@ankhorage/infra 4.1.12 → 5.1.0

package/src/project.test.ts

@@ -3,216 +3,66 @@ import { promises as fs } from 'fs';
 import os from 'os';
 import path from 'path';
 
-import { resolveInfraProject } from './project.js';
-import { createAppManifest, createWorkspaceFixture } from './testSupport.js';
+import { resolveInfraProjectAsync } from './features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';
+import { createWorkspaceFixture } from './testSupport.js';
 
-const tempRoots = new Set<string>();
+const temporaryPaths = new Set<string>();
 
 afterEach(async () => {
   await Promise.all(
-    [...tempRoots].map((rootPath) => fs.rm(rootPath, { force: true, recursive: true })),
+    [...temporaryPaths].map((entry) => fs.rm(entry, { force: true, recursive: true })),
   );
-  tempRoots.clear();
+  temporaryPaths.clear();
 });
 
-describe('resolveInfraProject', () => {
-  test('resolves an explicit project id from the workspace root', async () => {
+describe('project resolution', () => {
+  test('resolves explicit and cwd-inferred projects with canonical manifests', async () => {
     const fixture = await createWorkspaceFixture();
-    tempRoots.add(fixture.rootPath);
-
-    const project = await resolveInfraProject({
+    temporaryPaths.add(fixture.rootPath);
+    const explicit = await resolveInfraProjectAsync({
       cwd: fixture.rootPath,
       projectId: fixture.projectId,
     });
-
-    expect(project.projectId).toBe('shop');
-    expect(project.projectPath).toBe(fixture.projectPath);
-    expect(project.workspaceRoot).toBe(fixture.rootPath);
-  });
-
-  test('infers the project id from cwd inside apps/<project>', async () => {
-    const fixture = await createWorkspaceFixture();
-    tempRoots.add(fixture.rootPath);
-
-    const nestedPath = path.join(fixture.projectPath, 'src', 'modules');
-    await fs.mkdir(nestedPath, { recursive: true });
-
-    const project = await resolveInfraProject({
-      cwd: nestedPath,
-    });
-
-    expect(project.projectId).toBe('shop');
-    expect(project.projectPath).toBe(fixture.projectPath);
-  });
-
-  test('loads the fallback manifest when ankh.config.json is missing', async () => {
-    const fixture = await createWorkspaceFixture({
-      manifestFile: 'missing',
-    });
-    tempRoots.add(fixture.rootPath);
-
-    const project = await resolveInfraProject({
-      cwd: fixture.rootPath,
-      projectId: fixture.projectId,
-    });
-
-    expect(project.manifest.metadata.name).toBe('shop');
-    expect(project.manifest.metadata.slug).toBe('shop');
-    expect(project.manifest.infra.modules).toEqual([]);
-  });
-
-  test('rejects malformed manifest JSON', async () => {
-    const fixture = await createWorkspaceFixture({
-      manifestFile: 'invalid-json',
-    });
-    tempRoots.add(fixture.rootPath);
-
-    await expectRejectMessage(
-      resolveInfraProject({
-        cwd: fixture.rootPath,
-        projectId: fixture.projectId,
-      }),
-      'Project manifest is not valid JSON',
-    );
-  });
-
-  test('rejects traversal project ids', async () => {
-    const fixture = await createWorkspaceFixture();
-    tempRoots.add(fixture.rootPath);
-
-    await expectRejectMessage(
-      resolveInfraProject({
-        cwd: fixture.rootPath,
-        projectId: '../shop',
-      }),
-      'Invalid project id:',
+    const inferred = await resolveInfraProjectAsync({ cwd: fixture.projectPath });
+    expect(explicit.projectPath).toBe(fixture.projectPath);
+    expect(inferred.projectId).toBe(fixture.projectId);
+    expect(explicit.manifest.infra.environments.local.deployment.runtime.provider).toBe(
+      'docker-compose',
     );
   });
 
