@geekmidas/cli 10.0.0-alpha.82 → 10.0.0-alpha.84

package/dist/stages-CS1sjcRb.cjs

@@ -0,0 +1,174 @@
+const require_workspace = require("./workspace-Bic_R3tz.cjs");
+const require_config = require("./config.cjs");
+let node_fs_promises = require("node:fs/promises");
+//#region src/stages/plan.ts
+/**
+* Which stages a workflow run builds and deploys, from the event that started
+* it and the project's `stages`.
+*
+* The rules live here, in tested code, rather than in a workflow's YAML or in
+* the action that runs `gkm stages --github-output`: a project's deploy
+* workflow names no stage, and what it does for each event is decided by the
+* CLI the project installed.
+*
+* | event               | build              | deploy                          |
+* | ------------------- | ------------------ | ------------------------------- |
+* | `push`              | every deployed     | deployed, less the protected    |
+* | `release`           | none               | the protected                   |
+* | `workflow_dispatch` | none               | the one stage named             |
+* | anything else       | none               | none                            |
+*
+* A push builds every deployed stage, protected ones included, so a release
+* deploys images built from the very commit its tag names; a release and a
+* manual run deploy what a push already built.
+*/
+function planStages(stages, input) {
+	const kept = stages.protected ?? [];
+	switch (input.event) {
+		case "push": return {
+			build: [...stages.deployed],
+			deploy: stages.deployed.filter((stage) => !kept.includes(stage))
+		};
+		case "release": return {
+			build: [],
+			deploy: [...kept]
+		};
+		case "workflow_dispatch": {
+			const stage = input.stage?.trim();
+			if (!stage) throw new DispatchNamesNoStage(stages.deployed);
+			if (!stages.deployed.includes(stage)) throw new require_workspace.UndeclaredStage(stage, stages.deployed);
+			return {
+				build: [],
+				deploy: [stage]
+			};
+		}
+		default: return {
+			build: [],
+			deploy: []
+		};
+	}
+}
+/**
+* A manual run with no stage. Refused rather than read as "nothing to do", so
+* a run started with the field left empty fails where it can be seen.
+*/
+var DispatchNamesNoStage = class extends Error {
+	deployed;
+	constructor(deployed) {
+		super(`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(", ") || "nothing yet — gkm.config.ts deploys to no stage"}.`);
+		this.deployed = deployed;
+		this.name = "DispatchNamesNoStage";
+	}
+};
+//#endregion
+//#region src/stages/index.ts
+/**
+* `gkm stages` — the workspace's stages, as gkm.config.ts declares them.
+*
+* ```bash
+* gkm stages                    # a table
+* gkm stages --json             # {"local":"dev","deployed":["prod"],"protected":["prod"]}
+* gkm stages --github-output    # a workflow run's build and deploy matrices
+* ```
+*
+* The config is read by the normal loader (and sandbox), so a workflow never
+* parses TypeScript to learn which stages exist. `--github-output` is what the
+* `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and
+* which of them this run builds and deploys, to `$GITHUB_OUTPUT`.
+*/
+function stagesJson(stages) {
+	return {
+		local: stages.local,
+		deployed: [...stages.deployed],
+		protected: [...stages.protected ?? []]
+	};
+}
+/**
+* The region of the workspace's AWS secrets store — `ssm` or
+* `secrets-manager` — or `''` when its deployed stages keep their secrets
+* anywhere else. A job assumes the stage's AWS role only when this is set.
+*/
+function awsSecretsRegion(workspace) {
+	const store = workspace.secrets?.store;
+	if (typeof store !== "object" || store === null) return "";
+	if (store.provider === "ssm" || store.provider === "secrets-manager") return store.region;
+	return "";
+}
+/**
+* Every output the stages action sets, each a string `fromJSON()` reads, for
+* one workflow run.
+*/
+function githubOutputs(workspace, input) {
+	const stages = stagesJson(workspace.stages);
+	const plan = planStages(workspace.stages, input);
+	return {
+		local: JSON.stringify(stages.local),
+		deployed: JSON.stringify(stages.deployed),
+		protected: JSON.stringify(stages.protected),
+		build: JSON.stringify(plan.build),
+		deploy: JSON.stringify(plan.deploy),
+		"has-build": String(plan.build.length > 0),
+		"has-deploy": String(plan.deploy.length > 0),
+		"aws-region": awsSecretsRegion(workspace)
+	};
+}
+/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */
+function formatGithubOutputs(outputs) {
+	return Object.entries(outputs).map(([name, value]) => `${name}=${value}\n`).join("");
+}
+/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */
+function workflowCommandData(message) {
+	return message.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+function table(stages) {
+	const rows = [
+		["STAGE", "KIND"],
+		[stages.local, "local"],
+		...stages.deployed.map((name) => [name, stages.protected.includes(name) ? "deployed, protected" : "deployed"])
+	];
+	const width = Math.max(...rows.map(([name]) => name.length));
+	return rows.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`).join("\n");
+}
+async function stagesCommand(options, deps = {}) {
+	const env = deps.env ?? process.env;
+	const log = deps.log ?? ((line) => console.log(line));
+	if (!options.githubOutput) {
+		const stages = stagesJson((await require_config.loadWorkspaceSettings(deps.cwd)).stages);
+		log(options.json ? JSON.stringify(stages) : table(stages));
+		return;
+	}
+	try {
+		const file = env.GITHUB_OUTPUT;
+		if (!file) throw new GithubOutputNotSet();
+		const workspace = await require_config.loadWorkspaceSettings(deps.cwd);
+		const event = options.event || env.GITHUB_EVENT_NAME;
+		if (!event) throw new GithubEventNotSet();
+		const outputs = githubOutputs(workspace, {
+			event,
+			...options.stage ? { stage: options.stage } : {}
+		});
+		await (0, node_fs_promises.appendFile)(file, formatGithubOutputs(outputs));
+		log(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);
+	} catch (error) {
+		log(`::error title=gkm stages::${workflowCommandData(error instanceof Error ? error.message : String(error))}`);
+		throw error;
+	}
+}
+/** `--github-output` outside a GitHub Actions step, which sets the file. */
+var GithubOutputNotSet = class extends Error {
+	constructor() {
+		super("gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.");
+		this.name = "GithubOutputNotSet";
+	}
+};
+/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */
+var GithubEventNotSet = class extends Error {
+	constructor() {
+		super("gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.");
+		this.name = "GithubEventNotSet";
+	}
+};
+//#endregion
+exports.stagesCommand = stagesCommand;
+
+//# sourceMappingURL=stages-CS1sjcRb.cjs.map

