@pattform/engine 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,35 @@
-# Temporary Holding Version
+# Pattform Engine
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`pattform` turns an app repo's `deploy/*.yaml` specs into Pulumi stacks using Pattform capabilities (ADR-001, "Design: Capabilities and Engine"). It holds no infrastructure logic of its own: each spec names a capability and pins its version, and the engine installs that version and runs it.
+
+```bash
+pattform validate   # schemas + secret keys; no cloud credentials needed
+pattform preview    # validate, then pulumi preview per spec
+pattform up         # validate, then pulumi up per spec (Client specs first)
+pattform drift      # refresh + expect no changes; non-zero exit on drift
+```
+
+Options: `--dir <repo root>`, `--kind <Kind>`, `--exclude-kind <Kind>`, and `--capabilities-dir <path>` to install capabilities from a local, built `pattform-capabilities` checkout instead of npm.
+
+## What one run does, per spec
+
+1. **Load** every YAML document in `deploy/` except `*.sops.yaml`, and check the envelope: `apiVersion: platform.pattform.io/<version>`, PascalCase `kind`, DNS-1123 `metadata.name`, an exact `platform.pattform.io/capability-version`, no committed `status`.
+2. **Install** `@pattform/capability-<kind>@<version>` into `.pattform/work/<kind>.<namespace>.<name>/` with a generated `Pulumi.yaml` and a one-line program.
+3. **Validate** the spec against the capability's schema for its `apiVersion`, rejecting unknown fields, and check every secret the capability will read exists in the referenced SOPS file (key names are plaintext, so no KMS is needed).
+4. **Run** `preview`, `up` or `drift` through the Pulumi Automation API against `s3://pattform-pulumi-state` with the `awskms://alias/pattform-pulumi` secrets provider. The spec, metadata and repo go in as stack config; only the referenced secrets go in, as secret config.
+5. **Report** `status.conditions` (`Ready`, `Synced`) and outputs to `.pattform/status.json` and, in GitHub Actions, the job summary.
+
+## Stack names
+
+- `organization/<kind>/<namespace>.<name>` for namespaced kinds, e.g. `organization/landing-site/tazland.tazland-landing`
+- `organization/client/<name>` for clients
+- `platform.pattform.io/stack: <project>/<stack>` adopts an existing stack instead
+
+## Development
+
+```bash
+npm install
+npm test   # unit tests + an end-to-end validate of test/fixtures/tazland
+```
+
+The end-to-end test installs capabilities from `../pattform-capabilities`, which must be built. The fixture's `secrets.sops.yaml` holds dummy values encrypted with the real KMS key.

package/dist/src/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/src/cli.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("node:path"));
+const engine_1 = require("./engine");
+const spec_1 = require("./spec");
+const USAGE = `Usage: pattform <validate|preview|up|drift> [options]
+
+  validate   check every spec in deploy/ against its capability schema and
+             check referenced secrets exist (no cloud credentials needed)
+  preview    validate, then pulumi preview each spec
+  up         validate, then pulumi up each spec (Client specs first)
+  drift      pulumi preview --refresh --expect-no-changes each spec;
+             exits non-zero if anything drifted
+
+Options:
+  --dir <path>               repo root (default: current directory)
+  --kind <Kind>              only specs of this kind (repeatable)
+  --exclude-kind <Kind>      skip specs of this kind (repeatable)
+  --capabilities-dir <path>  install capabilities from a local, built
+                             pattform-capabilities checkout instead of npm
+`;
+function parseArgs(argv) {
+    const [command, ...rest] = argv;
+    const options = { root: process.cwd(), kinds: [], excludeKinds: [], capabilitiesDir: undefined };
+    for (let i = 0; i < rest.length; i++) {
+        const flag = rest[i];
+        const value = rest[i + 1];
+        if (value === undefined)
+            throw new spec_1.SpecError(`${flag} needs a value`);
+        switch (flag) {
+            case "--dir":
+                options.root = path.resolve(value);
+                break;
+            case "--kind":
+                options.kinds.push(value);
+                break;
+            case "--exclude-kind":
+                options.excludeKinds.push(value);
+                break;
+            case "--capabilities-dir":
+                options.capabilitiesDir = path.resolve(value);
+                break;
+            default: throw new spec_1.SpecError(`unknown option ${flag}`);
+        }
+        i++;
+    }
+    return { command, options };
+}
+async function main() {
+    const { command, options } = parseArgs(process.argv.slice(2));
+    if (!["validate", "preview", "up", "drift"].includes(command)) {
+        process.stdout.write(USAGE);
+        process.exit(command ? 2 : 0);
+    }
+    const reports = await (0, engine_1.execute)(command, {
+        ...options,
+        deployDir: path.join(options.root, "deploy"),
+    });
+    (0, engine_1.writeReports)(options.root, command, reports);
+    const failed = reports.filter(r => r.status.conditions.some(c => c.status === "False"));
+    for (const report of failed) {
+        const condition = report.status.conditions.find(c => c.status === "False");
+        console.error(`FAILED ${report.id}: ${condition.reason}: ${condition.message}`);
+    }
+    if (failed.length)
+        process.exit(1);
+}
+main().catch(error => {
+    console.error(error instanceof spec_1.SpecError ? `invalid: ${error.message}` : error);
+    process.exit(error instanceof spec_1.SpecError ? 2 : 1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/src/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,gDAAkC;AAClC,qCAA0D;AAC1D,iCAAmC;AAEnC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;CAeb,CAAC;AAEF,SAAS,SAAS,CAAC,IAAc;IAC7B,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAc,EAAE,YAAY,EAAE,EAAc,EAAE,eAAe,EAAE,SAA+B,EAAE,CAAC;IAC/I,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAS,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;QACtE,QAAQ,IAAI,EAAE,CAAC;YACX,KAAK,OAAO;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAAC,MAAM;YACxD,KAAK,QAAQ;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,MAAM;YAChD,KAAK,gBAAgB;gBAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,MAAM;YAC/D,KAAK,oBAAoB;gBAAE,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAAC,MAAM;YAChF,OAAO,CAAC,CAAC,MAAM,IAAI,gBAAS,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,CAAC,EAAE,CAAC;IACR,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,IAAI;IACf,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAA,gBAAO,EAAC,OAAkB,EAAE;QAC9C,GAAG,OAAO;QACV,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;KAC/C,CAAC,CAAC;IACH,IAAA,qBAAY,EAAC,OAAO,CAAC,IAAI,EAAE,OAAkB,EAAE,OAAO,CAAC,CAAC;IAExD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC;IACxF,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAE,CAAC;QAC5E,OAAO,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,gBAAS,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAChF,OAAO,CAAC,IAAI,CAAC,KAAK,YAAY,gBAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC"}

