@geekmidas/cli 10.0.0-alpha.12 → 10.0.0-alpha.121

package/dist/sandbox/config-worker.mjs

@@ -0,0 +1,44 @@
+import { a as registerAdjacentTsconfig, i as liveValuePaths, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
+import { readFile } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
+//#region src/sandbox/config-worker.ts
+/**
+* Loads `gkm.config.ts` in a sandbox and answers with it as data.
+*
+* Usage (by `loadWorkspaceConfig` with a sandbox, never by hand):
+*   node --import=<tsx> config-worker.ts /path/to/gkm.config.ts
+*
+* Answers `{ reason: 'loaded', config }`, `{ reason: 'live', paths }` when the
+* config holds something JSON cannot carry, or `{ reason: 'failed', error }`
+* when it could not be loaded at all.
+*/
+async function load(configPath) {
+	if (configPath.endsWith(".json")) return JSON.parse(await readFile(configPath, "utf8"));
+	return (await import(pathToFileURL(configPath).href)).default;
+}
+async function main() {
+	const configPath = process.argv[2];
+	try {
+		if (!configPath) throw new TypeError("No config path was given.");
+		await registerAdjacentTsconfig();
+		const config = await load(configPath);
+		const paths = liveValuePaths(config);
+		answer(paths.length > 0 ? {
+			reason: "live",
+			paths
+		} : {
+			reason: "loaded",
+			config
+		});
+	} catch (error) {
+		answer({
+			reason: "failed",
+			error: errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+export {};
+
+//# sourceMappingURL=config-worker.mjs.map

package/dist/sandbox/config-worker.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-worker.mjs","names":[],"sources":["../../src/sandbox/config-worker.ts"],"sourcesContent":["/**\n * Loads `gkm.config.ts` in a sandbox and answers with it as data.\n *\n * Usage (by `loadWorkspaceConfig` with a sandbox, never by hand):\n *   node --import=<tsx> config-worker.ts /path/to/gkm.config.ts\n *\n * Answers `{ reason: 'loaded', config }`, `{ reason: 'live', paths }` when the\n * config holds something JSON cannot carry, or `{ reason: 'failed', error }`\n * when it could not be loaded at all.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { pathToFileURL } from 'node:url';\nimport {\n\tanswer,\n\terrorData,\n\tliveValuePaths,\n\tregisterAdjacentTsconfig,\n} from './workerRuntime';\n\nasync function load(configPath: string): Promise<unknown> {\n\tif (configPath.endsWith('.json')) {\n\t\treturn JSON.parse(await readFile(configPath, 'utf8'));\n\t}\n\tconst module = await import(pathToFileURL(configPath).href);\n\treturn module.default;\n}\n\nasync function main(): Promise<void> {\n\tconst configPath = process.argv[2];\n\ttry {\n\t\tif (!configPath) throw new TypeError('No config path was given.');\n\t\tawait registerAdjacentTsconfig();\n\t\tconst config = await load(configPath);\n\t\tconst paths = liveValuePaths(config);\n\t\tanswer(\n\t\t\tpaths.length > 0\n\t\t\t\t? { reason: 'live', paths }\n\t\t\t\t: { reason: 'loaded', config },\n\t\t);\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAe,KAAK,YAAsC;CACzD,IAAI,WAAW,SAAS,OAAO,GAC9B,OAAO,KAAK,MAAM,MAAM,SAAS,YAAY,MAAM,CAAC;CAGrD,QAAO,MADc,OAAO,cAAc,UAAU,CAAC,CAAC,MAAA,CACxC;AACf;AAEA,eAAe,OAAsB;CACpC,MAAM,aAAa,QAAQ,KAAK;CAChC,IAAI;EACH,IAAI,CAAC,YAAY,MAAM,IAAI,UAAU,2BAA2B;EAChE,MAAM,yBAAyB;EAC/B,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,MAAM,QAAQ,eAAe,MAAM;EACnC,OACC,MAAM,SAAS,IACZ;GAAE,QAAQ;GAAQ;EAAM,IACxB;GAAE,QAAQ;GAAU;EAAO,CAC/B;CACD,SAAS,OAAO;EACf,OAAO;GAAE,QAAQ;GAAU,OAAO,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/credentials-worker.cjs

@@ -0,0 +1,54 @@
+const require_discover = require("../discover-DozUKs8f.cjs");
+const require_sandbox = require("../sandbox-CHv3OYXg.cjs");
+const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
+const require_credentialSchemas = require("../credentialSchemas-B67WJOOm.cjs");
+let node_path = require("node:path");
+let node_fs_promises = require("node:fs/promises");
+//#region src/sandbox/credentials-worker.ts
+/**
+* Loads a project's constructs in a sandbox and answers with what their
+* credentials schemas say, as data: each schema as JSON Schema, and whether
+* each value it was handed passes.
+*
+* Usage (by `inspectCredentials` under a sandbox, never by hand):
+*   node --import=<tsx> credentials-worker.ts '{"patterns":[…],"cwd":"…"}'
+*
+* The schemas are the project's code, which is why they run here. Each value
+* arrives as a file in `GKM_SECRETS_DIR` named by its key, is read into this
+* process's memory only, and never comes back: an answer carries issue paths
+* and messages, not values.
+*/
+/** Every secret file the sandbox mounted, by name. */
+async function mountedSecrets() {
+	const dir = process.env[require_sandbox.SECRETS_DIR_ENV];
+	if (!dir) return {};
+	const secrets = {};
+	for (const name of await (0, node_fs_promises.readdir)(dir)) secrets[name] = (await (0, node_fs_promises.readFile)((0, node_path.join)(dir, name), "utf8")).trim();
+	return secrets;
+}
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await require_workerRuntime.registerAdjacentTsconfig();
+		const sources = {};
+		const manifest = await require_discover.discover({
+			patterns: request.patterns,
+			cwd: request.cwd,
+			sources
+		});
+		const inspection = await require_credentialSchemas.inspectLive(require_credentialSchemas.liveCredentials(manifest, sources), await mountedSecrets());
+		require_workerRuntime.answer({
+			reason: "inspected",
+			...inspection
+		});
+	} catch (error) {
+		require_workerRuntime.answer({
+			reason: "failed",
+			error: require_workerRuntime.errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+
+//# sourceMappingURL=credentials-worker.cjs.map

