@vaharoni/devops 1.2.13 → 1.2.14

package/dist/devops.js

@@ -1,74 +1,3229 @@
 #!/usr/bin/env bun
-// This file behaves as a façade for various devops scripts
-import { globSync } from "glob";
-import { CLICommandParser, printUsageAndExit } from "./cli/common";
-import * as coreImports from "./cli/core";
-import * as extensionImports from "./cli/extensions";
-import { getConst } from "./libs/config";
-import { existsSync, readdirSync } from "fs";
-import path from "path";
-const [_node, _scriptPath, ...commandArgs] = process.argv;
-// Presentation
-const newLine = "\n    ";
-function maxKeyLength(commands) {
-    return Math.max(...Object.keys(commands).map((x) => x.length)) + 10;
-}
-// Core commands
-const coreCommands = {};
-Object.entries(coreImports).forEach(([constKey, imported]) => {
-    const { oneLiner, keyExamples, run } = imported;
-    const key = 'command' in imported ? imported.command : constKey;
-    coreCommands[key] = { oneLiner, keyExamples, run, key };
+import {
+  InternalToken
+} from "./chunk-N7EX3HJH.js";
+import {
+  CLICommandParser,
+  CommandExecutor,
+  MISSING_DOMAIN_KEY_ERROR,
+  StrongParams,
+  applyHandler,
+  containerRegistryImageName,
+  containerRegistryPath,
+  containerRegistryRepoPath,
+  dbMigrateJobName,
+  domainNameForEnv,
+  dotEnvFilesForEnv,
+  envToNamespace,
+  imageConfigMap,
+  imageDebugName,
+  isLocalOrRemoteEnv,
+  kubectlCommand,
+  patchSecretKeyCommand,
+  pkgRoot,
+  printUsageAndExit,
+  secretName,
+  upsertConfigMapCommand
+} from "./chunk-WKP7EQNU.js";
+import {
+  IGNORED_PATHS,
+  __export,
+  getConst,
+  getImageData,
+  getImageNames,
+  getImageType,
+  getTemplateData,
+  getWorkspace,
+  globEnvYamlFiles,
+  workspaceDirectoryForLanguage
+} from "./chunk-RZ46YYZZ.js";
+
+// src/devops.ts
+import { globSync as globSync2 } from "glob";
+
+// src/cli/core/index.ts
+var core_exports = {};
+__export(core_exports, {
+  affected: () => affected,
+  cloudrun: () => cloudrun,
+  consoleCommand: () => consoleCommand,
+  constant: () => constant,
+  env: () => env,
+  exec: () => exec,
+  image: () => image,
+  init: () => init,
+  job: () => job,
+  namespace: () => namespace,
+  prepBuild: () => prepBuild,
+  registry: () => registry,
+  run: () => run,
+  runMany: () => runMany,
+  test: () => test
 });
-const coreCommandsKeyLength = maxKeyLength(coreCommands);
-// Extensions
-const extensionCommands = {};
-const activeExtensions = getConst('extensions', { ignoreIfInvalid: true });
-if (activeExtensions?.length) {
-    const availableExtensionsLookup = Object.fromEntries(Object.entries(extensionImports).map(([constKey, value]) => {
-        const { oneLiner, keyExamples, run } = value;
-        const keyInYaml = 'name' in value ? value.name : constKey;
-        const key = 'command' in value ? value.command : constKey;
-        return [keyInYaml, { oneLiner, keyExamples, run, key }];
-    }));
-    for (const extension of activeExtensions) {
-        const extensionData = availableExtensionsLookup[extension];
-        if (!extensionData) {
-            console.error(`\nExtension "${extension}" referenced in constants.yaml is not supported\n\n`);
-            process.exit(1);
+
+// src/cli/core/run.ts
+import path from "path";
+var execShPath = path.join(pkgRoot, "cli/exec.sh");
+var oneLiner = "Runs a script defined in package.json after injecting env variables";
+var keyExamples = `$ devops run project:test`;
+var usage = `
+${oneLiner}
+
+GENERAL USAGE
+    devops run <project-name>:<script-name> [--] [options for script]
+
+NOTES
+    - Only works for node projects. Use 'devopspy' for python projects.
+    - Does not allow interactive mode. If you need interactivity, use devops exec instead.
+
+EXAMPLES
+    ${keyExamples}
+`;
+async function runFn(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length === 0) printUsageAndExit(usage);
+  const [workspace, script] = cmdObj.args[0].split(":");
+  if (!workspace || !script) printUsageAndExit(usage);
+  const rootPath = getWorkspace(workspace).rootPath;
+  const remaining = cmdObj.args.slice(1).join(" ");
+  cmdObj.executorFromEnv(
+    `${execShPath} ${rootPath} bun run ${script} ${remaining}`,
+    { checkEnvYaml: true }
+  ).spawn();
+}
+var run = { oneLiner, keyExamples, run: runFn };
+
+// src/cli/core/run-many.ts
+import concurrently from "concurrently";
+var oneLiner2 = "Runs a script concurrently in all projects that define it in their package.json";
+var keyExamples2 = `
+    $ devops run-many build
+`.trim();
+var usage2 = `
+${oneLiner2}
+
+USAGE
+    devops run-many <script-name> [--kill-others-on-fail]
+
+NOTE
+    Only works for node projects. Use 'devopspy' for python projects.
+
+EXAMPLES
+    ${keyExamples2}
+`;
+async function run2(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length === 0) printUsageAndExit(usage2);
+  const parsed = cmdObj.parseOptions({ booleans: ["--kill-others-on-fail"] });
+  const [script] = parsed.args;
+  const remaining = parsed.args.slice(1).join(" ");
+  const commands = [];
+  Object.values(workspaceDirectoryForLanguage("node")).forEach(async (packageData) => {
+    if (packageData.scripts?.[script]) {
+      commands.push({
+        name: packageData.name,
+        command: `devops --env ${cmdObj.env} run ${packageData.name}:${script} ${remaining}`
+      });
+    }
+  });
+  if (!commands.length) {
+    console.error(`No workspaces define the script: ${script}`);
+    process.exit(0);
+  }
+  const options = parsed.options["--kill-others-on-fail"] ? { killOthers: "failure" } : {};
+  concurrently(commands, options).result.then(() => {
+  }).catch((error) => {
+    console.error("One of the commands failed");
+    process.exit(1);
+  });
+}
+var runMany = { command: "run-many", oneLiner: oneLiner2, keyExamples: keyExamples2, run: run2 };
+
+// src/cli/core/exec.ts
+import path2 from "path";
+var execShPath2 = path2.join(pkgRoot, "cli/exec.sh");
+var oneLiner3 = "Executes a command after injecting env variables, either globally or in a workspace";
+var keyExamples3 = `
+    $ devops exec tmp/test.sh
+    $ devops exec bun test.ts --in myworkspace --env staging
+`.trim();
+var usage3 = `
+${oneLiner3}
+
+USAGE
+    devops exec <command>
+    devops exec --in <workspace> <command>
+    devops exec --in <workspace> <command> --interactive
+
+EXAMPLES
+    ${keyExamples3}
+`;
+function run3(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length === 0) printUsageAndExit(usage3);
+  const parsed = cmdObj.parseOptions({
+    params: ["--in"],
+    booleans: ["--interactive"]
+  });
+  const workspace = parsed.options["--in"];
+  let executor;
+  if (workspace) {
+    const rootPath = getWorkspace(workspace).rootPath;
+    executor = cmdObj.executorFromEnv(
+      `${execShPath2} ${rootPath} ${parsed.argsStr}`,
+      { checkEnvYaml: true }
+    );
+  } else {
+    executor = cmdObj.executorFromEnv(parsed.argsStr, { checkEnvYaml: true });
+  }
+  const interactive = Boolean(parsed.options["--interactive"]);
+  if (interactive) {
+    executor.spawn();
+  } else {
+    executor.exec();
+  }
+}
+var exec = { oneLiner: oneLiner3, keyExamples: keyExamples3, run: run3 };
+
+// src/libs/discovery/dependencies.ts
+import chalk from "chalk";
+var WorkspaceDependencies = class {
+  constructor(getAllProjects) {
+    this.getAllProjects = getAllProjects;
+  }
+  dependencies = {};
+  loaded = false;
+  workspaces = {};
+  _getOrCreate(name) {
+    let node = this.dependencies[name];
+    if (!node) {
+      node = new DependencyNode(name);
+      this.dependencies[name] = node;
+    }
+    return node;
+  }
+  _buildTree() {
+    this.workspaces = this.getAllProjects();
+    this.loaded = true;
+    for (const workspace of Object.keys(this.workspaces)) {
+      const node = this._getOrCreate(workspace);
+      const data = this.workspaces[workspace];
+      for (const dep of data.dependencyNames ?? []) {
+        if (this.workspaces[dep]) {
+          node.dependsOn.add(dep);
         }
-        extensionCommands[extensionData.key] = extensionData;
-    }
-}
-const extensionCommandsKeyLength = maxKeyLength(extensionCommands);
-// Plugins
-const pluginCommands = {};
-if (existsSync('.devops/plugins')) {
-    const pluginsDir = path.join(process.cwd(), '.devops/plugins');
-    const pluginFiles = globSync(path.join(pluginsDir, '*.ts'));
-    for (const pluginFile of pluginFiles) {
-        const plugin = await import(pluginFile);
-        const keys = Object.keys(plugin);
-        if (keys.length !== 1) {
-            console.error(`Plugin ${pluginFile} must export exactly one command`);
+      }
+    }
+  }
+  getDependents(workspaceName) {
+    if (!this.loaded) {
+      this._buildTree();
+    }
+    const node = this.dependencies[workspaceName];
+    if (!node) {
+      console.error(chalk.red(`
+Workspace ${workspaceName} not found
+`));
+      process.exit(1);
+    }
+    return node.flattenDependents(this.dependencies);
+  }
+};
+var DependencyNode = class {
+  name;
+  dependsOn;
+  constructor(name) {
+    this.name = name;
+    this.dependsOn = /* @__PURE__ */ new Set();
+  }
+  flattenDependents(allDependencies, visited) {
+    visited ??= /* @__PURE__ */ new Set();
+    visited.add(this.name);
+    const notVisitedDependents = [];
+    for (const dep of this.dependsOn) {
+      if (!visited.has(dep)) {
+        const node = allDependencies[dep];
+        notVisitedDependents.push(
+          ...node.flattenDependents(allDependencies, visited)
+        );
+      }
+    }
+    return [this.name, ...notVisitedDependents];
+  }
+};
+
+// src/libs/discovery/images.ts
+var _imageDescendents = {};
+var _imageDescendentsLoaded = false;
+function imageDescendents() {
+  if (!_imageDescendentsLoaded) {
+    for (const imageName of getImageNames()) {
+      const descendents = /* @__PURE__ */ new Set();
+      const imageData = getImageData(imageName);
+      const workspaces = workspaceDirectoryForLanguage(imageData.language);
+      const dependencyResolver = new WorkspaceDependencies(() => workspaces);
+      imageData.applications.forEach((workspace) => {
+        dependencyResolver.getDependents(workspace).forEach((name) => descendents.add(name));
+      });
+      _imageDescendents[imageName] = Array.from(descendents).map((name) => workspaces[name]);
+    }
+    _imageDescendentsLoaded = true;
+  }
+  return _imageDescendents;
+}
+function getImageDescendentData(imageName) {
+  return imageDescendents()[imageName] ?? [];
+}
+var _workspaceImages = {};
+var _workspaceImagesLoaded = false;
+function workspaceImages() {
+  if (!_workspaceImagesLoaded) {
+    for (const [imageName, descendents] of Object.entries(imageDescendents())) {
+      for (const packageData of descendents) {
+        _workspaceImages[packageData.name] ??= [];
+        _workspaceImages[packageData.name].push(imageName);
+      }
+    }
+    _workspaceImagesLoaded = true;
+  }
+  return _workspaceImages;
+}
+function getWorkspaceImages(workspaceName) {
+  const _verifyPresence = getWorkspace(workspaceName);
+  return workspaceImages()[workspaceName] ?? [];
+}
+
+// src/libs/git-helpers.ts
+function commitExists(sha) {
+  const statusCode = new CommandExecutor(
+    `git merge-base --is-ancestor "${sha}" HEAD`
+  ).exec({ onlyStatusCode: true });
+  return statusCode === 0;
+}
+function isAffected(path8, opts = {}) {
+  const baseSha = opts.baseSha || "HEAD^";
+  const headSha = opts.headSha || "HEAD";
+  if (!opts.skipCheck && (!commitExists(baseSha) || !commitExists(headSha)))
+    return true;
+  const statusCode = new CommandExecutor(
+    `git diff --quiet ${baseSha} ${headSha} -- ${path8}`,
+    { quiet: true }
+  ).exec({ onlyStatusCode: true });
+  return statusCode !== 0;
+}
+
+// src/libs/k8s-image-config.ts
+function updateImageConfigMap(monorepoEnv, image2, data = {}) {
+  const imageConfigMapName = imageConfigMap(image2);
+  return new CommandExecutor(
+    upsertConfigMapCommand(monorepoEnv, imageConfigMapName, data)
+  ).exec();
+}
+function getImageConfigMap(monorepoEnv, image2) {
+  const imageConfigMapName = imageConfigMap(image2);
+  const { statusCode, stdout } = new CommandExecutor(
+    kubectlCommand(
+      `get configmap ${imageConfigMapName} -o jsonpath='{.data}'`,
+      { monorepoEnv }
+    ),
+    { quiet: true }
+  ).exec({ asObject: true });
+  if (statusCode !== 0 || !stdout) return {};
+  try {
+    return JSON.parse(stdout);
+  } catch {
+    console.error(
+      `Error parsing config map data for ${image2}. Received: ${stdout}`
+    );
+    process.exit(1);
+  }
+}
+function deserializeImageConfigMapKey(monorepoEnv, image2, key) {
+  const value = getImageConfigMap(monorepoEnv, image2)[key];
+  if (!value) return {};
+  try {
+    return JSON.parse(value);
+  } catch {
+    console.error(`Error parsing config map data for ${image2} for key ${key}. Received: ${value}`);
+    process.exit(1);
+  }
+}
+function getImageVersion(monorepoEnv, image2) {
+  const data = getImageConfigMap(monorepoEnv, image2);
+  return data.version;
+}
+function setImageVersion(monorepoEnv, image2, version) {
+  const data = getImageConfigMap(monorepoEnv, image2);
+  return updateImageConfigMap(monorepoEnv, image2, { ...data, version });
+}
+function deleteImageVersion(monorepoEnv, image2) {
+  const { version, ...rest } = getImageConfigMap(monorepoEnv, image2);
+  return updateImageConfigMap(monorepoEnv, image2, rest);
+}
+function setK8sScale(monorepoEnv, workspaceName, replicaCount) {
+  const workspaceData = getWorkspace(workspaceName);
+  const serviceName = workspaceData.packageDataEntries.find((x) => x.deployment?.service_name)?.deployment?.service_name;
+  if (!serviceName) {
+    console.error(
+      `Workspace ${workspaceName} must have a service_name defined in its deployment key in package.json. Skipping.`
+    );
+    return false;
+  }
+  new CommandExecutor(
+    kubectlCommand(
+      `scale deployment ${workspaceName} --replicas=${replicaCount}`,
+      { monorepoEnv }
+    )
+  ).exec();
+  return true;
+}
+function setWorkspaceScale(monorepoEnv, image2, workspaceName, replicaCount) {
+  const workspaceData = getWorkspace(workspaceName);
+  if (!workspaceData.packageDataEntries.find((x) => x.deployment)) {
+    console.error(`Workspace ${workspaceName} does not have deployment data.`);
+    process.exit(1);
+  }
+  if (replicaCount < 1) {
+    console.error("Replica count must be at least 1.");
+    process.exit(1);
+  }
+  const { scale: _scale, ...rest } = getImageConfigMap(monorepoEnv, image2);
+  const parsedScale = deserializeImageConfigMapKey(monorepoEnv, image2, "scale");
+  const isApplicable2 = setK8sScale(monorepoEnv, workspaceName, replicaCount);
+  if (!isApplicable2) return;
+  updateImageConfigMap(monorepoEnv, image2, {
+    ...rest,
+    scale: JSON.stringify({
+      ...parsedScale,
+      [workspaceName]: replicaCount
+    })
+  });
+  return parsedScale?.[workspaceName] ?? 1;
+}
+function getWorkspaceScale(monorepoEnv, image2, workspaceName) {
+  const parsedScale = deserializeImageConfigMapKey(monorepoEnv, image2, "scale");
+  if (!workspaceName) return parsedScale ?? {};
+  const _ensureWorkspace = getWorkspace(workspaceName);
+  return parsedScale?.[workspaceName] ?? 1;
+}
+function resetWorkspaceScale(monorepoEnv, image2, workspaceName) {
+  const { scale: _scale, ...rest } = getImageConfigMap(monorepoEnv, image2);
+  const parsedScale = deserializeImageConfigMapKey(monorepoEnv, image2, "scale");
+  if (!workspaceName) {
+    updateImageConfigMap(monorepoEnv, image2, rest);
+    Object.entries(parsedScale ?? {}).filter(([_name, scale]) => Number(scale) > 1).forEach(([name, _scale2]) => {
+      setK8sScale(monorepoEnv, name, 1);
+    });
+    return parsedScale;
+  } else {
+    const oldScale = parsedScale?.[workspaceName] ?? 1;
+    const newScale = { ...parsedScale };
+    delete newScale[workspaceName];
+    updateImageConfigMap(monorepoEnv, image2, { ...rest, scale: JSON.stringify(newScale) });
+    setK8sScale(monorepoEnv, workspaceName, 1);
+    return oldScale;
+  }
+}
+
+// src/libs/affected-entities.ts
+function isImageAffected(image2, opts = {}) {
+  const headSha = opts.headSha ?? "HEAD";
+  let baseSha;
+  if (opts.fromLiveVersion) {
+    if (!opts.monorepoEnv) {
+      throw new Error("monorepoEnv is required when fromLiveVersion is true");
+    }
+    baseSha = getImageVersion(opts.monorepoEnv, image2);
+    if (!baseSha) return true;
+  }
+  baseSha ??= opts.baseSha ?? "HEAD^";
+  const descendentData = getImageDescendentData(image2);
+  if (!commitExists(baseSha) || !commitExists(headSha)) return true;
+  for (const { rootPath } of descendentData) {
+    if (isAffected(rootPath, { baseSha, headSha, skipCheck: true })) {
+      return true;
+    }
+  }
+  return false;
+}
+function findImagesAffected(opts = {}) {
+  return getImageNames().filter(
+    (imageName) => isImageAffected(imageName, opts)
+  );
+}
+function isWorkspaceAffected(workspaceName, opts = {}) {
+  const data = getWorkspace(workspaceName);
+  return isAffected(data.rootPath, opts);
+}
+function findImagesWithAffectedWorkspace(workspaceName, opts = {}) {
+  const res = [];
+  const headSha = opts.headSha ?? "HEAD";
+  const defaultBaseSha = opts.baseSha ?? "HEAD^";
+  const rootPath = getWorkspace(workspaceName).rootPath;
+  if (opts.fromLiveVersion && !opts.monorepoEnv) {
+    throw new Error("monorepoEnv is required when fromLiveVersion is true");
+  }
+  for (const imageName of getWorkspaceImages(workspaceName)) {
+    const baseSha = opts.fromLiveVersion ? getImageVersion(opts.monorepoEnv, imageName) : defaultBaseSha;
+    if (isAffected(rootPath, { baseSha, headSha })) {
+      res.push(imageName);
+    }
+  }
+  return res;
+}
+
+// src/cli/core/affected.ts
+var oneLiner4 = "Command to check whether an image or a workspace is affected by certain commit(s)";
+var keyExamples4 = `
+    $ devops affected list-images
+    $ devops affected workspace db --base <sha1> --head <sha2>
+    $ devops affected image main-node --from-live-version
+    $ devops affected find-migrator --from-live-version
+`;
+var usage4 = `
+${oneLiner4}
+
+GENERAL USAGE
+  List
+    devops affected list-images --base [SHA1] --head [SHA2]
+    devops affected list-images --from-live-version
+
+    These return a list of all images affected by the given commits.
