@geekmidas/cli 10.0.0-alpha.82 → 10.0.0-alpha.83

package/dist/stages-CHF9RFog.mjs

@@ -0,0 +1,174 @@
+import { A as UndeclaredStage } from "./workspace-DD9mtPy8.mjs";
+import { loadWorkspaceSettings } from "./config.mjs";
+import { appendFile } from "node:fs/promises";
+//#region src/stages/plan.ts
+/**
+* Which stages a workflow run builds and deploys, from the event that started
+* it and the project's `stages`.
+*
+* The rules live here, in tested code, rather than in a workflow's YAML or in
+* the action that runs `gkm stages --github-output`: a project's deploy
+* workflow names no stage, and what it does for each event is decided by the
+* CLI the project installed.
+*
+* | event               | build              | deploy                          |
+* | ------------------- | ------------------ | ------------------------------- |
+* | `push`              | every deployed     | deployed, less the protected    |
+* | `release`           | none               | the protected                   |
+* | `workflow_dispatch` | none               | the one stage named             |
+* | anything else       | none               | none                            |
+*
+* A push builds every deployed stage, protected ones included, so a release
+* deploys images built from the very commit its tag names; a release and a
+* manual run deploy what a push already built.
+*/
+function planStages(stages, input) {
+	const kept = stages.protected ?? [];
+	switch (input.event) {
+		case "push": return {
+			build: [...stages.deployed],
+			deploy: stages.deployed.filter((stage) => !kept.includes(stage))
+		};
+		case "release": return {
+			build: [],
+			deploy: [...kept]
+		};
+		case "workflow_dispatch": {
+			const stage = input.stage?.trim();
+			if (!stage) throw new DispatchNamesNoStage(stages.deployed);
+			if (!stages.deployed.includes(stage)) throw new UndeclaredStage(stage, stages.deployed);
+			return {
+				build: [],
+				deploy: [stage]
+			};
+		}
+		default: return {
+			build: [],
+			deploy: []
+		};
+	}
+}
+/**
+* A manual run with no stage. Refused rather than read as "nothing to do", so
+* a run started with the field left empty fails where it can be seen.
+*/
+var DispatchNamesNoStage = class extends Error {
+	deployed;
+	constructor(deployed) {
+		super(`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(", ") || "nothing yet — gkm.config.ts deploys to no stage"}.`);
+		this.deployed = deployed;
+		this.name = "DispatchNamesNoStage";
+	}
+};
+//#endregion
+//#region src/stages/index.ts
+/**
+* `gkm stages` — the workspace's stages, as gkm.config.ts declares them.
+*
+* ```bash
+* gkm stages                    # a table
+* gkm stages --json             # {"local":"dev","deployed":["prod"],"protected":["prod"]}
+* gkm stages --github-output    # a workflow run's build and deploy matrices
+* ```
+*
+* The config is read by the normal loader (and sandbox), so a workflow never
+* parses TypeScript to learn which stages exist. `--github-output` is what the
+* `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and
+* which of them this run builds and deploys, to `$GITHUB_OUTPUT`.
+*/
+function stagesJson(stages) {
+	return {
+		local: stages.local,
+		deployed: [...stages.deployed],
+		protected: [...stages.protected ?? []]
+	};
+}
+/**
+* The region of the workspace's AWS secrets store — `ssm` or
+* `secrets-manager` — or `''` when its deployed stages keep their secrets
+* anywhere else. A job assumes the stage's AWS role only when this is set.
+*/
+function awsSecretsRegion(workspace) {
+	const store = workspace.secrets?.store;
+	if (typeof store !== "object" || store === null) return "";
+	if (store.provider === "ssm" || store.provider === "secrets-manager") return store.region;
+	return "";
+}
+/**
+* Every output the stages action sets, each a string `fromJSON()` reads, for
+* one workflow run.
+*/
+function githubOutputs(workspace, input) {
+	const stages = stagesJson(workspace.stages);
+	const plan = planStages(workspace.stages, input);
+	return {
+		local: JSON.stringify(stages.local),
+		deployed: JSON.stringify(stages.deployed),
+		protected: JSON.stringify(stages.protected),
+		build: JSON.stringify(plan.build),
+		deploy: JSON.stringify(plan.deploy),
+		"has-build": String(plan.build.length > 0),
+		"has-deploy": String(plan.deploy.length > 0),
+		"aws-region": awsSecretsRegion(workspace)
+	};
+}
+/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */
+function formatGithubOutputs(outputs) {
+	return Object.entries(outputs).map(([name, value]) => `${name}=${value}\n`).join("");
+}
+/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */
+function workflowCommandData(message) {
+	return message.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+function table(stages) {
+	const rows = [
+		["STAGE", "KIND"],
+		[stages.local, "local"],
+		...stages.deployed.map((name) => [name, stages.protected.includes(name) ? "deployed, protected" : "deployed"])
+	];
+	const width = Math.max(...rows.map(([name]) => name.length));
+	return rows.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`).join("\n");
+}
+async function stagesCommand(options, deps = {}) {
+	const env = deps.env ?? process.env;
+	const log = deps.log ?? ((line) => console.log(line));
+	if (!options.githubOutput) {
+		const stages = stagesJson((await loadWorkspaceSettings(deps.cwd)).stages);
+		log(options.json ? JSON.stringify(stages) : table(stages));
+		return;
+	}
+	try {
+		const file = env.GITHUB_OUTPUT;
+		if (!file) throw new GithubOutputNotSet();
+		const workspace = await loadWorkspaceSettings(deps.cwd);
+		const event = options.event || env.GITHUB_EVENT_NAME;
+		if (!event) throw new GithubEventNotSet();
+		const outputs = githubOutputs(workspace, {
+			event,
+			...options.stage ? { stage: options.stage } : {}
+		});
+		await appendFile(file, formatGithubOutputs(outputs));
+		log(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);
+	} catch (error) {
+		log(`::error title=gkm stages::${workflowCommandData(error instanceof Error ? error.message : String(error))}`);
+		throw error;
+	}
+}
+/** `--github-output` outside a GitHub Actions step, which sets the file. */
+var GithubOutputNotSet = class extends Error {
+	constructor() {
+		super("gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.");
+		this.name = "GithubOutputNotSet";
+	}
+};
+/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */
+var GithubEventNotSet = class extends Error {
+	constructor() {
+		super("gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.");
+		this.name = "GithubEventNotSet";
+	}
+};
+//#endregion
+export { stagesCommand };
+
+//# sourceMappingURL=stages-CHF9RFog.mjs.map

