openlattice-cloudrun 0.0.3

package/tests/cloudrun-provider.test.ts

@@ -0,0 +1,1081 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { CloudRunProvider } from "../src/cloudrun-provider";
+
+// ── Mock fetch ──────────────────────────────────────────────────────
+
+const mocks = vi.hoisted(() => {
+  const mockFetch = vi.fn();
+  return { mockFetch };
+});
+
+vi.stubGlobal("fetch", mocks.mockFetch);
+
+// ── Helpers ─────────────────────────────────────────────────────────
+
+function mockFetchResponse(
+  status: number,
+  body: unknown,
+  headers?: Record<string, string>
+) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: {
+      get: (key: string) => headers?.[key] ?? null,
+    },
+    json: () => Promise.resolve(body),
+    text: () => Promise.resolve(JSON.stringify(body)),
+  };
+}
+
+const PROJECT_ID = "test-project";
+const REGION = "us-central1";
+const BASE = `https://run.googleapis.com/v2/projects/${PROJECT_ID}/locations/${REGION}`;
+
+function setupDefaultMocks() {
+  mocks.mockFetch.mockImplementation((url: string, opts?: RequestInit) => {
+    const method = opts?.method ?? "GET";
+
+    // POST /services — create service (returns operation)
+    if (method === "POST" && url.includes("/services?serviceId=")) {
+      return Promise.resolve(
+        mockFetchResponse(200, {
+          name: "operations/op-123",
+          done: true,
+        })
+      );
+    }
+
+    // GET /services/{id} — get service
+    if (method === "GET" && url.match(/\/services\/[^/?]+$/)) {
+      return Promise.resolve(
+        mockFetchResponse(200, {
+          name: `projects/${PROJECT_ID}/locations/${REGION}/services/test-svc`,
+          uri: "https://test-svc-abc123.us-central1.run.app",
+          terminalCondition: {
+            type: "Ready",
+            state: "CONDITION_SUCCEEDED",
+          },
+          traffic: [{ percent: 100, type: "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST" }],
+          template: {
+            containers: [
+              {
+                image: "python:3.12",
+                resources: {
+                  limits: { cpu: "1", memory: "512Mi" },
+                },
+              },
+            ],
+          },
+        })
+      );
+    }
+
+    // GET /services — list services (healthCheck)
+    if (method === "GET" && url.endsWith("/services")) {
+      return Promise.resolve(
+        mockFetchResponse(200, { services: [] })
+      );
+    }
+
+    // PATCH /services/{id} — update service (stop/start)
+    if (method === "PATCH" && url.match(/\/services\/[^/?]+$/)) {
+      return Promise.resolve(
+        mockFetchResponse(200, {
+          name: "operations/op-456",
+          done: true,
+        })
+      );
+    }
+
+    // DELETE /services/{id} — destroy
+    if (method === "DELETE" && url.includes("/services/")) {
+      return Promise.resolve(mockFetchResponse(200, {}));
+    }
+
+    // POST /jobs — create job (for exec)
+    if (method === "POST" && url.includes("/jobs?jobId=")) {
+      return Promise.resolve(
+        mockFetchResponse(200, {
+          name: "operations/op-job-create",
+          done: true,
+        })
+      );
+    }
+
+    // POST /jobs/{id}:run — run job
+    if (method === "POST" && url.includes(":run")) {
+      return Promise.resolve(
+        mockFetchResponse(200, {
+          name: "operations/op-job-run",
+          done: true,
+        })
+      );
+    }
+
+    // GET /jobs/{id}/executions — list executions
+    if (method === "GET" && url.includes("/executions")) {
+      return Promise.resolve(
+        mockFetchResponse(200, {
+          executions: [
+            {
+              name: "exec-1",
+              conditions: [
+                { type: "Completed", state: "CONDITION_SUCCEEDED" },
+              ],
+            },
+          ],
+        })
+      );
+    }
+
+    // DELETE /jobs/{id} — cleanup job
+    if (method === "DELETE" && url.includes("/jobs/")) {
+      return Promise.resolve(mockFetchResponse(200, {}));
+    }
+
+    // POST logging API — fetch logs
+    if (url.includes("logging.googleapis.com")) {
+      return Promise.resolve(
+        mockFetchResponse(200, {
+          entries: [
+            {
+              timestamp: "2024-01-01T00:00:00Z",
+              textPayload: "hello from logs",
+              severity: "DEFAULT",
+            },
+          ],
+        })
+      );
+    }
+
+    return Promise.resolve(mockFetchResponse(200, {}));
+  });
+}
+
+// ── Tests ───────────────────────────────────────────────────────────
+
+describe("CloudRunProvider", () => {