package/dist/sandbox/credentials-worker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-worker.cjs","names":["SECRETS_DIR_ENV","readdir","readFile","join","registerAdjacentTsconfig","discover","inspectLive","liveCredentials","errorData"],"sources":["../../src/sandbox/credentials-worker.ts"],"sourcesContent":["/**\n * Loads a project's constructs in a sandbox and answers with what their\n * credentials schemas say, as data: each schema as JSON Schema, and whether\n * each value it was handed passes.\n *\n * Usage (by `inspectCredentials` under a sandbox, never by hand):\n *   node --import=<tsx> credentials-worker.ts '{\"patterns\":[…],\"cwd\":\"…\"}'\n *\n * The schemas are the project's code, which is why they run here. Each value\n * arrives as a file in `GKM_SECRETS_DIR` named by its key, is read into this\n * process's memory only, and never comes back: an answer carries issue paths\n * and messages, not values.\n */\n\nimport { readdir, readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { type ConstructSource, discover } from '../reconcile/discover';\nimport { inspectLive, liveCredentials } from '../secrets/credentialSchemas';\nimport { SECRETS_DIR_ENV } from './sandbox';\nimport { answer, errorData, registerAdjacentTsconfig } from './workerRuntime';\n\n/** Every secret file the sandbox mounted, by name. */\nasync function mountedSecrets(): Promise<Record<string, string>> {\n\tconst dir = process.env[SECRETS_DIR_ENV];\n\tif (!dir) return {};\n\n\tconst secrets: Record<string, string> = {};\n\tfor (const name of await readdir(dir)) {\n\t\tsecrets[name] = (await readFile(join(dir, name), 'utf8')).trim();\n\t}\n\treturn secrets;\n}\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\tpatterns: string[];\n\t\t\tcwd: string;\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\tconst sources: Record<string, ConstructSource> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: request.patterns,\n\t\t\tcwd: request.cwd,\n\t\t\tsources,\n\t\t});\n\n\t\tconst inspection = await inspectLive(\n\t\t\tliveCredentials(manifest, sources),\n\t\t\tawait mountedSecrets(),\n\t\t);\n\t\tanswer({ reason: 'inspected', ...inspection });\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsBA,eAAe,iBAAkD;CAChE,MAAM,MAAM,QAAQ,IAAIA,gBAAAA;CACxB,IAAI,CAAC,KAAK,OAAO,CAAC;CAElB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,QAAAA,CAAQ,GAAG,GACnC,QAAQ,SAAS,OAAA,GAAMC,iBAAAA,SAAAA,EAAAA,GAASC,UAAAA,KAAAA,CAAK,KAAK,IAAI,GAAG,MAAM,EAAA,CAAG,KAAK;CAEhE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAIlD,MAAMC,sBAAAA,yBAAyB;EAE/B,MAAM,UAA2C,CAAC;EAClD,MAAM,WAAW,MAAMC,iBAAAA,SAAS;GAC/B,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAED,MAAM,aAAa,MAAMC,0BAAAA,YACxBC,0BAAAA,gBAAgB,UAAU,OAAO,GACjC,MAAM,eAAe,CACtB;EACA,sBAAA,OAAO;GAAE,QAAQ;GAAa,GAAG;EAAW,CAAC;CAC9C,SAAS,OAAO;EACf,sBAAA,OAAO;GAAE,QAAQ;GAAU,OAAOC,sBAAAA,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/credentials-worker.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/credentials-worker.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/credentials-worker.mjs

@@ -0,0 +1,55 @@
+import { i as discover } from "../discover-C5roJuc9.mjs";
+import { t as SECRETS_DIR_ENV } from "../sandbox-CbVB7uOD.mjs";
+import { a as registerAdjacentTsconfig, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
+import { a as liveCredentials, r as inspectLive } from "../credentialSchemas-DDOLRCLF.mjs";
+import { join } from "node:path";
+import { readFile, readdir } from "node:fs/promises";
+//#region src/sandbox/credentials-worker.ts
+/**
+* Loads a project's constructs in a sandbox and answers with what their
+* credentials schemas say, as data: each schema as JSON Schema, and whether
+* each value it was handed passes.
+*
+* Usage (by `inspectCredentials` under a sandbox, never by hand):
+*   node --import=<tsx> credentials-worker.ts '{"patterns":[…],"cwd":"…"}'
+*
+* The schemas are the project's code, which is why they run here. Each value
+* arrives as a file in `GKM_SECRETS_DIR` named by its key, is read into this
+* process's memory only, and never comes back: an answer carries issue paths
+* and messages, not values.
+*/
+/** Every secret file the sandbox mounted, by name. */
+async function mountedSecrets() {
+	const dir = process.env[SECRETS_DIR_ENV];
+	if (!dir) return {};
+	const secrets = {};
+	for (const name of await readdir(dir)) secrets[name] = (await readFile(join(dir, name), "utf8")).trim();
+	return secrets;
+}
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await registerAdjacentTsconfig();
+		const sources = {};
+		const manifest = await discover({
+			patterns: request.patterns,
+			cwd: request.cwd,
+			sources
+		});
+		const inspection = await inspectLive(liveCredentials(manifest, sources), await mountedSecrets());
+		answer({
+			reason: "inspected",
+			...inspection
+		});
+	} catch (error) {
+		answer({
+			reason: "failed",
+			error: errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+export {};
+
+//# sourceMappingURL=credentials-worker.mjs.map

