@abgov/nx-oc 13.0.0-beta.1 → 13.0.0-beta.3

package/src/executors/sandbox/schema.json

@@ -0,0 +1,50 @@
+{
+  "version": 2,
+  "outputCapture": "direct-nodejs",
+  "$schema": "http://json-schema.org/schema",
+  "title": "Sandbox deploy executor",
+  "description": "Builds the project image locally with podman, pushes it to the container registry, imports it into the sandbox namespace, and rolls out the deployment.",
+  "type": "object",
+  "properties": {
+    "sandboxProject": {
+      "type": "string",
+      "description": "The OpenShift namespace to deploy the sandbox into."
+    },
+    "registry": {
+      "type": "string",
+      "description": "Container registry the sandbox image is published to (e.g. ghcr.io/my-org)."
+    },
+    "database": {
+      "type": "string",
+      "enum": ["none", "postgres", "mongo"],
+      "default": "none",
+      "description": "Provision a shared sandbox database of this type before deploying."
+    },
+    "appType": {
+      "type": "string",
+      "enum": ["node", "frontend", "dotnet"],
+      "description": "Application type. Detected from the project configuration when omitted."
+    },
+    "imageTag": {
+      "type": "string",
+      "default": "sandbox",
+      "description": "Image tag pushed and imported into the namespace imagestream."
+    },
+    "skipBuild": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip the nx build + podman build steps and reuse the already-built image (resume a partial deploy)."
+    },
+    "skipPush": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip the registry login + push and reuse the already-pushed image (resume from the import step)."
+    },
+    "importRetries": {
+      "type": "number",
+      "default": 5,
+      "description": "How many times to retry oc import-image (absorbs the 409 from oc tag's async reconcile)."
+    }
+  },
+  "required": ["sandboxProject", "registry"]
+}

package/src/generators/deployment/deployment.js

@@ -7,51 +7,37 @@ const path = require("path");
 const yaml = require("yaml");
 const pipeline_envs_1 = require("../../pipeline-envs");
 const git_utils_1 = require("../../utils/git-utils");
+const app_type_1 = require("../../utils/app-type");
 const adsp_1 = require("../../adsp");
 const infraManifestFile = '.openshift/environments.yml';
 function normalizeOptions(host, options) {
     return tslib_1.__awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e;
         const projectName = (0, devkit_1.names)(options.project).fileName;
         const result = host.read(infraManifestFile).toString();
         const { items } = yaml.parse(result);
         const ocInfraProject = ((_b = (_a = items[0]) === null || _a === void 0 ? void 0 : _a.metadata) === null || _b === void 0 ? void 0 : _b.namespace) || '';
         const SA_PREFIX = 'system:serviceaccounts:';
         const ocEnvProjects = (_d = (_c = items[0]) === null || _c === void 0 ? void 0 : _c.subjects) === null || _d === void 0 ? void 0 : _d.filter((s) => s.kind === 'Group' && s.name.startsWith(SA_PREFIX)).map((s) => s.name.replace(SA_PREFIX, ''));
-        // TODO: Find a better way to determine this.
         const config = (0, devkit_1.readProjectConfiguration)(host, projectName);
-        let appType = options.appType;
-        if (!appType) {
-            switch (config.targets.build.executor) {
-                case '@nx/web:webpack':
-                case '@angular-devkit/build-angular:browser':
-                    appType = 'frontend';
-                    break;
-                case '@nx/node:build':
-                    appType = 'node';
-                    break;
-                case '@nx-dotnet/core:build':
-                    appType = 'dotnet';
-                    break;
-                case '@nx/webpack:webpack': {
-                    // More recent version of NX switched to use a generic webpack executor for builds.
-                    appType =
-                        config.targets.build.options.target === 'node' ? 'node' : 'frontend';
-                    break;
-                }
-            }
-        }
+        const appType = (_e = options.appType) !== null && _e !== void 0 ? _e : (0, app_type_1.detectApplicationType)(config);
         const adsp = yield (0, adsp_1.getAdspConfiguration)(host, options);
         return Object.assign(Object.assign({}, options), { appType,
             adsp,
             projectName,
             ocInfraProject,
-            ocEnvProjects });
+            ocEnvProjects, buildOutputPath: (0, app_type_1.getBuildOutputPath)(config) });
     });
 }
 function addFiles(host, options) {
     var _a, _b;
-    const templateOptions = Object.assign(Object.assign(Object.assign({}, options), options.adsp), { sourceRepositoryUrl: (0, git_utils_1.getGitRemoteUrl)(), database: (_a = options.database) !== null && _a !== void 0 ? _a : 'none', sandbox: (_b = options.sandbox) !== null && _b !== void 0 ? _b : false, tmpl: '' });
+    const templateOptions = Object.assign(Object.assign(Object.assign({}, options), options.adsp), { 
+        // Clean https URL for the image's source label (never the raw remote, which
+        // may be an SSH URL or carry a trailing newline).
+        sourceRepositoryUrl: (() => {
+            const repo = (0, git_utils_1.getGitHubRepo)((0, git_utils_1.getGitRemoteUrl)());
+            return repo ? `https://github.com/${repo}` : '';
+        })(), database: (_a = options.database) !== null && _a !== void 0 ? _a : 'none', sandbox: (_b = options.sandbox) !== null && _b !== void 0 ? _b : false, tmpl: '' });
     (0, devkit_1.generateFiles)(host, path.join(__dirname, `${options.appType}-files`), `./.openshift/${options.projectName}`, templateOptions);
 }
 function default_1(host, options) {