+  let provider: CloudRunProvider;
+
+  const defaultConfig = {
+    projectId: PROJECT_ID,
+    region: REGION,
+    authMethod: "token" as const,
+    accessToken: "test-token",
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    setupDefaultMocks();
+    provider = new CloudRunProvider(defaultConfig);
+  });
+
+  describe("constructor", () => {
+    it("sets name to 'cloudrun'", () => {
+      expect(provider.name).toBe("cloudrun");
+    });
+
+    it("declares expected capabilities", () => {
+      expect(provider.capabilities.restart).toBe(true);
+      expect(provider.capabilities.pause).toBe(false);
+      expect(provider.capabilities.snapshot).toBe(false);
+      expect(provider.capabilities.gpu).toBe(false);
+      expect(provider.capabilities.logs).toBe(true);
+      expect(provider.capabilities.tailscale).toBe(false);
+      expect(provider.capabilities.architectures).toContain("x86_64");
+      expect(provider.capabilities.persistentStorage).toBe(false);
+      expect(provider.capabilities.coldStartMs).toBe(3000);
+    });
+
+    it("throws if projectId is missing", () => {
+      expect(
+        () =>
+          new CloudRunProvider({
+            projectId: "",
+            authMethod: "token",
+            accessToken: "tok",
+          })
+      ).toThrow("projectId");
+    });
+
+    it("defaults region to us-central1", () => {
+      const p = new CloudRunProvider({
+        projectId: "my-proj",
+        authMethod: "token",
+        accessToken: "tok",
+      });
+      expect(p.name).toBe("cloudrun");
+    });
+  });
+
+  describe("provision", () => {
+    it("creates a service and returns node info", async () => {
+      const node = await provider.provision({
+        name: "test-svc",
+        runtime: { image: "python:3.12" },
+      });
+
+      expect(node.externalId).toBe("test-svc");
+      expect(node.endpoints).toHaveLength(1);
+      expect(node.endpoints[0].type).toBe("https");
+      expect(node.endpoints[0].port).toBe(443);
+      expect(node.endpoints[0].url).toContain("run.app");
+      expect(node.metadata?.publicUrl).toContain("run.app");
+      expect(node.metadata?.cloudRunProject).toBe(PROJECT_ID);
+      expect(node.metadata?.cloudRunRegion).toBe(REGION);
+    });
+
+    it("sends correct image in service body", async () => {
+      await provider.provision({
+        name: "test-svc",
+        runtime: { image: "nginx:latest" },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      expect(createCall).toBeDefined();
+      const body = JSON.parse(createCall[1].body);
+      expect(body.template.containers[0].image).toBe("nginx:latest");
+    });
+
+    it("uses custom port when specified", async () => {
+      await provider.provision({
+        name: "test-svc",
+        runtime: { image: "python:3.12" },
+        network: { ports: [{ port: 8080 }] },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      const body = JSON.parse(createCall[1].body);
+      expect(body.template.containers[0].ports[0].containerPort).toBe(8080);
+    });
+
+    it("defaults port to 3000", async () => {
+      await provider.provision({
+        name: "test-svc",
+        runtime: { image: "python:3.12" },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      const body = JSON.parse(createCall[1].body);
+      expect(body.template.containers[0].ports[0].containerPort).toBe(3000);
+    });
+
+    it("sets resource limits from spec", async () => {
+      await provider.provision({
+        name: "test-svc",
+        runtime: { image: "python:3.12" },
+        cpu: { cores: 2 },
+        memory: { sizeGiB: 4 },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      const body = JSON.parse(createCall[1].body);
+      expect(body.template.containers[0].resources.limits.cpu).toBe("2");
+      expect(body.template.containers[0].resources.limits.memory).toBe(
+        "4096Mi"
+      );
+    });
+
+    it("passes environment variables", async () => {
+      await provider.provision({
+        name: "test-svc",
+        runtime: {
+          image: "python:3.12",
+          env: { FOO: "bar", BAZ: "qux" },
+        },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      const body = JSON.parse(createCall[1].body);
+      const envArr = body.template.containers[0].env;
+      expect(envArr).toContainEqual({ name: "FOO", value: "bar" });
+      expect(envArr).toContainEqual({ name: "BAZ", value: "qux" });
+    });
+
+    it("passes custom command", async () => {
+      await provider.provision({
+        name: "test-svc",
+        runtime: {