+
+  Checkers
+    devops affected workspace <workspace> --base [SHA1] --head [SHA2]
+
+    devops affected image     <image>     --base [SHA1] --head [SHA2]
+    devops affected image     <image>     --from-live-version
+
+    These return "true" or "false". 
+
+  Finders
+    devops affected find-migrator --base [SHA1] --head [SHA2]
+    devops affected find-migrator --from-live-version
+
+    When --base and --head are used, it checks whether the db project is affected. If it is, it returns the name of one random 
+    affected image.
+    When --from-live-version is used, it iterates on the live version of each image that depends on db, and returns the first image that is 
+    affected by a db project change since that commit.
+
+    If the db project is unaffected, returns an empty string.
+
+  Options
+    Which commits are regarded for the affected calculation can be changed using:
+    --base               Base of the current branch (HEAD^ by default)
+    --head               Latest commit of the current branch (HEAD by default)
+    --from-live-version  Use the live version of the image/workspace as the base (see devops image version get)
+
+    If --from-live-version is present, --base and --head are ignored.
+
+EXAMPLES
+    ${keyExamples4.trim()}
+`;
+async function run4(cmdObj) {
+  const options = cmdObj.parseOptions({
+    params: ["--base", "--head"],
+    booleans: ["--from-live-version"]
+  });
+  if (cmdObj.help || options.args.length < 1) printUsageAndExit(usage4);
+  const baseSha = options.options["--base"]?.toString();
+  const headSha = options.options["--head"]?.toString();
+  const fromLiveVersion = Boolean(options.options["--from-live-version"]);
+  const commonOpts = {
+    baseSha,
+    headSha,
+    fromLiveVersion,
+    monorepoEnv: cmdObj.env
+  };
+  const [cmd, imageOrWorkspace] = options.args;
+  const params = new StrongParams(usage4, { imageOrWorkspace });
+  switch (cmd) {
+    case "list-images": {
+      console.log(findImagesAffected(commonOpts).join("\n"));
+      break;
+    }
+    case "workspace": {
+      const affected2 = isWorkspaceAffected(params.required("imageOrWorkspace"), commonOpts);
+      console.log(affected2 ? "true" : "false");
+      break;
+    }
+    case "image": {
+      const affected2 = isImageAffected(
+        params.required("imageOrWorkspace"),
+        commonOpts
+      );
+      console.log(affected2 ? "true" : "false");
+      break;
+    }
+    case "find-migrator": {
+      const migrator = findImagesWithAffectedWorkspace("db", commonOpts);
+      if (!migrator.length) break;
+      const firstMigrator = migrator.find((imageName) => getImageData(imageName)["can-db-migrate"]);
+      if (!firstMigrator) {
+        console.error(`The db project was changed and affects the following images: ${migrator.join(", ")}. However, no image in the list has can-db-migrate=true in .devops/config/images.yaml.`);
+        process.exit(1);
+      }
+      console.log(firstMigrator);
+      break;
+    }
+    default:
+      printUsageAndExit(usage4);
+  }
+}
+var affected = { oneLiner: oneLiner4, keyExamples: keyExamples4, run: run4 };
+
+// src/libs/cloudrun-helpers.ts
+import { randomBytes } from "crypto";
+
+// src/libs/k8s-secrets-manager.ts
+var SECRET_FILE_NAME = "env_json";
+function execUpdateSecret(monorepoEnv, secretValue) {
+  const { fullCommand, redactedCommand } = patchSecretKeyCommand(monorepoEnv, secretName(), SECRET_FILE_NAME, JSON.stringify(secretValue));
+  new CommandExecutor(fullCommand, { quiet: true, redactedCommand }).exec();
+}
+function getMonorepoSecretObject(monorepoEnv, keys = []) {
+  const escapedSecretFileName = SECRET_FILE_NAME.replaceAll(".", "\\.");
+  const cmd = kubectlCommand(`get secrets/${secretName()} -o jsonpath="{.data['${escapedSecretFileName}']}"`, { monorepoEnv });
+  const res = new CommandExecutor(cmd, { quiet: true }).exec();
+  if (!res) return {};
+  const resJson = JSON.parse(atob(res));
+  if (!keys || keys.length === 0) return resJson;
+  return Object.fromEntries(
+    keys.filter((x) => resJson[x]).map((x) => [x, resJson[x]])
+  );
+}
+function updateSecret(monorepoEnv, vars) {
+  if (!vars || Object.keys(vars).length === 0) {
+    console.error(
+      "Keys-value pairs to set must be provided, e.g. KEY1=val1 KEY2=val2"
+    );
+    process.exit(1);
+  }
+  const current = getMonorepoSecretObject(monorepoEnv);
+  const newVars = { ...current, ...vars };
+  execUpdateSecret(monorepoEnv, newVars);
+}
+function deleteSecretKeys(monorepoEnv, keys = []) {
+  if (!keys?.length) {
+    console.error("Keys to delete must be provided");
+    process.exit(1);
+  }
+  const secretValue = getMonorepoSecretObject(monorepoEnv);
+  keys.forEach((key) => delete secretValue[key]);
+  execUpdateSecret(monorepoEnv, secretValue);
+}
+function getMonorepoSecretStr(monorepoEnv, keys = []) {
+  const value = getMonorepoSecretObject(monorepoEnv, keys);
+  if (keys.length === 1) {
+    return Object.values(value)[0];
+  }
+  return Object.entries(value).map((pair) => pair.join("=")).join("\n");
+}
+function setMonorepoSecret(monorepoEnv, pairs = []) {
+  const pairsObj = Object.fromEntries(
+    pairs.map((x) => {
+      const [key, ...values] = x.split("=");
+      return [key, values.join("=")];
+    })
+  );
+  updateSecret(monorepoEnv, pairsObj);
+}
+function deleteMonorepoSecret(monorepoEnv, keys = []) {
+  deleteSecretKeys(monorepoEnv, keys);
+}
+
+// src/libs/cloudrun-helpers.ts
+import chalk2 from "chalk";
+function verifyCloudrunImage(image2) {
+  const imageData = getImageData(image2);
+  if (!imageData["cloudrun"]) {
+    console.error(`Image ${image2} is not a cloudrun image. Add "cloudrun: true" in images.yaml`);
+    process.exit(1);
+  }
+}
+function getEnvValuesToForward(env2, forwardEnv) {
+  if (!forwardEnv.length) return {};
+  let envValues = {};
+  const missingValues = /* @__PURE__ */ new Set();
+  for (const key of forwardEnv) {
+    const value = process.env[key];
+    if (value) {
+      envValues[key] = value;
+    } else {
+      missingValues.add(key);
+    }
+  }
+  if (missingValues.size > 0 && isLocalOrRemoteEnv(env2) === "remote") {
+    const secretsFromCluster = getMonorepoSecretObject(env2, Array.from(missingValues));
+    for (const key of Object.keys(secretsFromCluster)) {
+      envValues[key] = secretsFromCluster[key];
+      missingValues.delete(key);
+    }
+  }
+  if (missingValues.size > 0) {
+    console.error(`Some forwardEnv variables are missing: ${Array.from(missingValues).join(", ")}`);
+    process.exit(1);
+  }
+  return envValues;
+}
+async function buildDev(image2) {
+  verifyCloudrunImage(image2);
+  const env2 = "development";
+  const sha = randomBytes(12).toString("hex");
+  const buildDir = new CommandExecutor(`devops prep-build ${image2}`, {
+    env: env2,
+    quiet: true
+  }).exec().trim();
+  const tag = containerRegistryRepoPath(image2, env2, sha);
+  console.warn(`Building ${tag} from ${buildDir}`);
+  await new CommandExecutor(
+    `docker build --platform linux/amd64 -t ${tag} ${buildDir} --build-arg MONOREPO_ENV=${env2}`,
+    { env: env2 }
+  ).spawn({ pipeStdoutTo: "stderr" });
+  console.warn(`Pushing ${tag}`);
+  await new CommandExecutor(`docker push ${tag}`, { env: env2 }).spawn({ pipeStdoutTo: "stderr" });
+  console.warn(`
+\u2705 Built and pushed ${tag}
+`);
+  console.warn('Run "devops cloudrun deploy" next. For example:');
+  console.warn(chalk2.blue(`./devops cloudrun deploy ${image2} ${sha} --env ${env2} --allow-unauthenticated --region us-east1 --forward-env ENV1,ENV2 -- --service-account RUNTIME_SA`));
+  console.warn(chalk2.yellow(`
+
+RUNTIME_SA is the name of the service account used to run the Cloud Run service.`));
+  console.warn(chalk2.yellow(`Find it with "gcloud iam service-accounts list"
+`));
+  console.log(sha);
+}
+async function deploy({
+  image: image2,
+  env: env2,
+  sha,
+  region,
+  forwardEnv = [],
+  allowUnauthenticated = false,
+  cpu = "0.25",
+  memory = "256Mi",
+  minInstances = 0,
+  maxInstances = 1,
+  timeout = "60s",
+  extraArgs = ""
+}) {
+  verifyCloudrunImage(image2);
+  const repoPath = containerRegistryRepoPath(image2, env2, sha);
+  const envValues = getEnvValuesToForward(env2, forwardEnv);
+  const envValuesCsv = Object.entries(envValues).map(([key, value]) => `${key}="${value}"`).join(",");
+  const serviceName = `${image2}-${env2}`;
+  const cmd = `
+    gcloud run deploy ${serviceName} 
+      --image ${repoPath} 
+      ${Object.keys(envValues).length > 0 ? `--set-env-vars ${envValuesCsv}` : ""} 
+      ${allowUnauthenticated ? "--allow-unauthenticated" : ""}
+      --region ${region}
+      --cpu ${cpu}
+      --memory ${memory}
+      --min-instances ${minInstances}
+      --max-instances ${maxInstances}
+      --timeout ${timeout}
+      ${extraArgs}
+  `.trim().replace(/\s+/g, " ");
+  await new CommandExecutor(cmd, { env: env2 }).spawn();
+}
+
+// src/cli/core/cloudrun.ts
+var oneLiner5 = "Supports cloudrun images";
+var keyExamples5 = `
+    $ devops cloudrun deploy cloudrun-image SHA --env staging --region us-east1 [--forward-env ENV1,ENV2 --allow-unauthenticated]
+    $ devops cloudrun build-dev cloudrun-image
+`.trim();
+var usage5 = `
+${oneLiner5}
+
+USAGE
+  Configuration prerequisites:
+    - The image should be defined in images.yaml with:
+      cloudrun: true
+    - The artifact registry URL should be set in config/constants.yaml:
+      cloudrun-artifact-registry-repo-path: REGION-docker.pkg.dev/PROJECT_ID/REPO
+
+  Deploy a cloudrun image to Cloud Run:
+    devops cloudrun deploy <image> <sha> --env <env> --region <region> [options]
+
+    Options:
+      --forward-env ENV1,ENV2     Comma-separated env var names to forward into the service
+      --allow-unauthenticated     Allow unauthenticated access
+      --cpu <cpu>                 CPU, e.g. 0.25, 0.5, 1
+      --memory <mem>              Memory, e.g. 256Mi, 512Mi, 1Gi
+      --min-instances <n>         Minimum instances
+      --max-instances <n>         Maximum instances
+      --timeout <time>            Request timeout, e.g. 60s
+      --                          Pass through additional args to gcloud (e.g. -- --ingress internal)
+
+      Notes: 
+      - The image must already be pushed to the artifact registry.
+      - <env> also supports local environments (e.g. development).
+      - For remote monorepo environments, variables specified in --forward-env that 
+        are not present in the current process's env are fetched from the cluster.
+
+  Build a cloudrun image locally in development environment:
+    devops cloudrun build-dev cloudrun-image
+
+    This command builds the image locally with a random SHA and pushes it to the artifact registry.