package/dist/sandbox/credentials-worker.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-worker.mjs","names":[],"sources":["../../src/sandbox/credentials-worker.ts"],"sourcesContent":["/**\n * Loads a project's constructs in a sandbox and answers with what their\n * credentials schemas say, as data: each schema as JSON Schema, and whether\n * each value it was handed passes.\n *\n * Usage (by `inspectCredentials` under a sandbox, never by hand):\n *   node --import=<tsx> credentials-worker.ts '{\"patterns\":[…],\"cwd\":\"…\"}'\n *\n * The schemas are the project's code, which is why they run here. Each value\n * arrives as a file in `GKM_SECRETS_DIR` named by its key, is read into this\n * process's memory only, and never comes back: an answer carries issue paths\n * and messages, not values.\n */\n\nimport { readdir, readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { type ConstructSource, discover } from '../reconcile/discover';\nimport { inspectLive, liveCredentials } from '../secrets/credentialSchemas';\nimport { SECRETS_DIR_ENV } from './sandbox';\nimport { answer, errorData, registerAdjacentTsconfig } from './workerRuntime';\n\n/** Every secret file the sandbox mounted, by name. */\nasync function mountedSecrets(): Promise<Record<string, string>> {\n\tconst dir = process.env[SECRETS_DIR_ENV];\n\tif (!dir) return {};\n\n\tconst secrets: Record<string, string> = {};\n\tfor (const name of await readdir(dir)) {\n\t\tsecrets[name] = (await readFile(join(dir, name), 'utf8')).trim();\n\t}\n\treturn secrets;\n}\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\tpatterns: string[];\n\t\t\tcwd: string;\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\tconst sources: Record<string, ConstructSource> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: request.patterns,\n\t\t\tcwd: request.cwd,\n\t\t\tsources,\n\t\t});\n\n\t\tconst inspection = await inspectLive(\n\t\t\tliveCredentials(manifest, sources),\n\t\t\tawait mountedSecrets(),\n\t\t);\n\t\tanswer({ reason: 'inspected', ...inspection });\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsBA,eAAe,iBAAkD;CAChE,MAAM,MAAM,QAAQ,IAAI;CACxB,IAAI,CAAC,KAAK,OAAO,CAAC;CAElB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,MAAM,QAAQ,GAAG,GACnC,QAAQ,SAAS,MAAM,SAAS,KAAK,KAAK,IAAI,GAAG,MAAM,EAAA,CAAG,KAAK;CAEhE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAIlD,MAAM,yBAAyB;EAE/B,MAAM,UAA2C,CAAC;EAClD,MAAM,WAAW,MAAM,SAAS;GAC/B,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAED,MAAM,aAAa,MAAM,YACxB,gBAAgB,UAAU,OAAO,GACjC,MAAM,eAAe,CACtB;EACA,OAAO;GAAE,QAAQ;GAAa,GAAG;EAAW,CAAC;CAC9C,SAAS,OAAO;EACf,OAAO;GAAE,QAAQ;GAAU,OAAO,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/discover-worker.cjs

@@ -0,0 +1,50 @@
+const require_discover = require("../discover-DozUKs8f.cjs");
+const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
+//#region src/sandbox/discover-worker.ts
+/**
+* Discovers a project's constructs in a sandbox and answers with the
+* manifest as data.
+*
+* Usage (by `discover` under a sandbox, never by hand):
+*   node --import=<tsx> discover-worker.ts '{"patterns":[…],"cwd":"…"}'
+*
+* Discovery imports every construct module — the project's code — which is
+* why it runs here rather than in the deploy. Its warnings go to stderr, where
+* the host passes them on.
+*/
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await require_workerRuntime.registerAdjacentTsconfig();
+		const runnables = {};
+		const background = {};
+		const subscribers = {};
+		const manifest = await require_discover.discover({
+			patterns: request.patterns,
+			cwd: request.cwd,
+			runnables,
+			background,
+			subscribers
+		});
+		const paths = require_workerRuntime.liveValuePaths(manifest);
+		require_workerRuntime.answer(paths.length > 0 ? {
+			reason: "live",
+			paths
+		} : {
+			reason: "discovered",
+			manifest,
+			runnables,
+			background,
+			subscribers
+		});
+	} catch (error) {
+		require_workerRuntime.answer({
+			reason: "failed",
+			error: require_workerRuntime.errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+
+//# sourceMappingURL=discover-worker.cjs.map

