@geekmidas/cli 10.0.0-alpha.11 → 10.0.0-alpha.111

package/dist/discover-Bsr7HjqJ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover-Bsr7HjqJ.cjs","names":["AsyncLocalStorage","format","fg","kebabCase","relative","dirname","fileURLToPath","join","existsSync","pathToFileURL","dirname","fileURLToPath","join","existsSync","pathToFileURL","createRequire","oncePerRun","WORKER_RESULT_MARKER","activeSandbox","fg","canonicalId","relative","Cron","Queue","Subscriber","GkmError"],"sources":["../src/output.ts","../src/generators/Generator.ts","../src/owningTsconfigJsx.ts","../src/sandbox/worker.ts","../src/reconcile/discover.ts"],"sourcesContent":["/**\n * Where the CLI's progress lines go.\n *\n * Commands write their progress through `output` rather than `console`. Run\n * from the terminal that is the same thing. Run inside `deploy()`, each line\n * goes to the run that wrote it instead — as an event its caller can iterate,\n * and to the logger it was handed — so a deploy embedded in another program\n * does not print over that program's own output.\n *\n * Carried by `AsyncLocalStorage` rather than passed down, because the lines\n * come from everywhere a deploy reaches — the Dockerfile generator, the env\n * sniffer, construct discovery — and two deploys running in one process must\n * not hear each other.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { format } from 'node:util';\n\n/** How loud a line is. */\nexport type OutputLevel = 'info' | 'warn' | 'error';\n\n/** Receives each line written while it is the current sink. */\nexport type OutputSink = (level: OutputLevel, message: string) => void;\n\nconst current = new AsyncLocalStorage<OutputSink>();\n\n/** Runs `fn` with every line written through `output` sent to `sink`. */\nexport function withOutput<T>(sink: OutputSink, fn: () => T): T {\n\treturn current.run(sink, fn);\n}\n\nfunction write(\n\tlevel: OutputLevel,\n\tfallback: (...args: unknown[]) => void,\n): (...args: unknown[]) => void {\n\treturn (...args) => {\n\t\tconst sink = current.getStore();\n\t\tif (sink) sink(level, format(...args));\n\t\telse fallback(...args);\n\t};\n}\n\n/**\n * `console`, for the methods the CLI logs through — routed to the current\n * run's sink when there is one.\n */\nexport const output = {\n\tlog: write('info', (...args) => console.log(...args)),\n\tinfo: write('info', (...args) => console.info(...args)),\n\twarn: write('warn', (...args) => console.warn(...args)),\n\terror: write('error', (...args) => console.error(...args)),\n};\n","import { relative } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\nimport fg from 'fast-glob';\nimport kebabCase from 'lodash.kebabcase';\nimport type { BuildContext } from '../build/types';\nimport type { MainProvider, Routes } from '../types';\n\n/**\n * Zod v4 maintains a process-wide registry of schemas registered via\n * `.meta({ id })`. When we cache-bust user module imports (by appending a\n * `?t=timestamp` query), those modules re-execute and try to register the\n * same ids again, which throws `ID X already exists in the registry`.\n *\n * Clearing the registry in the CLI process is safe: the user's running\n * server lives in a subprocess and has its own isolated registry.\n *\n * Exported for tests.\n */\nexport function clearZodGlobalRegistry(): void {\n\tconst registry = (\n\t\tglobalThis as { __zod_globalRegistry?: { clear?: () => void } }\n\t).__zod_globalRegistry;\n\tif (registry && typeof registry.clear === 'function') {\n\t\tregistry.clear();\n\t}\n}\n\nexport interface GeneratorOptions {\n\t/** Where the build deploys: one Lambda per construct, or one process. */\n\ttarget?: MainProvider;\n\t/**\n\t * What a handler path in the manifest is relative to — the workspace root,\n\t * which is where `sst.config.ts` runs and resolves it from.\n\t */\n\troot?: string;\n\t[key: string]: any;\n}\n\nexport abstract class ConstructGenerator<T extends Construct, R = void> {\n\tabstract isConstruct(value: any): value is T;\n\n\tstatic async build<T extends Construct, R = void>(\n\t\tcontext: BuildContext,\n\t\toutputDir: string,\n\t\tgenerator: ConstructGenerator<T, R>,\n\t\tpatterns?: Routes,\n\t\toptions?: GeneratorOptions,\n\t): Promise<R> {\n\t\tconst constructs = await generator.load(patterns);\n\t\treturn generator.build(context, constructs, outputDir, options);\n\t}\n\n\tabstract build(\n\t\tcontext: BuildContext,\n\t\tconstructs: GeneratedConstruct<T>[],\n\t\toutputDir: string,\n\t\toptions?: GeneratorOptions,\n\t): Promise<R>;\n\n\tasync load(\n\t\tpatterns?: Routes,\n\t\tcwd = process.cwd(),\n\t\tbustCache = false,\n\t): Promise<GeneratedConstruct<T>[]> {\n\t\tconst logger = console;\n\n\t\tconst globPatterns = Array.isArray(patterns)\n\t\t\t? patterns\n\t\t\t: patterns\n\t\t\t\t? [patterns]\n\t\t\t\t: [];\n\n\t\t// Find all files\n\t\tconst files = fg.stream(globPatterns, {\n\t\t\tcwd,\n\t\t\tabsolute: true,\n\t\t});\n\n\t\t// Cache-busted re-imports re-execute user modules, which would try to\n\t\t// re-register Zod schemas with the same `.meta({ id })`. Clear the\n\t\t// global registry once per load to prevent duplicate-id errors.\n\t\tif (bustCache) {\n\t\t\tclearZodGlobalRegistry();\n\t\t}\n\n\t\t// Load constructs\n\t\tconst constructs: GeneratedConstruct<T>[] = [];\n\n\t\tfor await (const f of files) {\n\t\t\ttry {\n\t\t\t\tconst file = f.toString();\n\t\t\t\t// Append cache-busting query param to force re-import of changed modules\n\t\t\t\tconst importPath = bustCache ? `${file}?t=${Date.now()}` : file;\n\t\t\t\tconst module = await import(importPath);\n\n\t\t\t\t// Check all exports for constructs\n\t\t\t\tfor (const [key, construct] of Object.entries(module)) {\n\t\t\t\t\tif (this.isConstruct(construct)) {\n\t\t\t\t\t\tconstructs.push({\n\t\t\t\t\t\t\tkey,\n\t\t\t\t\t\t\tname: kebabCase(key),\n\t\t\t\t\t\t\tconstruct,\n\t\t\t\t\t\t\tpath: {\n\t\t\t\t\t\t\t\tabsolute: file,\n\t\t\t\t\t\t\t\trelative: relative(process.cwd(), file),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tconst err = error as Error;\n\t\t\t\tlogger.error(`Failed to load ${f}: ${err.message}`);\n\t\t\t\tif (err.stack) {\n\t\t\t\t\tlogger.error(err.stack);\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\n\t\treturn constructs;\n\t}\n}\n\nexport interface GeneratedConstruct<T extends Construct> {\n\tkey: string;\n\tname: string;\n\tconstruct: T;\n\tpath: {\n\t\tabsolute: string;\n\t\trelative: string;\n\t};\n}\n","import { existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath, pathToFileURL } from 'node:url';\n\nconst REGISTER = 'owning-tsconfig-jsx-register.mjs';\n\n/** The CLI's `bin/` was not found above the module looking for it. */\nexport class OwningTsconfigJsxHookMissing extends Error {\n\tconstructor(readonly from: string) {\n\t\tsuper(\n\t\t\t`Could not find bin/${REGISTER} in any directory above '${from}'. ` +\n\t\t\t\t'It ships with @geekmidas/cli beside bin/gkm.mjs; reinstall the ' +\n\t\t\t\t'package if it is missing.',\n\t\t);\n\t\tthis.name = 'OwningTsconfigJsxHookMissing';\n\t}\n}\n\n/**\n * The CLI's `bin/owning-tsconfig-jsx-register.mjs`, as a file URL. Searched\n * upward because this module runs from `src/` in the repo and from a chunk in\n * `dist/` once built, and `bin/` sits beside both.