@ankhorage/infra 4.1.2 → 4.1.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "4.1.2",
+  "version": "4.1.4",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -35,8 +35,8 @@
     "openapi"
   ],
   "dependencies": {
-    "@ankhorage/contracts": "^8.0.0",
-    "@ankhorage/supabase-vault": "^0.2.4"
+    "@ankhorage/contracts": "^8.0.1",
+    "@ankhorage/supabase-vault": "^0.2.5"
   },
   "files": [
     "dist",
@@ -89,10 +89,9 @@
   },
   "scripts": {
     "build": "rm -rf dist tsconfig.tsbuildinfo && bun x tsc -p tsconfig.json",
-    "changeset": "changeset",
-    "changeset:status": "changeset status --since=origin/main",
+    "changeset": "ankhorage-changeset",
+    "changeset:status": "ankhorage-changeset status --since=origin/main",
     "docs": "paradox",
-    "knip": "ankhorage-knip",
     "lint": "ankhorage-eslint . --max-warnings=0",
     "lint:fix": "ankhorage-eslint . --fix --max-warnings=0",
     "format": "ankhorage-prettier --write .",
@@ -103,16 +102,16 @@
     "test:e2e:minikube": "ANKH_MINIKUBE_ISOLATION=1 bun test src/adapters/minikube/base/twoAppIsolation.integration.test.ts",
     "test:e2e:supabase": "ANKH_MINIKUBE_SUPABASE_ISOLATION=1 bun test src/adapters/minikube/base/twoAppIsolation.integration.test.ts",
     "typecheck": "bun x tsc --noEmit -p tsconfig.json",
-    "version-packages": "changeset version"
+    "version-packages": "ankhorage-changeset version",
+    "knip:check": "ankhorage-knip"
   },
   "devDependencies": {
-    "@ankhorage/ankh": "^0.8.1",
-    "@ankhorage/devtools": "^1.2.1",
-    "@ankhorage/paradox": "^0.1.21",
-    "@changesets/cli": "^2.31.0",
-    "@types/bun": "^1.3.14",
+    "@ankhorage/ankh": "^0.8.4",
+    "@ankhorage/devtools": "^1.8.3",
+    "@ankhorage/paradox": "^0.1.24",
+    "@types/bun": "^1.4.0",
     "@types/node": "^25.6.0",
     "typescript": "^5.9.3"
   },
-  "packageManager": "bun@1.3.14"
+  "packageManager": "bun@1.4.0"
 }

package/src/adapters/minikube/README.md

@@ -73,9 +73,12 @@ official Supabase Kubernetes distribution.
 
 - Default app image: `ankh/<slug>:dev`.
 - By default `up.sh` triggers `build-app-image.sh` (`APP_BUILD_ENABLED=true`) before apply.
-- `build-app-image.sh` runs `bunx expo export --platform web --clear`, then builds via
-  `app-image/Dockerfile`. Clearing the Expo/Metro cache ensures rotated `EXPO_PUBLIC_*`
-  values replace cached transforms before the browser bundle and Docker image are created.
+- `build-app-image.sh` requires the app's installed `node_modules/.bin/expo`, runs
+  `expo export --platform web --clear` through that pinned local CLI, then builds via
+  `app-image/Dockerfile`. Missing app dependencies fail with an explicit frozen-install
+  instruction; the script never resolves Expo through `bunx` or the network. Clearing the
+  Expo/Metro cache ensures rotated `EXPO_PUBLIC_*` values replace cached transforms before the
+  browser bundle and Docker image are created.
 - `up.sh` syncs runtime image using `APP_IMAGE_SYNC_STRATEGY`:
   - `docker-load` (default): loads existing local Docker image into the app profile.
   - `minikube-build`: builds exported web artifacts directly into the profile image store.

