@staticforge/azure 0.0.0-stage → 0.1.1

package/dist/iac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iac.d.ts","sourceRoot":"","sources":["../src/iac.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,iBAAiB,EAA0B,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAEL,KAAK,UAAU,EAKhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,YAAY,EAA0C,MAAM,cAAc,CAAC;AAMzF,eAAO,MAAM,eAAe,QAA+B,CAAC;AAC5D,eAAO,MAAM,mBAAmB,QAAkC,CAAC;AAKnE,0CAA0C;AAC1C,eAAO,MAAM,aAAa,UAAgE,CAAC;AAI3F,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2GAA2G;AAC3G,wBAAgB,aAAa,CAC3B,MAAM,EAAE,iBAAiB,EACzB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,aAAa,CAUf;AAED,yEAAyE;AACzE,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,EAAE,YAAY,MAAM,KAAG,MACpB,CAAC;AAEnD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,iBAAiB,EACzB,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,mEAAmE;AACnE,wBAAsB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzE;AAqED,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,YAA+B,GAAG,UAAU,CA+F1F"}

package/dist/iac.js

@@ -0,0 +1,188 @@
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { ErrorCode, SforgeError } from '@staticforge/core';
+import { projectName, } from '@staticforge/iac';
+import { azureError, defaultClients, httpStatus } from './clients.js';
+/** Packaged HCL, next to src/ and dist/. */
+const terraformDir = (path) => fileURLToPath(new URL(`../terraform/${path}`, import.meta.url));
+export const SITE_MODULE_DIR = terraformDir('modules/site');
+export const STATE_BOOTSTRAP_DIR = terraformDir('state-bootstrap');
+const AZURERM_PROVIDER = { source: 'hashicorp/azurerm', version: '>= 4.0, < 5.0' };
+const TIME_PROVIDER = { source: 'hashicorp/time', version: '>= 0.12, < 1.0' };
+/** Where Azure offers Static Web Apps. */
+export const SWA_LOCATIONS = ['westus2', 'centralus', 'eastus2', 'westeurope', 'eastasia'];
+const MANAGEMENT_SCOPE = 'https://management.azure.com/.default';
+/** `sfstate<hash of the subscription>` in resource group `sforge-state`, key `<site>/<target>.tfstate`. */
+export function stateLocation(target, subscriptionId, project, targetName) {
+    return {
+        subscriptionId,
+        resourceGroup: target.state.resourceGroup ?? 'sforge-state',
+        storageAccount: target.state.storageAccount ??
+            `sfstate${createHash('sha256').update(subscriptionId.toLowerCase()).digest('hex').slice(0, 12)}`,
+        container: target.state.container,
+        key: `${project}/${targetName}.tfstate`,
+    };
+}
+/** Blob that holds a target's deploy history, in the state container. */
+export const historyBlobName = (project, targetName) => `_sforge/${project}/${targetName}/versions.json`;
+/**
+ * `targets.<n>.subscriptionId`, else AZURE_SUBSCRIPTION_ID / ARM_SUBSCRIPTION_ID,
+ * else the subscription `az login` selected.
+ */
+export async function resolveSubscription(clients, target, env) {
+    const id = target.subscriptionId ??
+        env.AZURE_SUBSCRIPTION_ID ??
+        env.ARM_SUBSCRIPTION_ID ??
+        (await clients.az(['account', 'show', '--query', 'id', '-o', 'tsv']));
+    if (id === undefined || id === '') {
+        throw new SforgeError(ErrorCode.CloudAuth, 'Could not tell which Azure subscription to use', {
+            hint: 'Run `az login`, or set targets.<name>.subscriptionId or AZURE_SUBSCRIPTION_ID.',
+        });
+    }
+    return id;
+}
+/** Fail early, with a useful message, when no credential works. */
+export async function assertSignedIn(clients) {
+    try {
+        await clients.credential().getToken(MANAGEMENT_SCOPE);
+    }
+    catch (error) {
+        throw azureError(error, 'Could not sign in to Azure', ErrorCode.CloudAuth);
+    }
+}
+const NOT_FOUND = new Set(['ResourceNotFound', 'ResourceGroupNotFound', 'ContainerNotFound']);
+const isNotFound = (error) => httpStatus(error) === 404 || NOT_FOUND.has(error?.code ?? '');
+/** Whether the state storage account and container exist. */
+async function stateExists(clients, location) {
+    const storage = clients.storage(location.subscriptionId);
+    try {
+        await storage.storageAccounts.getProperties(location.resourceGroup, location.storageAccount);
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return false;
+        throw azureError(error, `Could not check the state storage account ${location.storageAccount}`, ErrorCode.CloudAuth);
+    }
+    try {
+        await storage.blobContainers.get(location.resourceGroup, location.storageAccount, location.container);
+    }
+    catch (error) {
+        if (isNotFound(error)) {
+            throw new SforgeError(ErrorCode.StateMissing, `The storage account ${location.storageAccount} exists but has no container "${location.container}"`, {
+                hint: 'Create the container, or point targets.<name>.state at another storage account.',
+            });
+        }
+        throw azureError(error, 'Could not check the state container', ErrorCode.CloudAuth);
+    }
+    return true;
+}
+function azurermBackend(location, key = location.key) {
