@webda/azure 0.0.0-stage → 4.0.0-beta.14

package/lib/deployers/containerapps.service.d.ts

@@ -0,0 +1,186 @@
+import { Deployer, SecretString } from "@webda/core";
+import { AzureTemplate } from "../template.js";
+import { AzureArmDeployer, AzureArmDeployerParameters, AzureDeployResult } from "./arm.service.js";
+export declare const AZURE_SECTIONS: readonly ["LogAnalytics", "ManagedEnvironment", "ContainerApp", "Jobs", "Resources"];
+/** Azure Container Apps unit parameters. Image tags and Azure resource tags are separate. */
+export declare class AzureContainerAppsDeployerParameters extends AzureArmDeployerParameters {
+    /**
+     * Registry
+     */
+    registry?: string;
+    /**
+     * Registry auth
+     */
+    registryAuth: "aad" | "identity" | "none";
+    /**
+     * Container app
+     */
+    containerApp: {
+        name?: string;
+        cpu?: number;
+        memory?: string;
+        minReplicas?: number;
+        maxReplicas?: number;
+        ingress?: false | {
+            external?: boolean;
+            targetPort?: number;
+            transport?: string;
+        };
+        env?: Record<string, string | {
+            secretRef: string;
+        }>;
+        probes?: Record<string, any>[];
+        scaleRules?: Record<string, any>[];
+    };
+    /**
+     * Environment
+     */
+    environment: {
+        name?: string;
+        id?: string;
+    };
+    /**
+     * Log analytics
+     */
+    logAnalytics: false | {
+        name?: string;
+        retentionInDays?: number;
+    };
+    /**
+     * Secrets
+     */
+    secrets: Record<string, string | SecretString | {
+        keyVaultUrl: string;
+        identity: string;
+    }>;
+    /**
+     * Custom domains
+     */
+    customDomains: {
+        name: string;
+        certificateId?: string;
+        bindingType?: string;
+        validationMethod?: "CNAME" | "HTTP";
+    }[];
+    /**
+     * Crons
+     */
+    crons: boolean;
+}
+/** Build an OCI image and deploy its immutable digest to Azure Container Apps.
+ * @WebdaModda
+ */
+export declare class AzureContainerAppsDeployer extends AzureArmDeployer<AzureContainerAppsDeployerParameters> implements Deployer {
+    /**
+     * Parameters
+     */
+    static Parameters: typeof AzureContainerAppsDeployerParameters;
+    /**
+     * Image
+     */
+    protected image: string;
+    /**
+     * Write the generated ARM template for review.
+     * @param output - Optional template output path
+     * @returns Generated ARM template
+     */
+    generate(output?: string): Promise<AzureTemplate>;
+    /**
+     * Perform get resolved parameters.
+     * @override
+     */
+    getResolvedParameters(): AzureContainerAppsDeployerParameters;
+    /**
+     * Return the application resource identifier.
+     * @returns The app resource id result
+     */
+    getAppResourceId(): string;
+    /**
+     * Return the managed identity resource identifier.
+     * @returns The identity resource id result
+     */
+    protected getIdentityResourceId(): string;
+    /**
+     * Return the ARM expression for the application principal.
+     * @returns The app principal id result
+     */
+    getAppPrincipalId(): string;
+    /**
+     * Return the managed environment resource identifier.
+     * @returns The environment id result
+     */
+    protected environmentId(): string;
+    /**
+     * Describe the application managed identity.
+     * @returns The identity result
+     */
+    protected identity(): {
+        type: string;
+        userAssignedIdentities: {
+            [x: string]: {};
+        };
+    };
+    /**
+     * Build the runtime environment from contributors and explicit overrides.
+     * @returns The env result
+     */
+    protected env(): {
+        name: string;
+        value: string;
+    }[];
+    /**
+     * Convert configured secrets to secure parameters or Key Vault references.
+     * @returns The secrets result
+     */
+    protected secrets(): ({
+        keyVaultUrl: string;
+        identity: string;
+        name: string;
+    } | {
+        name: string;
+        value: string;
+    })[];
+    /**
+     * Configure managed identity image pulls.
+     * @returns The registries result
+     */
+    protected registries(): {
+        server: string;
+        identity: string;
+    }[];
+    /**
+     * Generate the deployment template without contacting Azure.
