files);
-
-    expect(result.files.map((file) => file.path)).not.toContain(
-      'infra/minikube/scripts/supabase-local-env.sh',
-    );
-    expect(serialized).not.toContain('supabase start');
-    expect(serialized).not.toContain('supabase stop');
-    expect(serialized).not.toContain('supabase status');
-    expect(serialized).not.toContain('SUPABASE_PROJECT_DIR');
-    expect(serialized).not.toContain('SUPABASE_LOCAL_PORT');
-    expect(serialized).not.toContain('supabase_*_');
-    expect(serialized).not.toContain('supabase-auth-secrets');
-  });
-
-  test('keeps Supabase migration history but executes against the Kubernetes DB URL', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('scanner'),
-    });
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-    const readme = getFile(result.files, 'infra/minikube/README.md');
-
-    const migrationFunction = upScript.slice(
-      upScript.indexOf('run_supabase_migrations()'),
-      upScript.indexOf('reconcile_supabase_profile()'),
-    );
-
-    expect(migrationFunction).toContain(
-      'SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "${SUPABASE_DB_URL}"',
-    );
-    expect(migrationFunction).not.toContain('supabase migration up --db-url "${SUPABASE_DB_URL}"');
-    expect(migrationFunction).toContain('echo "Applying pending Supabase migrations..."');
-    expect(migrationFunction).toContain('echo "Supabase migrations applied."');
-    expect(upScript).toContain('export SUPABASE_DB_URL PGSSLMODE=disable');
-    expect(upScript).not.toContain('migration up --local');
-    expect(upScript).toContain('cd "${ROOT_DIR}"');
-    expect(migrationFunction).toContain('if [[ "${SUPABASE_RUNTIME_ENABLED}" != "true" ]]; then');
-    expect(migrationFunction).toContain('if [[ -d "${ROOT_DIR}/supabase/migrations" ]]; then');
-    expect(upScript).toContain('set_required_env_default POSTGRES_PASSWORD "$(random_hex 32)"');
-    expect(upScript).not.toContain('set_env_default POSTGRES_PASSWORD "$(random_base64');
-    expect(upScript).toContain(
-      'set_required_env_default SUPABASE_DB_URL "postgres://postgres:${POSTGRES_PASSWORD}@127.0.0.1:${SUPABASE_DB_FORWARD_LOCAL_PORT}/postgres?sslmode=disable"',
-    );
-    expect(upScript).toContain('bootstrap_supabase_database');
-    expect(readme).toContain('Migration authoring/history remains Supabase');
-  });
-
-  test('preserves Supabase-disabled migration behavior', () => {
-    const result = generateInfrastructure(
-      {
-        deployment: {
-          target: 'minikube',
-          monitoring: false,
-        },
-        modules: [],
-      },
-      {
-        appManifest: createAppManifest('frontend-only'),
-      },
-    );
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-    const migrationFunction = upScript.slice(
-      upScript.indexOf('run_supabase_migrations()'),
-      upScript.indexOf('reconcile_supabase_profile()'),
-    );
-
-    expect(upScript).toContain('SUPABASE_RUNTIME_ENABLED="false"');
-    expect(migrationFunction).toContain('if [[ "${SUPABASE_RUNTIME_ENABLED}" != "true" ]]; then');
-    expect(migrationFunction).toContain('return 0');
-  });
-
-  test('lists and generates Supabase Kubernetes bootstrap and gateway contract files', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('scanner'),
-    });
-    const paths = result.files.map((file) => file.path);
-    const readme = getFile(result.files, 'infra/minikube/README.md');
-    const kustomization = getFile(result.files, 'infra/minikube/k8s/kustomization.yaml');
-    const bootstrap = getFile(result.files, 'infra/minikube/k8s/supabase/bootstrap.sql');
-    const postgresInit = getFile(
-      result.files,
-      'infra/minikube/k8s/supabase/postgres.init.configmap.yaml',
-    );
-    const postgres = getFile(result.files, 'infra/minikube/k8s/supabase/postgres.yaml');
-    const auth = getFile(result.files, 'infra/minikube/k8s/supabase/auth.yaml');
