@abgov/nx-oc 13.0.0-beta.1 → 13.0.0-beta.3

package/executors.json

@@ -5,6 +5,11 @@
       "implementation": "./src/executors/apply/apply",
       "schema": "./src/executors/apply/schema.json",
       "description": "Executor that applies deployment template to OpenShift."
+    },
+    "sandbox": {
+      "implementation": "./src/executors/sandbox/sandbox",
+      "schema": "./src/executors/sandbox/schema.json",
+      "description": "Build locally with podman, push to the registry, import into the sandbox namespace, and roll out."
     }
   }
 }

package/migrations.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "http://json-schema.org/schema",
+  "generators": {
+    "convert-sandbox-target-to-executor": {
+      "version": "13.0.0-beta.3",
+      "description": "Convert generated sandbox `nx:run-commands` targets to the @abgov/nx-oc:sandbox executor.",
+      "implementation": "./src/migrations/convert-sandbox-target/convert-sandbox-target"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abgov/nx-oc",
-  "version": "13.0.0-beta.1",
+  "version": "13.0.0-beta.3",
   "license": "Apache-2.0",
   "main": "src/index.js",
   "description": "Government of Alberta - Nx plugin for OpenShift.",
@@ -23,6 +23,9 @@
   },
   "generators": "./generators.json",
   "executors": "./executors.json",
+  "nx-migrations": {
+    "migrations": "./migrations.json"
+  },
   "scripts": {},
   "types": "./src/index.d.ts",
   "type": "commonjs"

package/src/adsp/adsp-utils.d.ts

@@ -15,3 +15,13 @@ export declare function getAdspConfiguration(_host: Tree, options: {
     tenantRealm?: string;
 }): Promise<AdspConfiguration>;
 export declare function isAdspOptions(options: unknown): options is AdspOptions;
+/**
+ * Registers redirect URIs (and matching post-logout URIs) on an existing public
+ * client so a deployed app can complete browser sign-in/out against its route.
+ *
+ * Idempotent and best-effort: no-ops without a token, skips if the client isn't
+ * found, and logs (never throws) on failure so it can't break generation. The
+ * client's `webOrigins` is intentionally left as-is — the default `["+"]`
+ * already allows CORS from any redirect-URI origin.
+ */
+export declare function addClientRedirectUris(accessServiceUrl: string, realm: string, clientId: string, redirectUris: string[], accessToken: string | undefined): Promise<void>;

package/src/adsp/adsp-utils.js

@@ -6,6 +6,7 @@ exports.getServiceUrls = getServiceUrls;
 exports.selectTenant = selectTenant;
 exports.getAdspConfiguration = getAdspConfiguration;
 exports.isAdspOptions = isAdspOptions;
+exports.addClientRedirectUris = addClientRedirectUris;
 const tslib_1 = require("tslib");
 const devkit_1 = require("@nx/devkit");
 const axios_1 = require("axios");
@@ -162,4 +163,51 @@ function isAdspOptions(options) {
     var _a;
     return !!((_a = options === null || options === void 0 ? void 0 : options.adsp) === null || _a === void 0 ? void 0 : _a.tenantRealm);
 }
+/**
+ * Registers redirect URIs (and matching post-logout URIs) on an existing public
+ * client so a deployed app can complete browser sign-in/out against its route.
+ *
+ * Idempotent and best-effort: no-ops without a token, skips if the client isn't
+ * found, and logs (never throws) on failure so it can't break generation. The
+ * client's `webOrigins` is intentionally left as-is — the default `["+"]`
+ * already allows CORS from any redirect-URI origin.
+ */
+function addClientRedirectUris(accessServiceUrl, realm, clientId, redirectUris, accessToken) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        if (!accessToken || redirectUris.length === 0)
+            return;
+        const base = new URL(`/auth/admin/realms/${realm}/clients`, accessServiceUrl)
+            .href;
+        const authHeader = { Authorization: `Bearer ${accessToken}` };
+        const union = (existing, additions) => Array.from(new Set([...(existing !== null && existing !== void 0 ? existing : []), ...additions]));
+        try {
+            const { data: clients } = yield axios_1.default.get(base, {
+                params: { clientId },
+                headers: authHeader,
+            });
+            const client = clients === null || clients === void 0 ? void 0 : clients[0];
+            if (!client) {
+                console.log(`[nx-oc] Public client '${clientId}' not found in realm '${realm}' — skipping redirect URI update.`);
+                return;
+            }
+            const existingPostLogout = ((_b = (_a = client.attributes) === null || _a === void 0 ? void 0 : _a['post.logout.redirect.uris']) !== null && _b !== void 0 ? _b : '')
+                .split('##')
+                .filter(Boolean);
+            const nextRedirects = union(client.redirectUris, redirectUris);
+            const nextPostLogout = union(existingPostLogout, redirectUris).join('##');
+            if (nextRedirects.length === ((_d = (_c = client.redirectUris) === null || _c === void 0 ? void 0 : _c.length) !== null && _d !== void 0 ? _d : 0) &&
+                nextPostLogout === ((_f = (_e = client.attributes) === null || _e === void 0 ? void 0 : _e['post.logout.redirect.uris']) !== null && _f !== void 0 ? _f : '')) {
+                console.log(`[nx-oc] Client '${clientId}' already allows ${redirectUris.join(', ')}.`);
+                return;
+            }
+            yield axios_1.default.put(`${base}/${client.id}`, Object.assign(Object.assign({}, client), { redirectUris: nextRedirects, attributes: Object.assign(Object.assign({}, client.attributes), { 'post.logout.redirect.uris': nextPostLogout }) }), { headers: authHeader });
+            console.log(`[nx-oc] Registered redirect URI(s) on client '${clientId}': ${redirectUris.join(', ')}`);
+        }
+        catch (err) {
+            const detail = (_j = (_h = (_g = err === null || err === void 0 ? void 0 : err.response) === null || _g === void 0 ? void 0 : _g.status) !== null && _h !== void 0 ? _h : err === null || err === void 0 ? void 0 : err.message) !== null && _j !== void 0 ? _j : err;
+            console.log(`[nx-oc] Could not update redirect URIs for '${clientId}': ${detail}`);
+        }
+    });
+}
 //# sourceMappingURL=adsp-utils.js.map

