@vaharoni/devops 1.0.47

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,mBAAmB,6BAA8B,CAAC;AAC/D,MAAM,MAAM,kBAAkB,GAAG,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAIpE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;EAQ1B,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,QAAA,MAAM,oBAAoB;;;;;;;;;EAGxB,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,QAAA,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAOrB,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG1B,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAmB9D,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAEjE,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,WAAW,EAAE,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG;IAEhE,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,qEAAqE;IACrE,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAA;AAED,QAAA,MAAM,gBAAgB;IACpB,sFAAsF;;IAEtF,+HAA+H;;IAE/H,yFAAyF;;IAEzF,uCAAuC;;IAEvC,kGAAkG;;IAElG,oBAAoB;;QAGhB,+FAA+F;;QAE/F,wBAAwB;;QAExB,oDAAoD;;;;;;;;;;;;QAMpD,uDAAuD;;QAEvD,8GAA8G;;;;;;;;;;IAzBlH,sFAAsF;;IAEtF,+HAA+H;;IAE/H,yFAAyF;;IAEzF,uCAAuC;;IAEvC,kGAAkG;;IAElG,oBAAoB;;QAGhB,+FAA+F;;QAE/F,wBAAwB;;QAExB,oDAAoD;;;;;;;;;;;;QAMpD,uDAAuD;;QAEvD,8GAA8G;;;;;;;;;;IAzBlH,sFAAsF;;IAEtF,+HAA+H;;IAE/H,yFAAyF;;IAEzF,uCAAuC;;IAEvC,kGAAkG;;IAElG,oBAAoB;;QAGhB,+FAA+F;;QAE/F,wBAAwB;;QAExB,oDAAoD;;;;;;;;;;;;QAMpD,uDAAuD;;QAEvD,8GAA8G;;;;;;;;;sBAKhG,CAAC;AACrB,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,qBAAqB;IAChC,0CAA0C;;IAE1C,uCAAuC;;IAEvC,sCAAsC;;IAEtC,uEAAuE;;QA1CvE,sFAAsF;;QAEtF,+HAA+H;;QAE/H,yFAAyF;;QAEzF,uCAAuC;;QAEvC,kGAAkG;;QAElG,oBAAoB;;YAGhB,+FAA+F;;YAE/F,wBAAwB;;YAExB,oDAAoD;;;;;;;;;;;;YAMpD,uDAAuD;;YAEvD,8GAA8G;;;;;;;;;;QAzBlH,sFAAsF;;QAEtF,+HAA+H;;QAE/H,yFAAyF;;QAEzF,uCAAuC;;QAEvC,kGAAkG;;QAElG,oBAAoB;;YAGhB,+FAA+F;;YAE/F,wBAAwB;;YAExB,oDAAoD;;;;;;;;;;;;YAMpD,uDAAuD;;YAEvD,8GAA8G;;;;;;;;;;QAzBlH,sFAAsF;;QAEtF,+HAA+H;;QAE/H,yFAAyF;;QAEzF,uCAAuC;;QAEvC,kGAAkG;;QAElG,oBAAoB;;YAGhB,+FAA+F;;YAE/F,wBAAwB;;YAExB,oDAAoD;;;;;;;;;;;;YAMpD,uDAAuD;;YAEvD,8GAA8G;;;;;;;;;;;;;;;QAzBlH,sFAAsF;;QAEtF,+HAA+H;;QAE/H,yFAAyF;;QAEzF,uCAAuC;;QAEvC,kGAAkG;;QAElG,oBAAoB;;YAGhB,+FAA+F;;YAE/F,wBAAwB;;YAExB,oDAAoD;;;;;;;;;;;;YAMpD,uDAAuD;;YAEvD,8GAA8G;;;;;;;;;;;;;;;QAzBlH,sFAAsF;;QAEtF,+HAA+H;;QAE/H,yFAAyF;;QAEzF,uCAAuC;;QAEvC,kGAAkG;;QAElG,oBAAoB;;YAGhB,+FAA+F;;YAE/F,wBAAwB;;YAExB,oDAAoD;;;;;;;;;;;;YAMpD,uDAAuD;;YAEvD,8GAA8G;;;;;;;;;;EAmBlH,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;gBA/ClC,sFAAsF;;gBAEtF,+HAA+H;;gBAE/H,yFAAyF;;gBAEzF,uCAAuC;;gBAEvC,kGAAkG;;gBAElG,oBAAoB;;oBAGhB,+FAA+F;;oBAE/F,wBAAwB;;oBAExB,oDAAoD;;;;;;;;;;;;oBAMpD,uDAAuD;;oBAEvD,8GAA8G;;;;;;;;;;gBAzBlH,sFAAsF;;gBAEtF,+HAA+H;;gBAE/H,yFAAyF;;gBAEzF,uCAAuC;;gBAEvC,kGAAkG;;gBAElG,oBAAoB;;oBAGhB,+FAA+F;;oBAE/F,wBAAwB;;oBAExB,oDAAoD;;;;;;;;;;;;oBAMpD,uDAAuD;;oBAEvD,8GAA8G;;;;;;;;;;gBAzBlH,sFAAsF;;gBAEtF,+HAA+H;;gBAE/H,yFAAyF;;gBAEzF,uCAAuC;;gBAEvC,kGAAkG;;gBAElG,oBAAoB;;oBAGhB,+FAA+F;;oBAE/F,wBAAwB;;oBAExB,oDAAoD;;;;;;;;;;;;oBAMpD,uDAAuD;;oBAEvD,8GAA8G;;;;;;;;;;;;;;gBAzBlH,sFAAsF;;gBAEtF,+HAA+H;;gBAE/H,yFAAyF;;gBAEzF,uCAAuC;;gBAEvC,kGAAkG;;gBAElG,oBAAoB;;oBAGhB,+FAA+F;;oBAE/F,wBAAwB;;oBAExB,oDAAoD;;;;;;;;;;;;oBAMpD,uDAAuD;;oBAEvD,8GAA8G;;;;;;;;;;;;;gBAzBlH,sFAAsF;;gBAEtF,+HAA+H;;gBAE/H,yFAAyF;;gBAEzF,uCAAuC;;gBAEvC,kGAAkG;;gBAElG,oBAAoB;;oBAGhB,+FAA+F;;oBAE/F,wBAAwB;;oBAExB,oDAAoD;;;;;;;;;;;;oBAMpD,uDAAuD;;oBAEvD,8GAA8G;;;;;;;;;;;;;;;gBAzBlH,sFAAsF;;gBAEtF,+HAA+H;;gBAE/H,yFAAyF;;gBAEzF,uCAAuC;;gBAEvC,kGAAkG;;gBAElG,oBAAoB;;oBAGhB,+FAA+F;;oBAE/F,wBAAwB;;oBAExB,oDAAoD;;;;;;;;;;;;oBAMpD,uDAAuD;;oBAEvD,8GAA8G;;;;;;;;;;;;;;;gBAzBlH,sFAAsF;;gBAEtF,+HAA+H;;gBAE/H,yFAAyF;;gBAEzF,uCAAuC;;gBAEvC,kGAAkG;;gBAElG,oBAAoB;;oBAGhB,+FAA+F;;oBAE/F,wBAAwB;;oBAExB,oDAAoD;;;;;;;;;;;;oBAMpD,uDAAuD;;oBAEvD,8GAA8G;;;;;;;;;;;;;;;;;;;;;gBAzBlH,sFAAsF;;gBAEtF,+HAA+H;;gBAE/H,yFAAyF;;gBAEzF,uCAAuC;;gBAEvC,kGAAkG;;gBAElG,oBAAoB;;oBAGhB,+FAA+F;;oBAE/F,wBAAwB;;oBAExB,oDAAoD;;;;;;;;;;;;oBAMpD,uDAAuD;;oBAEvD,8GAA8G;;;;;;;;;;;;;;;;;;;;;gBAzBlH,sFAAsF;;gBAEtF,+HAA+H;;gBAE/H,yFAAyF;;gBAEzF,uCAAuC;;gBAEvC,kGAAkG;;gBAElG,oBAAoB;;oBAGhB,+FAA+F;;oBAE/F,wBAAwB;;oBAExB,oDAAoD;;;;;;;;;;;;oBAMpD,uDAAuD;;oBAEvD,8GAA8G;;;;;;;;;;;;EAiClH,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAUxE,MAAM,MAAM,qBAAqB,GAAG;IAClC,+BAA+B;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;IACxB,mGAAmG;IACnG,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG,qBAAqB,GAAG,UAAU,GAAG;IAC1E,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,GAAG;IAC5D,8CAA8C;IAC9C,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,qBAAqB,GAAG;IACxD,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;CACxB,CAAA"}