+     * @param image - Immutable container image reference
+     * @returns ARM template without secret values
+     */
+    generateTemplate(image?: string): AzureTemplate;
+    /**
+     * Add the optional Log Analytics workspace.
+     */
+    LogAnalytics(): void;
+    /**
+     * Add the Container Apps managed environment.
+     */
+    ManagedEnvironment(): void;
+    /**
+     * Add the application and its scaling and ingress settings.
+     */
+    ContainerApp(): void;
+    /** Issue managed certificates after hostname registration, then bind them in a nested deployment. */
+    ManagedCertificates(): void;
+    /**
+     * Export declared crons as scheduled jobs, each running `cron run --id` on its operation.
+     */
+    Jobs(): void;
+    /**
+     * Publish the OCI image using the selected registry authentication.
+     * @returns The push result
+     */
+    push(): Promise<string>;
+    /**
+     * Publish and deploy the application, returning its endpoints.
+     * @returns The deploy result
+     */
+    deploy(): Promise<AzureDeployResult>;
+}
+//# sourceMappingURL=containerapps.service.d.ts.map

package/lib/deployers/containerapps.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerapps.service.d.ts","sources":["../../src/deployers/containerapps.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,QAAQ,EAA0B,YAAY,EAAc,MAAM,aAAa,CAAC;AAG/G,OAAO,EAEL,aAAa,EAKd,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEnG,eAAO,MAAM,cAAc,YAAI,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,CAAU,CAAC;AAEnH,6FAA6F;AAC7F,qBAAa,oCAAqC,SAAQ,0BAA0B;IAClF;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,YAAY,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,CAAS;IAClD;;OAEG;IACH,YAAY,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,KAAK,GAAG;YAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;KACpC,CAAM;IACP;;OAEG;IACH,WAAW,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAM;IACjD;;OAEG;IACH,YAAY,EAAE,KAAK,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAM;IACvE;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAM;IAChG;;OAEG;IACH,aAAa,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,EAAE,CAC/G;IACL;;OAEG;IACH,KAAK,UAAQ;CACd;AAED;;GAEG;AACH,qBAAa,0BACX,SAAQ,gBAAgB,CAAC,oCAAoC,CAC7D,YAAW,QAAQ;IAEnB;;OAEG;IACH,MAAM,CAAC,UAAU,8CAAwC;IACzD;;OAEG;IACH,SAAS,CAAC,KAAK,SAAM;IAErB;;;;OAIG;IAEG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAEtD;IAED;;;OAGG;IACH,qBAAqB,IAAI,oCAAoC,CAoB5D;IAED;;;OAGG;IACH,gBAAgB,IAAI,MAAM,CAEzB;IACD;;;OAGG;IACH,SAAS,CAAC,qBAAqB,IAAI,MAAM,CAKxC;IACD;;;OAGG;IACH,iBAAiB,IAAI,MAAM,CAE1B;IACD;;;OAGG;IACH,SAAS,CAAC,aAAa,IAAI,MAAM,CAIhC;IACD;;;OAGG;IACH,SAAS,CAAC,QAAQ;;;;;MAEjB;IACD;;;OAGG;IACH,SAAS,CAAC,GAAG;;;QAMZ;IACD;;;OAGG;IACH,SAAS,CAAC,OAAO;qBAvH8C,MAAM;kBAAY,MAAM;;;;;SA8HtF;IACD;;;OAGG;IACH,SAAS,CAAC,UAAU;;;QAInB;IAED;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,aAAa,CAoC9C;IAED;;OAEG;IACH,YAAY,IAAI,IAAI,CAYnB;IACD;;OAEG;IACH,kBAAkB,IAAI,IAAI,CA0BzB;IACD;;OAEG;IACH,YAAY,IAAI,IAAI,CAuDnB;IAED,qGAAqG;IACrG,mBAAmB,IAAI,IAAI,CAiD1B;IACD;;OAEG;IACH,IAAI,IAAI,IAAI,CA0CX;IAED;;;OAGG;IAEG,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAQ5B;IAED;;;OAGG;IAEG,MAAM,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAezC;CACF"}

package/lib/deployers/containerapps.service.js

@@ -0,0 +1,482 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { Command, CronService, getDeploymentVariables, SecretString, WebdaError } from "@webda/core";
+import { formatImageReference, parseImageReference } from "@webda/oci";
+import { AzureAuth } from "../auth.js";
+import { armValue, containerAppsSchedule, resourceId, roleAssignmentId, createAzureTemplate } from "../template.js";
+import { createHash } from "node:crypto";
+import { AzureArmDeployer, AzureArmDeployerParameters } from "./arm.service.js";
+export const AZURE_SECTIONS = ["LogAnalytics", "ManagedEnvironment", "ContainerApp", "Jobs", "Resources"];
+/** Azure Container Apps unit parameters. Image tags and Azure resource tags are separate. */
+export class AzureContainerAppsDeployerParameters extends AzureArmDeployerParameters {
+    constructor() {
+        super(...arguments);
+        /**
+         * Registry auth
+         */
+        this.registryAuth = "aad";
+        /**
+         * Container app
+         */
+        this.containerApp = {};
+        /**
+         * Environment
+         */
+        this.environment = {};
+        /**
+         * Log analytics
+         */
+        this.logAnalytics = {};
+        /**
+         * Secrets
+         */
+        this.secrets = {};
+        /**
+         * Custom domains
+         */
+        this.customDomains = [];
+        /**
+         * Crons
+         */
+        this.crons = true;
+    }
+}
+/** Build an OCI image and deploy its immutable digest to Azure Container Apps.