-    const envExample = getFile(result.files, 'infra/minikube/.env.example');
-    const gatewayTemplate = getFile(
-      result.files,
-      'infra/minikube/k8s/supabase/gateway.template.yml',
-    );
-    const gateway = getFile(result.files, 'infra/minikube/k8s/supabase/gateway.yaml');
-    const storage = getFile(result.files, 'infra/minikube/k8s/supabase/storage.yaml');
-    const kongEntrypoint = getFile(result.files, 'infra/minikube/k8s/supabase/kong-entrypoint.sh');
-
-    expect(paths).toContain('infra/minikube/k8s/supabase/bootstrap.sql');
-    expect(paths).toContain('infra/minikube/k8s/supabase/postgres.init.configmap.yaml');
-    expect(paths).toContain('infra/minikube/k8s/supabase/gateway.template.yml');
-    expect(paths).toContain('infra/minikube/k8s/supabase/kong-entrypoint.sh');
-    expect(paths).not.toContain('infra/minikube/k8s/supabase/secrets.yaml');
-    expect(readme).toContain('supabase/bootstrap.sql');
-    expect(readme).toContain('supabase/postgres.init.configmap.yaml');
-    expect(readme).toContain('supabase/gateway.template.yml');
-    expect(readme).toContain('supabase/kong-entrypoint.sh');
-    expect(kustomization).not.toContain('supabase/secrets.yaml');
-    expect(kustomization).not.toContain('gateway.configmap.yaml');
-    expect(kustomization).toContain('supabase/postgres.init.configmap.yaml');
-    expect(bootstrap).toContain('CREATE SCHEMA IF NOT EXISTS auth');
-    expect(bootstrap).toContain(
-      'GRANT anon, authenticated, service_role TO supabase_storage_admin',
-    );
-    expect(postgresInit).toContain('alter role postgres with superuser');
-    expect(postgresInit).toContain('grant pg_read_server_files to supabase_admin');
-    expect(postgresInit).toContain('grant execute on function pg_read_file(text) to public');
-    expect(postgres).toContain('name: POSTGRES_USER');
-    expect(postgres).toContain('value: postgres');
-    expect(postgres).toContain('name: PGPORT');
-    expect(postgres).toContain(
-      'mountPath: /docker-entrypoint-initdb.d/99-ankhorage-local-dev-extensions.sql',
-    );
-    expect(postgres).toContain('config_file=/etc/postgresql/postgresql.conf');
-    expect(gatewayTemplate).toContain('keyauth_credentials');
-    expect(gatewayTemplate).toContain('request-transformer');
-    expect(gatewayTemplate).toContain('_format_version: "2.1"');
-    expect(gatewayTemplate).toContain('username: "$DASHBOARD_USERNAME"');
-    expect(gatewayTemplate).toContain('password: "$DASHBOARD_PASSWORD"');
-    expect(kongEntrypoint).toContain('LUA_AUTH_EXPR');
-    expect(auth).toContain('name: GOTRUE_JWT_EXP');
-    expect(auth).toContain('key: JWT_EXPIRY');
-    expect(auth).toContain(
-      'postgres://supabase_auth_admin:$(POSTGRES_PASSWORD)@postgres.supabase.svc.cluster.local:5432/postgres?search_path=auth&sslmode=disable',
-    );
-    expect(storage).toContain(
-      'postgres://supabase_storage_admin:$(POSTGRES_PASSWORD)@postgres.supabase.svc.cluster.local:5432/postgres?search_path=storage&sslmode=disable',
-    );
-    expect(envExample).toContain('PGRST_DB_SCHEMAS=public,storage,graphql_public');
-    expect(auth).toContain('name: GOTRUE_EXTERNAL_EMAIL_ENABLED');
-    expect(auth).toContain('key: ENABLE_EMAIL_SIGNUP');
-    expect(auth).toContain('name: GOTRUE_SMTP_HOST');
-    expect(auth).toContain('name: GOTRUE_SMTP_PORT');
-    expect(auth).toContain('name: GOTRUE_SMTP_USER');
-    expect(auth).toContain('name: GOTRUE_SMTP_PASS');
-    expect(gatewayTemplate).toContain('name: realtime-v1-rest-openapi');
-    expect(gatewayTemplate).toContain('paths: [/realtime/v1/api/openapi]');
-    expect(gatewayTemplate).toContain('name: realtime-v1-rest-tenants');
-    expect(gatewayTemplate).toContain('paths: [/realtime/v1/api/tenants]');
-    expect(gatewayTemplate).toContain('name: request-termination');
-    expect(gatewayTemplate).toContain('status_code: 403');