-  test('rejects explicit project ids with nested traversal segments', async () => {
-    const fixture = await createWorkspaceFixture();
-    tempRoots.add(fixture.rootPath);
-
-    await expectRejectMessage(
-      resolveInfraProject({
-        cwd: fixture.rootPath,
-        projectId: 'shop/../other',
-      }),
-      'Invalid project id:',
-    );
+  test('requires a real manifest and rejects malformed JSON', async () => {
+    const missing = await createWorkspaceFixture({ manifestFile: 'missing' });
+    const invalid = await createWorkspaceFixture({ manifestFile: 'invalid-json' });
+    temporaryPaths.add(missing.rootPath);
+    temporaryPaths.add(invalid.rootPath);
+    expect(
+      await captureError(resolveInfraProjectAsync({ cwd: missing.rootPath, projectId: 'shop' })),
+    ).toContain('Project manifest not found');
+    expect(
+      await captureError(resolveInfraProjectAsync({ cwd: invalid.rootPath, projectId: 'shop' })),
+    ).toContain('Project manifest is not valid JSON');
   });
 
-  test('rejects explicit absolute project ids', async () => {
+  test('rejects traversal and projects outside an Ankh workspace', async () => {
     const fixture = await createWorkspaceFixture();
-    tempRoots.add(fixture.rootPath);
-
-    await expectRejectMessage(
-      resolveInfraProject({
-        cwd: fixture.rootPath,
-        projectId: '/tmp/shop',
-      }),
-      'Invalid project id:',
-    );
-  });
-
-  test('rejects explicit dot project ids', async () => {
-    const fixture = await createWorkspaceFixture();
-    tempRoots.add(fixture.rootPath);
-
-    await expectRejectMessage(
-      resolveInfraProject({
-        cwd: fixture.rootPath,
-        projectId: '.',
-      }),
-      'Invalid project id:',
-    );
-  });
-
-  test('rejects explicit dot-dot project ids', async () => {
-    const fixture = await createWorkspaceFixture();
-    tempRoots.add(fixture.rootPath);
-
-    await expectRejectMessage(
-      resolveInfraProject({
-        cwd: fixture.rootPath,
-        projectId: '..',
-      }),
-      'Invalid project id:',
-    );
-  });
-
-  test('rejects explicit empty project ids', async () => {
-    const fixture = await createWorkspaceFixture();
-    tempRoots.add(fixture.rootPath);
-
-    await expectRejectMessage(
-      resolveInfraProject({
-        cwd: fixture.rootPath,
-        projectId: '',
-      }),
-      'Invalid project id:',
-    );
-  });
-
-  test('rejects explicit blank project ids', async () => {
-    const fixture = await createWorkspaceFixture();
-    tempRoots.add(fixture.rootPath);
-
-    await expectRejectMessage(
-      resolveInfraProject({
-        cwd: fixture.rootPath,
-        projectId: '   ',
-      }),
-      'Invalid project id:',
-    );
-  });
-
-  test('fails when no workspace root can be found', async () => {
-    const rootPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-no-root-'));
-    tempRoots.add(rootPath);
-
-    await expectRejectMessage(
-      resolveInfraProject({
-        cwd: rootPath,
-        projectId: 'shop',
-      }),
-      'Could not find an Ankh workspace root',
-    );
-  });
-
-  test('reads a valid project manifest', async () => {
-    const manifest = createAppManifest('cards', {
-      deployment: {
-        monitoring: false,
-        target: 'minikube',
-      },
-      modules: [],
-    });
-    const fixture = await createWorkspaceFixture({
-      manifest,
-      projectId: 'cards',
-    });
-    tempRoots.add(fixture.rootPath);
-
-    const project = await resolveInfraProject({
-      cwd: fixture.rootPath,
-      projectId: 'cards',
-    });
-
-    expect(project.manifest.metadata.name).toBe('cards');
-    expect(project.manifest.infra.deployment?.target).toBe('minikube');
+    const outside = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-outside-'));
+    temporaryPaths.add(fixture.rootPath);
+    temporaryPaths.add(outside);
+    expect(
+      await captureError(resolveInfraProjectAsync({ cwd: fixture.rootPath, projectId: '../shop' })),
+    ).toContain('Invalid project id');
+    expect(
+      await captureError(resolveInfraProjectAsync({ cwd: outside, projectId: 'shop' })),
+    ).toContain('Could not find an Ankh workspace root');
   });
 });
 