+          image: "python:3.12",
+          command: ["python", "server.py"],
+        },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      const body = JSON.parse(createCall[1].body);
+      expect(body.template.containers[0].command).toEqual([
+        "python",
+        "server.py",
+      ]);
+    });
+
+    it("sanitizes labels", async () => {
+      await provider.provision({
+        name: "test-svc",
+        runtime: { image: "python:3.12" },
+        labels: { "My.Label": "Some Value!" },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      const body = JSON.parse(createCall[1].body);
+      expect(body.labels).toHaveProperty("my_label");
+      expect(body.labels["my_label"]).toBe("some_value_");
+      expect(body.labels["openlattice-managed"]).toBe("true");
+    });
+
+    it("applies scaling config", async () => {
+      const customProvider = new CloudRunProvider({
+        ...defaultConfig,
+        minInstances: 1,
+        maxInstances: 5,
+        concurrency: 40,
+      });
+
+      await customProvider.provision({
+        name: "test-svc",
+        runtime: { image: "python:3.12" },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      const body = JSON.parse(createCall[1].body);
+      expect(body.template.scaling.minInstanceCount).toBe(1);
+      expect(body.template.scaling.maxInstanceCount).toBe(5);
+      expect(body.template.maxInstanceRequestConcurrency).toBe(40);
+    });
+
+    it("generates service ID when name not provided", async () => {
+      await provider.provision({
+        runtime: { image: "python:3.12" },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      expect(createCall[0]).toMatch(/serviceId=ol-svc-/);
+    });
+
+    it("polls operation if not immediately done", async () => {
+      let pollCount = 0;
+      mocks.mockFetch.mockImplementation((url: string, opts?: RequestInit) => {
+        const method = opts?.method ?? "GET";
+
+        if (method === "POST" && url.includes("/services?serviceId=")) {
+          return Promise.resolve(
+            mockFetchResponse(200, {
+              name: "operations/op-pending",
+              done: false,
+            })
+          );
+        }
+
+        // Operation polling
+        if (url.includes("operations/op-pending")) {
+          pollCount++;
+          return Promise.resolve(
+            mockFetchResponse(200, {
+              name: "operations/op-pending",
+              done: pollCount >= 2,
+            })
+          );
+        }
+
+        // GET service
+        if (method === "GET" && url.match(/\/services\/[^/?]+$/)) {
+          return Promise.resolve(
+            mockFetchResponse(200, {
+              uri: "https://test-svc-abc.us-central1.run.app",
+              terminalCondition: { state: "CONDITION_SUCCEEDED" },
+              traffic: [{ percent: 100 }],
+            })
+          );
+        }
+
+        return Promise.resolve(mockFetchResponse(200, {}));
+      });
+
+      const node = await provider.provision({
+        name: "test-svc",
+        runtime: { image: "python:3.12" },
+      });
+
+      expect(node.externalId).toBe("test-svc");
+      expect(pollCount).toBeGreaterThanOrEqual(2);
+    });
+
+    it("includes VPC connector when configured", async () => {
+      const customProvider = new CloudRunProvider({
+        ...defaultConfig,
+        vpcConnector: "my-connector",
+      });
+
+      await customProvider.provision({
+        name: "test-svc",
+        runtime: { image: "python:3.12" },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      const body = JSON.parse(createCall[1].body);
+      expect(body.template.vpcAccess.connector).toBe("my-connector");
+    });
+
+    it("includes service account when configured", async () => {
+      const customProvider = new CloudRunProvider({
+        ...defaultConfig,
+        serviceAccount: "sa@project.iam.gserviceaccount.com",
+      });
+
+      await customProvider.provision({
+        name: "test-svc",
+        runtime: { image: "python:3.12" },
+      });
+
+      const createCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+      );
+      const body = JSON.parse(createCall[1].body);
+      expect(body.template.serviceAccount).toBe(
+        "sa@project.iam.gserviceaccount.com"
+      );
+    });
+  });
+
+  describe("exec", () => {
+    it("creates and runs a Cloud Run Job", async () => {
+      const result = await provider.exec("test-svc", ["echo", "hello"]);
+
+      // Should have created a job
+      const createJobCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/jobs?jobId=")