package/dist/stages-CS1sjcRb.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages-CS1sjcRb.cjs","names":["UndeclaredStage","loadWorkspaceSettings","appendFile"],"sources":["../src/stages/plan.ts","../src/stages/index.ts"],"sourcesContent":["/**\n * Which stages a workflow run builds and deploys, from the event that started\n * it and the project's `stages`.\n *\n * The rules live here, in tested code, rather than in a workflow's YAML or in\n * the action that runs `gkm stages --github-output`: a project's deploy\n * workflow names no stage, and what it does for each event is decided by the\n * CLI the project installed.\n *\n * | event               | build              | deploy                          |\n * | ------------------- | ------------------ | ------------------------------- |\n * | `push`              | every deployed     | deployed, less the protected    |\n * | `release`           | none               | the protected                   |\n * | `workflow_dispatch` | none               | the one stage named             |\n * | anything else       | none               | none                            |\n *\n * A push builds every deployed stage, protected ones included, so a release\n * deploys images built from the very commit its tag names; a release and a\n * manual run deploy what a push already built.\n */\n\nimport { UndeclaredStage } from '../workspace/stages.js';\nimport type { StagesConfig } from '../workspace/types.js';\n\nexport interface StagePlan {\n\t/** The stages whose images this run builds and pushes. */\n\tbuild: string[];\n\t/** The stages this run deploys. */\n\tdeploy: string[];\n}\n\nexport interface PlanInput {\n\t/** The GitHub event name: `push`, `release`, `workflow_dispatch`, … */\n\tevent: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport function planStages(stages: StagesConfig, input: PlanInput): StagePlan {\n\tconst kept = stages.protected ?? [];\n\n\tswitch (input.event) {\n\t\tcase 'push':\n\t\t\treturn {\n\t\t\t\tbuild: [...stages.deployed],\n\t\t\t\tdeploy: stages.deployed.filter((stage) => !kept.includes(stage)),\n\t\t\t};\n\t\tcase 'release':\n\t\t\treturn { build: [], deploy: [...kept] };\n\t\tcase 'workflow_dispatch': {\n\t\t\tconst stage = input.stage?.trim();\n\t\t\tif (!stage) throw new DispatchNamesNoStage(stages.deployed);\n\t\t\tif (!stages.deployed.includes(stage)) {\n\t\t\t\tthrow new UndeclaredStage(stage, stages.deployed);\n\t\t\t}\n\t\t\treturn { build: [], deploy: [stage] };\n\t\t}\n\t\tdefault:\n\t\t\treturn { build: [], deploy: [] };\n\t}\n}\n\n/**\n * A manual run with no stage. Refused rather than read as \"nothing to do\", so\n * a run started with the field left empty fails where it can be seen.\n */\nexport class DispatchNamesNoStage extends Error {\n\tconstructor(readonly deployed: readonly string[]) {\n\t\tsuper(\n\t\t\t`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(', ') || 'nothing yet — gkm.config.ts deploys to no stage'}.`,\n\t\t);\n\t\tthis.name = 'DispatchNamesNoStage';\n\t}\n}\n","/**\n * `gkm stages` — the workspace's stages, as gkm.config.ts declares them.\n *\n * ```bash\n * gkm stages                    # a table\n * gkm stages --json             # {\"local\":\"dev\",\"deployed\":[\"prod\"],\"protected\":[\"prod\"]}\n * gkm stages --github-output    # a workflow run's build and deploy matrices\n * ```\n *\n * The config is read by the normal loader (and sandbox), so a workflow never\n * parses TypeScript to learn which stages exist. `--github-output` is what the\n * `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and\n * which of them this run builds and deploys, to `$GITHUB_OUTPUT`.\n */\n\nimport { appendFile } from 'node:fs/promises';\nimport { loadWorkspaceSettings } from '../config.js';\nimport type { NormalizedWorkspace, StagesConfig } from '../workspace/types.js';\nimport { planStages } from './plan.js';\n\nexport { DispatchNamesNoStage, type PlanInput, planStages } from './plan.js';\n\nexport interface StagesOptions {\n\t/** Print the stages as JSON. */\n\tjson?: boolean;\n\t/** Write the outputs a deploy workflow reads to `$GITHUB_OUTPUT`. */\n\tgithubOutput?: boolean;\n\t/** The event to plan for; defaults to `GITHUB_EVENT_NAME`. */\n\tevent?: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport interface StagesDeps {\n\tcwd?: string;\n\tenv?: NodeJS.ProcessEnv;\n\t/** Where lines go; stdout by default. */\n\tlog?: (line: string) => void;\n}\n\n/** The stages, as `gkm stages --json` prints them. */\nexport interface StagesJson {\n\tlocal: string;\n\tdeployed: string[];\n\tprotected: string[];\n}\n\nexport function stagesJson(stages: StagesConfig): StagesJson {\n\treturn {\n\t\tlocal: stages.local,\n\t\tdeployed: [...stages.deployed],\n\t\tprotected: [...(stages.protected ?? [])],\n\t};\n}\n\n/**\n * The region of the workspace's AWS secrets store — `ssm` or\n * `secrets-manager` — or `''` when its deployed stages keep their secrets\n * anywhere else. A job assumes the stage's AWS role only when this is set.\n */\nexport function awsSecretsRegion(workspace: NormalizedWorkspace): string {\n\tconst store = workspace.secrets?.store;\n\tif (typeof store !== 'object' || store === null) return '';\n\tif (store.provider === 'ssm' || store.provider === 'secrets-manager') {\n\t\treturn store.region;\n\t}\n\treturn '';\n}\n\n/**\n * Every output the stages action sets, each a string `fromJSON()` reads, for\n * one workflow run.\n */\nexport function githubOutputs(\n\tworkspace: NormalizedWorkspace,\n\tinput: { event: string; stage?: string },\n): Record<string, string> {\n\tconst stages = stagesJson(workspace.stages);\n\tconst plan = planStages(workspace.stages, input);\n\n\treturn {\n\t\tlocal: JSON.stringify(stages.local),\n\t\tdeployed: JSON.stringify(stages.deployed),\n\t\tprotected: JSON.stringify(stages.protected),\n\t\tbuild: JSON.stringify(plan.build),\n\t\tdeploy: JSON.stringify(plan.deploy),\n\t\t// A matrix over an empty list is an error on GitHub, so a job over one\n\t\t// is skipped on these instead.