package/dist/types/index.js

@@ -0,0 +1,79 @@
+import { z } from "zod";
+export const SUPPORTED_LANGUAGES = ["python", "node"];
+// Config files
+export const constFileSchema = z.object({
+    "project-name": z.string(),
+    "infra": z.enum(["hetzner", "digitalocean"]),
+    "image-versions-to-keep": z.number(),
+    "registry-base-url": z.string(),
+    "registry-name": z.string(),
+    "extra-remote-environments": z.array(z.string()),
+    "extra-local-environments": z.array(z.string()),
+});
+const singleTemplateSchema = z.object({
+    "copy-common": z.boolean().optional(),
+    "extra-content": z.array(z.string()).optional(),
+});
+const singleImageSchema = z.object({
+    "image-template": z.string(),
+    "language": z.enum(SUPPORTED_LANGUAGES),
+    "domains": z.record(z.string()).optional(),
+    "debug-template": z.string(),
+    "can-db-migrate": z.boolean().optional(),
+    applications: z.array(z.string()),
+});
+export const imageFileSchema = z.object({
+    templates: z.record(singleTemplateSchema),
+    images: z.record(singleImageSchema),
+});
+const deploymentSchema = z.object({
+    /** The name of the composite template to build in order to support this deployment */
+    template: z.string(),
+    /** The name used by kubernetes objects. If ommitted, the name field from the enclosing context (e.g. package.json) is used. */
+    app_name: z.string().optional(),
+    /** This will be the name of the internal service used for intra-cluster communication */
+    service_name: z.string().optional(),
+    /** For services, the port to expose */
+    port: z.number().optional(),
+    /** This will be the subdomain of the exposed ingress. If not provided, taken from service_name */
+    subdomain: z.string().optional(),
+    /** For cron jobs */
+    cronJobs: z.array(z.object({
+        /** The name of the cron job. Used to identify in k8s. Should be unique among all cron jobs. */
+        name: z.string().optional(),
+        /** The cron schedule */
+        cron: z.string().optional(),
+        /** The curl command to invoke. Must be an array. */
+        curl: z.array(z.string()).optional(),
+    })).optional(),
+    prefectFlows: z.array(z.object({
+        /** The name of the container inside the prefect pod */
+        flow_name: z.string(),
+        /** The path to the file that runs the flow, relative to the project folder. E.g. src/data_pipeline/main.py */
+        script_path: z.string(),
+    })).optional()
+    /** The catchall below allows any other fields that might be in the package.json file */
+}).catchall(z.any());
+// ## Workspace Discovery: Languae-specific constructs
+export const packageFileNodeSchema = z.object({
+    /** This is considered the project name */
+    name: z.string(),
+    /** Scripts exposed by this project. */
+    scripts: z.record(z.string()).optional(),
+    /** The dependencies of the project */
+    dependencies: z.record(z.string()).optional(),
+    /** When a deployment data is available, a k8s deployment is created */
+    deployment: deploymentSchema.optional(),
+});
+export const packageFilePythonSchema = z.object({
+    project: z.object({
+        name: z.string(),
+        dependencies: z.string().array().optional(),
+    }),
+    tool: z.object({
+        devops: z.object({
+            deployment: deploymentSchema.optional(),
+            scripts: z.record(z.string()).optional(),
+        }).optional(),
+    }).optional(),
+});