+ * @WebdaModda
+ */
+let AzureContainerAppsDeployer = (() => {
+    var _a;
+    let _classSuper = AzureArmDeployer;
+    let _instanceExtraInitializers = [];
+    let _generate_decorators;
+    let _push_decorators;
+    let _deploy_decorators;
+    return _a = class AzureContainerAppsDeployer extends _classSuper {
+            constructor() {
+                super(...arguments);
+                /**
+                 * Image
+                 */
+                this.image = (__runInitializers(this, _instanceExtraInitializers), "");
+            }
+            /**
+             * Write the generated ARM template for review.
+             * @param output - Optional template output path
+             * @returns Generated ARM template
+             */
+            async generate(output) {
+                return super.generate(output);
+            }
+            /**
+             * Perform get resolved parameters.
+             * @override
+             */
+            getResolvedParameters() {
+                var _b, _c;
+                const p = super.getResolvedParameters();
+                const name = this.getName()
+                    .toLowerCase()
+                    .replace(/[^a-z0-9-]/g, "-")
+                    .replace(/^-+|-+$/g, "")
+                    .slice(0, 32);
+                (_b = p.containerApp).name ?? (_b.name = name);
+                (_c = p.environment).name ?? (_c.name = p.environment.id && !p.environment.id.startsWith("[")
+                    ? p.environment.id.split("/").slice(-1)[0]
+                    : `${p.resourceGroup}-env`);
+                if (!p.image && p.registry) {
+                    const packageName = getDeploymentVariables(this).package.name?.replace(/^@[^/]+\//, "") ?? name;
+                    p.image = `${p.registry}.azurecr.io/${packageName.toLowerCase()}`;
+                }
+                if (!p.image)
+                    throw new WebdaError.BadRequest("Container Apps requires image or registry");
+                if (!/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/.test(p.containerApp.name))
+                    throw new WebdaError.BadRequest("Invalid Container App name (2-32 lowercase letters, numbers and hyphens)");
+                return p;
+            }
+            /**
+             * Return the application resource identifier.
+             * @returns The app resource id result
+             */
+            getAppResourceId() {
+                return resourceId("Microsoft.App/containerApps", this.resources.containerApp.name);
+            }
+            /**
+             * Return the managed identity resource identifier.
+             * @returns The identity resource id result
+             */
+            getIdentityResourceId() {
+                return resourceId("Microsoft.ManagedIdentity/userAssignedIdentities", `${this.resources.containerApp.name}-identity`);
+            }
+            /**
+             * Return the ARM expression for the application principal.
+             * @returns The app principal id result
+             */
+            getAppPrincipalId() {
+                return `[reference(${armValue(this.getIdentityResourceId())}, '2023-01-31').principalId]`;
+            }
+            /**
+             * Return the managed environment resource identifier.
+             * @returns The environment id result
+             */
+            environmentId() {
+                return (this.resources.environment.id ?? resourceId("Microsoft.App/managedEnvironments", this.resources.environment.name));
+            }
+            /**
+             * Describe the application managed identity.
