@geekmidas/cli 10.0.0-alpha.1 → 10.0.0-alpha.11

package/dist/github-CrpsXSfV.mjs

@@ -0,0 +1,196 @@
+import "./discover-CAlFgYec.mjs";
+import { loadWorkspaceConfig } from "./config-B0L2tvvC.mjs";
+import { assertDeployedStage } from "./workspace-DaEX7FEg.mjs";
+import { getKeyPath } from "./keystore-TxeYM7an.mjs";
+import { existsSync, readFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { AttachRolePolicyCommand, CreateOpenIDConnectProviderCommand, CreateRoleCommand, GetRoleCommand, IAMClient, ListOpenIDConnectProvidersCommand, UpdateAssumeRolePolicyCommand } from "@aws-sdk/client-iam";
+
+//#region src/deploy/github.ts
+const logger = console;
+const GITHUB_OIDC_HOST = "token.actions.githubusercontent.com";
+const AUDIENCE = "sts.amazonaws.com";
+/**
+* What SST needs to create a stack is most of AWS, so this is the default —
+* said out loud in the output, and replaceable with `--policy-arn`.
+*/
+const DEFAULT_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess";
+const defaultGh = (args, input) => execFileSync("gh", args, {
+	encoding: "utf-8",
+	...input === void 0 ? {} : {
+		input,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	}
+}).trim();
+/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */
+function roleName(project, stage) {
+	return `${project}-github-${stage}`.toLowerCase().replace(/[^a-z0-9+=,.@_-]/g, "-").slice(0, 64);
+}
+/**
+* Who may assume the role: a workflow job running in this repository's
+* `<stage>` environment, and nothing else — not another branch's job, not
+* another environment's. That is what keeps a staging deploy from using the
+* production role.
+*/
+function trustPolicy(providerArn, repo, stage) {
+	return JSON.stringify({
+		Version: "2012-10-17",
+		Statement: [{
+			Effect: "Allow",
+			Principal: { Federated: providerArn },
+			Action: "sts:AssumeRoleWithWebIdentity",
+			Condition: { StringEquals: {
+				[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,
+				[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`
+			} }
+		}]
+	});
+}
+/** GitHub's OIDC provider in this account, created if it is not there. */
+async function ensureOidcProvider(iam) {
+	const { OpenIDConnectProviderList = [] } = await iam.send(new ListOpenIDConnectProvidersCommand({}));
+	const existing = OpenIDConnectProviderList.find((p) => p.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`))?.Arn;
+	if (existing) return existing;
+	const created = await iam.send(new CreateOpenIDConnectProviderCommand({
+		Url: `https://${GITHUB_OIDC_HOST}`,
+		ClientIDList: [AUDIENCE]
+	}));
+	return created.OpenIDConnectProviderArn;
+}
+/** The deploy role, created or brought back to this trust and policy. */
+async function ensureRole(iam, name, trust, policyArn) {
+	let arn;
+	try {
+		const { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));
+		await iam.send(new UpdateAssumeRolePolicyCommand({
+			RoleName: name,
+			PolicyDocument: trust
+		}));
+		arn = Role.Arn;
+	} catch (error) {
+		if (error.name !== "NoSuchEntityException") throw error;
+		const { Role } = await iam.send(new CreateRoleCommand({
+			RoleName: name,
+			AssumeRolePolicyDocument: trust,
+			Description: "Deploys from GitHub Actions (gkm deploy:github)",
+			MaxSessionDuration: 3600 * 2
+		}));
+		arn = Role.Arn;
+	}
+	await iam.send(new AttachRolePolicyCommand({
+		RoleName: name,
+		PolicyArn: policyArn
+	}));
+	return arn;
+}
+/**
+* An IAM client for the stage's account.
+*
+* `fromIni` for a named profile, deliberately: it resolves exactly that
+* profile — keys, assume-role, `credential_process` or SSO, whichever
+* ~/.aws/config says — and never falls back to AWS_* in the environment. The
+* provider chain checks the environment first, so exported staging keys would
+* quietly win over `--profile prod` and the production role would land in the
+* staging account.