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@vaharoni/devops",
+  "type": "module",
+  "version": "1.0.47",
+  "description": "Devops utility",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist/**/*",
+    "src/**/*"
+  ],
+  "bin": {
+    "devops": "dist/devops.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vaharoni/devops.git"
+  },
+  "author": "Amit Aharoni",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/vaharoni/devops/issues"
+  },
+  "homepage": "https://github.com/vaharoni/devops#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@dotenvx/dotenvx": "^1.38.3",
+    "@iarna/toml": "^2.2.5",
+    "chalk": "^5.3.0",
+    "concurrently": "^9.1.2",
+    "fs-extra": "11.2.0",
+    "glob": "^11.0.1",
+    "handlebars": "^4.7.8",
+    "lodash": "^4.17.21",
+    "tsx": "^4.19.3",
+    "yaml": "^2.4.2",
+    "zod": "^3.24.2"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "@types/fs-extra": "^11.0.4",
+    "@types/handlebars": "^4.1.0",
+    "@types/lodash": "^4.17.16",
+    "vitest": "^1.6.0"
+  },
+  "peerDependencies": {
+    "typescript": "^5.8.2"
+  }
+}

package/src/app-support/crypto/index.ts

@@ -0,0 +1,31 @@
+import { generateInternalAuthToken, parseInternalAuthTokenOrThrow } from "./internal-token";
+
+/** 
+ * A simple token generation/verification class that relies on the subject field of an internal JWT-like token. It can:
+ * - generate a short-lived (60s) token with the given subject
+ * - verify that a token has not expired and bears the given subject
+ * 
+ * Relies on the MONOREPO_BASE_SECRET environment variable for signing and verifying the token.
+ */
+export class InternalToken {
+  constructor(public subject: string) {}
+
+  generate() {
+    return generateInternalAuthToken({ sub: this.subject });
+  }
+
+  verifyOrThrow(token: string) {
+    const parsedToken = parseInternalAuthTokenOrThrow(token);
+    if (parsedToken.sub !== this.subject) {
+      throw new Error('Invalid token');
+    }
+  }
+
+  verifyFromHeaderOrThrow(authorizationHeader?: string | null) {
+    if (!authorizationHeader) {
+      throw new Error('Authorization header not found');
+    }
+    const token = authorizationHeader.replace('Bearer ', '');
+    this.verifyOrThrow(token);
+  }
+}

package/src/app-support/crypto/internal-token.spec.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { generateInternalAuthToken, parseInternalAuthTokenOrThrow } from './internal-token';
+
+vi.mock('../../libs/config', () => ({
+  getConst: () => 'test',
+}));
+
+describe('generate and verify internal token', () => {
+  beforeEach(() => {
+    process.env.MONOREPO_BASE_SECRET = '1234567890abcdef';
+  })
+
+  it('works for default tokens', () => {
+    const token = generateInternalAuthToken();
+    const parsedPayload = parseInternalAuthTokenOrThrow(token);
+    expect(parsedPayload.iss).toEqual('test-internal');
+    expect(parsedPayload.exp - parsedPayload.iat).toEqual(60);
+  });
+
+  it('works for custom tokens', () => {
+    const payload = { hello: 'world' };
+    const token = generateInternalAuthToken({
+      customClaims: payload,
+      expiresInSeconds: 30,
+      aud: 'aud',
+      sub: 'sub',
+    });
+    const parsedPayload = parseInternalAuthTokenOrThrow<{
+      hello: string;
+    }>(token);
+    expect(parsedPayload.iss).toEqual('test-internal');
+    expect(parsedPayload.exp - parsedPayload.iat).toEqual(30);
+    expect(parsedPayload.hello).toEqual('world');
+    expect(parsedPayload.aud).toEqual('aud');
+    expect(parsedPayload.sub).toEqual('sub');
+  });
+
+  it('throws for expired tokens', () => {
+    const invalidToken = generateInternalAuthToken({
+      expiresInSeconds: -1,
+    });
+    expect(() => parseInternalAuthTokenOrThrow(invalidToken)).toThrowError('Token expired');
+  });
+
+  it('throws for invalid signature', () => {
+    const payload = { hello: 'world' };
+    const token = generateInternalAuthToken({
+      customClaims: payload,
+    });
+    const invalidToken = token.replace(/.$/, 'x');
+    expect(() => parseInternalAuthTokenOrThrow(invalidToken)).toThrowError('Invalid token');
+  });
+});