package/dist/stages-CHF9RFog.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages-CHF9RFog.mjs","names":[],"sources":["../src/stages/plan.ts","../src/stages/index.ts"],"sourcesContent":["/**\n * Which stages a workflow run builds and deploys, from the event that started\n * it and the project's `stages`.\n *\n * The rules live here, in tested code, rather than in a workflow's YAML or in\n * the action that runs `gkm stages --github-output`: a project's deploy\n * workflow names no stage, and what it does for each event is decided by the\n * CLI the project installed.\n *\n * | event               | build              | deploy                          |\n * | ------------------- | ------------------ | ------------------------------- |\n * | `push`              | every deployed     | deployed, less the protected    |\n * | `release`           | none               | the protected                   |\n * | `workflow_dispatch` | none               | the one stage named             |\n * | anything else       | none               | none                            |\n *\n * A push builds every deployed stage, protected ones included, so a release\n * deploys images built from the very commit its tag names; a release and a\n * manual run deploy what a push already built.\n */\n\nimport { UndeclaredStage } from '../workspace/stages.js';\nimport type { StagesConfig } from '../workspace/types.js';\n\nexport interface StagePlan {\n\t/** The stages whose images this run builds and pushes. */\n\tbuild: string[];\n\t/** The stages this run deploys. */\n\tdeploy: string[];\n}\n\nexport interface PlanInput {\n\t/** The GitHub event name: `push`, `release`, `workflow_dispatch`, … */\n\tevent: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport function planStages(stages: StagesConfig, input: PlanInput): StagePlan {\n\tconst kept = stages.protected ?? [];\n\n\tswitch (input.event) {\n\t\tcase 'push':\n\t\t\treturn {\n\t\t\t\tbuild: [...stages.deployed],\n\t\t\t\tdeploy: stages.deployed.filter((stage) => !kept.includes(stage)),\n\t\t\t};\n\t\tcase 'release':\n\t\t\treturn { build: [], deploy: [...kept] };\n\t\tcase 'workflow_dispatch': {\n\t\t\tconst stage = input.stage?.trim();\n\t\t\tif (!stage) throw new DispatchNamesNoStage(stages.deployed);\n\t\t\tif (!stages.deployed.includes(stage)) {\n\t\t\t\tthrow new UndeclaredStage(stage, stages.deployed);\n\t\t\t}\n\t\t\treturn { build: [], deploy: [stage] };\n\t\t}\n\t\tdefault:\n\t\t\treturn { build: [], deploy: [] };\n\t}\n}\n\n/**\n * A manual run with no stage. Refused rather than read as \"nothing to do\", so\n * a run started with the field left empty fails where it can be seen.\n */\nexport class DispatchNamesNoStage extends Error {\n\tconstructor(readonly deployed: readonly string[]) {\n\t\tsuper(\n\t\t\t`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(', ') || 'nothing yet — gkm.config.ts deploys to no stage'}.`,\n\t\t);\n\t\tthis.name = 'DispatchNamesNoStage';\n\t}\n}\n","/**\n * `gkm stages` — the workspace's stages, as gkm.config.ts declares them.\n *\n * ```bash\n * gkm stages                    # a table\n * gkm stages --json             # {\"local\":\"dev\",\"deployed\":[\"prod\"],\"protected\":[\"prod\"]}\n * gkm stages --github-output    # a workflow run's build and deploy matrices\n * ```\n *\n * The config is read by the normal loader (and sandbox), so a workflow never\n * parses TypeScript to learn which stages exist. `--github-output` is what the\n * `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and\n * which of them this run builds and deploys, to `$GITHUB_OUTPUT`.\n */\n\nimport { appendFile } from 'node:fs/promises';\nimport { loadWorkspaceSettings } from '../config.js';\nimport type { NormalizedWorkspace, StagesConfig } from '../workspace/types.js';\nimport { planStages } from './plan.js';\n\nexport { DispatchNamesNoStage, type PlanInput, planStages } from './plan.js';\n\nexport interface StagesOptions {\n\t/** Print the stages as JSON. */\n\tjson?: boolean;\n\t/** Write the outputs a deploy workflow reads to `$GITHUB_OUTPUT`. */\n\tgithubOutput?: boolean;\n\t/** The event to plan for; defaults to `GITHUB_EVENT_NAME`. */\n\tevent?: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport interface StagesDeps {\n\tcwd?: string;\n\tenv?: NodeJS.ProcessEnv;\n\t/** Where lines go; stdout by default. */\n\tlog?: (line: string) => void;\n}\n\n/** The stages, as `gkm stages --json` prints them. */\nexport interface StagesJson {\n\tlocal: string;\n\tdeployed: string[];\n\tprotected: string[];\n}\n\nexport function stagesJson(stages: StagesConfig): StagesJson {\n\treturn {\n\t\tlocal: stages.local,\n\t\tdeployed: [...stages.deployed],\n\t\tprotected: [...(stages.protected ?? [])],\n\t};\n}\n\n/**\n * The region of the workspace's AWS secrets store — `ssm` or\n * `secrets-manager` — or `''` when its deployed stages keep their secrets\n * anywhere else. A job assumes the stage's AWS role only when this is set.\n */\nexport function awsSecretsRegion(workspace: NormalizedWorkspace): string {\n\tconst store = workspace.secrets?.store;\n\tif (typeof store !== 'object' || store === null) return '';\n\tif (store.provider === 'ssm' || store.provider === 'secrets-manager') {\n\t\treturn store.region;\n\t}\n\treturn '';\n}\n\n/**\n * Every output the stages action sets, each a string `fromJSON()` reads, for\n * one workflow run.\n */\nexport function githubOutputs(\n\tworkspace: NormalizedWorkspace,\n\tinput: { event: string; stage?: string },\n): Record<string, string> {\n\tconst stages = stagesJson(workspace.stages);\n\tconst plan = planStages(workspace.stages, input);\n\n\treturn {\n\t\tlocal: JSON.stringify(stages.local),\n\t\tdeployed: JSON.stringify(stages.deployed),\n\t\tprotected: JSON.stringify(stages.protected),\n\t\tbuild: JSON.stringify(plan.build),\n\t\tdeploy: JSON.stringify(plan.deploy),\n\t\t// A matrix over an empty list is an error on GitHub, so a job over one\n\t\t// is skipped on these instead.