+      );
+      expect(createJobCall).toBeDefined();
+
+      // Should have run the job
+      const runJobCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes(":run")
+      );
+      expect(runJobCall).toBeDefined();
+
+      expect(result.exitCode).toBe(0);
+    });
+
+    it("wraps command with cwd and env", async () => {
+      await provider.exec("test-svc", ["ls"], {
+        cwd: "/app",
+        env: { FOO: "bar" },
+      });
+
+      const createJobCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/jobs?jobId=")
+      );
+      const body = JSON.parse(createJobCall[1].body);
+      expect(body.template.template.containers[0].command).toEqual([
+        "sh",
+        "-c",
+        "cd /app && export FOO='bar' && ls",
+      ]);
+    });
+
+    it("calls onStdout and onStderr callbacks", async () => {
+      const onStdout = vi.fn();
+      const onStderr = vi.fn();
+
+      await provider.exec("test-svc", ["echo", "hello"], {
+        onStdout,
+        onStderr,
+      });
+
+      expect(onStdout).toHaveBeenCalled();
+      expect(onStderr).toHaveBeenCalled();
+    });
+
+    it("sanitizes job ID to meet Cloud Run constraints", async () => {
+      // Use a long service name that would exceed 49 chars
+      const longName = "a".repeat(60);
+      await provider.exec(longName, ["echo", "hello"]);
+
+      const createJobCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) =>
+          c[1]?.method === "POST" && c[0].includes("/jobs?jobId=")
+      );
+      expect(createJobCall).toBeDefined();
+      // Extract jobId from URL
+      const url = new URL(createJobCall[0]);
+      const jobId = url.searchParams.get("jobId")!;
+      expect(jobId.length).toBeLessThanOrEqual(49);
+      expect(jobId).toMatch(/^[a-z]([-a-z0-9]*[a-z0-9])?$/);
+    });
+
+    it("returns exit code 1 when execution fails", async () => {
+      mocks.mockFetch.mockImplementation((url: string, opts?: RequestInit) => {
+        const method = opts?.method ?? "GET";
+
+        if (method === "GET" && url.match(/\/services\/[^/?]+$/)) {
+          return Promise.resolve(
+            mockFetchResponse(200, {
+              template: {
+                containers: [{ image: "python:3.12" }],
+              },
+            })
+          );
+        }
+
+        if (method === "POST" && url.includes("/jobs?jobId=")) {
+          return Promise.resolve(
+            mockFetchResponse(200, { name: "ops/op", done: true })
+          );
+        }
+
+        if (method === "POST" && url.includes(":run")) {
+          return Promise.resolve(
+            mockFetchResponse(200, { name: "ops/op", done: true })
+          );
+        }
+
+        if (method === "GET" && url.includes("/executions")) {
+          return Promise.resolve(
+            mockFetchResponse(200, {
+              executions: [
+                {
+                  name: "exec-1",
+                  conditions: [
+                    { type: "Completed", state: "CONDITION_FAILED" },
+                  ],
+                },
+              ],
+            })
+          );
+        }
+
+        if (url.includes("logging.googleapis.com")) {
+          return Promise.resolve(
+            mockFetchResponse(200, {
+              entries: [
+                {
+                  timestamp: "2024-01-01T00:00:00Z",
+                  textPayload: "error: something went wrong",
+                  severity: "ERROR",
+                },
+              ],
+            })
+          );
+        }
+
+        if (method === "DELETE") {
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+
+        return Promise.resolve(mockFetchResponse(200, {}));
+      });
+
+      const result = await provider.exec("test-svc", [
+        "sh",
+        "-c",
+        "exit 1",
+      ]);
+
+      expect(result.exitCode).toBe(1);
+    });
+  });
+
+  describe("destroy", () => {
+    it("deletes the service", async () => {
+      await provider.destroy("test-svc");
+
+      const deleteCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) => c[1]?.method === "DELETE"
+      );
+      expect(deleteCall).toBeDefined();
+      expect(deleteCall[0]).toContain("/services/test-svc");
+    });
+
+    it("is idempotent for 404", async () => {
+      mocks.mockFetch.mockImplementation(
+        (url: string, opts?: RequestInit) => {
+          if (opts?.method === "DELETE") {
+            return Promise.resolve(
+              mockFetchResponse(404, { error: "not found" })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      await expect(