+             * @returns The identity result
+             */
+            identity() {
+                return { type: "SystemAssigned, UserAssigned", userAssignedIdentities: { [this.getIdentityResourceId()]: {} } };
+            }
+            /**
+             * Build the runtime environment from contributors and explicit overrides.
+             * @returns The env result
+             */
+            env() {
+                return Object.entries({
+                    ...this.contributedEnv,
+                    AZURE_CLIENT_ID: `[reference(${armValue(this.getIdentityResourceId())}, '2023-01-31').clientId]`,
+                    ...this.resources.containerApp.env
+                }).map(([name, value]) => ({ name, ...(typeof value === "string" ? { value } : value) }));
+            }
+            /**
+             * Convert configured secrets to secure parameters or Key Vault references.
+             * @returns The secrets result
+             */
+            secrets() {
+                return Object.entries(this.resources.secrets).map(([name, value]) => ({
+                    name,
+                    ...(typeof value === "object" && !(value instanceof SecretString)
+                        ? value
+                        : { value: this.secureParameter(value) })
+                }));
+            }
+            /**
+             * Configure managed identity image pulls.
+             * @returns The registries result
+             */
+            registries() {
+                if (this.resources.registryAuth === "none")
+                    return [];
+                const target = parseImageReference(this.resources.image);
+                return [{ server: target.registry, identity: this.getIdentityResourceId() }];
+            }
+            /**
+             * Generate the deployment template without contacting Azure.
+             * @param image - Immutable container image reference
+             * @returns ARM template without secret values
+             */
+            generateTemplate(image) {
+                this.prepare();
+                const target = parseImageReference(this.resources.image);
+                this.image = image ?? formatImageReference({ ...target, tag: target.digest ? undefined : target.tag });
+                this.addResource({
+                    type: "Microsoft.ManagedIdentity/userAssignedIdentities",
+                    apiVersion: "2023-01-31",
+                    name: `${this.resources.containerApp.name}-identity`,
+                    location: this.resources.location,
+                    tags: this.getDefaultTags()
+                });
+                this.Resources();
+                if (!this.resources.environment.id) {
+                    if (this.resources.logAnalytics !== false)
+                        this.LogAnalytics();
+                    this.ManagedEnvironment();
+                }
+                if (this.resources.registryAuth !== "none") {
+                    const registry = this.resources.registry ?? target.registry.split(".")[0];
+                    this.roles.push({
+                        scope: resourceId("Microsoft.ContainerRegistry/registries", registry),
+                        roleDefinitionId: `/subscriptions/${this.resources.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/7f951dda-4ed3-4680-a7ca-43fe172d538d`
+                    });
+                }
+                this.grantRoles();
+                this.ContainerApp();
+                this.ManagedCertificates();
+                if (this.resources.crons)
+                    this.Jobs();
+                this.template.outputs.fqdn = {
+                    type: "string",
+                    value: `[reference(${armValue(this.getAppResourceId())}, '2024-03-01').configuration.ingress.fqdn]`
+                };
+                this.template.outputs.latestRevisionName = {
+                    type: "string",
+                    value: `[reference(${armValue(this.getAppResourceId())}, '2024-03-01').latestRevisionName]`
+                };
+                return this.template;
+            }
+            /**
+             * Add the optional Log Analytics workspace.
+             */
+            LogAnalytics() {
+                const p = this.resources, log = p.logAnalytics;
+                if (log === false)
+                    return;
+                this.addResource({
+                    type: "Microsoft.OperationalInsights/workspaces",
+                    apiVersion: "2023-09-01",
+                    name: log.name ?? `${p.environment.name}-logs`,
+                    location: p.location,
+                    tags: this.getDefaultTags(),
+                    properties: { sku: { name: "PerGB2018" }, retentionInDays: log.retentionInDays ?? 30 }
+                });
+            }
+            /**
+             * Add the Container Apps managed environment.
+             */
+            ManagedEnvironment() {
+                const p = this.resources, log = p.logAnalytics;
+                const workspace = log === false
+                    ? undefined
+                    : resourceId("Microsoft.OperationalInsights/workspaces", log.name ?? `${p.environment.name}-logs`);
+                this.addResource({
+                    type: "Microsoft.App/managedEnvironments",
+                    apiVersion: "2024-03-01",
+                    name: p.environment.name,
+                    location: p.location,
+                    tags: this.getDefaultTags(),
+                    dependsOn: workspace ? [workspace] : [],
+                    properties: workspace
+                        ? {
+                            appLogsConfiguration: {
+                                destination: "log-analytics",
+                                logAnalyticsConfiguration: {
+                                    customerId: `[reference(${armValue(workspace)}, '2023-09-01').customerId]`,
+                                    sharedKey: `[listKeys(${armValue(workspace)}, '2023-09-01').primarySharedKey]`
+                                }
+                            }
+                        }
+                        : {}
+                });
+            }
+            /**
+             * Add the application and its scaling and ingress settings.