\n\t\t'has-build': String(plan.build.length > 0),\n\t\t'has-deploy': String(plan.deploy.length > 0),\n\t\t'aws-region': awsSecretsRegion(workspace),\n\t};\n}\n\n/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */\nexport function formatGithubOutputs(outputs: Record<string, string>): string {\n\treturn Object.entries(outputs)\n\t\t.map(([name, value]) => `${name}=${value}\\n`)\n\t\t.join('');\n}\n\n/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */\nfunction workflowCommandData(message: string): string {\n\treturn message\n\t\t.replaceAll('%', '%25')\n\t\t.replaceAll('\\r', '%0D')\n\t\t.replaceAll('\\n', '%0A');\n}\n\nfunction table(stages: StagesJson): string {\n\tconst rows: [string, string][] = [\n\t\t['STAGE', 'KIND'],\n\t\t[stages.local, 'local'],\n\t\t...stages.deployed.map((name): [string, string] => [\n\t\t\tname,\n\t\t\tstages.protected.includes(name) ? 'deployed, protected' : 'deployed',\n\t\t]),\n\t];\n\tconst width = Math.max(...rows.map(([name]) => name.length));\n\treturn rows\n\t\t.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`)\n\t\t.join('\\n');\n}\n\nexport async function stagesCommand(\n\toptions: StagesOptions,\n\tdeps: StagesDeps = {},\n): Promise<void> {\n\tconst env = deps.env ?? process.env;\n\tconst log = deps.log ?? ((line: string) => console.log(line));\n\n\tif (!options.githubOutput) {\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst stages = stagesJson(workspace.stages);\n\t\tlog(options.json ? JSON.stringify(stages) : table(stages));\n\t\treturn;\n\t}\n\n\ttry {\n\t\tconst file = env.GITHUB_OUTPUT;\n\t\tif (!file) throw new GithubOutputNotSet();\n\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst event = options.event || env.GITHUB_EVENT_NAME;\n\t\tif (!event) throw new GithubEventNotSet();\n\n\t\tconst outputs = githubOutputs(workspace, {\n\t\t\tevent,\n\t\t\t...(options.stage ? { stage: options.stage } : {}),\n\t\t});\n\t\tawait appendFile(file, formatGithubOutputs(outputs));\n\n\t\tlog(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);\n\t} catch (error) {\n\t\t// Annotated on the run, where whoever started it looks first.\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tlog(`::error title=gkm stages::${workflowCommandData(message)}`);\n\t\tthrow error;\n\t}\n}\n\n/** `--github-output` outside a GitHub Actions step, which sets the file. */\nexport class GithubOutputNotSet extends Error {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.',\n\t\t);\n\t\tthis.name = 'GithubOutputNotSet';\n\t}\n}\n\n/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */\nexport class GithubEventNotSet extends Error {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.',\n\t\t);\n\t\tthis.name = 'GithubEventNotSet';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,WAAW,QAAsB,OAA6B;CAC7E,MAAM,OAAO,OAAO,aAAa,CAAC;CAElC,QAAQ,MAAM,OAAd;EACC,KAAK,QACJ,OAAO;GACN,OAAO,CAAC,GAAG,OAAO,QAAQ;GAC1B,QAAQ,OAAO,SAAS,QAAQ,UAAU,CAAC,KAAK,SAAS,KAAK,CAAC;EAChE;EACD,KAAK,WACJ,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC,GAAG,IAAI;EAAE;EACvC,KAAK,qBAAqB;GACzB,MAAM,QAAQ,MAAM,OAAO,KAAK;GAChC,IAAI,CAAC,OAAO,MAAM,IAAI,qBAAqB,OAAO,QAAQ;GAC1D,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,GAClC,MAAM,IAAI,gBAAgB,OAAO,OAAO,QAAQ;GAEjD,OAAO;IAAE,OAAO,CAAC;IAAG,QAAQ,CAAC,KAAK;GAAE;EACrC;EACA,SACC,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC;EAAE;CACjC;AACD;;;;;AAMA,IAAa,uBAAb,cAA0C,MAAM;CAC1B;CAArB,YAAY,UAAsC;EACjD,MACC,wGAAwG,SAAS,KAAK,IAAI,KAAK,kDAAkD,EAClL;EAHoB,KAAA,WAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;;;;;AC1BA,SAAgB,WAAW,QAAkC;CAC5D,OAAO;EACN,OAAO,OAAO;EACd,UAAU,CAAC,GAAG,OAAO,QAAQ;EAC7B,WAAW,CAAC,GAAI,OAAO,aAAa,CAAC,CAAE;CACxC;AACD;;;;;;AAOA,SAAgB,iBAAiB,WAAwC;CACxE,MAAM,QAAQ,UAAU,SAAS;CACjC,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,IAAI,MAAM,aAAa,SAAS,MAAM,aAAa,mBAClD,OAAO,MAAM;CAEd,OAAO;AACR;;;;;AAMA,SAAgB,cACf,WACA,OACyB;CACzB,MAAM,SAAS,WAAW,UAAU,MAAM;CAC1C,MAAM,OAAO,WAAW,UAAU,QAAQ,KAAK;CAE/C,OAAO;EACN,OAAO,KAAK,UAAU,OAAO,KAAK;EAClC,UAAU,KAAK,UAAU,OAAO,QAAQ;EACxC,WAAW,KAAK,UAAU,OAAO,SAAS;EAC1C,OAAO,KAAK,UAAU,KAAK,KAAK;EAChC,QAAQ,KAAK,UAAU,KAAK,MAAM;EAGlC,aAAa,OAAO,KAAK,MAAM,SAAS,CAAC;EACzC,cAAc,OAAO,KAAK,OAAO,SAAS,CAAC;EAC3C,cAAc,iBAAiB,SAAS;CACzC;AACD;;AAGA,SAAgB,oBAAoB,SAAyC;CAC5E,OAAO,OAAO,QAAQ,OAAO,CAAC,CAC5B,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,CAAC,CAC5C,KAAK,EAAE;AACV;;AAGA,SAAS,oBAAoB,SAAyB;CACrD,OAAO,QACL,WAAW,KAAK,KAAK,CAAC,CACtB,WAAW,MAAM,KAAK,CAAC,CACvB,WAAW,MAAM,KAAK;AACzB;AAEA,SAAS,MAAM,QAA4B;CAC1C,MAAM,OAA2B;EAChC,CAAC,SAAS,MAAM;EAChB,CAAC,OAAO,OAAO,OAAO;EACtB,GAAG,OAAO,SAAS,KAAK,SAA2B,CAClD,MACA,OAAO,UAAU,SAAS,IAAI,IAAI,wBAAwB,UAC3D,CAAC;CACF;CACA,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC;CAC3D,OAAO,KACL,KAAK,CAAC,MAAM,UAAU,GAAG,KAAK,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,CACvD,KAAK,IAAI;AACZ;AAEA,eAAsB,cACrB,SACA,OAAmB,CAAC,GACJ;CAChB,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,KAAK,SAAS,SAAiB,QAAQ,IAAI,IAAI;CAE3D,IAAI,CAAC,QAAQ,cAAc;EAE1B,MAAM,SAAS,YAAW,MADF,sBAAsB,KAAK,GAAG,EAAA,CAClB,MAAM;EAC1C,IAAI,QAAQ,OAAO,KAAK,UAAU,MAAM,IAAI,MAAM,MAAM,CAAC;EACzD;CACD;CAEA,IAAI;EACH,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB;EAExC,MAAM,YAAY,MAAM,sBAAsB,KAAK,GAAG;EACtD,MAAM,QAAQ,QAAQ,SAAS,IAAI;EACnC,IAAI,CAAC,OAAO,MAAM,IAAI,kBAAkB;EAExC,MAAM,UAAU,cAAc,WAAW;GACxC;GACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjD,CAAC;EACD,MAAM,WAAW,MAAM,oBAAoB,OAAO,CAAC;EAEnD,IAAI,GAAG,MAAM,UAAU,QAAQ,MAAM,WAAW,QAAQ,QAAQ;CACjE,SAAS,OAAO;EAGf,IAAI,6BAA6B,oBADjB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACT,GAAG;EAC/D,MAAM;CACP;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC7C,cAAc;EACb,MACC,oKACD;EACA,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAC5C,cAAc;EACb,MACC,uLACD;EACA,KAAK,OAAO;CACb;AACD"}