+        provider.destroy("nonexistent")
+      ).resolves.toBeUndefined();
+    });
+
+    it("throws on non-404 errors", async () => {
+      mocks.mockFetch.mockImplementation(
+        (url: string, opts?: RequestInit) => {
+          if (opts?.method === "DELETE") {
+            return Promise.resolve(
+              mockFetchResponse(500, { error: "internal error" })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      await expect(provider.destroy("test-svc")).rejects.toThrow(
+        "destroy failed"
+      );
+    });
+  });
+
+  describe("inspect", () => {
+    it("returns running for succeeded condition with traffic", async () => {
+      const status = await provider.inspect("test-svc");
+      expect(status.status).toBe("running");
+    });
+
+    it("returns stopped for succeeded condition with 0 traffic", async () => {
+      mocks.mockFetch.mockImplementation(
+        (url: string, opts?: RequestInit) => {
+          if (
+            (opts?.method ?? "GET") === "GET" &&
+            url.match(/\/services\/[^/?]+$/)
+          ) {
+            return Promise.resolve(
+              mockFetchResponse(200, {
+                terminalCondition: {
+                  state: "CONDITION_SUCCEEDED",
+                },
+                traffic: [{ percent: 0 }],
+              })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      const status = await provider.inspect("test-svc");
+      expect(status.status).toBe("stopped");
+    });
+
+    it("returns stopped for failed condition", async () => {
+      mocks.mockFetch.mockImplementation(
+        (url: string, opts?: RequestInit) => {
+          if (
+            (opts?.method ?? "GET") === "GET" &&
+            url.match(/\/services\/[^/?]+$/)
+          ) {
+            return Promise.resolve(
+              mockFetchResponse(200, {
+                terminalCondition: {
+                  state: "CONDITION_FAILED",
+                  message: "deployment failed",
+                },
+              })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      const status = await provider.inspect("test-svc");
+      expect(status.status).toBe("stopped");
+    });
+
+    it("returns terminated for 404", async () => {
+      mocks.mockFetch.mockImplementation(() => {
+        return Promise.resolve(
+          mockFetchResponse(404, { error: "not found" })
+        );
+      });
+
+      const status = await provider.inspect("nonexistent");
+      expect(status.status).toBe("terminated");
+    });
+
+    it("returns unknown for other errors", async () => {
+      mocks.mockFetch.mockRejectedValue(new Error("network error"));
+
+      const status = await provider.inspect("test-svc");
+      expect(status.status).toBe("unknown");
+    });
+
+    it("returns running for reconciling service", async () => {
+      mocks.mockFetch.mockImplementation(
+        (url: string, opts?: RequestInit) => {
+          if (
+            (opts?.method ?? "GET") === "GET" &&
+            url.match(/\/services\/[^/?]+$/)
+          ) {
+            return Promise.resolve(
+              mockFetchResponse(200, {
+                reconciling: true,
+                terminalCondition: {},
+              })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      const status = await provider.inspect("test-svc");
+      expect(status.status).toBe("running");
+    });
+  });
+
+  describe("stop / start", () => {
+    it("stop patches traffic to 0%", async () => {
+      await provider.stop("test-svc");
+
+      const patchCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) => c[1]?.method === "PATCH"
+      );
+      expect(patchCall).toBeDefined();
+      const body = JSON.parse(patchCall[1].body);
+      expect(body.traffic[0].percent).toBe(0);
+    });
+
+    it("start patches traffic to 100%", async () => {
+      await provider.start("test-svc");
+
+      const patchCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) => c[1]?.method === "PATCH"
+      );
+      expect(patchCall).toBeDefined();
+      const body = JSON.parse(patchCall[1].body);
+      expect(body.traffic[0].percent).toBe(100);
+    });
+
+    it("stop is idempotent for 404", async () => {
+      mocks.mockFetch.mockImplementation(
+        (url: string, opts?: RequestInit) => {
+          if (opts?.method === "PATCH") {
+            return Promise.resolve(
+              mockFetchResponse(404, { error: "not found" })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      await expect(
+        provider.stop("nonexistent")
+      ).resolves.toBeUndefined();
+    });
+  });
+