-    expect(gateway).toContain('mountPath: /home/kong/temp.yml');
-    expect(gateway).toContain('subPath: temp.yml');
-    expect(gateway).toContain('mountPath: /home/kong/kong-entrypoint.sh');
-    expect(gateway).toContain('command: ["kong", "health"]');
-  });
-
-  test('defines reset separately from down and destroy', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('uwm'),
-    });
-    const resetScript = getFile(result.files, 'infra/minikube/scripts/reset.sh');
-    const downScript = getFile(result.files, 'infra/minikube/scripts/down.sh');
-
-    expect(resetScript).toContain('ANKH_RESET_CONFIRM');
-    expect(resetScript).toContain('delete namespace app');
-    expect(resetScript).toContain('delete namespace supabase');
-    expect(resetScript).toContain('does not delete the Minikube profile');
-    expect(downScript).toContain('minikube stop -p "${PROFILE}"');
-    expect(downScript).not.toContain('delete namespace');
-  });
-
-  test('keeps reset scoped to app namespace when Supabase is not generated', () => {
-    const result = generateInfrastructure(
-      {
-        deployment: {
-          target: 'minikube',
-          monitoring: false,
-        },
-      },
-      {
-        appManifest: createAppManifest('plain'),
-      },
-    );
-    const paths = result.files.map((file) => file.path);
-    const resetScript = getFile(result.files, 'infra/minikube/scripts/reset.sh');
-    const statusScript = getFile(result.files, 'infra/minikube/scripts/status.sh');
-
-    expect(paths).not.toContain('infra/minikube/k8s/namespaces/supabase.yaml');
-    expect(resetScript).toContain('delete namespace app');
-    expect(resetScript).not.toContain('delete namespace supabase');
-    expect(resetScript).not.toContain('namespaces/supabase.yaml');
-    expect(statusScript).toContain('for namespace in app; do');
-  });
-
-  test('places standalone provider workloads in provider-owned namespaces', () => {
-    const result = generateInfrastructure(
-      {
-        ...createSupabaseManifest(),
-        auth: {
-          scope: 'global',
-          provider: 'supabase',
-          authorization: {
-            engine: 'cerbos',
-            kind: 'RBAC',
-          },
-        },
-      },
-      {
-        appManifest: createAppManifest('authz-app'),
-      },
-    );
-    const paths = result.files.map((file) => file.path);
-    const kustomization = getFile(result.files, 'infra/minikube/k8s/kustomization.yaml');
-    const readme = getFile(result.files, 'infra/minikube/README.md');
-    const cerbosDeployment = getFile(
-      result.files,
-      'infra/minikube/k8s/authz/cerbos/cerbos.deployment.yaml',
-    );
-    const envExample = getFile(result.files, 'infra/minikube/.env.example');
-    const resetScript = getFile(result.files, 'infra/minikube/scripts/reset.sh');
-    const statusScript = getFile(result.files, 'infra/minikube/scripts/status.sh');
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-
-    expect(paths).toContain('infra/minikube/k8s/namespaces/cerbos.yaml');
-    expect(kustomization).toContain('namespaces/cerbos.yaml');
-    expect(readme).toContain('- Provider namespaces: `cerbos`');
-    expect(readme).toContain('## Provider Lifecycle Contributions');
-    expect(readme).not.toContain('\n\n\n## Provider Lifecycle Contributions');
-    expect(readme).toContain('`cerbos`: namespace `cerbos`');
-    expect(readme).toContain('`deployment/cerbos` in namespace `cerbos`');
-    expect(readme).toContain('`http` = `http://cerbos.cerbos.svc.cluster.local:3592`');
-    expect(cerbosDeployment).toContain('namespace: cerbos');
-    expect(cerbosDeployment).not.toContain('namespace: app');
-    expect(envExample).toContain('CERBOS_URL=http://cerbos.cerbos.svc.cluster.local:3592');
-    expect(resetScript).toContain('delete namespace cerbos');
-    expect(upScript).toContain('wait_for_provider_readiness');