package/src/adapters/minikube/base/appImageBuild.test.ts

@@ -25,7 +25,7 @@ test('re-exports rotated public environment values before building the app image
     const buildScriptPath = path.join(scriptsRoot, 'build-app-image.sh');
     const dockerfilePath = path.join(infraRoot, 'app-image', 'Dockerfile');
     const metroCachePath = path.join(workspaceRoot, 'fake-metro-cache');
-    const bunxArgsPath = path.join(workspaceRoot, 'bunx-args');
+    const expoArgsPath = path.join(workspaceRoot, 'expo-args');
     const dockerArgsPath = path.join(workspaceRoot, 'docker-args');
     const exportDir = path.join(appRoot, '.ankh', 'web-export');
     const bundlePath = path.join(exportDir, '_expo', 'static', 'js', 'web', 'index-fixture.js');
@@ -49,14 +49,14 @@ test('re-exports rotated public environment values before building the app image
     await writeFile(dockerfilePath, 'FROM scratch\n', 'utf8');
     await writeFile(buildScriptPath, buildScript, 'utf8');
     await chmod(buildScriptPath, 0o755);
-    await writeFakeBunx(path.join(fakeBin, 'bunx'));
+    await writeFakeExpo(path.join(appRoot, 'node_modules', '.bin', 'expo'));
     await writeFakeDocker(path.join(fakeBin, 'docker'));
 
     await writePublicEnvironment(appRoot, infraRoot, PUBLIC_KEY_A);
     await runBuildScript({
       appRoot,
       buildScriptPath,
-      bunxArgsPath,
+      expoArgsPath,
       dockerArgsPath,
       fakeBin,
       metroCachePath,
@@ -70,7 +70,7 @@ test('re-exports rotated public environment values before building the app image
     await runBuildScript({
       appRoot,
       buildScriptPath,
-      bunxArgsPath,
+      expoArgsPath,
       dockerArgsPath,
       fakeBin,
       metroCachePath,
@@ -80,8 +80,7 @@ test('re-exports rotated public environment values before building the app image
     expect(secondBundle).toContain(PUBLIC_KEY_B);
     expect(secondBundle).not.toContain(PUBLIC_KEY_A);
     expect(secondBundle).not.toContain(PRIVATE_SERVICE_ROLE_KEY);
-    expect((await readFile(bunxArgsPath, 'utf8')).trim().split('\n')).toEqual([
-      'expo',
+    expect((await readFile(expoArgsPath, 'utf8')).trim().split('\n')).toEqual([
       'export',
       '--platform',
       'web',
@@ -98,6 +97,64 @@ test('re-exports rotated public environment values before building the app image
   }
 });
 
+test('fails before global or network Expo resolution when app dependencies are missing', async () => {
+  const workspaceRoot = await mkdtemp(path.join(tmpdir(), 'ankh-infra-app-image-missing-expo-'));
+
+  try {
+    const appRoot = path.join(workspaceRoot, 'apps', APP_SLUG);
+    const infraRoot = path.join(appRoot, 'infra', 'minikube');
+    const scriptsRoot = path.join(infraRoot, 'scripts');
+    const fakeBin = path.join(workspaceRoot, 'bin');
+    const buildScriptPath = path.join(scriptsRoot, 'build-app-image.sh');
+    const dockerfilePath = path.join(infraRoot, 'app-image', 'Dockerfile');
+    const fallbackMarkerPath = path.join(workspaceRoot, 'forbidden-expo-fallback');
+    const generated = generateInfrastructure(
+      {
+        deployment: { target: 'minikube', monitoring: false },
+        modules: [],
+      },
+      { appManifest: createAppManifest(APP_SLUG) },
+    );
+    const buildScript = getGeneratedFile(
+      generated.files,
+      'infra/minikube/scripts/build-app-image.sh',
+    );
+
+    await mkdir(path.dirname(dockerfilePath), { recursive: true });
+    await mkdir(fakeBin, { recursive: true });
+    await mkdir(scriptsRoot, { recursive: true });
+    await writeFile(path.join(appRoot, 'package.json'), '{}\n', 'utf8');
+    await writeFile(dockerfilePath, 'FROM scratch\n', 'utf8');
+    await writeFile(buildScriptPath, buildScript, 'utf8');
+    await chmod(buildScriptPath, 0o755);
+    await writeFakeDocker(path.join(fakeBin, 'docker'));
+    await writeForbiddenExpoFallback(path.join(fakeBin, 'bunx'));
+    await writeForbiddenExpoFallback(path.join(fakeBin, 'expo'));
+
+    const result = await executeBuildScript({
+      appRoot,
+      buildScriptPath,
+      dockerArgsPath: path.join(workspaceRoot, 'docker-args'),
+      expoArgsPath: path.join(workspaceRoot, 'expo-args'),
+      fakeBin,
+      fallbackMarkerPath,
+      metroCachePath: path.join(workspaceRoot, 'fake-metro-cache'),
+    });
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain(
+      `App-owned Expo CLI is missing: ${appRoot}/node_modules/.bin/expo`,
+    );
+    expect(result.stderr).toContain(
+      `Run 'bun install --frozen-lockfile' in ${appRoot} before building the app image.`,
+    );
+    expect(buildScript).not.toContain('bunx');
+    expect(await Bun.file(fallbackMarkerPath).exists()).toBe(false);
+  } finally {
+    await rm(workspaceRoot, { recursive: true, force: true });
+  }
+});
+
 async function writePublicEnvironment(
   appRoot: string,
   infraRoot: string,
@@ -122,19 +179,20 @@ SUPABASE_SERVICE_ROLE_KEY=${PRIVATE_SERVICE_ROLE_KEY}
   );
 }
 