package/src/adsp/adsp-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"adsp-utils.js","sourceRoot":"","sources":["../../../../../packages/nx-oc/src/adsp/adsp-utils.ts"],"names":[],"mappings":";;AAeA,sCAOC;AAED,gCAqFC;AAED,wCAYC;AAED,oCAoBC;AAED,oDAgDC;AAED,sCAEC;;AAvMD,uCAAmD;AACnD,iCAA0B;AAC1B,uCAAkC;AAClC,mCAAmC;AACnC,6BAA6B;AAC7B,iDAA+D;AAE/D,iDAA+D;AAC/D,+CAA0E;AAO1E,SAAgB,aAAa,CAAC,IAAU,EAAE,UAAkB;IAC1D,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAY,IAAA,iBAAQ,EACzD,IAAI,EACJ,cAAc,CACf,CAAC;IAEF,OAAO,CAAC,CAAC,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAG,UAAU,CAAC,CAAA,IAAI,CAAC,CAAC,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAG,UAAU,CAAC,CAAA,CAAC;AACzE,CAAC;AAED,SAAsB,UAAU,CAC9B,gBAAwB,EACxB,KAAa;;;QAEb,MAAM,MAAM,GAAG,IAAI,iCAAiB,CAAC;YACnC,MAAM,EAAE;gBACN,EAAE,EAAE,aAAa;gBACjB,MAAM,EAAE,EAAE;aACX;YACD,IAAI,EAAE;gBACJ,SAAS,EAAE,gBAAgB;gBAC3B,SAAS,EAAE,gBAAgB,KAAK,gCAAgC;gBAChE,aAAa,EAAE,gBAAgB,KAAK,+BAA+B;aACpE;SACF,CAAC,CAAC;QAEH,wEAAwE;QACxE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACvD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAA,uBAAS,EAAC,MAAM,CAAC,EAAE,CAAC;oBACvB,OAAO,MAAM,CAAC,WAAW,CAAC;gBAC5B,CAAC;gBAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBACxB,IAAI,CAAC;wBACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM;6BAC3B,WAAW,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;6BACrF,OAAO,EAAE,CAAC;wBACb,MAAM,SAAS,GAAG,MAAC,KAAK,CAAC,YAAY,CAAY,mCAAI,GAAG,CAAC;wBACzD,IAAA,4BAAc,EAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,CAAW,EAAE,KAAK,CAAC,eAAe,CAAuB,EAAE,SAAS,CAAC,CAAC;wBAClI,OAAO,KAAK,CAAC,cAAc,CAAW,CAAC;oBACzC,CAAC;oBAAC,WAAM,CAAC;wBACP,kDAAkD;oBACpD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,gCAAgC,CAAC;QACtD,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC;YAC3C,YAAY;YACZ,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG,EAAE,GAAG;gBACrC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;gBAElC,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CACN,mEAAmE,CACpE,CAAC;oBACF,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC;wBACd,IAAI,EAAE,IAAc;wBACpB,YAAY;qBACb,CAAC,CACH,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACnC,YAAY;YACZ,IAAI,OAAO,CAAc,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CACrC,UAAU,CACR,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,EACvD,MAAM,CACP,CACF;SACF,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAEjC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAC,KAAK,CAAC,YAAY,CAAY,mCAAI,GAAG,CAAC;YACzD,IAAA,4BAAc,EAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,CAAW,EAAE,KAAK,CAAC,eAAe,CAAuB,EAAE,SAAS,CAAC,CAAC;QACpI,CAAC;QAED,OAAO,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;CAAA;AAED,SAAsB,cAAc,CAAC,YAAoB;;QACvD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,eAAK,CAAC,GAAG,CACvC,IAAI,GAAG,CAAC,2CAA2C,EAAE,YAAY,CAAC,CAAC,IAAI,EACvE,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CACrE,CAAC;QAEF,MAAM,IAAI,GAA2B,OAAO,CAAC,MAAM,CACjD,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,iCAAM,MAAM,KAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,IAAG,EACvD,EAAE,CACH,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,SAAsB,YAAY,CAAC,gBAAwB,EAAE,KAAa;;QACxE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,eAAK,CAAC,GAAG,CAEtC,IAAI,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE;YAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;aAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAM,EAAqB;YAC9C,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iDAAiD;YAC1D,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC;IAChB,CAAC;CAAA;AAED,SAAsB,oBAAoB,CACxC,KAAW,EACX,OAA8F;;;QAE9F,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QACrC,MAAM,WAAW,GAAG,2BAAY,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;QAEhD,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,4DAA4D;YAC5D,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAEpE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAK,CAAC,GAAG,CAC9B,IAAI,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAC5C,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CACrC,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,cAAc,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,KAAK,CAAC,KAAK,CAAC;YACjD,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;YACrF,OAAO;gBACL,MAAM,EAAE,IAAA,cAAK,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAClC,WAAW,EAAE,KAAK;gBAClB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;gBAC9C,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;gBACpD,WAAW,EAAE,KAAK;aACnB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,0EAA0E;YAC1E,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC;YACtF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO;gBACL,MAAM,EAAE,IAAA,cAAK,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;gBACnC,WAAW,EAAE,MAAM,CAAC,KAAK;gBACzB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;gBAC9C,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;CAAA;AAED,SAAgB,aAAa,CAAC,OAAgB;;IAC5C,OAAO,CAAC,CAAC,CAAA,MAAC,OAAuB,aAAvB,OAAO,uBAAP,OAAO,CAAkB,IAAI,0CAAE,WAAW,CAAA,CAAC;AACvD,CAAC"}
+{"version":3,"file":"adsp-utils.js","sourceRoot":"","sources":["../../../../../packages/nx-oc/src/adsp/adsp-utils.ts"],"names":[],"mappings":";;AAeA,sCAOC;AAED,gCAqFC;AAED,wCAYC;AAED,oCAoBC;AAED,oDAgDC;AAED,sCAEC;AAWD,sDA0EC;;AA5RD,uCAAmD;AACnD,iCAA0B;AAC1B,uCAAkC;AAClC,mCAAmC;AACnC,6BAA6B;AAC7B,iDAA+D;AAE/D,iDAA+D;AAC/D,+CAA0E;AAO1E,SAAgB,aAAa,CAAC,IAAU,EAAE,UAAkB;IAC1D,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAY,IAAA,iBAAQ,EACzD,IAAI,EACJ,cAAc,CACf,CAAC;IAEF,OAAO,CAAC,CAAC,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAG,UAAU,CAAC,CAAA,IAAI,CAAC,CAAC,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAG,UAAU,CAAC,CAAA,CAAC;AACzE,CAAC;AAED,SAAsB,UAAU,CAC9B,gBAAwB,EACxB,KAAa;;;QAEb,MAAM,MAAM,GAAG,IAAI,iCAAiB,CAAC;YACnC,MAAM,EAAE;gBACN,EAAE,EAAE,aAAa;gBACjB,MAAM,EAAE,EAAE;aACX;YACD,IAAI,EAAE;gBACJ,SAAS,EAAE,gBAAgB;gBAC3B,SAAS,EAAE,gBAAgB,KAAK,gCAAgC;gBAChE,aAAa,EAAE,gBAAgB,KAAK