+    return {
+        type: 'azurerm',
+        config: {
+            subscription_id: location.subscriptionId,
+            resource_group_name: location.resourceGroup,
+            storage_account_name: location.storageAccount,
+            container_name: location.container,
+            key,
+            // Entra ID (the az login or the CI identity), never account keys.
+            use_azuread_auth: true,
+        },
+    };
+}
+/** Resource providers the modules use, registered by the azurerm provider itself. */
+const RESOURCE_PROVIDERS = ['Microsoft.Web', 'Microsoft.Storage'];
+const azurermProvider = (subscriptionId) => ({
+    features: {},
+    subscription_id: subscriptionId,
+    // Storage is managed through the management plane: account keys are disabled.
+    storage_use_azuread: true,
+    // Register only what the modules need (the default "core" set registers dozens).
+    resource_provider_registrations: 'none',
+    resource_providers_to_register: RESOURCE_PROVIDERS,
+});
+export function createAzureIacProfile(clients = defaultClients()) {
+    return {
+        provider: 'azure',
+        async prepare(input) {
+            const target = input.target;
+            const name = input.targetName;
+            for (const [option, label] of [
+                [target.domain, 'domain'],
+                [target.dnsZone, 'dnsZone'],
+                [target.ci, 'ci'],
+            ]) {
+                if (option !== undefined) {
+                    throw new SforgeError(ErrorCode.Unsupported, `targets.${name}.${label} is not supported for Azure targets yet`, {
+                        hint: 'Custom domains and the GitHub Actions identity for Azure arrive in milestone M9.',
+                    });
+                }
+            }
+            if (!SWA_LOCATIONS.includes(target.location)) {
+                throw new SforgeError(ErrorCode.ConfigInvalid, `targets.${name}.location "${target.location}" has no Static Web Apps`, { hint: `Use one of: ${SWA_LOCATIONS.join(', ')}.` });
+            }
+            const project = projectName(input.config);
+            const outputsOnly = input.purpose === 'outputs';
+            const subscriptionId = await resolveSubscription(clients, target, input.env);
+            if (!outputsOnly)
+                await assertSignedIn(clients);
+            const location = stateLocation(target, subscriptionId, project, name);
+            const exists = outputsOnly ? true : await stateExists(clients, location);
+            const tags = { 'sforge:managed-by': 'staticforge' };
+            const spec = {
+                requiredProviders: { azurerm: AZURERM_PROVIDER },
+                providers: { azurerm: [azurermProvider(subscriptionId)] },
+                module: {
+                    name: 'site',
+                    dir: SITE_MODULE_DIR,
+                    inputs: {
+                        name: project,
+                        target: name,
+                        resource_group_name: target.resourceGroup,
+                        create_resource_group: target.createResourceGroup,
+                        location: target.location,
+                        sku: target.sku,
+                        tags: { ...tags, 'sforge:site': project, 'sforge:target': name },
+                    },
+                },
+                outputs: [
+                    'static_web_app_name',
+                    'static_web_app_id',
+                    'resource_group',
+                    'location',
+                    'sku',
+                    'default_host_name',
+                    'url',
+                ],
+                backend: azurermBackend(location),
+            };
+            const bootstrap = {
+                requiredProviders: { azurerm: AZURERM_PROVIDER, time: TIME_PROVIDER },
+                providers: { azurerm: [azurermProvider(subscriptionId)], time: [{}] },
+                module: {
+                    name: 'state',
+                    dir: STATE_BOOTSTRAP_DIR,
+                    inputs: {
+                        resource_group_name: location.resourceGroup,
+                        location: target.state.location ?? target.location,
+                        storage_account_name: location.storageAccount,
+                        container_name: location.container,
+                        tags,
+                    },
+                },
+                outputs: ['resource_group', 'storage_account', 'storage_account_id', 'container'],
+                backend: azurermBackend(location, '_sforge/state-bootstrap.tfstate'),
+            };
+            return {
+                spec,
+                state: {
+                    id: `azure-${subscriptionId.slice(0, 8)}-${location.storageAccount}`,
+                    description: `azure://${location.storageAccount}/${location.container}/${location.key}`,
+                    exists,
+                    bootstrap,
+                },
+            };
+        },
+    };
+}
+//# sourceMappingURL=iac.js.map