+  describe("logs", () => {
+    it("returns log entries from Cloud Logging", async () => {
+      const entries: any[] = [];
+      for await (const entry of provider.logs("test-svc")) {
+        entries.push(entry);
+      }
+
+      expect(entries).toHaveLength(1);
+      expect(entries[0].message).toBe("hello from logs");
+      expect(entries[0].stream).toBe("stdout");
+      expect(entries[0].timestamp).toBeInstanceOf(Date);
+    });
+
+    it("maps ERROR severity to stderr", async () => {
+      mocks.mockFetch.mockImplementation(
+        (url: string) => {
+          if (url.includes("logging.googleapis.com")) {
+            return Promise.resolve(
+              mockFetchResponse(200, {
+                entries: [
+                  {
+                    timestamp: "2024-01-01T00:00:00Z",
+                    textPayload: "something failed",
+                    severity: "ERROR",
+                  },
+                ],
+              })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      const entries: any[] = [];
+      for await (const entry of provider.logs("test-svc")) {
+        entries.push(entry);
+      }
+
+      expect(entries[0].stream).toBe("stderr");
+    });
+
+    it("passes tail option as pageSize", async () => {
+      const entries: any[] = [];
+      for await (const entry of provider.logs("test-svc", { tail: 5 })) {
+        entries.push(entry);
+      }
+
+      const loggingCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) => c[0].includes("logging.googleapis.com")
+      );
+      const body = JSON.parse(loggingCall[1].body);
+      expect(body.pageSize).toBe(5);
+    });
+
+    it("passes since option as timestamp filter", async () => {
+      const since = new Date("2024-06-01T00:00:00Z");
+      const entries: any[] = [];
+      for await (const entry of provider.logs("test-svc", { since })) {
+        entries.push(entry);
+      }
+
+      const loggingCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) => c[0].includes("logging.googleapis.com")
+      );
+      const body = JSON.parse(loggingCall[1].body);
+      expect(body.filter).toContain("2024-06-01T00:00:00.000Z");
+    });
+
+    it("uses ascending order in follow mode", async () => {
+      let pollCount = 0;
+      mocks.mockFetch.mockImplementation(
+        (url: string, opts?: RequestInit) => {
+          if (url.includes("logging.googleapis.com")) {
+            pollCount++;
+            if (pollCount === 1) {
+              return Promise.resolve(
+                mockFetchResponse(200, {
+                  entries: [
+                    {
+                      timestamp: "2024-01-01T00:00:01Z",
+                      textPayload: "first log",
+                      severity: "DEFAULT",
+                    },
+                  ],
+                })
+              );
+            }
+            // Second poll returns empty to stop follow
+            return Promise.resolve(
+              mockFetchResponse(200, { entries: [] })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      const entries: any[] = [];
+      const iter = provider.logs("test-svc", { follow: true })[Symbol.asyncIterator]();
+      const first = await iter.next();
+      if (!first.done) entries.push(first.value);
+      await iter.return!();
+
+      expect(entries).toHaveLength(1);
+      expect(entries[0].message).toBe("first log");
+
+      // Verify ascending order was used
+      const loggingCall = mocks.mockFetch.mock.calls.find(
+        (c: any[]) => c[0].includes("logging.googleapis.com")
+      );
+      const body = JSON.parse(loggingCall[1].body);
+      expect(body.orderBy).toBe("timestamp asc");
+    });
+
+    it("returns empty when logging API fails", async () => {
+      mocks.mockFetch.mockImplementation(
+        (url: string) => {
+          if (url.includes("logging.googleapis.com")) {
+            return Promise.resolve(
+              mockFetchResponse(403, { error: "forbidden" })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      const entries: any[] = [];
+      for await (const entry of provider.logs("test-svc")) {
+        entries.push(entry);
+      }
+
+      expect(entries).toHaveLength(0);
+    });
+  });
+
+  describe("healthCheck", () => {
+    it("returns healthy when API is reachable", async () => {
+      const health = await provider.healthCheck();
+      expect(health.healthy).toBe(true);
+      expect(health.latencyMs).toBeTypeOf("number");
+    });
+
+    it("returns unhealthy when API fails", async () => {
+      mocks.mockFetch.mockRejectedValue(new Error("network error"));