-    expect(upScript).toContain('run_provider_migrations');
-    expect(upScript).toContain('run_provider_reconciliation');
-    expect(upScript).toContain('rollout status "deployment/cerbos" --timeout=180s');
-    expect(upScript.indexOf('kubectl --context "${PROFILE}" apply -k "${K8S_DIR}"')).toBeLessThan(
-      upScript.lastIndexOf('wait_for_provider_readiness'),
-    );
-    expect(statusScript).toContain('for namespace in app supabase cerbos; do');
-    expect(statusScript).toContain(
-      '- provider cerbos endpoint/http: http://cerbos.cerbos.svc.cluster.local:3592',
-    );
-    expect(statusScript).toContain('- provider cerbos/cerbos: ready');
-  });
-
-  test('uses generated Supabase runtime ownership as an immutable script decision', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('scanner'),
-    });
-    const envExample = getFile(result.files, 'infra/minikube/.env.example');
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-
-    expect(envExample).not.toContain('SUPABASE_RUNTIME_ENABLED=');
-    expect(upScript).toContain('SUPABASE_RUNTIME_ENABLED="true"');
-    expect(upScript).not.toContain('SUPABASE_RUNTIME_ENABLED="${SUPABASE_RUNTIME_ENABLED');
-  });
-
-  test('wires configured OAuth providers into GoTrue runtime env without serializing secrets', () => {
-    const result = generateInfrastructure(
-      {
-        ...createSupabaseManifest(),
-        secretStore: {
-          provider: 'supabase-vault',
-        },
-        auth: {
-          scope: 'global',
-          provider: 'supabase',
-          oauth: {
-            enabled: true,
-            callbackRoute: '/auth/callback',
-            providers: [
-              {
-                id: 'google',
-                enabled: true,
-                credentialsRef: 'auth/oauth/google',
-              },
-            ],
-          },
-        },
-      },
-      {
-        appManifest: createAppManifest('oauth-app'),
-      },
-    );
-    const envExample = getFile(result.files, 'infra/minikube/.env.example');
-    const readme = getFile(result.files, 'infra/minikube/README.md');
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-
-    expect(envExample).toContain('# google: auth/oauth/google');
-    expect(readme).not.toContain('credentialsRef` entries.\n\n\nPinned images:');
-    expect(envExample).toContain('GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID=');
-    expect(envExample).toContain('GOTRUE_EXTERNAL_GOOGLE_SECRET=');
-    expect(upScript).toContain('GOTRUE_EXTERNAL_GOOGLE_ENABLED=true');
-    expect(upScript).toContain(
-      'GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID=${GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID}',
-    );
-    expect(upScript).toContain('credentialsRef auth/oauth/google');
-    expect(upScript).toContain("resolve_vault_secret_field 'auth/oauth/google' 'clientSecret'");
-    expect(upScript).toContain(
-      'set_required_env_default ADDITIONAL_REDIRECT_URLS "$(derive_additional_redirect_urls)"',
-    );
-    expect(upScript).toContain('site_url_without_slash}/${callback_path}');
-    expect(upScript).toContain('OAUTH_NATIVE_REDIRECT_URLS');
-    expect(upScript).not.toContain('write_env_value GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID');
-    expect(upScript).not.toContain('write_env_value GOTRUE_EXTERNAL_GOOGLE_SECRET');
-    expect(upScript).not.toContain('sentinel-client-secret-value');
-  });
-
-  test('generates required secrets even when copied env example contains empty keys', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('scanner'),
-    });
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-
-    expect(upScript).toContain('load_env_file_preserving_process_env');
-    expect(upScript).toContain('APP_IMAGE="${APP_IMAGE:-}"');
-    expect(upScript).toContain(
-      'load_env_file_preserving_process_env\nSUPABASE_RUNTIME_ENABLED="true"',