package/dist/iac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iac.js","sourceRoot":"","sources":["../src/iac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAA0B,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAML,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAqB,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEzF,4CAA4C;AAC5C,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CACpC,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAEnE,MAAM,gBAAgB,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AACnF,MAAM,aAAa,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE9E,0CAA0C;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;AAE3F,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AAUjE,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAC3B,MAAyB,EACzB,cAAsB,EACtB,OAAe,EACf,UAAkB;IAElB,OAAO;QACL,cAAc;QACd,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,cAAc;QAC3D,cAAc,EACZ,MAAM,CAAC,KAAK,CAAC,cAAc;YAC3B,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QAClG,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,GAAG,EAAE,GAAG,OAAO,IAAI,UAAU,UAAU;KACxC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,UAAkB,EAAU,EAAE,CAC7E,WAAW,OAAO,IAAI,UAAU,gBAAgB,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAqB,EACrB,MAAyB,EACzB,GAAsB;IAEtB,MAAM,EAAE,GACN,MAAM,CAAC,cAAc;QACrB,GAAG,CAAC,qBAAqB;QACzB,GAAG,CAAC,mBAAmB;QACvB,CAAC,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,gDAAgD,EAAE;YAC3F,IAAI,EAAE,gFAAgF;SACvF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,CAAC,KAAK,EAAE,4BAA4B,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE9F,MAAM,UAAU,GAAG,CAAC,KAAc,EAAW,EAAE,CAC7C,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,GAAG,CAAE,KAAkC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;AAE9F,6DAA6D;AAC7D,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,QAAuB;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,UAAU,CACd,KAAK,EACL,6CAA6C,QAAQ,CAAC,cAAc,EAAE,EACtE,SAAS,CAAC,SAAS,CACpB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,CAC9B,QAAQ,CAAC,aAAa,EACtB,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,SAAS,CACnB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,YAAY,EACtB,uBAAuB,QAAQ,CAAC,cAAc,iCAAiC,QAAQ,CAAC,SAAS,GAAG,EACpG;gBACE,IAAI,EAAE,iFAAiF;aACxF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,qCAAqC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,QAAuB,EAAE,GAAG,GAAG,QAAQ,CAAC,GAAG;IACjE,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE;YACN,eAAe,EAAE,QAAQ,CAAC,cAAc;YACxC,mBAAmB,EAAE,QAAQ,CAAC,aAAa;YAC3C,oBAAoB,EAAE,QAAQ,CAAC,cAAc;YAC7C,cAAc,EAAE,QAAQ,CAAC,SAAS;YAClC,GAAG;YACH,kEAAkE;YAClE,gBAAgB,EAAE,IAAI;SACvB;KACF,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,kBAAkB,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;AAElE,MAAM,eAAe,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,CAAC;IACnD,QAAQ,EAAE,EAAE;IACZ,eAAe,EAAE,cAAc;IAC/B,8EAA8E;IAC9E,mBAAmB,EAAE,IAAI;IACzB,iFAAiF;IACjF,+BAA+B,EAAE,MAAM;IACvC,8BAA8B,EAAE,kBAAkB;CACnD,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,UAAwB,cAAc,EAAE;IAC5E,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,KAAK,CAAC,OAAO,CAAC,KAAmB;YAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,MAA2B,CAAC;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC;YAE9B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI;gBAC5B,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;gBACzB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;gBAC3B,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC;aACT,EAAE,CAAC;gBACX,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,WAAW,EACrB,WAAW,IAAI,IAAI,KAAK,yCAAyC,EACjE;wBACE,IAAI,EAAE,kFAAkF;qBACzF,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,aAAa,EACvB,WAAW,IAAI,cAAc,MAAM,CAAC,QAAQ,0BAA0B,EACtE,EAAE,IAAI,EAAE,eAAe,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACrD,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;YAChD,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7E,IAAI,CAAC,WAAW;gBAAE,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAEzE,MAAM,IAAI,GAAG,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAC;YACpD,MAAM,IAAI,GAAY;gBACpB,iBAAiB,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;gBAChD,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,EAAE;gBACzD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,GAAG,EAAE,eAAe;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,IAAI;wBACZ,mBAAmB,EAAE,MAAM,CAAC,aAAa;wBACzC,qBAAqB,EAAE,MAAM,CAAC,mBAAmB;wBACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE;qBACjE;iBACF;gBACD,OAAO,EAAE;oBACP,qBAAqB;oBACrB,mBAAmB;oBACnB,gBAAgB;oBAChB,UAAU;oBACV,KAAK;oBACL,mBAAmB;oBACnB,KAAK;iBACN;gBACD,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC;aAClC,CAAC;YAEF,MAAM,SAAS,GAAY;gBACzB,iBAAiB,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE;gBACrE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE;gBACrE,MAAM,EAAE;oBACN,IAAI,EAAE,OAAO;oBACb,GAAG,EAAE,mBAAmB;oBACxB,MAAM,EAAE;wBACN,mBAAmB,EAAE,QAAQ,CAAC,aAAa;wBAC3C,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;wBAClD,oBAAoB,EAAE,QAAQ,CAAC,cAAc;wBAC7C,cAAc,EAAE,QAAQ,CAAC,SAAS;wBAClC,IAAI;qBACL;iBACF;gBACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,WAAW,CAAC;gBACjF,OAAO,EAAE,cAAc,CAAC,QAAQ,EAAE,iCAAiC,CAAC;aACrE,CAAC;YAEF,OAAO;gBACL,IAAI;gBACJ,KAAK,EAAE;oBACL,EAAE,EAAE,SAAS,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,cAAc,EAAE;oBACpE,WAAW,EAAE,WAAW,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,EAAE;oBACvF,MAAM;oBACN,SAAS;iBACV;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+import type { Provider } from '@staticforge/provider-api';
+import { type AzureClients } from './clients.js';
+export * from './clients.js';
+export * from './deployer.js';
+export * from './history.js';
+export * from './iac.js';
+export * from './rebuild.js';
+export * from './swa-config.js';
+export * from './uploader.js';
+/** The Azure provider: Static Web Apps, named preview environments, rollback by rebuild. */
+export declare function createAzureProvider(clients?: AzureClients): Provider;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,cAAc,CAAC;AAIjE,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAE9B,4FAA4F;AAC5F,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,YAA+B,GAAG,QAAQ,CAOtF"}