\n\t\t'has-build': String(plan.build.length > 0),\n\t\t'has-deploy': String(plan.deploy.length > 0),\n\t\t'aws-region': awsSecretsRegion(workspace),\n\t};\n}\n\n/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */\nexport function formatGithubOutputs(outputs: Record<string, string>): string {\n\treturn Object.entries(outputs)\n\t\t.map(([name, value]) => `${name}=${value}\\n`)\n\t\t.join('');\n}\n\n/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */\nfunction workflowCommandData(message: string): string {\n\treturn message\n\t\t.replaceAll('%', '%25')\n\t\t.replaceAll('\\r', '%0D')\n\t\t.replaceAll('\\n', '%0A');\n}\n\nfunction table(stages: StagesJson): string {\n\tconst rows: [string, string][] = [\n\t\t['STAGE', 'KIND'],\n\t\t[stages.local, 'local'],\n\t\t...stages.deployed.map((name): [string, string] => [\n\t\t\tname,\n\t\t\tstages.protected.includes(name) ? 'deployed, protected' : 'deployed',\n\t\t]),\n\t];\n\tconst width = Math.max(...rows.map(([name]) => name.length));\n\treturn rows\n\t\t.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`)\n\t\t.join('\\n');\n}\n\nexport async function stagesCommand(\n\toptions: StagesOptions,\n\tdeps: StagesDeps = {},\n): Promise<void> {\n\tconst env = deps.env ?? process.env;\n\tconst log = deps.log ?? ((line: string) => console.log(line));\n\n\tif (!options.githubOutput) {\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst stages = stagesJson(workspace.stages);\n\t\tlog(options.json ? JSON.stringify(stages) : table(stages));\n\t\treturn;\n\t}\n\n\ttry {\n\t\tconst file = env.GITHUB_OUTPUT;\n\t\tif (!file) throw new GithubOutputNotSet();\n\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst event = options.event || env.GITHUB_EVENT_NAME;\n\t\tif (!event) throw new GithubEventNotSet();\n\n\t\tconst outputs = githubOutputs(workspace, {\n\t\t\tevent,\n\t\t\t...(options.stage ? { stage: options.stage } : {}),\n\t\t});\n\t\tawait appendFile(file, formatGithubOutputs(outputs));\n\n\t\tlog(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);\n\t} catch (error) {\n\t\t// Annotated on the run, where whoever started it looks first.\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tlog(`::error title=gkm stages::${workflowCommandData(message)}`);\n\t\tthrow error;\n\t}\n}\n\n/** `--github-output` outside a GitHub Actions step, which sets the file. */\nexport class GithubOutputNotSet extends Error {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.',\n\t\t);\n\t\tthis.name = 'GithubOutputNotSet';\n\t}\n}\n\n/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */\nexport class GithubEventNotSet extends Error {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.',\n\t\t);\n\t\tthis.name = 'GithubEventNotSet';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,WAAW,QAAsB,OAA6B;CAC7E,MAAM,OAAO,OAAO,aAAa,CAAC;CAElC,QAAQ,MAAM,OAAd;EACC,KAAK,QACJ,OAAO;GACN,OAAO,CAAC,GAAG,OAAO,QAAQ;GAC1B,QAAQ,OAAO,SAAS,QAAQ,UAAU,CAAC,KAAK,SAAS,KAAK,CAAC;EAChE;EACD,KAAK,WACJ,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC,GAAG,IAAI;EAAE;EACvC,KAAK,qBAAqB;GACzB,MAAM,QAAQ,MAAM,OAAO,KAAK;GAChC,IAAI,CAAC,OAAO,MAAM,IAAI,qBAAqB,OAAO,QAAQ;GAC1D,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,GAClC,MAAM,IAAIA,kBAAAA,gBAAgB,OAAO,OAAO,QAAQ;GAEjD,OAAO;IAAE,OAAO,CAAC;IAAG,QAAQ,CAAC,KAAK;GAAE;EACrC;EACA,SACC,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC;EAAE;CACjC;AACD;;;;;AAMA,IAAa,uBAAb,cAA0C,MAAM;CAC1B;CAArB,YAAY,UAAsC;EACjD,MACC,wGAAwG,SAAS,KAAK,IAAI,KAAK,kDAAkD,EAClL;EAHoB,KAAA,WAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;;;;;AC1BA,SAAgB,WAAW,QAAkC;CAC5D,OAAO;EACN,OAAO,OAAO;EACd,UAAU,CAAC,GAAG,OAAO,QAAQ;EAC7B,WAAW,CAAC,GAAI,OAAO,aAAa,CAAC,CAAE;CACxC;AACD;;;;;;AAOA,SAAgB,iBAAiB,WAAwC;CACxE,MAAM,QAAQ,UAAU,SAAS;CACjC,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,IAAI,MAAM,aAAa,SAAS,MAAM,aAAa,mBAClD,OAAO,MAAM;CAEd,OAAO;AACR;;;;;AAMA,SAAgB,cACf,WACA,OACyB;CACzB,MAAM,SAAS,WAAW,UAAU,MAAM;CAC1C,MAAM,OAAO,WAAW,UAAU,QAAQ,KAAK;CAE/C,OAAO;EACN,OAAO,KAAK,UAAU,OAAO,KAAK;EAClC,UAAU,KAAK,UAAU,OAAO,QAAQ;EACxC,WAAW,KAAK,UAAU,OAAO,SAAS;EAC1C,OAAO,KAAK,UAAU,KAAK,KAAK;EAChC,QAAQ,KAAK,UAAU,KAAK,MAAM;EAGlC,aAAa,OAAO,KAAK,MAAM,SAAS,CAAC;EACzC,cAAc,OAAO,KAAK,OAAO,SAAS,CAAC;EAC3C,cAAc,iBAAiB,SAAS;CACzC;AACD;;AAGA,SAAgB,oBAAoB,SAAyC;CAC5E,OAAO,OAAO,QAAQ,OAAO,CAAC,CAC5B,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,CAAC,CAC5C,KAAK,EAAE;AACV;;AAGA,SAAS,oBAAoB,SAAyB;CACrD,OAAO,QACL,WAAW,KAAK,KAAK,CAAC,CACtB,WAAW,MAAM,KAAK,CAAC,CACvB,WAAW,MAAM,KAAK;AACzB;AAEA,SAAS,MAAM,QAA4B;CAC1C,MAAM,OAA2B;EAChC,CAAC,SAAS,MAAM;EAChB,CAAC,OAAO,OAAO,OAAO;EACtB,GAAG,OAAO,SAAS,KAAK,SAA2B,CAClD,MACA,OAAO,UAAU,SAAS,IAAI,IAAI,wBAAwB,UAC3D,CAAC;CACF;CACA,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC;CAC3D,OAAO,KACL,KAAK,CAAC,MAAM,UAAU,GAAG,KAAK,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,CACvD,KAAK,IAAI;AACZ;AAEA,eAAsB,cACrB,SACA,OAAmB,CAAC,GACJ;CAChB,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,KAAK,SAAS,SAAiB,QAAQ,IAAI,IAAI;CAE3D,IAAI,CAAC,QAAQ,cAAc;EAE1B,MAAM,SAAS,YAAW,MADFC,eAAAA,sBAAsB,KAAK,GAAG,EAAA,CAClB,MAAM;EAC1C,IAAI,QAAQ,OAAO,KAAK,UAAU,MAAM,IAAI,MAAM,MAAM,CAAC;EACzD;CACD;CAEA,IAAI;EACH,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB;EAExC,MAAM,YAAY,MAAMA,eAAAA,sBAAsB,KAAK,GAAG;EACtD,MAAM,QAAQ,QAAQ,SAAS,IAAI;EACnC,IAAI,CAAC,OAAO,MAAM,IAAI,kBAAkB;EAExC,MAAM,UAAU,cAAc,WAAW;GACxC;GACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjD,CAAC;EACD,OAAA,GAAMC,iBAAAA,WAAAA,CAAW,MAAM,oBAAoB,OAAO,CAAC;EAEnD,IAAI,GAAG,MAAM,UAAU,QAAQ,MAAM,WAAW,QAAQ,QAAQ;CACjE,SAAS,OAAO;EAGf,IAAI,6BAA6B,oBADjB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACT,GAAG;EAC/D,MAAM;CACP;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC7C,cAAc;EACb,MACC,oKACD;EACA,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAC5C,cAAc;EACb,MACC,uLACD;EACA,KAAK,OAAO;CACb;AACD"}