package/dist/stages-CwrYVX9u.cjs

@@ -0,0 +1,174 @@
+const require_workspace = require("./workspace-4i6Jwsoa.cjs");
+const require_config = require("./config.cjs");
+let node_fs_promises = require("node:fs/promises");
+//#region src/stages/plan.ts
+/**
+* Which stages a workflow run builds and deploys, from the event that started
+* it and the project's `stages`.
+*
+* The rules live here, in tested code, rather than in a workflow's YAML or in
+* the action that runs `gkm stages --github-output`: a project's deploy
+* workflow names no stage, and what it does for each event is decided by the
+* CLI the project installed.
+*
+* | event               | build              | deploy                          |
+* | ------------------- | ------------------ | ------------------------------- |
+* | `push`              | every deployed     | deployed, less the protected    |
+* | `release`           | none               | the protected                   |
+* | `workflow_dispatch` | none               | the one stage named             |
+* | anything else       | none               | none                            |
+*
+* A push builds every deployed stage, protected ones included, so a release
+* deploys images built from the very commit its tag names; a release and a
+* manual run deploy what a push already built.
+*/
+function planStages(stages, input) {
+	const kept = stages.protected ?? [];
+	switch (input.event) {
+		case "push": return {
+			build: [...stages.deployed],
+			deploy: stages.deployed.filter((stage) => !kept.includes(stage))
+		};
+		case "release": return {
+			build: [],
+			deploy: [...kept]
+		};
+		case "workflow_dispatch": {
+			const stage = input.stage?.trim();
+			if (!stage) throw new DispatchNamesNoStage(stages.deployed);
+			if (!stages.deployed.includes(stage)) throw new require_workspace.UndeclaredStage(stage, stages.deployed);
+			return {
+				build: [],
+				deploy: [stage]
+			};
+		}
+		default: return {
+			build: [],
+			deploy: []
+		};
+	}
+}
+/**
+* A manual run with no stage. Refused rather than read as "nothing to do", so
+* a run started with the field left empty fails where it can be seen.
+*/
+var DispatchNamesNoStage = class extends Error {
+	deployed;
+	constructor(deployed) {
+		super(`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(", ") || "nothing yet — gkm.config.ts deploys to no stage"}.`);
+		this.deployed = deployed;
+		this.name = "DispatchNamesNoStage";
+	}
+};
+//#endregion
+//#region src/stages/index.ts
+/**
+* `gkm stages` — the workspace's stages, as gkm.config.ts declares them.
+*
+* ```bash
+* gkm stages                    # a table
+* gkm stages --json             # {"local":"dev","deployed":["prod"],"protected":["prod"]}
+* gkm stages --github-output    # a workflow run's build and deploy matrices
+* ```
+*
+* The config is read by the normal loader (and sandbox), so a workflow never
+* parses TypeScript to learn which stages exist. `--github-output` is what the
+* `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and
+* which of them this run builds and deploys, to `$GITHUB_OUTPUT`.
+*/
+function stagesJson(stages) {
+	return {
+		local: stages.local,
+		deployed: [...stages.deployed],
+		protected: [...stages.protected ?? []]
+	};
+}
+/**
+* The region of the workspace's AWS secrets store — `ssm` or
+* `secrets-manager` — or `''` when its deployed stages keep their secrets
+* anywhere else. A job assumes the stage's AWS role only when this is set.
+*/
+function awsSecretsRegion(workspace) {
+	const store = workspace.secrets?.store;
+	if (typeof store !== "object" || store === null) return "";
+	if (store.provider === "ssm" || store.provider === "secrets-manager") return store.region;
+	return "";
+}
+/**
+* Every output the stages action sets, each a string `fromJSON()` reads, for
+* one workflow run.
+*/
+function githubOutputs(workspace, input) {
+	const stages = stagesJson(workspace.stages);
+	const plan = planStages(workspace.stages, input);
+	return {
+		local: JSON.stringify(stages.local),
+		deployed: JSON.stringify(stages.deployed),
+		protected: JSON.stringify(stages.protected),
+		build: JSON.stringify(plan.build),
+		deploy: JSON.stringify(plan.deploy),
+		"has-build": String(plan.build.length > 0),
+		"has-deploy": String(plan.deploy.length > 0),
+		"aws-region": awsSecretsRegion(workspace)
+	};
+}
+/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */
+function formatGithubOutputs(outputs) {
+	return Object.entries(outputs).map(([name, value]) => `${name}=${value}\n`).join("");
+}
+/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */
+function workflowCommandData(message) {
+	return message.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+function table(stages) {
+	const rows = [
+		["STAGE", "KIND"],
+		[stages.local, "local"],
+		...stages.deployed.map((name) => [name, stages.protected.includes(name) ? "deployed, protected" : "deployed"])
+	];
+	const width = Math.max(...rows.map(([name]) => name.length));
+	return rows.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`).join("\n");
+}
+async function stagesCommand(options, deps = {}) {
+	const env = deps.env ?? process.env;
+	const log = deps.log ?? ((line) => console.log(line));
+	if (!options.githubOutput) {
+		const stages = stagesJson((await require_config.loadWorkspaceSettings(deps.cwd)).stages);
+		log(options.json ? JSON.stringify(stages) : table(stages));
+		return;
+	}
+	try {
+		const file = env.GITHUB_OUTPUT;
+		if (!file) throw new GithubOutputNotSet();
+		const workspace = await require_config.loadWorkspaceSettings(deps.cwd);
+		const event = options.event || env.GITHUB_EVENT_NAME;
+		if (!event) throw new GithubEventNotSet();
+		const outputs = githubOutputs(workspace, {
+			event,
+			...options.stage ? { stage: options.stage } : {}
+		});
+		await (0, node_fs_promises.appendFile)(file, formatGithubOutputs(outputs));
+		log(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);
+	} catch (error) {
+		log(`::error title=gkm stages::${workflowCommandData(error instanceof Error ? error.message : String(error))}`);
+		throw error;
+	}
+}
+/** `--github-output` outside a GitHub Actions step, which sets the file. */
+var GithubOutputNotSet = class extends Error {
+	constructor() {
+		super("gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.");
+		this.name = "GithubOutputNotSet";
+	}
+};
+/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */
+var GithubEventNotSet = class extends Error {
+	constructor() {
+		super("gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.");
+		this.name = "GithubEventNotSet";
+	}
+};
+//#endregion
+exports.stagesCommand = stagesCommand;
+
+//# sourceMappingURL=stages-CwrYVX9u.cjs.map