+
+EXAMPLES
+    ${keyExamples5}
+`;
+var handlers = {
+  "build-dev": (opts) => {
+    buildDev(opts.required("image"));
+  },
+  _deploy: (opts) => {
+    const rawForwardEnv = opts.optional("forwardEnv");
+    const forwardEnv = rawForwardEnv ? rawForwardEnv.split(",").map((v) => v.trim()).filter(Boolean) : [];
+    const minInstancesStr = opts.optional("minInstances");
+    const maxInstancesStr = opts.optional("maxInstances");
+    deploy({
+      image: opts.required("image"),
+      env: opts.required("env"),
+      sha: opts.required("sha"),
+      region: opts.required("region"),
+      forwardEnv,
+      allowUnauthenticated: opts.optional("allowUnauthenticated") === "true",
+      cpu: opts.optional("cpu"),
+      memory: opts.optional("memory"),
+      minInstances: minInstancesStr ? Number(minInstancesStr) : void 0,
+      maxInstances: maxInstancesStr ? Number(maxInstancesStr) : void 0,
+      timeout: opts.optional("timeout"),
+      extraArgs: opts.optional("extraArgs")
+    });
+  }
+};
+async function run5(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length === 0) printUsageAndExit(usage5);
+  const parsed = cmdObj.parseOptions({
+    params: [
+      "--keep-last",
+      "--forward-env",
+      "--region",
+      "--cpu",
+      "--memory",
+      "--min-instances",
+      "--max-instances",
+      "--timeout",
+      "--sha"
+    ],
+    booleans: ["--allow-unauthenticated"],
+    passthroughArgs: true
+  });
+  const [subcommand, image2, sha] = parsed.args;
+  if (subcommand === "deploy") {
+    cmdObj.executorFromEnv(
+      `devops cloudrun _deploy ${cmdObj.args.slice(1).join(" ")}`,
+      { checkEnvYaml: false }
+    ).spawn();
+    return;
+  }
+  const handler = handlers[subcommand];
+  if (!handler) {
+    console.error(`Unknown subcommand: ${subcommand}`);
+    printUsageAndExit(usage5);
+  }
+  const params = new StrongParams(usage5, {
+    env: cmdObj.env,
+    subcommand,
+    image: image2,
+    sha,
+    keepLast: parsed.options["--keep-last"],
+    forwardEnv: parsed.options["--forward-env"],
+    region: parsed.options["--region"],
+    allowUnauthenticated: parsed.options["--allow-unauthenticated"] ? "true" : void 0,
+    cpu: parsed.options["--cpu"],
+    memory: parsed.options["--memory"],
+    minInstances: parsed.options["--min-instances"],
+    maxInstances: parsed.options["--max-instances"],
+    timeout: parsed.options["--timeout"],
+    extraArgs: parsed.passthrough ? parsed.passthrough.join(" ") : void 0
+  });
+  handler(params);
+}
+var cloudrun = { oneLiner: oneLiner5, keyExamples: keyExamples5, run: run5 };
+
+// src/libs/k8s-namespace.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var BASE_SECRET_KEY = "baseSecret";
+function checkEnvSetup(monorepoEnv) {
+  const namespace2 = envToNamespace(monorepoEnv);
+  const exitCode = new CommandExecutor(
+    kubectlCommand(`get ns ${namespace2}`)
+  ).exec({
+    onlyStatusCode: true
+  });
+  return exitCode === 0;
+}
+function createNamespace(monorepoEnv) {
+  new CommandExecutor(kubectlCommand(`create ns ${envToNamespace(monorepoEnv)}`)).exec();
+}
+function createEmptyEnvSecret(monorepoEnv) {
+  const cmd = kubectlCommand(`create secret generic ${secretName()}`, { namespace: envToNamespace(monorepoEnv) });
+  new CommandExecutor(cmd).exec();
+}
+function patchBaseSecret(monorepoEnv) {
+  const { fullCommand, redactedCommand } = patchSecretKeyCommand(
+    monorepoEnv,
+    secretName(),
+    BASE_SECRET_KEY,
+    randomBytes2(32).toString("hex")
+  );
+  new CommandExecutor(fullCommand, { quiet: true, redactedCommand }).exec();
+}
+function deleteNamespace(monorepoEnv) {
+  const cmd = kubectlCommand(`delete ns ${envToNamespace(monorepoEnv)}`);
+  new CommandExecutor(cmd).exec();
+}
+
+// src/libs/k8s-generate.ts
+import path3 from "path";
+import yaml from "yaml";
+import fs from "fs";
+import { globSync } from "glob";
+import _ from "lodash";
+import Handlebars from "handlebars";
+var MANIFEST_FOLDER_PATH = path3.join(process.cwd(), ".devops/manifests");
+var MANIFEST_INDEX_FILE_PATH = path3.join(MANIFEST_FOLDER_PATH, "_index.yaml");
+var DB_MIGRATE_TEMPLATE_NAME = "db-migrate";
+function verifyNotCloudrunImage(image2) {
+  const imageData = getImageData(image2);
+  if (imageData["cloudrun"]) {
+    console.error(`Image ${image2} is a cloudrun image. Cloudrun images are not supported for k8s generation`);
+    process.exit(1);
+  }
+}
+function generateImageDeployments(monorepoEnv, image2, gitSha) {
+  verifyNotCloudrunImage(image2);
+  const generator = new ImageContextGenerator(monorepoEnv, image2, gitSha);
+  const apps = getImageDescendentData(image2).filter((packageData) => packageData.deployment).flatMap((projectData) => {
+    const context = generator.getDeployment(projectData);
+    const renderFn = (template2) => Handlebars.compile(template2)(context);
+    return generateManifestForDeployment(projectData.rootPath, projectData.deployment.template, renderFn);
+  });
+  const manifest = apps.filter(Boolean).join("\n---\n");
+  return ensureProperDomainsPresent(manifest, monorepoEnv, image2);
+}
+function generateWorkspaceDeployment(packageData, monorepoEnv, image2, gitSha) {
+  verifyNotCloudrunImage(image2);
+  const generator = new ImageContextGenerator(monorepoEnv, image2, gitSha);
+  const context = generator.getDeployment(packageData);
+  const renderFn = (template2) => Handlebars.compile(template2)(context);
+  const manifest = generateManifestForDeployment(packageData.rootPath, packageData.deployment.template, renderFn).join("\n---\n");
+  return ensureProperDomainsPresent(manifest, monorepoEnv, image2);
+}
+function generateDebugPod(monorepoEnv, image2, gitSha) {
+  verifyNotCloudrunImage(image2);
+  const generator = new ImageContextGenerator(monorepoEnv, image2, gitSha);
+  const context = generator.getDebug();
+  const renderFn = (template2) => Handlebars.compile(template2)(context);
+  const debugTemplate = getImageData(image2)["debug-template"];
+  if (!debugTemplate) return;
+  return generateManifestsFromTemplateName(debugTemplate, renderFn, { validate: false }).map((x) => yaml.stringify(x)).join("\n---\n");
+}
+function generateDbMigrateJob(monorepoEnv, image2, gitSha) {
+  verifyNotCloudrunImage(image2);
+  const generator = new ImageContextGenerator(monorepoEnv, image2, gitSha);
+  const context = generator.getDbMigrate();
+  const renderFn = (template2) => Handlebars.compile(template2)(context);
+  return generateManifestsFromTemplateName(DB_MIGRATE_TEMPLATE_NAME, renderFn).map((x) => yaml.stringify(x)).join("\n---\n");
+}
+function ensureProperDomainsPresent(manifest, monorepoEnv, image2) {
+  if (manifest.includes(MISSING_DOMAIN_KEY_ERROR)) {
+    console.error(`The image ${image2} does not have a domain defined for the environment ${monorepoEnv}. Please add it to the .devops/config/images.yaml.`);
+    process.exit(1);
+  }
+  return manifest;
+}
+function generateManifestForDeployment(rootPath, templateName, renderFn) {
+  const defaults = generateManifestsFromTemplateName(templateName, renderFn);
+  const overrides = generateManifestFromFilesInFolder(rootPath, renderFn);
+  const keyExtractor = (manifest) => `${manifest.kind}-${manifest.metadata.name}`;
+  const defaultTemplateLookup = _.keyBy(defaults, keyExtractor);
+  const overrideTemplateLookup = _.keyBy(overrides, keyExtractor);
+  const mergedTemplates = _.merge(defaultTemplateLookup, overrideTemplateLookup);
+  return Object.values(mergedTemplates).map((x) => yaml.stringify(x));
+}
+function generateManifestsFromTemplateName(templateName, renderFn, options = { validate: true }) {
+  const entries = manifestFilesForTemplate(templateName);
+  if (!entries) {
+    console.error(`No entries found for ${templateName} in ${MANIFEST_INDEX_FILE_PATH}`);
+    process.exit(1);
+  }
+  return generateManifestsFromFileList(entries.map((entry) => path3.join(MANIFEST_FOLDER_PATH, entry)), renderFn, options);
+}
+function generateManifestFromFilesInFolder(folderPath, renderFn) {
+  const manifestOverridePath = path3.join(folderPath, "manifests");
+  if (!fs.existsSync(manifestOverridePath)) {
+    return [];
+  }
+  const files = globSync(path3.join(manifestOverridePath, "**/*")).filter((x) => fs.lstatSync(x).isFile());
+  return generateManifestsFromFileList(files, renderFn);
+}
+function generateManifestsFromFileList(filesList, renderFn, options = { validate: true }) {
+  return filesList.flatMap((filePath) => {
+    try {
+      const manifestFileStr = fs.readFileSync(filePath, "utf8");
+      const renderedStr = renderFn(manifestFileStr);
+      const res = yaml.parseAllDocuments(renderedStr);
+      if (options.validate) {
+        res.forEach((doc) => {
+          if (!doc.get("kind") || !doc.getIn(["metadata", "name"])) {
+            console.error(`Invalid manifest file ${filePath}: kind and metadata.name must be present`);
+            console.error(doc.toString());
             process.exit(1);
+          }
+        });
+      }
+      return res.map((x) => x.toJSON());
+    } catch (e) {
+      if (e instanceof Error) {
+        console.error(`Could not parse ${filePath}: ${e.message}`);
+      } else {
+        console.error(`Could not parse ${filePath}`);
+      }
+      process.exit(1);
+    }
+  });
+}
+var _manifestIndex;
+function manifestFilesForTemplate(template2) {
+  if (!_manifestIndex) {
+    try {
+      const indexFileStr = fs.readFileSync(MANIFEST_INDEX_FILE_PATH, "utf8");
+      _manifestIndex = yaml.parse(indexFileStr);
+    } catch {
+      console.error(`Unable to process ${MANIFEST_INDEX_FILE_PATH}`);
+      process.exit(1);
+    }
+  }
+  return _manifestIndex[template2];
+}
+var ImageContextGenerator = class {
+  constructor(monorepoEnv, image2, gitSha) {
+    this.monorepoEnv = monorepoEnv;
+    this.image = image2;
+    this.gitSha = gitSha;
+    this.replicaMap = getWorkspaceScale(monorepoEnv, image2);
+    this.imageContext = {
+      monorepo_env: monorepoEnv,
+      namespace: envToNamespace(monorepoEnv),
+      env_secret_name: secretName(),
+      env_base_secret_key: BASE_SECRET_KEY,
+      domain_name: domainNameForEnv(image2, monorepoEnv),
+      image_path: containerRegistryRepoPath(image2, monorepoEnv, gitSha)
+    };
+  }
+  replicaMap;
+  imageContext;
+  getDeployment(pkgData) {
+    if (!pkgData.deployment) {
+      console.error(`The deployment key is missing for workspace ${pkgData.name}`);
+      process.exit(1);
+    }
+    return {
+      // Basic context
+      project_name: pkgData.name,
+      ...this.imageContext,
+      // Defaults that can be overriden by pkgData.deployment
+      app_name: pkgData.name,
+      subdomain: pkgData.deployment.service_name,
+      // This may override the defaults above
+      ...pkgData.deployment,
+      // Override from config map
+      replicas: this.replicaMap[pkgData.name] ?? 1
+    };
+  }
+  getDbMigrate() {
+    return {
+      ...this.imageContext,
+      db_migrate_job_name: dbMigrateJobName(this.gitSha)
+    };
+  }
+  getDebug() {
+    return {
+      ...this.imageContext,
+      debug_pod_name: imageDebugName(this.image)
+    };
+  }
+};
+
+// src/cli/core/console.ts
+import yaml2 from "yaml";
+var oneLiner6 = "Spin up a debug pod of the specified image and get a shell into it.";
+var keyExamples6 = `
+$ devops console main-node
+`.trim();
+var usage6 = `
+${oneLiner6}
+
+USAGE
+    devops console <image> [--version <version>]
+
+    Options:
+      --version <version>    The version (git SHA) of the image to use. 
+                             If not specified, the live version of the image (obtained using 'devops image version get <image>') is used.