package/dist/stages-CSXt7N2b.mjs

@@ -0,0 +1,174 @@
+import { A as UndeclaredStage } from "./workspace-Drz4jsvy.mjs";
+import { loadWorkspaceSettings } from "./config.mjs";
+import { appendFile } from "node:fs/promises";
+//#region src/stages/plan.ts
+/**
+* Which stages a workflow run builds and deploys, from the event that started
+* it and the project's `stages`.
+*
+* The rules live here, in tested code, rather than in a workflow's YAML or in
+* the action that runs `gkm stages --github-output`: a project's deploy
+* workflow names no stage, and what it does for each event is decided by the
+* CLI the project installed.
+*
+* | event               | build              | deploy                          |
+* | ------------------- | ------------------ | ------------------------------- |
+* | `push`              | every deployed     | deployed, less the protected    |
+* | `release`           | none               | the protected                   |
+* | `workflow_dispatch` | none               | the one stage named             |
+* | anything else       | none               | none                            |
+*
+* A push builds every deployed stage, protected ones included, so a release
+* deploys images built from the very commit its tag names; a release and a
+* manual run deploy what a push already built.
+*/
+function planStages(stages, input) {
+	const kept = stages.protected ?? [];
+	switch (input.event) {
+		case "push": return {
+			build: [...stages.deployed],
+			deploy: stages.deployed.filter((stage) => !kept.includes(stage))
+		};
+		case "release": return {
+			build: [],
+			deploy: [...kept]
+		};
+		case "workflow_dispatch": {
+			const stage = input.stage?.trim();
+			if (!stage) throw new DispatchNamesNoStage(stages.deployed);
+			if (!stages.deployed.includes(stage)) throw new UndeclaredStage(stage, stages.deployed);
+			return {
+				build: [],
+				deploy: [stage]
+			};
+		}
+		default: return {
+			build: [],
+			deploy: []
+		};
+	}
+}
+/**
+* A manual run with no stage. Refused rather than read as "nothing to do", so
+* a run started with the field left empty fails where it can be seen.
+*/
+var DispatchNamesNoStage = class extends Error {
+	deployed;
+	constructor(deployed) {
+		super(`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(", ") || "nothing yet — gkm.config.ts deploys to no stage"}.`);
+		this.deployed = deployed;
+		this.name = "DispatchNamesNoStage";
+	}
+};
+//#endregion
+//#region src/stages/index.ts
+/**
+* `gkm stages` — the workspace's stages, as gkm.config.ts declares them.
+*
+* ```bash
+* gkm stages                    # a table
+* gkm stages --json             # {"local":"dev","deployed":["prod"],"protected":["prod"]}
+* gkm stages --github-output    # a workflow run's build and deploy matrices
+* ```
+*
+* The config is read by the normal loader (and sandbox), so a workflow never
+* parses TypeScript to learn which stages exist. `--github-output` is what the
+* `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and
+* which of them this run builds and deploys, to `$GITHUB_OUTPUT`.
+*/
+function stagesJson(stages) {
+	return {
+		local: stages.local,
+		deployed: [...stages.deployed],
+		protected: [...stages.protected ?? []]
+	};
+}
+/**
+* The region of the workspace's AWS secrets store — `ssm` or
+* `secrets-manager` — or `''` when its deployed stages keep their secrets
+* anywhere else. A job assumes the stage's AWS role only when this is set.
+*/
+function awsSecretsRegion(workspace) {
+	const store = workspace.secrets?.store;
+	if (typeof store !== "object" || store === null) return "";
+	if (store.provider === "ssm" || store.provider === "secrets-manager") return store.region;
+	return "";
+}
+/**
+* Every output the stages action sets, each a string `fromJSON()` reads, for
+* one workflow run.
+*/
+function githubOutputs(workspace, input) {
+	const stages = stagesJson(workspace.stages);
+	const plan = planStages(workspace.stages, input);
+	return {
+		local: JSON.stringify(stages.local),
+		deployed: JSON.stringify(stages.deployed),
+		protected: JSON.stringify(stages.protected),
+		build: JSON.stringify(plan.build),
+		deploy: JSON.stringify(plan.deploy),
+		"has-build": String(plan.build.length > 0),
+		"has-deploy": String(plan.deploy.length > 0),
+		"aws-region": awsSecretsRegion(workspace)
+	};
+}
+/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */
+function formatGithubOutputs(outputs) {
+	return Object.entries(outputs).map(([name, value]) => `${name}=${value}\n`).join("");
+}
+/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */
+function workflowCommandData(message) {
+	return message.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+function table(stages) {
+	const rows = [
+		["STAGE", "KIND"],
+		[stages.local, "local"],
+		...stages.deployed.map((name) => [name, stages.protected.includes(name) ? "deployed, protected" : "deployed"])
+	];
+	const width = Math.max(...rows.map(([name]) => name.length));
+	return rows.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`).join("\n");
+}
+async function stagesCommand(options, deps = {}) {
+	const env = deps.env ?? process.env;
+	const log = deps.log ?? ((line) => console.log(line));
+	if (!options.githubOutput) {
+		const stages = stagesJson((await loadWorkspaceSettings(deps.cwd)).stages);
+		log(options.json ? JSON.stringify(stages) : table(stages));
+		return;
+	}
+	try {
+		const file = env.GITHUB_OUTPUT;
+		if (!file) throw new GithubOutputNotSet();
+		const workspace = await loadWorkspaceSettings(deps.cwd);
+		const event = options.event || env.GITHUB_EVENT_NAME;
+		if (!event) throw new GithubEventNotSet();
+		const outputs = githubOutputs(workspace, {
+			event,
+			...options.stage ? { stage: options.stage } : {}
+		});
+		await appendFile(file, formatGithubOutputs(outputs));
+		log(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);
+	} catch (error) {
+		log(`::error title=gkm stages::${workflowCommandData(error instanceof Error ? error.message : String(error))}`);
+		throw error;
+	}
+}
+/** `--github-output` outside a GitHub Actions step, which sets the file. */
+var GithubOutputNotSet = class extends Error {
+	constructor() {
+		super("gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.");
+		this.name = "GithubOutputNotSet";
+	}
+};
+/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */
+var GithubEventNotSet = class extends Error {
+	constructor() {
+		super("gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.");
+		this.name = "GithubEventNotSet";
+	}
+};
+//#endregion
+export { stagesCommand };
+
+//# sourceMappingURL=stages-CSXt7N2b.mjs.map