package/dist/stages-CwrYVX9u.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages-CwrYVX9u.cjs","names":["UndeclaredStage","loadWorkspaceSettings","appendFile"],"sources":["../src/stages/plan.ts","../src/stages/index.ts"],"sourcesContent":["/**\n * Which stages a workflow run builds and deploys, from the event that started\n * it and the project's `stages`.\n *\n * The rules live here, in tested code, rather than in a workflow's YAML or in\n * the action that runs `gkm stages --github-output`: a project's deploy\n * workflow names no stage, and what it does for each event is decided by the\n * CLI the project installed.\n *\n * | event               | build              | deploy                          |\n * | ------------------- | ------------------ | ------------------------------- |\n * | `push`              | every deployed     | deployed, less the protected    |\n * | `release`           | none               | the protected                   |\n * | `workflow_dispatch` | none               | the one stage named             |\n * | anything else       | none               | none                            |\n *\n * A push builds every deployed stage, protected ones included, so a release\n * deploys images built from the very commit its tag names; a release and a\n * manual run deploy what a push already built.\n */\n\nimport { UndeclaredStage } from '../workspace/stages.js';\nimport type { StagesConfig } from '../workspace/types.js';\n\nexport interface StagePlan {\n\t/** The stages whose images this run builds and pushes. */\n\tbuild: string[];\n\t/** The stages this run deploys. */\n\tdeploy: string[];\n}\n\nexport interface PlanInput {\n\t/** The GitHub event name: `push`, `release`, `workflow_dispatch`, … */\n\tevent: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport function planStages(stages: StagesConfig, input: PlanInput): StagePlan {\n\tconst kept = stages.protected ?? [];\n\n\tswitch (input.event) {\n\t\tcase 'push':\n\t\t\treturn {\n\t\t\t\tbuild: [...stages.deployed],\n\t\t\t\tdeploy: stages.deployed.filter((stage) => !kept.includes(stage)),\n\t\t\t};\n\t\tcase 'release':\n\t\t\treturn { build: [], deploy: [...kept] };\n\t\tcase 'workflow_dispatch': {\n\t\t\tconst stage = input.stage?.trim();\n\t\t\tif (!stage) throw new DispatchNamesNoStage(stages.deployed);\n\t\t\tif (!stages.deployed.includes(stage)) {\n\t\t\t\tthrow new UndeclaredStage(stage, stages.deployed);\n\t\t\t}\n\t\t\treturn { build: [], deploy: [stage] };\n\t\t}\n\t\tdefault:\n\t\t\treturn { build: [], deploy: [] };\n\t}\n}\n\n/**\n * A manual run with no stage. Refused rather than read as \"nothing to do\", so\n * a run started with the field left empty fails where it can be seen.\n */\nexport class DispatchNamesNoStage extends Error {\n\tconstructor(readonly deployed: readonly string[]) {\n\t\tsuper(\n\t\t\t`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(', ') || 'nothing yet — gkm.config.ts deploys to no stage'}.`,\n\t\t);\n\t\tthis.name = 'DispatchNamesNoStage';\n\t}\n}\n","/**\n * `gkm stages` — the workspace's stages, as gkm.config.ts declares them.\n *\n * ```bash\n * gkm stages                    # a table\n * gkm stages --json             # {\"local\":\"dev\",\"deployed\":[\"prod\"],\"protected\":[\"prod\"]}\n * gkm stages --github-output    # a workflow run's build and deploy matrices\n * ```\n *\n * The config is read by the normal loader (and sandbox), so a workflow never\n * parses TypeScript to learn which stages exist. `--github-output` is what the\n * `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and\n * which of them this run builds and deploys, to `$GITHUB_OUTPUT`.\n */\n\nimport { appendFile } from 'node:fs/promises';\nimport { loadWorkspaceSettings } from '../config.js';\nimport type { NormalizedWorkspace, StagesConfig } from '../workspace/types.js';\nimport { planStages } from './plan.js';\n\nexport { DispatchNamesNoStage, type PlanInput, planStages } from './plan.js';\n\nexport interface StagesOptions {\n\t/** Print the stages as JSON. */\n\tjson?: boolean;\n\t/** Write the outputs a deploy workflow reads to `$GITHUB_OUTPUT`. */\n\tgithubOutput?: boolean;\n\t/** The event to plan for; defaults to `GITHUB_EVENT_NAME`. */\n\tevent?: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport interface StagesDeps {\n\tcwd?: string;\n\tenv?: NodeJS.ProcessEnv;\n\t/** Where lines go; stdout by default. */\n\tlog?: (line: string) => void;\n}\n\n/** The stages, as `gkm stages --json` prints them. */\nexport interface StagesJson {\n\tlocal: string;\n\tdeployed: string[];\n\tprotected: string[];\n}\n\nexport function stagesJson(stages: StagesConfig): StagesJson {\n\treturn {\n\t\tlocal: stages.local,\n\t\tdeployed: [...stages.deployed],\n\t\tprotected: [...(stages.protected ?? [])],\n\t};\n}\n\n/**\n * The region of the workspace's AWS secrets store — `ssm` or\n * `secrets-manager` — or `''` when its deployed stages keep their secrets\n * anywhere else. A job assumes the stage's AWS role only when this is set.\n */\nexport function awsSecretsRegion(workspace: NormalizedWorkspace): string {\n\tconst store = workspace.secrets?.store;\n\tif (typeof store !== 'object' || store === null) return '';\n\tif (store.provider === 'ssm' || store.provider === 'secrets-manager') {\n\t\treturn store.region;\n\t}\n\treturn '';\n}\n\n/**\n * Every output the stages action sets, each a string `fromJSON()` reads, for\n * one workflow run.\n */\nexport function githubOutputs(\n\tworkspace: NormalizedWorkspace,\n\tinput: { event: string; stage?: string },\n): Record<string, string> {\n\tconst stages = stagesJson(workspace.stages);\n\tconst plan = planStages(workspace.stages, input);\n\n\treturn {\n\t\tlocal: JSON.stringify(stages.local),\n\t\tdeployed: JSON.stringify(stages.deployed),\n\t\tprotected: JSON.stringify(stages.protected),\n\t\tbuild: JSON.stringify(plan.build),\n\t\tdeploy: JSON.stringify(plan.deploy),\n\t\t// A matrix over an empty list is an error on GitHub, so a job over one\n\t\t// is skipped on these instead.