package/src/generators/deployment/deployment.js.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/deployment/deployment.ts"],"names":[],"mappings":";;AAqFA,4BAqCC;;AA1HD,uCAOoB;AACpB,6BAA6B;AAC7B,6BAA6B;AAC7B,uDAA2D;AAC3D,qDAAwD;AAExD,qCAAkD;AAElD,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAExD,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,CAAA,MAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,QAAQ,0CAAE,SAAS,KAAI,EAAE,CAAC;QAE3D,MAAM,SAAS,GAAG,yBAAyB,CAAC;QAC5C,MAAM,aAAa,GAAG,MAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,QAAQ,0CACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QAE7C,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAoB,OAAO,CAAC,OAAO,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACtC,KAAK,iBAAiB,CAAC;gBACvB,KAAK,uCAAuC;oBAC1C,OAAO,GAAG,UAAU,CAAC;oBACrB,MAAM;gBACR,KAAK,gBAAgB;oBACnB,OAAO,GAAG,MAAM,CAAC;oBACjB,MAAM;gBACR,KAAK,uBAAuB;oBAC1B,OAAO,GAAG,QAAQ,CAAC;oBACnB,MAAM;gBACR,KAAK,qBAAqB,CAAC,CAAC,CAAC;oBAC3B,mFAAmF;oBACnF,OAAO;wBACL,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;oBACvE,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEvD,uCACK,OAAO,KACV,OAAO;YACP,IAAI;YACJ,WAAW;YACX,cAAc;YACd,aAAa,IACb;IACJ,CAAC;CAAA;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,OAAyB;;IACrD,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI,KACf,mBAAmB,EAAE,IAAA,2BAAe,GAAE,EACtC,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,EACpC,OAAO,EAAE,MAAA,OAAO,CAAC,OAAO,mCAAI,KAAK,EACjC,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,EAChD,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CACT,qEAAqE,CACtE,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,mCACT,MAAM,CAAC,OAAO,KACjB,YAAY,EAAE;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE;oBACP,SAAS,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;;wBAAC,OAAA,CAAC;4BAC9D,OAAO;4BACP,GAAG,EAAE,MAAA,4BAAI,CAAC,CAAC,CAAC,0CAAE,WAAW,EAAE;yBAC5B,CAAC,CAAA;qBAAA,CAAC;iBACJ;aACF,GACF,CAAC;QAEF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClC,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CAAA"}
+{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/deployment/deployment.ts"],"names":[],"mappings":";;AAuEA,4BAqCC;;AA5GD,uCAOoB;AACpB,6BAA6B;AAC7B,6BAA6B;AAC7B,uDAA2D;AAC3D,qDAAuE;AACvE,mDAAiF;AAEjF,qCAAkD;AAElD,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAExD,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,CAAA,MAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,QAAQ,0CAAE,SAAS,KAAI,EAAE,CAAC;QAE3D,MAAM,SAAS,GAAG,yBAAyB,CAAC;QAC5C,MAAM,aAAa,GAAG,MAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,QAAQ,0CACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QAE7C,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,IAAA,gCAAqB,EAAC,MAAM,CAAC,CAAC;QAEjE,MAAM,IAAI,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEvD,uCACK,OAAO,KACV,OAAO;YACP,IAAI;YACJ,WAAW;YACX,cAAc;YACd,aAAa,EACb,eAAe,EAAE,IAAA,6BAAkB,EAAC,MAAM,CAAC,IAC3C;IACJ,CAAC;CAAA;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,OAAyB;;IACrD,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI;QACf,4EAA4E;QAC5E,kDAAkD;QAClD,mBAAmB,EAAE,CAAC,GAAG,EAAE;YACzB,MAAM,IAAI,GAAG,IAAA,yBAAa,EAAC,IAAA,2BAAe,GAAE,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC,CAAC,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,CAAC,CAAC,EAAE,EACJ,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,EACpC,OAAO,EAAE,MAAA,OAAO,CAAC,OAAO,mCAAI,KAAK,EACjC,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,EAChD,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CACT,qEAAqE,CACtE,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,mCACT,MAAM,CAAC,OAAO,KACjB,YAAY,EAAE;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE;oBACP,SAAS,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;;wBAAC,OAAA,CAAC;4BAC9D,OAAO;4BACP,GAAG,EAAE,MAAA,4BAAI,CAAC,CAAC,CAAC,0CAAE,WAAW,EAAE;yBAC5B,CAAC,CAAA;qBAAA,CAAC;iBACJ;aACF,GACF,CAAC;QAEF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClC,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CAAA"}

package/src/generators/deployment/deployment.spec.ts

@@ -158,6 +158,10 @@ describe('Deployment Generator', () => {
     const manifest = host.read('.openshift/test/test.yml').toString();
     expect(manifest).toContain('readinessProbe');
     expect(manifest).toContain('livenessProbe');
+    // The service authenticates with ADSP using a confidential client secret,
+    // injected from the ${APP_NAME}-secrets Secret.
+    expect(manifest).toContain('CLIENT_SECRET');
+    expect(manifest).toContain('${APP_NAME}-secrets');
   });
 