+*/
+async function iamFor(profile, endpoint) {
+	const config = { region: "us-east-1" };
+	if (profile) {
+		const { fromIni } = await import("@aws-sdk/credential-providers");
+		config.credentials = fromIni({ profile });
+	}
+	if (endpoint) {
+		config.endpoint = endpoint;
+		config.credentials = {
+			accessKeyId: "test",
+			secretAccessKey: "test"
+		};
+	}
+	return new IAMClient(config);
+}
+async function deployGithubCommand(options, deps = {}) {
+	const gh = deps.gh ?? defaultGh;
+	const { workspace } = await loadWorkspaceConfig(deps.cwd);
+	assertDeployedStage(workspace.stages, options.stage);
+	const repo = options.repo ?? gh([
+		"repo",
+		"view",
+		"--json",
+		"nameWithOwner",
+		"-q",
+		".nameWithOwner"
+	]);
+	const role = roleName(workspace.name, options.stage);
+	const policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;
+	const keyPath = getKeyPath(options.stage, workspace.name);
+	const hasKey = existsSync(keyPath);
+	logger.log(`\n🔐 GitHub → AWS for stage "${options.stage}"\n`);
+	logger.log(`  Repository:   ${repo}`);
+	logger.log(`  AWS profile:  ${options.profile ?? "(default credentials)"}`);
+	logger.log(`  Role:         ${role}`);
+	logger.log(`  Policy:       ${policyArn}${options.policyArn ? "" : "  (default; --policy-arn to narrow)"}`);
+	logger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);
+	logger.log(`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`);
+	if (options.dryRun) {
+		logger.log("\n  --dry-run: nothing changed.\n");
+		return { repo };
+	}
+	const iam = deps.iam ?? await iamFor(options.profile);
+	const providerArn = await ensureOidcProvider(iam).catch((error) => {
+		if (/SSO session/i.test(String(error?.message)) && options.profile) throw new SsoSessionExpired(options.profile);
+		throw error;
+	});
+	const roleArn = await ensureRole(iam, role, trustPolicy(providerArn, repo, options.stage), policyArn);
+	logger.log(`\n  ✓ AWS: ${roleArn}`);
+	gh([
+		"api",
+		"--method",
+		"PUT",
+		`repos/${repo}/environments/${options.stage}`
+	]);
+	gh([
+		"variable",
+		"set",
+		"AWS_ROLE_ARN",
+		"--env",
+		options.stage,
+		"--repo",
+		repo,
+		"--body",
+		roleArn
+	]);
+	logger.log(`  ✓ GitHub: environment "${options.stage}", AWS_ROLE_ARN`);
+	if (hasKey) {
+		gh([
+			"secret",
+			"set",
+			"GKM_SECRETS_KEY",
+			"--env",
+			options.stage,
+			"--repo",
+			repo
+		], readFileSync(keyPath, "utf-8").trim());
+		logger.log("  ✓ GitHub: GKM_SECRETS_KEY");
+	} else logger.log(`  ⚠ No secrets key for "${options.stage}"; run gkm secrets:init --stage ${options.stage}, then this again.`);
+	logger.log(`\n  Protect it: add required reviewers to the "${options.stage}" environment in the repository settings.\n`);
+	return {
+		roleArn,
+		repo
+	};
+}
+/** The profile's SSO login has lapsed; the fix is one command away. */
+var SsoSessionExpired = class extends Error {
+	constructor(profile) {