package/dist/sandbox/discover-worker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover-worker.cjs","names":["registerAdjacentTsconfig","discover","liveValuePaths","errorData"],"sources":["../../src/sandbox/discover-worker.ts"],"sourcesContent":["/**\n * Discovers a project's constructs in a sandbox and answers with the\n * manifest as data.\n *\n * Usage (by `discover` under a sandbox, never by hand):\n *   node --import=<tsx> discover-worker.ts '{\"patterns\":[…],\"cwd\":\"…\"}'\n *\n * Discovery imports every construct module — the project's code — which is\n * why it runs here rather than in the deploy. Its warnings go to stderr, where\n * the host passes them on.\n */\n\nimport { type BoundSubscriber, discover } from '../reconcile/discover';\nimport {\n\tanswer,\n\terrorData,\n\tliveValuePaths,\n\tregisterAdjacentTsconfig,\n} from './workerRuntime';\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\tpatterns: string[];\n\t\t\tcwd: string;\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\tconst runnables: Record<string, string[]> = {};\n\t\tconst background: Record<string, string[]> = {};\n\t\tconst subscribers: Record<string, BoundSubscriber[]> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: request.patterns,\n\t\t\tcwd: request.cwd,\n\t\t\trunnables,\n\t\t\tbackground,\n\t\t\tsubscribers,\n\t\t});\n\n\t\tconst paths = liveValuePaths(manifest);\n\t\tanswer(\n\t\t\tpaths.length > 0\n\t\t\t\t? { reason: 'live', paths }\n\t\t\t\t: {\n\t\t\t\t\t\treason: 'discovered',\n\t\t\t\t\t\tmanifest,\n\t\t\t\t\t\trunnables,\n\t\t\t\t\t\tbackground,\n\t\t\t\t\t\tsubscribers,\n\t\t\t\t\t},\n\t\t);\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAIlD,MAAMA,sBAAAA,yBAAyB;EAE/B,MAAM,YAAsC,CAAC;EAC7C,MAAM,aAAuC,CAAC;EAC9C,MAAM,cAAiD,CAAC;EACxD,MAAM,WAAW,MAAMC,iBAAAA,SAAS;GAC/B,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;GACA;GACA;EACD,CAAC;EAED,MAAM,QAAQC,sBAAAA,eAAe,QAAQ;EACrC,sBAAA,OACC,MAAM,SAAS,IACZ;GAAE,QAAQ;GAAQ;EAAM,IACxB;GACA,QAAQ;GACR;GACA;GACA;GACA;EACD,CACH;CACD,SAAS,OAAO;EACf,sBAAA,OAAO;GAAE,QAAQ;GAAU,OAAOC,sBAAAA,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/discover-worker.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/discover-worker.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/discover-worker.mjs

@@ -0,0 +1,51 @@
+import { i as discover } from "../discover-C5roJuc9.mjs";
+import { a as registerAdjacentTsconfig, i as liveValuePaths, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
+//#region src/sandbox/discover-worker.ts
+/**
+* Discovers a project's constructs in a sandbox and answers with the
+* manifest as data.
+*
+* Usage (by `discover` under a sandbox, never by hand):
+*   node --import=<tsx> discover-worker.ts '{"patterns":[…],"cwd":"…"}'
+*
+* Discovery imports every construct module — the project's code — which is
+* why it runs here rather than in the deploy. Its warnings go to stderr, where
+* the host passes them on.
+*/
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await registerAdjacentTsconfig();
+		const runnables = {};
+		const background = {};
+		const subscribers = {};
+		const manifest = await discover({
+			patterns: request.patterns,
+			cwd: request.cwd,
+			runnables,
+			background,
+			subscribers
+		});
+		const paths = liveValuePaths(manifest);
+		answer(paths.length > 0 ? {
+			reason: "live",
+			paths
+		} : {
+			reason: "discovered",
+			manifest,
+			runnables,
+			background,
+			subscribers
+		});
+	} catch (error) {
+		answer({
+			reason: "failed",
+			error: errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+export {};
+
+//# sourceMappingURL=discover-worker.mjs.map

package/dist/sandbox/discover-worker.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover-worker.mjs","names":[],"sources":["../../src/sandbox/discover-worker.ts"],"sourcesContent":["/**\n * Discovers a project's constructs in a sandbox and answers with the\n * manifest as data.\n *\n * Usage (by `discover` under a sandbox, never by hand):\n *   node --import=<tsx> discover-worker.ts '{\"patterns\":[…],\"cwd\":\"…\"}'\n *\n * Discovery imports every construct module — the project's code — which is\n * why it runs here rather than in the deploy. Its warnings go to stderr, where\n * the host passes them on.\n */\n\nimport { type BoundSubscriber, discover } from '../reconcile/discover';\nimport {\n\tanswer,\n\terrorData,\n\tliveValuePaths,\n\tregisterAdjacentTsconfig,\n} from './workerRuntime';\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\tpatterns: string[];\n\t\t\tcwd: string;\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\tconst runnables: Record<string, string[]> = {};\n\t\tconst background: Record<string, string[]> = {};\n\t\tconst subscribers: Record<string, BoundSubscriber[]> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: request.patterns,\n\t\t\tcwd: request.cwd,\n\t\t\trunnables,\n\t\t\tbackground,\n\t\t\tsubscribers,\n\t\t});\n\n\t\tconst paths = liveValuePaths(manifest);\n\t\tanswer(\n\t\t\tpaths.length > 0\n\t\t\t\t? { reason: 'live', paths }\n\t\t\t\t: {\n\t\t\t\t\t\treason: 'discovered',\n\t\t\t\t\t\tmanifest,\n\t\t\t\t\t\trunnables,\n\t\t\t\t\t\tbackground,\n\t\t\t\t\t\tsubscribers,\n\t\t\t\t\t},\n\t\t);\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAIlD,MAAM,yBAAyB;EAE/B,MAAM,YAAsC,CAAC;EAC7C,MAAM,aAAuC,CAAC;EAC9C,MAAM,cAAiD,CAAC;EACxD,MAAM,WAAW,MAAM,SAAS;GAC/B,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;GACA;GACA;EACD,CAAC;EAED,MAAM,QAAQ,eAAe,QAAQ;EACrC,OACC,MAAM,SAAS,IACZ;GAAE,QAAQ;GAAQ;EAAM,IACxB;GACA,QAAQ;GACR;GACA;GACA;GACA;EACD,CACH;CACD,SAAS,OAAO;EACf,OAAO;GAAE,QAAQ;GAAU,OAAO,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/migrate-worker.cjs