-async function expectRejectMessage(promise: Promise<unknown>, text: string): Promise<void> {
-  let didReject = false;
-
+async function captureError(operation: Promise<unknown>): Promise<string> {
   try {
-    await promise;
+    await operation;
   } catch (error) {
-    didReject = true;
-    expect(error instanceof Error ? error.message : String(error)).toContain(text);
+    return error instanceof Error ? error.message : String(error);
   }
-
-  expect(didReject).toBe(true);
+  throw new Error('Expected operation to fail.');
 }

package/src/projectContractsParser.test.ts

@@ -2,7 +2,7 @@ import { afterEach, expect, test } from 'bun:test';
 import { promises as fs } from 'fs';
 import path from 'path';
 
-import { resolveInfraProject } from './project.js';
+import { resolveInfraProjectAsync } from './features/environment-lifecycle/adapters/outbound/resolveInfraProjectAsync.js';
 import { createAppManifest, createWorkspaceFixture } from './testSupport.js';
 
 const tempRoots = new Set<string>();
@@ -33,7 +33,7 @@ test('Infra rejects nested manifest shapes rejected by Contracts', async () => {
   );
 
   const error = await captureError(
-    resolveInfraProject({ cwd: fixture.rootPath, projectId: fixture.projectId }),
+    resolveInfraProjectAsync({ cwd: fixture.rootPath, projectId: fixture.projectId }),
   );
   expect(error.message).toContain('Project manifest has an invalid shape');
 });

package/src/projectInfrastructure.test.ts

@@ -1,203 +1,148 @@
+import type { InfraGeneratedArtifact, InfraLedger } from '@ankhorage/contracts/infra';
 import { afterEach, describe, expect, test } from 'bun:test';
 import { promises as fs } from 'fs';
 import os from 'os';
 import path from 'path';
 
 import {
+  readStoredInfraStateAsync,
+  removeStoredInfraStateAsync,
   resolveProjectFile,
-  resolveProjectInfrastructureTarget,
-  syncProjectInfrastructure,
-} from './projectInfrastructure.js';
-import { createAppManifest } from './testSupport.js';
+  writeInfraGeneratedArtifactsAsync,
+  writeStoredInfraStateAsync,
+} from './project/index.js';
 
-const tempRoots = new Set<string>();
+const temporaryPaths = new Set<string>();
 
 afterEach(async () => {
   await Promise.all(
-    [...tempRoots].map((rootPath) => fs.rm(rootPath, { force: true, recursive: true })),
+    [...temporaryPaths].map((entry) => fs.rm(entry, { force: true, recursive: true })),
   );
-  tempRoots.clear();
+  temporaryPaths.clear();
 });
 
-describe('project infrastructure sync', () => {
-  test('writes generated files and the infra ledger', async () => {
-    const projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-sync-'));
-    tempRoots.add(projectPath);
-
-    const result = await syncProjectInfrastructure({
-      projectId: 'shop',
-      projectPath,
-      manifest: createAppManifest('shop', {
-        deployment: { target: 'minikube', monitoring: false },
-        modules: [],
-      }),
-      generateInfrastructureImpl() {
-        return {
-          files: [
-            {
-              path: 'infra/minikube/scripts/status.sh',
-              content: '#!/usr/bin/env bash\n',
-              executable: true,
-            },
-            { path: 'infra/minikube/.env.example', content: 'APP_PORT=1\n' },
-          ],
-          warnings: ['generated warning'],
-          meta: {
-            target: 'minikube',
-            providers: [],
-          },
-          dependencies: [],
-        };
-      },
-    });
-
-    expect(result.generated).toBe(2);
-    expect(result.removed).toBe(0);
-    expect(result.warnings).toEqual(['generated warning']);
-    expect(await fs.readFile(path.join(projectPath, 'infra/minikube/.env.example'), 'utf8')).toBe(
-      'APP_PORT=1\n',
-    );
-
-    const ledger = JSON.parse(
-      await fs.readFile(path.join(projectPath, '.ankh/infra-ledger.json'), 'utf8'),
-    ) as {
-      readonly target: string;
-      readonly files: readonly string[];
-    };
-    expect(ledger.target).toBe('minikube');
-    expect(ledger.files).toEqual([
-      'infra/minikube/.env.example',
-      'infra/minikube/scripts/status.sh',
-    ]);
-  });
-
-  test('removes stale files when regeneration shrinks the output set', async () => {
-    const projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-stale-'));
-    tempRoots.add(projectPath);
-
-    const manifest = createAppManifest('shop', {
-      deployment: { target: 'minikube', monitoring: false },
-      modules: [],
-    });
-
-    await syncProjectInfrastructure({
-      projectId: 'shop',
-      projectPath,
-      manifest,
-      generateInfrastructureImpl() {
-        return {
-          files: [
-            { path: 'infra/minikube/scripts/status.sh', content: 'first' },
-            { path: 'infra/minikube/scripts/up.sh', content: 'extra' },
-          ],
-          warnings: [],
-          meta: { target: 'minikube', providers: [] },
-          dependencies: [],
-        };
-      },
+describe('project Infra state and artifacts', () => {
+  test('persists environment-scoped desired state and a secret-safe ledger', async () => {
+    const projectPath = await temporaryProject();
+    await writeStoredInfraStateAsync(projectPath, {
+      schemaVersion: 1,
+      desired: desired,
+      ledger: ledger([]),
     });
-
-    const result = await syncProjectInfrastructure({
-      projectId: 'shop',
-      projectPath,
-      manifest,
-      generateInfrastructureImpl() {
-        return {
-          files: [{ path: 'infra/minikube/scripts/status.sh', content: 'second' }],
-          warnings: [],
-          meta: { target: 'minikube', providers: [] },
-          dependencies: [],
-        };
-      },
+    expect(await readStoredInfraStateAsync(projectPath, 'local')).toEqual({
+      schemaVersion: 1,
+      desired,
+      ledger: ledger([]),
     });
-
-    expect(result.removed).toBe(1);
-    expect(await pathExists(path.join(projectPath, 'infra/minikube/scripts/up.sh'))).toBe(false);
+    await removeStoredInfraStateAsync(projectPath, 'local');
+    expect(await readStoredInfraStateAsync(projectPath, 'local')).toBeNull();
   });
 