+
+EXAMPLES
+  ${keyExamples6}
+`;
+function run6(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length === 0) printUsageAndExit(usage6);
+  const parsed = cmdObj.parseOptions({ params: ["--version"] });
+  if (parsed.args.length !== 1) printUsageAndExit(usage6);
+  const image2 = parsed.args[0];
+  const version = parsed.options["--version"];
+  const gitSha = version ?? getImageVersion(cmdObj.env, image2);
+  if (!gitSha) {
+    console.error(`No git SHA found for image ${image2} in environment ${cmdObj.env}`);
+    process.exit(1);
+  }
+  const debugYaml = generateDebugPod(cmdObj.env, image2, gitSha);
+  if (!debugYaml) {
+    console.error(`The image ${image2} does not specify debug-template in images.yaml`);
+    process.exit(1);
+  }
+  const userName = new CommandExecutor(`kubectl auth whoami -o jsonpath='{.status.userInfo.username}'`).exec();
+  const debugManifestsJson = JSON.stringify(yaml2.parse(debugYaml));
+  const randomId = Math.random().toString(36).substring(2, 10);
+  const podName = ["ephemeral-console", slugify(userName), slugify(image2), randomId].filter(Boolean).join("-");
+  new CommandExecutor(
+    kubectlCommand(
+      `run ${podName} --restart=Never --rm -it --image=overridden --overrides='${debugManifestsJson}'`,
+      { monorepoEnv: cmdObj.env }
+    )
+  ).spawn();
+}
+function slugify(str, maxLength = 20) {
+  return str.toLowerCase().trim().replace(/[^a-zA-Z0-9]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, maxLength);
+}
+var consoleCommand = { command: "console", oneLiner: oneLiner6, keyExamples: keyExamples6, run: run6 };
+
+// src/cli/core/constant.ts
+var oneLiner7 = "Prints to stdout a constant from constant.yaml";
+var keyExamples7 = `$ devops constant infra`;
+var usage7 = `
+${oneLiner7}
+
+GENERAL USAGE
+    devops constant <constant-name>
+
+EXAMPLES
+    ${keyExamples7}
+`;
+async function run7(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length === 0) printUsageAndExit(usage7);
+  const [constant2] = cmdObj.args;
+  console.log(getConst(constant2));
+}
+var constant = { oneLiner: oneLiner7, keyExamples: keyExamples7, run: run7 };
+
+// src/libs/validate-env.ts
+import fs2 from "fs";
+import yaml3 from "yaml";
+var CombinedEnvValidator = class {
+  envYamlPaths;
+  dotEnvPaths;
+  yamlValidators = [];
+  dotEnvParsers = [];
+  keysFromYamlFiles = /* @__PURE__ */ new Set();
+  keysFromDotEnvFiles = {};
+  errors = {};
+  warnings = [];
+  constructor(envYamlPaths, dotEnvPaths = []) {
+    this.envYamlPaths = envYamlPaths.filter(
+      (path8) => !IGNORED_PATHS.some((ignoredPath) => path8.includes(ignoredPath))
+    );
+    this.dotEnvPaths = dotEnvPaths;
+  }
+  validate() {
+    this._handleYamlFiles();
+    this._handleDotEnvFiles();
+    this._finalize();
+  }
+  _handleYamlFiles() {
+    this._loadYamlFiles(this.envYamlPaths);
+    this._validateYamlFiles();
+    this._haltIfParsingErrors();
+    this._extractErrors();
+  }
+  _handleDotEnvFiles() {
+    this._loadDotEnvFiles(this.dotEnvPaths);
+    this._parseDotEnvFiles();
+    this._combineDotEnvFiles();
+    this._extractWarnings();
+  }
+  _loadYamlFiles(envYamlPaths) {
+    envYamlPaths.forEach((path8) => {
+      const validator = new SingleEnvValidator(path8);
+      this.yamlValidators.push(validator);
+    });
+  }
+  _validateYamlFiles() {
+    this.yamlValidators.forEach((x) => x.validate());
+  }
+  _haltIfParsingErrors() {
+    const filesWithParsingErrors = this.yamlValidators.filter(
+      (validator) => Boolean(validator.parsingError)
+    );
+    if (filesWithParsingErrors.length === 0) return;
+    console.error("The following env.yaml files have parsing errors:");
+    filesWithParsingErrors.forEach((validator) => {
+      console.error(`	${validator.parsingError}`);
+    });
+    process.exit(1);
+  }
+  _extractErrors() {
+    this.yamlValidators.forEach((validator) => {
+      Object.keys(validator.parsedEnvYaml ?? {}).forEach((envVar) => {
+        this.keysFromYamlFiles.add(envVar);
+      });
+      Object.entries(validator.errors).forEach(([envVar, error]) => {
+        this.errors[envVar] ??= [];
+        this.errors[envVar].push(error);
+      });
+    });
+  }
+  _loadDotEnvFiles(dotEnvPaths = []) {
+    dotEnvPaths.forEach((path8) => {
+      const parser = new DotEnvParser(path8);
+      this.dotEnvParsers.push(parser);
+    });
+  }
+  _parseDotEnvFiles() {
+    this.dotEnvParsers.forEach((x) => x.parse());
+  }
+  _combineDotEnvFiles() {
+    this.dotEnvParsers.forEach((parser) => {
+      if (!parser.keys) return;
+      parser.keys.forEach((key) => {
+        this.keysFromDotEnvFiles[key] ??= [];
+        this.keysFromDotEnvFiles[key].push(parser.path);
+      });
+    });
+  }
+  _extractWarnings() {
+    const unusedKeys = Object.keys(this.keysFromDotEnvFiles).filter(
+      (x) => !this.keysFromYamlFiles.has(x)
+    );
+    unusedKeys.forEach((x) => {
+      this.warnings.push(`${x} in: ${this.keysFromDotEnvFiles[x].join(", ")}`);
+    });
+  }
+  _finalize() {
+    if (this.warnings.length > 0) {
+      console.error(
+        "WARNING: some env variables exist in .env but not in env.yaml:"
+      );
+      this.warnings.forEach((warning) => console.error(`	${warning}`));
+      console.error();
+    }
+    if (Object.keys(this.errors).length > 0) {
+      Object.entries(this.errors).forEach(([key, errors]) => {
+        console.error(`Errors for ${key}:`);
+        errors.forEach((error) => console.error(`	${error}`));
+        console.error();
+      });
+      console.error();
+      process.exit(1);
+    }
+  }
+};
+var DotEnvParser = class {
+  path;
+  keys;
+  constructor(path8) {
+    this.path = path8;
+  }
+  parse() {
+    const text = this._readFile(this.path);
+    if (text) this.keys = this._parse(text);
+  }
+  _readFile(path8) {
+    if (!fs2.existsSync(path8)) return;
+    return fs2.readFileSync(path8).toString();
+  }
+  _parse(text) {
+    const lines = text.split("\n");
+    const withoutComments = lines.map((x) => x.replace(/#.*$/, "").trim()).filter(Boolean);
+    const keys = withoutComments.map((x) => x.split("=").map((y) => y.trim())).filter((x) => x.length > 1).map((x) => x[0]);
+    return keys;
+  }
+};
+var SingleEnvValidator = class {
+  envYamlPath;
+  parsedEnvYaml;
+  parsingError;
+  errors = {};
+  constructor(envYamlPath) {
+    this.envYamlPath = envYamlPath;
+  }
+  validate() {
+    this.parsedEnvYaml = this._parse();
+    if (!this.parsingError) this._addAllErrors();
+  }
+  _readFile() {
+    if (!fs2.existsSync(this.envYamlPath)) {
+      console.error(`Skipping ${this.envYamlPath}: does not exist`);
+      return;
+    }
+    return yaml3.parse(fs2.readFileSync(this.envYamlPath).toString());
+  }
+  _generateError(message) {
+    return `Error in ${this.envYamlPath}: ${message}`;
+  }
+  _setParsingError(message) {
+    this.parsingError = this._generateError(message);
+  }
+  _addError(key, message) {
+    this.errors[key] = this._generateError(message);
+  }
+  _parse() {
+    const allEnv = {};
+    const envManifest = this._readFile();
+    if (!envManifest) return;
+    if (!(envManifest instanceof Array)) {
+      this._setParsingError(`env.yaml file must resolve to an array`);
+      return;
+    }
+    envManifest.forEach((env2) => {
+      if (env2 instanceof Object) {
+        const entries = Object.entries(env2);
+        if (entries.length > 1) {
+          this._setParsingError(
+            `every object in env.yaml must have one key. Error near: ${entries[0][0]}`
+          );
+          return;
         }
-        const constKey = keys[0];
-        const { oneLiner, keyExamples, run, command } = plugin[constKey];
-        const key = command ?? constKey;
-        if (!oneLiner || !keyExamples || !run) {
-            console.error(`Plugin ${pluginFile} must export oneLiner, keyExamples, and run`);
-            process.exit(1);
+        const [name, value] = entries[0];
+        if (!(value instanceof Array) && !["optional", "boolean"].includes(value)) {
+          this._setParsingError(
+            `invalid value for ${name}: ${JSON.stringify(value)}`
+          );
+          return;
         }
-        if (typeof run !== 'function') {
-            console.error(`Plugin ${pluginFile} must export a run function`);
-            process.exit(1);
+        allEnv[name] = value;
+      } else {
+        allEnv[env2] = "required";
+      }
+    });
+    return allEnv;
+  }
+  _addAllErrors() {
+    Object.entries(this.parsedEnvYaml).forEach(([key, requirement]) => {
+      const value = process.env[key];
+      if (requirement !== "optional" && !value) {
+        this._addError(key, `${key} is required but missing`);
+      } else if (requirement === "boolean" && !["true", "false"].includes(String(value))) {
+        this._addError(
+          key,
+          `${key} must be either true or false. Value: ${value}`
+        );
+      } else if (requirement instanceof Array && !requirement.includes(value ?? "")) {
+        this._addError(
+          key,
+          `${key} must be one of ${requirement.join(", ")}. Value: ${value}`
+        );
+      }
+    });
+  }
+};
+
+// src/cli/core/env.ts
+var oneLiner8 = "Commands to manipulate env variables";
+var keyExamples8 = `
+$ devops env get --env staging
+$ devops env get KEY1 KEY2 --env staging
+$ devops env set KEY1=123 KEY2=345 --env staging
+$ devops env delete KEY1 KEY2 --env staging
+$ devops env validate
+`;
+var usage8 = `
+${oneLiner8}
+
+COMMANDS
+  get         Fetches secrets for the chosen environment and printes them to console
+  set         Sets specific secrets for the chosen environment
+  delete      Deletes specific secrets for the chosen environment
+  validate    Validate locally, verifying the existence and type of environment variables against all env.yaml files
+
+EXAMPLES
+  ${keyExamples8}
+`;
+function run8(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length === 0) printUsageAndExit(usage8);
+  const [command, ...rest] = cmdObj.args;
+  switch (command) {
+    case "validate": {
+      const envYamlFiles = globEnvYamlFiles();
+      cmdObj.executorFromEnv(
+        `devops env _validate ${envYamlFiles.join(" ")}`,
+        { quiet: false }
+      ).exec();
+      break;
+    }
+    case "_validate": {
+      const options = cmdObj.parseOptions({ booleans: ["--skip-dotenv"] });
+      const [_subcmd, ...envYamlFiles] = options.args;
+      const envFiles = options.options["--skip-dotenv"] ? [] : dotEnvFilesForEnv(cmdObj.env);
+      const validator = new CombinedEnvValidator(envYamlFiles, envFiles);
+      validator.validate();
+      break;
+    }
+    case "get": {
+      console.log(getMonorepoSecretStr(cmdObj.env, rest));
+      break;
+    }
+    case "set": {
+      setMonorepoSecret(cmdObj.env, rest);
+      break;
+    }
+    case "delete": {
+      deleteMonorepoSecret(cmdObj.env, rest);
+      break;
+    }
+    default: {
+      printUsageAndExit(usage8);
+    }
+  }
+}
+var env = { oneLiner: oneLiner8, keyExamples: keyExamples8, run: run8 };
+
+// src/cli/core/image.ts
+var oneLiner9 = "Applies image-related manifests, retrieves or set the version deployed, and scales deployments of applications";
+var keyExamples9 = `
+    $ devops image get        type   main-node
+    $ devops image deployment gen    main-node sha  --env staging
+    $ devops image deployment create main-node sha  --env staging
+    $ devops image deployment delete main-node      --env staging
+    $ devops image version    get    main-node      --env staging
+    $ devops image version    set    main-node sha  --env staging
+    $ devops image version    unset  main-node      --env staging
+    $ devops image scale      get    main-node       --env staging
+    $ devops image scale      get    main-node www   --env staging
+    $ devops image scale      set    main-node www 3 --env staging
+    $ devops image scale      unset  main-node       --env staging
+    $ devops image scale      unset  main-node www   --env staging
+`.trim();
+var usage9 = `
+${oneLiner9}
+
+GET IMAGE TYPE
+    devops image get type <image-name>
+
+    Returns "k8s" or "cloudrun" depending on the image type.
+
+GENERATING DEPLOYMENT MANIFESTS
+    devops image deployment gen|create|delete <image-name> <sha>
+
+    gen     - generates the manifest file with all applications that are deployed with the image
+    create  - generates the manifest file and then runs kubectl apply
+    delete  - generates the manifest file and then runs kubectl delete
+
+MANAGINE APPLICATION SCALE
+    devops image scale get|unset <image-name> [<workspace-name>]
+    devops image scale set <image-name> <workspace-name> <replica-count>
+
+    set    - sets the scale count in the image's config map so that it persists across deployments. 
+    get    - retrieves the current scale count. If workspace is not provided, all workspaces are returned.
+    unset  - resets the scale count by removing the key from the image's config map. If workspace is not provided, all workspaces are reset.
+
+    Both 'set' and 'unset' return the previous scale count prior to the operation.
+
+MANAGING IMAGE VERSIONS
+    devops image version get|unset <image> 
+    devops image version set <image> <sha>
+
+    Meant to be called during deployment in order to maintain a record of the most recent deployed version.
+
+EXAMPLES
+    ${keyExamples9}
+`;
+var handlers2 = {
+  get: {
+    type: (opts) => {
+      console.log(getImageType(opts.required("image")));
+    }
+  },
+  deployment: {
+    gen: (opts) => {
+      console.log(
+        generateImageDeployments(
+          opts.required("env"),
+          opts.required("image"),
+          opts.required("sha")
+        )
+      );
+    },
+    create: (opts) => {
+      applyHandler(
+        "apply-deployment-",
+        "apply",
+        generateImageDeployments(
+          opts.required("env"),
+          opts.required("image"),
+          opts.required("sha")
+        )
+      );
+    },
+    delete: (opts) => {
+      applyHandler(
+        "delete-deployment-",
+        "delete",
+        generateImageDeployments(
+          opts.required("env"),
+          opts.required("image"),
+          "dummy-sha"
+        )
+      );
+    }
+  },
+  scale: {
+    set: (opts) => {
+      const workspace = opts.required("workspace");
+      const image2 = opts.required("image");
+      const replicas = Number(opts.required("replicas"));
+      const res = setWorkspaceScale(
+        opts.required("env"),
+        image2,
+        workspace,
+        replicas
+      );
+      if (res) {
+        console.warn(
+          `Scale for ${workspace} in ${image2} set to ${replicas}. Previous value:`
+        );
+        console.log(res);
+      }
+    },
+    get: (opts) => {
+      const workspace = opts.optional("workspace");
+      if (!workspace) {
+        console.log(
+          getWorkspaceScale(
+            opts.required("env"),
+            opts.required("image")
+          )
+        );
+      } else {
+        console.log(
+          getWorkspaceScale(
+            opts.required("env"),
+            opts.required("image"),
+            workspace
+          )
+        );
+      }
+    },
+    unset: (opts) => {
+      const image2 = opts.required("image");
+      const workspace = opts.optional("workspace");
+      const prev = resetWorkspaceScale(opts.required("env"), image2, workspace);
+      if (workspace) {
+        console.warn(`Scale for ${workspace} in ${image2} unset. Previous scale:`);
+        console.log(prev);
+      } else {
+        console.warn(
+          `Scale for all workspaces in ${image2} unset. Previous scale:`
+        );
+        console.log(prev);
+      }
+    }
+  },
+  version: {
+    get: (opts) => {
+      const version = getImageVersion(
+        opts.required("env"),
+        opts.required("image")
+      );
+      console.log(version ?? "");
+    },
+    set: (opts) => {
+      setImageVersion(
+        opts.required("env"),
+        opts.required("image"),
+        opts.required("sha")
+      );
+    },
+    unset: (opts) => {
+      deleteImageVersion(
+        opts.required("env"),
+        opts.required("image")
+      );
+    }
+  }
+};
+function run9(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length < 1) printUsageAndExit(usage9);
+  const [command, subcommand, image2, param1, param2] = cmdObj.args;
+  const commandHandler = handlers2[command];
+  if (!commandHandler) {
+    console.error(`Unknown command: ${command}`);
+    printUsageAndExit(usage9);
+  }
+  const handler = commandHandler[subcommand];
+  if (!handler) {
+    console.error(`Unknown subcommand: ${subcommand}`);
+    printUsageAndExit(usage9);
+  }
+  function getExtraParams() {
+    if (command === "get") {
+      return {};
+    } else if (command === "scale") {
+      return subcommand === "set" ? { workspace: param1, replicas: param2 } : { workspace: param1 };
+    } else {
+      return { sha: param1 };
+    }
+  }
+  const params = new StrongParams(usage9, {
+    env: cmdObj.env,
+    subcommand,
+    image: image2,
+    ...getExtraParams()
+  });
+  handler(params);
+}
+var image = { oneLiner: oneLiner9, keyExamples: keyExamples9, run: run9 };
+
+// src/cli/core/init.ts
+import inquirer from "inquirer";
+
+// src/libs/init-generator.ts
+import path4 from "path";
+import fs3 from "fs-extra";
+import chalk3 from "chalk";
+import fg from "fast-glob";
+var templatesDir = path4.join(pkgRoot, "src/target-templates");
+var targetDir = process.cwd();
+var InitGenerator = class {
+  projectName;
+  /** The key is targetRel */
+  files = {};
+  constructor() {
+    if (fs3.existsSync("package.json")) {
+      const packageJson = fs3.readJSONSync("package.json");
+      this.projectName = packageJson.name;
+    }
+  }
+  _ensureFileExists(targetRel) {
+    if (!this.files[targetRel]) {
+      throw new Error(`File for target "${targetRel}" not found.`);
+    }
+  }
+  enableSubtitution(targetRel) {
+    this._ensureFileExists(targetRel);
+    if (this.files[targetRel].type !== "copied") {
+      throw new Error(`File for target "${targetRel}" is not a copied file.`);
+    }
+    this.files[targetRel].enableSubstitution = true;
+  }
+  setMessageGenerator(targetRel, messageGen) {
+    this._ensureFileExists(targetRel);
+    this.files[targetRel].messageGenerator = messageGen;
+  }
+  addGeneratedFile(targetRel, content) {
+    const targetAbs = path4.join(targetDir, targetRel);
+    const targetFolderAbs = path4.dirname(targetAbs);
+    const exists = fs3.existsSync(targetAbs);
+    this.files[targetRel] = {
+      type: "generated",
+      targetRel,
+      targetAbs,
+      targetFolderAbs,
+      targetExists: exists,
+      content
+    };
+  }
+  /**
+   * @param source relative path under the templates folder. All files and folders under `source` are copied directly under `target`.