\n */\nfunction registerUrl(): string {\n\tconst from = dirname(fileURLToPath(import.meta.url));\n\tfor (let dir = from; ; dir = dirname(dir)) {\n\t\tconst candidate = join(dir, 'bin', REGISTER);\n\t\tif (existsSync(candidate)) return pathToFileURL(candidate).href;\n\t\tif (dirname(dir) === dir) throw new OwningTsconfigJsxHookMissing(from);\n\t}\n}\n\n/**\n * `NODE_OPTIONS` for a process that runs app code through tsx, with the hook\n * that compiles each `.tsx` with its own tsconfig's JSX settings (see\n * `bin/owning-tsconfig-jsx.mjs`) put in front of every other `--import`, so it\n * is registered before tsx and reads the source on tsx's behalf.\n *\n * `bin/gkm.mjs` already starts the CLI this way, and its children inherit it;\n * this is for those that set `NODE_OPTIONS` themselves, or whose CLI was\n * started with tsx already imported.\n */\nexport function withOwningTsconfigJsx(nodeOptions = ''): string {\n\tif (nodeOptions.includes(REGISTER)) return nodeOptions;\n\treturn [`--import=${registerUrl()}`, nodeOptions].filter(Boolean).join(' ');\n}\n","/**\n * Running one of the CLI's own worker scripts inside a sandbox, and reading\n * back the one JSON value it answers with.\n *\n * The worker imports the project's TypeScript — `gkm.config.ts`, construct\n * modules, an app's entry — so it starts with the CLI's own tsx and the two\n * hooks `gkm` itself runs with (JSX by the owning tsconfig, path aliases by\n * the adjacent one). The host process needs none of them loaded: a program\n * calling `deploy()` without `--import tsx` still loads a TypeScript config.\n */\n\nimport { existsSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath, pathToFileURL } from 'node:url';\nimport type { z } from 'zod';\nimport { withOwningTsconfigJsx } from '../owningTsconfigJsx';\nimport { oncePerRun, type Sandbox } from './sandbox';\nimport { WORKER_RESULT_MARKER } from './workerRuntime';\n\nconst here = dirname(fileURLToPath(import.meta.url));\n\n/**\n * A worker's file: `dist/sandbox/<name>.mjs` once built — whether this module\n * was bundled into `dist/` or sits beside it — or the `.ts` source under tsx.\n */\nexport function workerFile(name: string): string {\n\tconst candidates = [\n\t\tjoin(here, 'sandbox', `${name}.mjs`),\n\t\tjoin(here, `${name}.mjs`),\n\t\tjoin(here, '..', 'sandbox', `${name}.mjs`),\n\t\tjoin(here, `${name}.ts`),\n\t];\n\treturn (\n\t\tcandidates.find((path) => existsSync(path)) ?? join(here, `${name}.ts`)\n\t);\n}\n\n/** tsx, from the CLI's own dependencies — never the project's. */\nexport function tsxUrl(): string {\n\treturn pathToFileURL(createRequire(import.meta.url).resolve('tsx')).href;\n}\n\n/**\n * `node`'s arguments for `script`: the CLI's TypeScript loaders, then any\n * further `imports`, then the script and its `args` — an argument array, so\n * nothing about a path is read by a shell.\n */\nexport function nodeWithTsx(\n\tscript: string,\n\targs: readonly string[],\n\timports: readonly string[] = [],\n): string[] {\n\treturn [\n\t\t...withOwningTsconfigJsx(`--import=${tsxUrl()}`).split(' '),\n\t\t...imports.map((path) => `--import=${pathToFileURL(path).href}`),\n\t\tscript,\n\t\t...args,\n\t];\n}\n\n/** A worker ended without the answer it exists to give. */\nexport class SandboxWorkerFailed extends Error {\n\tconstructor(\n\t\treadonly step: string,\n\t\treadonly exitCode: number | null,\n\t\treadonly stderr: string,\n\t) {\n\t\tsuper(\n\t\t\t`The sandboxed ${step} ended (exit code ${exitCode}) without an ` +\n\t\t\t\t`answer.${stderr.trim() ? `\\n${stderr.trim()}` : ''}\\nIts output ` +\n\t\t\t\t'above says why; the sandbox must be able to run `node` with the ' +\n\t\t\t\t\"CLI's own files at the paths they have here.\",\n\t\t);\n\t\tthis.name = 'SandboxWorkerFailed';\n\t}\n}\n\nexport interface WorkerRun<T> {\n\t/** What the worker answered, as the schema reads it. */\n\tvalue: T;\n\t/** What it wrote to stderr: warnings a caller may pass on. */\n\tstderr: string;\n}\n\n/**\n * Run worker `name` in `sandbox`, and parse its answer with `schema`.\n *\n * The answer is the last marked line on stdout. Anything else the project's\n * code printed is ignored, and an answer the schema refuses is a failure\n * rather than data — a worker in an isolating sandbox runs code the host does\n * not trust.\n *\n * Within a run (`withSandbox`), the same worker asked the same question is\n * started once; every ask gets its own copy of the answer, and its stderr, as\n * though it had run again.\n */\nexport async function runWorker<S extends z.ZodType>(\n\tsandbox: Sandbox,\n\tstep: string,\n\toptions: WorkerOptions<S>,\n): Promise<WorkerRun<z.infer<S>>> {\n\t// A step handed secrets acts on something — a database it migrates — and\n\t// is not a question whose answer can be reused; nor do its secrets belong\n\t// in a cache key.\n\tif (options.secrets) return startWorker(sandbox, step, options);\n\n\tconst key = JSON.stringify([\n\t\toptions.name,\n\t\toptions.cwd,\n\t\toptions.args,\n\t\toptions.env ?? {},\n\t]);\n\tconst answer = await oncePerRun(sandbox, key, () =>\n\t\tstartWorker(sandbox, step, options),\n\t);\n\treturn structuredClone(answer);\n}\n\ninterface WorkerOptions<S extends z.ZodType> {\n\tname: string;\n\targs: readonly string[];\n\tcwd: string;\n\ttimeoutMs: number;\n\tenv?: Readonly<Record<string, string>>;\n\t/** Mounted as files, named by `GKM_SECRETS_DIR` — never variables. */\n\tsecrets?: Readonly<Record<string, string>>;\n\tsignal?: AbortSignal;\n\tschema: S;\n}\n\nasync function startWorker<S extends z.ZodType>(\n\tsandbox: Sandbox,\n\tstep: string,\n\toptions: WorkerOptions<S>,\n): Promise<WorkerRun<z.infer<S>>> {\n\tconst result = await sandbox.exec(\n\t\t'node',\n\t\tnodeWithTsx(workerFile(options.name), options.args),\n\t\t{\n\t\t\tcwd: options.cwd,\n\t\t\tenv: { ...sandbox.env, ...options.env },\n\t\t\ttimeoutMs: options.timeoutMs,\n\t\t\toutput: 'capture',\n\t\t\t...(options.secrets ? { secrets: options.secrets } : {}),\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t},\n\t);\n\n\tconst line = result.stdout\n\t\t.split('\\n')\n\t\t.reverse()\n\t\t.find((l) => l.startsWith(WORKER_RESULT_MARKER));\n\tif (line) {\n\t\ttry {\n\t\t\tconst parsed = options.schema.safeParse(\n\t\t\t\tJSON.parse(line.slice(WORKER_RESULT_MARKER.length)),\n\t\t\t);\n\t\t\tif (parsed.success) return { value: parsed.data, stderr: result.stderr };\n\t\t} catch {\n\t\t\t// Not JSON: as good as no answer.\n\t\t}\n\t}\n\n\tthrow new SandboxWorkerFailed(step, result.exitCode, result.stderr);\n}\n","/**\n * Discovery — one glob, one structural test.\n *\n * A glob per kind is the same specialness the construct model removes, and\n * resources have no kind to be listed under: a declared `ObjectStorage` would\n * never be found by `routes:` or `crons:`. So there is one `constructs` glob,\n * every export of every matching module is inspected, and the per-kind\n * `isConstruct` checks collapse into a single question — does it have an id and\n * can it declare?\n *\n * Structural rather than `instanceof` on purpose. A construct from a different\n * copy of `@geekmidas/constructs` — a linked workspace, two versions in a\n * lockfile — is still a construct, and `instanceof` is exactly the check that\n * says otherwise.