package/dist/index.js

@@ -0,0 +1,20 @@
+import { defaultClients } from './clients.js';
+import { REQUIRED_OUTPUTS, createAzureDeployer } from './deployer.js';
+import { createAzureIacProfile } from './iac.js';
+export * from './clients.js';
+export * from './deployer.js';
+export * from './history.js';
+export * from './iac.js';
+export * from './rebuild.js';
+export * from './swa-config.js';
+export * from './uploader.js';
+/** The Azure provider: Static Web Apps, named preview environments, rollback by rebuild. */
+export function createAzureProvider(clients = defaultClients()) {
+    return {
+        id: 'azure',
+        iac: createAzureIacProfile(clients),
+        createDeployer: (context) => createAzureDeployer(context, clients),
+        requiredOutputs: REQUIRED_OUTPUTS,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,cAAc,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAE9B,4FAA4F;AAC5F,MAAM,UAAU,mBAAmB,CAAC,UAAwB,cAAc,EAAE;IAC1E,OAAO;QACL,EAAE,EAAE,OAAO;QACX,GAAG,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACnC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC;QAClE,eAAe,EAAE,gBAAgB;KAClC,CAAC;AACJ,CAAC"}

package/dist/rebuild.d.ts

@@ -0,0 +1,15 @@
+import type { DeployerContext } from '@staticforge/provider-api';
+export interface Rebuilt {
+    /** A finished build (with its manifest) of the commit. */
+    buildDir: string;
+    cleanup(): void;
+}
+/** Builds the site as it was at a commit. Injectable, so tests need no git history. */
+export type Rebuild = (sha: string, context: DeployerContext) => Promise<Rebuilt>;
+/**
+ * Check the commit out into a temporary worktree next to the real one, build it
+ * with that commit's own config and content, and hand over the output. The
+ * project's dependencies and image cache are shared, so nothing is installed.
+ */
+export declare const rebuildAtCommit: Rebuild;
+//# sourceMappingURL=rebuild.d.ts.map

package/dist/rebuild.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebuild.d.ts","sourceRoot":"","sources":["../src/rebuild.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,WAAW,OAAO;IACtB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAclF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,OAwE7B,CAAC"}