   it('can generate deployment for dotnet', async () => {
@@ -218,8 +222,7 @@ describe('Deployment Generator', () => {
     const manifest = host.read('.openshift/test/test.yml').toString();
     expect(manifest).toContain('DATABASE_URL');
     expect(manifest).toContain('initContainers');
-    expect(manifest).toContain('prisma');
-    expect(manifest).toContain('migrate');
+    expect(manifest).toContain('migrate.js');
   });
 
   it('includes MONGODB_URI secretKeyRef without init container for mongo node deployment', async () => {

package/src/generators/deployment/dotnet-files/Dockerfile__tmpl__

@@ -0,0 +1,16 @@
+FROM registry.access.redhat.com/ubi8/dotnet-80 AS build
+ARG PROJECT
+WORKDIR /src
+COPY . .
+RUN dotnet publish ${PROJECT} -c Release -o /app/publish
+
+FROM registry.access.redhat.com/ubi8/dotnet-80-runtime
+<% if (sourceRepositoryUrl) { %>
+# Provenance: associate the image with its source repo (shown in GHCR).
+LABEL org.opencontainers.image.source=<%= sourceRepositoryUrl %>
+<% } %>
+WORKDIR /app
+COPY --from=build /app/publish .
+ENV ASPNETCORE_URLS=http://+:5000
+EXPOSE 5000
+CMD ["dotnet", "<%= projectName %>.dll"]

package/src/generators/deployment/frontend-files/Dockerfile__tmpl__

@@ -0,0 +1,10 @@
+FROM registry.access.redhat.com/ubi9/nginx-120
+<% if (sourceRepositoryUrl) { %>
+# Provenance: associate the image with its source repo (shown in GHCR).
+LABEL org.opencontainers.image.source=<%= sourceRepositoryUrl %>
+<% } %>
+# Build output path mirrors the workspace layout (from the project's build target).
+COPY ./<%= buildOutputPath %>/nginx.conf "${NGINX_CONF_PATH}"
+COPY ./<%= buildOutputPath %> .
+
+CMD nginx -g "daemon off;"

package/src/generators/deployment/node-files/Dockerfile__tmpl__

@@ -0,0 +1,10 @@
+FROM registry.access.redhat.com/ubi9/nodejs-24
+<% if (sourceRepositoryUrl) { %>
+# Provenance: associate the image with its source repo (shown in GHCR).
+LABEL org.opencontainers.image.source=<%= sourceRepositoryUrl %>
+<% } %>
+# Build output path mirrors the workspace layout (from the project's build target).
+COPY ./<%= buildOutputPath %> .
+COPY ./node_modules ./node_modules
+
+CMD node main.js

package/src/generators/deployment/node-files/__projectName__.yml__tmpl__

@@ -91,7 +91,7 @@ objects:
 <% } else { %>
               image: image-registry.openshift-image-registry.svc:5000/${INFRA_PROJECT}/${APP_NAME}:${DEPLOY_TAG}
 <% } %>
-              command: ["npx", "prisma", "migrate", "deploy"]
+              command: ["node", "migrate.js"]
               envFrom:
                 - configMapRef:
                     name: ${APP_NAME}
@@ -127,6 +127,17 @@ objects:
                   value: '3333'
                 - name: LOG_LEVEL
                   value: info
+                # ADSP confidential-client secret the service uses to authenticate
+                # with the access service. Sandbox: created by `nx run <app>:sandbox`
+                # from the service's .env.
+<% if (!sandbox) { %>
+                # Other envs: oc create secret generic ${APP_NAME}-secrets --from-literal=CLIENT_SECRET=<secret>
+<% } %>
+                - name: CLIENT_SECRET
+                  valueFrom:
+                    secretKeyRef:
+                      name: ${APP_NAME}-secrets
+                      key: CLIENT_SECRET
 <% if (database === 'postgres') { %>
 <% if (sandbox) { %>
                 - name: POSTGRES_PASSWORD

package/src/generators/deployment/schema.d.ts

@@ -19,4 +19,5 @@ export interface NormalizedSchema extends Schema {
   ocInfraProject: string;
   ocEnvProjects: string[];
   adsp: AdspConfiguration;
+  buildOutputPath: string;
 }

package/src/generators/sandbox/database-files/sandbox-postgres.yml__tmpl__

@@ -3,7 +3,9 @@
 # deleted on re-apply, so data persists across deployments.
 #
 # Multiple apps in the same namespace share this instance. Each app uses its
-# own database (<appName>_sandbox) created automatically by Prisma migrate.
+# own database (<appName>_sandbox): the `nx run <app>:sandbox` target creates it
+# (idempotently) after Postgres is ready, and the app's migrate init container
+# applies the schema on deploy.
 #
 # Credentials are stored in the sandbox-postgres-creds Secret, created once
 # per namespace by `nx run <app>:sandbox` on first use. Subsequent apps read