,+BAA+B;aACpE;SACF,CAAC,CAAC;QAEH,wEAAwE;QACxE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACvD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAA,uBAAS,EAAC,MAAM,CAAC,EAAE,CAAC;oBACvB,OAAO,MAAM,CAAC,WAAW,CAAC;gBAC5B,CAAC;gBAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBACxB,IAAI,CAAC;wBACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM;6BAC3B,WAAW,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;6BACrF,OAAO,EAAE,CAAC;wBACb,MAAM,SAAS,GAAG,MAAC,KAAK,CAAC,YAAY,CAAY,mCAAI,GAAG,CAAC;wBACzD,IAAA,4BAAc,EAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,CAAW,EAAE,KAAK,CAAC,eAAe,CAAuB,EAAE,SAAS,CAAC,CAAC;wBAClI,OAAO,KAAK,CAAC,cAAc,CAAW,CAAC;oBACzC,CAAC;oBAAC,WAAM,CAAC;wBACP,kDAAkD;oBACpD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,gCAAgC,CAAC;QACtD,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC;YAC3C,YAAY;YACZ,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG,EAAE,GAAG;gBACrC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;gBAElC,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CACN,mEAAmE,CACpE,CAAC;oBACF,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC;wBACd,IAAI,EAAE,IAAc;wBACpB,YAAY;qBACb,CAAC,CACH,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACnC,YAAY;YACZ,IAAI,OAAO,CAAc,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CACrC,UAAU,CACR,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,EACvD,MAAM,CACP,CACF;SACF,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAEjC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAC,KAAK,CAAC,YAAY,CAAY,mCAAI,GAAG,CAAC;YACzD,IAAA,4BAAc,EAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,CAAW,EAAE,KAAK,CAAC,eAAe,CAAuB,EAAE,SAAS,CAAC,CAAC;QACpI,CAAC;QAED,OAAO,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;CAAA;AAED,SAAsB,cAAc,CAAC,YAAoB;;QACvD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,eAAK,CAAC,GAAG,CACvC,IAAI,GAAG,CAAC,2CAA2C,EAAE,YAAY,CAAC,CAAC,IAAI,EACvE,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CACrE,CAAC;QAEF,MAAM,IAAI,GAA2B,OAAO,CAAC,MAAM,CACjD,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,iCAAM,MAAM,KAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,IAAG,EACvD,EAAE,CACH,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,SAAsB,YAAY,CAAC,gBAAwB,EAAE,KAAa;;QACxE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,eAAK,CAAC,GAAG,CAEtC,IAAI,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE;YAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;aAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAM,EAAqB;YAC9C,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iDAAiD;YAC1D,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC;IAChB,CAAC;CAAA;AAED,SAAsB,oBAAoB,CACxC,KAAW,EACX,OAA8F;;;QAE9F,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QACrC,MAAM,WAAW,GAAG,2BAAY,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;QAEhD,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,4DAA4D;YAC5D,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAEpE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAK,CAAC,GAAG,CAC9B,IAAI,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAC5C,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CACrC,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,cAAc,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,KAAK,CAAC,KAAK,CAAC;YACjD,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;YACrF,OAAO;gBACL,MAAM,EAAE,IAAA,cAAK,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAClC,WAAW,EAAE,KAAK;gBAClB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;gBAC9C,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;gBACpD,WAAW,EAAE,KAAK;aACnB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,0EAA0E;YAC1E,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC;YACtF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO;gBACL,MAAM,EAAE,IAAA,cAAK,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;gBACnC,WAAW,EAAE,MAAM,CAAC,KAAK;gBACzB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;gBAC9C,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;CAAA;AAED,SAAgB,aAAa,CAAC,OAAgB;;IAC5C,OAAO,CAAC,CAAC,CAAA,MAAC,OAAuB,aAAvB,OAAO,uBAAP,OAAO,CAAkB,IAAI,0CAAE,WAAW,CAAA,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAsB,qBAAqB,CACzC,gBAAwB,EACxB,KAAa,EACb,QAAgB,EAChB,YAAsB,EACtB,WAA+B;;;QAE/B,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,sBAAsB,KAAK,UAAU,EAAE,gBAAgB,CAAC;aAC1E,IAAI,CAAC;QACR,MAAM,UAAU,GAAG,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,CAAC,QAA8B,EAAE,SAAmB,EAAE,EAAE,CACpE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,eAAK,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC9C,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,OAAO,EAAE,UAAU;aACpB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CACT,0BAA0B,QAAQ,yBAAyB,KAAK,mCAAmC,CACpG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,kBAAkB,GAAa,CACnC,MAAA,MAAA,MAAM,CAAC,UAAU,0CAAG,2BAA2B,CAAC,mCAAI,EAAE,CACvD;iBACE,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC,CAAC;YAEnB,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAC/D,MAAM,cAAc,GAAG,KAAK,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE1E,IACE,aAAa,CAAC,MAAM,KAAK,CAAC,MAAA,MAAA,MAAM,CAAC,YAAY,0CAAE,MAAM,mCAAI,CAAC,CAAC;gBAC3D,cAAc,KAAK,CAAC,MAAA,MAAA,MAAM,CAAC,UAAU,0CAAG,2BAA2B,CAAC,mCAAI,EAAE,CAAC,EAC3E,CAAC;gBACD,OAAO,CAAC,GAAG,CACT,mBAAmB,QAAQ,oBAAoB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1E,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,eAAK,CAAC,GAAG,CACb,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,EAAE,kCAEjB,MAAM,KACT,YAAY,EAAE,aAAa,EAC3B,UAAU,kCACL,MAAM,CAAC,UAAU,KACpB,2BAA2B,EAAE,cAAc,QAG/C,EAAE,OAAO,EAAE,UAAU,EAAE,CACxB,CAAC;YACF,OAAO,CAAC,GAAG,CACT,iDAAiD,QAAQ,MAAM,YAAY,CAAC,IAAI,CAC9E,IAAI,CACL,EAAE,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GACV,MAAA,MAAA,MAAC,GAA4D,aAA5D,GAAG,uBAAH,GAAG,CAA2D,QAAQ,0CACnE,MAAM,mCACT,GAA4B,aAA5B,GAAG,uBAAH,GAAG,CAA2B,OAAO,mCACtC,GAAG,CAAC;YACN,OAAO,CAAC,GAAG,CACT,+CAA+C,QAAQ,MAAM,MAAM,EAAE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;CAAA"}