-    );
-    expect(upScript.indexOf('load_env_file_preserving_process_env')).toBeLessThan(
-      upScript.lastIndexOf('APP_IMAGE="${APP_IMAGE:-ankh/scanner:dev}"'),
-    );
-    expect(upScript).toContain('set_required_env_default POSTGRES_PASSWORD "$(random_hex 32)"');
-    expect(upScript).toContain('write_env_value "${key}" "${value}"');
-    expect(upScript).toContain('set_optional_env_default SMTP_USER ""');
-  });
-
-  test('syncs browser-safe Supabase env into the generated app env.local before build', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('books'),
-    });
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-    const buildScript = getFile(result.files, 'infra/minikube/scripts/build-app-image.sh');
-    const readme = getFile(result.files, 'infra/minikube/README.md');
-
-    expect(upScript).toContain('sync_app_public_supabase_env()');
-    expect(upScript).toContain('local app_env_file="${APP_SOURCE_DIR}/.env.local"');
-    expect(upScript).toContain(
-      'write_key_value_file_value "${app_env_file}" "EXPO_PUBLIC_SUPABASE_URL" "${EXPO_PUBLIC_SUPABASE_URL}"',
-    );
-    expect(upScript).toContain(
-      'write_key_value_file_value "${app_env_file}" "EXPO_PUBLIC_SUPABASE_ANON_KEY" "${EXPO_PUBLIC_SUPABASE_ANON_KEY}"',
-    );
-    expect(upScript).toContain('ensure_supabase_runtime_env\nsync_app_public_supabase_env');
-    expect(upScript.lastIndexOf('sync_app_public_supabase_env')).toBeLessThan(
-      upScript.indexOf(
-        'if [[ "${APP_RUNTIME_ENABLED}" == "true" && "${APP_BUILD_ENABLED}" == "true" ]]',
-      ),
-    );
-    expect(upScript).not.toContain('SUPABASE_SERVICE_ROLE_KEY" "${SUPABASE_SERVICE_ROLE_KEY}"');
-    expect(buildScript).toContain('EXPO_CLI="${APP_SOURCE_DIR}/node_modules/.bin/expo"');
-    expect(buildScript).toContain(
-      '"${EXPO_CLI}" export --platform web --clear --output-dir "${APP_WEB_EXPORT_DIR}"',
-    );
-    expect(buildScript).not.toContain('bunx');
-    expect(readme).toContain(
-      '`build-app-image.sh` requires the app-installed `node_modules/.bin/expo` and never resolves',
-    );
-    expect(readme).toContain('Expo globally or through the network.');
-    expect(readme).toContain('It clears the Expo/Metro bundler cache before every web');
-  });
-
-  test('starts Supabase schema owners before app migrations and profile reconciliation', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('scanner'),
-    });
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-
-    expect(upScript).toContain('apply_supabase_runtime_workloads');
-    expect(upScript).toContain('exec deployment/postgres -- psql -U postgres');
-    expect(upScript).toContain('create schema if not exists vault');
-    expect(upScript).toContain('grant execute on function pg_read_file(text) to public');
-    expect(upScript.indexOf('postgres.init.configmap.yaml')).toBeLessThan(
-      upScript.indexOf('postgres.pvc.yaml'),
-    );
-    expect(upScript.lastIndexOf('  wait_for_supabase_database')).toBeLessThan(
-      upScript.lastIndexOf('  bootstrap_supabase_database'),
-    );
-    expect(upScript).toContain('rollout status deployment/postgres --timeout=900s');
-    expect(upScript).toContain('rollout status deployment/gateway --timeout=600s');
-    const runMigrationsCallIndex = upScript.lastIndexOf('  run_supabase_migrations');
-    const reconcileProfileCallIndex = upScript.lastIndexOf('  reconcile_supabase_profile');
-    const appRuntimeApplyIndex = upScript.lastIndexOf(
-      'kubectl --context "${PROFILE}" apply -k "${K8S_DIR}"',
-    );
-
-    expect(upScript.lastIndexOf('  apply_supabase_runtime_workloads')).toBeLessThan(
-      upScript.indexOf('rollout status deployment/auth'),
-    );
-    expect(upScript.indexOf('rollout status deployment/auth')).toBeLessThan(runMigrationsCallIndex);
-    expect(upScript.indexOf('rollout status deployment/storage')).toBeLessThan(