package/src/generators/sandbox/files/SANDBOX.md__tmpl__

@@ -0,0 +1,91 @@
+# Sandbox deploy — <%= projectName %>
+
+Deploy runbook for coding agents. `nx run <%= projectName %>:sandbox` builds the
+image **locally with podman**, pushes it to GHCR, imports it into the
+`<%= sandboxProject %>` namespace, and rolls out — no git push or CI wait. The
+orchestration lives in the `@abgov/nx-oc:sandbox` executor (versioned in the
+plugin), so the steps below are what it runs for you.
+
+## What the target does, in order
+
+1. **Preflight** — `oc` login, `gh` auth, and `podman` machine are checked up
+   front; a failure here stops before the build with an actionable message.
+2. Upsert the pull secret + <% if (appType === 'node') { %>the `CLIENT_SECRET` secret + <% } %>any paired Services<% if (database && database !== 'none') { %> + the shared `<%= database %>` database<% } %>.
+3. `nx build <%= projectName %> --configuration production`
+4. `podman build` → `podman login` (gh token) → `podman push` to
+   `<%= registry %>/<%= imageName %>:sandbox`.
+5. `oc tag … --reference-policy=local` then `oc import-image` (retried to absorb
+   the tag-reconcile 409).
+6. `oc process | oc apply` the manifest, then `oc rollout restart` + `status`.
+
+## Options (resume a partial deploy without rebuilding)
+
+```bash
+nx run <%= projectName %>:sandbox --skipBuild            # reuse the built image; re-push + import + roll out
+nx run <%= projectName %>:sandbox --skipBuild --skipPush # reuse the pushed image; re-import + roll out only
+nx run <%= projectName %>:sandbox --imageTag=<tag>       # push/import under a different tag
+nx run <%= projectName %>:sandbox --importRetries=8      # more import retries on a slow cluster
+```
+
+## Preflight failures — cause → fix
+
+- **`'podman' is required …`** — podman not installed. `brew install podman` (macOS).
+- **`podman is installed but not responding`** — machine stopped. `podman machine start`.
+- **`'gh' is required …`** — GitHub CLI not installed. See https://cli.github.com.
+- **`gh is installed but not authenticated`** — run `gh auth login`.
+- **oc login prompts / fails** — `oc login` to your cluster, targeting the
+  `<%= sandboxProject %>` namespace (`oc project <%= sandboxProject %>`).
+
+## If the deploy fails mid-way (work around by hand)
+
+The executor stops at the first failing step. After fixing the cause, the
+fastest path is usually `--skipBuild` (or `--skipBuild --skipPush`) to resume.
+If you need to drive it manually, these are the remaining steps — the image ref
+is `<%= registry %>/<%= imageName %>:sandbox`:
+
+```bash
+NS=<%= sandboxProject %>
+REF=<%= registry %>/<%= imageName %>:sandbox
+# (1) push, if not already pushed
+gh auth token | podman login <%= registryHost %> -u "$(gh api user -q .login)" --password-stdin
+podman push "$REF"
+# (2) point the imagestream at it and import (retry absorbs the tag race)
+oc tag "$REF" <%= projectName %>:sandbox --reference-policy=local -n "$NS"
+until oc import-image <%= projectName %>:sandbox --confirm -n "$NS"; do sleep 3; done
+# (3) apply the manifest and roll out
+oc process -f .openshift/<%= projectName %>/<%= projectName %>.yml -p PROJECT="$NS" | oc apply -f -
+oc rollout restart deployment/<%= projectName %> -n "$NS"
+oc rollout status  deployment/<%= projectName %> -n "$NS" --timeout=180s
+```
+
+## Verify
+
+```bash
+oc get pods -n <%= sandboxProject %> -l name=<%= projectName %>
+<% if (appType === 'node') { %>curl "https://$(oc get route <%= projectName %> -n <%= sandboxProject %> -o jsonpath='{.spec.host}')/health"<% } else { %>curl -I "https://$(oc get route <%= projectName %> -n <%= sandboxProject %> -o jsonpath='{.spec.host}')/"<% } %>
+```
+
+## Known issues & workarounds
+
+- **`podman push` / import fails with an auth error** — the *active* `gh`
+  account lacks `write:packages` (or access to the org). Preflight only confirms
+  *an* account is logged in, not its scope. Check `gh auth status`; switch with
+  `gh auth switch -u <account>`, then re-run with `--skipBuild`.
+- **Pod `FailedCreate` "exceeded quota"** — the namespace CPU quota is full.
+  Free room: `oc get deploy -n <%= sandboxProject %>` then delete stale apps
+  (`oc delete all,configmap,is -l app=<old-app> -n <%= sandboxProject %>`), and re-run.
+- **Pod `CrashLoopBackOff`** — `oc logs -n <%= sandboxProject %> <pod> -c <%= projectName %>`.<% if (appType === 'node' && database && database !== 'none') { %>
+  For the DB migration, also check the init container:
+  `oc logs -n <%= sandboxProject %> <pod> -c <%= projectName %>-migrate`.<% } %>
+<% if (appType === 'frontend') { %>- **Sign-in returns `Invalid redirect_uri`** — the sandbox Route wasn't
+  registered on the Keycloak public client (the generator does this when it can
+  resolve the cluster ingress domain). Add `https://<%= projectName %>-<%= sandboxProject %>.<ingress-domain>/*`
+  to the client's valid redirect URIs.
+<% } %>- **Import 409 "object has been modified"** — the `oc tag` reconcile race; the
+  executor already retries. If you hit it manually, just re-run the import.
+
+## Teardown
+
+```bash
+nx run <%= projectName %>:sandbox-teardown   # remove sandbox resources + delete the GHCR image
+```