package/src/build-assets.spec.ts

@@ -0,0 +1,62 @@
+import * as fs from 'fs';
+import * as path from 'path';
+// minimatch is always present (nx depends on it); used only in this test.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+import minimatch = require('minimatch');
+
+/**
+ * Guards the source -> published-package boundary.
+ *
+ * The build copies non-source files (generator templates, schemas, static
+ * assets) into the package via the build target's `assets` globs. Any such file
+ * NOT matched by a glob is silently dropped from the published package, so a
+ * consumer's generate produces output referencing a file that was never
+ * shipped. This is exactly how `Dockerfile__tmpl__` was lost: the rename from
+ * `Dockerfile.template` (dotted) to `Dockerfile__tmpl__` (dotless) stopped it
+ * matching `**\/*.!(ts)`.
+ *
+ * Unit tests of the generators can't catch this — they resolve templates from
+ * the source tree, never the packaged output. This asserts the invariant
+ * directly: every non-TypeScript file under src is covered by an asset glob.
+ */
+describe('build assets packaging', () => {
+  const srcRoot = __dirname;
+  const projectRoot = path.join(srcRoot, '..');
+  const repoRoot = path.join(projectRoot, '..', '..');
+
+  function listFiles(dir: string): string[] {
+    return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+      const full = path.join(dir, entry.name);
+      return entry.isDirectory() ? listFiles(full) : [full];
+    });
+  }
+
+  it('matches every non-TypeScript src file with an asset glob', () => {
+    const project = JSON.parse(
+      fs.readFileSync(path.join(projectRoot, 'project.json'), 'utf-8')
+    );
+    const assets: unknown[] = project.targets.build.options.assets ?? [];
+
+    // Globs whose input is this package's src directory.
+    const srcGlobs = assets
+      .filter(
+        (a): a is { input: string; glob: string } =>
+          typeof a === 'object' &&
+          a !== null &&
+          'input' in a &&
+          path.resolve(repoRoot, (a as { input: string }).input) === srcRoot
+      )
+      .map((a) => a.glob);
+
+    // Every non-source file under src must ship (tsc only emits .ts -> .js).
+    const mustShip = listFiles(srcRoot)
+      .filter((f) => !/\.tsx?$/.test(f))
+      .map((f) => path.relative(srcRoot, f));
+
+    const unmatched = mustShip.filter(
+      (rel) => !srcGlobs.some((glob) => minimatch(rel, glob, { dot: true }))
+    );
+
+    expect(unmatched).toEqual([]);
+  });
+});

package/src/executors/sandbox/sandbox.d.ts

@@ -0,0 +1,5 @@
+import { ExecutorContext } from '@nx/devkit';
+import { SandboxExecutorSchema } from './schema';
+export default function runExecutor(options: SandboxExecutorSchema, context: ExecutorContext): Promise<{
+    success: boolean;
+}>;