-  test('cleans generated files when deployment is removed', async () => {
-    const projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-clean-'));
-    tempRoots.add(projectPath);
-
-    await fs.mkdir(path.join(projectPath, '.ankh'), { recursive: true });
-    await fs.mkdir(path.join(projectPath, 'infra/minikube/scripts'), { recursive: true });
-    await fs.writeFile(
-      path.join(projectPath, 'infra/minikube/scripts/status.sh'),
-      'status',
-      'utf8',
-    );
-    await fs.writeFile(
-      path.join(projectPath, '.ankh/infra-ledger.json'),
-      JSON.stringify({
-        schemaVersion: 1,
-        generatedAt: new Date().toISOString(),
-        target: 'minikube',
-        files: ['infra/minikube/scripts/status.sh'],
-        warnings: [],
-      }),
-      'utf8',
-    );
-
-    const result = await syncProjectInfrastructure({
-      projectId: 'shop',
+  test('writes deterministic artifacts and removes only previously tracked stale files', async () => {
+    const projectPath = await temporaryProject();
+    const unrelatedPath = path.join(projectPath, 'infra/unrelated.txt');
+    await fs.mkdir(path.dirname(unrelatedPath), { recursive: true });
+    await fs.writeFile(unrelatedPath, 'keep', 'utf8');
+    const first = artifact('infra/compose.yaml', 'first');
+    const stale = artifact('infra/stale.yaml', 'stale');
+    await writeInfraGeneratedArtifactsAsync(projectPath, [first, stale], undefined);
+    const result = await writeInfraGeneratedArtifactsAsync(
       projectPath,
-      manifest: createAppManifest('shop', { modules: [] }),
-    });
-
-    expect(result.generated).toBe(0);
-    expect(result.removed).toBe(1);
-    expect(await pathExists(path.join(projectPath, '.ankh/infra-ledger.json'))).toBe(false);
+      [artifact('infra/compose.yaml', 'second')],
+      ledger([first, stale]),
+    );
+    expect(result).toEqual({ written: 1, removed: 1 });
+    expect(await fs.readFile(path.join(projectPath, 'infra/compose.yaml'), 'utf8')).toBe('second');
+    expect(await fs.readFile(unrelatedPath, 'utf8')).toBe('keep');
+    expect(await fileExists(path.join(projectPath, 'infra/stale.yaml'))).toBe(false);
   });
 