package/src/generators/sandbox/sandbox.js

@@ -6,41 +6,86 @@ const devkit_1 = require("@nx/devkit");
 const path = require("path");
 const adsp_1 = require("../../adsp");
 const git_utils_1 = require("../../utils/git-utils");
+const oc_utils_1 = require("../../utils/oc-utils");
+const app_type_1 = require("../../utils/app-type");
+const SANDBOX_GENERATOR = '@abgov/nx-oc:sandbox';
+// Resolves the sandbox container registry once per workspace and persists it to
+// nx.json so subsequent sandbox generations reuse it without re-prompting:
+//   --registry flag → nx.json → derived from git remote (ghcr.io/<org>) → prompt.
+function resolveRegistry(host, registry, remoteUrl) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        if (registry)
+            return persistRegistry(host, registry);
+        const stored = (_c = (_b = (_a = (0, devkit_1.readNxJson)(host)) === null || _a === void 0 ? void 0 : _a.generators) === null || _b === void 0 ? void 0 : _b[SANDBOX_GENERATOR]) === null || _c === void 0 ? void 0 : _c.registry;
+        if (stored)
+            return stored;
+        const derived = (0, git_utils_1.deriveRegistryFromRemote)(remoteUrl);
+        if (derived) {
+            console.log(`\n✓ Sandbox registry: ${derived.toLowerCase()} (derived from git remote)\n`);
+            return persistRegistry(host, derived);
+        }
+        const { prompt } = yield Promise.resolve().then(() => require('enquirer'));
+        const { registry: answered } = yield prompt({
+            type: 'input',
+            name: 'registry',
+            message: 'What container registry should sandbox images be published to (e.g., ghcr.io/my-org)?',
+        });
+        return persistRegistry(host, answered);
+    });
+}
+// Container registries (GHCR) require lowercase paths, so normalize on store.
+function persistRegistry(host, registry) {
+    var _a, _b, _c;
+    const value = registry.toLowerCase();
+    const nxJson = (_a = (0, devkit_1.readNxJson)(host)) !== null && _a !== void 0 ? _a : {};
+    const generators = ((_b = nxJson.generators) !== null && _b !== void 0 ? _b : {});
+    generators[SANDBOX_GENERATOR] = Object.assign(Object.assign({}, ((_c = generators[SANDBOX_GENERATOR]) !== null && _c !== void 0 ? _c : {})), { registry: value });
+    nxJson.generators = generators;
+    (0, devkit_1.updateNxJson)(host, nxJson);
+    return value;
+}
 function normalizeOptions(host, options) {
     return tslib_1.__awaiter(this, void 0, void 0, function* () {
-        var _a;
+        var _a, _b;
         const projectName = (0, devkit_1.names)(options.project).fileName;
         const config = (0, devkit_1.readProjectConfiguration)(host, projectName);
-        let appType = options.appType;
-        if (!appType) {
-            switch (config.targets.build.executor) {
-                case '@nx/web:webpack':
-                case '@angular-devkit/build-angular:browser':
-                    appType = 'frontend';
-                    break;
-                case '@nx/node:build':
-                    appType = 'node';
-                    break;
-                case '@nx-dotnet/core:build':
-                    appType = 'dotnet';
-                    break;
-                case '@nx/webpack:webpack':
-                    appType =
-                        config.targets.build.options.target === 'node' ? 'node' : 'frontend';
-                    break;
-            }
-        }
-        const adsp = yield (0, adsp_1.getAdspConfiguration)(host, Object.assign(Object.assign({}, options), { env: (_a = options.env) !== null && _a !== void 0 ? _a : 'dev' }));
+        const appType = (_a = options.appType) !== null && _a !== void 0 ? _a : (0, app_type_1.detectApplicationType)(config);
+        const adsp = yield (0, adsp_1.getAdspConfiguration)(host, Object.assign(Object.assign({}, options), { env: (_b = options.env) !== null && _b !== void 0 ? _b : 'dev' }));
+        const remoteUrl = (0, git_utils_1.getGitRemoteUrl)();
+        const registry = (yield resolveRegistry(host, options.registry, remoteUrl)).toLowerCase();
+        // Prefix the image with the (per-user) sandbox namespace so images from
+        // different experimenters never collide on GHCR's org-global package names.
+        const imageName = `${options.sandboxProject}-${projectName}`.toLowerCase();
+        const repoSlug = (0, git_utils_1.getGitHubRepo)(remoteUrl);
         return Object.assign(Object.assign({}, options), { appType,
             adsp,
-            projectName });
+            projectName, buildOutputPath: (0, app_type_1.getBuildOutputPath)(config), registry, registryHost: registry.split('/')[0], registryOrg: registry.split('/').slice(1).join('/'), imageName, imageRef: `${registry}/${imageName}:sandbox`, sourceRepositoryUrl: repoSlug ? `https://github.com/${repoSlug}` : undefined });
     });
 }
 function addManifestFiles(host, options) {
-    var _a;
-    const templateOptions = Object.assign(Object.assign(Object.assign({}, options), options.adsp), { sourceRepositoryUrl: (0, git_utils_1.getGitRemoteUrl)(), database: (_a = options.database) !== null && _a !== void 0 ? _a : 'none', sandbox: true, ocInfraProject: options.sandboxProject, tmpl: '' });
+    var _a, _b;
+    const templateOptions = Object.assign(Object.assign(Object.assign({}, options), options.adsp), { 
+        // Clean https URL for the image's source label (provenance / UI connect).
+        sourceRepositoryUrl: (_a = options.sourceRepositoryUrl) !== null && _a !== void 0 ? _a : '', database: (_b = options.database) !== null && _b !== void 0 ? _b : 'none', sandbox: true, ocInfraProject: options.sandboxProject, tmpl: '' });
     (0, devkit_1.generateFiles)(host, path.join(__dirname, `../deployment/${options.appType}-files`), `./.openshift/${options.projectName}`, templateOptions);
 }
+// Emit the per-app deploy + troubleshooting runbook next to the manifests, so a
+// coding agent has one canonical, app-aware source (rather than the guidance
+// being duplicated across every app's AGENTS.md).
+function addSandboxDoc(host, options) {
+    var _a;
+    (0, devkit_1.generateFiles)(host, path.join(__dirname, 'files'), `./.openshift/${options.projectName}`, {