+   * @param target relative path under the project root folder.
+   * If the target file exists already in `files`, it will be overridden.
+   */
+  addCopiedFolder(source, target) {
+    const pathPrefix = path4.join(templatesDir, source);
+    const glob = path4.join(pathPrefix, "**/*");
+    fg.globSync(glob, { dot: true }).forEach((sourceAbs) => {
+      const sourceRel = path4.relative(templatesDir, sourceAbs);
+      const pathUnderSource = path4.relative(pathPrefix, sourceAbs);
+      const targetRel = path4.join(target, pathUnderSource);
+      const targetAbs = path4.join(targetDir, targetRel);
+      const targetFolderAbs = path4.dirname(targetAbs);
+      const exists = fs3.existsSync(targetAbs);
+      this.files[targetRel] = {
+        type: "copied",
+        sourceRel,
+        targetRel,
+        sourceAbs,
+        targetAbs,
+        targetFolderAbs,
+        targetExists: exists
+      };
+    });
+  }
+  run({
+    substitution = {},
+    messages = []
+  }) {
+    const fileMessages = [];
+    Object.values(this.files).forEach((fileInfo) => {
+      if (fileInfo.messageGenerator) {
+        const message = fileInfo.messageGenerator(fileInfo.targetExists, fileInfo);
+        if (message) {
+          fileMessages.push(message);
         }
-        pluginCommands[key] = { oneLiner, keyExamples, run, key };
+      }
+      if (fileInfo.targetExists) {
+        console.log(`Skipped ${chalk3.yellow(fileInfo.targetRel)} (exists)`);
+        return;
+      }
+      if (!fs3.existsSync(fileInfo.targetFolderAbs)) {
+        fs3.mkdirSync(fileInfo.targetFolderAbs, { recursive: true });
+      }
+      if (fileInfo.type === "generated") {
+        fs3.writeFileSync(fileInfo.targetAbs, fileInfo.content, "utf8");
+      } else if (fileInfo.enableSubstitution) {
+        const content = fs3.readFileSync(fileInfo.sourceAbs, "utf8");
+        const substitutedContent = content.replace(/\$([A-Z_]+)/g, (_2, varName) => {
+          const value = substitution[varName];
+          if (!value) {
+            throw new Error(`${chalk3.blue("TemplateCopier.run()")}: Variable ${chalk3.yellow(varName)} is needed by ${chalk3.yellow(fileInfo.targetRel)} but is undefined.`);
+          }
+          return value;
+        });
+        fs3.writeFileSync(fileInfo.targetAbs, substitutedContent);
+      } else {
+        fs3.copySync(fileInfo.sourceAbs, fileInfo.targetAbs, {
+          overwrite: false,
+          errorOnExist: false,
+          dereference: false
+        });
+      }
+      console.log(`Created ${chalk3.green(fileInfo.targetRel)}`);
+    });
+    const allMessages = [...messages, ...fileMessages];
+    if (!allMessages.length) return;
+    console.log(chalk3.blue("\nNext steps:"));
+    allMessages.forEach((msg, i) => {
+      console.log(`${i + 1}. ${msg}
+`);
+    });
+  }
+};
+
+// src/cli/core/init.ts
+import chalk4 from "chalk";
+import fs4 from "fs-extra";
+var oneLiner10 = "Initializes the devops utility by copying template files to the current folder";
+var keyExamples10 = `$ devops init`;
+var usage10 = `
+${oneLiner10}
+
+NOTE
+    No files are overwritten.
+
+EXAMPLES
+    ${keyExamples10}
+`;
+async function run10(cmdObj) {
+  if (cmdObj.help) printUsageAndExit(usage10);
+  createFiles();
+}
+var init = { oneLiner: oneLiner10, keyExamples: keyExamples10, run: run10 };
+async function createFiles() {
+  const tc = new InitGenerator();
+  const userChoices = await getUserChoices(tc.projectName);
+  tc.addCopiedFolder("lang-variants-common/typescript", ".");
+  if (userChoices.usePython) {
+    tc.addCopiedFolder("lang-variants-common/python", ".");
+    tc.enableSubtitution("pyproject.toml");
+  }
+  tc.enableSubtitution(".devops/config/images.yaml");
+  tc.setMessageGenerator(".envrc", envrcMessage);
+  const gitIgnore = gitIgnoreContent(userChoices.infraVariant, userChoices.usePython);
+  tc.addGeneratedFile(".gitignore", gitIgnore);
+  tc.setMessageGenerator(".gitignore", gitignoreMessageGen(gitIgnore));
+  tc.addCopiedFolder(`infra-variants/${userChoices.infraVariant}`, ".");
+  tc.enableSubtitution(".devops/config/constants.yaml");
+  if (userChoices.infraVariant === "hetzner") {
+    tc.enableSubtitution(".devops/infra/hetzner/harbor-cert.yaml");
+    tc.enableSubtitution(".devops/infra/hetzner/harbor-values.yaml");
+    tc.enableSubtitution(".devops/infra/hetzner/hcloud-config.yaml");
+  }
+  if (userChoices.usePrisma) {
+    tc.addCopiedFolder("lang-variants-prisma/typescript", ".");
+    if (userChoices.usePython) {
+      tc.addCopiedFolder("lang-variants-prisma/python", ".");
+    }
+  }
+  const clusterResources = new Set(userChoices.clusterResources);
+  if (clusterResources.has("dns-test")) {
+    tc.addCopiedFolder("cluster-resource-options/dns-test", ".devops/infra/dns-test");
+  }
+  if (clusterResources.has("monitoring-ingress")) {
+    tc.addCopiedFolder("cluster-resource-options/monitoring-ingress", ".devops/infra/monitoring-ingress");
+  }
+  if (clusterResources.has("postgres")) {
+    tc.addCopiedFolder("cluster-resource-options/postgres", ".devops/infra/postgres");
+    tc.enableSubtitution(".devops/infra/postgres/staging/configurations/07-SGObjectStorage.yaml");
+    tc.enableSubtitution(".devops/infra/postgres/staging/configurations/08-SGScript.yaml");
+    tc.enableSubtitution(".devops/infra/postgres/production/configurations/07-SGObjectStorage.yaml");
+    tc.enableSubtitution(".devops/infra/postgres/production/configurations/08-SGScript.yaml");
+  }
+  if (clusterResources.has("redis")) {
+    tc.addCopiedFolder("cluster-resource-options/redis", ".devops/infra/redis");
+  }
+  if (clusterResources.has("milvus")) {
+    tc.addCopiedFolder("cluster-resource-options/milvus", ".devops/infra/milvus");
+  }
+  if (clusterResources.has("prefect") && userChoices.usePython) {
+    tc.addCopiedFolder("cluster-resource-options/prefect", ".devops/infra/prefect");
+  }
+  tc.run({
+    substitution: {
+      "PROJECT_NAME": userChoices.projectName,
+      "STAGING_DOMAIN": userChoices.stagingDomain,
+      "PRODUCTION_DOMAIN": userChoices.productionDomain,
+      "GCLOUD_PROJECT_ID": userChoices.gcloudProjectId,
+      "REGISTRY_IMAGE_PATH_PREFIX": userChoices.registryImagePathPrefix,
+      "REGISTRY_BASE_URL": userChoices.registryBaseUrl
+    },
+    messages: [
+      packageJsonMessage(userChoices.usePrisma)
+    ]
+  });
+}
+function packageJsonMessage(usePrisma) {
+  const prismaMessage = usePrisma ? `,
+    "db/**",
+    "dml/**"` : "";
+  return `add the following entry to the main ${chalk4.blue("package.json")}:
+  ${chalk4.yellow(`"workspaces": [
+    "libs/**",
+    "applications/**"${prismaMessage}
+  ],`)}`;
+}
+function gitIgnoreContent(infraVariant, usePython) {
+  const common = `**/.env*
+config/kubeconfig
+tmp/**
+!tmp/**/.gitkeep`;
+  const gcloud = infraVariant === "gcloud" ? "config/gke_gcloud_auth_plugin_cache" : null;
+  const python = usePython ? `venv/
+**/__pycache__` : null;
+  return [common, gcloud, python].filter(Boolean).join("\n");
+}
+function gitignoreMessageGen(content) {
+  return (exists) => {
+    if (!exists) return;
+    return `add the following to your ${chalk4.blue(".gitignore")}:
+${chalk4.yellow(content)}`;
+  };
+}
+function envrcMessage(targetExists, fileInfo) {
+  if (fileInfo.type !== "copied") throw new Error(`envrcMessage() expects a copied file, got ${fileInfo.type}`);
+  if (targetExists) {
+    const content = fs4.readFileSync(fileInfo.sourceAbs, "utf-8");
+    return `add the following to your ${chalk4.blue(".envrc")} and run ${chalk4.yellow("direnv allow")}:
+${chalk4.yellow(content)}`;
+  } else {
+    return `Enable ${chalk4.blue(".envrc")} by installing ${chalk4.blue("direnv")} and running ${chalk4.yellow("direnv allow")}`;
+  }
+}
+function getUserChoices(projectName) {
+  const defaultProjectName = projectName || "changeme";
+  return inquirer.prompt([
+    {
+      type: "input",
+      name: "projectName",
+      message: `Enter the project name (default: '${defaultProjectName}')`,
+      default: defaultProjectName
+    },
+    {
+      type: "input",
+      name: "stagingDomain",
+      message: "Enter the staging domain (default: 'staging.com')",
+      default: "staging.com"
+    },
+    {
+      type: "input",
+      name: "productionDomain",
+      message: "Enter the production domain (default: 'production.com')",
+      default: "production.com"
+    },
+    {
+      type: "list",
+      name: "infraVariant",
+      message: "Where does your cluster run?",
+      choices: [
+        { name: "Google Cloud", value: "gcloud" },
+        { name: "Digital Ocean", value: "digitalocean" },
+        { name: "Hetzner", value: "hetzner" }
+      ]
+    },
+    {
+      type: "input",
+      name: "gcloudProjectId",
+      message: "Enter the GCP project ID (default: 'changeme')",
+      default: "changeme",
+      when: (answers) => answers.infraVariant === "gcloud"
+    },
+    {
+      type: "input",
+      name: "registryImagePathPrefix",
+      message: (answers) => `Enter your Digital Ocean container registry name (default: '${answers.projectName}')`,
+      default: (answers) => answers.projectName,
+      when: (answers) => answers.infraVariant === "digitalocean"
+    },
+    {
+      type: "input",
+      name: "registryBaseUrl",
+      message: (answers) => `Enter your registry base URL (default: 'registry.${answers.stagingDomain}')`,
+      default: (answers) => `registry.${answers.stagingDomain}`,
+      when: (answers) => answers.infraVariant === "hetzner"
+    },
+    {
+      type: "confirm",
+      name: "usePython",
+      message: "Add support for Python?",
+      default: true
+    },
+    {
+      type: "confirm",
+      name: "usePrisma",
+      message: "Add support for Prisma?",
+      default: true
+    },
+    {
+      type: "checkbox",
+      name: "clusterResources",
+      message: "Optional manifests and helm charts to add",
+      choices: (answers) => [
+        { name: "Manifest to test DNS setup", value: "dns-test" },
+        { name: "Manifest to setup ingress for graphana and prometheus", value: "monitoring-ingress" },
+        { name: "Stackgres CRDs and manifests for Postgres", value: "postgres" },
+        { name: "Redis Helm chart values", value: "redis" },
+        { name: "Milvus helm chart values", value: "milvus" },
+        ...answers.usePython ? [{ name: "Prefect Helm chart values", value: "prefect" }] : []
+      ]
+    }
+  ]);
+}
+
+// src/libs/k8s-job-waiter.ts
+var POLL_INTERVAL_SEC = 1;
+var K8sJobWaiter = class {
+  constructor(monorepoEnv, timeoutInS) {
+    this.monorepoEnv = monorepoEnv;
+    this.namespace = envToNamespace(monorepoEnv);
+    this.jobStatuses = {};
+    this.timeoutInMs = timeoutInS * 1e3;
+  }
+  timeoutInMs;
+  namespace;
+  jobStatuses;
+  async pollJob(job2) {
+    const startTime = Date.now();
+    while (true) {
+      const res = await this.fetchStatus(job2);
+      const elapsed = Date.now() - startTime;
+      if (res.failure > 0) {
+        const error = await this.fetchError(job2);
+        this.jobStatuses[job2] = { status: "failure", elapsed, error };
+        return;
+      }
+      if (res.success > 0) {
+        this.jobStatuses[job2] = { status: "success", elapsed };
+        return;
+      }
+      if (elapsed >= this.timeoutInMs) {
+        this.jobStatuses[job2] = { status: "timeout", elapsed };
+        return;
+      }
+      await new Promise((res2) => setTimeout(res2, POLL_INTERVAL_SEC * 1e3));
+    }
+  }
+  async fetchStatus(job2) {
+    const result = new CommandExecutor(
+      kubectlCommand(
+        `get job ${job2} -o jsonpath='{.status.failed},{.status.succeeded}'`,
+        { namespace: this.namespace }
+      )
+    ).exec();
+    const [failure, success] = result.split(",").map((x) => Number(x));
+    return { failure, success };
+  }
+  async fetchError(job2) {
+    try {
+      const podName = new CommandExecutor(
+        kubectlCommand(`get pod -l job-name=${job2} -o name`, {
+          namespace: this.namespace
+        })
+      ).exec();
+      const logs = new CommandExecutor(
+        kubectlCommand(`logs ${podName}`, { namespace: this.namespace })
+      ).exec();
+      return logs;
+    } catch (e) {
+      console.log("Error fetching logs for job", { job: job2, e });
+      return `<COULD NOT FETCH ERROR FOR ${job2}>`;
+    }
+  }
+};
+async function k8sJobWaiter(monorepoEnv, timeoutInS, jobs) {
+  const waiter = new K8sJobWaiter(monorepoEnv, timeoutInS);
+  await Promise.all(jobs.map((job2) => waiter.pollJob(job2)));
+  return waiter.jobStatuses;
+}
+function printJobStatuses(statuses) {
+  console.log("Statuses:");
+  Object.entries(statuses).forEach(([job2, statusRecord]) => {
+    console.log(
+      `${job2}: ${statusRecord.status} ${Math.round(statusRecord.elapsed / 1e3 * 100) / 100}s`
+    );
+  });
+  console.log();
+  Object.entries(statuses).filter(([_2, statusRecord]) => statusRecord.status === "failure").forEach(([job2, statusRecord]) => {
+    console.error(`Error for ${job2}:`);
+    console.error(statusRecord.error);
+    console.error();
+  });
+  const failures = Object.entries(statuses).filter(
+    ([_2, statusRecord]) => ["failure", "timeout"].includes(statusRecord.status)
+  );
+  if (failures.length > 0) {
+    console.error();
+    console.error(
+      `Some jobs did not succeed: ${failures.map(([job2, _2]) => job2).join(", ")}`
+    );
+    console.error();
+    process.exit(1);
+  }
+  Object.entries(statuses).forEach(([job2, statusRecord]) => {
+    console.log(`${job2}: ${statusRecord.status}`);
+  });
+}
+
+// src/cli/core/job.ts
+var oneLiner11 = "Creates a k8s job and waits for it to run";
+var keyExamples11 = `
+    $ devops job db-migrate gen    main-node <sha> --env staging
+    $ devops job db-migrate create main-node <sha> --env staging --timeout 120
+`.trim();
+var usage11 = `
+${oneLiner11}
+
+GENERAL USAGE
+    devops job db-migrate gen    <image> <sha>
+    devops job db-migrate create <image> <sha> --timeout <timeout>
+
+EXAMPLES
+    ${keyExamples11}
+`;
+var handlers3 = {
+  gen: (opts) => {
+    console.log(
+      generateDbMigrateJob(opts.required("env"), opts.required("image"), opts.required("sha"))
+    );
+  },
+  create: async (opts) => {
+    const env2 = opts.required("env");
+    const image2 = opts.required("image");
+    const sha = opts.required("sha");
+    const timeout = opts.optional("timeout") ?? "240";
+    const manifest = generateDbMigrateJob(env2, image2, sha);
+    const jobName = dbMigrateJobName(sha);
+    applyHandler(`apply-${jobName}`, "apply", manifest);
+    const statuses = await k8sJobWaiter(env2, Number(timeout ?? "240"), [jobName]);
+    if (statuses && Object.keys(statuses).length > 0) {
+      printJobStatuses(statuses);
+    }
+  }
+};
+function run11(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length < 1) printUsageAndExit(usage11);
+  const parsedArgs = cmdObj.parseOptions({
+    params: ["--timeout"]
+  });
+  const [jobName, command, image2, sha] = parsedArgs.args;
+  if (jobName !== "db-migrate") {
+    console.error(`Unknown job: ${jobName}. Only db-migrate is supported at this time.`);
+    process.exit(1);
+  }
+  const handler = handlers3[command];
+  if (!handler) {
+    console.error(`Unknown command: ${command}`);
+    printUsageAndExit(usage11);
+  }
+  const timeout = parsedArgs.options["--timeout"];
+  const params = new StrongParams(usage11, {
+    env: cmdObj.env,
+    image: image2,
+    sha,
+    timeout
+  });
+  handler(params);
+}
+var job = { oneLiner: oneLiner11, keyExamples: keyExamples11, run: run11 };
+
+// src/libs/hetzner/reg-secret.ts
+function isApplicable() {
+  const infra = getConst("infra");
+  if (infra !== "hetzner") {
+    console.warn(
+      "Setting up registry permissions is only needed for Harbor in a Hetzner setup"
+    );
+    return false;
+  }
+  return true;
+}
+function copySecretHarborToNamespace(monorepoEnv) {
+  if (!isApplicable()) return;
+  const cmd = kubectlCommand("get secret harbor-registry-secret -o json", {
+    monorepoEnv,
+    namespace: "harbor"
+  });
+  const secretStr = new CommandExecutor(cmd, { quiet: true }).exec();
+  const secretJson = JSON.parse(secretStr);
+  const {
+    apiVersion,
+    data,
+    kind,
+    metadata: { name },
+    type
+  } = secretJson;
+  const relevantParts = {
+    apiVersion,
+    data,
+    kind,
+    metadata: { name, namespace: envToNamespace(monorepoEnv) },
+    type
+  };
+  const copyCmd = `echo '${JSON.stringify(relevantParts)}' | kubectl apply -f -`;
+  new CommandExecutor(copyCmd, { quiet: true }).exec();
+}
+function patchServiceAccountImagePullSecret(monorepoEnv) {
+  if (!isApplicable()) return;
+  const cmd = kubectlCommand(
+    `patch serviceaccount default -p '{"imagePullSecrets": [{"name": "harbor-registry-secret"}]}'`,
+    { monorepoEnv }
+  );
+  new CommandExecutor(cmd, { quiet: true }).exec();
+}
+
+// src/cli/core/namespace.ts
+var oneLiner12 = "Creates the basic prerequisites for a monorepo";
+var keyExamples12 = `
+    $ devops namespace create --env staging
+    $ devops namespace delete --env staging
+    $ devops namespace check  --env staging
+`.trim();
+var usage12 = `
+${oneLiner12}
+
+GENERAL USAGE
+    devops namespcae create|delete|check --env <env>
+
+    'create' does the following:
+      1. Creates the namepace
+      2. Creates a secret to hold environment variables (used by devops env) and the base cryptographic secret 
+      3. On Hetzner, copies the Harbor secret to the namespace and patches the default service account to use it
+
+    'delete' removes the namespace in kubernetes, which deletes all entities within it.