package/dist/src/engine.d.ts

@@ -0,0 +1,50 @@
+import { SpecDocument } from "./spec";
+import { SecretRef } from "./secrets";
+import { LoadedCapability, WorkspaceOptions } from "./workspace";
+import { Operation } from "./run";
+export type Command = "validate" | Operation;
+export interface EngineOptions extends WorkspaceOptions {
+    deployDir: string;
+    kinds?: string[];
+    excludeKinds?: string[];
+    awsRegion?: string;
+    log?: (line: string) => void;
+}
+interface Planned {
+    spec: SpecDocument;
+    capability: LoadedCapability;
+    workDir: string;
+    project: string;
+    stack: string;
+    refs: SecretRef[];
+}
+export interface StackReport {
+    id: string;
+    stack: string;
+    status: {
+        conditions: {
+            type: string;
+            status: "True" | "False";
+            reason: string;
+            message: string;
+            lastTransitionTime: string;
+        }[];
+        outputs?: {
+            [key: string]: unknown;
+        };
+    };
+    changes?: {
+        [op: string]: number;
+    };
+}
+export interface RepoInfo {
+    owner: string;
+    name: string;
+    url: string;
+    branch: string;
+}
+export declare function detectRepo(root: string): RepoInfo;
+export declare function plan(options: EngineOptions): Planned[];
+export declare function execute(command: Command, options: EngineOptions): Promise<StackReport[]>;
+export declare function writeReports(root: string, command: Command, reports: StackReport[]): void;
+export {};