package/src/executors/sandbox/sandbox.js

@@ -0,0 +1,183 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = runExecutor;
+const tslib_1 = require("tslib");
+const devkit_1 = require("@nx/devkit");
+const child_process_1 = require("child_process");
+const app_type_1 = require("../../utils/app-type");
+const oc_utils_1 = require("../../utils/oc-utils");
+const PROXY_TAG_PREFIX = 'adsp:proxy-service:';
+// Fail fast, with an actionable message, before the (slow) production build —
+// rather than a raw "command not found" partway through.
+function requireTool(tool, hint) {
+    try {
+        (0, child_process_1.execSync)(`command -v ${tool}`, { stdio: 'ignore', shell: '/bin/bash' });
+    }
+    catch (_a) {
+        throw new Error(`'${tool}' is required but was not found on PATH. ${hint}`);
+    }
+}
+// The pull secret + registry login read the gh session token, so gh must be
+// installed AND authenticated. Checked up front so a missing/expired login
+// fails before the slow build rather than at the push/import step.
+function requireGhAuth() {
+    requireTool('gh', 'Install the GitHub CLI (https://cli.github.com).');
+    try {
+        (0, child_process_1.execSync)('gh auth status', { stdio: 'ignore', shell: '/bin/bash' });
+    }
+    catch (_a) {
+        throw new Error('gh is installed but not authenticated. Run `gh auth login` as an account with write:packages on the registry org (check/switch with `gh auth status` / `gh auth switch`).');
+    }
+}
+// podman must be installed and its machine reachable. `podman info` fails when
+// the machine is stopped, so it catches that before the build.
+function requirePodman() {
+    requireTool('podman', "Install it (macOS: 'brew install podman').");
+    try {
+        (0, child_process_1.execSync)('podman info', { stdio: 'ignore', shell: '/bin/bash' });
+    }
+    catch (_a) {
+        throw new Error("podman is installed but not responding — start the machine (macOS: 'podman machine start').");
+    }
+}
+function run(label, cmd, cwd) {
+    devkit_1.logger.info(`\n▸ ${label}`);
+    // Safe to echo: secrets are shell substitutions ($(gh auth token), $(grep …
+    // .env)), so the literal command never contains a resolved secret.
+    devkit_1.logger.info(`  $ ${cmd}`);
+    (0, child_process_1.execSync)(cmd, { stdio: 'inherit', cwd, shell: '/bin/bash' });
+}
+// oc tag triggers an async imagestream reconcile, so a back-to-back
+// import-image can 409 ("object has been modified"). Retry until it settles.
+function importWithRetry(imageStreamTag, namespace, cwd, retries) {
+    for (let attempt = 1;; attempt++) {
+        try {
+            run(`Import image (attempt ${attempt}/${retries})`, `oc import-image ${imageStreamTag} --confirm -n ${namespace}`, cwd);
+            return;
+        }
+        catch (err) {
+            if (attempt >= retries) {
+                throw new Error(`oc import-image failed after ${retries} attempts: ${err.message}`);
+            }
+            devkit_1.logger.warn(`  import-image failed (likely the oc tag reconcile race); retrying in 3s`);
+            (0, child_process_1.execSync)('sleep 3', { stdio: 'ignore' });
+        }
+    }
+}
+function runExecutor(options, context) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const projectName = context.projectName;
+        const project = projectName && ((_a = context.projectsConfigurations) === null || _a === void 0 ? void 0 : _a.projects[projectName]);
+        if (!projectName || !project) {
+            devkit_1.logger.error('[nx-oc:sandbox] Could not resolve the target project.');
+            return { success: false };
+        }
+        const { sandboxProject, registry, imageTag = 'sandbox', skipBuild = false, skipPush = false, importRetries = 5, } = options;
+        if (!sandboxProject) {
+            devkit_1.logger.error('[nx-oc:sandbox] "sandboxProject" is required.');
+            return { success: false };
+        }
+        if (!registry) {
+            devkit_1.logger.error('[nx-oc:sandbox] "registry" is required.');
+            return { success: false };
+        }
+        const appType = (_b = options.appType) !== null && _b !== void 0 ? _b : (0, app_type_1.detectApplicationType)(project);
+        if (!appType) {
+            devkit_1.logger.error(`[nx-oc:sandbox] Could not determine the application type for ${projectName}.`);
+            return { success: false };
+        }
+        const database = (_c = options.database) !== null && _c !== void 0 ? _c : 'none';
+        // Container registries (GHCR) require lowercase paths. Prefix the image with
+        // the (per-user) namespace so images from different experimenters never
+        // collide on GHCR's org-global package names.
+        const reg = registry.toLowerCase();
+        const registryHost = reg.split('/')[0];
+        const imageName = `${sandboxProject}-${projectName}`.toLowerCase();
+        const imageRef = `${reg}/${imageName}:${imageTag}`;
+        const projectRoot = project.root;
+        const cwd = context.root;
+        try {
+            // ---- preflight: check prerequisites before the expensive build ----
+            (0, oc_utils_1.ensureOcLogin)();
+            // The pull secret + import always need gh (session token to reach GHCR).
+            requireGhAuth();
+            if (!skipBuild || !skipPush) {
+                requirePodman();
+            }
+            // ---- service client secret (node services authenticate to ADSP) ----
+            // Upserted from the current .env so re-runs pick up a rotated secret.