\n */\n\nimport { relative } from 'node:path';\nimport { Cron } from '@geekmidas/constructs/crons';\nimport { Queue } from '@geekmidas/constructs/queue';\nimport { Subscriber } from '@geekmidas/constructs/subscribers';\nimport {\n\tassertDerivations,\n\ttype ConstructManifest,\n\tcanonicalId,\n\ttype Declaration,\n} from '@geekmidas/manifest';\nimport fg from 'fast-glob';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport { clearZodGlobalRegistry } from '../generators/Generator';\nimport { output } from '../output';\nimport { activeSandbox, type Sandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** `console`, or the deploy run discovering the manifest. */\nconst logger = output;\n\n/** The construct face discovery needs: an id, and the ability to declare. */\ninterface Declarable {\n\tid: string;\n\tdeclare(): Declaration[];\n}\n\n/**\n * Whether a module export is a construct.\n *\n * Deliberately loose about what else it carries — a construct that also has a\n * `service` is still a construct, and requiring one would exclude the kinds that\n * own no address.\n */\nexport function isDeclarable(value: unknown): value is Declarable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Declarable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\tcandidate.id.length > 0 &&\n\t\ttypeof candidate.declare === 'function'\n\t);\n}\n\nexport interface DiscoverOptions {\n\t/** The glob(s) to search. One pattern, not one per kind. */\n\tpatterns: string | readonly string[];\n\tcwd?: string;\n\t/**\n\t * Re-import changed modules, for the dev watcher.\n\t *\n\t * A single glob makes discovery more central, not less: a new construct file\n\t * has to be picked up on `add`, not only on `change`.\n\t */\n\tbustCache?: boolean;\n\t/**\n\t * Filled in with where each construct was found, when provided.\n\t *\n\t * Discovery is the only thing that knows: it globbed the files and imported\n\t * them. Everything downstream that needs to *write* an import — the build,\n\t * generating a server entry that reads a surface's logger — would otherwise\n\t * have to be told the path in config, which is the string this removes.\n\t *\n\t * An out-parameter rather than a second return value so that every existing\n\t * caller, which wants the manifest and nothing else, is unchanged.\n\t */\n\tsources?: Record<string, ConstructSource>;\n\t/**\n\t * Filled in, when provided, with the ids each owner's runnables declared an\n\t * edge to — keyed by the surface an endpoint was built from, or the worker\n\t * a cron or subscriber was.\n\t *\n\t * A runnable is not a declaration: a surface's endpoints are found by the\n\t * glob, not listed by the surface, so its node says `endpoints: []` until a\n\t * build folds the routes in. Anything deciding what an app's process reaches\n\t * — which keys its container is given — needs those edges before any build,\n\t * and discovery is already importing the files they are in.\n\t */\n\trunnables?: Record<string, string[]>;\n\t/**\n\t * Filled in, when provided, with the files each worker's background work is\n\t * declared in — its crons, queue consumers and topic subscribers — keyed by\n\t * the worker.\n\t *\n\t * What says which app's build carries a worker's entry: the one whose\n\t * directory holds its work. A worker declares no path of its own.\n\t */\n\tbackground?: Record<string, string[]>;\n\t/**\n\t * Import the construct modules in this sandbox rather than in this\n\t * process. Defaults to the run's own (`withSandbox`), so a deploy's every\n\t * discovery — the engine's included — happens there; with neither, they\n\t * are imported here, as before.\n\t */\n\tsandbox?: Sandbox;\n}\n\n/** What the discovery worker answers. Checked: the worker ran project code. */\nconst DiscoverAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('discovered'),\n\t\tmanifest: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ id: z.string(), kind: z.string() }).loose(),\n\t\t),\n\t\trunnables: z.record(z.string(), z.array(z.string())),\n\t\tbackground: z.record(z.string(), z.array(z.string())).optional(),\n\t}),\n\tz.object({ reason: z.literal('live'), paths: z.array(z.string()) }),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z\n\t\t\t.object({\n\t\t\t\tname: z.string(),\n\t\t\t\tmessage: z.string(),\n\t\t\t\tid: z.string().optional(),\n\t\t\t\tsources: z.array(z.string()).optional(),\n\t\t\t})\n\t\t\t.loose(),\n\t}),\n]);\n\n/**\n * The manifest, discovered in `sandbox` and handed back as JSON — or\n * `undefined` when it holds something JSON cannot carry and the sandbox is\n * not isolating, for the caller to discover here as before.\n */\nasync function discoverInSandbox(\n\tsandbox: Sandbox,\n\toptions: DiscoverOptions,\n): Promise<ConstructManifest | undefined> {\n\tconst cwd = options.cwd ?? sandbox.root;\n\tconst patterns =\n\t\ttypeof options.patterns === 'string'\n\t\t\t? [options.patterns]\n\t\t\t: [...options.patterns];\n\n\tconst { value, stderr } = await runWorker(sandbox, 'construct discovery', {\n\t\tname: 'discover-worker',\n\t\targs: [JSON.stringify({ patterns, cwd })],\n\t\tcwd,\n\t\ttimeoutMs: DISCOVER_TIMEOUT_MS,\n\t\tschema: DiscoverAnswer,\n\t});\n\n\t// Discovery's own warnings — a glob that matched nothing — are the\n\t// run's, as they would be had it discovered in-process: as written, one\n\t// message, less the newline the worker's `console.warn` ended it with.\n\tif (stderr.trim()) logger.warn(stderr.replace(/\\n$/, ''));\n\n\tswitch (value.reason) {\n\t\tcase 'discovered':\n\t\t\tif (options.runnables) {\n\t\t\t\tfor (const [owner, edges] of Object.entries(value.runnables)) {\n\t\t\t\t\toptions.runnables[owner] = edges;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (options.background) {\n\t\t\t\tfor (const [owner, files] of Object.entries(value.background ?? {})) {\n\t\t\t\t\toptions.background[owner] = files;\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn value.manifest as unknown as ConstructManifest;\n\t\tcase 'failed':\n\t\t\tif (value.error.name === 'DuplicateConstruct' && value.error.id) {\n\t\t\t\tthrow new DuplicateConstruct(value.error.id, value.error.sources ?? []);\n\t\t\t}\n\t\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t\tcase 'live':\n\t\t\tif (sandbox.isolating) throw new ConstructsNotSerializable(value.paths);\n\t\t\treturn undefined;\n\t}\n}\n\n/**\n * A caller asked for the construct objects (`sources`) or a watcher's\n * re-import under an isolating sandbox, where only data comes back.\n */\nexport class LiveConstructsUnavailable extends Error {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'Discovery was asked for the construct objects themselves under an ' +\n\t\t\t\t'isolating sandbox, which hands back only data. Run this step ' +\n\t\t\t\t'without one, or ask only for the manifest.',\n\t\t);\n\t\tthis.name = 'LiveConstructsUnavailable';\n\t}\n}\n\n/** How long discovering a project's constructs may take in a sandbox. */\nconst DISCOVER_TIMEOUT_MS = 60_000;\n\n/** Importing a construct module, or declaring one, threw in the sandbox. */\nexport class ConstructDiscoveryFailed extends Error {\n\tconstructor(\n\t\treadonly errorName: string,\n\t\treadonly detail: string,\n\t) {\n\t\tsuper(`Discovering constructs failed (${errorName}): ${detail}`);\n\t\tthis.name = 'ConstructDiscoveryFailed';\n\t}\n}\n\n/**\n * The constructs' declarations hold something that is not data, and the\n * sandbox they were discovered in hands the deploy nothing but data.