+        projectName: options.projectName,
+        appType: options.appType,
+        database: (_a = options.database) !== null && _a !== void 0 ? _a : 'none',
+        sandboxProject: options.sandboxProject,
+        registry: options.registry,
+        registryHost: options.registryHost,
+        imageName: options.imageName,
+        tmpl: '',
+    });
+}
 function addDatabaseFiles(host, options) {
     if (!options.database || options.database === 'none')
         return;
@@ -48,48 +93,54 @@ function addDatabaseFiles(host, options) {
 }
 function addSandboxTarget(host, options) {
     const config = (0, devkit_1.readProjectConfiguration)(host, options.project);
-    const { projectName, sandboxProject, database } = options;
-    const commands = [];
-    if (database === 'postgres') {
-        commands.push(`oc get secret sandbox-postgres-creds -n ${sandboxProject} 2>/dev/null || ` +
-            `oc create secret generic sandbox-postgres-creds ` +
-            `--from-literal=POSTGRESQL_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') ` +
-            `-n ${sandboxProject}`);
-        commands.push(`oc apply -f .openshift/sandbox/sandbox-postgres.yml -n ${sandboxProject}`);
-    }
-    else if (database === 'mongo') {
-        commands.push(`oc get secret sandbox-mongodb-creds -n ${sandboxProject} 2>/dev/null || ` +
-            `oc create secret generic sandbox-mongodb-creds ` +
-            `--from-literal=MONGODB_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') ` +
-            `-n ${sandboxProject}`);
-        commands.push(`oc apply -f .openshift/sandbox/sandbox-mongodb.yml -n ${sandboxProject}`);
-    }
-    commands.push(`oc process -f .openshift/${projectName}/${projectName}.yml -p PROJECT=${sandboxProject} | oc apply -f -`);
-    commands.push([
-        `REGISTRY=$(oc registry info)`,
-        `CONTAINER_CLI=$(command -v podman || command -v docker)`,
-        `$CONTAINER_CLI login -u $(oc whoami) -p $(oc whoami -t) $REGISTRY`,
-        `$CONTAINER_CLI build -t $REGISTRY/${sandboxProject}/${projectName}:sandbox -f .openshift/${projectName}/Dockerfile .`,
-        `$CONTAINER_CLI push $REGISTRY/${sandboxProject}/${projectName}:sandbox`,
-    ].join(' && '));
-    commands.push(`oc rollout restart deployment/${projectName} -n ${sandboxProject}`);
-    commands.push(`oc rollout status deployment/${projectName} -n ${sandboxProject} --timeout=120s`);
+    const { projectName, sandboxProject, database, appType, registry, registryOrg, imageName, } = options;
+    // The deploy orchestration (preflight, build → podman → push → import with
+    // retry → rollout, database/paired-service provisioning) lives in the
+    // @abgov/nx-oc:sandbox executor, versioned in the plugin — so bug fixes reach
+    // every project on `npm update` instead of being baked into project.json.
     config.targets = Object.assign(Object.assign({}, config.targets), { sandbox: {
-            executor: 'nx:run-commands',
-            options: {
-                commands,
-                sequential: true,
-            },
+            executor: '@abgov/nx-oc:sandbox',
+            options: Object.assign({ sandboxProject,
+                registry,
+                appType }, (database && database !== 'none' ? { database } : {})),
         }, 'sandbox-teardown': {
             executor: 'nx:run-commands',
             options: {
                 commands: [
-                    `oc delete all,configmap -l app=${projectName} -n ${sandboxProject} --ignore-not-found`,
+                    `oc delete all,configmap,is -l app=${projectName} -n ${sandboxProject} --ignore-not-found`,
+                    `oc delete imagestream ${projectName} -n ${sandboxProject} --ignore-not-found`,
+                    // Remove the sandbox package (needs delete:packages). Best-effort:
+                    // sandbox packages are the unlinked ones and can also be pruned org-wide
+                    // via `select(.repository == null)`.
+                    `gh api --method DELETE /orgs/${registryOrg}/packages/container/${imageName} 2>/dev/null || true`,
                 ],
             },
         } });
     (0, devkit_1.updateProjectConfiguration)(host, options.project, config);
 }
+// Register the sandbox deployment's Route with the frontend's public client so
+// browser sign-in works against the deployed URL — not just localhost. The
+// Route host is deterministic by convention (<app>-<namespace>.<ingressDomain>),
+// so this happens once at generate time using the token already obtained for
+// ADSP config — no per-deploy login.
+function registerSandboxRedirectUri(options) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        if (options.appType !== 'frontend')
+            return;
+        const { adsp, projectName, sandboxProject } = options;
+        if (!(adsp === null || adsp === void 0 ? void 0 : adsp.accessToken))
+            return;
+        const ingressDomain = (0, oc_utils_1.getClusterIngressDomain)();
+        if (!ingressDomain) {
+            console.log('[nx-oc] Could not determine the cluster ingress domain; skipping redirect URI registration. ' +
+                'Add the deployment Route to the client manually if browser sign-in fails.');
+            return;
+        }
+        const routeUrl = `https://${projectName}-${sandboxProject}.${ingressDomain}`;
+        const clientId = `urn:ads:${adsp.tenant}:${projectName}`;
+        yield (0, adsp_1.addClientRedirectUris)(adsp.accessServiceUrl, adsp.tenantRealm, clientId, [`${routeUrl}/*`], adsp.accessToken);
+    });
+}
 function default_1(host, options) {
     return tslib_1.__awaiter(this, void 0, void 0, function* () {
         const normalizedOptions = yield normalizeOptions(host, options);
@@ -99,7 +150,9 @@ function default_1(host, options) {
         }
         addManifestFiles(host, normalizedOptions);
         addDatabaseFiles(host, normalizedOptions);
+        addSandboxDoc(host, normalizedOptions);
         addSandboxTarget(host, normalizedOptions);
+        yield registerSandboxRedirectUri(normalizedOptions);
         yield (0, devkit_1.formatFiles)(host);
     });
 }