-  test('preserves apps/studio skip behavior', async () => {
-    const projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-studio-'));
-    tempRoots.add(projectPath);
-
-    const result = await syncProjectInfrastructure({
-      projectId: 'studio',
-      projectPath,
-      manifest: createAppManifest('studio', {
-        deployment: { target: 'minikube', monitoring: false },
-        modules: [],
-      }),
-    });
-
-    expect(result.skipped?.reason).toContain('apps/studio');
+  test('rejects traversal, state collisions and duplicate artifact paths before writing', async () => {
+    const projectPath = await temporaryProject();
+    expect(() => resolveProjectFile(projectPath, '../outside')).toThrow('outside project root');
+    expect(() => resolveProjectFile(projectPath, '.ankh/infra/local/state.json')).toThrow(
+      'Invalid generated Infra artifact path',
+    );
+    expect(
+      await captureError(
+        writeInfraGeneratedArtifactsAsync(
+          projectPath,
+          [artifact('infra/duplicate', 'a'), artifact('infra/duplicate', 'b')],
+          undefined,
+        ),
+      ),
+    ).toContain('Duplicate generated Infra artifact path');
+    expect(await fileExists(path.join(projectPath, 'infra/duplicate'))).toBe(false);
   });
 
-  test('resolves targets from the ledger when deployment metadata is absent', async () => {
-    const projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-target-'));
-    tempRoots.add(projectPath);
-
-    await fs.mkdir(path.join(projectPath, '.ankh'), { recursive: true });
+  test('fails closed when stored secret outputs contain a resolved value', async () => {
+    const projectPath = await temporaryProject();
+    const statePath = path.join(projectPath, '.ankh/infra/local/state.json');
+    await fs.mkdir(path.dirname(statePath), { recursive: true });
     await fs.writeFile(
-      path.join(projectPath, '.ankh/infra-ledger.json'),
+      statePath,
       JSON.stringify({
         schemaVersion: 1,
-        generatedAt: new Date().toISOString(),
-        target: 'minikube',
-        files: [],
-        warnings: [],
+        desired,
+        ledger: {
+          ...ledger([]),
+          outputs: [
+            {
+              owner: artifact('infra/example', '').owner,
+              name: 'password',
+              visibility: 'secret',
+              value: 'must-not-be-accepted',
+            },
+          ],
+        },
       }),
       'utf8',
     );
-
-    const target = await resolveProjectInfrastructureTarget({
-      manifest: createAppManifest('shop', { modules: [] }),
-      projectPath,
-    });
-
-    expect(target).toBe('minikube');
-  });
-
-  test('rejects generated file paths outside the project root', () => {
-    expect(() => resolveProjectFile('/workspace/project', '../outside.txt')).toThrow(
-      'Invalid infra output path outside project root',
+    expect(await captureError(readStoredInfraStateAsync(projectPath, 'local'))).toContain(
+      'invalid shape',
     );
   });
 });
 
-async function pathExists(filePath: string): Promise<boolean> {
+const desired = {
+  deployment: {
+    compute: { provider: 'local' },
+    runtime: { provider: 'docker-compose' },
+  },
+} as const;
+
+function ledger(artifacts: readonly InfraGeneratedArtifact[]): InfraLedger {
+  return {
+    schemaVersion: 1,
+    projectId: 'sample',
+    environment: 'local',
+    targets: [],
+    resources: [],
+    outputs: [],
+    artifacts: artifacts.map(({ owner, path: artifactPath }) => ({ owner, path: artifactPath })),
+  };
+}
+
+function artifact(artifactPath: string, content: string): InfraGeneratedArtifact {
+  return {
+    owner: {
+      projectId: 'sample',
+      environment: 'local',
+      adapter: 'docker-compose',
+      resourceId: 'runtime',
+    },
+    path: artifactPath,
+    content,
+  };
+}
+
+async function temporaryProject(): Promise<string> {
+  const projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-project-'));
+  temporaryPaths.add(projectPath);
+  return projectPath;
+}
+
+async function fileExists(filePath: string): Promise<boolean> {
   try {
     await fs.access(filePath);
     return true;
@@ -205,3 +150,12 @@ async function pathExists(filePath: string): Promise<boolean> {
     return false;
   }
 }
+
+async function captureError(operation: Promise<unknown>): Promise<string> {
+  try {
+    await operation;
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+  throw new Error('Expected operation to fail.');
+}