package/dist/src/engine.js

@@ -0,0 +1,195 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectRepo = detectRepo;
+exports.plan = plan;
+exports.execute = execute;
+exports.writeReports = writeReports;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const spec_1 = require("./spec");
+const schema_1 = require("./schema");
+const secrets_1 = require("./secrets");
+const workspace_1 = require("./workspace");
+const run_1 = require("./run");
+// GitHub Actions sets GITHUB_REPOSITORY; locally, read the origin remote.
+function detectRepo(root) {
+    let slug = process.env.GITHUB_REPOSITORY;
+    if (!slug) {
+        const remote = (0, node_child_process_1.execFileSync)("git", ["-C", root, "remote", "get-url", "origin"], { encoding: "utf8" }).trim();
+        const match = /github\.com[:/]([^/]+)\/(.+?)(\.git)?$/.exec(remote);
+        if (!match)
+            throw new Error(`cannot read the GitHub repo from origin remote ${remote}`);
+        slug = `${match[1]}/${match[2]}`;
+    }
+    const [owner, name] = slug.split("/");
+    const branch = process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME || "main";
+    return { owner, name, url: `https://github.com/${owner}/${name}`, branch };
+}
+function selected(spec, options) {
+    if (options.kinds?.length && !options.kinds.includes(spec.kind))
+        return false;
+    if (options.excludeKinds?.includes(spec.kind))
+        return false;
+    return true;
+}
+// Load, install and validate every selected spec. Needs npm but no cloud
+// credentials, so `validate` runs safely on any PR.
+function plan(options) {
+    const log = options.log ?? console.log;
+    const specs = (0, spec_1.loadSpecs)(options.deployDir).filter(spec => selected(spec, options));
+    const planned = [];
+    for (const spec of specs) {
+        const owner = `${spec.file} ${(0, spec_1.specId)(spec)}`;
+        const version = (0, spec_1.capabilityVersion)(spec);
+        const dirName = (0, spec_1.specId)(spec).replace(/\//g, ".");
+        const workDir = (0, workspace_1.prepareWorkspace)(options, dirName, spec.kind, version);
+        const capability = (0, workspace_1.loadCapability)(workDir, spec.kind);
+        if (capability.scope === "Namespaced" && !spec.metadata.namespace) {
+            throw new spec_1.SpecError(`${owner}: ${spec.kind} is namespaced, so metadata.namespace (the client) is required`);
+        }
+        if (capability.scope === "Cluster" && spec.metadata.namespace) {
+            throw new spec_1.SpecError(`${owner}: ${spec.kind} is cluster-scoped, so it takes no metadata.namespace`);
+        }
+        const { project, stack } = (0, spec_1.stackName)(spec, capability.scope);
+        (0, workspace_1.writeProject)(workDir, project, spec.kind, version);
+        const schema = capability.schemas[spec.apiVersion];
+        if (!schema) {
+            throw new spec_1.SpecError(`${owner}: ${spec.kind}@${version} has no schema for ${spec.apiVersion} (has ${Object.keys(capability.schemas).join(", ")})`);
+        }
+        (0, schema_1.validateSpec)(schema, spec.spec, owner);
+        const refs = capability.secretRefs ? capability.secretRefs(spec.spec) : (0, secrets_1.collectExplicitRefs)(spec.spec);
+        (0, secrets_1.checkRefs)(options.deployDir, refs, owner);
+        log(`ok  ${(0, spec_1.specId)(spec)}  ${spec.kind}@${version}  -> organization/${project}/${stack}`);
+        planned.push({ spec, capability, workDir, project, stack, refs });
+    }
+    // Cluster-scoped kinds (Client) first: namespaced specs read the deploy
+    // identities they publish.
+    return planned.sort((a, b) => (a.capability.scope === "Cluster" ? 0 : 1) - (b.capability.scope === "Cluster" ? 0 : 1));
+}
+function conditions(ok, operation, result, error) {
+    const now = new Date().toISOString();
+    if (!ok) {
+        return [
+            { type: "Synced", status: "False", reason: "RunFailed", message: String(error).slice(0, 500), lastTransitionTime: now },
+            { type: "Ready", status: "False", reason: "RunFailed", message: `${operation} failed`, lastTransitionTime: now },
+        ];
+    }
+    if (operation === "drift") {
+        return [{
+                type: "Synced", status: result?.drifted ? "False" : "True",
+                reason: result?.drifted ? "DriftDetected" : "InSync",
+                message: result?.drifted ? "live resources differ from the spec" : "no drift", lastTransitionTime: now,
+            }];
+    }
+    if (operation === "preview") {
+        return [{ type: "Synced", status: "True", reason: "Previewed", message: JSON.stringify(result?.changes ?? {}), lastTransitionTime: now }];
+    }
+    return [
+        { type: "Synced", status: "True", reason: "Applied", message: JSON.stringify(result?.changes ?? {}), lastTransitionTime: now },
+        { type: "Ready", status: "True", reason: "Deployed", message: "stack is up to date", lastTransitionTime: now },
+    ];
+}
+async function execute(command, options) {
+    const log = options.log ?? console.log;
+    const planned = plan(options);
+    if (command === "validate") {
+        return planned.map(p => ({
+            id: (0, spec_1.specId)(p.spec),
+            stack: `organization/${p.project}/${p.stack}`,
+            status: { conditions: [] },
+        }));
+    }
+    const repo = detectRepo(options.root);
+    const secrets = new secrets_1.SecretStore(options.deployDir);
+    const reports = [];
+    for (const p of planned) {
+        const id = (0, spec_1.specId)(p.spec);
+        log(`\n=== ${command} ${id} (organization/${p.project}/${p.stack}) ===`);
+        let result;
+        let error;
+        try {
+            result = await (0, run_1.runStack)(command, {
+                workDir: p.workDir,
+                project: p.project,
+                stack: p.stack,
+                config: {
+                    "aws:region": options.awsRegion ?? "ap-southeast-2",
+                    "pattform:apiVersion": p.spec.apiVersion,
+                    "pattform:metadata": p.spec.metadata,
+                    "pattform:spec": p.spec.spec,
+                    "pattform:repo": repo,
+                },
+                secretConfig: { "pattform:secrets": secrets.resolve(p.refs) },
+                onOutput: line => process.stdout.write(line),
+            });
+        }
+        catch (e) {
+            error = e;
+        }
+        reports.push({
+            id,
+            stack: `organization/${p.project}/${p.stack}`,
+            status: { conditions: conditions(!error, command, result, error), outputs: result?.outputs },
+            changes: result?.changes,
+        });
+        // Stop at the first failed up: later specs may depend on this one.
+        if (error && command === "up")
+            break;
+    }
+    return reports;
+}
+function writeReports(root, command, reports) {
+    const dir = path.join(root, ".pattform");
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, "status.json"), JSON.stringify({ command, reports }, null, 2));
+    const summary = process.env.GITHUB_STEP_SUMMARY;
+    if (summary) {
+        const rows = reports.map(r => {
+            const failed = r.status.conditions.find(c => c.status === "False");
+            return `| ${r.id} | \`${r.stack}\` | ${failed ? `${failed.reason}` : "OK"} | ${r.changes ? JSON.stringify(r.changes) : ""} |`;
+        });
+        fs.appendFileSync(summary, [
+            `### pattform ${command}`,
+            "",
+            "| Spec | Stack | Result | Changes |",
+            "| --- | --- | --- | --- |",
+            ...rows,
+            "",
+        ].join("\n"));
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/src/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/engine.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,gCAWC;AAUD,oBAqCC;AA0BD,0BAgDC;AAED,oCAoBC;AA1MD,4CAA8B;AAC9B,gDAAkC;AAClC,2DAAkD;AAClD,iCAEgB;AAChB,qCAAwC;AACxC,uCAAmF;AACnF,2CAAiH;AACjH,+BAAuD;AAsCvD,0EAA0E;AAC1E,SAAgB,UAAU,CAAC,IAAY;IACnC,IAAI,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,IAAA,iCAAY,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7G,MAAM,KAAK,GAAG,wCAAwC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,EAAE,CAAC,CAAC;QACxF,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC;IACpF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,sBAAsB,KAAK,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB,EAAE,OAAsB;IACxD,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,oDAAoD;AACpD,SAAgB,IAAI,CAAC,OAAsB;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAc,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAA,aAAM,EAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAA,wBAAiB,EAAC,IAAI,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,IAAA,aAAM,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,IAAA,4BAAgB,EAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,IAAA,0BAAc,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,UAAU,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAS,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,IAAI,gEAAgE,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC5D,MAAM,IAAI,gBAAS,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,IAAI,uDAAuD,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAA,gBAAS,EAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAA,wBAAY,EAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,gBAAS,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,OAAO,sBAAsB,IAAI,CAAC,UAAU,SAAS,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtJ,CAAC;QACD,IAAA,qBAAY,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEvC,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,6BAAmB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvG,IAAA,mBAAS,EAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAE1C,GAAG,CAAC,OAAO,IAAA,aAAM,EAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,OAAO,qBAAqB,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,wEAAwE;IACxE,2BAA2B;IAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,UAAU,CAAC,EAAW,EAAE,SAAoB,EAAE,MAA6B,EAAE,KAAc;IAChG,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,EAAE,EAAE,CAAC;QACN,OAAO;YACH,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE;YAChI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,SAAS,SAAS,EAAE,kBAAkB,EAAE,GAAG,EAAE;SAC5H,CAAC;IACN,CAAC;IACD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC;gBACJ,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAgB,CAAC,CAAC,CAAC,MAAe;gBAC5E,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;gBACpD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG;aACzG,CAAC,CAAC;IACP,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACvJ,CAAC;IACD,OAAO;QACH,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE;QACvI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,GAAG,EAAE;KAC1H,CAAC;AACN,CAAC;AAEM,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,OAAsB;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,IAAA,aAAM,EAAC,CAAC,CAAC,IAAI,CAAC;YAClB,KAAK,EAAE,gBAAgB,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE;YAC7C,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;SAC7B,CAAC,CAAC,CAAC;IACR,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,qBAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,aAAM,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,SAAS,OAAO,IAAI,EAAE,kBAAkB,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;QACzE,IAAI,MAA6B,CAAC;QAClC,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,MAAM,IAAA,cAAQ,EAAC,OAAO,EAAE;gBAC7B,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE;oBACJ,YAAY,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB;oBACnD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU;oBACxC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;oBACpC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;oBAC5B,eAAe,EAAE,IAAI;iBACxB;gBACD,YAAY,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;gBAC7D,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;aAC/C,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,KAAK,GAAG,CAAC,CAAC;QACd,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACT,EAAE;YACF,KAAK,EAAE,gBAAgB,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE;YAC7C,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;YAC5F,OAAO,EAAE,MAAM,EAAE,OAAO;SAC3B,CAAC,CAAC;QACH,mEAAmE;QACnE,IAAI,KAAK,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,SAAgB,YAAY,CAAC,IAAY,EAAE,OAAgB,EAAE,OAAsB;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE/F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAChD,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACzB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,QAAQ,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QAClI,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE;YACvB,gBAAgB,OAAO,EAAE;YACzB,EAAE;YACF,qCAAqC;YACrC,2BAA2B;YAC3B,GAAG,IAAI;YACP,EAAE;SACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClB,CAAC;AACL,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,4 @@
+export { execute, plan, detectRepo, writeReports } from "./engine";
+export type { Command, EngineOptions, StackReport, RepoInfo } from "./engine";
+export { loadSpecs, stackName, capabilityPackage, SpecError } from "./spec";
+export { validateSpec, strict } from "./schema";