-      runMigrationsCallIndex,
-    );
-    expect(upScript.indexOf('  reconcile_supabase_profile')).toBeLessThan(
-      upScript.indexOf('  reload_postgrest_schema'),
-    );
-    expect(upScript.indexOf('rollout status deployment/studio')).toBeLessThan(
-      upScript.indexOf('"${PORT_FORWARD_SCRIPT}" start studio'),
-    );
-    expect(runMigrationsCallIndex).toBeLessThan(reconcileProfileCallIndex);
-    expect(reconcileProfileCallIndex).toBeLessThan(appRuntimeApplyIndex);
-  });
-
-  test('treats port-forwards as slug-owned lifecycle resources', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('uwm'),
-    });
-    const portForwardScript = getFile(result.files, 'infra/minikube/scripts/port-forward.sh');
-    const statusScript = getFile(result.files, 'infra/minikube/scripts/status.sh');
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-    const downScript = getFile(result.files, 'infra/minikube/scripts/down.sh');
-
-    expect(portForwardScript).toContain('service/app-runtime');
-    expect(portForwardScript).toContain('service/gateway');
-    expect(portForwardScript).toContain('service/studio');
-    expect(portForwardScript).toContain('service/postgres');
-    expect(portForwardScript).toContain('RUNTIME_FORWARD_NAMES=(app supabase-gateway)');
-    expect(portForwardScript).toContain(
-      'ALL_FORWARD_NAMES=(app supabase-gateway studio db-migration)',
-    );
-    expect(portForwardScript).toContain(
-      'start:runtime) for_each_forward start app supabase-gateway',
-    );
-    expect(portForwardScript).toContain('for_each_forward stop app supabase-gateway');
-    expect(portForwardScript).toContain(
-      'status:runtime) for_each_forward status app supabase-gateway',
-    );
-    expect(portForwardScript).toContain('${PROFILE}-${1}.pid');
-    expect(portForwardScript).toContain('crashed stale_pid');
-    expect(portForwardScript).toContain('is_port_accepting()');
-    expect(portForwardScript).toContain('recent kubectl port-forward log');
-    expect(portForwardScript).toContain('did not become ready on local port');
-    expect(portForwardScript).toContain('not ready pid=');
-    expect(portForwardScript).toContain('terminate_forward_process()');
-    expect(portForwardScript).toContain('ps -p "${pid}" -o command=');
-    expect(portForwardScript).toContain('ps -p "${pid}" -o comm=');
-    expect(portForwardScript).toContain('is_owned_forward_process()');
-    expect(portForwardScript).toContain(
-      '*"kubectl --context ${PROFILE} -n ${namespace} port-forward ${resource} ${local_port}:${remote_port}"*',
-    );
-    expect(portForwardScript).toContain('kill -KILL "${pid}"');
-    expect(portForwardScript).toContain('failed to stop owned port-forward pid');
-    expect(portForwardScript).toContain('local port ${local_port} is still accepting connections');
-    expect(portForwardScript).toContain('refusing to terminate non-owned live pid');
-    expect(portForwardScript).toContain(
-      'stale pid file pointed at non-owned live pid ${pid}; removing ownership record ${pid_file}',
-    );
-    expect(portForwardScript).toContain(
-      'port occupied by non-owned process on local port ${local_port}',
-    );
-    expect(portForwardScript).toContain('stale_pid_non_owned=${pid}');
-    expect(statusScript).toContain('port-forward.sh" status all');
-    expect(upScript).toContain('set -Eeuo pipefail');
-    expect(upScript).toContain('trap cleanup_failed_up ERR');
-    expect(upScript).toContain('start supabase-gateway');
-    expect(upScript).toContain('start db-migration');
-    expect(upScript).toContain('Failed to start db-migration port-forward for Supabase bootstrap.');
-    expect(upScript.indexOf('trap cleanup_failed_up ERR')).toBeLessThan(
-      upScript.indexOf('require_command minikube'),
-    );
-    expect(upScript).toContain('trap - ERR');