package/src/app-support/crypto/internal-token.ts

@@ -0,0 +1,82 @@
+import { getConst } from '../../libs/config';
+import { sign, verify } from './secret';
+
+export type InternalTokenClaims<CustomClaims extends object = object> =
+  CustomClaims & {
+    /** The token issuer */
+    iss: string;
+    /** Issued at */
+    iat: number;
+    /** Expires at */
+    exp: number;
+    /** The subject of the token. Should contain a string of the "service account" who bears the token. */
+    sub?: string;
+    /** The audience of the token. Should contain a string of who the token is intended for. */
+    aud?: string;
+  };
+
+class InternalTokenError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'InternalTokenError';
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+}
+
+function defaultClaims({
+  expiresInSeconds,
+  sub,
+  aud,
+}: {
+  expiresInSeconds: number;
+  sub?: string;
+  aud?: string;
+}): InternalTokenClaims {
+  return {
+    iss: `${getConst('project-name')}-internal`,
+    iat: Math.floor(Date.now() / 1000),
+    exp: Math.floor(Date.now() / 1000) + expiresInSeconds,
+    sub,
+    aud,
+  };
+}
+
+export function generateInternalAuthToken({
+  customClaims = {},
+  expiresInSeconds = 60,
+  sub,
+  aud,
+}: {
+  customClaims?: Record<string, string>;
+  expiresInSeconds?: number;
+  sub?: string;
+  aud?: string;
+} = {}) {
+  const data = {
+    ...customClaims,
+    // This should be after the customClaims so that custom claims cannot override the default claims
+    ...defaultClaims({ expiresInSeconds, sub, aud }),
+  };
+  const str = JSON.stringify(data);
+  const encodedData = Buffer.from(str).toString('base64');
+  const signature = sign(encodedData);
+  return `${encodedData}.${signature}`;
+}
+
+export function parseInternalAuthTokenOrThrow<CustomClaims extends object = object>(
+  token: string,
+): InternalTokenClaims<CustomClaims> {
+  const [encodedData, signature] = token.split('.');
+  const isSignatureOk = verify(encodedData, signature);
+  if (!isSignatureOk) {
+    throw new InternalTokenError('Invalid token');
+  }
+  const dataStr = Buffer.from(encodedData, 'base64').toString('utf-8');
+  const data: InternalTokenClaims<CustomClaims> = JSON.parse(dataStr);
+
+  if (data.exp < Math.floor(Date.now() / 1000)) {
+    throw new InternalTokenError('Token expired');
+  }
+
+  return data;
+}

package/src/app-support/crypto/secret.spec.ts

@@ -0,0 +1,18 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { sign, verify } from './secret';
+
+describe('sign and verify', () => {
+  beforeEach(() => {
+    process.env.MONOREPO_BASE_SECRET = '1234567890abcdef';
+  })
+
+  it('verify should return true for correct signature', async () => {
+    const sig = sign('data');
+    expect(verify('data', sig)).toEqual(true);
+  });
+
+  it('verify should return false for correct signature', async () => {
+    const sig = sign('data');
+    expect(verify('data2', sig)).toEqual(false);
+  });
+});

package/src/app-support/crypto/secret.ts

@@ -0,0 +1,13 @@
+import { createHmac } from 'crypto';
+
+export function sign(data: string) {
+  const keyStr = process.env.MONOREPO_BASE_SECRET;
+  if (!keyStr) throw new Error('Secret not set');
+  const key = Buffer.from(keyStr, 'hex');
+  return createHmac('sha256', key).update(data).digest('hex');
+}
+
+export function verify(data: string, signature: string) {
+  const generatedSignature = sign(data);
+  return generatedSignature === signature;
+}