+		super(`The SSO session for profile "${profile}" has expired or is invalid. Run: aws sso login --profile ${profile}`);
+		this.profile = profile;
+		this.name = "SsoSessionExpired";
+	}
+};
+
+//#endregion
+export { deployGithubCommand };
+//# sourceMappingURL=github-CrpsXSfV.mjs.map

package/dist/github-CrpsXSfV.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-CrpsXSfV.mjs","names":["defaultGh: Gh","project: string","stage: string","providerArn: string","repo: string","iam: IAMClient","name: string","trust: string","policyArn: string","arn: string","profile?: string","endpoint?: string","config: IAMClientConfig","options: DeployGithubOptions","deps: { iam?: IAMClient; gh?: Gh; cwd?: string }","profile: string"],"sources":["../src/deploy/github.ts"],"sourcesContent":["/**\n * `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.\n *\n * A stage usually lives in its own AWS account — staging in one, production in\n * another — so this runs once per stage, with that account's profile:\n *\n *   gkm deploy:github --stage staging --profile acme-dev\n *   gkm deploy:github --stage prod    --profile acme-prod\n *\n * In the stage's account it makes sure GitHub's OIDC provider exists, and a\n * role that only this repository's `<stage>` environment can assume. On\n * GitHub it creates that environment and gives it what the generated deploy\n * workflow reads: `AWS_ROLE_ARN`, and the stage's secrets key as\n * `GKM_SECRETS_KEY`. Re-running it converges rather than duplicating.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport {\n\tAttachRolePolicyCommand,\n\tCreateOpenIDConnectProviderCommand,\n\tCreateRoleCommand,\n\tGetRoleCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tListOpenIDConnectProvidersCommand,\n\tUpdateAssumeRolePolicyCommand,\n} from '@aws-sdk/client-iam';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { getKeyPath } from '../secrets/keystore.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\n\nconst logger = console;\n\nconst GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';\nconst AUDIENCE = 'sts.amazonaws.com';\n\n/**\n * What SST needs to create a stack is most of AWS, so this is the default —\n * said out loud in the output, and replaceable with `--policy-arn`.\n */\nexport const DEFAULT_POLICY_ARN = 'arn:aws:iam::aws:policy/AdministratorAccess';\n\nexport interface DeployGithubOptions {\n\tstage: string;\n\t/** The AWS profile for the stage's account. */\n\tprofile?: string;\n\t/** `owner/name`; defaults to the repository `gh` sees here. */\n\trepo?: string;\n\t/** The policy the deploy role gets. */\n\tpolicyArn?: string;\n\tdryRun?: boolean;\n}\n\n/** Runs `gh` with the given arguments and optional stdin, returning stdout. */\nexport type Gh = (args: string[], input?: string) => string;\n\nconst defaultGh: Gh = (args, input) =>\n\texecFileSync('gh', args, {\n\t\tencoding: 'utf-8',\n\t\t...