-async function writeFakeBunx(filePath: string): Promise<void> {
+async function writeFakeExpo(filePath: string): Promise<void> {
+  await mkdir(path.dirname(filePath), { recursive: true });
   await writeFile(
     filePath,
     `#!/usr/bin/env bash
 set -euo pipefail
 
-printf '%s\\n' "$@" > "\${FAKE_BUNX_ARGS_PATH:?}"
+printf '%s\\n' "$@" > "\${FAKE_EXPO_ARGS_PATH:?}"
 
-if [[ "\${1:-}" != "expo" || "\${2:-}" != "export" ]]; then
+if [[ "\${1:-}" != "export" ]]; then
   echo "Expected expo export invocation." >&2
   exit 64
 fi
-shift 2
+shift
 
 clear_cache=false
 output_dir=""
@@ -208,20 +266,38 @@ fi
   await chmod(filePath, 0o755);
 }
 
-async function runBuildScript(args: {
+async function writeForbiddenExpoFallback(filePath: string): Promise<void> {
+  await writeFile(
+    filePath,
+    `#!/usr/bin/env bash
+set -euo pipefail
+
+: > "\${FAKE_FALLBACK_MARKER_PATH:?}"
+exit 86
+`,
+    'utf8',
+  );
+  await chmod(filePath, 0o755);
+}
+
+async function executeBuildScript(args: {
   appRoot: string;
   buildScriptPath: string;
-  bunxArgsPath: string;
+  expoArgsPath: string;
   dockerArgsPath: string;
   fakeBin: string;
+  fallbackMarkerPath?: string;
   metroCachePath: string;
-}): Promise<void> {
+}): Promise<{ exitCode: number | null; stderr: string; stdout: string }> {
   const child = spawn('bash', [args.buildScriptPath], {
     cwd: args.appRoot,
     env: {
       ...process.env,
-      FAKE_BUNX_ARGS_PATH: args.bunxArgsPath,
       FAKE_DOCKER_ARGS_PATH: args.dockerArgsPath,
+      FAKE_EXPO_ARGS_PATH: args.expoArgsPath,
+      ...(args.fallbackMarkerPath === undefined
+        ? {}
+        : { FAKE_FALLBACK_MARKER_PATH: args.fallbackMarkerPath }),
       FAKE_METRO_CACHE_PATH: args.metroCachePath,
       PATH: `${args.fakeBin}:${process.env.PATH ?? ''}`,
     },
@@ -237,6 +313,19 @@ async function runBuildScript(args: {
     exitCodePromise,
   ]);
 
+  return { exitCode, stderr, stdout };
+}
+
+async function runBuildScript(args: {
+  appRoot: string;
+  buildScriptPath: string;
+  expoArgsPath: string;
+  dockerArgsPath: string;
+  fakeBin: string;
+  metroCachePath: string;
+}): Promise<void> {
+  const { exitCode, stderr, stdout } = await executeBuildScript(args);
+
   if (exitCode !== 0) {
     throw new Error(
       `Generated build script exited with ${String(exitCode)}. stdout=${stdout} stderr=${stderr}`,

package/src/adapters/minikube/base/index.test.ts

@@ -398,12 +398,16 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
       ),
     );
     expect(upScript).not.toContain('SUPABASE_SERVICE_ROLE_KEY" "${SUPABASE_SERVICE_ROLE_KEY}"');
+    expect(buildScript).toContain('EXPO_CLI="${APP_SOURCE_DIR}/node_modules/.bin/expo"');
     expect(buildScript).toContain(
-      'bunx expo export --platform web --clear --output-dir "${APP_WEB_EXPORT_DIR}"',
+      '"${EXPO_CLI}" export --platform web --clear --output-dir "${APP_WEB_EXPORT_DIR}"',
     );
+    expect(buildScript).not.toContain('bunx');
     expect(readme).toContain(
-      '`build-app-image.sh` clears the Expo/Metro bundler cache before every web export.',
+      '`build-app-image.sh` requires the app-installed `node_modules/.bin/expo` and never resolves',
     );
+    expect(readme).toContain('Expo globally or through the network.');
+    expect(readme).toContain('It clears the Expo/Metro bundler cache before every web');
   });
 
   test('starts Supabase schema owners before app migrations and profile reconciliation', () => {

package/src/adapters/minikube/base/index.ts

@@ -451,10 +451,12 @@ ${appRuntimeEnabled ? `- App: \`http://127.0.0.1:${supabaseHostPorts.app}\`\n` :
 