package/dist/src/index.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.strict = exports.validateSpec = exports.SpecError = exports.capabilityPackage = exports.stackName = exports.loadSpecs = exports.writeReports = exports.detectRepo = exports.plan = exports.execute = void 0;
+var engine_1 = require("./engine");
+Object.defineProperty(exports, "execute", { enumerable: true, get: function () { return engine_1.execute; } });
+Object.defineProperty(exports, "plan", { enumerable: true, get: function () { return engine_1.plan; } });
+Object.defineProperty(exports, "detectRepo", { enumerable: true, get: function () { return engine_1.detectRepo; } });
+Object.defineProperty(exports, "writeReports", { enumerable: true, get: function () { return engine_1.writeReports; } });
+var spec_1 = require("./spec");
+Object.defineProperty(exports, "loadSpecs", { enumerable: true, get: function () { return spec_1.loadSpecs; } });
+Object.defineProperty(exports, "stackName", { enumerable: true, get: function () { return spec_1.stackName; } });
+Object.defineProperty(exports, "capabilityPackage", { enumerable: true, get: function () { return spec_1.capabilityPackage; } });
+Object.defineProperty(exports, "SpecError", { enumerable: true, get: function () { return spec_1.SpecError; } });
+var schema_1 = require("./schema");
+Object.defineProperty(exports, "validateSpec", { enumerable: true, get: function () { return schema_1.validateSpec; } });
+Object.defineProperty(exports, "strict", { enumerable: true, get: function () { return schema_1.strict; } });
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,mCAAmE;AAA1D,iGAAA,OAAO,OAAA;AAAE,8FAAA,IAAI,OAAA;AAAE,oGAAA,UAAU,OAAA;AAAE,sGAAA,YAAY,OAAA;AAEhD,+BAA4E;AAAnE,iGAAA,SAAS,OAAA;AAAE,iGAAA,SAAS,OAAA;AAAE,yGAAA,iBAAiB,OAAA;AAAE,iGAAA,SAAS,OAAA;AAC3D,mCAAgD;AAAvC,sGAAA,YAAY,OAAA;AAAE,gGAAA,MAAM,OAAA"}

package/dist/src/run.d.ts

@@ -0,0 +1,23 @@
+export type Operation = "preview" | "up" | "drift";
+export interface StackRun {
+    workDir: string;
+    project: string;
+    stack: string;
+    config: {
+        [key: string]: unknown;
+    };
+    secretConfig: {
+        [key: string]: unknown;
+    };
+    onOutput: (line: string) => void;
+}
+export interface RunResult {
+    changes: {
+        [op: string]: number;
+    };
+    outputs?: {
+        [key: string]: unknown;
+    };
+    drifted?: boolean;
+}
+export declare function runStack(operation: Operation, run: StackRun): Promise<RunResult>;

package/dist/src/run.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runStack = runStack;
+const automation_1 = require("@pulumi/pulumi/automation");
+const workspace_1 = require("./workspace");
+function toConfigMap(values, secret) {
+    const map = {};
+    for (const [key, value] of Object.entries(values)) {
+        map[key] = { value: typeof value === "string" ? value : JSON.stringify(value), secret };
+    }
+    return map;
+}
+function plainOutputs(outputs) {
+    const result = {};
+    for (const [key, output] of Object.entries(outputs)) {
+        result[key] = output.secret ? "[secret]" : output.value;
+    }
+    return result;
+}
+async function runStack(operation, run) {
+    const stack = await automation_1.LocalWorkspace.createOrSelectStack({ stackName: `organization/${run.project}/${run.stack}`, workDir: run.workDir }, { secretsProvider: workspace_1.SECRETS_PROVIDER });
+    await stack.setAllConfig({
+        ...toConfigMap(run.config, false),
+        ...toConfigMap(run.secretConfig, true),
+    });
+    switch (operation) {
+        case "preview": {
+            const result = await stack.preview({ diff: true, onOutput: run.onOutput });
+            return { changes: result.changeSummary };
+        }
+        case "drift": {
+            try {
+                const result = await stack.preview({ refresh: true, expectNoChanges: true, diff: true, onOutput: run.onOutput });
+                return { changes: result.changeSummary, drifted: false };
+            }
+            catch (error) {
+                // expectNoChanges fails the preview when anything would change;
+                // any other failure (auth, a broken program) is a real error.
+                if (/no changes were expected/i.test(String(error))) {
+                    return { changes: {}, drifted: true };
+                }
+                throw error;
+            }
+        }
+        case "up": {
+            const result = await stack.up({ diff: true, onOutput: run.onOutput });
+            return {
+                changes: (result.summary.resourceChanges ?? {}),
+                outputs: plainOutputs(result.outputs),
+            };
+        }
+    }
+}
+//# sourceMappingURL=run.js.map

package/dist/src/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/run.ts"],"names":[],"mappings":";;AAoCA,4BAoCC;AAxED,0DAAiF;AACjF,2CAA+C;AAmB/C,SAAS,WAAW,CAAC,MAAkC,EAAE,MAAe;IACpE,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,OAAkB;IACpC,MAAM,MAAM,GAA+B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,SAAoB,EAAE,GAAa;IAC9D,MAAM,KAAK,GAAG,MAAM,2BAAc,CAAC,mBAAmB,CAClD,EAAE,SAAS,EAAE,gBAAgB,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAC/E,EAAE,eAAe,EAAE,4BAAgB,EAAE,CACxC,CAAC;IACF,MAAM,KAAK,CAAC,YAAY,CAAC;QACrB,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QACjC,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC;KACzC,CAAC,CAAC;IAEH,QAAQ,SAAS,EAAE,CAAC;QAChB,KAAK,SAAS,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,aAAyC,EAAE,CAAC;QACzE,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACX,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACjH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,aAAyC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,gEAAgE;gBAChE,8DAA8D;gBAC9D,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAClD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC1C,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;QACL,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtE,OAAO;gBACH,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAA6B;gBAC3E,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;aACxC,CAAC;QACN,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/src/schema.d.ts