+
+    'check' returns exit code 0 if the namespace exists in kubernetes, 1 otherwise.
+
+EXAMPLES
+    ${keyExamples12}
+`;
+var handlers4 = {
+  create(opts) {
+    const env2 = opts.required("env");
+    createNamespace(env2);
+    createEmptyEnvSecret(env2);
+    patchBaseSecret(env2);
+    copySecretHarborToNamespace(env2);
+    patchServiceAccountImagePullSecret(env2);
+  },
+  delete(opts) {
+    deleteNamespace(opts.required("env"));
+  },
+  check(opts) {
+    const exists = checkEnvSetup(opts.required("env"));
+    if (exists) return;
+    console.error(`
+      The environment does not exist in the cluster.
+      In order to create resources for it in the cluster, it must be first set up. This is done to protect from unintentional resource creation.
+      To set up the environment, run the following from your dev machine:
+      $ devops namespace create --env <env>
+    `);
+    process.exit(1);
+  }
+};
+function run12(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length < 1) printUsageAndExit(usage12);
+  const [command] = cmdObj.args;
+  const handler = handlers4[command];
+  if (!handler) {
+    console.error(`Unknown command: ${command}`);
+    printUsageAndExit(usage12);
+  }
+  const params = new StrongParams(usage12, {
+    env: cmdObj.env
+  });
+  handler(params);
+}
+var namespace = { oneLiner: oneLiner12, keyExamples: keyExamples12, run: run12 };
+
+// src/cli/core/prep-build.ts
+import fs5 from "fs-extra";
+import os from "os";
+import path5 from "path";
+import chalk5 from "chalk";
+var oneLiner13 = "Copies all dependencies of an image to a temporary folder in preparation for a Docker build";
+var keyExamples13 = `
+    $ devops prep-build main-node
+`.trim();
+var usage13 = `
+${oneLiner13}
+
+USAGE
+    devops prep-build <image> --env <env>
+
+    If <env> is a remote environment (e.g. staging, production), the environment variables are 
+    fetched from the cluster and injected in case they are needed during the build process.
+
+EXAMPLES
+    ${keyExamples13}
+`;
+async function run13(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length === 0) printUsageAndExit(usage13);
+  const [image2] = cmdObj.args;
+  const imageData = getImageData(image2);
+  const imageTemplate = imageData["image-template"];
+  const dockerFile = `${imageTemplate}.Dockerfile`;
+  const dockerFilePath = path5.join(".devops/docker-images", dockerFile);
+  const dockerImagePayloadPath = path5.join(".devops/docker-images", imageTemplate);
+  const dockerCommonPayloadPath = path5.join(".devops/docker-images", "common");
+  const imageTemplateData = getTemplateData(imageTemplate);
+  const copyCommon = imageTemplateData["copy-common"] ?? false;
+  const imageExtraContent = imageTemplateData["extra-content"] ?? [];
+  if (!fs5.existsSync(dockerFilePath)) {
+    console.error(`The dockerfile ${dockerFilePath} does not exist`);
+    process.exit(1);
+  }
+  imageExtraContent.forEach((file) => {
+    if (!fs5.existsSync(file)) {
+      console.error(`The file ${file} is specified in the extra-content section of ${image2} but does not exist`);
+      process.exit(1);
+    }
+  });
+  const destFolder = `${os.tmpdir()}/image-${image2}-${Date.now()}`;
+  console.warn(`Creating build in ${destFolder}`);
+  fs5.mkdirSync(destFolder);
+  console.warn(`COPYING Dockerfile`);
+  fs5.copySync(dockerFilePath, path5.join(destFolder, "Dockerfile"));
+  if (copyCommon) {
+    console.warn(`COPYING Docker common`);
+    fs5.copySync(dockerCommonPayloadPath, destFolder);
+  }
+  if (fs5.existsSync(dockerImagePayloadPath)) {
+    console.warn(`COPYING Docker image payload`);
+    fs5.copySync(dockerImagePayloadPath, destFolder);
+  }
+  console.warn(`COPYING .devops/config`);
+  fs5.mkdirSync(path5.join(destFolder, ".devops"));
+  fs5.copySync(".devops/config", path5.join(destFolder, ".devops/config"));
+  console.warn(`CREATING config for the build process`);
+  fs5.mkdirSync(path5.join(destFolder, "config"));
+  const destGlobalEnvPath = path5.join(destFolder, "config/.env.global");
+  if (isLocalOrRemoteEnv(cmdObj.env) === "remote") {
+    const envFileData = getMonorepoSecretStr(cmdObj.env);
+    fs5.writeFileSync(destGlobalEnvPath, envFileData);
+  } else {
+    let anyCopied = false;
+    const localGlobalEnvPath = "config/.env.global";
+    const localEnvPath = `config/.env.${cmdObj.env}`;
+    const destEnvPath = path5.join(destFolder, `config/.env.${cmdObj.env}`);
+    if (fs5.existsSync(localGlobalEnvPath)) {
+      console.warn(`COPYING ${localGlobalEnvPath} to ${destGlobalEnvPath}`);
+      fs5.copyFileSync(localGlobalEnvPath, destGlobalEnvPath);
+      anyCopied = true;
+    }
+    if (fs5.existsSync(localEnvPath)) {
+      console.warn(`COPYING ${localEnvPath} to ${destEnvPath}`);
+      fs5.copyFileSync(localEnvPath, destEnvPath);
+      anyCopied = true;
+    }
+    if (!anyCopied) {
+      console.warn(chalk5.red(`
+Warning: local environment ${cmdObj.env} has no .env files. Environment variables will not be injected.
+`));
+    }
+  }
+  getImageDescendentData(image2).forEach((project) => {
+    console.warn(`COPYING ${project.rootPath}`);
+    if (project.rootPath === ".devops") return;
+    fs5.copySync(project.rootPath, path5.join(destFolder, project.rootPath));
+  });
+  console.warn(`COPYING files from image-extra-content`);
+  imageExtraContent.forEach((file) => {
+    fs5.copySync(file, path5.join(destFolder, file));
+    console.warn(`  ${file}`);
+  });
+  console.log(destFolder);
+}
+var prepBuild = { command: "prep-build", oneLiner: oneLiner13, keyExamples: keyExamples13, run: run13 };
+
+// src/libs/digital-ocean/container-reg.ts
+import { z } from "zod";
+var repoTagMetadataSchema = z.object({
+  // What we rely on
+  tag: z.string().optional(),
+  updated_at: z.string(),
+  manifest_digest: z.string()
+  // Other fields that existed in the output
+  // registry_name: z.string().optional(),
+  // repository: z.string().optional(),
+  // compressed_size_bytes: z.number().optional(),
+  // size_bytes: z.number().optional(),
+});
+var repoTagMetadataSchemaOutput = z.array(repoTagMetadataSchema);
+function getRepoTagMetadata(repoName) {
+  const cmd = `doctl registry repository list-tags ${repoName} -o json`;
+  const res = new CommandExecutor(cmd, { quiet: true }).exec();
+  if (!res) return [];
+  try {
+    const parsed = JSON.parse(res);
+    const parseRes = repoTagMetadataSchemaOutput.safeParse(parsed);
+    if (parseRes.error) {
+      console.error(
+        `Error schema-parsing output from "${cmd}": ${parseRes.error.toString()}`
+      );
+      console.error(">>> Command output");
+      console.error(res);
+      process.exit(1);
+    }
+    return parseRes.data.filter((data) => data.tag).sort(
+      (a, b) => new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime()
+    );
+  } catch (e) {
+    console.error(`Error JSON-parsing output from "${cmd}": ${res}`);
+    process.exit(1);
+  }
+}
+function deleteRepoTag(repoName, tag) {
+  const cmd = `doctl registry repository delete-tag ${repoName} ${tag} --force`;
+  new CommandExecutor(cmd).exec();
+}
+function stargGarbageCollection(registryName) {
+  const cmd = `doctl registry garbage-collection start --include-untagged-manifests ${registryName} --force`;
+  new CommandExecutor(cmd).exec();
+}
+function prune(registryFullName, repoName, image2) {
+  const infra = getConst("infra");
+  if (infra !== "digitalocean") {
+    console.warn(
+      "Pruning is only supported for the DigitalOcean container registry"
+    );
+    return;
+  }
+  const imageData = getImageData(image2);
+  if (imageData["cloudrun"]) {
+    console.warn(
+      "Pruning is skipped for cloudrun images"
+    );
+    return;
+  }
+  const tags = getRepoTagMetadata(repoName);
+  const versionsToKeep = Number(getConst("image-versions-to-keep"));
+  if (!tags.length || tags.length <= versionsToKeep) return;
+  const tagsToDelete = tags.slice(versionsToKeep);
+  tagsToDelete.forEach((tag) => {
+    deleteRepoTag(repoName, tag.tag);
+  });
+  const registryName = registryFullName.split("/").slice(-1)[0];
+  stargGarbageCollection(registryName);
+}
+
+// src/cli/core/registry.ts
+var oneLiner14 = "Manage container repositories";
+var keyExamples14 = `
+    $ devops registry server-url
+    $ devops registry reg-url
+    $ devops registry repo-url   my-image sha
+    $ devops registry image-name my-image 
+    $ devops registry prune      my-image
+`.trim();
+var usage14 = `
+${oneLiner14}
+
+USAGE
+  Get base URLs for the container registry of the cluster:
+      devops registry server-url
+      devops registry reg-url
+
+      Note: for cloudrun images these URLs are not relevant. 
+
+  Gets the URL of an image in the container registry:
+    devops registry repo-url <image> <sha> --env <env>
+
+  Gets the image name in the container registry:
+    devops registry image-name <image> --env <env>
+
+  Prunes the repository of old images to enforce the "image-versions-to-keep" constant in config/constants.yaml:
+    devops registry prune <image> --env <env>
+
+    This is only relevant when the "infra" constant is set to "digitalocean".
+
+EXAMPLES
+    ${keyExamples14}
+`;
+var handlers5 = {
+  "server-url": () => console.log(getConst("registry-base-url")),
+  "reg-url": () => console.log(containerRegistryPath()),
+  "repo-url": (opts) => {
+    console.log(
+      containerRegistryRepoPath(
+        opts.required("image"),
+        opts.required("env"),
+        opts.required("sha")
+      )
+    );
+  },
+  "image-name": (opts) => {
+    console.log(containerRegistryImageName(opts.required("image"), opts.required("env")));
+  },
+  prune: (opts) => {
+    const regName = containerRegistryPath();
+    const image2 = opts.required("image");
+    const repoName = containerRegistryImageName(
+      image2,
+      opts.required("env")
+    );
+    prune(regName, repoName, image2);
+  }
+};
+function run14(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length < 1) printUsageAndExit(usage14);
+  const [command, image2, sha] = cmdObj.args;
+  const handler = handlers5[command];
+  if (!handler) {
+    console.error(`Unknown command: ${command}`);
+    printUsageAndExit(usage14);
+  }
+  const params = new StrongParams(usage14, { image: image2, env: cmdObj.env, sha });
+  handler(params);
+}
+var registry = { oneLiner: oneLiner14, keyExamples: keyExamples14, run: run14 };
+
+// src/cli/core/test.ts
+var oneLiner15 = "Runs tests in all projects or one specific project";
+var keyExamples15 = `
+$ devops test
+$ devops test project
+`;
+var usage15 = `
+${oneLiner15}
+
+USAGE
+  ${keyExamples15}
+`;
+function run15(cmdObj) {
+  const options = cmdObj.parseOptions({ params: ["--in"] });
+  if (cmdObj.help || options.args.length > 1) printUsageAndExit(usage15);
+  const workspace = options.args[0];
+  const env2 = cmdObj.envForced ? cmdObj.env : "test";
+  if (workspace) {
+    new CommandExecutor(`devops run ${workspace}:test --env ${env2}`).spawn();
+  } else {
+    new CommandExecutor(`devops run-many test --env ${env2}`).spawn();
+  }
+}
+var test = { oneLiner: oneLiner15, keyExamples: keyExamples15, run: run15 };
+
+// src/cli/extensions/index.ts
+var extensions_exports = {};
+__export(extensions_exports, {
+  dml: () => dml,
+  internalCurl: () => internalCurl,
+  jwt: () => jwt,
+  prisma: () => prisma,
+  redisBitnami: () => redisBitnami,
+  redisHa: () => redisHa,
+  stackgres: () => stackgres,
+  template: () => template
+});
+
+// src/cli/extensions/dml.ts
+import fs6 from "fs";
+var oneLiner16 = "Utilities to manage and run DML scripts in the db project";
+var keyExamples16 = `
+    $ devops dml create --name my-dml-name
+    $ devops dml run 20250113153318_my_dml_name
+`;
+var usage16 = `
+${oneLiner16}
+
+CREATE DML SCRIPTS
+    devops dml create --name <dml-semantic-name>
+
+    This command creates a new folder under /dml using the current timestamp and a 
+    snake-case version of the name. Inside the folder, a file called migrate.ts is created. 