@@ -0,0 +1,75 @@
+const require_discover = require("../discover-DozUKs8f.cjs");
+const require_sandbox = require("../sandbox-CHv3OYXg.cjs");
+const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
+const require_databases = require("../databases-fOaoBInm.cjs");
+let node_path = require("node:path");
+let node_fs_promises = require("node:fs/promises");
+//#region src/sandbox/migrate-worker.ts
+/**
+* Applies a deployed stage's migrations, then runs its seeds, in a sandbox —
+* what `gkm seed` runs, against URLs the deploy hands it as secret files.
+*
+* Usage (by the Dokploy target's release, never by hand):
+*   node --import=<tsx> migrate-worker.ts '{"root":"…","stage":"…","manifest":{…},"patterns":[…]}'
+*
+* Migrations and seeds are the project's own code, which is why they run
+* here rather than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,
+* named by its key, and is read into this process's memory only: never into
+* `process.env`, where a child the migration starts would inherit it.
+*/
+/** Every secret file the sandbox mounted, by name. */
+async function mountedSecrets() {
+	const dir = process.env[require_sandbox.SECRETS_DIR_ENV];
+	if (!dir) return {};
+	const secrets = {};
+	for (const name of await (0, node_fs_promises.readdir)(dir)) secrets[name] = (await (0, node_fs_promises.readFile)((0, node_path.join)(dir, name), "utf8")).trim();
+	return secrets;
+}
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await require_workerRuntime.registerAdjacentTsconfig();
+		const sources = {};
+		if (request.patterns.length > 0) await require_discover.discover({
+			patterns: request.patterns,
+			cwd: request.root,
+			sources
+		});
+		const options = {
+			root: request.root,
+			manifest: request.manifest,
+			sources,
+			env: await mountedSecrets()
+		};
+		const runs = await require_databases.migrateDatabases(options);
+		const seeds = await require_databases.seedDatabases({
+			...options,
+			stage: request.stage
+		});
+		require_workerRuntime.answer({
+			reason: "migrated",
+			runs: runs.map(({ target, applied }) => ({
+				construct: target.id,
+				migrations: target.migrations,
+				applied
+			})),
+			seeds: seeds.map(({ target, seeded }) => ({
+				construct: target.id,
+				seeds: target.seeds,
+				seeded
+			}))
+		});
+	} catch (error) {
+		require_workerRuntime.answer({
+			reason: "failed",
+			error: {
+				...require_workerRuntime.errorData(error),
+				...error instanceof require_databases.SeedFailed ? { cause: require_workerRuntime.errorData(error.cause) } : {}
+			}
+		});
+	}
+}
+main();
+//#endregion
+
+//# sourceMappingURL=migrate-worker.cjs.map