@@ -0,0 +1,2 @@
+export declare function strict(node: any): any;
+export declare function validateSpec(schema: object, spec: unknown, owner: string): void;

package/dist/src/schema.js

@@ -0,0 +1,48 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.strict = strict;
+exports.validateSpec = validateSpec;
+const ajv_1 = __importDefault(require("ajv"));
+const ajv_formats_1 = __importDefault(require("ajv-formats"));
+const spec_1 = require("./spec");
+// Capability schemas are CRD-compatible, which rules out additionalProperties
+// next to properties. Unknown fields are still rejected here, the way
+// Kubernetes strict field validation would, by adding it before compiling.
+function strict(node) {
+    if (Array.isArray(node))
+        return node.map(strict);
+    if (node && typeof node === "object") {
+        const out = {};
+        for (const [key, value] of Object.entries(node))
+            out[key] = strict(value);
+        if (out.type === "object" && out.properties && out.additionalProperties === undefined) {
+            out.additionalProperties = false;
+        }
+        return out;
+    }
+    return node;
+}
+const ajv = new ajv_1.default({ allErrors: true, strict: false });
+(0, ajv_formats_1.default)(ajv);
+const compiled = new WeakMap();
+function validateSpec(schema, spec, owner) {
+    let validate = compiled.get(schema);
+    if (!validate) {
+        validate = ajv.compile(strict(schema));
+        compiled.set(schema, validate);
+    }
+    if (!validate(spec)) {
+        const problems = (validate.errors ?? []).map(error => {
+            const at = error.instancePath ? `spec${error.instancePath.replace(/\//g, ".")}` : "spec";
+            const extra = error.keyword === "additionalProperties"
+                ? ` (${error.params.additionalProperty})`
+                : "";
+            return `${at} ${error.message}${extra}`;
+        });
+        throw new spec_1.SpecError(`${owner}: ${problems.join("; ")}`);
+    }
+}
+//# sourceMappingURL=schema.js.map

package/dist/src/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":";;;;;AAOA,wBAWC;AAMD,oCAgBC;AAxCD,8CAA4C;AAC5C,8DAAqC;AACrC,iCAAmC;AAEnC,8EAA8E;AAC9E,sEAAsE;AACtE,2EAA2E;AAC3E,SAAgB,MAAM,CAAC,IAAS;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,GAAG,GAAQ,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACpF,GAAG,CAAC,oBAAoB,GAAG,KAAK,CAAC;QACrC,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,aAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,IAAA,qBAAU,EAAC,GAAG,CAAC,CAAC;AAChB,MAAM,QAAQ,GAAG,IAAI,OAAO,EAA4B,CAAC;AAEzD,SAAgB,YAAY,CAAC,MAAc,EAAE,IAAa,EAAE,KAAa;IACrE,IAAI,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YACjD,MAAM,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACzF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,KAAK,sBAAsB;gBAClD,CAAC,CAAC,KAAM,KAAK,CAAC,MAAc,CAAC,kBAAkB,GAAG;gBAClD,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,GAAG,EAAE,IAAI,KAAK,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,gBAAS,CAAC,GAAG,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;AACL,CAAC"}

package/dist/src/secrets.d.ts

@@ -0,0 +1,16 @@
+export interface SecretRef {
+    name: string;
+    key: string;
+}
+export declare function refId(ref: SecretRef): string;
+export declare function collectExplicitRefs(value: unknown, refs?: SecretRef[]): SecretRef[];
+export declare function checkRefs(deployDir: string, refs: SecretRef[], owner: string): void;
+export declare class SecretStore {
+    private readonly deployDir;
+    private readonly files;
+    constructor(deployDir: string);
+    private decrypt;
+    resolve(refs: SecretRef[]): {
+        [id: string]: string;
+    };
+}

package/dist/src/secrets.js

@@ -0,0 +1,125 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretStore = void 0;
+exports.refId = refId;
+exports.collectExplicitRefs = collectExplicitRefs;
+exports.checkRefs = checkRefs;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const yaml_1 = require("yaml");
+const spec_1 = require("./spec");
+function refId(ref) {
+    return `${ref.name}/${ref.key}`;
+}
+// Fallback when a capability doesn't declare secretRefs(): every object
+// shaped {name, key} under a property ending in "Ref".
+function collectExplicitRefs(value, refs = []) {
+    if (Array.isArray(value)) {
+        value.forEach(item => collectExplicitRefs(item, refs));
+    }
+    else if (value && typeof value === "object") {
+        for (const [key, child] of Object.entries(value)) {
+            if (key.endsWith("Ref") && child && typeof child === "object"
+                && typeof child.name === "string" && typeof child.key === "string") {
+                refs.push({ name: child.name, key: child.key });
+            }
+            else {
+                collectExplicitRefs(child, refs);
+            }
+        }
+    }
+    return refs;
+}
+function secretsFile(deployDir, name) {
+    return path.join(deployDir, `${name}.sops.yaml`);
+}
+function checkRefs(deployDir, refs, owner) {
+    const keysByFile = new Map();
+    for (const ref of refs) {
+        let keys = keysByFile.get(ref.name);
+        if (!keys) {
+            const file = secretsFile(deployDir, ref.name);
+            if (!fs.existsSync(file)) {
+                throw new spec_1.SpecError(`${owner}: secret ${refId(ref)} needs ${path.basename(file)} in deploy/`);
+            }
+            const doc = (0, yaml_1.parse)(fs.readFileSync(file, "utf8")) ?? {};
+            if (!doc.sops) {
+                throw new spec_1.SpecError(`${owner}: ${path.basename(file)} is not SOPS-encrypted; never commit plaintext secrets`);
+            }
+            keys = new Set(Object.keys(doc).filter(key => key !== "sops"));
+            keysByFile.set(ref.name, keys);
+        }
+        if (!keys.has(ref.key)) {
+            throw new spec_1.SpecError(`${owner}: secret ${refId(ref)} is missing from ${ref.name}.sops.yaml (add it with: sops ${ref.name}.sops.yaml)`);
+        }
+    }
+}
+// Decrypts each referenced file once per run. Uses the ambient AWS
+// credentials (the job's OIDC role, or `aws login` locally).
+class SecretStore {
+    deployDir;
+    files = new Map();
+    constructor(deployDir) {
+        this.deployDir = deployDir;
+    }
+    decrypt(name) {
+        let values = this.files.get(name);
+        if (!values) {
+            const output = (0, node_child_process_1.execFileSync)("sops", ["decrypt", "--output-type", "json", secretsFile(this.deployDir, name)], {
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+            values = JSON.parse(output);
+            this.files.set(name, values);
+        }
+        return values;
+    }
+    // Only the refs a stack uses, keyed "<file>/<key>".
+    resolve(refs) {
+        const resolved = {};
+        for (const ref of refs) {
+            const value = this.decrypt(ref.name)[ref.key];
+            if (typeof value !== "string") {
+                throw new spec_1.SpecError(`secret ${refId(ref)} must be a string`);
+            }
+            resolved[refId(ref)] = value;
+        }
+        return resolved;
+    }
+}
+exports.SecretStore = SecretStore;
+//# sourceMappingURL=secrets.js.map