+    You should write your DML script in this file.
+    
+    You can add additional artifacts to the folder, such as a README.md file, sql files, json 
+    files, csv files, etc. You can also add optional scripts, such as rollback.ts.
+
+RUN DML SCRIPTS
+    devops dml run <dml-folder-name> [script-file-name] [-- arg1 arg2 ...]
+
+    The dml-folder-name must be the full name, including the timestamp. This follows prisma 
+    conventions. 
+    If the optional script-file-name is omitted, 'migrate' is used by default. The name should 
+    not include the '.ts' suffix. 
+    Optionally, args can be passed to the script as command line arguments after double
+    dash (--).
+    The runner first changes the working directory to 'dml/', then executes the script using 
+    'bunx tsx'.
+    
+    Note: DML scripts are typically run inside the debug container of the image.
+
+EXAMPLES
+    ${keyExamples16.trim()}
+    $ devops dml run 20250113153318_my_dml_name rollback
+    $ devops dml run 20250113153318_my_dml_name -- staging
+`;
+var dmlFileTemplate = `
+/**
+ * Header code that retrieves the context of the DML script.
+ * Feel free to modify this code to suit your needs.
+ * 
+ * fullDmlFilePath  - path to the current file
+ * fullDmlDirPath   - path to the current directory
+ * dmlFile          - name of the current DML script file
+ * dmlDir           - name of the directory containing the DML scripts
+ * args             - command line arguments passed to the script
+ * 
+ * Notes: 
+ * - the script runs with the cwd set to the dml/ directory
+ * - remove unused variables from this template, otherwise the linter will complain 
+*/
+
+import { prisma } from 'db';
+import { basename, dirname, sep } from 'path';
+import { fileURLToPath } from 'url';
+
+const fullDmlFilePath = fileURLToPath(import.meta.url);
+const fullDmlDirPath = dirname(fullDmlFilePath);
+const dmlFile = basename(fullDmlFilePath);
+const dmlDir = fullDmlDirPath.split(sep).pop();
+
+const args = process.argv.slice(2);
+`.trim();
+function createDml(name) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 14);
+  const nameSnake = name.toLowerCase().replace(/[^a-z0-9]/g, "_");
+  const folderName = `${timestamp}_${nameSnake}`;
+  fs6.mkdirSync(`dml/${folderName}`);
+  fs6.writeFileSync(`dml/${folderName}/migrate.ts`, dmlFileTemplate);
+  console.log(`
+Created DML folder: dml/${folderName}
+`);
+}
+function runDml(cmdObj, folderName, scriptFileName, args) {
+  scriptFileName ??= "migrate";
+  args ??= [];
+  const script = scriptFileName.endsWith(".ts") ? scriptFileName : `${scriptFileName}.ts`;
+  cmdObj.executorFromEnv(
+    // prettier-ignore
+    `devops exec --in dml bun ${folderName}/${script} ${args.join(" ")}`
+  ).exec();
+}
+function run16(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length < 1) printUsageAndExit(usage16);
+  const parsed = cmdObj.parseOptions({
+    passthroughArgs: true,
+    params: ["--name"]
+  });
+  switch (parsed.args[0]) {
+    case "create": {
+      const name = parsed.options["--name"];
+      if (!name) printUsageAndExit(usage16);
+      return createDml(name);
+    }
+    case "run": {
+      const [_2, folderName, scriptFileName] = parsed.args;
+      if (!folderName) printUsageAndExit(usage16);
+      return runDml(cmdObj, folderName, scriptFileName, parsed.passthrough);
+    }
+    default:
+      printUsageAndExit(usage16);
+  }
+}
+var dml = { oneLiner: oneLiner16, keyExamples: keyExamples16, run: run16 };
+
+// src/cli/extensions/internal-curl.ts
+var oneLiner17 = "Runs a curl command bearing an internal jwt-like token to allow verifying internal communication within the namespace";
+var keyExamples17 = `$ devops internal-curl jobs http://service-name:port/path`;
+var usage17 = `
+${oneLiner17}
+
+GENERAL USAGE
+    devops internal-curl <subject> [curl-options] <url>
+
+NOTE
+    --env should not be used with this command. It is expected to be run inside pods in the namespace.
+    Relies on the MONOREPO_BASE_SECRET environment variable for signing the token.
+    
+    'subject' is the subject of the token. Receiving endpoints should verify it matches the expected value using the 
+    'InternalToken' class exposed by @vaharoni/devops.
+
+EXAMPLES
+    ${keyExamples17}
+`;
+async function run17(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length === 0 || cmdObj.envForced) printUsageAndExit(usage17);
+  const [subject, ...rest] = cmdObj.args;
+  let token;
+  if (process.env.MONOREPO_BASE_SECRET) {
+    token = new InternalToken(subject).generate();
+  } else {
+    const res = cmdObj.executorFromEnv(`devops jwt ${subject}`).exec({ asObject: true });
+    if (res.statusCode !== 0) {
+      console.error("Failed to generate token. Aborting.");
+      process.exit(1);
+    }
+    token = res.stdout.trim();
+  }
+  cmdObj.executorFromEnv(`curl -H "Authorization: Bearer ${token}" ${rest.join(" ")}`).exec();
+}
+var internalCurl = { command: "internal-curl", oneLiner: oneLiner17, keyExamples: keyExamples17, run: run17 };
+
+// src/cli/extensions/jwt.ts
+var oneLiner18 = "Returns a JWT-like token to allow verifying internal communication within the namespace";
+var keyExamples18 = `$ devops jwt jobs`;
+var usage18 = `
+${oneLiner18}
+
+GENERAL USAGE
+    devops jwt <subject>
+
+NOTE
+    The token is valid for 60 seconds and bears the specified subject.
+    --env should not be used with this command. It is expected to be run inside pods in the namespace.
+    Relies on the MONOREPO_BASE_SECRET environment variable for signing the token.
+
+EXAMPLES
+    ${keyExamples18}
+`;
+async function run18(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length === 0 || cmdObj.envForced) printUsageAndExit(usage18);
+  const subject = cmdObj.args[0];
+  console.log(new InternalToken(subject).generate());
+}
+var jwt = { oneLiner: oneLiner18, keyExamples: keyExamples18, run: run18 };
+
+// src/cli/extensions/prisma.ts
+import path6 from "path";
+var execShPath3 = path6.join(pkgRoot, "cli/exec.sh");
+var oneLiner19 = "Runs prisma commands in the db project after injecting the environment variables";
+var keyExamples19 = `$ devops prisma migrate dev`;
+var usage19 = `
+${oneLiner19}
+
+GENERAL USAGE
+    devops prisma <command>
+
+    <command> can be any command you normally set prisma for.
+
+EXAMPLES
+    ${keyExamples19}
+`;
+async function run19(cmdObj) {
+  cmdObj.executorFromEnv(
+    `${execShPath3} db bunx prisma ${cmdObj.args.join(" ")}`,
+    { checkEnvYaml: false }
+  ).spawn();
+}
+var prisma = { oneLiner: oneLiner19, keyExamples: keyExamples19, run: run19 };
+
+// src/cli/extensions/redis-bitnami.ts
+import chalk6 from "chalk";
+
+// src/libs/k8s-redis-bitnami.ts
+function getRedisList() {
+  const cmd = kubectlCommand(`get pods -l app.kubernetes.io/name=redis -A`);
+  const res = new CommandExecutor(cmd, { quiet: true }).exec();
+  if (!res) return null;
+  return res;
+}
+function getRedisPassword(namespace2) {
+  const cmd = kubectlCommand(`get secrets/${namespace2} -o jsonpath="{.data}"`, {
+    namespace: namespace2
+  });
+  const res = new CommandExecutor(cmd, { quiet: true }).exec();
+  if (!res) return null;
+  try {
+    const resJson = JSON.parse(res);
+    const password = atob(resJson["redis-password"]);
+    return { password };
+  } catch {
+    return null;
+  }
+}
+function establishRedisTunnel(namespace2, port) {
+  const cmd = kubectlCommand(`port-forward svc/${namespace2}-master ${port}:6379`, {
+    namespace: namespace2
+  });
+  new CommandExecutor(cmd).spawn();
+}
+
+// src/cli/extensions/redis-bitnami.ts
+var oneLiner20 = "Utilities to help accessing production and staging redis installation from Bitnami";
+var keyExamples20 = `
+    $ devops redis list
+    $ devops redis password  redis-staging
+    $ devops redis tunnel    redis-staging
+`.trim();
+var usage20 = `
+${oneLiner20}
+
+COMMANDS
+    list                                  Lists the available redis installations
+    password <namespace>                  Shows the password for the Redis instance
+    tunnel   <namespace> [-p <port>]      Sets up a tunnel to the remote Redis instance so you can access the DB from your local machine on port 9379 by default
+
+NOTES
+    This command assumes the namespace and the helm release name are the same.
+    The --env flag should not be used with these commands, as the Redis namespaces follow different conventions than the monorepo env. 
+
+EXAMPLES
+    ${keyExamples20}
+`;
+var handlers6 = {
+  list: () => {
+    const res = getRedisList();
+    console.log(res);
+  },
+  password: (opts) => {
+    const namespace2 = opts.required("namespace");
+    const res = getRedisPassword(namespace2);
+    if (!res) {
+      console.error("Failed to get the secret");
+      process.exit(1);
+    } else {
+      console.log();
+      console.log(res.password);
+      console.log();
+    }
+  },
+  tunnel: (opts) => {
+    const namespace2 = opts.required("namespace");
+    const port = opts.optional("port") ?? "9379";
+    const res = getRedisPassword(namespace2);
+    console.log(
+      chalk6.blue("\nAfter the tunnel is established, connect to Redis by running:\n	") + chalk6.green.bold(`redis-cli -p ${port} --askpass`)
+    );
+    if (res) {
+      console.log(chalk6.blue("	Password: ") + chalk6.green.bold(res.password));
+      console.log();
+    }
+    establishRedisTunnel(namespace2, port);
+  }
+};
+function run20(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length < 1) printUsageAndExit(usage20);
+  const parsed = cmdObj.parseOptions({ params: ["-p"] });
+  const [command, namespace2] = parsed.args;
+  const port = parsed.options["-p"];
+  const handler = handlers6[command];
+  if (!handler) {
+    console.error(`Unknown command: ${command}`);
+    printUsageAndExit(usage20);
+  }
+  const params = new StrongParams(usage20, {
+    namespace: namespace2,
+    port
+  });
+  handler(params);
+}
+var redisBitnami = { name: "redis-bitnami", command: "redis", oneLiner: oneLiner20, keyExamples: keyExamples20, run: run20 };
+
+// src/libs/k8s-redis-ha.ts
+function getRedisList2() {
+  const cmd = kubectlCommand(`get pods -l app=redis-ha -A`);
+  const res = new CommandExecutor(cmd, { quiet: true }).exec();
+  if (!res) return null;
+  return res;
+}
+function establishRedisTunnel2(namespace2, port) {
+  const cmd = kubectlCommand(`port-forward svc/${namespace2}-redis-ha ${port}:6379`, {
+    namespace: namespace2
+  });
+  new CommandExecutor(cmd).spawn();
+}
+
+// src/cli/extensions/redis-ha.ts
+var oneLiner21 = "Utilities to help accessing production and staging redis installation from redis-ha";
+var keyExamples21 = `
+    $ devops redis list
+    $ devops redis tunnel    redis-staging
+`.trim();
+var usage21 = `
+${oneLiner21}
+
+COMMANDS
+    list                                  Lists the available redis installations
+    tunnel   <namespace> [-p <port>]      Sets up a tunnel to the remote Redis instance so you can access the DB from your local machine on port 9379 by default
+
+NOTES
+    This command assumes the namespace and the helm release name are the same.
+    The --env flag should not be used with these commands, as the Redis namespaces follow different conventions than the monorepo env. 
+
+EXAMPLES
+    ${keyExamples21}
+`;
+var handlers7 = {
+  list: () => {
+    const res = getRedisList2();
+    console.log(res);
+  },
+  tunnel: (opts) => {
+    const namespace2 = opts.required("namespace");
+    const port = opts.optional("port") ?? "9379";
+    establishRedisTunnel2(namespace2, port);
+  }
+};
+function run21(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length < 1) printUsageAndExit(usage21);
+  const parsed = cmdObj.parseOptions({ params: ["-p"] });
+  const [command, namespace2] = parsed.args;
+  const port = parsed.options["-p"];
+  const handler = handlers7[command];
+  if (!handler) {
+    console.error(`Unknown command: ${command}`);
+    printUsageAndExit(usage21);
+  }
+  const params = new StrongParams(usage21, {
+    namespace: namespace2,
+    port
+  });
+  handler(params);
+}
+var redisHa = { name: "redis-ha", command: "redis", oneLiner: oneLiner21, keyExamples: keyExamples21, run: run21 };
+
+// src/libs/k8s-db.ts
+function getDbList() {
+  const cmd = kubectlCommand(`get sgcluster -A`);
+  const res = new CommandExecutor(cmd, { quiet: true }).exec();
+  if (!res) return null;
+  return res;
+}
+function getDbBackups() {
+  const cmd = kubectlCommand(`get sgbkp -A`);
+  const res = new CommandExecutor(cmd, { quiet: true }).exec();
+  if (!res) return null;
+  return res;
+}
+function getDbAdminPassword() {
+  const cmd = kubectlCommand(
+    `get secrets/stackgres-restapi-admin -o jsonpath="{.data}"`,
+    { namespace: "stackgres" }
+  );
+  const res = new CommandExecutor(cmd, { quiet: true }).exec();
+  if (!res) return null;
+  try {
+    const resJson = JSON.parse(res);
+    const password = atob(resJson["clearPassword"]);
+    const user = atob(resJson["k8sUsername"]);
+    return { user, password };
+  } catch {
+    return null;
+  }
+}
+function getDbPasswords(namespace2) {
+  const cmd = kubectlCommand(`get secrets/${namespace2} -o jsonpath="{.data}"`, {
+    namespace: namespace2
+  });
+  const res = new CommandExecutor(cmd, { quiet: true }).exec();
+  if (!res) return null;
+  try {
+    const resJson = JSON.parse(res);
+    const superUser = atob(resJson["superuser-username"]);
+    const superPassword = atob(resJson["superuser-password"]);
+    const authenticatorUser = atob(resJson["authenticator-username"]);
+    const authenticatorPassword = atob(resJson["authenticator-password"]);
+    const replicationUser = atob(resJson["replication-username"]);
+    const replicationPassword = atob(resJson["replication-password"]);
+    return {
+      superUser,
+      superPassword,
+      authenticatorUser,
+      authenticatorPassword,
+      replicationUser,
+      replicationPassword
+    };
+  } catch {
+    return null;
+  }
+}
+function connectToPatroni(namespace2) {
+  const cmd = kubectlCommand(
+    `exec -it ${namespace2}-0 -c patroni -- /bin/bash`,
+    { namespace: namespace2 }
+  );
+  new CommandExecutor(cmd).spawn();
+}
+function connectToPsql(namespace2) {
+  const cmd = kubectlCommand(
+    `exec -it ${namespace2}-0 -c postgres-util -- psql`,
+    { namespace: namespace2 }
+  );
+  new CommandExecutor(cmd).spawn();
+}
+function establishTunnel(namespace2, port) {
+  const cmd = kubectlCommand(`port-forward pod/${namespace2}-0 ${port}:5432`, {
+    namespace: namespace2
+  });
+  new CommandExecutor(cmd).spawn();
+}
+
+// src/cli/extensions/stackgres.ts
+var oneLiner22 = "Utilities to help day to day operations of production and staging databases";
+var keyExamples22 = `
+    $ devops db list
+    $ devops db backups
+    $ devops db password  ui
+    $ devops db password  db-staging
+    $ devops db tunnel    db-staging
+    $ devops db patroni   db-staging
+    $ devops db psql      db-staging
+`.trim();
+var usage22 = `
+${oneLiner22}
+
+NOTES
+    The admin UI provided by Stackgres is great. It allows you to do most of the operations you need, such as 
+    restarting the cluster, upgrading postgres versions, and restoring from backups with point in time recovery (PITR).