package/src/generators/sandbox/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/sandbox/sandbox.ts"],"names":[],"mappings":";;AAyJA,4BAWC;;AApKD,uCAOoB;AACpB,6BAA6B;AAC7B,qCAAkD;AAClD,qDAAwD;AAIxD,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAoB,OAAO,CAAC,OAAO,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACtC,KAAK,iBAAiB,CAAC;gBACvB,KAAK,uCAAuC;oBAC1C,OAAO,GAAG,UAAU,CAAC;oBACrB,MAAM;gBACR,KAAK,gBAAgB;oBACnB,OAAO,GAAG,MAAM,CAAC;oBACjB,MAAM;gBACR,KAAK,uBAAuB;oBAC1B,OAAO,GAAG,QAAQ,CAAC;oBACnB,MAAM;gBACR,KAAK,qBAAqB;oBACxB,OAAO;wBACL,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;oBACvE,MAAM;YACV,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,kCACvC,OAAO,KACV,GAAG,EAAE,MAAC,OAAO,CAAC,GAA+B,mCAAI,KAAK,IACtD,CAAC;QAEH,uCACK,OAAO,KACV,OAAO;YACP,IAAI;YACJ,WAAW,IACX;IACJ,CAAC;CAAA;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;;IAC7D,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI,KACf,mBAAmB,EAAE,IAAA,2BAAe,GAAE,EACtC,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,EACpC,OAAO,EAAE,IAAI,EACb,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,OAAO,CAAC,OAAO,QAAQ,CAAC,EAC9D,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;IAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO;IAC7D,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACtC,sBAAsB,EACtB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;IAC7D,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CACX,2CAA2C,cAAc,kBAAkB;YACzE,kDAAkD;YAClD,oFAAoF;YACpF,MAAM,cAAc,EAAE,CACzB,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,0DAA0D,cAAc,EAAE,CAC3E,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CACX,0CAA0C,cAAc,kBAAkB;YACxE,iDAAiD;YACjD,iFAAiF;YACjF,MAAM,cAAc,EAAE,CACzB,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,yDAAyD,cAAc,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAI,CACX,4BAA4B,WAAW,IAAI,WAAW,mBAAmB,cAAc,kBAAkB,CAC1G,CAAC;IAEF,QAAQ,CAAC,IAAI,CACX;QACE,8BAA8B;QAC9B,yDAAyD;QACzD,mEAAmE;QACnE,qCAAqC,cAAc,IAAI,WAAW,0BAA0B,WAAW,eAAe;QACtH,iCAAiC,cAAc,IAAI,WAAW,UAAU;KACzE,CAAC,IAAI,CAAC,MAAM,CAAC,CACf,CAAC;IAEF,QAAQ,CAAC,IAAI,CACX,iCAAiC,WAAW,OAAO,cAAc,EAAE,CACpE,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,gCAAgC,WAAW,OAAO,cAAc,iBAAiB,CAClF,CAAC;IAEF,MAAM,CAAC,OAAO,mCACT,MAAM,CAAC,OAAO,KACjB,OAAO,EAAE;YACP,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE;gBACP,QAAQ;gBACR,UAAU,EAAE,IAAI;aACjB;SACF,EACD,kBAAkB,EAAE;YAClB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE;gBACP,QAAQ,EAAE;oBACR,kCAAkC,WAAW,OAAO,cAAc,qBAAqB;iBACxF;aACF;SACF,GACF,CAAC;IAEF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CAAA"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/sandbox/sandbox.ts"],"names":[],"mappings":";;AA0OA,4BAaC;;AAvPD,uCASoB;AACpB,6BAA6B;AAC7B,qCAAyE;AACzE,qDAI+B;AAC/B,mDAA+D;AAC/D,mDAAiF;AAGjF,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAEjD,gFAAgF;AAChF,2EAA2E;AAC3E,kFAAkF;AAClF,SAAe,eAAe,CAC5B,IAAU,EACV,QAA4B,EAC5B,SAA6B;;;QAE7B,IAAI,QAAQ;YAAE,OAAO,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAA,MACb,MAAA,IAAA,mBAAU,EAAC,IAAI,CAAC,0CAAE,UAGnB,0CAAG,iBAAiB,CAAC,0CAAE,QAAQ,CAAC;QACjC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,IAAA,oCAAwB,EAAC,SAAS,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,yBAAyB,OAAO,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;YAC1F,OAAO,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,2CAAa,UAAU,EAAC,CAAC;QAC5C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAuB;YAChE,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EACL,uFAAuF;SAC1F,CAAC,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;CAAA;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