(input === undefined\n\t\t\t? {}\n\t\t\t: { input, stdio: ['pipe', 'pipe', 'pipe'] as const }),\n\t}).trim();\n\n/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */\nexport function roleName(project: string, stage: string): string {\n\treturn `${project}-github-${stage}`\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9+=,.@_-]/g, '-')\n\t\t.slice(0, 64);\n}\n\n/**\n * Who may assume the role: a workflow job running in this repository's\n * `<stage>` environment, and nothing else — not another branch's job, not\n * another environment's. That is what keeps a staging deploy from using the\n * production role.\n */\nexport function trustPolicy(\n\tproviderArn: string,\n\trepo: string,\n\tstage: string,\n): string {\n\treturn JSON.stringify({\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tPrincipal: { Federated: providerArn },\n\t\t\t\tAction: 'sts:AssumeRoleWithWebIdentity',\n\t\t\t\tCondition: {\n\t\t\t\t\tStringEquals: {\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t],\n\t});\n}\n\n/** GitHub's OIDC provider in this account, created if it is not there. */\nexport async function ensureOidcProvider(iam: IAMClient): Promise<string> {\n\tconst { OpenIDConnectProviderList = [] } = await iam.send(\n\t\tnew ListOpenIDConnectProvidersCommand({}),\n\t);\n\tconst existing = OpenIDConnectProviderList.find((p) =>\n\t\tp.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`),\n\t)?.Arn;\n\tif (existing) return existing;\n\n\tconst created = await iam.send(\n\t\tnew CreateOpenIDConnectProviderCommand({\n\t\t\tUrl: `https://${GITHUB_OIDC_HOST}`,\n\t\t\tClientIDList: [AUDIENCE],\n\t\t}),\n\t);\n\treturn created.OpenIDConnectProviderArn!;\n}\n\n/** The deploy role, created or brought back to this trust and policy. */\nexport async function ensureRole(\n\tiam: IAMClient,\n\tname: string,\n\ttrust: string,\n\tpolicyArn: string,\n): Promise<string> {\n\tlet arn: string;\n\ttry {\n\t\tconst { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));\n\t\tawait iam.send(\n\t\t\tnew UpdateAssumeRolePolicyCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tPolicyDocument: trust,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name !== 'NoSuchEntityException') {\n\t\t\tthrow error;\n\t\t}\n\t\tconst { Role } = await iam.send(\n\t\t\tnew CreateRoleCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tAssumeRolePolicyDocument: trust,\n\t\t\t\tDescription: 'Deploys from GitHub Actions (gkm deploy:github)',\n\t\t\t\t// SST deploys can run long; the default hour is tight.\n\t\t\t\tMaxSessionDuration: 3600 * 2,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t}\n\n\t// Attaching an attached policy is a no-op, so this converges too.\n\tawait iam.send(\n\t\tnew AttachRolePolicyCommand({ RoleName: name, PolicyArn: policyArn }),\n\t);\n\treturn arn;\n}\n\n/**\n * An IAM client for the stage's account.