package/src/app-support/discovery/dev-discovery-loader.ts

@@ -0,0 +1,35 @@
+import { workspaces } from "../../libs/discovery";
+
+let _portLookupByServiceName: Record<string, number> | null = null;
+
+function getPortLookup() {
+  if (_portLookupByServiceName) return _portLookupByServiceName;
+  if (process.env["IS_KUBERNETES"] === "true") {
+    throw new Error(
+      "getPortLookup() should only be used in local development. In production, the service name is sufficient."
+    );
+  }
+
+  _portLookupByServiceName = {};
+  Object.values(workspaces()).forEach((workspace) => {
+    workspace.packageDataEntries.forEach((pkg) => {
+      const serviceName = pkg.deployment?.service_name;
+      const port = pkg.deployment?.port;
+      if (!serviceName || !port) return;
+      const existing = _portLookupByServiceName![serviceName];
+      if (!existing) {
+        _portLookupByServiceName![serviceName] = port;
+      } else if (existing !== port) {
+        console.error(
+          `Service name ${serviceName} has conflicting ports: ${existing} and ${port}`
+        );
+        process.exit(1);
+      }
+    });
+  });
+  return _portLookupByServiceName;
+}
+
+export function getPortForServiceName(serviceName: string) {
+  return getPortLookup()[serviceName];
+}

package/src/app-support/discovery/service-endpoint.ts

@@ -0,0 +1,12 @@
+import { getPortForServiceName } from "./dev-discovery-loader";
+
+export function getServiceEndpoint(serviceName: string): string {
+  if (process.env["IS_KUBERNETES"] === "true") {
+    return `http://${serviceName}`;
+  }
+
+  const servicePort = getPortForServiceName(serviceName);
+  if (!servicePort)
+    throw new Error(`Port not found for service ${serviceName}`);
+  return `http://127.0.0.1:${servicePort}`;
+}

package/src/cli/affected.ts

@@ -0,0 +1,116 @@
+import {
+  findImagesAffected,
+  findImagesWithAffectedWorkspace,
+  isImageAffected,
+  isWorkspaceAffected,
+} from "../libs/affected-entities";
+import { getImageData } from "../libs/config";
+import { CLICommandParser, printUsageAndExit, StrongParams } from "./common";
+
+const oneLiner =
+  "Command to check whether an image or a workspace is affected by certain commit(s)";
+const keyExamples = `
+    $ devops affected list-images
+    $ devops affected workspace db --base <sha1> --head <sha2>
+    $ devops affected image main-node --from-live-version
+    $ devops affected find-migrator --from-live-version
+`;
+
+const usage = `
+${oneLiner}
+
+GENERAL USAGE
+  List
+    devops affected list-images --base [SHA1] --head [SHA2]
+    devops affected list-images --from-live-version
+
+    These return a list of all images affected by the given commits.
+
+  Checkers
+    devops affected workspace <workspace> --base [SHA1] --head [SHA2]
+
+    devops affected image     <image>     --base [SHA1] --head [SHA2]
+    devops affected image     <image>     --from-live-version
+
+    These return "true" or "false". 
+
+  Finders
+    devops affected find-migrator --base [SHA1] --head [SHA2]
+    devops affected find-migrator --from-live-version
+
+    When --base and --head are used, it checks whether the db project is affected. If it is, it returns the name of one random 
+    affected image.
+    When --from-live-version is used, it iterates on the live version of each image that depends on db, and returns the first image that is 
+    affected by a db project change since that commit.
+
+    If the db project is unaffected, returns an empty string.
+
+  Options
+    Which commits are regarded for the affected calculation can be changed using:
+    --base               Base of the current branch (HEAD^ by default)
+    --head               Latest commit of the current branch (HEAD by default)
+    --from-live-version  Use the live version of the image/workspace as the base (see devops image version get)
+
+    If --from-live-version is present, --base and --head are ignored.
+
+EXAMPLES
+    ${keyExamples.trim()}
+`;
+
+async function run(cmdObj: CLICommandParser) {
+  const options = cmdObj.parseOptions({
+    params: ["--base", "--head"],
+    booleans: ["--from-live-version"],
+  });
+  if (cmdObj.help || options.args.length < 1) printUsageAndExit(usage);
+  const baseSha = options.options["--base"]?.toString();
+  const headSha = options.options["--head"]?.toString();
+  const fromLiveVersion = Boolean(options.options["--from-live-version"]);
+  const commonOpts = {
+    baseSha,
+    headSha,
+    fromLiveVersion,
+    monorepoEnv: cmdObj.env,
+  };
+
+  const [cmd, imageOrWorkspace] = options.args;
+  const params = new StrongParams(usage, { imageOrWorkspace });
+
+  switch (cmd) {
+    case "list-images": {
+      console.log(findImagesAffected(commonOpts).join("\n"));
+      break;
+    }
+    case "workspace": {
+      // prettier-ignore
+      const affected = isWorkspaceAffected(params.required("imageOrWorkspace"), commonOpts);
+      console.log(affected ? "true" : "false");
+      break;
+    }
+    case "image": {
+      const affected = isImageAffected(
+        params.required("imageOrWorkspace"),
+        commonOpts
+      );
+      console.log(affected ? "true" : "false");
+      break;
+    }
+    case "find-migrator": {
+      const migrator = findImagesWithAffectedWorkspace("db", commonOpts)
+      if (!migrator.length) break;
+      const firstMigrator = migrator.find(imageName => getImageData(imageName)["can-db-migrate"]);
+      if (!firstMigrator) {
+        console.error(`The db project was changed and affects the following images: ${migrator.join(", ")}. However, no image in the list has can-db-migrate=true in .devops/config/images.yaml.`);
+        process.exit(1);
+      }
+      console.log(firstMigrator);
+      break;
+    }
+    default:
+      printUsageAndExit(usage);
+  }
+}
+
+export default {
+  affected: { oneLiner, keyExamples, run },
+};