\n\t\t'has-build': String(plan.build.length > 0),\n\t\t'has-deploy': String(plan.deploy.length > 0),\n\t\t'aws-region': awsSecretsRegion(workspace),\n\t};\n}\n\n/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */\nexport function formatGithubOutputs(outputs: Record<string, string>): string {\n\treturn Object.entries(outputs)\n\t\t.map(([name, value]) => `${name}=${value}\\n`)\n\t\t.join('');\n}\n\n/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */\nfunction workflowCommandData(message: string): string {\n\treturn message\n\t\t.replaceAll('%', '%25')\n\t\t.replaceAll('\\r', '%0D')\n\t\t.replaceAll('\\n', '%0A');\n}\n\nfunction table(stages: StagesJson): string {\n\tconst rows: [string, string][] = [\n\t\t['STAGE', 'KIND'],\n\t\t[stages.local, 'local'],\n\t\t...stages.deployed.map((name): [string, string] => [\n\t\t\tname,\n\t\t\tstages.protected.includes(name) ? 'deployed, protected' : 'deployed',\n\t\t]),\n\t];\n\tconst width = Math.max(...rows.map(([name]) => name.length));\n\treturn rows\n\t\t.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`)\n\t\t.join('\\n');\n}\n\nexport async function stagesCommand(\n\toptions: StagesOptions,\n\tdeps: StagesDeps = {},\n): Promise<void> {\n\tconst env = deps.env ?? process.env;\n\tconst log = deps.log ?? ((line: string) => console.log(line));\n\n\tif (!options.githubOutput) {\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst stages = stagesJson(workspace.stages);\n\t\tlog(options.json ? JSON.stringify(stages) : table(stages));\n\t\treturn;\n\t}\n\n\ttry {\n\t\tconst file = env.GITHUB_OUTPUT;\n\t\tif (!file) throw new GithubOutputNotSet();\n\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst event = options.event || env.GITHUB_EVENT_NAME;\n\t\tif (!event) throw new GithubEventNotSet();\n\n\t\tconst outputs = githubOutputs(workspace, {\n\t\t\tevent,\n\t\t\t...(options.stage ? { stage: options.stage } : {}),\n\t\t});\n\t\tawait appendFile(file, formatGithubOutputs(outputs));\n\n\t\tlog(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);\n\t} catch (error) {\n\t\t// Annotated on the run, where whoever started it looks first.\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tlog(`::error title=gkm stages::${workflowCommandData(message)}`);\n\t\tthrow error;\n\t}\n}\n\n/** `--github-output` outside a GitHub Actions step, which sets the file. */\nexport class GithubOutputNotSet extends Error {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.',\n\t\t);\n\t\tthis.name = 'GithubOutputNotSet';\n\t}\n}\n\n/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */\nexport class GithubEventNotSet extends Error {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.',\n\t\t);\n\t\tthis.name = 'GithubEventNotSet';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,WAAW,QAAsB,OAA6B;CAC7E,MAAM,OAAO,OAAO,aAAa,CAAC;CAElC,QAAQ,MAAM,OAAd;EACC,KAAK,QACJ,OAAO;GACN,OAAO,CAAC,GAAG,OAAO,QAAQ;GAC1B,QAAQ,OAAO,SAAS,QAAQ,UAAU,CAAC,KAAK,SAAS,KAAK,CAAC;EAChE;EACD,KAAK,WACJ,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC,GAAG,IAAI;EAAE;EACvC,KAAK,qBAAqB;GACzB,MAAM,QAAQ,MAAM,OAAO,KAAK;GAChC,IAAI,CAAC,OAAO,MAAM,IAAI,qBAAqB,OAAO,QAAQ;GAC1D,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,GAClC,MAAM,IAAIA,kBAAAA,gBAAgB,OAAO,OAAO,QAAQ;GAEjD,OAAO;IAAE,OAAO,CAAC;IAAG,QAAQ,CAAC,KAAK;GAAE;EACrC;EACA,SACC,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC;EAAE;CACjC;AACD;;;;;AAMA,IAAa,uBAAb,cAA0C,MAAM;CAC1B;CAArB,YAAY,UAAsC;EACjD,MACC,wGAAwG,SAAS,KAAK,IAAI,KAAK,kDAAkD,EAClL;EAHoB,KAAA,WAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;;;;;AC1BA,SAAgB,WAAW,QAAkC;CAC5D,OAAO;EACN,OAAO,OAAO;EACd,UAAU,CAAC,GAAG,OAAO,QAAQ;EAC7B,WAAW,CAAC,GAAI,OAAO,aAAa,CAAC,CAAE;CACxC;AACD;;;;;;AAOA,SAAgB,iBAAiB,WAAwC;CACxE,MAAM,QAAQ,UAAU,SAAS;CACjC,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,IAAI,MAAM,aAAa,SAAS,MAAM,aAAa,mBAClD,OAAO,MAAM;CAEd,OAAO;AACR;;;;;AAMA,SAAgB,cACf,WACA,OACyB;CACzB,MAAM,SAAS,WAAW,UAAU,MAAM;CAC1C,MAAM,OAAO,WAAW,UAAU,QAAQ,KAAK;CAE/C,OAAO;EACN,OAAO,KAAK,UAAU,OAAO,KAAK;EAClC,UAAU,KAAK,UAAU,OAAO,QAAQ;EACxC,WAAW,KAAK,UAAU,OAAO,SAAS;EAC1C,OAAO,KAAK,UAAU,KAAK,KAAK;EAChC,QAAQ,KAAK,UAAU,KAAK,MAAM;EAGlC,aAAa,OAAO,KAAK,MAAM,SAAS,CAAC;EACzC,cAAc,OAAO,KAAK,OAAO,SAAS,CAAC;EAC3C,cAAc,iBAAiB,SAAS;CACzC;AACD;;AAGA,SAAgB,oBAAoB,SAAyC;CAC5E,OAAO,OAAO,QAAQ,OAAO,CAAC,CAC5B,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,CAAC,CAC5C,KAAK,EAAE;AACV;;AAGA,SAAS,oBAAoB,SAAyB;CACrD,OAAO,QACL,WAAW,KAAK,KAAK,CAAC,CACtB,WAAW,MAAM,KAAK,CAAC,CACvB,WAAW,MAAM,KAAK;AACzB;AAEA,SAAS,MAAM,QAA4B;CAC1C,MAAM,OAA2B;EAChC,CAAC,SAAS,MAAM;EAChB,CAAC,OAAO,OAAO,OAAO;EACtB,GAAG,OAAO,SAAS,KAAK,SAA2B,CAClD,MACA,OAAO,UAAU,SAAS,IAAI,IAAI,wBAAwB,UAC3D,CAAC;CACF;CACA,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC;CAC3D,OAAO,KACL,KAAK,CAAC,MAAM,UAAU,GAAG,KAAK,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,CACvD,KAAK,IAAI;AACZ;AAEA,eAAsB,cACrB,SACA,OAAmB,CAAC,GACJ;CAChB,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,KAAK,SAAS,SAAiB,QAAQ,IAAI,IAAI;CAE3D,IAAI,CAAC,QAAQ,cAAc;EAE1B,MAAM,SAAS,YAAW,MADFC,eAAAA,sBAAsB,KAAK,GAAG,EAAA,CAClB,MAAM;EAC1C,IAAI,QAAQ,OAAO,KAAK,UAAU,MAAM,IAAI,MAAM,MAAM,CAAC;EACzD;CACD;CAEA,IAAI;EACH,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB;EAExC,MAAM,YAAY,MAAMA,eAAAA,sBAAsB,KAAK,GAAG;EACtD,MAAM,QAAQ,QAAQ,SAAS,IAAI;EACnC,IAAI,CAAC,OAAO,MAAM,IAAI,kBAAkB;EAExC,MAAM,UAAU,cAAc,WAAW;GACxC;GACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjD,CAAC;EACD,OAAA,GAAMC,iBAAAA,WAAAA,CAAW,MAAM,oBAAoB,OAAO,CAAC;EAEnD,IAAI,GAAG,MAAM,UAAU,QAAQ,MAAM,WAAW,QAAQ,QAAQ;CACjE,SAAS,OAAO;EAGf,IAAI,6BAA6B,oBADjB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACT,GAAG;EAC/D,MAAM;CACP;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC7C,cAAc;EACb,MACC,oKACD;EACA,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAC5C,cAAc;EACb,MACC,uLACD;EACA,KAAK,OAAO;CACb;AACD"}