\n *\n * `fromIni` for a named profile, deliberately: it resolves exactly that\n * profile — keys, assume-role, `credential_process` or SSO, whichever\n * ~/.aws/config says — and never falls back to AWS_* in the environment. The\n * provider chain checks the environment first, so exported staging keys would\n * quietly win over `--profile prod` and the production role would land in the\n * staging account.\n */\nexport async function iamFor(\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<IAMClient> {\n\tconst config: IAMClientConfig = { region: 'us-east-1' };\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\tconfig.credentials = { accessKeyId: 'test', secretAccessKey: 'test' };\n\t}\n\treturn new IAMClient(config);\n}\n\nexport async function deployGithubCommand(\n\toptions: DeployGithubOptions,\n\tdeps: { iam?: IAMClient; gh?: Gh; cwd?: string } = {},\n): Promise<{ roleArn?: string; repo: string }> {\n\tconst gh = deps.gh ?? defaultGh;\n\tconst { workspace } = await loadWorkspaceConfig(deps.cwd);\n\tassertDeployedStage(workspace.stages, options.stage);\n\n\tconst repo =\n\t\toptions.repo ??\n\t\tgh(['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner']);\n\tconst role = roleName(workspace.name, options.stage);\n\tconst policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;\n\tconst keyPath = getKeyPath(options.stage, workspace.name);\n\tconst hasKey = existsSync(keyPath);\n\n\tlogger.log(`\\n🔐 GitHub → AWS for stage \"${options.stage}\"\\n`);\n\tlogger.log(`  Repository:   ${repo}`);\n\tlogger.log(`  AWS profile:  ${options.profile ?? '(default credentials)'}`);\n\tlogger.log(`  Role:         ${role}`);\n\tlogger.log(\n\t\t`  Policy:       ${policyArn}${options.policyArn ? '' : '  (default; --policy-arn to narrow)'}`,\n\t);\n\tlogger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);\n\tlogger.log(\n\t\t`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`,\n\t);\n\n\tif (options.dryRun) {\n\t\tlogger.log('\\n  --dry-run: nothing changed.\\n');\n\t\treturn { repo };\n\t}\n\n\tconst iam = deps.iam ?? (await iamFor(options.profile));\n\tconst providerArn = await ensureOidcProvider(iam).catch((error) => {\n\t\t// The first AWS call is where an expired SSO login surfaces; the SDK's\n\t\t// message does not say which profile, and this command knows.\n\t\tif (/SSO session/i.test(String(error?.message)) && options.profile) {\n\t\t\tthrow new SsoSessionExpired(options.profile);\n\t\t}\n\t\tthrow error;\n\t});\n\tconst roleArn = await ensureRole(\n\t\tiam,\n\t\trole,\n\t\ttrustPolicy(providerArn, repo, options.stage),\n\t\tpolicyArn,\n\t);\n\tlogger.log(`\\n  ✓ AWS: ${roleArn}`);\n\n\t// The environment the generated deploy workflow runs the stage in.\n\tgh(['api', '--method', 'PUT', `repos/${repo}/environments/${options.stage}`]);\n\tgh([\n\t\t'variable',\n\t\t'set',\n\t\t'AWS_ROLE_ARN',\n\t\t'--env',\n\t\toptions.stage,\n\t\t'--repo',\n\t\trepo,\n\t\t'--body',\n\t\troleArn,\n\t]);\n\tlogger.log(`  ✓ GitHub: environment \"${options.stage}\", AWS_ROLE_ARN`);\n\n\tif (hasKey) {\n\t\t// Through stdin, so the key is never an argument a process list shows.