+             */
+            ContainerApp() {
+                const p = this.resources, app = p.containerApp;
+                const roleIds = this.template.resources
+                    .filter(resource => resource.type === "Microsoft.Authorization/roleAssignments")
+                    .map(roleAssignmentId);
+                this.addResource({
+                    type: "Microsoft.App/containerApps",
+                    apiVersion: "2024-03-01",
+                    name: app.name,
+                    location: p.location,
+                    tags: this.getDefaultTags(),
+                    identity: this.identity(),
+                    dependsOn: [this.getIdentityResourceId(), ...(!p.environment.id ? [this.environmentId()] : []), ...roleIds],
+                    properties: {
+                        managedEnvironmentId: this.environmentId(),
+                        configuration: {
+                            activeRevisionsMode: "Single",
+                            ingress: app.ingress === false
+                                ? undefined
+                                : {
+                                    external: true,
+                                    targetPort: 18080,
+                                    transport: "auto",
+                                    ...app.ingress,
+                                    customDomains: p.customDomains.map(domain => ({
+                                        name: domain.name,
+                                        certificateId: domain.certificateId,
+                                        bindingType: domain.certificateId ? (domain.bindingType ?? "SniEnabled") : "Disabled"
+                                    }))
+                                },
+                            secrets: this.secrets(),
+                            registries: this.registries()
+                        },
+                        template: {
+                            containers: [
+                                {
+                                    name: "webda",
+                                    image: this.image,
+                                    resources: { cpu: app.cpu ?? 0.5, memory: app.memory ?? "1Gi" },
+                                    env: this.env(),
+                                    probes: app.probes
+                                }
+                            ],
+                            scale: {
+                                minReplicas: p.customDomains.some(domain => !domain.certificateId)
+                                    ? Math.max(1, app.minReplicas ?? 0)
+                                    : (app.minReplicas ?? 0),
+                                maxReplicas: app.maxReplicas ?? 10,
+                                rules: app.scaleRules
+                            }
+                        }
+                    }
+                });
+            }
+            /** Issue managed certificates after hostname registration, then bind them in a nested deployment. */
+            ManagedCertificates() {
+                const managed = this.resources.customDomains.filter(domain => !domain.certificateId);
+                if (!managed.length)
+                    return;
+                if (this.resources.containerApp.ingress === false || this.resources.containerApp.ingress?.external === false)
+                    throw new WebdaError.BadRequest("Managed certificates require public HTTP ingress");
+                const app = this.template.resources.find(resource => resource.type === "Microsoft.App/containerApps");
+                const certificates = new Map();
+                for (const domain of managed) {
+                    if (!/^[a-zA-Z0-9.-]+$/.test(domain.name))
+                        throw new WebdaError.BadRequest("Invalid custom domain name");
+                    const name = `${this.resources.containerApp.name}-${createHash("sha256").update(domain.name).digest("hex").slice(0, 8)}`;
+                    const id = resourceId("Microsoft.App/managedEnvironments/managedCertificates", this.resources.environment.name, name);
+                    certificates.set(domain.name, id);
+                    this.addResource({
+                        type: "Microsoft.App/managedEnvironments/managedCertificates",
+                        apiVersion: "2024-03-01",
+                        name: `${this.resources.environment.name}/${name}`,
+                        location: this.resources.location,
+                        dependsOn: [this.getAppResourceId()],
+                        properties: { subjectName: domain.name, domainControlValidation: domain.validationMethod ?? "CNAME" }
+                    });
+                }
+                const boundApp = structuredClone(app);
+                delete boundApp.dependsOn;
+                boundApp.properties.configuration.ingress.customDomains = this.resources.customDomains.map(domain => ({
+                    name: domain.name,
+                    certificateId: domain.certificateId ?? certificates.get(domain.name),
+                    bindingType: domain.bindingType ?? "SniEnabled"
+                }));
+                const nested = createAzureTemplate();
+                nested.parameters = structuredClone(this.template.parameters);
+                nested.resources = [boundApp];
+                this.addResource({
+                    type: "Microsoft.Resources/deployments",
+                    apiVersion: "2022-09-01",
+                    name: `${this.resources.containerApp.name}-domains`,
+                    dependsOn: [...certificates.values()],
+                    properties: {
+                        mode: "Incremental",
+                        expressionEvaluationOptions: { scope: "inner" },
+                        template: nested,
+                        parameters: Object.fromEntries(Object.keys(nested.parameters).map(name => [name, { value: `[parameters('${name}')]` }]))
+                    }
+                });
+            }
+            /**
+             * Export declared crons as scheduled jobs, each running `cron run --id` on its operation.
