@geekmidas/cli 10.0.0-alpha.122 → 10.0.0-alpha.124

package/dist/{config-D48erO2j.d.mts → config-IgK6YaGp.d.cts}

@@ -1,6 +1,5 @@
-import { b as NormalizedAppConfig, jt as GkmError, r as GkmConfig, v as LoadedConfig, x as NormalizedWorkspace } from "./types-HqVPddRK.mjs";
-import { n as Sandbox } from "./sandbox-C4g1eG31.mjs";
-import "./index-Dpji6Bxq.mjs";
+import { Lt as Sandbox, Wt as GkmError, b as NormalizedAppConfig, r as GkmConfig, v as LoadedConfig, x as NormalizedWorkspace } from "./types-CFU2uvrz.cjs";
+import "./index-4CO0HD27.cjs";
 import { ConstructManifest } from "@geekmidas/manifest";
 //#region src/dev/discovery.d.ts
 /** Where an app is in its life. `stopped` is a server that exited on its own. */
@@ -266,4 +265,4 @@ interface WorkspaceAppInfo {
 declare function loadWorkspaceAppInfo(cwd?: string): Promise<WorkspaceAppInfo>;
 //#endregion
 export { DiscoveredApp as C, DiscoveryResponse as D, DiscoveryEvent as E, DataApiKind as S, DiscoveredWorkspace as T, loadWorkspaceAppInfo as _, ConfigNotFound as a, parseModuleConfig as b, NotABackendApp as c, WorkspaceAppInfo as d, WorkspaceDeclaresNoConstructs as f, loadConfig as g, loadAppConfig as h, ConfigLoadFailed as i, NotInAnApp as l, findWorkspaceRoot as m, CONFIG_LOAD_TIMEOUT_MS as n, ConfigObjectNotSerializable as o, defineConfig as p, ConfigDiscoveryResult as r, LoadConfigOptions as s, AppConfigResult as t, ParsedModuleConfig as u, loadWorkspaceConfig as v, DiscoveredDataApi as w, AppStatus as x, loadWorkspaceSettings as y };
-//# sourceMappingURL=config-D48erO2j.d.mts.map
+//# sourceMappingURL=config-IgK6YaGp.d.cts.map

package/dist/config-IgK6YaGp.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-IgK6YaGp.d.cts","names":[],"sources":["../src/dev/discovery.ts","../src/config.ts"],"mappings":";;;;;KAqFY;;KAGA;;;;;;UAyBK;;EAEhB;;EAEA;;UA8BgB;EAChB,MAAM;;EAEN;;EAEA;;EAEA;;UAGgB;EAChB;EACA;EACA;;EAEA;EACA;EACA,QAAQ;EACR;;EAEA;EACA,UAAU;;UAGM;;EAEhB;EACA;EACA;EACA;EACA,UAAU;;EAEV,WAAW;EACX,MAAM;;;UAIU;EAChB;;EAEA;IAAQ;IAAa;;;EAErB;EACA,YAAY;;;KAID;EACP;EAAkB,UAAU;;EAC5B;EAAiD;;EAEnD;EACA;EACA,KAAK;;;;;;;;;;;;;;;;;;;;;iBCpJQ,aAAa,QAAQ,YAAY;UAIhC;EAChB;EACA;;;;;;;;;;;;;;;;;;;iBAoBe,kBACf,sBACA,uBACE;UAac;EAChB;EACA;;;;;;;;iBAgDe,kBAAkB;;cAKrB,uBAAuB;WACd;EAArB,YAAqB;;UAaL;;;;;;;;EAQhB,UAAU;;;;;EAKV;;;;;;;cAQY;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,oBACA;;;;;;;cAYE,oCAAoC;WAEtC;WACA;EAFV,YACU,oBACA;;;;;;;;iBA0GW,WACrB,eACE,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuCW,sBACrB,cACA,UAAS,oBACP,QAAQ;iBAKW,oBACrB,cACA,UAAS,oBACP,QAAQ;;;;;;;;cAmEE,sCAAsC;WAC7B;EAArB,YAAqB;;UAWL;EAChB;EACA,KAAK;EACL,WAAW;EACX,WAAW;EACX;EACA;;;cAqCY,mBAAmB;WAErB;WACA,MAAM,SAAS;EAFzB,YACU,aACA,MAAM,SAAS;;;;;;;;;;;;;;;iBAoCJ,cACrB,eACE,QAAQ;;cAkBE,uBAAuB;WACd;EAArB,YAAqB;;UAQL;;EAEhB;EACA,KAAK;EACL,WAAW;EACX;;;;;;;;;iBAUqB,qBACrB,eACE,QAAQ"}