,IAAU,EAAE,QAAgB;;IACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAA,IAAA,mBAAU,EAAC,IAAI,CAAC,mCAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,MAAA,MAAM,CAAC,UAAU,mCAAI,EAAE,CAG1C,CAAC;IACF,UAAU,CAAC,iBAAiB,CAAC,mCACxB,CAAC,MAAA,UAAU,CAAC,iBAAiB,CAAC,mCAAI,EAAE,CAAC,KACxC,QAAQ,EAAE,KAAK,GAChB,CAAC;IACF,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,IAAA,qBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,IAAA,gCAAqB,EAAC,MAAM,CAAC,CAAC;QAEjE,MAAM,IAAI,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,kCACvC,OAAO,KACV,GAAG,EAAE,MAAC,OAAO,CAAC,GAA+B,mCAAI,KAAK,IACtD,CAAC;QAEH,MAAM,SAAS,GAAG,IAAA,2BAAe,GAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1F,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAC;QAE1C,uCACK,OAAO,KACV,OAAO;YACP,IAAI;YACJ,WAAW,EACX,eAAe,EAAE,IAAA,6BAAkB,EAAC,MAAM,CAAC,EAC3C,QAAQ,EACR,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EACpC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EACnD,SAAS,EACT,QAAQ,EAAE,GAAG,QAAQ,IAAI,SAAS,UAAU,EAC5C,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,IAC5E;IACJ,CAAC;CAAA;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;;IAC7D,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI;QACf,0EAA0E;QAC1E,mBAAmB,EAAE,MAAA,OAAO,CAAC,mBAAmB,mCAAI,EAAE,EACtD,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,EACpC,OAAO,EAAE,IAAI,EACb,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,OAAO,CAAC,OAAO,QAAQ,CAAC,EAC9D,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,kDAAkD;AAClD,SAAS,aAAa,CAAC,IAAU,EAAE,OAAyB;;IAC1D,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAC7B,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC;QACE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,EAAE;KACT,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;IAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO;IAC7D,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACtC,sBAAsB,EACtB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;IAC7D,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,EACJ,WAAW,EACX,cAAc,EACd,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,SAAS,GACV,GAAG,OAAO,CAAC;IAEZ,2EAA2E;IAC3E,sEAAsE;IACtE,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,CAAC,OAAO,mCACT,MAAM,CAAC,OAAO,KACjB,OAAO,EAAE;YACP,QAAQ,EAAE,sBAAsB;YAChC,OAAO,kBACL,cAAc;gBACd,QAAQ;gBACR,OAAO,IACJ,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD;SACF,EACD,kBAAkB,EAAE;YAClB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE;gBACP,QAAQ,EAAE;oBACR,qCAAqC,WAAW,OAAO,cAAc,qBAAqB;oBAC1F,yBAAyB,WAAW,OAAO,cAAc,qBAAqB;oBAC9E,mEAAmE;oBACnE,yEAAyE;oBACzE,qCAAqC;oBACrC,gCAAgC,WAAW,uBAAuB,SAAS,sBAAsB;iBAClG;aACF;SACF,GACF,CAAC;IAEF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,iFAAiF;AACjF,6EAA6E;AAC7E,qCAAqC;AACrC,SAAe,0BAA0B,CAAC,OAAyB;;QACjE,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO;QAC3C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QACtD,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,CAAA;YAAE,OAAO;QAE/B,MAAM,aAAa,GAAG,IAAA,kCAAuB,GAAE,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CACT,8FAA8F;gBAC5F,2EAA2E,CAC9E,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,WAAW,IAAI,cAAc,IAAI,aAAa,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QACzD,MAAM,IAAA,4BAAqB,EACzB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,QAAQ,EACR,CAAC,GAAG,QAAQ,IAAI,CAAC,EACjB,IAAI,CAAC,WAAW,CACjB,CAAC;IACJ,CAAC;CAAA;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,aAAa,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACvC,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,MAAM,0BAA0B,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CAAA"}