package/dist/src/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,sBAEC;AAID,kDAcC;AAMD,8BAoBC;AA9DD,4CAA8B;AAC9B,gDAAkC;AAClC,2DAAkD;AAClD,+BAA6B;AAC7B,iCAAmC;AAYnC,SAAgB,KAAK,CAAC,GAAc;IAChC,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AACpC,CAAC;AAED,wEAAwE;AACxE,uDAAuD;AACvD,SAAgB,mBAAmB,CAAC,KAAc,EAAE,OAAoB,EAAE;IACtE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;mBACtD,OAAQ,KAAa,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAQ,KAAa,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACvF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAG,KAAa,CAAC,IAAI,EAAE,GAAG,EAAG,KAAa,CAAC,GAAG,EAAE,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACJ,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,IAAY;IAChD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;AACrD,CAAC;AAED,SAAgB,SAAS,CAAC,SAAiB,EAAE,IAAiB,EAAE,KAAa;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,gBAAS,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,GAAG,GAAG,IAAA,YAAK,EAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACZ,MAAM,IAAI,gBAAS,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAClH,CAAC;YACD,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC;YAC/D,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,gBAAS,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,GAAG,CAAC,oBAAoB,GAAG,CAAC,IAAI,iCAAiC,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC;QAC1I,CAAC;IACL,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,6DAA6D;AAC7D,MAAa,WAAW;IAGS;IAFZ,KAAK,GAAG,IAAI,GAAG,EAAsC,CAAC;IAEvE,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAE1C,OAAO,CAAC,IAAY;QACxB,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,IAAA,iCAAY,EAAC,MAAM,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE;gBACzG,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA+B,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,OAAO,CAAC,IAAiB;QACrB,MAAM,QAAQ,GAA6B,EAAE,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,gBAAS,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACjE,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QACjC,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ;AA9BD,kCA8BC"}

package/dist/src/spec.d.ts

@@ -0,0 +1,27 @@
+export declare const API_GROUP = "platform.pattform.io";
+export declare const ANNOTATION_CAPABILITY_VERSION = "platform.pattform.io/capability-version";
+export declare const ANNOTATION_STACK = "platform.pattform.io/stack";
+export interface SpecDocument {
+    apiVersion: string;
+    kind: string;
+    metadata: {
+        name: string;
+        namespace?: string;
+        annotations?: {
+            [key: string]: string;
+        };
+    };
+    spec: unknown;
+    file: string;
+}
+export declare class SpecError extends Error {
+}
+export declare function loadSpecs(deployDir: string): SpecDocument[];
+export declare function specId(spec: SpecDocument): string;
+export declare function capabilityVersion(spec: SpecDocument): string;
+export declare function kebab(kind: string): string;
+export declare function capabilityPackage(kind: string): string;
+export declare function stackName(spec: SpecDocument, scope: "Namespaced" | "Cluster"): {
+    project: string;
+    stack: string;
+};

package/dist/src/spec.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SpecError = exports.ANNOTATION_STACK = exports.ANNOTATION_CAPABILITY_VERSION = exports.API_GROUP = void 0;
+exports.loadSpecs = loadSpecs;
+exports.specId = specId;
+exports.capabilityVersion = capabilityVersion;
+exports.kebab = kebab;
+exports.capabilityPackage = capabilityPackage;
+exports.stackName = stackName;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const yaml_1 = require("yaml");
+// Loading and checking the Kubernetes-style envelope of every spec in an app
+// repo's deploy/ folder. Capability-specific validation (the schema) happens
+// later, once the pinned capability is installed.
+exports.API_GROUP = "platform.pattform.io";
+exports.ANNOTATION_CAPABILITY_VERSION = `${exports.API_GROUP}/capability-version`;
+exports.ANNOTATION_STACK = `${exports.API_GROUP}/stack`;
+const DNS_1123_LABEL = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;
+const SEMVER = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+class SpecError extends Error {
+}
+exports.SpecError = SpecError;
+function isSecretsFile(file) {
+    return file.endsWith(".sops.yaml") || file.endsWith(".sops.yml");
+}
+// Every YAML document in deploy/ except SOPS secret files.
+function loadSpecs(deployDir) {
+    if (!fs.existsSync(deployDir)) {
+        throw new SpecError(`${deployDir} does not exist`);
+    }
+    const files = fs.readdirSync(deployDir)
+        .filter(file => /\.ya?ml$/.test(file) && !isSecretsFile(file))
+        .sort();
+    const specs = [];
+    for (const file of files) {
+        const docs = (0, yaml_1.parseAllDocuments)(fs.readFileSync(path.join(deployDir, file), "utf8"));
+        for (const doc of docs) {
+            if (doc.errors.length) {
+                throw new SpecError(`${file}: ${doc.errors[0].message}`);
+            }
+            const value = doc.toJSON();
+            if (value === null || value === undefined)
+                continue; // empty document
+            specs.push(checkEnvelope(value, file));
+        }
+    }
+    const seen = new Set();
+    for (const spec of specs) {
+        const id = specId(spec);
+        if (seen.has(id)) {
+            throw new SpecError(`${spec.file}: ${id} is declared more than once`);
+        }
+        seen.add(id);
+    }
+    return specs;
+}
+function checkEnvelope(value, file) {
+    const where = (field) => `${file}: ${field}`;
+    if (typeof value !== "object" || Array.isArray(value)) {
+        throw new SpecError(`${file}: each document must be a mapping`);
+    }
+    const { apiVersion, kind, metadata, spec } = value;
+    if (typeof apiVersion !== "string" || !apiVersion.startsWith(`${exports.API_GROUP}/`)) {
+        throw new SpecError(where(`apiVersion must be ${exports.API_GROUP}/<version>, got ${JSON.stringify(apiVersion)}`));
+    }
+    if (typeof kind !== "string" || !/^[A-Z][A-Za-z0-9]*$/.test(kind)) {
+        throw new SpecError(where(`kind must be PascalCase, got ${JSON.stringify(kind)}`));
+    }
+    if (!metadata || typeof metadata.name !== "string" || !DNS_1123_LABEL.test(metadata.name) || metadata.name.length > 63) {
+        throw new SpecError(where(`metadata.name must be a DNS-1123 label (lowercase letters, digits, hyphens, max 63)`));
+    }
+    if (metadata.namespace !== undefined && (typeof metadata.namespace !== "string" || !DNS_1123_LABEL.test(metadata.namespace))) {
+        throw new SpecError(where(`metadata.namespace must be a DNS-1123 label`));
+    }
+    const version = metadata.annotations?.[exports.ANNOTATION_CAPABILITY_VERSION];
+    if (typeof version !== "string" || !SEMVER.test(version)) {
+        throw new SpecError(where(`${kind}/${metadata.name} needs annotation ${exports.ANNOTATION_CAPABILITY_VERSION} set to an exact version, e.g. "1.0.0"`));
+    }
+    if ("status" in value) {
+        throw new SpecError(where(`status is written by the engine and must not be committed`));
+    }
+    return { apiVersion, kind, metadata, spec: spec ?? {}, file };
+}
+function specId(spec) {
+    return spec.metadata.namespace
+        ? `${spec.kind}/${spec.metadata.namespace}/${spec.metadata.name}`
+        : `${spec.kind}/${spec.metadata.name}`;
+}
+function capabilityVersion(spec) {
+    return spec.metadata.annotations[exports.ANNOTATION_CAPABILITY_VERSION];
+}
+function kebab(kind) {
+    return kind.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+function capabilityPackage(kind) {
+    return `@pattform/capability-${kebab(kind)}`;
+}
+// organization/<kind>/<namespace>.<name>, organization/client/<name> for
+// cluster-scoped kinds, or the stack named by the adoption annotation.
+function stackName(spec, scope) {
+    const adopt = spec.metadata.annotations?.[exports.ANNOTATION_STACK];
+    if (adopt) {
+        const match = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(adopt);
+        if (!match) {
+            throw new SpecError(`${spec.file}: ${exports.ANNOTATION_STACK} must be <project>/<stack>, got ${adopt}`);
+        }
+        return { project: match[1], stack: match[2] };
+    }
+    if (scope === "Namespaced") {
+        if (!spec.metadata.namespace) {
+            throw new SpecError(`${spec.file}: ${spec.kind} is namespaced, so metadata.namespace (the client) is required`);
+        }
+        return { project: kebab(spec.kind), stack: `${spec.metadata.namespace}.${spec.metadata.name}` };
+    }
+    if (spec.metadata.namespace) {
+        throw new SpecError(`${spec.file}: ${spec.kind} is cluster-scoped, so it takes no metadata.namespace`);
+    }
+    return { project: kebab(spec.kind), stack: spec.metadata.name };
+}
+//# sourceMappingURL=spec.js.map