package/dist/stages-CSXt7N2b.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages-CSXt7N2b.mjs","names":[],"sources":["../src/stages/plan.ts","../src/stages/index.ts"],"sourcesContent":["/**\n * Which stages a workflow run builds and deploys, from the event that started\n * it and the project's `stages`.\n *\n * The rules live here, in tested code, rather than in a workflow's YAML or in\n * the action that runs `gkm stages --github-output`: a project's deploy\n * workflow names no stage, and what it does for each event is decided by the\n * CLI the project installed.\n *\n * | event               | build              | deploy                          |\n * | ------------------- | ------------------ | ------------------------------- |\n * | `push`              | every deployed     | deployed, less the protected    |\n * | `release`           | none               | the protected                   |\n * | `workflow_dispatch` | none               | the one stage named             |\n * | anything else       | none               | none                            |\n *\n * A push builds every deployed stage, protected ones included, so a release\n * deploys images built from the very commit its tag names; a release and a\n * manual run deploy what a push already built.\n */\n\nimport { UndeclaredStage } from '../workspace/stages.js';\nimport type { StagesConfig } from '../workspace/types.js';\n\nexport interface StagePlan {\n\t/** The stages whose images this run builds and pushes. */\n\tbuild: string[];\n\t/** The stages this run deploys. */\n\tdeploy: string[];\n}\n\nexport interface PlanInput {\n\t/** The GitHub event name: `push`, `release`, `workflow_dispatch`, … */\n\tevent: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport function planStages(stages: StagesConfig, input: PlanInput): StagePlan {\n\tconst kept = stages.protected ?? [];\n\n\tswitch (input.event) {\n\t\tcase 'push':\n\t\t\treturn {\n\t\t\t\tbuild: [...stages.deployed],\n\t\t\t\tdeploy: stages.deployed.filter((stage) => !kept.includes(stage)),\n\t\t\t};\n\t\tcase 'release':\n\t\t\treturn { build: [], deploy: [...kept] };\n\t\tcase 'workflow_dispatch': {\n\t\t\tconst stage = input.stage?.trim();\n\t\t\tif (!stage) throw new DispatchNamesNoStage(stages.deployed);\n\t\t\tif (!stages.deployed.includes(stage)) {\n\t\t\t\tthrow new UndeclaredStage(stage, stages.deployed);\n\t\t\t}\n\t\t\treturn { build: [], deploy: [stage] };\n\t\t}\n\t\tdefault:\n\t\t\treturn { build: [], deploy: [] };\n\t}\n}\n\n/**\n * A manual run with no stage. Refused rather than read as \"nothing to do\", so\n * a run started with the field left empty fails where it can be seen.\n */\nexport class DispatchNamesNoStage extends Error {\n\tconstructor(readonly deployed: readonly string[]) {\n\t\tsuper(\n\t\t\t`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(', ') || 'nothing yet — gkm.config.ts deploys to no stage'}.`,\n\t\t);\n\t\tthis.name = 'DispatchNamesNoStage';\n\t}\n}\n","/**\n * `gkm stages` — the workspace's stages, as gkm.config.ts declares them.\n *\n * ```bash\n * gkm stages                    # a table\n * gkm stages --json             # {\"local\":\"dev\",\"deployed\":[\"prod\"],\"protected\":[\"prod\"]}\n * gkm stages --github-output    # a workflow run's build and deploy matrices\n * ```\n *\n * The config is read by the normal loader (and sandbox), so a workflow never\n * parses TypeScript to learn which stages exist. `--github-output` is what the\n * `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and\n * which of them this run builds and deploys, to `$GITHUB_OUTPUT`.\n */\n\nimport { appendFile } from 'node:fs/promises';\nimport { loadWorkspaceSettings } from '../config.js';\nimport type { NormalizedWorkspace, StagesConfig } from '../workspace/types.js';\nimport { planStages } from './plan.js';\n\nexport { DispatchNamesNoStage, type PlanInput, planStages } from './plan.js';\n\nexport interface StagesOptions {\n\t/** Print the stages as JSON. */\n\tjson?: boolean;\n\t/** Write the outputs a deploy workflow reads to `$GITHUB_OUTPUT`. */\n\tgithubOutput?: boolean;\n\t/** The event to plan for; defaults to `GITHUB_EVENT_NAME`. */\n\tevent?: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport interface StagesDeps {\n\tcwd?: string;\n\tenv?: NodeJS.ProcessEnv;\n\t/** Where lines go; stdout by default. */\n\tlog?: (line: string) => void;\n}\n\n/** The stages, as `gkm stages --json` prints them. */\nexport interface StagesJson {\n\tlocal: string;\n\tdeployed: string[];\n\tprotected: string[];\n}\n\nexport function stagesJson(stages: StagesConfig): StagesJson {\n\treturn {\n\t\tlocal: stages.local,\n\t\tdeployed: [...stages.deployed],\n\t\tprotected: [...(stages.protected ?? [])],\n\t};\n}\n\n/**\n * The region of the workspace's AWS secrets store — `ssm` or\n * `secrets-manager` — or `''` when its deployed stages keep their secrets\n * anywhere else. A job assumes the stage's AWS role only when this is set.\n */\nexport function awsSecretsRegion(workspace: NormalizedWorkspace): string {\n\tconst store = workspace.secrets?.store;\n\tif (typeof store !== 'object' || store === null) return '';\n\tif (store.provider === 'ssm' || store.provider === 'secrets-manager') {\n\t\treturn store.region;\n\t}\n\treturn '';\n}\n\n/**\n * Every output the stages action sets, each a string `fromJSON()` reads, for\n * one workflow run.\n */\nexport function githubOutputs(\n\tworkspace: NormalizedWorkspace,\n\tinput: { event: string; stage?: string },\n): Record<string, string> {\n\tconst stages = stagesJson(workspace.stages);\n\tconst plan = planStages(workspace.stages, input);\n\n\treturn {\n\t\tlocal: JSON.stringify(stages.local),\n\t\tdeployed: JSON.stringify(stages.deployed),\n\t\tprotected: JSON.stringify(stages.protected),\n\t\tbuild: JSON.stringify(plan.build),\n\t\tdeploy: JSON.stringify(plan.deploy),\n\t\t// A matrix over an empty list is an error on GitHub, so a job over one\n\t\t// is skipped on these instead.\n\t\t'has-build': String(plan.build.length > 0),\n\t\t'has-deploy': String(plan.deploy.length > 0),\n\t\t'aws-region': awsSecretsRegion(workspace),\n\t};\n}\n\n/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */\nexport function formatGithubOutputs(outputs: Record<string, string>): string {\n\treturn Object.entries(outputs)\n\t\t.map(([name, value]) => `${name}=${value}\\n`)\n\t\t.join('');\n}\n\n/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */\nfunction workflowCommandData(message: string): string {\n\treturn message\n\t\t.replaceAll('%', '%25')\n\t\t.replaceAll('\\r', '%0D')\n\t\t.replaceAll('\\n', '%0A');\n}\n\nfunction table(stages: StagesJson): string {\n\tconst rows: [string, string][] = [\n\t\t['STAGE', 'KIND'],\n\t\t[stages.local, 'local'],\n\t\t...stages.deployed.map((name): [string, string] => [\n\t\t\tname,\n\t\t\tstages.protected.includes(name) ? 'deployed, protected' : 'deployed',\n\t\t]),\n\t];\n\tconst width = Math.max(...rows.map(([name]) => name.length));\n\treturn rows\n\t\t.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`)\n\t\t.join('\\n');\n}\n\nexport async function stagesCommand(\n\toptions: StagesOptions,\n\tdeps: StagesDeps = {},\n): Promise<void> {\n\tconst env = deps.env ?? process.env;\n\tconst log = deps.log ?? ((line: string) => console.log(line));\n\n\tif (!options.githubOutput) {\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst stages = stagesJson(workspace.stages);\n\t\tlog(options.json ? JSON.stringify(stages) : table(stages));\n\t\treturn;\n\t}\n\n\ttry {\n\t\tconst file = env.GITHUB_OUTPUT;\n\t\tif (!file) throw new GithubOutputNotSet();\n\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst event = options.event || env.GITHUB_EVENT_NAME;\n\t\tif (!event) throw new GithubEventNotSet();\n\n\t\tconst outputs = githubOutputs(workspace, {\n\t\t\tevent,\n\t\t\t...(options.stage ? { stage: options.stage } : {}),\n\t\t});\n\t\tawait appendFile(file, formatGithubOutputs(outputs));\n\n\t\tlog(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);\n\t} catch (error) {\n\t\t// Annotated on the run, where whoever started it looks first.\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tlog(`::error title=gkm stages::${workflowCommandData(message)}`);\n\t\tthrow error;\n\t}\n}\n\n/** `--github-output` outside a GitHub Actions step, which sets the file. */\nexport class GithubOutputNotSet extends Error {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.',\n\t\t);\n\t\tthis.name = 'GithubOutputNotSet';\n\t}\n}\n\n/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */\nexport class GithubEventNotSet extends Error {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.',\n\t\t);\n\t\tthis.name = 'GithubEventNotSet';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,WAAW,QAAsB,OAA6B;CAC7E,MAAM,OAAO,OAAO,aAAa,CAAC;CAElC,QAAQ,MAAM,OAAd;EACC,KAAK,QACJ,OAAO;GACN,OAAO,CAAC,GAAG,OAAO,QAAQ;GAC1B,QAAQ,OAAO,SAAS,QAAQ,UAAU,CAAC,KAAK,SAAS,KAAK,CAAC;EAChE;EACD,KAAK,WACJ,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC,GAAG,IAAI;EAAE;EACvC,KAAK,qBAAqB;GACzB,MAAM,QAAQ,MAAM,OAAO,KAAK;GAChC,IAAI,CAAC,OAAO,MAAM,IAAI,qBAAqB,OAAO,QAAQ;GAC1D,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,GAClC,MAAM,IAAI,gBAAgB,OAAO,OAAO,QAAQ;GAEjD,OAAO;IAAE,OAAO,CAAC;IAAG,QAAQ,CAAC,KAAK;GAAE;EACrC;EACA,SACC,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC;EAAE;CACjC;AACD;;;;;AAMA,IAAa,uBAAb,cAA0C,MAAM;CAC1B;CAArB,YAAY,UAAsC;EACjD,MACC,wGAAwG,SAAS,KAAK,IAAI,KAAK,kDAAkD,EAClL;EAHoB,KAAA,WAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;;;;;AC1BA,SAAgB,WAAW,QAAkC;CAC5D,OAAO;EACN,OAAO,OAAO;EACd,UAAU,CAAC,GAAG,OAAO,QAAQ;EAC7B,WAAW,CAAC,GAAI,OAAO,aAAa,CAAC,CAAE;CACxC;AACD;;;;;;AAOA,SAAgB,iBAAiB,WAAwC;CACxE,MAAM,QAAQ,UAAU,SAAS;CACjC,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,IAAI,MAAM,aAAa,SAAS,MAAM,aAAa,mBAClD,OAAO,MAAM;CAEd,OAAO;AACR;;;;;AAMA,SAAgB,cACf,WACA,OACyB;CACzB,MAAM,SAAS,WAAW,UAAU,MAAM;CAC1C,MAAM,OAAO,WAAW,UAAU,QAAQ,KAAK;CAE/C,OAAO;EACN,OAAO,KAAK,UAAU,OAAO,KAAK;EAClC,UAAU,KAAK,UAAU,OAAO,QAAQ;EACxC,WAAW,KAAK,UAAU,OAAO,SAAS;EAC1C,OAAO,KAAK,UAAU,KAAK,KAAK;EAChC,QAAQ,KAAK,UAAU,KAAK,MAAM;EAGlC,aAAa,OAAO,KAAK,MAAM,SAAS,CAAC;EACzC,cAAc,OAAO,KAAK,OAAO,SAAS,CAAC;EAC3C,cAAc,iBAAiB,SAAS;CACzC;AACD;;AAGA,SAAgB,oBAAoB,SAAyC;CAC5E,OAAO,OAAO,QAAQ,OAAO,CAAC,CAC5B,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,CAAC,CAC5C,KAAK,EAAE;AACV;;AAGA,SAAS,oBAAoB,SAAyB;CACrD,OAAO,QACL,WAAW,KAAK,KAAK,CAAC,CACtB,WAAW,MAAM,KAAK,CAAC,CACvB,WAAW,MAAM,KAAK;AACzB;AAEA,SAAS,MAAM,QAA4B;CAC1C,MAAM,OAA2B;EAChC,CAAC,SAAS,MAAM;EAChB,CAAC,OAAO,OAAO,OAAO;EACtB,GAAG,OAAO,SAAS,KAAK,SAA2B,CAClD,MACA,OAAO,UAAU,SAAS,IAAI,IAAI,wBAAwB,UAC3D,CAAC;CACF;CACA,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC;CAC3D,OAAO,KACL,KAAK,CAAC,MAAM,UAAU,GAAG,KAAK,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,CACvD,KAAK,IAAI;AACZ;AAEA,eAAsB,cACrB,SACA,OAAmB,CAAC,GACJ;CAChB,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,KAAK,SAAS,SAAiB,QAAQ,IAAI,IAAI;CAE3D,IAAI,CAAC,QAAQ,cAAc;EAE1B,MAAM,SAAS,YAAW,MADF,sBAAsB,KAAK,GAAG,EAAA,CAClB,MAAM;EAC1C,IAAI,QAAQ,OAAO,KAAK,UAAU,MAAM,IAAI,MAAM,MAAM,CAAC;EACzD;CACD;CAEA,IAAI;EACH,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB;EAExC,MAAM,YAAY,MAAM,sBAAsB,KAAK,GAAG;EACtD,MAAM,QAAQ,QAAQ,SAAS,IAAI;EACnC,IAAI,CAAC,OAAO,MAAM,IAAI,kBAAkB;EAExC,MAAM,UAAU,cAAc,WAAW;GACxC;GACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjD,CAAC;EACD,MAAM,WAAW,MAAM,oBAAoB,OAAO,CAAC;EAEnD,IAAI,GAAG,MAAM,UAAU,QAAQ,MAAM,WAAW,QAAQ,QAAQ;CACjE,SAAS,OAAO;EAGf,IAAI,6BAA6B,oBADjB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACT,GAAG;EAC/D,MAAM;CACP;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC7C,cAAc;EACb,MACC,oKACD;EACA,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAC5C,cAAc;EACb,MACC,uLACD;EACA,KAAK,OAAO;CACb;AACD"}