package/dist/target/public.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_define = require("../define-DzRz8FgH.cjs");
-const require_resolve = require("../resolve-ApSUK_HB.cjs");
+const require_resolve = require("../resolve-DCTcD823.cjs");
 const require_provider = require("../provider-C9_-45d5.cjs");
 exports.DeployTargetNotYetSupported = require_define.DeployTargetNotYetSupported;
 exports.InvalidTargetOptions = require_resolve.InvalidTargetOptions;

package/dist/target/public.mjs

@@ -1,4 +1,4 @@
 import { a as UnknownDeployTarget, i as DeployTargetNotYetSupported, n as isDeployTarget, t as defineTarget } from "../define-DR8xGYfL.mjs";
-import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-DY9TaVeV.mjs";
+import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-y1PkSZrF.mjs";
 import { t as ProviderRemoved } from "../provider-q4lsYzYG.mjs";
 export { DeployTargetNotYetSupported, InvalidTargetOptions, ProviderRemoved, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, defineTarget, isDeployTarget };

package/dist/workspace/index.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_workspace = require("../workspace-Bp8FEkF-.cjs");
+const require_workspace = require("../workspace-4i6Jwsoa.cjs");
 exports.DokployRegistryMoved = require_workspace.DokployRegistryMoved;
+exports.InvalidWorkspaceConfig = require_workspace.InvalidWorkspaceConfig;
 exports.PHASE_2_DEPLOY_TARGETS = require_workspace.PHASE_2_DEPLOY_TARGETS;
 exports.PUBLIC_ENV_PREFIXES = require_workspace.PUBLIC_ENV_PREFIXES;
 exports.SUPPORTED_DEPLOY_TARGETS = require_workspace.SUPPORTED_DEPLOY_TARGETS;

package/dist/workspace/index.d.cts

@@ -1,3 +1,3 @@
 import { A as FrontendFramework, B as validateWorkspaceConfig, C as SecretsConfig, D as isWorkspaceConfig, E as WorkspaceInput, F as formatValidationErrors, I as getDeployTargetError, L as isDeployTargetSupported, M as PHASE_2_DEPLOY_TARGETS, N as SUPPORTED_DEPLOY_TARGETS, O as BackendFramework, P as WorkspaceConfigSchema, R as isPhase2DeployTarget, S as NormalizedWorkspace, T as WorkspaceConfig, _ as InferAppNames, b as ModelsConfig, c as AppInput, d as ComposeWorkspaceConfig, f as ConstrainedApps, g as DokployWorkspaceConfig, j as MobileFramework, l as AppsRecord, m as DeployTargetName, o as AppConfig, p as DeployConfig, s as AppConfigInput, u as ComposeLogsConfig, v as InferredWorkspaceConfig, w as SharedConfig, x as NormalizedAppConfig, y as LoadedConfig, z as safeValidateWorkspaceConfig } from "../types-DZtj9jeI.cjs";
-import { a as constructPatterns, c as getAppGkmConfig, d as processConfig, f as workspaceConstructGlobs, g as stripPublicPrefix, h as getPublicEnvPrefix, i as assertNoMovedDeployKeys, l as getEndpointForStage, m as PUBLIC_ENV_PREFIXES, n as allConstructGlobs, o as defineWorkspace, p as wrapSingleAppAsWorkspace, r as appConstructGlobs, s as getAppBuildOrder, t as DokployRegistryMoved, u as normalizeWorkspace } from "../index-DTEPwLml.cjs";
-export { type AppConfig, type AppConfigInput, type AppInput, type AppsRecord, type BackendFramework, type ComposeLogsConfig, type ComposeWorkspaceConfig, type ConstrainedApps, type DeployConfig, type DeployTargetName, DokployRegistryMoved, type DokployWorkspaceConfig, type FrontendFramework, type InferAppNames, type InferredWorkspaceConfig, type LoadedConfig, type MobileFramework, type ModelsConfig, type NormalizedAppConfig, type NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, PUBLIC_ENV_PREFIXES, SUPPORTED_DEPLOY_TARGETS, type SecretsConfig, type SharedConfig, type WorkspaceConfig, WorkspaceConfigSchema, type WorkspaceInput, allConstructGlobs, appConstructGlobs, assertNoMovedDeployKeys, constructPatterns, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDeployTargetError, getEndpointForStage, getPublicEnvPrefix, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, stripPublicPrefix, validateWorkspaceConfig, workspaceConstructGlobs, wrapSingleAppAsWorkspace };
+import { _ as stripPublicPrefix, a as assertNoMovedDeployKeys, c as getAppBuildOrder, d as normalizeWorkspace, f as processConfig, g as getPublicEnvPrefix, h as PUBLIC_ENV_PREFIXES, i as appConstructGlobs, l as getAppGkmConfig, m as wrapSingleAppAsWorkspace, n as InvalidWorkspaceConfig, o as constructPatterns, p as workspaceConstructGlobs, r as allConstructGlobs, s as defineWorkspace, t as DokployRegistryMoved, u as getEndpointForStage } from "../index-DFrbhRwg.cjs";
+export { type AppConfig, type AppConfigInput, type AppInput, type AppsRecord, type BackendFramework, type ComposeLogsConfig, type ComposeWorkspaceConfig, type ConstrainedApps, type DeployConfig, type DeployTargetName, DokployRegistryMoved, type DokployWorkspaceConfig, type FrontendFramework, type InferAppNames, type InferredWorkspaceConfig, InvalidWorkspaceConfig, type LoadedConfig, type MobileFramework, type ModelsConfig, type NormalizedAppConfig, type NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, PUBLIC_ENV_PREFIXES, SUPPORTED_DEPLOY_TARGETS, type SecretsConfig, type SharedConfig, type WorkspaceConfig, WorkspaceConfigSchema, type WorkspaceInput, allConstructGlobs, appConstructGlobs, assertNoMovedDeployKeys, constructPatterns, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDeployTargetError, getEndpointForStage, getPublicEnvPrefix, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, stripPublicPrefix, validateWorkspaceConfig, workspaceConstructGlobs, wrapSingleAppAsWorkspace };

package/dist/workspace/index.d.mts

@@ -1,3 +1,3 @@
 import { A as FrontendFramework, B as validateWorkspaceConfig, C as SecretsConfig, D as isWorkspaceConfig, E as WorkspaceInput, F as formatValidationErrors, I as getDeployTargetError, L as isDeployTargetSupported, M as PHASE_2_DEPLOY_TARGETS, N as SUPPORTED_DEPLOY_TARGETS, O as BackendFramework, P as WorkspaceConfigSchema, R as isPhase2DeployTarget, S as NormalizedWorkspace, T as WorkspaceConfig, _ as InferAppNames, b as ModelsConfig, c as AppInput, d as ComposeWorkspaceConfig, f as ConstrainedApps, g as DokployWorkspaceConfig, j as MobileFramework, l as AppsRecord, m as DeployTargetName, o as AppConfig, p as DeployConfig, s as AppConfigInput, u as ComposeLogsConfig, v as InferredWorkspaceConfig, w as SharedConfig, x as NormalizedAppConfig, y as LoadedConfig, z as safeValidateWorkspaceConfig } from "../types-BzCavjGt.mjs";
-import { a as constructPatterns, c as getAppGkmConfig, d as processConfig, f as workspaceConstructGlobs, g as stripPublicPrefix, h as getPublicEnvPrefix, i as assertNoMovedDeployKeys, l as getEndpointForStage, m as PUBLIC_ENV_PREFIXES, n as allConstructGlobs, o as defineWorkspace, p as wrapSingleAppAsWorkspace, r as appConstructGlobs, s as getAppBuildOrder, t as DokployRegistryMoved, u as normalizeWorkspace } from "../index-C0UmP_lg.mjs";
-export { type AppConfig, type AppConfigInput, type AppInput, type AppsRecord, type BackendFramework, type ComposeLogsConfig, type ComposeWorkspaceConfig, type ConstrainedApps, type DeployConfig, type DeployTargetName, DokployRegistryMoved, type DokployWorkspaceConfig, type FrontendFramework, type InferAppNames, type InferredWorkspaceConfig, type LoadedConfig, type MobileFramework, type ModelsConfig, type NormalizedAppConfig, type NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, PUBLIC_ENV_PREFIXES, SUPPORTED_DEPLOY_TARGETS, type SecretsConfig, type SharedConfig, type WorkspaceConfig, WorkspaceConfigSchema, type WorkspaceInput, allConstructGlobs, appConstructGlobs, assertNoMovedDeployKeys, constructPatterns, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDeployTargetError, getEndpointForStage, getPublicEnvPrefix, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, stripPublicPrefix, validateWorkspaceConfig, workspaceConstructGlobs, wrapSingleAppAsWorkspace };
+import { _ as stripPublicPrefix, a as assertNoMovedDeployKeys, c as getAppBuildOrder, d as normalizeWorkspace, f as processConfig, g as getPublicEnvPrefix, h as PUBLIC_ENV_PREFIXES, i as appConstructGlobs, l as getAppGkmConfig, m as wrapSingleAppAsWorkspace, n as InvalidWorkspaceConfig, o as constructPatterns, p as workspaceConstructGlobs, r as allConstructGlobs, s as defineWorkspace, t as DokployRegistryMoved, u as getEndpointForStage } from "../index-Wuqpf316.mjs";
+export { type AppConfig, type AppConfigInput, type AppInput, type AppsRecord, type BackendFramework, type ComposeLogsConfig, type ComposeWorkspaceConfig, type ConstrainedApps, type DeployConfig, type DeployTargetName, DokployRegistryMoved, type DokployWorkspaceConfig, type FrontendFramework, type InferAppNames, type InferredWorkspaceConfig, InvalidWorkspaceConfig, type LoadedConfig, type MobileFramework, type ModelsConfig, type NormalizedAppConfig, type NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, PUBLIC_ENV_PREFIXES, SUPPORTED_DEPLOY_TARGETS, type SecretsConfig, type SharedConfig, type WorkspaceConfig, WorkspaceConfigSchema, type WorkspaceInput, allConstructGlobs, appConstructGlobs, assertNoMovedDeployKeys, constructPatterns, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDeployTargetError, getEndpointForStage, getPublicEnvPrefix, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, stripPublicPrefix, validateWorkspaceConfig, workspaceConstructGlobs, wrapSingleAppAsWorkspace };

