@faable/faable 1.21.0 → 1.23.0

package/dist/api/context.js

@@ -7,7 +7,7 @@ import { CredentialsStore } from '../lib/CredentialsStore.js';
 import { loadLiveCredentials } from './session.js';
 import { log } from '../log.js';
 
-const context = async () => {
+const context = async (targetAppId) => {
     let api;
     // Auth resolution: FAABLE_TOKEN → OIDC (CI) → local `faable login` credentials.
     if (process.env.FAABLE_TOKEN) {
@@ -19,7 +19,12 @@ const context = async () => {
         // Github actions environment
         try {
             const idToken = process.env.FAABLE_ID_TOKEN || (await getIDToken("https://faable.com"));
-            api = FaableApi.create({ authStrategy: oidc_strategy, auth: { idToken } });
+            // targetAppId disambiguates a monorepo (several apps, one repo) in the
+            // OIDC exchange — from `faable deploy <app_id>`.
+            api = FaableApi.create({
+                authStrategy: oidc_strategy,
+                auth: { idToken, appId: targetAppId },
+            });
         }
         catch (_) {
             console.error("Error fetching token, configure 'permissions: id-token: write'");
@@ -54,8 +59,8 @@ const context = async () => {
 // Exits with a uniform message when there is no session at all. An expired
 // session that could not be refreshed still surfaces here as a working `api`
 // whose first call returns 401 — FaableApi maps that to the same re-login hint.
-const requireApi = async () => {
-    const ctx = await context();
+const requireApi = async (targetAppId) => {
+    const ctx = await context(targetAppId);
     if (!ctx.api) {
         log.error("❌ Not logged in. Run 'faable login' first.");
         process.exit(1);

package/dist/api/strategies/oidc.strategy.js

@@ -1,11 +1,15 @@
 import axios from 'axios';
 import { create_base_client } from '../base_client.js';
 
-const exchangeGithubOidcToken = async (gh_token) => {
+const exchangeGithubOidcToken = async (gh_token, target_app_id) => {
     const client = create_base_client();
     try {
+        // Monorepo: several apps share one repo, so the exchange can't infer which
+        // app the workflow targets — pass the explicit app_id (`faable deploy
+        // <app_id>`). The api verifies it's linked to the OIDC token's repository.
         const res = await client.post("/auth/github-oidc", {
-            token: gh_token
+            token: gh_token,
+            ...(target_app_id ? { app_id: target_app_id } : {})
         });
         const { access_token, app_id } = res.data;
         return { access_token, app_id };
@@ -31,28 +35,24 @@ const exchangeGithubOidcToken = async (gh_token) => {
     }
 };
 const oidc_strategy = (config) => {
-    const { idToken } = config;
+    const { idToken, appId } = config;
     if (!idToken) {
         throw new Error("Missing idToken.");
     }
     let token_ex;
+    const ensure = async () => {
+        if (!token_ex)
+            token_ex = await exchangeGithubOidcToken(idToken, appId);
+        return token_ex;
+    };
     return {
         headers: async () => {
-            if (!token_ex) {
-                const ex = await exchangeGithubOidcToken(idToken);
-                token_ex = ex;
-            }
+            const ex = await ensure();
             return {
-                Authorization: `Bearer ${token_ex.access_token}`,
+                Authorization: `Bearer ${ex.access_token}`,
             };
         },
-        app_id: async () => {
-            if (!token_ex) {
-                const ex = await exchangeGithubOidcToken(idToken);
-                token_ex = ex;
-            }
-            return token_ex.app_id;
-        }
+        app_id: async () => (await ensure()).app_id,
     };
 };
 

package/dist/commands/deploy/index.js

@@ -54,11 +54,20 @@ const deploy = {
         // into the build-log buffer) and cmd() (which captures subprocess output
         // into the same buffer). Must happen before any detect/build call.
         configure_buildpacks({ log, exec: cmd });
-        const ctx = await requireApi();
+        // Pass the explicit app target to the OIDC exchange so a monorepo (several
+        // apps, one repo) can be disambiguated in CI.
+        const ctx = await requireApi(args.app_id);
         const { api } = ctx;
         const config = Configuration.instance().deployConfig();
         const app_id = await resolve_app_id(args.app_id, ctx.appId, api, workdir);
         const app = await api.getApp(app_id);
+        // Monorepo Root Directory: the server is the source of truth
+        // (App.root_dir), so no repo config file is needed. A local
+        // faable.json rootDir (dev override) still wins if set.
+        if (!config.rootDir && app.root_dir) {
+            config.rootDir = app.root_dir;
+            log.info(`📁 Monorepo root directory (from app): ${app.root_dir}`);
+        }
         // Capture the commit/ref/actor so the deployment records which commit
         // it came from and who pushed it (env in CI, git fallback locally).
         const git = await git_context({ workdir });

package/dist/lib/Configuration.js

@@ -54,6 +54,7 @@ class Configuration {
             startCommand: this.config.startCommand,
             buildCommand: this.config.buildCommand,
             buildpack: this.config.buildpack,
+            rootDir: this.config.rootDir,
             next: this.config.next,
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "1.21.0",
+  "version": "1.23.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "@actions/core": "^3.0.0",
-    "@faabletools/buildpacks": "^1.0.0",
+    "@faabletools/buildpacks": "^1.7.0",
     "axios": "^1.13.2",
     "fs-extra": "^11.3.2",
     "handlebars": "^4.7.8",