package/dist/target/public.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_define = require("../define-DzRz8FgH.cjs");
-const require_resolve = require("../resolve-ApSUK_HB.cjs");
+const require_resolve = require("../resolve-T2I-5FcT.cjs");
 const require_provider = require("../provider-C9_-45d5.cjs");
 exports.DeployTargetNotYetSupported = require_define.DeployTargetNotYetSupported;
 exports.InvalidTargetOptions = require_resolve.InvalidTargetOptions;

package/dist/target/public.d.cts

@@ -1,5 +1,5 @@
-import { $ as TargetOptionsSchema, G as DeploySecrets, H as DeployFailure, J as DeployTargetEntry, K as DeployTarget, Ot as StageSecrets, Q as TargetOptionsIssue, Tt as StateStore, U as DeployPhaseContext, V as AnyDeployTarget, W as DeployRuntime, X as TargetEvent, Y as DeployTargetLogger, Z as TargetOptions, _t as CredentialKinds, at as ResourceVia, et as DeployEvent, gt as CredentialKind, ht as Credential, it as ResourceChange, kt as DeployIdentity, mt as AwsCredential, nt as DeployEventType, ot as AppDeployResult, q as DeployTargetCapabilities, rt as DeployPhase, st as DeployResult, tt as DeployEventError, vt as CredentialProvider, yt as CredentialRequest } from "../types-DZtj9jeI.cjs";
-import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-D6A-C6zh.cjs";
+import { $ as TargetOptions, At as StageSecrets, Dt as StateStore, G as DeployPhaseContext, J as DeployTarget, K as DeployRuntime, Q as TargetEvent, U as AnyDeployTarget, W as DeployFailure, X as DeployTargetEntry, Y as DeployTargetCapabilities, Z as DeployTargetLogger, _t as Credential, at as DeployPhase, bt as CredentialProvider, ct as AppDeployResult, et as TargetOptionsIssue, gt as AwsCredential, it as DeployEventType, jt as DeployIdentity, lt as DeployResult, nt as DeployEvent, ot as ResourceChange, q as DeploySecrets, rt as DeployEventError, st as ResourceVia, tt as TargetOptionsSchema, vt as CredentialKind, xt as CredentialRequest, yt as CredentialKinds } from "../types-DiZj6hqp.cjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-DMLgL26v.cjs";
 //#region src/target/define.d.ts
 /**
  * A deploy target, typed from what it is written with: the options from its