+            if (appType === 'node') {
+                run('Upsert CLIENT_SECRET', `oc create secret generic ${projectName}-secrets ` +
+                    `--from-literal=CLIENT_SECRET="$(grep -E '^CLIENT_SECRET=' ${projectRoot}/.env 2>/dev/null | cut -d= -f2-)" ` +
+                    `-n ${sandboxProject} --dry-run=client -o yaml | oc apply -f -`, cwd);
+            }
+            // ---- shared database provisioning ----
+            if (database === 'postgres') {
+                run('Ensure Postgres credentials', `oc get secret sandbox-postgres-creds -n ${sandboxProject} 2>/dev/null || ` +
+                    `oc create secret generic sandbox-postgres-creds ` +
+                    `--from-literal=POSTGRESQL_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') ` +
+                    `-n ${sandboxProject}`, cwd);
+                run('Deploy shared Postgres', `oc apply -f .openshift/sandbox/sandbox-postgres.yml -n ${sandboxProject}`, cwd);
+                // The shared Postgres only creates the admin database; each app needs its
+                // own <app>_sandbox database created before its migrate init container
+                // runs. Wait for Postgres, then create the database idempotently.
+                const dbName = `${projectName}_sandbox`;
+                run('Create app database', `oc rollout status deployment/sandbox-postgres -n ${sandboxProject} --timeout=180s && ` +
+                    `oc exec -n ${sandboxProject} deployment/sandbox-postgres -- ` +
+                    `bash -lc "psql -U postgres -tc \\"SELECT 1 FROM pg_database WHERE datname='${dbName}'\\" ` +
+                    `| grep -q 1 || createdb -U postgres ${dbName}"`, cwd);
+            }
+            else if (database === 'mongo') {
+                run('Ensure MongoDB credentials', `oc get secret sandbox-mongodb-creds -n ${sandboxProject} 2>/dev/null || ` +
+                    `oc create secret generic sandbox-mongodb-creds ` +
+                    `--from-literal=MONGODB_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') ` +
+                    `-n ${sandboxProject}`, cwd);
+                run('Deploy shared MongoDB', `oc apply -f .openshift/sandbox/sandbox-mongodb.yml -n ${sandboxProject}`, cwd);
+            }
+            // ---- paired backend Services (so a frontend's nginx resolves proxy_pass
+            // upstreams at startup). Only the Service is needed for DNS. Idempotent. ----
+            const proxyServices = ((_d = project.tags) !== null && _d !== void 0 ? _d : [])
+                .filter((tag) => tag.startsWith(PROXY_TAG_PREFIX))
+                .map((tag) => {
+                const value = tag.slice(PROXY_TAG_PREFIX.length);
+                const lastColon = value.lastIndexOf(':');
+                return { name: value.slice(0, lastColon), port: value.slice(lastColon + 1) };
+            });
+            for (const { name, port } of proxyServices) {
+                run(`Ensure paired Service ${name}`, `oc get service ${name} -n ${sandboxProject} >/dev/null 2>&1 || ` +
+                    `oc create service clusterip ${name} --tcp=${port}:${port} -n ${sandboxProject}`, cwd);
+            }
+            // ---- build locally + push to the registry ----
+            if (!skipBuild) {
+                run('Build', `npx nx build ${projectName} --configuration production`, cwd);
+                run('Podman build', `podman build --platform=linux/amd64 -f .openshift/${projectName}/Dockerfile -t ${imageRef} .`, cwd);
+            }
+            if (!skipPush) {
+                // gh supplies the token so no PAT is stored; the same session token backs
+                // the pull secret below.
+                run('Registry login', `gh auth token | podman login ${registryHost} -u "$(gh api user -q .login)" --password-stdin`, cwd);
+                run('Push image', `podman push ${imageRef}`, cwd);
+            }
+            // ---- import into the namespace imagestream + roll out ----
+            // Per-deploy pull secret from the gh session (no long-lived PAT needed).
+            run('Upsert pull secret', `oc create secret docker-registry ghcr-pull ` +
+                `--docker-server=${registryHost} --docker-username="$(gh api user -q .login)" --docker-password="$(gh auth token)" ` +
+                `-n ${sandboxProject} --dry-run=client -o yaml | oc apply -f -`, cwd);
+            // oc tag sets/repoints the imagestream tag with reference-policy=local so
+            // pods pull in-cluster; import --confirm then pulls the current manifest.
+            run('Tag imagestream', `oc tag ${imageRef} ${projectName}:${imageTag} --reference-policy=local -n ${sandboxProject}`, cwd);
+            importWithRetry(`${projectName}:${imageTag}`, sandboxProject, cwd, importRetries);
+            run('Apply manifest', `oc process -f .openshift/${projectName}/${projectName}.yml -p PROJECT=${sandboxProject} | oc apply -f -`, cwd);
+            run('Restart rollout', `oc rollout restart deployment/${projectName} -n ${sandboxProject}`, cwd);
+            run('Wait for rollout', `oc rollout status deployment/${projectName} -n ${sandboxProject} --timeout=180s`, cwd);
+            devkit_1.logger.info(`\n✓ Sandbox deploy complete for ${projectName}.`);
+            return { success: true };
+        }
+        catch (err) {
+            devkit_1.logger.error(`\n[nx-oc:sandbox] ${err.message}`);
+            return { success: false };
+        }
+    });
+}
+//# sourceMappingURL=sandbox.js.map