package/dist/sandbox/migrate-worker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-worker.cjs","names":["SECRETS_DIR_ENV","readdir","readFile","join","registerAdjacentTsconfig","discover","migrateDatabases","seedDatabases","errorData","SeedFailed"],"sources":["../../src/sandbox/migrate-worker.ts"],"sourcesContent":["/**\n * Applies a deployed stage's migrations, then runs its seeds, in a sandbox —\n * what `gkm seed` runs, against URLs the deploy hands it as secret files.\n *\n * Usage (by the Dokploy target's release, never by hand):\n *   node --import=<tsx> migrate-worker.ts '{\"root\":\"…\",\"stage\":\"…\",\"manifest\":{…},\"patterns\":[…]}'\n *\n * Migrations and seeds are the project's own code, which is why they run\n * here rather than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,\n * named by its key, and is read into this process's memory only: never into\n * `process.env`, where a child the migration starts would inherit it.\n */\n\nimport { readdir, readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\tmigrateDatabases,\n\tSeedFailed,\n\tseedDatabases,\n} from '../migrate/databases';\nimport { type ConstructSource, discover } from '../reconcile/discover';\nimport { SECRETS_DIR_ENV } from './sandbox';\nimport { answer, errorData, registerAdjacentTsconfig } from './workerRuntime';\n\n/** Every secret file the sandbox mounted, by name. */\nasync function mountedSecrets(): Promise<Record<string, string>> {\n\tconst dir = process.env[SECRETS_DIR_ENV];\n\tif (!dir) return {};\n\n\tconst secrets: Record<string, string> = {};\n\tfor (const name of await readdir(dir)) {\n\t\tsecrets[name] = (await readFile(join(dir, name), 'utf8')).trim();\n\t}\n\treturn secrets;\n}\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\troot: string;\n\t\t\tstage: string;\n\t\t\tmanifest: ConstructManifest;\n\t\t\tpatterns: string[];\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\t// Where each construct is declared, so a migration runs with the Kysely\n\t\t// its own file resolves. The manifest itself is the deploy's: what it\n\t\t// provisioned is what gets migrated, not a second reading of the files.\n\t\tconst sources: Record<string, ConstructSource> = {};\n\t\tif (request.patterns.length > 0) {\n\t\t\tawait discover({\n\t\t\t\tpatterns: request.patterns,\n\t\t\t\tcwd: request.root,\n\t\t\t\tsources,\n\t\t\t});\n\t\t}\n\n\t\tconst options = {\n\t\t\troot: request.root,\n\t\t\tmanifest: request.manifest,\n\t\t\tsources,\n\t\t\tenv: await mountedSecrets(),\n\t\t};\n\t\tconst runs = await migrateDatabases(options);\n\t\t// Every seed, every time, after the schema it was written for.\n\t\tconst seeds = await seedDatabases({ ...options, stage: request.stage });\n\n\t\tanswer({\n\t\t\treason: 'migrated',\n\t\t\truns: runs.map(({ target, applied }) => ({\n\t\t\t\tconstruct: target.id,\n\t\t\t\tmigrations: target.migrations,\n\t\t\t\tapplied,\n\t\t\t})),\n\t\t\tseeds: seeds.map(({ target, seeded }) => ({\n\t\t\t\tconstruct: target.id,\n\t\t\t\tseeds: target.seeds,\n\t\t\t\tseeded,\n\t\t\t})),\n\t\t});\n\t} catch (error) {\n\t\t// A seed's cause is the database's error — an Error, which `errorData`\n\t\t// leaves out — and it is what says what to fix.\n\t\tanswer({\n\t\t\treason: 'failed',\n\t\t\terror: {\n\t\t\t\t...errorData(error),\n\t\t\t\t...(error instanceof SeedFailed\n\t\t\t\t\t? { cause: errorData(error.cause) }\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t});\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA0BA,eAAe,iBAAkD;CAChE,MAAM,MAAM,QAAQ,IAAIA,gBAAAA;CACxB,IAAI,CAAC,KAAK,OAAO,CAAC;CAElB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,QAAAA,CAAQ,GAAG,GACnC,QAAQ,SAAS,OAAA,GAAMC,iBAAAA,SAAAA,EAAAA,GAASC,UAAAA,KAAAA,CAAK,KAAK,IAAI,GAAG,MAAM,EAAA,CAAG,KAAK;CAEhE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAMlD,MAAMC,sBAAAA,yBAAyB;EAK/B,MAAM,UAA2C,CAAC;EAClD,IAAI,QAAQ,SAAS,SAAS,GAC7B,MAAMC,iBAAAA,SAAS;GACd,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAGF,MAAM,UAAU;GACf,MAAM,QAAQ;GACd,UAAU,QAAQ;GAClB;GACA,KAAK,MAAM,eAAe;EAC3B;EACA,MAAM,OAAO,MAAMC,kBAAAA,iBAAiB,OAAO;EAE3C,MAAM,QAAQ,MAAMC,kBAAAA,cAAc;GAAE,GAAG;GAAS,OAAO,QAAQ;EAAM,CAAC;EAEtE,sBAAA,OAAO;GACN,QAAQ;GACR,MAAM,KAAK,KAAK,EAAE,QAAQ,eAAe;IACxC,WAAW,OAAO;IAClB,YAAY,OAAO;IACnB;GACD,EAAE;GACF,OAAO,MAAM,KAAK,EAAE,QAAQ,cAAc;IACzC,WAAW,OAAO;IAClB,OAAO,OAAO;IACd;GACD,EAAE;EACH,CAAC;CACF,SAAS,OAAO;EAGf,sBAAA,OAAO;GACN,QAAQ;GACR,OAAO;IACN,GAAGC,sBAAAA,UAAU,KAAK;IAClB,GAAI,iBAAiBC,kBAAAA,aAClB,EAAE,OAAOD,sBAAAA,UAAU,MAAM,KAAK,EAAE,IAChC,CAAC;GACL;EACD,CAAC;CACF;AACD;AAEK,KAAK"}

package/dist/sandbox/migrate-worker.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/migrate-worker.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/migrate-worker.mjs

@@ -0,0 +1,76 @@
+import { i as discover } from "../discover-C5roJuc9.mjs";
+import { t as SECRETS_DIR_ENV } from "../sandbox-CbVB7uOD.mjs";
+import { a as registerAdjacentTsconfig, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
+import { o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "../databases-BPOgTn1u.mjs";
+import { join } from "node:path";
+import { readFile, readdir } from "node:fs/promises";
+//#region src/sandbox/migrate-worker.ts
+/**
+* Applies a deployed stage's migrations, then runs its seeds, in a sandbox —
+* what `gkm seed` runs, against URLs the deploy hands it as secret files.
+*
+* Usage (by the Dokploy target's release, never by hand):
+*   node --import=<tsx> migrate-worker.ts '{"root":"…","stage":"…","manifest":{…},"patterns":[…]}'
+*
+* Migrations and seeds are the project's own code, which is why they run
+* here rather than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,
+* named by its key, and is read into this process's memory only: never into
+* `process.env`, where a child the migration starts would inherit it.
+*/
+/** Every secret file the sandbox mounted, by name. */
+async function mountedSecrets() {
+	const dir = process.env[SECRETS_DIR_ENV];
+	if (!dir) return {};
+	const secrets = {};
+	for (const name of await readdir(dir)) secrets[name] = (await readFile(join(dir, name), "utf8")).trim();
+	return secrets;
+}
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await registerAdjacentTsconfig();
+		const sources = {};
+		if (request.patterns.length > 0) await discover({
+			patterns: request.patterns,
+			cwd: request.root,
+			sources
+		});
+		const options = {
+			root: request.root,
+			manifest: request.manifest,
+			sources,
+			env: await mountedSecrets()
+		};
+		const runs = await migrateDatabases(options);
+		const seeds = await seedDatabases({
+			...options,
+			stage: request.stage
+		});
+		answer({
+			reason: "migrated",
+			runs: runs.map(({ target, applied }) => ({
+				construct: target.id,
+				migrations: target.migrations,
+				applied
+			})),
+			seeds: seeds.map(({ target, seeded }) => ({
+				construct: target.id,
+				seeds: target.seeds,
+				seeded
+			}))
+		});
+	} catch (error) {
+		answer({
+			reason: "failed",
+			error: {
+				...errorData(error),
+				...error instanceof SeedFailed ? { cause: errorData(error.cause) } : {}
+			}
+		});
+	}
+}
+main();
+//#endregion
+export {};
+
+//# sourceMappingURL=migrate-worker.mjs.map