\n */\nexport class ConstructsNotSerializable extends Error {\n\tconstructor(readonly paths: readonly string[]) {\n\t\tsuper(\n\t\t\t`The construct manifest holds values that are not plain data at: ` +\n\t\t\t\t`${paths.join(', ')}. Under an isolating sandbox the deploy only ` +\n\t\t\t\t'receives what JSON can carry; deploy with a sandbox that is not ' +\n\t\t\t\t'isolating if the host trusts this project.',\n\t\t);\n\t\tthis.name = 'ConstructsNotSerializable';\n\t}\n}\n\n/** Where a construct was declared, and under what name. */\nexport interface ConstructSource {\n\t/** Absolute path to the module that exported it. */\n\tfile: string;\n\t/** The name it was exported as — what an import statement has to say. */\n\texportName: string;\n\t/**\n\t * The exported construct itself.\n\t *\n\t * What a declaration cannot say — whether it serves itself — the object can\n\t * be asked, and discovery already imported it.\n\t */\n\tconstruct: unknown;\n}\n\n/**\n * Build the construct manifest for a project.\n *\n * Runs the manifest's own validation before returning, so an app is wrong here\n * — where the error names a file — rather than at deploy.\n *\n * @throws {DuplicateConstruct} when two exports claim one id.\n */\nexport async function discover(\n\toptions: DiscoverOptions,\n): Promise<ConstructManifest> {\n\tconst sandbox = options.sandbox ?? activeSandbox();\n\tif (sandbox) {\n\t\tif (!options.sources && !options.bustCache) {\n\t\t\tconst sandboxed = await discoverInSandbox(sandbox, options);\n\t\t\tif (sandboxed) return sandboxed;\n\t\t} else if (sandbox.isolating) {\n\t\t\t// The construct objects themselves, or a re-import for the watcher:\n\t\t\t// neither can cross a sandbox that hands back only data.\n\t\t\tthrow new LiveConstructsUnavailable();\n\t\t}\n\t}\n\n\tconst {\n\t\tpatterns,\n\t\tcwd = process.cwd(),\n\t\tbustCache = false,\n\t\tsources: out,\n\t} = options;\n\n\t// Re-importing user modules re-executes them, and Zod v4 throws on a\n\t// re-registered `.meta({ id })`. Same reason the generators clear it.\n\tif (bustCache) clearZodGlobalRegistry();\n\n\tconst manifest: Record<string, Declaration> = {};\n\t/** Which file declared each id, for the error when two of them do. */\n\tconst sources: Record<string, string> = {};\n\t/**\n\t * Constructs already seen, by identity.\n\t *\n\t * A re-export is the *same object* reached through a second file — ESM\n\t * bindings are live, so `export * from './database.js'` hands back the\n\t * binding rather than a copy. Without this, a barrel file made every\n\t * construct in it appear declared twice, and `constructs/index.ts` is the\n\t * first thing anyone writes in a shared folder.\n\t *\n\t * Identity rather than file is also the more honest rule: what may not\n\t * happen twice is two *different* constructs claiming one id, and that is\n\t * still an error below.\n\t */\n\tconst seen = new WeakSet<object>();\n\n\tconst globs = Array.isArray(patterns) ? [...patterns] : [patterns as string];\n\tconst files = fg.stream(globs, { cwd, absolute: true });\n\n\t/** Matched files, for the diagnostic below. */\n\tlet matched = 0;\n\n\tfor await (const found of files) {\n\t\tmatched++;\n\t\tconst file = found.toString();\n\t\tconst module = await import(bustCache ? `${file}?t=${Date.now()}` : file);\n\n\t\tfor (const [exportName, exported] of Object.entries(module)) {\n\t\t\tif (options.background)\n\t\t\t\trecordBackground(options.background, exported, file);\n\t\t\tif (!isDeclarable(exported)) {\n\t\t\t\tif (options.runnables) recordRunnable(options.runnables, exported);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// The same construct, reached again through a re-export. Skipped\n\t\t\t// rather than re-declared: it has already claimed its id, from the\n\t\t\t// file that defined it.\n\t\t\tif (seen.has(exported as object)) continue;\n\t\t\tseen.add(exported as object);\n\n\t\t\t// A construct that is also something a process runs — a queue and its\n\t\t\t// consumer, built from a worker — reaches what it depends on through\n\t\t\t// that process, exactly as an endpoint or a cron does.\n\t\t\tif (\n\t\t\t\toptions.runnables &&\n\t\t\t\ttypeof (exported as { owner?: unknown }).owner === 'string'\n\t\t\t) {\n\t\t\t\trecordRunnable(options.runnables, exported);\n\t\t\t}\n\n\t\t\tfor (const declaration of exported.declare()) {\n\t\t\t\t// Canonicalise here too: a construct built by hand rather than through\n\t\t\t\t// a constructor is still subject to the same identity rule.\n\t\t\t\tconst id = canonicalId(declaration.id);\n\t\t\t\tconst source = relative(cwd, file);\n\n\t\t\t\tconst claimed = sources[id];\n\t\t\t\tif (claimed !== undefined && claimed !== source) {\n\t\t\t\t\tthrow new DuplicateConstruct(id, [claimed, source]);\n\t\t\t\t}\n\n\t\t\t\tmanifest[id] = { ...declaration, id };\n\t\t\t\tsources[id] = source;\n\t\t\t\tif (out) out[id] = { file, exportName, construct: exported };\n\t\t\t}\n\t\t}\n\t}\n\n\t// Reference integrity before anyone reads it — a schema tenant naming a\n\t// database that was deleted is a manifest error, not a reconcile failure.\n\tassertDerivations(manifest);\n\n\twarnIfNothingFound(globs, matched, Object.keys(manifest).length);\n\n\treturn manifest;\n}\n\n/**\n * Record where a worker's background work is declared: a cron, a queue\n * consumer or a topic subscriber, under the worker that owns it.\n */\nfunction recordBackground(\n\tbackground: Record<string, string[]>,\n\texported: unknown,\n\tfile: string,\n): void {\n\tif (\n\t\t!Cron.isCron(exported) &&\n\t\t!Queue.isQueue(exported) &&\n\t\t!Subscriber.isSubscriber(exported)\n\t) {\n\t\treturn;\n\t}\n\tconst owner = (exported as { owner?: unknown }).owner;\n\tif (typeof owner !== 'string') return;\n\n\tconst key = canonicalId(owner);\n\tconst files = background[key] ?? [];\n\tbackground[key] = files;\n\tif (!files.includes(file)) files.push(file);\n}\n\n/**\n * What a runnable consumes, by id: a queue's consumer drains that queue, a\n * subscriber its topic. Nothing for anything else.\n */\nexport function consumedBy(runnable: unknown): string[] {\n\tif (Queue.isQueue(runnable)) return [runnable.id];\n\tif (Subscriber.isSubscriber(runnable) && runnable.topicName) {\n\t\treturn [canonicalId(runnable.topicName)];\n\t}\n\treturn [];\n}\n\n/**\n * Record a runnable's edges under the construct that owns it — the surface an\n * endpoint was built from, or the worker a cron or subscriber was. Anything\n * with no owner, or that is not a runnable at all, is left alone.\n */\nfunction recordRunnable(\n\trunnables: Record<string, string[]>,\n\texported: unknown,\n): void {\n\tif (typeof exported !== 'object' || exported === null) return;\n\n\tconst runnable = exported as {\n\t\tsurface?: { id?: unknown };\n\t\towner?: unknown;\n\t\tconstructs?: unknown;\n\t};\n\tconst owner =\n\t\ttypeof runnable.surface?.id === 'string'\n\t\t\t? runnable.surface.id\n\t\t\t: typeof runnable.owner === 'string'\n\t\t\t\t? runnable.owner\n\t\t\t\t: undefined;\n\tif (!owner || !Array.isArray(runnable.constructs)) return;\n\n\tconst key = canonicalId(owner);\n\tconst edges = runnables[key] ?? [];\n\trunnables[key] = edges;\n\t// What it consumes is an edge of its process too, so a worker is handed\n\t// the carriers its own work is bound to and no other.\n\tfor (const id of [...runnable.constructs, ...consumedBy(exported)]) {\n\t\tif (typeof id !== 'string') continue;\n\t\tconst target = canonicalId(id);\n\t\tif (!edges.includes(target)) edges.push(target);\n\t}\n}\n\n/**\n * Say so when a glob was configured and found nothing.