package/dist/src/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../src/spec.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,8BA8BC;AA8BD,wBAIC;AAED,8CAEC;AAED,sBAEC;AAED,8CAEC;AAID,8BAmBC;AArID,4CAA8B;AAC9B,gDAAkC;AAClC,+BAAyC;AAEzC,6EAA6E;AAC7E,6EAA6E;AAC7E,kDAAkD;AAErC,QAAA,SAAS,GAAG,sBAAsB,CAAC;AACnC,QAAA,6BAA6B,GAAG,GAAG,iBAAS,qBAAqB,CAAC;AAClE,QAAA,gBAAgB,GAAG,GAAG,iBAAS,QAAQ,CAAC;AAcrD,MAAM,cAAc,GAAG,iCAAiC,CAAC;AACzD,MAAM,MAAM,GAAG,mCAAmC,CAAC;AAEnD,MAAa,SAAU,SAAQ,KAAK;CAAG;AAAvC,8BAAuC;AAEvC,SAAS,aAAa,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrE,CAAC;AAED,2DAA2D;AAC3D,SAAgB,SAAS,CAAC,SAAiB;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC,GAAG,SAAS,iBAAiB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;SAClC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;SAC7D,IAAI,EAAE,CAAC;IAEZ,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAA,wBAAiB,EAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS,CAAC,iBAAiB;YACtE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,EAAE,6BAA6B,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAAU,EAAE,IAAY;IAC3C,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACnD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,iBAAS,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,sBAAsB,iBAAS,mBAAmB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrH,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC3H,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,qCAA6B,CAAC,CAAC;IACtE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,qBAAqB,qCAA6B,wCAAwC,CAAC,CAAC,CAAC;IACnJ,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,SAAgB,MAAM,CAAC,IAAkB;IACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS;QAC1B,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjE,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED,SAAgB,iBAAiB,CAAC,IAAkB;IAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAY,CAAC,qCAA6B,CAAC,CAAC;AACrE,CAAC;AAED,SAAgB,KAAK,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACrE,CAAC;AAED,SAAgB,iBAAiB,CAAC,IAAY;IAC1C,OAAO,wBAAwB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,yEAAyE;AACzE,uEAAuE;AACvE,SAAgB,SAAS,CAAC,IAAkB,EAAE,KAA+B;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,wBAAgB,CAAC,CAAC;IAC5D,IAAI,KAAK,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,wBAAgB,mCAAmC,KAAK,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,gEAAgE,CAAC,CAAC;QACpH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,uDAAuD,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;AACpE,CAAC"}

package/dist/src/workspace.d.ts

@@ -0,0 +1,20 @@
+export declare const BACKEND_URL = "s3://pattform-pulumi-state?region=ap-southeast-2";
+export declare const SECRETS_PROVIDER = "awskms://alias/pattform-pulumi?region=ap-southeast-2";
+export interface WorkspaceOptions {
+    root: string;
+    capabilitiesDir?: string;
+}
+export declare function prepareWorkspace(options: WorkspaceOptions, dirName: string, kind: string, version: string): string;
+export declare function writeProject(workDir: string, project: string, kind: string, version: string): void;
+export interface LoadedCapability {
+    kind: string;
+    scope: "Namespaced" | "Cluster";
+    schemas: {
+        [apiVersion: string]: object;
+    };
+    secretRefs?(spec: unknown): {
+        name: string;
+        key: string;
+    }[];
+}
+export declare function loadCapability(workDir: string, kind: string): LoadedCapability;