package/dist/workspace/index.mjs

@@ -1,2 +1,2 @@
-import { C as isDeployTargetSupported, E as validateWorkspaceConfig, S as getDeployTargetError, T as safeValidateWorkspaceConfig, _ as isWorkspaceConfig, a as constructPatterns, b as WorkspaceConfigSchema, c as getAppGkmConfig, d as processConfig, f as workspaceConstructGlobs, g as stripPublicPrefix, h as getPublicEnvPrefix, i as assertNoMovedDeployKeys, l as getEndpointForStage, m as PUBLIC_ENV_PREFIXES, n as allConstructGlobs, o as defineWorkspace, p as wrapSingleAppAsWorkspace, r as appConstructGlobs, s as getAppBuildOrder, t as DokployRegistryMoved, u as normalizeWorkspace, v as PHASE_2_DEPLOY_TARGETS, w as isPhase2DeployTarget, x as formatValidationErrors, y as SUPPORTED_DEPLOY_TARGETS } from "../workspace-BBdqmkch.mjs";
-export { DokployRegistryMoved, PHASE_2_DEPLOY_TARGETS, PUBLIC_ENV_PREFIXES, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, allConstructGlobs, appConstructGlobs, assertNoMovedDeployKeys, constructPatterns, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDeployTargetError, getEndpointForStage, getPublicEnvPrefix, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, stripPublicPrefix, validateWorkspaceConfig, workspaceConstructGlobs, wrapSingleAppAsWorkspace };
+import { C as getDeployTargetError, D as validateWorkspaceConfig, E as safeValidateWorkspaceConfig, S as formatValidationErrors, T as isPhase2DeployTarget, _ as stripPublicPrefix, a as assertNoMovedDeployKeys, b as SUPPORTED_DEPLOY_TARGETS, c as getAppBuildOrder, d as normalizeWorkspace, f as processConfig, g as getPublicEnvPrefix, h as PUBLIC_ENV_PREFIXES, i as appConstructGlobs, l as getAppGkmConfig, m as wrapSingleAppAsWorkspace, n as InvalidWorkspaceConfig, o as constructPatterns, p as workspaceConstructGlobs, r as allConstructGlobs, s as defineWorkspace, t as DokployRegistryMoved, u as getEndpointForStage, v as isWorkspaceConfig, w as isDeployTargetSupported, x as WorkspaceConfigSchema, y as PHASE_2_DEPLOY_TARGETS } from "../workspace-DD9mtPy8.mjs";
+export { DokployRegistryMoved, InvalidWorkspaceConfig, PHASE_2_DEPLOY_TARGETS, PUBLIC_ENV_PREFIXES, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, allConstructGlobs, appConstructGlobs, assertNoMovedDeployKeys, constructPatterns, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDeployTargetError, getEndpointForStage, getPublicEnvPrefix, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, stripPublicPrefix, validateWorkspaceConfig, workspaceConstructGlobs, wrapSingleAppAsWorkspace };

package/dist/{workspace-Bp8FEkF-.cjs → workspace-4i6Jwsoa.cjs}

@@ -1162,8 +1162,9 @@ function processConfig(config, cwd) {
 	assertNoMovedDeployKeys(config.deploy);
 	if (isWorkspaceConfig(config)) {
 		assertKnownSecretsStore(config.secrets?.store);
+		if (config.stages === void 0) throw new InvalidStages(stageProblems(void 0));
 		const result = safeValidateWorkspaceConfig(config);
-		if (!result.success && result.error) throw new Error(formatValidationErrors(result.error));
+		if (!result.success && result.error) throw new InvalidWorkspaceConfig(formatValidationErrors(result.error));
 		return {
 			type: "workspace",
 			raw: config,
@@ -1176,6 +1177,13 @@ function processConfig(config, cwd) {
 		workspace: wrapSingleAppAsWorkspace(config, cwd)
 	};
 }
+/** A workspace config the schema refuses; the message lists every issue. */
+var InvalidWorkspaceConfig = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidWorkspaceConfig";
+	}
+};
 /**
 * The workspace's own constructs globs, absolute.
 *
@@ -1306,6 +1314,12 @@ Object.defineProperty(exports, "InvalidStages", {
 		return InvalidStages;
 	}
 });
+Object.defineProperty(exports, "InvalidWorkspaceConfig", {
+	enumerable: true,
+	get: function() {
+		return InvalidWorkspaceConfig;
+	}
+});
 Object.defineProperty(exports, "LOGS_PORT", {
 	enumerable: true,
 	get: function() {
@@ -1342,6 +1356,12 @@ Object.defineProperty(exports, "TEST_STAGE", {
 		return TEST_STAGE;
 	}
 });
+Object.defineProperty(exports, "UndeclaredStage", {
+	enumerable: true,
+	get: function() {
+		return UndeclaredStage;
+	}
+});
 Object.defineProperty(exports, "UnknownSecretsStoreProvider", {
 	enumerable: true,
 	get: function() {
@@ -1517,4 +1537,4 @@ Object.defineProperty(exports, "wrapSingleAppAsWorkspace", {
 	}
 });
 
-//# sourceMappingURL=workspace-Bp8FEkF-.cjs.map
+//# sourceMappingURL=workspace-4i6Jwsoa.cjs.map