package/dist/sandbox/migrate-worker.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-worker.mjs","names":[],"sources":["../../src/sandbox/migrate-worker.ts"],"sourcesContent":["/**\n * Applies a deployed stage's migrations, then runs its seeds, in a sandbox —\n * what `gkm seed` runs, against URLs the deploy hands it as secret files.\n *\n * Usage (by the Dokploy target's release, never by hand):\n *   node --import=<tsx> migrate-worker.ts '{\"root\":\"…\",\"stage\":\"…\",\"manifest\":{…},\"patterns\":[…]}'\n *\n * Migrations and seeds are the project's own code, which is why they run\n * here rather than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,\n * named by its key, and is read into this process's memory only: never into\n * `process.env`, where a child the migration starts would inherit it.\n */\n\nimport { readdir, readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\tmigrateDatabases,\n\tSeedFailed,\n\tseedDatabases,\n} from '../migrate/databases';\nimport { type ConstructSource, discover } from '../reconcile/discover';\nimport { SECRETS_DIR_ENV } from './sandbox';\nimport { answer, errorData, registerAdjacentTsconfig } from './workerRuntime';\n\n/** Every secret file the sandbox mounted, by name. */\nasync function mountedSecrets(): Promise<Record<string, string>> {\n\tconst dir = process.env[SECRETS_DIR_ENV];\n\tif (!dir) return {};\n\n\tconst secrets: Record<string, string> = {};\n\tfor (const name of await readdir(dir)) {\n\t\tsecrets[name] = (await readFile(join(dir, name), 'utf8')).trim();\n\t}\n\treturn secrets;\n}\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\troot: string;\n\t\t\tstage: string;\n\t\t\tmanifest: ConstructManifest;\n\t\t\tpatterns: string[];\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\t// Where each construct is declared, so a migration runs with the Kysely\n\t\t// its own file resolves. The manifest itself is the deploy's: what it\n\t\t// provisioned is what gets migrated, not a second reading of the files.\n\t\tconst sources: Record<string, ConstructSource> = {};\n\t\tif (request.patterns.length > 0) {\n\t\t\tawait discover({\n\t\t\t\tpatterns: request.patterns,\n\t\t\t\tcwd: request.root,\n\t\t\t\tsources,\n\t\t\t});\n\t\t}\n\n\t\tconst options = {\n\t\t\troot: request.root,\n\t\t\tmanifest: request.manifest,\n\t\t\tsources,\n\t\t\tenv: await mountedSecrets(),\n\t\t};\n\t\tconst runs = await migrateDatabases(options);\n\t\t// Every seed, every time, after the schema it was written for.\n\t\tconst seeds = await seedDatabases({ ...options, stage: request.stage });\n\n\t\tanswer({\n\t\t\treason: 'migrated',\n\t\t\truns: runs.map(({ target, applied }) => ({\n\t\t\t\tconstruct: target.id,\n\t\t\t\tmigrations: target.migrations,\n\t\t\t\tapplied,\n\t\t\t})),\n\t\t\tseeds: seeds.map(({ target, seeded }) => ({\n\t\t\t\tconstruct: target.id,\n\t\t\t\tseeds: target.seeds,\n\t\t\t\tseeded,\n\t\t\t})),\n\t\t});\n\t} catch (error) {\n\t\t// A seed's cause is the database's error — an Error, which `errorData`\n\t\t// leaves out — and it is what says what to fix.\n\t\tanswer({\n\t\t\treason: 'failed',\n\t\t\terror: {\n\t\t\t\t...errorData(error),\n\t\t\t\t...(error instanceof SeedFailed\n\t\t\t\t\t? { cause: errorData(error.cause) }\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t});\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA0BA,eAAe,iBAAkD;CAChE,MAAM,MAAM,QAAQ,IAAI;CACxB,IAAI,CAAC,KAAK,OAAO,CAAC;CAElB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,MAAM,QAAQ,GAAG,GACnC,QAAQ,SAAS,MAAM,SAAS,KAAK,KAAK,IAAI,GAAG,MAAM,EAAA,CAAG,KAAK;CAEhE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAMlD,MAAM,yBAAyB;EAK/B,MAAM,UAA2C,CAAC;EAClD,IAAI,QAAQ,SAAS,SAAS,GAC7B,MAAM,SAAS;GACd,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAGF,MAAM,UAAU;GACf,MAAM,QAAQ;GACd,UAAU,QAAQ;GAClB;GACA,KAAK,MAAM,eAAe;EAC3B;EACA,MAAM,OAAO,MAAM,iBAAiB,OAAO;EAE3C,MAAM,QAAQ,MAAM,cAAc;GAAE,GAAG;GAAS,OAAO,QAAQ;EAAM,CAAC;EAEtE,OAAO;GACN,QAAQ;GACR,MAAM,KAAK,KAAK,EAAE,QAAQ,eAAe;IACxC,WAAW,OAAO;IAClB,YAAY,OAAO;IACnB;GACD,EAAE;GACF,OAAO,MAAM,KAAK,EAAE,QAAQ,cAAc;IACzC,WAAW,OAAO;IAClB,OAAO,OAAO;IACd;GACD,EAAE;EACH,CAAC;CACF,SAAS,OAAO;EAGf,OAAO;GACN,QAAQ;GACR,OAAO;IACN,GAAG,UAAU,KAAK;IAClB,GAAI,iBAAiB,aAClB,EAAE,OAAO,UAAU,MAAM,KAAK,EAAE,IAChC,CAAC;GACL;EACD,CAAC;CACF;AACD;AAEK,KAAK"}