package/dist/src/workspace.js

@@ -0,0 +1,116 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRETS_PROVIDER = exports.BACKEND_URL = void 0;
+exports.prepareWorkspace = prepareWorkspace;
+exports.writeProject = writeProject;
+exports.loadCapability = loadCapability;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const spec_1 = require("./spec");
+// One throwaway Pulumi project per stack under .pattform/work/, holding a
+// generated Pulumi.yaml, a one-line program and the pinned capability
+// installed with npm. The capability's own dependencies fix the provider
+// versions, so a capability version fully determines what the stack runs.
+exports.BACKEND_URL = "s3://pattform-pulumi-state?region=ap-southeast-2";
+exports.SECRETS_PROVIDER = "awskms://alias/pattform-pulumi?region=ap-southeast-2";
+function npm(args, cwd) {
+    return (0, node_child_process_1.execFileSync)("npm", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}
+function packLocal(capabilitiesDir, workspace, into) {
+    const dir = path.join(capabilitiesDir, "packages", workspace);
+    if (!fs.existsSync(path.join(dir, "dist"))) {
+        throw new Error(`${dir} is not built; run npm run build in ${capabilitiesDir}`);
+    }
+    const tarball = npm(["pack", "--pack-destination", into, "--silent"], dir).trim().split("\n").pop();
+    return `file:./.tarballs/${tarball}`;
+}
+// Installs the pinned capability into .pattform/work/<dirName>/. The Pulumi
+// project file is written separately (writeProject) once the capability's
+// scope, and so the stack name, is known.
+function prepareWorkspace(options, dirName, kind, version) {
+    const workDir = path.join(options.root, ".pattform", "work", dirName);
+    fs.mkdirSync(workDir, { recursive: true });
+    const pkg = (0, spec_1.capabilityPackage)(kind);
+    const dependencies = {};
+    const overrides = {};
+    if (options.capabilitiesDir) {
+        const tarballs = path.join(workDir, ".tarballs");
+        fs.rmSync(tarballs, { recursive: true, force: true });
+        fs.mkdirSync(tarballs);
+        const sdk = packLocal(options.capabilitiesDir, "sdk", tarballs);
+        dependencies[pkg] = packLocal(options.capabilitiesDir, (0, spec_1.kebab)(kind), tarballs);
+        dependencies["@pattform/capability-sdk"] = sdk;
+        overrides["@pattform/capability-sdk"] = sdk;
+    }
+    else {
+        dependencies[pkg] = version;
+    }
+    const manifest = { name: `pattform-stack-${dirName}`.toLowerCase().replace(/[^a-z0-9-]/g, "-"), private: true, dependencies, overrides };
+    const manifestText = JSON.stringify(manifest, null, 2);
+    const installedMarker = path.join(workDir, ".installed.json");
+    const upToDate = !options.capabilitiesDir
+        && fs.existsSync(installedMarker)
+        && fs.readFileSync(installedMarker, "utf8") === manifestText;
+    fs.writeFileSync(path.join(workDir, "package.json"), manifestText);
+    fs.writeFileSync(path.join(workDir, "index.js"), `module.exports = require("@pattform/capability-sdk").run(require("${pkg}").default);\n`);
+    if (!upToDate) {
+        npm(["install", "--no-audit", "--no-fund", "--omit=dev", "--loglevel=error"], workDir);
+        fs.writeFileSync(installedMarker, manifestText);
+    }
+    return workDir;
+}
+function writeProject(workDir, project, kind, version) {
+    fs.writeFileSync(path.join(workDir, "Pulumi.yaml"), [
+        `name: ${project}`,
+        `runtime: nodejs`,
+        `main: index.js`,
+        `description: Generated by pattform-engine for ${kind} (${(0, spec_1.capabilityPackage)(kind)}@${version}). Do not edit.`,
+        `backend:`,
+        `  url: ${exports.BACKEND_URL}`,
+        ``,
+    ].join("\n"));
+}
+function loadCapability(workDir, kind) {
+    const modulePath = path.join(workDir, "node_modules", (0, spec_1.capabilityPackage)(kind));
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const capability = require(modulePath).default;
+    if (!capability || capability.kind !== kind) {
+        throw new Error(`${(0, spec_1.capabilityPackage)(kind)} does not export the ${kind} capability`);
+    }
+    return capability;
+}
+//# sourceMappingURL=workspace.js.map

package/dist/src/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../src/workspace.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,4CAwCC;AAED,oCAUC;AASD,wCAQC;AAzGD,4CAA8B;AAC9B,gDAAkC;AAClC,2DAAkD;AAClD,iCAAkD;AAElD,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,0EAA0E;AAE7D,QAAA,WAAW,GAAG,kDAAkD,CAAC;AACjE,QAAA,gBAAgB,GAAG,sDAAsD,CAAC;AASvF,SAAS,GAAG,CAAC,IAAc,EAAE,GAAW;IACpC,OAAO,IAAA,iCAAY,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,SAAS,CAAC,eAAuB,EAAE,SAAiB,EAAE,IAAY;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,uCAAuC,eAAe,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAG,CAAC;IACrG,OAAO,oBAAoB,OAAO,EAAE,CAAC;AACzC,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,0CAA0C;AAC1C,SAAgB,gBAAgB,CAC5B,OAAyB,EACzB,OAAe,EACf,IAAY,EACZ,OAAe;IAEf,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACtE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAA,wBAAiB,EAAC,IAAI,CAAC,CAAC;IAEpC,MAAM,YAAY,GAA+B,EAAE,CAAC;IACpD,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACjD,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChE,YAAY,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,IAAA,YAAK,EAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9E,YAAY,CAAC,0BAA0B,CAAC,GAAG,GAAG,CAAC;QAC/C,SAAS,CAAC,0BAA0B,CAAC,GAAG,GAAG,CAAC;IAChD,CAAC;SAAM,CAAC;QACJ,YAAY,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IAChC,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,kBAAkB,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IACzI,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,eAAe;WAClC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;WAC9B,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,YAAY,CAAC;IAEjE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAC3C,qEAAqE,GAAG,gBAAgB,CAAC,CAAC;IAE9F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,kBAAkB,CAAC,EAAE,OAAO,CAAC,CAAC;QACvF,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,SAAgB,YAAY,CAAC,OAAe,EAAE,OAAe,EAAE,IAAY,EAAE,OAAe;IACxF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE;QAChD,SAAS,OAAO,EAAE;QAClB,iBAAiB;QACjB,gBAAgB;QAChB,iDAAiD,IAAI,KAAK,IAAA,wBAAiB,EAAC,IAAI,CAAC,IAAI,OAAO,iBAAiB;QAC7G,UAAU;QACV,UAAU,mBAAW,EAAE;QACvB,EAAE;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAClB,CAAC;AASD,SAAgB,cAAc,CAAC,OAAe,EAAE,IAAY;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAA,wBAAiB,EAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,OAA2B,CAAC;IACnE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAA,wBAAiB,EAAC,IAAI,CAAC,wBAAwB,IAAI,aAAa,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,UAAU,CAAC;AACtB,CAAC"}

package/package.json

@@ -1,6 +1,26 @@
 {
   "name": "@pattform/engine",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Turns an app repo's deploy/*.yaml specs into Pulumi stacks using Pattform capabilities (ADR-001)",
+  "license": "SEE LICENSE IN LICENSE",
+  "bin": { "pattform": "dist/src/cli.js" },
+  "main": "dist/src/index.js",
+  "types": "dist/src/index.d.ts",
+  "files": ["dist/src"],
+  "repository": { "type": "git", "url": "git+https://github.com/Pattform/pattform-engine.git" },
+  "publishConfig": { "access": "public" },
+  "scripts": {
+    "build": "tsc -p .",
+    "test": "npm run build && node --test 'dist/test/*.test.js'"
+  },
+  "dependencies": {
+    "@pulumi/pulumi": "^3.253.0",
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
+    "yaml": "^2.6.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.6.3"
+  }
+}