+
+      const health = await provider.healthCheck();
+      expect(health.healthy).toBe(false);
+      expect(health.message).toContain("unreachable");
+    });
+  });
+
+  describe("getCost", () => {
+    it("returns estimated cost based on resource usage", async () => {
+      mocks.mockFetch.mockImplementation(
+        (url: string, opts?: RequestInit) => {
+          if (
+            (opts?.method ?? "GET") === "GET" &&
+            url.match(/\/services\/[^/?]+$/)
+          ) {
+            return Promise.resolve(
+              mockFetchResponse(200, {
+                createTime: new Date(
+                  Date.now() - 3600 * 1000
+                ).toISOString(), // 1 hour ago
+                template: {
+                  containers: [
+                    {
+                      resources: {
+                        limits: { cpu: "2", memory: "1024Mi" },
+                      },
+                    },
+                  ],
+                },
+              })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      const cost = await provider.getCost("test-svc");
+      expect(cost.totalUsd).toBeTypeOf("number");
+      expect(cost.totalUsd).toBeGreaterThan(0);
+    });
+
+    it("returns 0 on error", async () => {
+      mocks.mockFetch.mockRejectedValue(new Error("network error"));
+
+      const cost = await provider.getCost("test-svc");
+      expect(cost.totalUsd).toBe(0);
+    });
+  });
+
+  describe("getExtension", () => {
+    it("returns network extension", () => {
+      const ext = provider.getExtension("test-svc", "network");
+      expect(ext).toBeDefined();
+      expect(ext).toHaveProperty("getUrl");
+    });
+
+    it("network extension returns run.app URL", async () => {
+      const ext = provider.getExtension("test-svc", "network")!;
+      const url = await ext.getUrl(443);
+      expect(url).toContain("run.app");
+    });
+
+    it("returns undefined for unsupported extensions", () => {
+      expect(provider.getExtension("test-svc", "files")).toBeUndefined();
+      expect(provider.getExtension("test-svc", "metrics")).toBeUndefined();
+    });
+  });
+
+  describe("retry logic", () => {
+    it("retries on 429 with exponential backoff", async () => {
+      let callCount = 0;
+      mocks.mockFetch.mockImplementation(
+        (url: string, opts?: RequestInit) => {
+          const method = opts?.method ?? "GET";
+          if (method === "GET" && url.endsWith("/services")) {
+            callCount++;
+            if (callCount <= 2) {
+              return Promise.resolve(
+                mockFetchResponse(429, { error: "rate limited" })
+              );
+            }
+            return Promise.resolve(
+              mockFetchResponse(200, { services: [] })
+            );
+          }
+          return Promise.resolve(mockFetchResponse(200, {}));
+        }
+      );
+
+      const health = await provider.healthCheck();
+      expect(health.healthy).toBe(true);
+      expect(callCount).toBe(3);
+    });
+  });
+});
+
+describe("label sanitization", () => {
+  const provider = new CloudRunProvider({
+    projectId: "test",
+    authMethod: "token",
+    accessToken: "tok",
+  });
+
+  // We test label sanitization indirectly through provision
+  it("lowercases and replaces invalid characters", async () => {
+    setupDefaultMocks();
+    await provider.provision({
+      name: "test-svc",
+      runtime: { image: "alpine" },
+      labels: { "My.Label@Key": "Some Value!Here" },
+    });
+
+    const createCall = mocks.mockFetch.mock.calls.find(
+      (c: any[]) =>
+        c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+    );
+    const body = JSON.parse(createCall[1].body);
+    expect(body.labels["my_label_key"]).toBe("some_value_here");
+  });
+
+  it("truncates to 63 characters", async () => {
+    vi.clearAllMocks();
+    setupDefaultMocks();
+    const longKey = "a".repeat(100);
+    const longValue = "b".repeat(100);
+
+    await provider.provision({
+      name: "test-svc",
+      runtime: { image: "alpine" },
+      labels: { [longKey]: longValue },
+    });
+
+    const createCall = mocks.mockFetch.mock.calls.find(
+      (c: any[]) =>
+        c[1]?.method === "POST" && c[0].includes("/services?serviceId=")
+    );
+    const body = JSON.parse(createCall[1].body);
+    const keys = Object.keys(body.labels).filter(
+      (k: string) => k !== "openlattice-managed"
+    );
+    expect(keys[0].length).toBeLessThanOrEqual(63);
+    expect(body.labels[keys[0]].length).toBeLessThanOrEqual(63);
+  });
+});