package/dist/rebuild.js

@@ -0,0 +1,97 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, relative } from 'node:path';
+import { buildSite } from '@staticforge/build';
+import { ErrorCode, SforgeError } from '@staticforge/core';
+function git(cwd, args) {
+    return execFileSync('git', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] })
+        .toString()
+        .trim();
+}
+function unavailable(sha, reason) {
+    return new SforgeError(ErrorCode.Unsupported, `Cannot rebuild ${sha}: ${reason}`, {
+        hint: 'Azure rollbacks rebuild the site from git. Fetch the full history (in CI: fetch-depth: 0) or deploy a fixed version instead.',
+    });
+}
+/**
+ * Check the commit out into a temporary worktree next to the real one, build it
+ * with that commit's own config and content, and hand over the output. The
+ * project's dependencies and image cache are shared, so nothing is installed.
+ */
+export const rebuildAtCommit = async (sha, context) => {
+    const { rootDir } = context;
+    let top;
+    try {
+        top = git(rootDir, ['rev-parse', '--show-toplevel']);
+    }
+    catch {
+        throw unavailable(sha, 'the project is not in a git repository');
+    }
+    try {
+        git(top, ['cat-file', '-e', `${sha}^{commit}`]);
+    }
+    catch {
+        throw unavailable(sha, 'the commit is not in this repository');
+    }
+    const scratch = mkdtempSync(join(tmpdir(), 'sforge-rollback-'));
+    const worktree = join(scratch, 'checkout');
+    const cleanup = () => {
+        try {
+            git(top, ['worktree', 'remove', '--force', worktree]);
+        }
+        catch {
+            // Already gone, or never added.
+        }
+        rmSync(scratch, { recursive: true, force: true });
+        try {
+            git(top, ['worktree', 'prune']);
+        }
+        catch {
+            // Not worth failing a rollback over.
+        }
+    };
+    try {
+        git(top, ['worktree', 'add', '--detach', worktree, sha]);
+        const projectDir = join(worktree, relative(top, rootDir));
+        // Config files may import packages; share the project's node_modules.
+        for (const [from, to] of [
+            [join(top, 'node_modules'), join(worktree, 'node_modules')],
+            [join(rootDir, 'node_modules'), join(projectDir, 'node_modules')],
+            [join(rootDir, '.sforge', 'cache'), join(projectDir, '.sforge', 'cache')],
+        ]) {
+            if (existsSync(from) && !existsSync(to)) {
+                mkdirSync(join(to, '..'), { recursive: true });
+                symlinkSync(from, to, 'dir');
+            }
+        }
+        if (context.loadConfig === undefined) {
+            throw new SforgeError(ErrorCode.Internal, 'The provider was created without a config loader');
+        }
+        let loaded;
+        try {
+            loaded = await context.loadConfig(projectDir);
+        }
+        catch (error) {
+            throw unavailable(sha, `its configuration cannot be loaded (${error.message})`);
+        }
+        context.logger.info(`Building ${sha} for the rollback`);
+        const build = await buildSite({
+            rootDir: loaded.rootDir,
+            config: loaded.config,
+            scratchDir: join(scratch, 'out'),
+            logger: context.logger,
+        });
+        if (!build.ok) {
+            throw new SforgeError(ErrorCode.DeployFailed, `Version ${sha} no longer builds`, {
+                details: { diagnostics: build.diagnostics.filter((d) => d.severity === 'error') },
+            });
+        }
+        return { buildDir: build.outDir, cleanup };
+    }
+    catch (error) {
+        cleanup();
+        throw error;
+    }
+};
+//# sourceMappingURL=rebuild.js.map

package/dist/rebuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebuild.js","sourceRoot":"","sources":["../src/rebuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAqB,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAY9E,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc;IACtC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;SACzE,QAAQ,EAAE;SACV,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc;IAC9C,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,kBAAkB,GAAG,KAAK,MAAM,EAAE,EAAE;QAChF,IAAI,EAAE,8HAA8H;KACrI,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAY,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,WAAW,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,WAAW,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAE1D,sEAAsE;QACtE,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;YACvB,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YAC3D,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YACjE,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;SACjE,EAAE,CAAC;YACX,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,kDAAkD,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,GAAG,EAAE,uCAAwC,KAAe,CAAC,OAAO,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,GAAG,mBAAmB,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,GAAG,mBAAmB,EAAE;gBAC/E,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;QACV,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC"}

package/dist/swa-config.d.ts

@@ -0,0 +1,19 @@
+import type { SforgeConfig } from '@staticforge/core';
+import { type BuildManifest } from '@staticforge/provider-api';
+/** Static Web Apps rejects a configuration file larger than 20 KB. */
+export declare const SWA_CONFIG_LIMIT: number;
+export declare const SWA_CONFIG_FILE = "staticwebapp.config.json";
+export interface GeneratedSwaConfig {
+    config: Record<string, unknown>;
+    json: string;
+    /** Cache rules left out because the file would exceed the size limit (those files revalidate). */
+    droppedRoutes: number;
+}
+/**
+ * The `staticwebapp.config.json` of a build: the `security` headers on every
+ * response, the cache classes of the manifest, the trailing-slash policy, a 404
+ * page and the search page's own CSP. Static Web Apps has no per-file metadata,
+ * so cache classes become route rules, within the 20 KB limit of the file.
+ */
+export declare function generateStaticWebAppConfig(config: SforgeConfig, manifest: BuildManifest): GeneratedSwaConfig;
+//# sourceMappingURL=swa-config.d.ts.map