-    expect(downScript).toContain('port-forward.sh" stop all');
-  });
-
-  test('generates an app-only runtime forward group without Supabase', () => {
-    const result = generateInfrastructure(
-      {
-        deployment: {
-          target: 'minikube',
-          monitoring: false,
-        },
-        modules: [],
-      },
-      {
-        appManifest: createAppManifest('frontend-only'),
-      },
-    );
-    const portForwardScript = getFile(result.files, 'infra/minikube/scripts/port-forward.sh');
-
-    expect(portForwardScript).toContain('RUNTIME_FORWARD_NAMES=(app)');
-    expect(portForwardScript).toContain('ALL_FORWARD_NAMES=(app)');
-    expect(portForwardScript).toContain(
-      'OBSOLETE_FORWARD_NAMES=(supabase-gateway studio db-migration)',
-    );
-    expect(portForwardScript).not.toContain('RUNTIME_FORWARD_NAMES=(app supabase-gateway)');
-  });
-
-  test('reconciles a generated Web topology to the exact native-only desired topology', () => {
-    const baseManifest = createAppManifest('topology-upgrade');
-    const webResult = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: {
-        ...baseManifest,
-        deploy: { targets: { web: { enabled: true } } },
-      },
-    });
-    const nativeResult = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: {
-        ...baseManifest,
-        deploy: {
-          targets: {
-            android: { enabled: true, package: 'com.ankh.topologyupgrade' },
-          },
-        },
-      },
-    });
-    const webPaths = webResult.files.map((file) => file.path);
-    const nativePaths = nativeResult.files.map((file) => file.path);
-    const webAppConfig = getFile(webResult.files, 'infra/minikube/k8s/app.configmap.yaml');
-    const webUpScript = getFile(webResult.files, 'infra/minikube/scripts/up.sh');
-    const nativeUpScript = getFile(nativeResult.files, 'infra/minikube/scripts/up.sh');
-    const nativePortForwardScript = getFile(
-      nativeResult.files,
-      'infra/minikube/scripts/port-forward.sh',
-    );
-    const exactDelete =
-      'delete deployment/app-runtime service/app-runtime configmap/app-infra-config --ignore-not-found';
-
-    expect(webPaths).toContain('infra/minikube/k8s/app/deployment.yaml');
-    expect(webPaths).toContain('infra/minikube/k8s/app/service.yaml');
-    expect(webPaths).toContain('infra/minikube/k8s/app.configmap.yaml');
-    expect(webAppConfig).toContain('name: app-infra-config');
-    expect(getFile(webResult.files, 'infra/minikube/scripts/port-forward.sh')).toContain(
-      'RUNTIME_FORWARD_NAMES=(app supabase-gateway)',
-    );
-
-    expect(nativePaths).not.toContain('infra/minikube/k8s/app/deployment.yaml');
-    expect(nativePaths).not.toContain('infra/minikube/k8s/app/service.yaml');
-    expect(nativePaths).not.toContain('infra/minikube/k8s/app.configmap.yaml');
-    expect(nativeUpScript).toContain(exactDelete);
-    expect(nativeUpScript).toContain('"${PORT_FORWARD_SCRIPT}" stop obsolete');
-    expect(nativeUpScript.indexOf(exactDelete)).toBeLessThan(
-      nativeUpScript.indexOf('"${PORT_FORWARD_SCRIPT}" stop obsolete'),
-    );
-    expect(nativePortForwardScript).toContain(
-      'MANAGED_FORWARD_NAMES=(app supabase-gateway studio db-migration)',
-    );
-    expect(nativePortForwardScript).toContain('OBSOLETE_FORWARD_NAMES=(app)');
-    expect(webUpScript).not.toContain(exactDelete);
-    expect(webUpScript).not.toContain('stop obsolete');
-  });
-
-  test('derives native-only runtime topology without a fictional Kubernetes app service', () => {
-    const appManifest = {
-      ...createAppManifest('native-only'),
-      deploy: {
-        targets: {
-          android: { enabled: true, package: 'com.ankh.nativeonly' },
-          ios: { enabled: true, bundleIdentifier: 'com.ankh.nativeonly' },
-        },
-      },
-    };
-    const result = generateInfrastructure(createSupabaseManifest(), { appManifest });