package/src/cli/common.spec.ts

@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest';
+import { CLICommandParser } from './common';
+
+describe('CLICommandParser', () => {
+  // Extra white space intentional
+  const subject = new CLICommandParser(
+    'run tmp/test.sh --env production --in workspace    --flag arg'.split(' '),
+  );
+
+  it('constructor: builds object correctly', () => {
+    expect(subject.command).toEqual('run');
+    expect(subject.env).toEqual('production');
+    expect(subject.args).toEqual([
+      'tmp/test.sh',
+      '--in',
+      'workspace',
+      '--flag',
+      'arg',
+    ]);
+  });
+
+  describe('parseOptions', () => {
+    it('detects params and booleans', () => {
+      const res = subject.parseOptions({
+        params: ['--in'],
+        booleans: ['--flag'],
+      });
+      expect(res.args).toEqual(['tmp/test.sh', 'arg']);
+      expect(res.argsStr).toEqual('tmp/test.sh arg');
+      expect(res.options).toEqual({ '--in': 'workspace', '--flag': true });
+    });
+
+    it('leaves intact params that are not in the list', () => {
+      const res = subject.parseOptions();
+      expect(res.args).toEqual([
+        'tmp/test.sh',
+        '--in',
+        'workspace',
+        '--flag',
+        'arg',
+      ]);
+      expect(res.argsStr).toEqual('tmp/test.sh --in workspace --flag arg');
+      expect(res.options).toEqual({});
+    });
+
+    it('handles passthrough args when they exist', () => {
+      const altSubject = new CLICommandParser(
+        'run tmp/test.sh --env production --in workspace --flag arg -- p1 p2'.split(
+          ' ',
+        ),
+      );
+      const res = altSubject.parseOptions({
+        params: ['--in'],
+        booleans: ['--flag'],
+        passthroughArgs: true,
+      });
+      expect(res.args).toEqual(['tmp/test.sh', 'arg']);
+      expect(res.argsStr).toEqual('tmp/test.sh arg');
+      expect(res.options).toEqual({ '--in': 'workspace', '--flag': true });
+      expect(res.passthrough).toEqual(['p1', 'p2']);
+    });
+
+    it('handles passthrough args when they do not exist', () => {
+      const altSubject = new CLICommandParser(
+        'run tmp/test.sh --env production --in workspace --flag arg'.split(' '),
+      );
+      const res = altSubject.parseOptions({
+        params: ['--in'],
+        booleans: ['--flag'],
+        passthroughArgs: true,
+      });
+      expect(res.args).toEqual(['tmp/test.sh', 'arg']);
+      expect(res.argsStr).toEqual('tmp/test.sh arg');
+      expect(res.options).toEqual({ '--in': 'workspace', '--flag': true });
+      expect(res.passthrough).toEqual([]);
+    });
+  });
+});