package/dist/swa-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"swa-config.d.ts","sourceRoot":"","sources":["../src/swa-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,2BAA2B,CAAC;AAEnC,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAI1C,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAO1D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,aAAa,EAAE,MAAM,CAAC;CACvB;AA6DD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,aAAa,GACtB,kBAAkB,CAsEpB"}

package/dist/swa-config.js

@@ -0,0 +1,136 @@
+import { dirname } from 'node:path';
+import { cacheControl, contentType, publishedFiles, searchPaths, securityHeaders, } from '@staticforge/provider-api';
+/** Static Web Apps rejects a configuration file larger than 20 KB. */
+export const SWA_CONFIG_LIMIT = 20 * 1024;
+/** Stay below the limit: the platform may count differently than JSON.stringify. */
+const BUDGET = 19 * 1024;
+export const SWA_CONFIG_FILE = 'staticwebapp.config.json';
+/** Extensions Static Web Apps may not know, given the type `sforge preview` serves them as. */
+const MIME_CANDIDATES = ['.avif', '.webp', '.vtt', '.webmanifest', '.mjs', '.wasm', '.xml'];
+function mimeTypes(manifest) {
+    const present = new Set(publishedFiles(manifest)
+        .map(([path]) => /\.[a-z0-9]+$/i.exec(path)?.[0].toLowerCase())
+        .filter((ext) => ext !== undefined));
+    return Object.fromEntries(MIME_CANDIDATES.filter((ext) => present.has(ext)).map((ext) => [
+        ext,
+        contentType(`x${ext}`).split(';')[0],
+    ]));
+}
+/**
+ * Routes that cache fingerprinted files for a year. A directory whose files are
+ * all immutable (the image variants) becomes one wildcard route, anything else
+ * is listed file by file, most useful first.
+ */
+function immutableRoutes(manifest) {
+    const files = publishedFiles(manifest);
+    const totals = new Map();
+    for (const [path, entry] of files) {
+        for (let dir = dirname(path); dir !== '.'; dir = dirname(dir)) {
+            const total = totals.get(dir) ?? { all: 0, immutable: 0 };
+            total.all++;
+            if (entry.cache === 'immutable')
+                total.immutable++;
+            totals.set(dir, total);
+        }
+    }
+    const dirs = new Set();
+    const exact = [];
+    for (const [path, entry] of files) {
+        if (entry.cache !== 'immutable')
+            continue;
+        // The shallowest ancestor holding nothing but immutable files.
+        const ancestors = [];
+        for (let dir = dirname(path); dir !== '.'; dir = dirname(dir))
+            ancestors.unshift(dir);
+        const whole = ancestors.find((dir) => {
+            const total = totals.get(dir);
+            return total !== undefined && total.all === total.immutable;
+        });
+        if (whole !== undefined)
+            dirs.add(whole);
+        else
+            exact.push(path);
+    }
+    return { dirs: [...dirs].sort(), files: exact.sort() };
+}
+/** The `Strict-Transport-Security` value for the configured policy. */
+function hstsValue(hsts) {
+    return [
+        `max-age=${hsts.maxAge}`,
+        ...(hsts.includeSubDomains ? ['includeSubDomains'] : []),
+        ...(hsts.preload ? ['preload'] : []),
+    ].join('; ');
+}
+/**
+ * The `staticwebapp.config.json` of a build: the `security` headers on every
+ * response, the cache classes of the manifest, the trailing-slash policy, a 404
+ * page and the search page's own CSP. Static Web Apps has no per-file metadata,
+ * so cache classes become route rules, within the 20 KB limit of the file.
+ */
+export function generateStaticWebAppConfig(config, manifest) {
+    const security = securityHeaders(config);
+    const globalHeaders = {
+        'Cache-Control': cacheControl('revalidate'),
+        'X-Content-Type-Options': 'nosniff',
+        'Referrer-Policy': security.referrerPolicy,
+        ...(security.contentSecurityPolicy !== null && {
+            'Content-Security-Policy': security.contentSecurityPolicy,
+        }),
+        ...(security.hsts !== null && { 'Strict-Transport-Security': hstsValue(security.hsts) }),
+        ...(security.frameOptions !== null && { 'X-Frame-Options': security.frameOptions }),
+        ...(security.permissionsPolicy !== null && {
+            'Permissions-Policy': security.permissionsPolicy,
+        }),
+    };
+    const routes = [];
+    if (security.searchContentSecurityPolicy !== null &&
+        security.searchContentSecurityPolicy !== security.contentSecurityPolicy) {
+        const headers = { 'Content-Security-Policy': security.searchContentSecurityPolicy };
+        for (const pattern of searchPaths(config)) {
+            // `/x/*` does not match `/x`, which the search page is served at. Static Web Apps
+            // treats `/x` and `/x/` as the same route and rejects a configuration with both.
+            if (pattern.endsWith('/*'))
+                routes.push({ route: pattern.slice(0, -2), headers });
+            routes.push({ route: pattern, headers });
+        }
+    }
+    const base = {
+        // SWA's "always" also appends a slash to files (style.css → style.css/); "auto" adds it to
+        // folders only, which is what build.trailingSlash "always" means.
+        ...(config.build.cleanUrls && {
+            trailingSlash: config.build.trailingSlash === 'always' ? 'auto' : 'never',
+        }),
+        ...(manifest.files['404.html'] !== undefined && {
+            responseOverrides: { '404': { rewrite: '/404.html', statusCode: 404 } },
+        }),
+        globalHeaders,
+        ...(Object.keys(mimeTypes(manifest)).length > 0 && { mimeTypes: mimeTypes(manifest) }),
+    };
+    const immutable = immutableRoutes(manifest);
+    const immutableHeaders = { 'Cache-Control': cacheControl('immutable') };
+    const wanted = [
+        ...immutable.dirs.map((dir) => ({ route: `/${dir}/*`, headers: immutableHeaders })),
+        ...immutable.files.map((path) => ({ route: `/${path}`, headers: immutableHeaders })),
+    ];
+    const render = (extra, space) => JSON.stringify({ ...base, routes: [...routes, ...extra] }, null, space);
+    // The size only grows with the number of routes: find how many fit. Directory rules
+    // come first (they cover the most files), so single files are dropped from the end.
+    let low = 0;
+    let high = wanted.length;
+    while (low < high) {
+        const mid = Math.ceil((low + high) / 2);
+        if (render(wanted.slice(0, mid)).length <= BUDGET)
+            low = mid;
+        else
+            high = mid - 1;
+    }
+    const used = wanted.slice(0, low);
+    const pretty = render(used, 2);
+    const json = pretty.length <= BUDGET ? pretty : render(used);
+    return {
+        config: JSON.parse(json),
+        json: `${json}\n`,
+        droppedRoutes: wanted.length - low,
+    };
+}
+//# sourceMappingURL=swa-config.js.map