\n *\n * The glob is not a filter over declarations already known — it is *how they\n * are found*, by importing what it matches. So a file it misses is a\n * declaration that does not exist, and every symptom of that appears somewhere\n * other than the cause: no container starts, no env key is written, and the\n * application fails on first use against a resource it can see in its own\n * source.\n *\n * Nothing reported it before, because an unmatched file is indistinguishable\n * from a file nobody wrote. These two cases are the ones that are *not*\n * ambiguous — a glob was configured, so something was expected.\n *\n * Silent when no glob is configured at all: that is a project which has not\n * adopted constructs, and has nothing to be missing.\n */\nfunction warnIfNothingFound(\n\tglobs: readonly string[],\n\tmatched: number,\n\tdeclared: number,\n): void {\n\tif (globs.length === 0) return;\n\n\tif (matched === 0) {\n\t\tlogger.warn(\n\t\t\t`\\n⚠️  The constructs glob matched no files, so nothing was declared.\\n` +\n\t\t\t\t`   Patterns: ${globs.join(', ')}\\n` +\n\t\t\t\t`   Nothing will be provisioned — no containers, no env keys, no ` +\n\t\t\t\t`resources.\\n` +\n\t\t\t\t`   A common cause is depth: '*.ts' matches one level, '**/*.ts' ` +\n\t\t\t\t`matches any.`,\n\t\t);\n\t\treturn;\n\t}\n\n\tif (declared === 0) {\n\t\tlogger.warn(\n\t\t\t`\\n⚠️  The constructs glob matched ${matched} file(s) but none declared ` +\n\t\t\t\t`anything.\\n` +\n\t\t\t\t`   Patterns: ${globs.join(', ')}\\n` +\n\t\t\t\t`   Discovery keeps exports with an 'id' that can 'declare()'. A ` +\n\t\t\t\t`construct that is\\n` +\n\t\t\t\t`   built but never exported is invisible to it.`,\n\t\t);\n\t}\n}\n\n/** Two constructs claiming one id. */\nexport class DuplicateConstruct extends GkmError {\n\t/** The id claimed twice. */\n\treadonly id: string;\n\t/** The files that claimed it. */\n\treadonly sources: readonly string[];\n\n\tconstructor(id: string, sources: readonly string[]) {\n\t\tsuper('Two constructs declare the same id');\n\t\tthis.name = 'DuplicateConstruct';\n\t\tthis.id = id;\n\t\tthis.sources = sources;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,UAAU,IAAIA,iBAAAA,kBAA8B;;AAGlD,SAAgB,WAAc,MAAkB,IAAgB;CAC/D,OAAO,QAAQ,IAAI,MAAM,EAAE;AAC5B;AAEA,SAAS,MACR,OACA,UAC+B;CAC/B,QAAQ,GAAG,SAAS;EACnB,MAAM,OAAO,QAAQ,SAAS;EAC9B,IAAI,MAAM,KAAK,QAAA,GAAOC,UAAAA,OAAAA,CAAO,GAAG,IAAI,CAAC;OAChC,SAAS,GAAG,IAAI;CACtB;AACD;;;;;AAMA,MAAa,SAAS;CACrB,KAAK,MAAM,SAAS,GAAG,SAAS,QAAQ,IAAI,GAAG,IAAI,CAAC;CACpD,MAAM,MAAM,SAAS,GAAG,SAAS,QAAQ,KAAK,GAAG,IAAI,CAAC;CACtD,MAAM,MAAM,SAAS,GAAG,SAAS,QAAQ,KAAK,GAAG,IAAI,CAAC;CACtD,OAAO,MAAM,UAAU,GAAG,SAAS,QAAQ,MAAM,GAAG,IAAI,CAAC;AAC1D;;;;;;;;;;;;;;ACjCA,SAAgB,yBAA+B;CAC9C,MAAM,WACL,WACC;CACF,IAAI,YAAY,OAAO,SAAS,UAAU,YACzC,SAAS,MAAM;AAEjB;AAaA,IAAsB,qBAAtB,MAAwE;CAGvE,aAAa,MACZ,SACA,WACA,WACA,UACA,SACa;EACb,MAAM,aAAa,MAAM,UAAU,KAAK,QAAQ;EAChD,OAAO,UAAU,MAAM,SAAS,YAAY,WAAW,OAAO;CAC/D;CASA,MAAM,KACL,UACA,MAAM,QAAQ,IAAI,GAClB,YAAY,OACuB;EACnC,MAAM,SAAS;EAEf,MAAM,eAAe,MAAM,QAAQ,QAAQ,IACxC,WACA,WACC,CAAC,QAAQ,IACT,CAAC;EAGL,MAAM,QAAQC,UAAAA,QAAG,OAAO,cAAc;GACrC;GACA,UAAU;EACX,CAAC;EAKD,IAAI,WACH,uBAAuB;EAIxB,MAAM,aAAsC,CAAC;EAE7C,WAAW,MAAM,KAAK,OACrB,IAAI;GACH,MAAM,OAAO,EAAE,SAAS;GAGxB,MAAM,SAAS,OADI,YAAA,OAAY,GAAG,KAAK,KAAK,KAAK,IAAI,OAAA,OAAM;GAI3D,KAAK,MAAM,CAAC,KAAK,cAAc,OAAO,QAAQ,MAAM,GACnD,IAAI,KAAK,YAAY,SAAS,GAC7B,WAAW,KAAK;IACf;IACA,OAAA,GAAMC,iBAAAA,QAAAA,CAAU,GAAG;IACnB;IACA,MAAM;KACL,UAAU;KACV,WAAA,GAAUC,UAAAA,SAAAA,CAAS,QAAQ,IAAI,GAAG,IAAI;IACvC;GACD,CAAC;EAGJ,SAAS,OAAO;GACf,MAAM,MAAM;GACZ,OAAO,MAAM,kBAAkB,EAAE,IAAI,IAAI,SAAS;GAClD,IAAI,IAAI,OACP,OAAO,MAAM,IAAI,KAAK;GAEvB,MAAM;EACP;EAGD,OAAO;CACR;AACD;;;ACrHA,MAAM,WAAW;;AAGjB,IAAa,+BAAb,cAAkD,MAAM;CAClC;CAArB,YAAY,MAAuB;EAClC,MACC,sBAAsB,SAAS,2BAA2B,KAAK,4FAGhE;EALoB,KAAA,OAAA;EAMpB,KAAK,OAAO;CACb;AACD;;;;;;AAOA,SAAS,cAAsB;CAC9B,MAAM,QAAA,GAAOC,UAAAA,QAAAA,EAAAA,GAAQC,SAAAA,cAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,IAA6B,CAAC;CACnD,KAAK,IAAI,MAAM,OAAQ,OAAA,GAAMD,UAAAA,QAAAA,CAAQ,GAAG,GAAG;EAC1C,MAAM,aAAA,GAAYE,UAAAA,KAAAA,CAAK,KAAK,OAAO,QAAQ;EAC3C,KAAA,GAAIC,QAAAA,WAAAA,CAAW,SAAS,GAAG,QAAA,GAAOC,SAAAA,cAAAA,CAAc,SAAS,CAAC,CAAC;EAC3D,KAAA,GAAIJ,UAAAA,QAAAA,CAAQ,GAAG,MAAM,KAAK,MAAM,IAAI,6BAA6B,IAAI;CACtE;AACD;;;;;;;;;;;AAYA,SAAgB,sBAAsB,cAAc,IAAY;CAC/D,IAAI,YAAY,SAAS,QAAQ,GAAG,OAAO;CAC3C,OAAO,CAAC,YAAY,YAAY,KAAK,WAAW,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;AAC3E;;;;;;;;;;;;;ACzBA,MAAM,QAAA,GAAOK,UAAAA,QAAAA,EAAAA,GAAQC,SAAAA,cAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,IAA6B,CAAC;;;;;AAMnD,SAAgB,WAAW,MAAsB;CAOhD,OACC;GANAC,GAAAA,UAAAA,KAAAA,CAAK,MAAM,WAAW,GAAG,KAAK,KAAK;GACnCA,GAAAA,UAAAA,KAAAA,CAAK,MAAM,GAAG,KAAK,KAAK;GACxBA,GAAAA,UAAAA,KAAAA,CAAK,MAAM,MAAM,WAAW,GAAG,KAAK,KAAK;GACzCA,GAAAA,UAAAA,KAAAA,CAAK,MAAM,GAAG,KAAK,IAAI;CAGd,CAAC,CAAC,MAAM,UAAA,GAASC,QAAAA,WAAAA,CAAW,IAAI,CAAC,MAAA,GAAKD,UAAAA,KAAAA,CAAK,MAAM,GAAG,KAAK,IAAI;AAExE;;AAGA,SAAgB,SAAiB;CAChC,QAAA,GAAOE,SAAAA,cAAAA,EAAAA,GAAcC,YAAAA,cAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,IAA6B,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;AACrE;;;;;;AAOA,SAAgB,YACf,QACA,MACA,UAA6B,CAAC,GACnB;CACX,OAAO;EACN,GAAG,sBAAsB,YAAY,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG;EAC1D,GAAG,QAAQ,KAAK,SAAS,aAAA,GAAYD,SAAAA,cAAAA,CAAc,IAAI,CAAC,CAAC,MAAM;EAC/D;EACA,GAAG;CACJ;AACD;;AAGA,IAAa,sBAAb,cAAyC,MAAM;CAEpC;CACA;CACA;CAHV,YACC,MACA,UACA,QACC;EACD,MACC,iBAAiB,KAAK,oBAAoB,SAAS,sBACxC,OAAO,KAAK,IAAI,KAAK,OAAO,KAAK,MAAM,GAAG,4HAGtD;EATS,KAAA,OAAA;EACA,KAAA,WAAA;EACA,KAAA,SAAA;EAQT,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;AAqBA,eAAsB,UACrB,SACA,MACA,SACiC;CAIjC,IAAI,QAAQ,SAAS,OAAO,YAAY,SAAS,MAAM,OAAO;CAE9D,MAAM,MAAM,KAAK,UAAU;EAC1B,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ,OAAO,CAAC;CACjB,CAAC;CACD,MAAM,SAAS,MAAME,gBAAAA,WAAW,SAAS,WACxC,YAAY,SAAS,MAAM,OAAO,CACnC;CACA,OAAO,gBAAgB,MAAM;AAC9B;AAcA,eAAe,YACd,SACA,MACA,SACiC;CACjC,MAAM,SAAS,MAAM,QAAQ,KAC5B,QACA,YAAY,WAAW,QAAQ,IAAI,GAAG,QAAQ,IAAI,GAClD;EACC,KAAK,QAAQ;EACb,KAAK;GAAE,GAAG,QAAQ;GAAK,GAAG,QAAQ;EAAI;EACtC,WAAW,QAAQ;EACnB,QAAQ;EACR,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACtD,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;CACpD,CACD;CAEA,MAAM,OAAO,OAAO,OAClB,MAAM,IAAI,CAAC,CACX,QAAQ,CAAC,CACT,MAAM,MAAM,EAAE,WAAWC,sBAAAA,oBAAoB,CAAC;CAChD,IAAI,MACH,IAAI;EACH,MAAM,SAAS,QAAQ,OAAO,UAC7B,KAAK,MAAM,KAAK,MAAMA,sBAAAA,qBAAqB,MAAM,CAAC,CACnD;EACA,IAAI,OAAO,SAAS,OAAO;GAAE,OAAO,OAAO;GAAM,QAAQ,OAAO;EAAO;CACxE,QAAQ,CAER;CAGD,MAAM,IAAI,oBAAoB,MAAM,OAAO,UAAU,OAAO,MAAM;AACnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;AClIA,MAAM,SAAS;;;;;;;;AAef,SAAgB,aAAa,OAAqC;CACjE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,YAAY;CAElB,OACC,OAAO,UAAU,OAAO,YACxB,UAAU,GAAG,SAAS,KACtB,OAAO,UAAU,YAAY;AAE/B;;AAwDA,MAAM,iBAAA,gBAAA,mBAAsC,UAAU;CAC5C,gBAAA,OAAA;EACR,QAAA,gBAAA,QAAkB,YAAY;EAC9B,UAAA,gBAAA,OAAA,gBAAA,OACU,GAAA,gBAAA,OACA;GAAE,IAAA,gBAAA,OAAa;GAAG,MAAA,gBAAA,OAAe;EAAE,CAAC,CAAC,CAAC,MAAM,CACtD;EACA,WAAA,gBAAA,OAAA,gBAAA,OAA6B,GAAA,gBAAA,MAAA,gBAAA,OAAoB,CAAC,CAAC;EACnD,YAAA,gBAAA,OAAA,gBAAA,OAA8B,GAAA,gBAAA,MAAA,gBAAA,OAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;CAChE,CAAC;CACQ,gBAAA,OAAA;EAAE,QAAA,gBAAA,QAAkB,MAAM;EAAG,OAAA,gBAAA,MAAA,gBAAA,OAAwB,CAAC;CAAE,CAAC;CACzD,gBAAA,OAAA;EACR,QAAA,gBAAA,QAAkB,QAAQ;EAC1B,OAAA,gBAAA,OACS;GACP,MAAA,gBAAA,OAAe;GACf,SAAA,gBAAA,OAAkB;GAClB,IAAA,gBAAA,OAAa,CAAC,CAAC,SAAS;GACxB,SAAA,gBAAA,MAAA,gBAAA,OAA0B,CAAC,CAAC,CAAC,SAAS;EACvC,CAAC,CAAC,CACD,MAAM;CACT,CAAC;AACF,CAAC;;;;;;AAOD,eAAe,kBACd,SACA,SACyC;CACzC,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,WACL,OAAO,QAAQ,aAAa,WACzB,CAAC,QAAQ,QAAQ,IACjB,CAAC,GAAG,QAAQ,QAAQ;CAExB,MAAM,EAAE,OAAO,WAAW,MAAM,UAAU,SAAS,uBAAuB;EACzE,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE;GAAU;EAAI,CAAC,CAAC;EACxC;EACA,WAAW;EACX,QAAQ;CACT,CAAC;CAKD,IAAI,OAAO,KAAK,GAAG,OAAO,KAAK,OAAO,QAAQ,OAAO,EAAE,CAAC;CAExD,QAAQ,MAAM,QAAd;EACC,KAAK;GACJ,IAAI,QAAQ,WACX,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,MAAM,SAAS,GAC1D,QAAQ,UAAU,SAAS;GAG7B,IAAI,QAAQ,YACX,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,MAAM,cAAc,CAAC,CAAC,GACjE,QAAQ,WAAW,SAAS;GAG9B,OAAO,MAAM;EACd,KAAK;GACJ,IAAI,MAAM,MAAM,SAAS,wBAAwB,MAAM,MAAM,IAC5D,MAAM,IAAI,mBAAmB,MAAM,MAAM,IAAI,MAAM,MAAM,WAAW,CAAC,CAAC;GAEvE,MAAM,IAAI,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;EACzE,KAAK;GACJ,IAAI,QAAQ,WAAW,MAAM,IAAI,0BAA0B,MAAM,KAAK;GACtE;CACF;AACD;;;;;AAMA,IAAa,4BAAb,cAA+C,MAAM;CACpD,cAAc;EACb,MACC,2KAGD;EACA,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,sBAAsB;;AAG5B,IAAa,2BAAb,cAA8C,MAAM;CAEzC;CACA;CAFV,YACC,WACA,QACC;EACD,MAAM,kCAAkC,UAAU,KAAK,QAAQ;EAHtD,KAAA,YAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACb;AACD;;;;;AAMA,IAAa,4BAAb,cAA+C,MAAM;CAC/B;CAArB,YAAY,OAAmC;EAC9C,MACC,mEACI,MAAM,KAAK,IAAI,EAAE,wJAGtB;EANoB,KAAA,QAAA;EAOpB,KAAK,OAAO;CACb;AACD;;;;;;;;;AAyBA,eAAsB,SACrB,SAC6B;CAC7B,MAAM,UAAU,QAAQ,WAAWC,gBAAAA,cAAc;CACjD,IAAI,SAAS;EACZ,IAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,WAAW;GAC3C,MAAM,YAAY,MAAM,kBAAkB,SAAS,OAAO;GAC1D,IAAI,WAAW,OAAO;EACvB,OAAO,IAAI,QAAQ,WAGlB,MAAM,IAAI,0BAA0B;CAEtC;CAEA,MAAM,EACL,UACA,MAAM,QAAQ,IAAI,GAClB,YAAY,OACZ,SAAS,QACN;CAIJ,IAAI,WAAW,uBAAuB;CAEtC,MAAM,WAAwC,CAAC;;CAE/C,MAAM,UAAkC,CAAC;;;;;;;;;;;;;;CAczC,MAAM,uBAAO,IAAI,QAAgB;CAEjC,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,QAAkB;CAC3E,MAAM,QAAQC,UAAAA,QAAG,OAAO,OAAO;EAAE;EAAK,UAAU;CAAK,CAAC;;CAGtD,IAAI,UAAU;CAEd,WAAW,MAAM,SAAS,OAAO;EAChC;EACA,MAAM,OAAO,MAAM,SAAS;EAC5B,MAAM,SAAS,OAAa,YAAA,OAAY,GAAG,KAAK,KAAK,KAAK,IAAI,OAAA,OAAM;EAEpE,KAAK,MAAM,CAAC,YAAY,aAAa,OAAO,QAAQ,MAAM,GAAG;GAC5D,IAAI,QAAQ,YACX,iBAAiB,QAAQ,YAAY,UAAU,IAAI;GACpD,IAAI,CAAC,aAAa,QAAQ,GAAG;IAC5B,IAAI,QAAQ,WAAW,eAAe,QAAQ,WAAW,QAAQ;IACjE;GACD;GAKA,IAAI,KAAK,IAAI,QAAkB,GAAG;GAClC,KAAK,IAAI,QAAkB;GAK3B,IACC,QAAQ,aACR,OAAQ,SAAiC,UAAU,UAEnD,eAAe,QAAQ,WAAW,QAAQ;GAG3C,KAAK,MAAM,eAAe,SAAS,QAAQ,GAAG;IAG7C,MAAM,MAAA,GAAKC,oBAAAA,YAAAA,CAAY,YAAY,EAAE;IACrC,MAAM,UAAA,GAASC,UAAAA,SAAAA,CAAS,KAAK,IAAI;IAEjC,MAAM,UAAU,QAAQ;IACxB,IAAI,YAAY,KAAA,KAAa,YAAY,QACxC,MAAM,IAAI,mBAAmB,IAAI,CAAC,SAAS,MAAM,CAAC;IAGnD,SAAS,MAAM;KAAE,GAAG;KAAa;IAAG;IACpC,QAAQ,MAAM;IACd,IAAI,KAAK,IAAI,MAAM;KAAE;KAAM;KAAY,WAAW;IAAS;GAC5D;EACD;CACD;CAIA,CAAA,GAAA,oBAAA,kBAAA,CAAkB,QAAQ;CAE1B,mBAAmB,OAAO,SAAS,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAM;CAE/D,OAAO;AACR;;;;;AAMA,SAAS,iBACR,YACA,UACA,MACO;CACP,IACC,CAACC,4BAAAA,KAAK,OAAO,QAAQ,KACrB,CAACC,4BAAAA,MAAM,QAAQ,QAAQ,KACvB,CAACC,kCAAAA,WAAW,aAAa,QAAQ,GAEjC;CAED,MAAM,QAAS,SAAiC;CAChD,IAAI,OAAO,UAAU,UAAU;CAE/B,MAAM,OAAA,GAAMJ,oBAAAA,YAAAA,CAAY,KAAK;CAC7B,MAAM,QAAQ,WAAW,QAAQ,CAAC;CAClC,WAAW,OAAO;CAClB,IAAI,CAAC,MAAM,SAAS,IAAI,GAAG,MAAM,KAAK,IAAI;AAC3C;;;;;AAMA,SAAgB,WAAW,UAA6B;CACvD,IAAIG,4BAAAA,MAAM,QAAQ,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE;CAChD,IAAIC,kCAAAA,WAAW,aAAa,QAAQ,KAAK,SAAS,WACjD,OAAO,EAAA,GAACJ,oBAAAA,YAAAA,CAAY,SAAS,SAAS,CAAC;CAExC,OAAO,CAAC;AACT;;;;;;AAOA,SAAS,eACR,WACA,UACO;CACP,IAAI,OAAO,aAAa,YAAY,aAAa,MAAM;CAEvD,MAAM,WAAW;CAKjB,MAAM,QACL,OAAO,SAAS,SAAS,OAAO,WAC7B,SAAS,QAAQ,KACjB,OAAO,SAAS,UAAU,WACzB,SAAS,QACT,KAAA;CACL,IAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,SAAS,UAAU,GAAG;CAEnD,MAAM,OAAA,GAAMA,oBAAAA,YAAAA,CAAY,KAAK;CAC7B,MAAM,QAAQ,UAAU,QAAQ,CAAC;CACjC,UAAU,OAAO;CAGjB,KAAK,MAAM,MAAM,CAAC,GAAG,SAAS,YAAY,GAAG,WAAW,QAAQ,CAAC,GAAG;EACnE,IAAI,OAAO,OAAO,UAAU;EAC5B,MAAM,UAAA,GAASA,oBAAAA,YAAAA,CAAY,EAAE;EAC7B,IAAI,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM,KAAK,MAAM;CAC/C;AACD;;;;;;;;;;;;;;;;;;AAmBA,SAAS,mBACR,OACA,SACA,UACO;CACP,IAAI,MAAM,WAAW,GAAG;CAExB,IAAI,YAAY,GAAG;EAClB,OAAO,KACN,sFACiB,MAAM,KAAK,IAAI,EAAE,2JAKnC;EACA;CACD;CAEA,IAAI,aAAa,GAChB,OAAO,KACN,qCAAqC,QAAQ,qDAE5B,MAAM,KAAK,IAAI,EAAE,qIAInC;AAEF;;AAGA,IAAa,qBAAb,cAAwCK,eAAAA,SAAS;;CAEhD;;CAEA;CAEA,YAAY,IAAY,SAA4B;EACnD,MAAM,oCAAoC;EAC1C,KAAK,OAAO;EACZ,KAAK,KAAK;EACV,KAAK,UAAU;CAChB;AACD"}

package/dist/discover-Ca8U75dl.mjs

@@ -0,0 +1,537 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { a as discriminatedUnion, c as literal, d as object, f as record, n as array, p as string } from "./schemas-BCwKKA42.mjs";
+import { i as activeSandbox, s as oncePerRun } from "./sandbox-CbVB7uOD.mjs";
+import { t as WORKER_RESULT_MARKER } from "./workerRuntime-CsOyBRx2.mjs";
+import { createRequire } from "node:module";
+import { dirname, join, relative } from "node:path";
+import { existsSync } from "node:fs";
+import { assertDerivations, canonicalId } from "@geekmidas/manifest";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { format } from "node:util";
+import { Cron } from "@geekmidas/constructs/crons";
+import { Queue } from "@geekmidas/constructs/queue";
+import { Subscriber } from "@geekmidas/constructs/subscribers";
+import fg from "fast-glob";
+import kebabCase$1 from "lodash.kebabcase";
+//#region src/output.ts
+/**
+* Where the CLI's progress lines go.
+*
+* Commands write their progress through `output` rather than `console`. Run
+* from the terminal that is the same thing. Run inside `deploy()`, each line
+* goes to the run that wrote it instead — as an event its caller can iterate,
+* and to the logger it was handed — so a deploy embedded in another program
+* does not print over that program's own output.
+*
+* Carried by `AsyncLocalStorage` rather than passed down, because the lines
+* come from everywhere a deploy reaches — the Dockerfile generator, the env
+* sniffer, construct discovery — and two deploys running in one process must
+* not hear each other.
+*/
+const current = new AsyncLocalStorage();
+/** Runs `fn` with every line written through `output` sent to `sink`. */
+function withOutput(sink, fn) {
+	return current.run(sink, fn);
+}
+function write(level, fallback) {
+	return (...args) => {
+		const sink = current.getStore();
+		if (sink) sink(level, format(...args));
+		else fallback(...args);
+	};
+}
+/**
+* `console`, for the methods the CLI logs through — routed to the current
+* run's sink when there is one.
+*/
+const output = {
+	log: write("info", (...args) => console.log(...args)),
+	info: write("info", (...args) => console.info(...args)),
+	warn: write("warn", (...args) => console.warn(...args)),
+	error: write("error", (...args) => console.error(...args))
+};
+//#endregion
+//#region src/generators/Generator.ts
+/**
+* Zod v4 maintains a process-wide registry of schemas registered via
+* `.meta({ id })`. When we cache-bust user module imports (by appending a
+* `?t=timestamp` query), those modules re-execute and try to register the
+* same ids again, which throws `ID X already exists in the registry`.
+*
+* Clearing the registry in the CLI process is safe: the user's running
+* server lives in a subprocess and has its own isolated registry.
+*
+* Exported for tests.