 ## App Image Export
 
-\`build-app-image.sh\` clears the Expo/Metro bundler cache before every web export. Expo
-inlines \`EXPO_PUBLIC_*\` values into the browser bundle, so cache invalidation ensures a
-rotated browser-safe Supabase URL or anon key replaces the previous value before the Docker
-image is built. Privileged Supabase credentials are not written to the app's public env file.
+\`build-app-image.sh\` requires the app-installed \`node_modules/.bin/expo\` and never resolves
+Expo globally or through the network. It clears the Expo/Metro bundler cache before every web
+export. Expo inlines \`EXPO_PUBLIC_*\` values into the browser bundle, so cache invalidation
+ensures a rotated browser-safe Supabase URL or anon key replaces the previous value before the
+Docker image is built. Privileged Supabase credentials are not written to the app's public env
+file.
 
 ## Runtime Conventions
 
@@ -2958,29 +2960,31 @@ if [[ "\${APP_BUILD_ENABLED}" != "true" ]]; then
   exit 0
 fi
 
-if ! command -v docker >/dev/null 2>&1; then
-  echo "docker is required to build app image."
+if [[ ! -f "\${APP_SOURCE_DIR}/package.json" ]]; then
+  echo "APP_SOURCE_DIR does not look like an app root: \${APP_SOURCE_DIR}"
   exit 1
 fi
 
-if ! command -v bunx >/dev/null 2>&1; then
-  echo "bunx is required to export the app for container image build."
+if [[ ! -f "\${DOCKERFILE_PATH}" ]]; then
+  echo "Dockerfile for app image build is missing: \${DOCKERFILE_PATH}"
   exit 1
 fi
 
-if [[ ! -f "\${APP_SOURCE_DIR}/package.json" ]]; then
-  echo "APP_SOURCE_DIR does not look like an app root: \${APP_SOURCE_DIR}"
+EXPO_CLI="\${APP_SOURCE_DIR}/node_modules/.bin/expo"
+if [[ ! -x "\${EXPO_CLI}" ]]; then
+  echo "App-owned Expo CLI is missing: \${EXPO_CLI}" >&2
+  echo "Run 'bun install --frozen-lockfile' in \${APP_SOURCE_DIR} before building the app image." >&2
   exit 1
 fi
 
-if [[ ! -f "\${DOCKERFILE_PATH}" ]]; then
-  echo "Dockerfile for app image build is missing: \${DOCKERFILE_PATH}"
+if ! command -v docker >/dev/null 2>&1; then
+  echo "docker is required to build app image."
   exit 1
 fi
 
 (
   cd "\${APP_SOURCE_DIR}"
-  bunx expo export --platform web --clear --output-dir "\${APP_WEB_EXPORT_DIR}"
+  "\${EXPO_CLI}" export --platform web --clear --output-dir "\${APP_WEB_EXPORT_DIR}"
 )
 
 if [[ "\${APP_WEB_EXPORT_DIR}" = /* ]]; then

package/src/adapters/minikube/base/twoAppIsolation.integration.test.ts

@@ -22,8 +22,7 @@ const DIAGNOSTIC_OUTPUT_LIMIT = 20_000;
 const APP_ONLY_TEST_PROFILES = ['ankh-isolation-a', 'ankh-isolation-b'] as const;
 const SUPABASE_TEST_PROFILES = ['ankh-isolation-supa-a', 'ankh-isolation-supa-b'] as const;
 type TestOwnedMinikubeProfile =
-  | (typeof APP_ONLY_TEST_PROFILES)[number]
-  | (typeof SUPABASE_TEST_PROFILES)[number];
+  (typeof APP_ONLY_TEST_PROFILES)[number] | (typeof SUPABASE_TEST_PROFILES)[number];
 
 describe('generated Minikube two-app isolation', () => {
   isolationTest(