package/dist/swa-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"swa-config.js","sourceRoot":"","sources":["../src/swa-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAEL,YAAY,EACZ,WAAW,EACX,cAAc,EACd,WAAW,EACX,eAAe,GAChB,MAAM,2BAA2B,CAAC;AAEnC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,oFAAoF;AACpF,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzB,MAAM,CAAC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAc1D,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAE5F,SAAS,SAAS,CAAC,QAAuB;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,cAAc,CAAC,QAAQ,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC9D,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CACrD,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CACvB,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7D,GAAG;QACH,WAAW,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW;KAC/C,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAuB;IAC9C,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8C,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,GAAG,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;gBAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;YAAE,SAAS;QAC1C,+DAA+D;QAC/D,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,SAAS,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;;YACpC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;AACzD,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,IAA6D;IAC9E,OAAO;QACL,WAAW,IAAI,CAAC,MAAM,EAAE;QACxB,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAoB,EACpB,QAAuB;IAEvB,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,aAAa,GAA2B;QAC5C,eAAe,EAAE,YAAY,CAAC,YAAY,CAAC;QAC3C,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,QAAQ,CAAC,cAAc;QAC1C,GAAG,CAAC,QAAQ,CAAC,qBAAqB,KAAK,IAAI,IAAI;YAC7C,yBAAyB,EAAE,QAAQ,CAAC,qBAAqB;SAC1D,CAAC;QACF,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,EAAE,2BAA2B,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,IAAI,IAAI,EAAE,iBAAiB,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,iBAAiB,KAAK,IAAI,IAAI;YACzC,oBAAoB,EAAE,QAAQ,CAAC,iBAAiB;SACjD,CAAC;KACH,CAAC;IAEF,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IACE,QAAQ,CAAC,2BAA2B,KAAK,IAAI;QAC7C,QAAQ,CAAC,2BAA2B,KAAK,QAAQ,CAAC,qBAAqB,EACvE,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,yBAAyB,EAAE,QAAQ,CAAC,2BAA2B,EAAE,CAAC;QACpF,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,kFAAkF;YAClF,iFAAiF;YACjF,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YAClF,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAA4B;QACpC,2FAA2F;QAC3F,kEAAkE;QAClE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI;YAC5B,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SAC1E,CAAC;QACF,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI;YAC9C,iBAAiB,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;SACxE,CAAC;QACF,aAAa;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;KACvF,CAAC;IAEF,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAG,EAAE,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;IACxE,MAAM,MAAM,GAAY;QACtB,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACnF,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;KACrF,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,KAAc,EAAE,EAAE,CAChD,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAE1E,oFAAoF;IACpF,oFAAoF;IACpF,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,OAAO,GAAG,GAAG,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM;YAAE,GAAG,GAAG,GAAG,CAAC;;YACxD,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B;QACnD,IAAI,EAAE,GAAG,IAAI,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,MAAM,GAAG,GAAG;KACnC,CAAC;AACJ,CAAC"}