package/dist/target/public.d.mts

@@ -1,5 +1,5 @@
-import { $ as TargetOptionsSchema, G as DeploySecrets, H as DeployFailure, J as DeployTargetEntry, K as DeployTarget, Ot as StageSecrets, Q as TargetOptionsIssue, Tt as StateStore, U as DeployPhaseContext, V as AnyDeployTarget, W as DeployRuntime, X as TargetEvent, Y as DeployTargetLogger, Z as TargetOptions, _t as CredentialKinds, at as ResourceVia, et as DeployEvent, gt as CredentialKind, ht as Credential, it as ResourceChange, kt as DeployIdentity, mt as AwsCredential, nt as DeployEventType, ot as AppDeployResult, q as DeployTargetCapabilities, rt as DeployPhase, st as DeployResult, tt as DeployEventError, vt as CredentialProvider, yt as CredentialRequest } from "../types-BzCavjGt.mjs";
-import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-ekxfPNM-.mjs";
+import { $ as TargetOptions, At as StageSecrets, Dt as StateStore, G as DeployPhaseContext, J as DeployTarget, K as DeployRuntime, Q as TargetEvent, U as AnyDeployTarget, W as DeployFailure, X as DeployTargetEntry, Y as DeployTargetCapabilities, Z as DeployTargetLogger, _t as Credential, at as DeployPhase, bt as CredentialProvider, ct as AppDeployResult, et as TargetOptionsIssue, gt as AwsCredential, it as DeployEventType, jt as DeployIdentity, lt as DeployResult, nt as DeployEvent, ot as ResourceChange, q as DeploySecrets, rt as DeployEventError, st as ResourceVia, tt as TargetOptionsSchema, vt as CredentialKind, xt as CredentialRequest, yt as CredentialKinds } from "../types-BZn-8ssD.mjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-CNu2C2hB.mjs";
 //#region src/target/define.d.ts
 /**
  * A deploy target, typed from what it is written with: the options from its

package/dist/target/public.mjs

@@ -1,4 +1,4 @@
 import { a as UnknownDeployTarget, i as DeployTargetNotYetSupported, n as isDeployTarget, t as defineTarget } from "../define-DR8xGYfL.mjs";
-import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-DY9TaVeV.mjs";
+import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-r7PAs6ng.mjs";
 import { t as ProviderRemoved } from "../provider-q4lsYzYG.mjs";
 export { DeployTargetNotYetSupported, InvalidTargetOptions, ProviderRemoved, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, defineTarget, isDeployTarget };