package/src/executors/sandbox/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/executors/sandbox/sandbox.ts"],"names":[],"mappings":";;AA0FA,8BAwMC;;AAlSD,uCAAqD;AACrD,iDAAyC;AACzC,mDAA6D;AAC7D,mDAAqD;AAGrD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,8EAA8E;AAC9E,yDAAyD;AACzD,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,IAAI,CAAC;QACH,IAAA,wBAAQ,EAAC,cAAc,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,IAAI,IAAI,4CAA4C,IAAI,EAAE,CAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,2EAA2E;AAC3E,mEAAmE;AACnE,SAAS,aAAa;IACpB,WAAW,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,IAAA,wBAAQ,EAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2KAA2K,CAC5K,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,+DAA+D;AAC/D,SAAS,aAAa;IACpB,WAAW,CACT,QAAQ,EACR,4CAA4C,CAC7C,CAAC;IACF,IAAI,CAAC;QACH,IAAA,wBAAQ,EAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW;IAClD,eAAM,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC5B,4EAA4E;IAC5E,mEAAmE;IACnE,eAAM,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IAC1B,IAAA,wBAAQ,EAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,oEAAoE;AACpE,6EAA6E;AAC7E,SAAS,eAAe,CACtB,cAAsB,EACtB,SAAiB,EACjB,GAAW,EACX,OAAe;IAEf,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,GAAG,CACD,yBAAyB,OAAO,IAAI,OAAO,GAAG,EAC9C,mBAAmB,cAAc,iBAAiB,SAAS,EAAE,EAC7D,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,cACpC,GAAa,CAAC,OACjB,EAAE,CACH,CAAC;YACJ,CAAC;YACD,eAAM,CAAC,IAAI,CACT,0EAA0E,CAC3E,CAAC;YACF,IAAA,wBAAQ,EAAC,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAA8B,WAAW,CACvC,OAA8B,EAC9B,OAAwB;;;QAExB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,MAAM,OAAO,GACX,WAAW,KAAI,MAAA,OAAO,CAAC,sBAAsB,0CAAE,QAAQ,CAAC,WAAW,CAAC,CAAA,CAAC;QACvE,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,eAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,EACJ,cAAc,EACd,QAAQ,EACR,QAAQ,GAAG,SAAS,EACpB,SAAS,GAAG,KAAK,EACjB,QAAQ,GAAG,KAAK,EAChB,aAAa,GAAG,CAAC,GAClB,GAAG,OAAO,CAAC;QAEZ,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,eAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,eAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,IAAA,gCAAqB,EAAC,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,eAAM,CAAC,KAAK,CACV,gEAAgE,WAAW,GAAG,CAC/E,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAG,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,CAAC;QAE5C,6EAA6E;QAC7E,wEAAwE;QACxE,8CAA8C;QAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,GAAG,cAAc,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC;YACH,sEAAsE;YACtE,IAAA,wBAAa,GAAE,CAAC;YAChB,yEAAyE;YACzE,aAAa,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,aAAa,EAAE,CAAC;YAClB,CAAC;YAED,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,GAAG,CACD,sBAAsB,EACtB,4BAA4B,WAAW,WAAW;oBAChD,6DAA6D,WAAW,qCAAqC;oBAC7G,MAAM,cAAc,2CAA2C,EACjE,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,yCAAyC;YACzC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,GAAG,CACD,6BAA6B,EAC7B,2CAA2C,cAAc,kBAAkB;oBACzE,kDAAkD;oBAClD,oFAAoF;oBACpF,MAAM,cAAc,EAAE,EACxB,GAAG,CACJ,CAAC;gBACF,GAAG,CACD,wBAAwB,EACxB,0DAA0D,cAAc,EAAE,EAC1E,GAAG,CACJ,CAAC;gBACF,0EAA0E;gBAC1E,uEAAuE;gBACvE,kEAAkE;gBAClE,MAAM,MAAM,GAAG,GAAG,WAAW,UAAU,CAAC;gBACxC,GAAG,CACD,qBAAqB,EACrB,oDAAoD,cAAc,qBAAqB;oBACrF,cAAc,cAAc,kCAAkC;oBAC9D,8EAA8E,MAAM,OAAO;oBAC3F,uCAAuC,MAAM,GAAG,EAClD,GAAG,CACJ,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAChC,GAAG,CACD,4BAA4B,EAC5B,0CAA0C,cAAc,kBAAkB;oBACxE,iDAAiD;oBACjD,iFAAiF;oBACjF,MAAM,cAAc,EAAE,EACxB,GAAG,CACJ,CAAC;gBACF,GAAG,CACD,uBAAuB,EACvB,yDAAyD,cAAc,EAAE,EACzE,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,8EAA8E;YAC9E,MAAM,aAAa,GAAG,CAAC,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC;iBACvC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;iBACjD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACX,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/E,CAAC,CAAC,CAAC;YACL,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;gBAC3C,GAAG,CACD,yBAAyB,IAAI,EAAE,EAC/B,kBAAkB,IAAI,OAAO,cAAc,sBAAsB;oBAC/D,+BAA+B,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,cAAc,EAAE,EAClF,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,iDAAiD;YACjD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CACD,OAAO,EACP,gBAAgB,WAAW,6BAA6B,EACxD,GAAG,CACJ,CAAC;gBACF,GAAG,CACD,cAAc,EACd,qDAAqD,WAAW,kBAAkB,QAAQ,IAAI,EAC9F,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,0EAA0E;gBAC1E,yBAAyB;gBACzB,GAAG,CACD,gBAAgB,EAChB,gCAAgC,YAAY,iDAAiD,EAC7F,GAAG,CACJ,CAAC;gBACF,GAAG,CAAC,YAAY,EAAE,eAAe,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YAED,6DAA6D;YAC7D,yEAAyE;YACzE,GAAG,CACD,oBAAoB,EACpB,6CAA6C;gBAC3C,mBAAmB,YAAY,qFAAqF;gBACpH,MAAM,cAAc,2CAA2C,EACjE,GAAG,CACJ,CAAC;YACF,0EAA0E;YAC1E,0EAA0E;YAC1E,GAAG,CACD,iBAAiB,EACjB,UAAU,QAAQ,IAAI,WAAW,IAAI,QAAQ,gCAAgC,cAAc,EAAE,EAC7F,GAAG,CACJ,CAAC;YACF,eAAe,CACb,GAAG,WAAW,IAAI,QAAQ,EAAE,EAC5B,cAAc,EACd,GAAG,EACH,aAAa,CACd,CAAC;YAEF,GAAG,CACD,gBAAgB,EAChB,4BAA4B,WAAW,IAAI,WAAW,mBAAmB,cAAc,kBAAkB,EACzG,GAAG,CACJ,CAAC;YACF,GAAG,CACD,iBAAiB,EACjB,iCAAiC,WAAW,OAAO,cAAc,EAAE,EACnE,GAAG,CACJ,CAAC;YACF,GAAG,CACD,kBAAkB,EAClB,gCAAgC,WAAW,OAAO,cAAc,iBAAiB,EACjF,GAAG,CACJ,CAAC;YAEF,eAAM,CAAC,IAAI,CAAC,mCAAmC,WAAW,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAM,CAAC,KAAK,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;CAAA"}