package/dist/uploader.d.ts

@@ -0,0 +1,24 @@
+export interface UploadRequest {
+    /** Directory of the files to publish (already without dot-paths). */
+    dir: string;
+    /** `production`, or the name of a preview environment. */
+    environment: string;
+    /** Deployment token of the Static Web App. Never logged. */
+    token: string;
+    env: NodeJS.ProcessEnv;
+}
+export interface UploadResult {
+    /** The URL the deployment client reports, when it does. */
+    url?: string;
+}
+/** Sends a directory to a Static Web App environment. */
+export type Uploader = (request: UploadRequest) => Promise<UploadResult>;
+/** Remove ANSI colors and the token from output that is shown to users. */
+export declare function sanitize(output: string, token: string): string;
+/**
+ * Uploads with `swa deploy`, which downloads and runs Microsoft's
+ * StaticSitesClient. The token travels in the environment, and the process runs
+ * in an empty directory so it cannot pick up a project's `.github/workflows`.
+ */
+export declare const swaCliUploader: Uploader;
+//# sourceMappingURL=uploader.d.ts.map

package/dist/uploader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploader.d.ts","sourceRoot":"","sources":["../src/uploader.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,yDAAyD;AACzD,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAYzE,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,QAoC5B,CAAC"}

package/dist/uploader.js

@@ -0,0 +1,58 @@
+import { spawn } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { createRequire } from 'node:module';
+import { ErrorCode, SforgeError } from '@staticforge/core';
+const TIMEOUT_MS = 15 * 60_000;
+/** Entry point of the `swa` command line shipped as a dependency. */
+function swaBinary() {
+    const require = createRequire(import.meta.url);
+    const manifestPath = require.resolve('@azure/static-web-apps-cli/package.json');
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    return join(dirname(manifestPath), manifest.bin.swa);
+}
+/** Remove ANSI colors and the token from output that is shown to users. */
+export function sanitize(output, token) {
+    return (output
+        .replaceAll(token, '***')
+        // eslint-disable-next-line no-control-regex
+        .replace(/\x1b\[[0-9;]*m/g, '')
+        .trim());
+}
+/**
+ * Uploads with `swa deploy`, which downloads and runs Microsoft's
+ * StaticSitesClient. The token travels in the environment, and the process runs
+ * in an empty directory so it cannot pick up a project's `.github/workflows`.
+ */
+export const swaCliUploader = async ({ dir, environment, token, env }) => {
+    const cwd = mkdtempSync(join(tmpdir(), 'sforge-swa-'));
+    try {
+        const output = await new Promise((resolve, reject) => {
+            const child = spawn(process.execPath, [swaBinary(), 'deploy', dir, '--env', environment, '--no-use-keychain'], {
+                cwd,
+                env: { ...env, SWA_CLI_DEPLOYMENT_TOKEN: token, FORCE_COLOR: '0', CI: 'true' },
+                stdio: ['ignore', 'pipe', 'pipe'],
+                timeout: TIMEOUT_MS,
+            });
+            let text = '';
+            child.stdout.on('data', (chunk) => (text += String(chunk)));
+            child.stderr.on('data', (chunk) => (text += String(chunk)));
+            child.on('error', reject);
+            child.on('close', (code) => resolve({ code, text }));
+        });
+        const clean = sanitize(output.text, token);
+        if (output.code !== 0 || /deployment failed|deployment failure/i.test(clean)) {
+            throw new SforgeError(ErrorCode.DeployFailed, `The Static Web Apps deployment client failed (exit code ${output.code})`, {
+                details: { output: clean.split('\n').slice(-30).join('\n') },
+                hint: 'Run again with --verbose for more output. The client is downloaded on first use: check that you have network access.',
+            });
+        }
+        const url = /Project deployed to\s+(https:\/\/\S+)/.exec(clean)?.[1];
+        return url === undefined ? {} : { url };
+    }
+    finally {
+        rmSync(cwd, { recursive: true, force: true });
+    }
+};
+//# sourceMappingURL=uploader.js.map