-    const paths = result.files.map((file) => file.path);
-    const kustomization = getFile(result.files, 'infra/minikube/k8s/kustomization.yaml');
-    const portForwardScript = getFile(result.files, 'infra/minikube/scripts/port-forward.sh');
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-    const readme = getFile(result.files, 'infra/minikube/README.md');
-
-    expect(paths).not.toContain('infra/minikube/k8s/app/deployment.yaml');
-    expect(paths).not.toContain('infra/minikube/k8s/app/service.yaml');
-    expect(paths).not.toContain('infra/minikube/k8s/app.configmap.yaml');
-    expect(kustomization).not.toContain('app/deployment.yaml');
-    expect(kustomization).not.toContain('app/service.yaml');
-    expect(portForwardScript).toContain('RUNTIME_FORWARD_NAMES=(supabase-gateway)');
-    expect(portForwardScript).toContain('ALL_FORWARD_NAMES=(supabase-gateway studio db-migration)');
-    expect(portForwardScript).toContain(
-      'MANAGED_FORWARD_NAMES=(app supabase-gateway studio db-migration)',
-    );
-    expect(portForwardScript).toContain('OBSOLETE_FORWARD_NAMES=(app)');
-    expect(portForwardScript).toContain('${name}: skipped (Web app runtime disabled)');
-    expect(upScript).toContain('APP_RUNTIME_ENABLED="false"');
-    expect(upScript).toContain(
-      'delete deployment/app-runtime service/app-runtime configmap/app-infra-config --ignore-not-found',
-    );
-    expect(readme).toContain('disabled (no enabled Web deploy target)');
-    expect(JSON.stringify(result.files)).not.toContain('adb');
-    expect(JSON.stringify(result.files)).not.toContain('10.0.2.2');
-  });
-
-  test('keeps legacy manifests without deploy targets on the Web app runtime topology', () => {
-    const result = generateInfrastructure(createSupabaseManifest(), {
-      appManifest: createAppManifest('legacy-web'),
-    });
-    const paths = result.files.map((file) => file.path);
-    const portForwardScript = getFile(result.files, 'infra/minikube/scripts/port-forward.sh');
-    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
-
-    expect(paths).toContain('infra/minikube/k8s/app/service.yaml');
-    expect(portForwardScript).toContain('RUNTIME_FORWARD_NAMES=(app supabase-gateway)');
-    expect(portForwardScript).toContain('OBSOLETE_FORWARD_NAMES=()');
-    expect(upScript).not.toContain('delete deployment/app-runtime');
-  });
-
-  test('generates an empty provider-agnostic runtime group when no host target exists', () => {
-    const appManifest = {
-      ...createAppManifest('native-no-provider'),
-      deploy: {
-        targets: {
-          android: { enabled: true, package: 'com.ankh.nativeproviderless' },
-        },
-      },
-    };
-    const result = generateInfrastructure(
-      { deployment: { target: 'minikube', monitoring: false }, modules: [] },
-      { appManifest },
-    );
-    const portForwardScript = getFile(result.files, 'infra/minikube/scripts/port-forward.sh');
-
-    expect(portForwardScript).toContain('RUNTIME_FORWARD_NAMES=()');
-    expect(portForwardScript).toContain('ALL_FORWARD_NAMES=()');
-    expect(portForwardScript).toContain(
-      'OBSOLETE_FORWARD_NAMES=(app supabase-gateway studio db-migration)',
-    );
-  });
-});
-
-function createSupabaseManifest(): InfraManifestInput {
-  return {
-    deployment: {
-      target: 'minikube',
-      monitoring: false,
-    },
-    auth: {
-      scope: 'global',
-      provider: 'supabase',
-    },
-    database: {
-      provider: 'supabase',
-      tier: 'dev',
-    },
-    storage: {
-      provider: 'supabase',
-      buckets: ['assets'],
-    },
-    modules: [],
-  };
-}
-
-function getFile(files: readonly { path: string; content: string }[], path: string): string {
-  const file = files.find((candidate) => candidate.path === path);
-  if (!file) throw new Error(`Missing generated file: ${path}`);
-  return file.content;
-}