+             */
+            Jobs() {
+                for (const cron of CronService.resolveCrons()) {
+                    const id = CronService.getExportId(cron), p = this.resources, app = p.containerApp;
+                    const name = `${app.name.slice(0, 15)}-${id.slice(0, 16)}`.toLowerCase();
+                    this.addResource({
+                        type: "Microsoft.App/jobs",
+                        apiVersion: "2024-03-01",
+                        name,
+                        location: p.location,
+                        tags: this.getDefaultTags(),
+                        identity: this.identity(),
+                        dependsOn: [this.getAppResourceId()],
+                        properties: {
+                            environmentId: this.environmentId(),
+                            configuration: {
+                                triggerType: "Schedule",
+                                replicaTimeout: 1800,
+                                replicaRetryLimit: 3,
+                                scheduleTriggerConfig: {
+                                    cronExpression: containerAppsSchedule(cron.cron),
+                                    parallelism: 1,
+                                    replicaCompletionCount: 1
+                                },
+                                secrets: this.secrets(),
+                                registries: this.registries()
+                            },
+                            template: {
+                                containers: [
+                                    {
+                                        name: "webda",
+                                        image: this.image,
+                                        args: ["cron", "run", "--id", id],
+                                        env: this.env(),
+                                        resources: { cpu: app.cpu ?? 0.5, memory: app.memory ?? "1Gi" }
+                                    }
+                                ]
+                            }
+                        }
+                    });
+                }
+            }
+            /**
+             * Publish the OCI image using the selected registry authentication.
+             * @returns The push result
+             */
+            async push() {
+                const p = this.getResolvedParameters();
+                if (p.registryAuth === "aad") {
+                    const server = parseImageReference(p.image).registry;
+                    const token = await new AzureAuth(p).getAcrRefreshToken(server);
+                    this.parameters.credentials[server] = { identityToken: new SecretString(token, "azure") };
+                }
+                return super.push();
+            }
+            /**
+             * Publish and deploy the application, returning its endpoints.
+             * @returns The deploy result
+             */
+            async deploy() {
+                const digest = await this.push();
+                const p = this.getResolvedParameters(), target = parseImageReference(p.image);
+                const image = formatImageReference({ ...target, tag: undefined, digest });
+                this.generateTemplate(image);
+                this.writeTemplate();
+                const outputs = await this.sendTemplate();
+                return (this.result = {
+                    image,
+                    digest,
+                    fqdn: outputs.fqdn?.value,
+                    revision: outputs.latestRevisionName?.value,
+                    outputs
+                });
+            }
+        },
+        (() => {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _generate_decorators = [Command("azure template", { description: "Generate the Container Apps ARM template" })];
+            _push_decorators = [Command("container push", { description: "Build and push the image using Azure registry authentication" })];
+            _deploy_decorators = [Command("deploy", { description: "Build, publish and deploy the application to Azure Container Apps" })];
+            __esDecorate(_a, null, _generate_decorators, { kind: "method", name: "generate", static: false, private: false, access: { has: obj => "generate" in obj, get: obj => obj.generate }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _push_decorators, { kind: "method", name: "push", static: false, private: false, access: { has: obj => "push" in obj, get: obj => obj.push }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _deploy_decorators, { kind: "method", name: "deploy", static: false, private: false, access: { has: obj => "deploy" in obj, get: obj => obj.deploy }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(_a, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        })(),
+        /**
+         * Parameters
+         */
+        _a.Parameters = AzureContainerAppsDeployerParameters,
+        _a;
+})();
+export { AzureContainerAppsDeployer };
+//# sourceMappingURL=containerapps.service.js.map