package/src/executors/sandbox/sandbox.spec.ts

@@ -0,0 +1,186 @@
+import { ExecutorContext } from '@nx/devkit';
+import runExecutor from './sandbox';
+import { SandboxExecutorSchema } from './schema';
+
+jest.mock('child_process', () => ({
+  ...jest.requireActual('child_process'),
+  execSync: jest.fn(),
+}));
+jest.mock('../../utils/oc-utils', () => ({ ensureOcLogin: jest.fn() }));
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { execSync } = require('child_process') as { execSync: jest.Mock };
+
+const IMAGE_REF = 'ghcr.io/test-org/test-sandbox-test:sandbox';
+
+function context(tags: string[] = []): ExecutorContext {
+  return {
+    root: '/ws',
+    cwd: '/ws',
+    isVerbose: false,
+    projectName: 'test',
+    projectsConfigurations: {
+      version: 2,
+      projects: {
+        test: { root: 'apps/test', tags },
+      },
+    },
+  } as unknown as ExecutorContext;
+}
+
+const baseOptions: SandboxExecutorSchema = {
+  sandboxProject: 'test-sandbox',
+  registry: 'ghcr.io/test-org',
+  appType: 'node',
+};
+
+// The commands passed to execSync, in call order.
+function commands(): string[] {
+  return execSync.mock.calls.map((c) => c[0] as string);
+}
+
+beforeEach(() => {
+  execSync.mockReset();
+  execSync.mockImplementation(() => Buffer.from(''));
+});
+
+describe('sandbox executor', () => {
+  it('builds, pushes, tags, imports, and rolls out in order', async () => {
+    const result = await runExecutor(baseOptions, context());
+    expect(result.success).toBe(true);
+
+    const cmds = commands();
+    const has = (s: string) => cmds.some((c) => c.includes(s));
+    expect(has('nx build test --configuration production')).toBe(true);
+    expect(
+      has(
+        `podman build --platform=linux/amd64 -f .openshift/test/Dockerfile -t ${IMAGE_REF} .`
+      )
+    ).toBe(true);
+    expect(has(`podman push ${IMAGE_REF}`)).toBe(true);
+    expect(
+      has(`oc tag ${IMAGE_REF} test:sandbox --reference-policy=local -n test-sandbox`)
+    ).toBe(true);
+    expect(has('oc import-image test:sandbox --confirm -n test-sandbox')).toBe(true);
+    expect(has('oc create secret docker-registry ghcr-pull')).toBe(true);
+    expect(has('oc rollout restart deployment/test -n test-sandbox')).toBe(true);
+    expect(has('oc rollout status deployment/test -n test-sandbox')).toBe(true);
+
+    // ordering: build precedes push precedes tag precedes import precedes rollout
+    const idx = (s: string) => cmds.findIndex((c) => c.includes(s));
+    expect(idx('podman build')).toBeLessThan(idx('podman push'));
+    expect(idx('podman push')).toBeLessThan(idx('oc tag'));
+    expect(idx('oc tag')).toBeLessThan(idx('oc import-image'));
+    expect(idx('oc import-image')).toBeLessThan(idx('oc rollout restart'));
+  });
+
+  it('mirrors CLIENT_SECRET for a node service only', async () => {
+    await runExecutor(baseOptions, context());
+    expect(
+      commands().some(
+        (c) => c.includes('oc create secret generic test-secrets') && c.includes('CLIENT_SECRET')
+      )
+    ).toBe(true);
+
+    execSync.mockClear();
+    await runExecutor({ ...baseOptions, appType: 'frontend' }, context());
+    expect(commands().some((c) => c.includes('test-secrets'))).toBe(false);
+  });
+
+  it('fails fast with an actionable message when podman is missing', async () => {
+    execSync.mockImplementation((cmd: string) => {
+      if (cmd.startsWith('command -v podman')) throw new Error('not found');
+      return Buffer.from('');
+    });
+    const result = await runExecutor(baseOptions, context());
+    expect(result.success).toBe(false);
+    // did not proceed to the build
+    expect(commands().some((c) => c.includes('podman build'))).toBe(false);
+  });
+
+  it('fails fast when the podman machine is not running', async () => {
+    execSync.mockImplementation((cmd: string) => {
+      if (cmd === 'podman info') throw new Error('cannot connect');
+      return Buffer.from('');
+    });
+    const result = await runExecutor(baseOptions, context());
+    expect(result.success).toBe(false);
+    expect(commands().some((c) => c.includes('podman build'))).toBe(false);
+  });
+
+  it('fails fast when gh is installed but not authenticated (before the build)', async () => {
+    execSync.mockImplementation((cmd: string) => {
+      if (cmd === 'gh auth status') throw new Error('not logged in');
+      return Buffer.from('');
+    });
+    const result = await runExecutor(baseOptions, context());
+    expect(result.success).toBe(false);
+    // gh checked up front — no build/push happened
+    expect(commands().some((c) => c.includes('nx build test'))).toBe(false);
+    expect(commands().some((c) => c.includes('podman build'))).toBe(false);
+  });
+
+  it('retries oc import-image on the tag-reconcile race', async () => {
+    let importAttempts = 0;
+    execSync.mockImplementation((cmd: string) => {
+      if (cmd.includes('oc import-image')) {
+        importAttempts++;
+        if (importAttempts < 3) throw new Error('409 the object has been modified');
+      }
+      return Buffer.from('');
+    });
+    const result = await runExecutor(baseOptions, context());
+    expect(result.success).toBe(true);
+    expect(importAttempts).toBe(3);
+  });
+
+  it('gives up after importRetries and fails', async () => {
+    execSync.mockImplementation((cmd: string) => {
+      if (cmd.includes('oc import-image')) throw new Error('409');
+      return Buffer.from('');
+    });
+    const result = await runExecutor({ ...baseOptions, importRetries: 2 }, context());
+    expect(result.success).toBe(false);
+    const importCalls = commands().filter((c) => c.includes('oc import-image'));
+    expect(importCalls.length).toBe(2);
+  });
+
+  it('skipBuild/skipPush reuse the existing image', async () => {
+    await runExecutor({ ...baseOptions, skipBuild: true, skipPush: true }, context());
+    const cmds = commands();
+    expect(cmds.some((c) => c.includes('podman build'))).toBe(false);
+    expect(cmds.some((c) => c.includes('nx build test'))).toBe(false);
+    expect(cmds.some((c) => c.includes('podman push'))).toBe(false);
+    // still imports + rolls out
+    expect(cmds.some((c) => c.includes('oc import-image'))).toBe(true);
+    expect(cmds.some((c) => c.includes('oc rollout restart'))).toBe(true);
+  });
+
+  it('provisions Postgres and the per-app database before rollout', async () => {
+    await runExecutor({ ...baseOptions, database: 'postgres' }, context());
+    const cmds = commands();
+    expect(cmds.some((c) => c.includes('sandbox-postgres-creds'))).toBe(true);
+    expect(cmds.some((c) => c.includes('sandbox-postgres.yml'))).toBe(true);
+    expect(cmds.some((c) => c.includes('createdb -U postgres test_sandbox'))).toBe(true);
+    const createDbIdx = cmds.findIndex((c) => c.includes('createdb'));
+    const rolloutIdx = cmds.findIndex((c) => c.includes('rollout status deployment/test'));
+    expect(createDbIdx).toBeGreaterThanOrEqual(0);
+    expect(createDbIdx).toBeLessThan(rolloutIdx);
+  });
+
+  it('ensures paired backend Services from proxy-service tags (idempotent)', async () => {
+    await runExecutor(
+      { ...baseOptions, appType: 'frontend' },
+      context(['adsp:proxy-service:test-service:3333'])
+    );
+    const guard = commands().find((c) => c.includes('oc get service test-service'));
+    expect(guard).toBeTruthy();
+    expect(guard).toContain('||');
+    expect(guard).toContain('oc create service clusterip test-service --tcp=3333:3333');
+  });
+
+  it('adds no paired-service guard without proxy-service tags', async () => {
+    await runExecutor(baseOptions, context());
+    expect(commands().some((c) => c.includes('oc get service'))).toBe(false);
+  });
+});

package/src/executors/sandbox/schema.d.ts

@@ -0,0 +1,12 @@
+import { ApplicationType, DatabaseType } from '../../generators/deployment/schema';
+
+export interface SandboxExecutorSchema {
+  sandboxProject: string;
+  registry: string;
+  database?: DatabaseType;
+  appType?: ApplicationType;
+  imageTag?: string;
+  skipBuild?: boolean;
+  skipPush?: boolean;
+  importRetries?: number;
+}