+
+    This utility complements the admin UI with a few helpful shortcuts.
+
+    Note that the --env flag should not be used with these commands, as the DB namespaces follow different
+    conventions than the monorepo env. 
+
+    This utility assumes that the cluster name and the namespace are always the same.
+
+COMMANDS
+    list                                  Lists the available clusters
+    backups                               Lists all available backups
+    password ui                           Shows the password to the admin UI
+    password <namespace>                  Shows the superuser, replication, and authenticator password of the remote database
+    patroni  <namespace>                  Obtain a shell to the primary pod's patroni container, where you can run 'patronictl'
+    psql     <namespace>                  Runs 'psql' in the primary pod's postgres-utils container
+    tunnel   <namespace> [-p <port>]      Sets up a tunnel to the remote database so you can access the DB from your local machine. 
+                                          By default, the port is taken from the namespace to make it easier to create connection profiles locally: 
+                                          db-staging: 7432, db-production: 8432, otherwise: 9432
+
+EXAMPLES
+    ${keyExamples22}
+`;
+var DEFAULT_PORTS = {
+  "db-staging": "7432",
+  "db-production": "8432"
+};
+var handlers8 = {
+  list: () => {
+    const res = getDbList();
+    console.log(res);
+  },
+  backups: () => {
+    const res = getDbBackups();
+    console.log(res);
+  },
+  password: (opts) => {
+    const namespace2 = opts.required("namespace");
+    if (namespace2 === "ui") {
+      const res2 = getDbAdminPassword();
+      if (!res2) {
+        console.error("Failed to get the secret");
+        process.exit(1);
+      } else {
+        console.log(`User: ${res2.user}`);
+        console.log(`Password: ${res2.password}`);
+      }
+      return;
+    }
+    const res = getDbPasswords(namespace2);
+    if (!res) {
+      console.error("Failed to get the secret");
+      process.exit(1);
+    } else {
+      console.log("\nSuperuser");
+      console.log(`  ${res.superUser}`);
+      console.log(`  ${res.superPassword}`);
+      console.log("\nAuthenticator");
+      console.log(`  ${res.authenticatorUser}`);
+      console.log(`  ${res.authenticatorPassword}`);
+      console.log("\nReplication");
+      console.log(`  ${res.replicationUser}`);
+      console.log(`  ${res.replicationPassword}`);
+      console.log();
+    }
+  },
+  tunnel: (opts) => {
+    const defaultPort = DEFAULT_PORTS[opts.required("namespace")] || "9432";
+    const port = opts.optional("port") || defaultPort;
+    establishTunnel(opts.required("namespace"), port);
+  },
+  patroni: (opts) => {
+    connectToPatroni(opts.required("namespace"));
+  },
+  psql: (opts) => {
+    connectToPsql(opts.required("namespace"));
+  }
+};
+function run22(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length < 1) printUsageAndExit(usage22);
+  const parsed = cmdObj.parseOptions({ params: ["-p"] });
+  const [command, namespace2] = parsed.args;
+  const port = parsed.options["-p"];
+  const handler = handlers8[command];
+  if (!handler) {
+    console.error(`Unknown command: ${command}`);
+    printUsageAndExit(usage22);
+  }
+  const params = new StrongParams(usage22, {
+    namespace: namespace2,
+    port
+  });
+  handler(params);
+}
+var stackgres = { command: "db", oneLiner: oneLiner22, keyExamples: keyExamples22, run: run22 };
+
+// src/cli/extensions/template.ts
+import chalk7 from "chalk";
+var SUPPORTED_CONTEXT_TYPES = ["deployment", "db-migrate", "debug"];
+var oneLiner23 = "Utilities to help validate manifest templates rendering.";
+var keyExamples23 = `
+    $ devops template context deployment www
+    $ devops template context debug
+    $ devops template context db-migrate
+    $ devops template gen     deployment www
+    $ devops template gen     debug      main-node
+    $ devops template gen     db-migrate
+`.trim();
+var usage23 = `
+${oneLiner23}
+
+IMPORTANT
+    This command generates examples only. It's intended to help design new templates by showing what context variables are available
+    and how they get rendered using handlebar replacement. They should not be used to apply changes to the cluster.
+
+SHOW CONTEXT OBJECT
+    devops template context deployment <workspace>
+    devops template context db-migrate-job|debug
+
+    Prints out a context object with dummy values for the specified template type.
+    For deployment, the workspace name is required.
+
+GENERATE TEMPLATES
+    devops template gen deployment <workspace>
+    devops template gen debug <image>
+    devops template gen db-migrate-job
+
+    For deployment, generates an example manifest of a workspace, including override files present under the 'manifests' folder.
+
+EXAMPLES
+    ${keyExamples23}
+`;
+var handlers9 = {
+  context: {
+    "deployment": (opts) => {
+      const workspace = opts.required("workspaceOrImage");
+      const workspaceData = getWorkspace(workspace);
+      const packageDataWithDeployment = workspaceData.packageDataEntries.find((entry) => entry.deployment);
+      if (!packageDataWithDeployment) {
+        console.error(`No deployment found for workspace ${workspace}`);
+        process.exit(1);
+      }
+      const randomImage = getWorkspaceImages(workspace)[0];
+      console.warn(chalk7.green("\nThis is a sample context object used to render a manifest template of type deployment:\n"));
+      console.log(
+        JSON.stringify(
+          new ImageContextGenerator(opts.required("env"), randomImage, "dummy-sha").getDeployment(packageDataWithDeployment),
+          null,
+          2
+        )
+      );
+    },
+    "db-migrate": (opts) => {
+      const randomImage = getWorkspaceImages("db").filter((image2) => getImageData(image2)["can-db-migrate"])[0];
+      if (!randomImage) {
+        console.error("No image found with can-db-migrate=true in the db workspace.");
+        process.exit(1);
+      }
+      console.warn(chalk7.green("\nThis is a sample context object used to render a manifest template of type db-migrate:\n"));
+      console.log(
+        JSON.stringify(
+          new ImageContextGenerator(opts.required("env"), randomImage, "dummy-sha").getDbMigrate(),
+          null,
+          2
+        )
+      );
+    },
+    "debug": (opts) => {
+      const randomImage = getImageNames()[0];
+      console.warn(chalk7.green("\nThis is a sample context object used to render a manifest template of type debug:\n"));
+      console.log(
+        JSON.stringify(
+          new ImageContextGenerator(opts.required("env"), randomImage, "dummy-sha").getDebug(),
+          null,
+          2
+        )
+      );
+    }
+  },
+  gen: {
+    "deployment": (opts) => {
+      const workspace = opts.required("workspaceOrImage");
+      const workspaceData = getWorkspace(workspace);
+      const packageDataWithDeployment = workspaceData.packageDataEntries.find((entry) => entry.deployment);
+      if (!packageDataWithDeployment) {
+        console.error(`No deployment found for workspace ${workspace}`);
+        process.exit(1);
+      }
+      const randomImage = getWorkspaceImages(workspace)[0];
+      console.warn(chalk7.green(`
+This is a sample of generated manifests for the ${workspace} workspace:
+`));
+      console.log(
+        generateWorkspaceDeployment(
+          packageDataWithDeployment,
+          opts.required("env"),
+          randomImage,
+          "dummy-sha"
+        )
+      );
+    },
+    "db-migrate": (opts) => {
+      const randomImage = getWorkspaceImages("db").filter((image2) => getImageData(image2)["can-db-migrate"])[0];
+      if (!randomImage) {
+        console.error("No image found with can-db-migrate=true in the db workspace.");
+        process.exit(1);
+      }
+      console.warn(chalk7.green("\nThis is a sample of generated manifests for the db-migrate job:\n"));
+      console.log(
+        generateDbMigrateJob(
+          opts.required("env"),
+          randomImage,
+          "dummy-sha"
+        )
+      );
+    },
+    "debug": (opts) => {
+      const image2 = opts.required("workspaceOrImage");
+      console.warn(chalk7.green(`
+This is a sample of generated manifests for the debug image ${image2}:
+`));
+      console.log(
+        generateDebugPod(
+          opts.required("env"),
+          image2,
+          "dummy-sha"
+        )
+      );
+    }
+  }
+};
+function run23(cmdObj) {
+  if (cmdObj.help || cmdObj.args.length < 1) printUsageAndExit(usage23);
+  const [command, contextType, param] = cmdObj.args;
+  const commandHandler = handlers9[command];
+  if (!commandHandler) {
+    console.error(`Unknown command: ${command}`);
+    printUsageAndExit(usage23);
+  }
+  if (!SUPPORTED_CONTEXT_TYPES.includes(contextType)) {
+    console.error(`Unknown context type: ${contextType}. Supported types: ${SUPPORTED_CONTEXT_TYPES.join(", ")}`);
+    process.exit(1);
+  }
+  const handler = commandHandler[contextType];
+  const params = new StrongParams(usage23, {
+    env: cmdObj.env === "development" ? "staging" : cmdObj.env,
+    contextType,
+    workspaceOrImage: param
+  });
+  handler(params);
+}
+var template = { oneLiner: oneLiner23, keyExamples: keyExamples23, run: run23 };
+
+// src/devops.ts
+import { existsSync } from "fs";
+import path7 from "path";
+var [_node, _scriptPath, ...commandArgs] = process.argv;
+var newLine = "\n    ";
+function maxKeyLength(commands) {
+  return Math.max(...Object.keys(commands).map((x) => x.length)) + 10;
+}
+var coreCommands = {};
+Object.entries(core_exports).forEach(([constKey, imported]) => {
+  const { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24 } = imported;
+  const key = "command" in imported ? imported.command : constKey;
+  coreCommands[key] = { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24, key };
+});
+var coreCommandsKeyLength = maxKeyLength(coreCommands);
+var extensionCommands = {};
+var activeExtensions = getConst("extensions", { ignoreIfInvalid: true });
+if (activeExtensions?.length) {
+  const availableExtensionsLookup = Object.fromEntries(
+    Object.entries(extensions_exports).map(([constKey, value]) => {
+      const { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24 } = value;
+      const keyInYaml = "name" in value ? value.name : constKey;
+      const key = "command" in value ? value.command : constKey;
+      return [keyInYaml, { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24, key }];
+    })
+  );
+  for (const extension of activeExtensions) {
+    const extensionData = availableExtensionsLookup[extension];
+    if (!extensionData) {
+      console.error(`
+Extension "${extension}" referenced in constants.yaml is not supported
+
+`);
+      process.exit(1);
+    }
+    extensionCommands[extensionData.key] = extensionData;
+  }
+}
+var extensionCommandsKeyLength = maxKeyLength(extensionCommands);
+var pluginCommands = {};
+if (existsSync(".devops/plugins")) {
+  const pluginsDir = path7.join(process.cwd(), ".devops/plugins");
+  const pluginFiles = globSync2(path7.join(pluginsDir, "*.ts"));
+  for (const pluginFile of pluginFiles) {
+    const plugin = await import(pluginFile);
+    const keys = Object.keys(plugin);
+    if (keys.length !== 1) {
+      console.error(`Plugin ${pluginFile} must export exactly one command`);
+      process.exit(1);
+    }
+    const constKey = keys[0];
+    const { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24, command } = plugin[constKey];
+    const key = command ?? constKey;
+    if (!oneLiner24 || !keyExamples24 || !run24) {
+      console.error(`Plugin ${pluginFile} must export oneLiner, keyExamples, and run`);
+      process.exit(1);
+    }
+    if (typeof run24 !== "function") {
+      console.error(`Plugin ${pluginFile} must export a run function`);
+      process.exit(1);
     }
+    pluginCommands[key] = { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24, key };
+  }
 }
-const pluginCommandsKeyLength = maxKeyLength(pluginCommands);
-const GENERAL_USAGE = `
+var pluginCommandsKeyLength = maxKeyLength(pluginCommands);
+var GENERAL_USAGE = `
 Devops utilities for the monorepo.
 
 USAGE
@@ -92,36 +3247,25 @@ CHOOSING ENV with <env-options>
 
 
 CORE COMMANDS
-    ${Object.values(coreCommands)
-    .map((cmd) => [cmd.key, " ".repeat(coreCommandsKeyLength - cmd.key.length), cmd.oneLiner].join(""))
-    .join(newLine)}
+    ${Object.values(coreCommands).map(
+  (cmd) => [cmd.key, " ".repeat(coreCommandsKeyLength - cmd.key.length), cmd.oneLiner].join("")
+).join(newLine)}
 `;
-const EXTENSION_USAGE = Object.keys(extensionCommands).length ? `
+var EXTENSION_USAGE = Object.keys(extensionCommands).length ? `
 ACTIVE EXTENSIONS
-    ${Object.values(extensionCommands)
-    .map((cmd) => [cmd.key, " ".repeat(extensionCommandsKeyLength - cmd.key.length), cmd.oneLiner].join(""))
-    .join(newLine)}
-` : '';
-const PLUGIN_USAGE = Object.keys(pluginCommands).length ? `
+    ${Object.values(extensionCommands).map(
+  (cmd) => [cmd.key, " ".repeat(extensionCommandsKeyLength - cmd.key.length), cmd.oneLiner].join("")
+).join(newLine)}
+` : "";
+var PLUGIN_USAGE = Object.keys(pluginCommands).length ? `
 ACTIVE PLUGINS
-    ${Object.values(pluginCommands)
-    .map((cmd) => [cmd.key, " ".repeat(pluginCommandsKeyLength - cmd.key.length), cmd.oneLiner].join(""))
-    .join(newLine)}
-` : '';
-const ALL_USAGE = [GENERAL_USAGE, EXTENSION_USAGE, PLUGIN_USAGE].filter(Boolean).join("");
-const allCommands = { ...coreCommands, ...extensionCommands, ...pluginCommands };
-// EXAMPLES
-//     ${Object.values(commands)
-//       .map((cmd) =>
-//         cmd.keyExamples
-//           .split("\n")
-//           .map((x) => x.trim())
-//           .filter(Boolean)
-//           .join(newLine)
-//       )
-//       .join(newLine)}
-const commandObj = new CLICommandParser(commandArgs);
-const chosenCommand = allCommands[commandObj.command];
-if (!chosenCommand)
-    printUsageAndExit(ALL_USAGE);
+    ${Object.values(pluginCommands).map(
+  (cmd) => [cmd.key, " ".repeat(pluginCommandsKeyLength - cmd.key.length), cmd.oneLiner].join("")
+).join(newLine)}
+` : "";
+var ALL_USAGE = [GENERAL_USAGE, EXTENSION_USAGE, PLUGIN_USAGE].filter(Boolean).join("");
+var allCommands = { ...coreCommands, ...extensionCommands, ...pluginCommands };
+var commandObj = new CLICommandParser(commandArgs);
+var chosenCommand = allCommands[commandObj.command];
+if (!chosenCommand) printUsageAndExit(ALL_USAGE);
 chosenCommand.run(commandObj);