\n\t\tgh(\n\t\t\t[\n\t\t\t\t'secret',\n\t\t\t\t'set',\n\t\t\t\t'GKM_SECRETS_KEY',\n\t\t\t\t'--env',\n\t\t\t\toptions.stage,\n\t\t\t\t'--repo',\n\t\t\t\trepo,\n\t\t\t],\n\t\t\treadFileSync(keyPath, 'utf-8').trim(),\n\t\t);\n\t\tlogger.log('  ✓ GitHub: GKM_SECRETS_KEY');\n\t} else {\n\t\tlogger.log(\n\t\t\t`  ⚠ No secrets key for \"${options.stage}\"; run gkm secrets:init --stage ${options.stage}, then this again.`,\n\t\t);\n\t}\n\n\tlogger.log(\n\t\t`\\n  Protect it: add required reviewers to the \"${options.stage}\" environment in the repository settings.\\n`,\n\t);\n\treturn { roleArn, repo };\n}\n\n/** The profile's SSO login has lapsed; the fix is one command away. */\nexport class SsoSessionExpired extends Error {\n\tconstructor(readonly profile: string) {\n\t\tsuper(\n\t\t\t`The SSO session for profile \"${profile}\" has expired or is invalid. Run: aws sso login --profile ${profile}`,\n\t\t);\n\t\tthis.name = 'SsoSessionExpired';\n\t}\n}\n"],"mappings":";;;;;;;;;AAgCA,MAAM,SAAS;AAEf,MAAM,mBAAmB;AACzB,MAAM,WAAW;;;;;AAMjB,MAAa,qBAAqB;AAgBlC,MAAMA,YAAgB,CAAC,MAAM,UAC5B,aAAa,MAAM,MAAM;CACxB,UAAU;CACV,GAAI,mBACD,CAAE,IACF;EAAE;EAAO,OAAO;GAAC;GAAQ;GAAQ;EAAO;CAAW;AACtD,EAAC,CAAC,MAAM;;AAGV,SAAgB,SAASC,SAAiBC,OAAuB;AAChE,QAAO,CAAC,EAAE,QAAQ,UAAU,MAAM,EAChC,aAAa,CACb,QAAQ,qBAAqB,IAAI,CACjC,MAAM,GAAG,GAAG;AACd;;;;;;;AAQD,SAAgB,YACfC,aACAC,MACAF,OACS;AACT,QAAO,KAAK,UAAU;EACrB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,WAAW,EAAE,WAAW,YAAa;GACrC,QAAQ;GACR,WAAW,EACV,cAAc;MACX,EAAE,iBAAiB,QAAQ;MAC3B,EAAE,iBAAiB,SAAS,OAAO,KAAK,eAAe,MAAM;GAC/D,EACD;EACD,CACD;CACD,EAAC;AACF;;AAGD,eAAsB,mBAAmBG,KAAiC;CACzE,MAAM,EAAE,4BAA4B,CAAE,GAAE,GAAG,MAAM,IAAI,KACpD,IAAI,kCAAkC,CAAE,GACxC;CACD,MAAM,WAAW,0BAA0B,KAAK,CAAC,MAChD,EAAE,KAAK,UAAU,gBAAgB,iBAAiB,EAAE,CACpD,EAAE;AACH,KAAI,SAAU,QAAO;CAErB,MAAM,UAAU,MAAM,IAAI,KACzB,IAAI,mCAAmC;EACtC,MAAM,UAAU,iBAAiB;EACjC,cAAc,CAAC,QAAS;CACxB,GACD;AACD,QAAO,QAAQ;AACf;;AAGD,eAAsB,WACrBA,KACAC,MACAC,OACAC,WACkB;CAClB,IAAIC;AACJ,KAAI;EACH,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,KAAK,IAAI,eAAe,EAAE,UAAU,KAAM,GAAE;AACvE,QAAM,IAAI,KACT,IAAI,8BAA8B;GACjC,UAAU;GACV,gBAAgB;EAChB,GACD;AACD,QAAM,KAAM;CACZ,SAAQ,OAAO;AACf,MAAK,MAA4B,SAAS,wBACzC,OAAM;EAEP,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,KAC1B,IAAI,kBAAkB;GACrB,UAAU;GACV,0BAA0B;GAC1B,aAAa;GAEb,oBAAoB,OAAO;EAC3B,GACD;AACD,QAAM,KAAM;CACZ;AAGD,OAAM,IAAI,KACT,IAAI,wBAAwB;EAAE,UAAU;EAAM,WAAW;CAAW,GACpE;AACD,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,OACrBC,SACAC,UACqB;CACrB,MAAMC,SAA0B,EAAE,QAAQ,YAAa;AACvD,KAAI,SAAS;EACZ,MAAM,EAAE,SAAS,GAAG,MAAM,OAAO;AACjC,SAAO,cAAc,QAAQ,EAAE,QAAS,EAAC;CACzC;AACD,KAAI,UAAU;AACb,SAAO,WAAW;AAClB,SAAO,cAAc;GAAE,aAAa;GAAQ,iBAAiB;EAAQ;CACrE;AACD,QAAO,IAAI,UAAU;AACrB;AAED,eAAsB,oBACrBC,SACAC,OAAmD,CAAE,GACP;CAC9C,MAAM,KAAK,KAAK,MAAM;CACtB,MAAM,EAAE,WAAW,GAAG,MAAM,oBAAoB,KAAK,IAAI;AACzD,qBAAoB,UAAU,QAAQ,QAAQ,MAAM;CAEpD,MAAM,OACL,QAAQ,QACR,GAAG;EAAC;EAAQ;EAAQ;EAAU;EAAiB;EAAM;CAAiB,EAAC;CACxE,MAAM,OAAO,SAAS,UAAU,MAAM,QAAQ,MAAM;CACpD,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,UAAU,WAAW,QAAQ,OAAO,UAAU,KAAK;CACzD,MAAM,SAAS,WAAW,QAAQ;AAElC,QAAO,KAAK,+BAA+B,QAAQ,MAAM,KAAK;AAC9D,QAAO,KAAK,kBAAkB,KAAK,EAAE;AACrC,QAAO,KAAK,kBAAkB,QAAQ,WAAW,wBAAwB,EAAE;AAC3E,QAAO,KAAK,kBAAkB,KAAK,EAAE;AACrC,QAAO,KACL,kBAAkB,UAAU,EAAE,QAAQ,YAAY,KAAK,sCAAsC,EAC9F;AACD,QAAO,KAAK,uBAAuB,KAAK,eAAe,QAAQ,MAAM,OAAO;AAC5E,QAAO,KACL,kBAAkB,SAAS,WAAW,UAAU,QAAQ,kCAAkC,QAAQ,MAAM,QAAQ,EACjH;AAED,KAAI,QAAQ,QAAQ;AACnB,SAAO,IAAI,oCAAoC;AAC/C,SAAO,EAAE,KAAM;CACf;CAED,MAAM,MAAM,KAAK,OAAQ,MAAM,OAAO,QAAQ,QAAQ;CACtD,MAAM,cAAc,MAAM,mBAAmB,IAAI,CAAC,MAAM,CAAC,UAAU;AAGlE,MAAI,eAAe,KAAK,OAAO,OAAO,QAAQ,CAAC,IAAI,QAAQ,QAC1D,OAAM,IAAI,kBAAkB,QAAQ;AAErC,QAAM;CACN,EAAC;CACF,MAAM,UAAU,MAAM,WACrB,KACA,MACA,YAAY,aAAa,MAAM,QAAQ,MAAM,EAC7C,UACA;AACD,QAAO,KAAK,aAAa,QAAQ,EAAE;AAGnC,IAAG;EAAC;EAAO;EAAY;GAAQ,QAAQ,KAAK,gBAAgB,QAAQ,MAAM;CAAE,EAAC;AAC7E,IAAG;EACF;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;EACA;CACA,EAAC;AACF,QAAO,KAAK,2BAA2B,QAAQ,MAAM,iBAAiB;AAEtE,KAAI,QAAQ;AAEX,KACC;GACC;GACA;GACA;GACA;GACA,QAAQ;GACR;GACA;EACA,GACD,aAAa,SAAS,QAAQ,CAAC,MAAM,CACrC;AACD,SAAO,IAAI,8BAA8B;CACzC,MACA,QAAO,KACL,0BAA0B,QAAQ,MAAM,kCAAkC,QAAQ,MAAM,oBACzF;AAGF,QAAO,KACL,iDAAiD,QAAQ,MAAM,6CAChE;AACD,QAAO;EAAE;EAAS;CAAM;AACxB;;AAGD,IAAa,oBAAb,cAAuC,MAAM;CAC5C,YAAqBC,SAAiB;AACrC,SACE,+BAA+B,QAAQ,4DAA4D,QAAQ,EAC5G;EAHmB;AAIpB,OAAK,OAAO;CACZ;AACD"}

package/dist/{index-CHB4tSzX.d.cts → index-Ayxg_DQY.d.mts}

@@ -1,4 +1,4 @@
-import { AppsRecord, Framework, GkmConfig, InferredWorkspaceConfig, LoadedConfig, NormalizedWorkspace, Routes, WorkspaceConfig, WorkspaceInput } from "./types-abJQuk7m.cjs";
+import { AppsRecord, Framework, GkmConfig, InferredWorkspaceConfig, LoadedConfig, NormalizedWorkspace, Routes, WorkspaceConfig, WorkspaceInput } from "./types-CL7jPFM2.mjs";
 
 //#region src/workspace/publicEnv.d.ts
 
@@ -172,4 +172,4 @@ declare function getEndpointForStage(dokployConfig: {
 //# sourceMappingURL=index.d.ts.map
 //#endregion
 export { PUBLIC_ENV_PREFIXES, allConstructGlobs, appConstructGlobs, constructPatterns, defineWorkspace, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getEndpointForStage, getPublicEnvPrefix, normalizeWorkspace, processConfig, stripPublicPrefix, workspaceConstructGlobs, wrapSingleAppAsWorkspace };
-//# sourceMappingURL=index-CHB4tSzX.d.cts.map
+//# sourceMappingURL=index-Ayxg_DQY.d.mts.map