package/dist/sandbox-C4g1eG31.d.mts

@@ -0,0 +1,104 @@
+import { jt as GkmError } from "./types-HqVPddRK.mjs";
+//#region src/sandbox/sandbox.d.ts
+/** Where a command's output goes. */
+type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
+interface SandboxExecOptions {
+  /**
+   * Where the command runs: the project root or a directory below it, as an
+   * absolute path or relative to the root. Anywhere else is refused with
+   * {@link SandboxCwdEscape}.
+   */
+  cwd: string;
+  /**
+   * The command's whole environment. Nothing of the host's is added to it:
+   * start from {@link Sandbox.env} and add what the step needs.
+   */
+  env: Readonly<Record<string, string>>;
+  /**
+   * How long the command may run before it is killed. Required: a step that
+   * waits forever — a sniffed entry that opens a server, a build stuck on a
+   * prompt — would otherwise hold the deploy, and its lock, forever.
+   */
+  timeoutMs: number;
+  /**
+   * Files the command can read, by name. Mounted in a directory of their own
+   * — named by `GKM_SECRETS_DIR` in the command's environment — and removed
+   * when it exits. Never set as variables, which every child inherits, a
+   * crash report prints and `/proc/<pid>/environ` shows.
+   */
+  secrets?: Readonly<Record<string, string>>;
+  /**
+   * `capture` (the default) returns stdout and stderr in the result;
+   * `inherit` gives the command the host's terminal; `stderr` sends both
+   * streams to the host's stderr; `ignore` discards them.
+   */
+  output?: SandboxOutput;
+  /** Kills the command when aborted; `exec` rejects with the signal's reason. */
+  signal?: AbortSignal;
+}
+/** How a command ended. A non-zero exit is a result, not an error. */
+interface SandboxResult {
+  exitCode: number | null;
+  signal: string | null;
+  /** What it wrote to stdout, when its output was captured. */
+  stdout: string;
+  /** What it wrote to stderr, when its output was captured. */
+  stderr: string;
+}
+/**
+ * Runs a command against the project, and nothing else of the host's.
+ *
+ * `exec` resolves with the result however the command exited. It rejects
+ * with {@link CommandTimedOut} once the timeout passes — after the command is
+ * gone — with {@link SandboxCwdEscape} for a directory outside the project,
+ * with the signal's reason when aborted, and with the spawn error when the
+ * program cannot be started.
+ */
+interface Sandbox {
+  /** The project: the directory every command runs at or below. */
+  readonly root: string;
+  /**
+   * Whether the code it runs is kept from the host: its files, its
+   * processes, its memory.
+   *
+   * An isolating sandbox shares nothing but what crosses `exec`, so a config
+   * reaches the deploy as data — a live object in it (a custom state store,
+   * an inline target) cannot cross, and is refused with
+   * `ConfigObjectNotSerializable`. A non-isolating one, like
+   * {@link LocalSandbox}, runs on the host as the host's user; a project
+   * whose config holds live objects is then loaded in-process as before,
+   * because a project trusted to run there is trusted to do that.
+   */
+  readonly isolating: boolean;
+  /**
+   * The environment a command starts from: what any program needs to run
+   * here — `PATH`, `HOME`, the locale — and no credential.
+   */
+  readonly env: Readonly<Record<string, string>>;
+  exec(command: string, args: readonly string[], options: SandboxExecOptions): Promise<SandboxResult>;
+}
+/** The variable naming the directory a command's secrets are mounted in. */
+declare const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
+/** A command was asked to run outside the project. */
+declare class SandboxCwdEscape extends GkmError {
+  readonly cwd: string;
+  readonly root: string;
+  constructor(cwd: string, root: string);
+}
+/**
+ * `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.
+ *
+ * Symlinks are resolved on both sides first, so a link inside the project
+ * that points out of it is an escape, and a project reached through a link
+ * (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call
+ * before it runs anything.
+ */
+declare function confineCwd(root: string, cwd: string): string;
+/** A secret's file name: one path segment, so it cannot be written elsewhere. */
+declare class SecretNameInvalid extends GkmError {
+  readonly secretName: string;
+  constructor(secretName: string);
+}
+//#endregion
+export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
+//# sourceMappingURL=sandbox-C4g1eG31.d.mts.map

package/dist/sandbox-C4g1eG31.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-C4g1eG31.d.mts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}