package/dist/{types-DZtj9jeI.d.cts → types-BZn-8ssD.d.mts}

@@ -1,5 +1,4 @@
 import { ConstructManifest } from "@geekmidas/manifest";
-//#endregion
 //#region src/deploy/identity.d.ts
 /**
  * Who a deploy is, on a target it shares with other workspaces.
@@ -911,6 +910,13 @@ interface DeployTargetCapabilities {
    * stage with `UndeclaredStage`.
    */
   localStage?: boolean;
+  /**
+   * Whether it runs telemetry's self-hosted provider — OpenObserve beside
+   * the apps — for a stage whose `deploy.telemetry` asks for it, or names
+   * nothing. Absent, a stage that uses a `Telemetry` construct names a
+   * provider of its own (`otlp`) or opts out with `false`.
+   */
+  selfHostedTelemetry?: boolean;
 }
 /** A failed validation of a target's options, issue by issue. */
 interface TargetOptionsIssue {
@@ -5831,13 +5837,6 @@ declare const WorkspaceConfigSchema: ZodObject<{
       }, $strip>>;
     }, $strip>>;
     compose: ZodOptional<ZodObject<{
-      logs: ZodOptional<ZodUnion<readonly [ZodBoolean, ZodObject<{
-        port: ZodOptional<ZodNumber>;
-        retentionDays: ZodOptional<ZodNumber>;
-        public: ZodOptional<ZodObject<{
-          allow: ZodArray<ZodString>;
-        }, $strip>>;
-      }, $strip>]>>;
       proxy: ZodOptional<ZodUnion<readonly [ZodEnum<{
         caddy: "caddy";
         traefik: "traefik";
@@ -5849,7 +5848,21 @@ declare const WorkspaceConfigSchema: ZodObject<{
         certFile: ZodString;
         keyFile: ZodString;
       }, $strict>>>;
-    }, $strip>>;
+    }, $strict>>;
+    telemetry: ZodOptional<ZodRecord<ZodString, ZodUnion<readonly [ZodLiteral<false>, ZodLiteral<"self-hosted">, ZodObject<{
+      provider: ZodLiteral<"self-hosted">;
+      port: ZodOptional<ZodNumber>;
+      retentionDays: ZodOptional<ZodNumber>;
+      public: ZodOptional<ZodObject<{
+        allow: ZodArray<ZodString>;
+      }, $strip>>;
+      sampleRate: ZodOptional<ZodNumber>;
+    }, $strict>, ZodObject<{
+      provider: ZodLiteral<"otlp">;
+      endpoint: ZodString;
+      headers: ZodOptional<ZodRecord<ZodString, ZodString>>;
+      sampleRate: ZodOptional<ZodNumber>;
+    }, $strict>]>>>;
     dns: ZodOptional<ZodUnion<readonly [ZodRecord<ZodString, ZodUnion<readonly [ZodDiscriminatedUnion<[ZodObject<{
       provider: ZodLiteral<"hostinger">;
       ttl: ZodOptional<ZodNumber>;
@@ -6313,17 +6326,10 @@ interface DokployVerifyConfig {
  *
  * @example
  * ```ts
- * deploy: { compose: { logs: true } }
- * deploy: { compose: { logs: { port: 5081, retentionDays: 14 } } }
- * deploy: { compose: { logs: { public: { allow: ['203.0.113.7', '10.0.0.0/8'] } } } }
+ * deploy: { compose: { proxy: 'traefik' } }
  * ```
  */
 interface ComposeWorkspaceConfig {
-  /**
-   * Run OpenObserve in the stack and send every backend's logs and traces
-   * to it. `true` for the defaults.
-   */
-  logs?: boolean | ComposeLogsConfig;
   /**
    * What serves a deployed stage's stack: `'caddy'` (the default) — the
    * stack's own Caddy on 80/443 — or `'traefik'`, the server's shared
@@ -6355,8 +6361,42 @@ interface ComposeTlsConfig {
   certFile: string;
   keyFile: string;
 }
-/** How the stack's OpenObserve is run and reached — `deploy.compose.logs`. */
-interface ComposeLogsConfig {
+/**
+ * Where one stage's telemetry goes, and how much of it — `deploy.telemetry`,
+ * by stage.
+ *
+ * What is emitted is the application's (the `Telemetry` construct); where it
+ * goes is this. A server target runs the self-hosted provider when a stage
+ * names nothing; AWS has none, so a deployed AWS stage that uses telemetry
+ * names a provider. `false` sends nothing. The local stage ignores this: `gkm
+ * dev` and `gkm compose` on it always run OpenObserve, at 100%.
+ *
+ * @example
+ * ```ts
+ * telemetry: {
+ *   staging: 'self-hosted',
+ *   production: { provider: 'self-hosted', retentionDays: 14, sampleRate: 0.1 },
+ *   preview: { provider: 'otlp', endpoint: 'https://otlp.example.com', sampleRate: 0.5 },
+ *   scratch: false,
+ * }
+ * ```
+ */
+type StageTelemetryConfig = 'self-hosted' | SelfHostedTelemetryConfig | OtlpTelemetryConfig | false;
+/** Shared by every provider. */
+interface TelemetryProviderConfig {
+  /**
+   * The fraction of traces kept, decided where a trace starts and followed
+   * by every service it reaches (`parentbased_traceidratio`). Logs are not
+   * sampled. 0 to 1; default 1.
+   */
+  sampleRate?: number;
+}
+/**
+ * The target runs the collector and its UI: OpenObserve, in a compose stack,
+ * reached through an SSH tunnel by default.
+ */
+interface SelfHostedTelemetryConfig extends TelemetryProviderConfig {
+  provider: 'self-hosted';
   /**
    * The port it is published on, on 127.0.0.1 only — reached from another
    * machine through an SSH tunnel. Default 5080.
@@ -6368,7 +6408,7 @@ interface ComposeLogsConfig {
    */
   retentionDays?: number;
   /**
-   * Serve it on `logs.<stage domain>` through the stack's Caddy, to these
+   * Serve it on `logs.<stage domain>` through the stack's proxy, to these
    * addresses only (IPs or CIDRs), instead of on a loopback port. Every
    * other address is answered 403.
    */
@@ -6376,6 +6416,14 @@ interface ComposeLogsConfig {
     allow: string[];
   };
 }
+/** Any OTLP/HTTP endpoint — a collector, a vendor's ingest. */
+interface OtlpTelemetryConfig extends TelemetryProviderConfig {
+  provider: 'otlp';
+  /** The OTLP/HTTP base URL; `/v1/traces` and `/v1/logs` are added to it. */
+  endpoint: string;
+  /** Headers sent with every export — `{ 'x-team': 'shop' }`. */
+  headers?: Record<string, string>;
+}
 /**
  * Deployment configuration for the workspace.
  *
@@ -6451,6 +6499,11 @@ interface DeployConfig {
   dokploy?: DokployWorkspaceConfig;
   /** What the `compose` target runs beside the apps — see {@link ComposeWorkspaceConfig}. */
   compose?: ComposeWorkspaceConfig;
+  /**
+   * Where each deployed stage's telemetry goes — see
+   * {@link StageTelemetryConfig}.
+   */
+  telemetry?: Record<string, StageTelemetryConfig>;
   /** DNS configuration for automatic record creation */
   dns?: DnsConfig;
   /** Backup destination configuration for database services */
@@ -7393,5 +7446,5 @@ interface GkmConfig {
   deploy?: DeployConfig;
 }
 //#endregion
-export { TargetOptionsSchema as $, FrontendFramework as A, deployIdentity as At, validateWorkspaceConfig as B, SecretsConfig as C, storedCredentials as Ct, isWorkspaceConfig as D, ReleasedImage as Dt, WorkspaceInput as E, StateVersionConflict as Et, formatValidationErrors as F, DeploySecrets as G, DeployFailure as H, getDeployTargetError as I, DeployTargetEntry as J, DeployTarget as K, isDeployTargetSupported as L, PHASE_2_DEPLOY_TARGETS as M, SUPPORTED_DEPLOY_TARGETS as N, BackendFramework as O, StageSecrets as Ot, WorkspaceConfigSchema as P, TargetOptionsIssue as Q, isPhase2DeployTarget as R, NormalizedWorkspace as S, chainCredentials as St, WorkspaceConfig as T, StateStore as Tt, DeployPhaseContext as U, AnyDeployTarget as V, DeployRuntime as W, TargetEvent as X, DeployTargetLogger as Y, TargetOptions as Z, InferAppNames as _, CredentialKinds as _t, Routes as a, ResourceVia as at, ModelsConfig as b, MissingCredential as bt, AppInput as c, DEV_SERVICES as ct, ComposeWorkspaceConfig as d, ExternalServicesNotConfigured as dt, DeployEvent as et, ConstrainedApps as f, MissingServiceKey as ft, DokployWorkspaceConfig as g, CredentialKind as gt, DevConfig as h, Credential as ht, OpenApiConfig as i, ResourceChange as it, MobileFramework as j, Framework as k, DeployIdentity as kt, AppsRecord as l, DevService as lt, DeployTargetName as m, AwsCredential as mt, EmailBackend as n, DeployEventType as nt, AppConfig as o, AppDeployResult as ot, DeployConfig as p, UnknownDevService as pt, DeployTargetCapabilities as q, GkmConfig as r, DeployPhase as rt, AppConfigInput as s, DeployResult as st, CacheBackend as t, DeployEventError as tt, ComposeLogsConfig as u, DevServicesNeedServerTarget as ut, InferredWorkspaceConfig as v, CredentialProvider as vt, SharedConfig as w, StateLocked as wt, NormalizedAppConfig as x, StoredCredentialsOptions as xt, LoadedConfig as y, CredentialRequest as yt, safeValidateWorkspaceConfig as z };
-//# sourceMappingURL=types-DZtj9jeI.d.cts.map
+export { TargetOptions as $, BackendFramework as A, StageSecrets as At, isPhase2DeployTarget as B, SecretsConfig as C, StoredCredentialsOptions as Ct, WorkspaceConfig as D, StateStore as Dt, StageTelemetryConfig as E, StateLocked as Et, SUPPORTED_DEPLOY_TARGETS as F, DeployPhaseContext as G, validateWorkspaceConfig as H, WorkspaceConfigSchema as I, DeployTarget as J, DeployRuntime as K, formatValidationErrors as L, FrontendFramework as M, deployIdentity as Mt, MobileFramework as N, WorkspaceInput as O, StateVersionConflict as Ot, PHASE_2_DEPLOY_TARGETS as P, TargetEvent as Q, getDeployTargetError as R, OtlpTelemetryConfig as S, MissingCredential as St, SharedConfig as T, storedCredentials as Tt, AnyDeployTarget as U, safeValidateWorkspaceConfig as V, DeployFailure as W, DeployTargetEntry as X, DeployTargetCapabilities as Y, DeployTargetLogger as Z, InferredWorkspaceConfig as _, Credential as _t, Routes as a, DeployPhase as at, NormalizedAppConfig as b, CredentialProvider as bt, AppInput as c, AppDeployResult as ct, ConstrainedApps as d, DevService as dt, TargetOptionsIssue as et, DeployConfig as f, DevServicesNeedServerTarget as ft, InferAppNames as g, AwsCredential as gt, DokployWorkspaceConfig as h, UnknownDevService as ht, OpenApiConfig as i, DeployEventType as it, Framework as j, DeployIdentity as jt, isWorkspaceConfig as k, ReleasedImage as kt, AppsRecord as l, DeployResult as lt, DevConfig as m, MissingServiceKey as mt, EmailBackend as n, DeployEvent as nt, AppConfig as o, ResourceChange as ot, DeployTargetName as p, ExternalServicesNotConfigured as pt, DeploySecrets as q, GkmConfig as r, DeployEventError as rt, AppConfigInput as s, ResourceVia as st, CacheBackend as t, TargetOptionsSchema as tt, ComposeWorkspaceConfig as u, DEV_SERVICES as ut, LoadedConfig as v, CredentialKind as vt, SelfHostedTelemetryConfig as w, chainCredentials as wt, NormalizedWorkspace as x, CredentialRequest as xt, ModelsConfig as y, CredentialKinds as yt, isDeployTargetSupported as z };
+//# sourceMappingURL=types-BZn-8ssD.d.mts.map