package/dist/index-Ayxg_DQY.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-Ayxg_DQY.d.mts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"sourcesContent":[],"mappings":";;;;;;AASA;AAoBA;AAoBA;;;cAxCa;AC2Hb;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;AAAwC,iBDzLxB,kBAAA,CCyLwB,SAAA,CAAA,EDzLO,SCyLP,CAAA,EAAA,MAAA;;;AAGlB;AAsEtB;AAA6B,iBD9Ob,iBAAA,CC8Oa,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;;;;;;;;AA3J7B;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;;;;AAGsB;AAsEtB;;;;;AAGe;AA6Bf;AAmBA;AAwBA;AAaA;AAiBA;;;;AAGY;AAmCZ;AAmCA;;;;AAIS;AAgDO,iBAjYA,eAmYqB,CAAA,oBAnYe,UAmYT,CAAA,CAAA,MAAA,EAlYlC,cAkYkC,CAlYnB,KAkYmB,CAAA,CAAA,EAjYxC,uBAiYwC,CAjYhB,KAiYgB,CAAA;;;;iBAnW3B,kBAAA,SACP,+BAEN;;;;;iBA+Ca,wBAAA,SACP,yBAEN;;;;;iBAsEa,aAAA,SACP,YAAY,+BAElB;;;;;;;iBA6Ba,uBAAA,YACJ;;;;;;;;;;;;iBAkBI,iBAAA,YACJ;;;;;;;iBAuBI,iBAAA,YAA6B;;iBAa7B,iBAAA,SAA0B;;;;;iBAiB1B,eAAA,YACJ,uCAET;;;;;iBAmCa,gBAAA,YAA4B;;;;;;;;;;iBAmC5B,oBAAA,YACJ,2DAGT;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDa,mBAAA;;cAEqB"}

package/dist/{index-BThUzEIp.d.mts → index-CR5urhWX.d.cts}

@@ -1,4 +1,4 @@
-import { AppsRecord, Framework, GkmConfig, InferredWorkspaceConfig, LoadedConfig, NormalizedWorkspace, Routes, WorkspaceConfig, WorkspaceInput } from "./types-C-arnQ1r.mjs";
+import { AppsRecord, Framework, GkmConfig, InferredWorkspaceConfig, LoadedConfig, NormalizedWorkspace, Routes, WorkspaceConfig, WorkspaceInput } from "./types-Y3fKQSAK.cjs";
 
 //#region src/workspace/publicEnv.d.ts
 
@@ -172,4 +172,4 @@ declare function getEndpointForStage(dokployConfig: {
 //# sourceMappingURL=index.d.ts.map
 //#endregion
 export { PUBLIC_ENV_PREFIXES, allConstructGlobs, appConstructGlobs, constructPatterns, defineWorkspace, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getEndpointForStage, getPublicEnvPrefix, normalizeWorkspace, processConfig, stripPublicPrefix, workspaceConstructGlobs, wrapSingleAppAsWorkspace };
-//# sourceMappingURL=index-BThUzEIp.d.mts.map
+//# sourceMappingURL=index-CR5urhWX.d.cts.map

package/dist/index-CR5urhWX.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-CR5urhWX.d.cts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"sourcesContent":[],"mappings":";;;;;;AASA;AAoBA;AAoBA;;;cAxCa;AC2Hb;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;AAAwC,iBDzLxB,kBAAA,CCyLwB,SAAA,CAAA,EDzLO,SCyLP,CAAA,EAAA,MAAA;;;AAGlB;AAsEtB;AAA6B,iBD9Ob,iBAAA,CC8Oa,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;;;;;;;;AA3J7B;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;;;;AAGsB;AAsEtB;;;;;AAGe;AA6Bf;AAmBA;AAwBA;AAaA;AAiBA;;;;AAGY;AAmCZ;AAmCA;;;;AAIS;AAgDO,iBAjYA,eAmYqB,CAAA,oBAnYe,UAmYT,CAAA,CAAA,MAAA,EAlYlC,cAkYkC,CAlYnB,KAkYmB,CAAA,CAAA,EAjYxC,uBAiYwC,CAjYhB,KAiYgB,CAAA;;;;iBAnW3B,kBAAA,SACP,+BAEN;;;;;iBA+Ca,wBAAA,SACP,yBAEN;;;;;iBAsEa,aAAA,SACP,YAAY,+BAElB;;;;;;;iBA6Ba,uBAAA,YACJ;;;;;;;;;;;;iBAkBI,iBAAA,YACJ;;;;;;;iBAuBI,iBAAA,YAA6B;;iBAa7B,iBAAA,SAA0B;;;;;iBAiB1B,eAAA,YACJ,uCAET;;;;;iBAmCa,gBAAA,YAA4B;;;;;;;;;;iBAmC5B,oBAAA,YACJ,2DAGT;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDa,mBAAA;;cAEqB"}