+*/
+function clearZodGlobalRegistry() {
+	const registry = globalThis.__zod_globalRegistry;
+	if (registry && typeof registry.clear === "function") registry.clear();
+}
+var ConstructGenerator = class {
+	static async build(context, outputDir, generator, patterns, options) {
+		const constructs = await generator.load(patterns);
+		return generator.build(context, constructs, outputDir, options);
+	}
+	async load(patterns, cwd = process.cwd(), bustCache = false) {
+		const logger = console;
+		const globPatterns = Array.isArray(patterns) ? patterns : patterns ? [patterns] : [];
+		const files = fg.stream(globPatterns, {
+			cwd,
+			absolute: true
+		});
+		if (bustCache) clearZodGlobalRegistry();
+		const constructs = [];
+		for await (const f of files) try {
+			const file = f.toString();
+			const module = await (bustCache ? import(`${file}?t=${Date.now()}`) : import(file));
+			for (const [key, construct] of Object.entries(module)) if (this.isConstruct(construct)) constructs.push({
+				key,
+				name: kebabCase$1(key),
+				construct,
+				path: {
+					absolute: file,
+					relative: relative(process.cwd(), file)
+				}
+			});
+		} catch (error) {
+			const err = error;
+			logger.error(`Failed to load ${f}: ${err.message}`);
+			if (err.stack) logger.error(err.stack);
+			throw error;
+		}
+		return constructs;
+	}
+};
+//#endregion
+//#region src/owningTsconfigJsx.ts
+const REGISTER = "owning-tsconfig-jsx-register.mjs";
+/** The CLI's `bin/` was not found above the module looking for it. */
+var OwningTsconfigJsxHookMissing = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not find bin/${REGISTER} in any directory above '${from}'. It ships with @geekmidas/cli beside bin/gkm.mjs; reinstall the package if it is missing.`);
+		this.from = from;
+		this.name = "OwningTsconfigJsxHookMissing";
+	}
+};
+/**
+* The CLI's `bin/owning-tsconfig-jsx-register.mjs`, as a file URL. Searched
+* upward because this module runs from `src/` in the repo and from a chunk in
+* `dist/` once built, and `bin/` sits beside both.
+*/
+function registerUrl() {
+	const from = dirname(fileURLToPath(import.meta.url));
+	for (let dir = from;; dir = dirname(dir)) {
+		const candidate = join(dir, "bin", REGISTER);
+		if (existsSync(candidate)) return pathToFileURL(candidate).href;
+		if (dirname(dir) === dir) throw new OwningTsconfigJsxHookMissing(from);
+	}
+}
+/**
+* `NODE_OPTIONS` for a process that runs app code through tsx, with the hook
+* that compiles each `.tsx` with its own tsconfig's JSX settings (see
+* `bin/owning-tsconfig-jsx.mjs`) put in front of every other `--import`, so it
+* is registered before tsx and reads the source on tsx's behalf.
+*
+* `bin/gkm.mjs` already starts the CLI this way, and its children inherit it;
+* this is for those that set `NODE_OPTIONS` themselves, or whose CLI was
+* started with tsx already imported.
+*/
+function withOwningTsconfigJsx(nodeOptions = "") {
+	if (nodeOptions.includes(REGISTER)) return nodeOptions;
+	return [`--import=${registerUrl()}`, nodeOptions].filter(Boolean).join(" ");
+}
+//#endregion
+//#region src/sandbox/worker.ts
+/**
+* Running one of the CLI's own worker scripts inside a sandbox, and reading
+* back the one JSON value it answers with.
+*
+* The worker imports the project's TypeScript — `gkm.config.ts`, construct
+* modules, an app's entry — so it starts with the CLI's own tsx and the two
+* hooks `gkm` itself runs with (JSX by the owning tsconfig, path aliases by
+* the adjacent one). The host process needs none of them loaded: a program
+* calling `deploy()` without `--import tsx` still loads a TypeScript config.
+*/
+const here = dirname(fileURLToPath(import.meta.url));
+/**
+* A worker's file: `dist/sandbox/<name>.mjs` once built — whether this module
+* was bundled into `dist/` or sits beside it — or the `.ts` source under tsx.
+*/
+function workerFile(name) {
+	return [
+		join(here, "sandbox", `${name}.mjs`),
+		join(here, `${name}.mjs`),
+		join(here, "..", "sandbox", `${name}.mjs`),
+		join(here, `${name}.ts`)
+	].find((path) => existsSync(path)) ?? join(here, `${name}.ts`);
+}
+/** tsx, from the CLI's own dependencies — never the project's. */
+function tsxUrl() {
+	return pathToFileURL(createRequire(import.meta.url).resolve("tsx")).href;
+}
+/**
+* `node`'s arguments for `script`: the CLI's TypeScript loaders, then any
+* further `imports`, then the script and its `args` — an argument array, so
+* nothing about a path is read by a shell.
+*/
+function nodeWithTsx(script, args, imports = []) {
+	return [
+		...withOwningTsconfigJsx(`--import=${tsxUrl()}`).split(" "),
+		...imports.map((path) => `--import=${pathToFileURL(path).href}`),
+		script,
+		...args
+	];
+}
+/** A worker ended without the answer it exists to give. */
+var SandboxWorkerFailed = class extends Error {
+	step;
+	exitCode;
+	stderr;
+	constructor(step, exitCode, stderr) {
+		super(`The sandboxed ${step} ended (exit code ${exitCode}) without an answer.${stderr.trim() ? `\n${stderr.trim()}` : ""}\nIts output above says why; the sandbox must be able to run \`node\` with the CLI's own files at the paths they have here.`);
+		this.step = step;
+		this.exitCode = exitCode;
+		this.stderr = stderr;
+		this.name = "SandboxWorkerFailed";
+	}
+};
+/**
+* Run worker `name` in `sandbox`, and parse its answer with `schema`.
+*
+* The answer is the last marked line on stdout. Anything else the project's
+* code printed is ignored, and an answer the schema refuses is a failure
+* rather than data — a worker in an isolating sandbox runs code the host does
+* not trust.
+*
+* Within a run (`withSandbox`), the same worker asked the same question is
+* started once; every ask gets its own copy of the answer, and its stderr, as
+* though it had run again.
+*/
+async function runWorker(sandbox, step, options) {
+	if (options.secrets) return startWorker(sandbox, step, options);
+	const key = JSON.stringify([
+		options.name,
+		options.cwd,
+		options.args,
+		options.env ?? {}
+	]);
+	const answer = await oncePerRun(sandbox, key, () => startWorker(sandbox, step, options));
+	return structuredClone(answer);
+}
+async function startWorker(sandbox, step, options) {
+	const result = await sandbox.exec("node", nodeWithTsx(workerFile(options.name), options.args), {
+		cwd: options.cwd,
+		env: {
+			...sandbox.env,
+			...options.env
+		},
+		timeoutMs: options.timeoutMs,
+		output: "capture",
+		...options.secrets ? { secrets: options.secrets } : {},
+		...options.signal ? { signal: options.signal } : {}
+	});
+	const line = result.stdout.split("\n").reverse().find((l) => l.startsWith(WORKER_RESULT_MARKER));
+	if (line) try {
+		const parsed = options.schema.safeParse(JSON.parse(line.slice(WORKER_RESULT_MARKER.length)));
+		if (parsed.success) return {
+			value: parsed.data,
+			stderr: result.stderr
+		};
+	} catch {}
+	throw new SandboxWorkerFailed(step, result.exitCode, result.stderr);
+}
+//#endregion
+//#region src/reconcile/discover.ts
+/**
+* Discovery — one glob, one structural test.
+*
+* A glob per kind is the same specialness the construct model removes, and
+* resources have no kind to be listed under: a declared `ObjectStorage` would
+* never be found by `routes:` or `crons:`. So there is one `constructs` glob,
+* every export of every matching module is inspected, and the per-kind
+* `isConstruct` checks collapse into a single question — does it have an id and
+* can it declare?
+*
+* Structural rather than `instanceof` on purpose. A construct from a different
+* copy of `@geekmidas/constructs` — a linked workspace, two versions in a
+* lockfile — is still a construct, and `instanceof` is exactly the check that
+* says otherwise.
+*/
+var discover_exports = /* @__PURE__ */ __exportAll({
+	ConstructDiscoveryFailed: () => ConstructDiscoveryFailed,
+	ConstructsNotSerializable: () => ConstructsNotSerializable,
+	DuplicateConstruct: () => DuplicateConstruct,
+	LiveConstructsUnavailable: () => LiveConstructsUnavailable,
+	consumedBy: () => consumedBy,
+	discover: () => discover,
+	isDeclarable: () => isDeclarable
+});
+/** `console`, or the deploy run discovering the manifest. */
+const logger = output;
+/**
+* Whether a module export is a construct.
+*
+* Deliberately loose about what else it carries — a construct that also has a
+* `service` is still a construct, and requiring one would exclude the kinds that
+* own no address.
+*/
+function isDeclarable(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.id === "string" && candidate.id.length > 0 && typeof candidate.declare === "function";
+}
+/** What the discovery worker answers. Checked: the worker ran project code. */
+const DiscoverAnswer = discriminatedUnion("reason", [
+	object({
+		reason: literal("discovered"),
+		manifest: record(string(), object({
+			id: string(),
+			kind: string()
+		}).loose()),
+		runnables: record(string(), array(string())),
+		background: record(string(), array(string())).optional()
+	}),
+	object({
+		reason: literal("live"),
+		paths: array(string())
+	}),
+	object({
+		reason: literal("failed"),
+		error: object({
+			name: string(),
+			message: string(),
+			id: string().optional(),
+			sources: array(string()).optional()
+		}).loose()
+	})
+]);
+/**
+* The manifest, discovered in `sandbox` and handed back as JSON — or
+* `undefined` when it holds something JSON cannot carry and the sandbox is
+* not isolating, for the caller to discover here as before.
+*/
+async function discoverInSandbox(sandbox, options) {
+	const cwd = options.cwd ?? sandbox.root;
+	const patterns = typeof options.patterns === "string" ? [options.patterns] : [...options.patterns];
+	const { value, stderr } = await runWorker(sandbox, "construct discovery", {
+		name: "discover-worker",
+		args: [JSON.stringify({
+			patterns,
+			cwd
+		})],
+		cwd,
+		timeoutMs: DISCOVER_TIMEOUT_MS,
+		schema: DiscoverAnswer
+	});
+	if (stderr.trim()) logger.warn(stderr.replace(/\n$/, ""));
+	switch (value.reason) {
+		case "discovered":
+			if (options.runnables) for (const [owner, edges] of Object.entries(value.runnables)) options.runnables[owner] = edges;
+			if (options.background) for (const [owner, files] of Object.entries(value.background ?? {})) options.background[owner] = files;
+			return value.manifest;
+		case "failed":
+			if (value.error.name === "DuplicateConstruct" && value.error.id) throw new DuplicateConstruct(value.error.id, value.error.sources ?? []);
+			throw new ConstructDiscoveryFailed(value.error.name, value.error.message);
+		case "live":
+			if (sandbox.isolating) throw new ConstructsNotSerializable(value.paths);
+			return;
+	}
+}
+/**
+* A caller asked for the construct objects (`sources`) or a watcher's
+* re-import under an isolating sandbox, where only data comes back.
+*/
+var LiveConstructsUnavailable = class extends Error {
+	constructor() {
+		super("Discovery was asked for the construct objects themselves under an isolating sandbox, which hands back only data. Run this step without one, or ask only for the manifest.");
+		this.name = "LiveConstructsUnavailable";
+	}
+};
+/** How long discovering a project's constructs may take in a sandbox. */
+const DISCOVER_TIMEOUT_MS = 6e4;
+/** Importing a construct module, or declaring one, threw in the sandbox. */
+var ConstructDiscoveryFailed = class extends Error {
+	errorName;
+	detail;
+	constructor(errorName, detail) {
+		super(`Discovering constructs failed (${errorName}): ${detail}`);
+		this.errorName = errorName;
+		this.detail = detail;
+		this.name = "ConstructDiscoveryFailed";
+	}
+};
+/**
+* The constructs' declarations hold something that is not data, and the
+* sandbox they were discovered in hands the deploy nothing but data.
+*/
+var ConstructsNotSerializable = class extends Error {
+	paths;
+	constructor(paths) {
+		super(`The construct manifest holds values that are not plain data at: ${paths.join(", ")}. Under an isolating sandbox the deploy only receives what JSON can carry; deploy with a sandbox that is not isolating if the host trusts this project.`);
+		this.paths = paths;
+		this.name = "ConstructsNotSerializable";
+	}
+};
+/**
+* Build the construct manifest for a project.
+*
+* Runs the manifest's own validation before returning, so an app is wrong here
+* — where the error names a file — rather than at deploy.
+*
+* @throws {DuplicateConstruct} when two exports claim one id.
+*/
+async function discover(options) {
+	const sandbox = options.sandbox ?? activeSandbox();
+	if (sandbox) {
+		if (!options.sources && !options.bustCache) {
+			const sandboxed = await discoverInSandbox(sandbox, options);
+			if (sandboxed) return sandboxed;
+		} else if (sandbox.isolating) throw new LiveConstructsUnavailable();
+	}
+	const { patterns, cwd = process.cwd(), bustCache = false, sources: out } = options;
+	if (bustCache) clearZodGlobalRegistry();
+	const manifest = {};
+	/** Which file declared each id, for the error when two of them do. */
+	const sources = {};
+	/**
+	* Constructs already seen, by identity.
+	*
+	* A re-export is the *same object* reached through a second file — ESM
+	* bindings are live, so `export * from './database.js'` hands back the
+	* binding rather than a copy. Without this, a barrel file made every
+	* construct in it appear declared twice, and `constructs/index.ts` is the
+	* first thing anyone writes in a shared folder.
+	*
+	* Identity rather than file is also the more honest rule: what may not
+	* happen twice is two *different* constructs claiming one id, and that is
+	* still an error below.
+	*/
+	const seen = /* @__PURE__ */ new WeakSet();
+	const globs = Array.isArray(patterns) ? [...patterns] : [patterns];
+	const files = fg.stream(globs, {
+		cwd,
+		absolute: true
+	});
+	/** Matched files, for the diagnostic below. */
+	let matched = 0;
+	for await (const found of files) {
+		matched++;
+		const file = found.toString();
+		const module = await (bustCache ? import(`${file}?t=${Date.now()}`) : import(file));
+		for (const [exportName, exported] of Object.entries(module)) {
+			if (options.background) recordBackground(options.background, exported, file);
+			if (!isDeclarable(exported)) {
+				if (options.runnables) recordRunnable(options.runnables, exported);
+				continue;
+			}
+			if (seen.has(exported)) continue;
+			seen.add(exported);
+			if (options.runnables && typeof exported.owner === "string") recordRunnable(options.runnables, exported);
+			for (const declaration of exported.declare()) {
+				const id = canonicalId(declaration.id);
+				const source = relative(cwd, file);
+				const claimed = sources[id];
+				if (claimed !== void 0 && claimed !== source) throw new DuplicateConstruct(id, [claimed, source]);
+				manifest[id] = {
+					...declaration,
+					id
+				};
+				sources[id] = source;
+				if (out) out[id] = {
+					file,
+					exportName,
+					construct: exported
+				};
+			}
+		}
+	}
+	assertDerivations(manifest);
+	warnIfNothingFound(globs, matched, Object.keys(manifest).length);
+	return manifest;
+}
+/**
+* Record where a worker's background work is declared: a cron, a queue
+* consumer or a topic subscriber, under the worker that owns it.
+*/
+function recordBackground(background, exported, file) {
+	if (!Cron.isCron(exported) && !Queue.isQueue(exported) && !Subscriber.isSubscriber(exported)) return;
+	const owner = exported.owner;
+	if (typeof owner !== "string") return;
+	const key = canonicalId(owner);
+	const files = background[key] ?? [];
+	background[key] = files;
+	if (!files.includes(file)) files.push(file);
+}
+/**
+* What a runnable consumes, by id: a queue's consumer drains that queue, a
+* subscriber its topic. Nothing for anything else.
+*/
+function consumedBy(runnable) {
+	if (Queue.isQueue(runnable)) return [runnable.id];
+	if (Subscriber.isSubscriber(runnable) && runnable.topicName) return [canonicalId(runnable.topicName)];
+	return [];
+}
+/**
+* Record a runnable's edges under the construct that owns it — the surface an
+* endpoint was built from, or the worker a cron or subscriber was. Anything
+* with no owner, or that is not a runnable at all, is left alone.
+*/
+function recordRunnable(runnables, exported) {
+	if (typeof exported !== "object" || exported === null) return;
+	const runnable = exported;
+	const owner = typeof runnable.surface?.id === "string" ? runnable.surface.id : typeof runnable.owner === "string" ? runnable.owner : void 0;
+	if (!owner || !Array.isArray(runnable.constructs)) return;
+	const key = canonicalId(owner);
+	const edges = runnables[key] ?? [];
+	runnables[key] = edges;
+	for (const id of [...runnable.constructs, ...consumedBy(exported)]) {
+		if (typeof id !== "string") continue;
+		const target = canonicalId(id);
+		if (!edges.includes(target)) edges.push(target);
+	}
+}
+/**
+* Say so when a glob was configured and found nothing.
+*
+* The glob is not a filter over declarations already known — it is *how they
+* are found*, by importing what it matches. So a file it misses is a
+* declaration that does not exist, and every symptom of that appears somewhere
+* other than the cause: no container starts, no env key is written, and the
+* application fails on first use against a resource it can see in its own
+* source.
+*
+* Nothing reported it before, because an unmatched file is indistinguishable
+* from a file nobody wrote. These two cases are the ones that are *not*
+* ambiguous — a glob was configured, so something was expected.
+*
+* Silent when no glob is configured at all: that is a project which has not
+* adopted constructs, and has nothing to be missing.
+*/
+function warnIfNothingFound(globs, matched, declared) {
+	if (globs.length === 0) return;
+	if (matched === 0) {
+		logger.warn(`\n⚠️  The constructs glob matched no files, so nothing was declared.\n   Patterns: ${globs.join(", ")}\n   Nothing will be provisioned — no containers, no env keys, no resources.\n   A common cause is depth: '*.ts' matches one level, '**/*.ts' matches any.`);
+		return;
+	}
+	if (declared === 0) logger.warn(`\n⚠️  The constructs glob matched ${matched} file(s) but none declared anything.\n   Patterns: ${globs.join(", ")}\n   Discovery keeps exports with an 'id' that can 'declare()'. A construct that is\n   built but never exported is invisible to it.`);
+}
+/** Two constructs claiming one id. */
+var DuplicateConstruct = class extends GkmError {
+	/** The id claimed twice. */
+	id;
+	/** The files that claimed it. */
+	sources;
+	constructor(id, sources) {
+		super("Two constructs declare the same id");
+		this.name = "DuplicateConstruct";
+		this.id = id;
+		this.sources = sources;
+	}
+};
+//#endregion
+export { discover_exports as a, nodeWithTsx as c, ConstructGenerator as d, output as f, discover as i, runWorker as l, ConstructsNotSerializable as n, isDeclarable as o, withOutput as p, consumedBy as r, SandboxWorkerFailed as s, ConstructDiscoveryFailed as t, withOwningTsconfigJsx as u };
+
+//# sourceMappingURL=discover-Ca8U75dl.mjs.map