package/dist/{config-DHDtsQrB.d.cts → config-kE-p5hxq.d.mts}

@@ -1,6 +1,5 @@
-import { b as NormalizedAppConfig, jt as GkmError, r as GkmConfig, v as LoadedConfig, x as NormalizedWorkspace } from "./types-B6UXlEkf.cjs";
-import { n as Sandbox } from "./sandbox-CdKgQ3XU.cjs";
-import "./index-8OfpOtSI.cjs";
+import { Lt as Sandbox, Wt as GkmError, b as NormalizedAppConfig, r as GkmConfig, v as LoadedConfig, x as NormalizedWorkspace } from "./types-D3BeGucy.mjs";
+import "./index-DhUf0B0m.mjs";
 import { ConstructManifest } from "@geekmidas/manifest";
 //#region src/dev/discovery.d.ts
 /** Where an app is in its life. `stopped` is a server that exited on its own. */
@@ -266,4 +265,4 @@ interface WorkspaceAppInfo {
 declare function loadWorkspaceAppInfo(cwd?: string): Promise<WorkspaceAppInfo>;
 //#endregion
 export { DiscoveredApp as C, DiscoveryResponse as D, DiscoveryEvent as E, DataApiKind as S, DiscoveredWorkspace as T, loadWorkspaceAppInfo as _, ConfigNotFound as a, parseModuleConfig as b, NotABackendApp as c, WorkspaceAppInfo as d, WorkspaceDeclaresNoConstructs as f, loadConfig as g, loadAppConfig as h, ConfigLoadFailed as i, NotInAnApp as l, findWorkspaceRoot as m, CONFIG_LOAD_TIMEOUT_MS as n, ConfigObjectNotSerializable as o, defineConfig as p, ConfigDiscoveryResult as r, LoadConfigOptions as s, AppConfigResult as t, ParsedModuleConfig as u, loadWorkspaceConfig as v, DiscoveredDataApi as w, AppStatus as x, loadWorkspaceSettings as y };
-//# sourceMappingURL=config-DHDtsQrB.d.cts.map
+//# sourceMappingURL=config-kE-p5hxq.d.mts.map

package/dist/config-kE-p5hxq.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-kE-p5hxq.d.mts","names":[],"sources":["../src/dev/discovery.ts","../src/config.ts"],"mappings":";;;;;KAqFY;;KAGA;;;;;;UAyBK;;EAEhB;;EAEA;;UA8BgB;EAChB,MAAM;;EAEN;;EAEA;;EAEA;;UAGgB;EAChB;EACA;EACA;;EAEA;EACA;EACA,QAAQ;EACR;;EAEA;EACA,UAAU;;UAGM;;EAEhB;EACA;EACA;EACA;EACA,UAAU;;EAEV,WAAW;EACX,MAAM;;;UAIU;EAChB;;EAEA;IAAQ;IAAa;;;EAErB;EACA,YAAY;;;KAID;EACP;EAAkB,UAAU;;EAC5B;EAAiD;;EAEnD;EACA;EACA,KAAK;;;;;;;;;;;;;;;;;;;;;iBCpJQ,aAAa,QAAQ,YAAY;UAIhC;EAChB;EACA;;;;;;;;;;;;;;;;;;;iBAoBe,kBACf,sBACA,uBACE;UAac;EAChB;EACA;;;;;;;;iBAgDe,kBAAkB;;cAKrB,uBAAuB;WACd;EAArB,YAAqB;;UAaL;;;;;;;;EAQhB,UAAU;;;;;EAKV;;;;;;;cAQY;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,oBACA;;;;;;;cAYE,oCAAoC;WAEtC;WACA;EAFV,YACU,oBACA;;;;;;;;iBA0GW,WACrB,eACE,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuCW,sBACrB,cACA,UAAS,oBACP,QAAQ;iBAKW,oBACrB,cACA,UAAS,oBACP,QAAQ;;;;;;;;cAmEE,sCAAsC;WAC7B;EAArB,YAAqB;;UAWL;EAChB;EACA,KAAK;EACL,WAAW;EACX,WAAW;EACX;EACA;;;cAqCY,mBAAmB;WAErB;WACA,MAAM,SAAS;EAFzB,YACU,aACA,MAAM,SAAS;;;;;;;;;;;;;;;iBAoCJ,cACrB,eACE,QAAQ;;cAkBE,uBAAuB;WACd;EAArB,YAAqB;;UAQL;;EAEhB;EACA,KAAK;EACL,WAAW;EACX;;;;;;;;;iBAUqB,qBACrB,eACE,QAAQ"}

package/dist/config.cjs

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_workspace = require("./workspace-BwqQnool.cjs");
+const require_workspace = require("./workspace-C82GLPnf.cjs");
 const require_schemas = require("./schemas-BQ_v0lEX.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_discover = require("./discover-DozUKs8f.cjs");
+const require_discover = require("./discover-ojkcbxHw.cjs");
 const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");

package/dist/config.d.cts

@@ -1,4 +1,4 @@
-import { D as WorkspaceConfig, m as DevConfig, r as GkmConfig, v as LoadedConfig } from "./types-B6UXlEkf.cjs";
-import { l as defineWorkspace } from "./index-8OfpOtSI.cjs";
-import { C as DiscoveredApp, D as DiscoveryResponse, E as DiscoveryEvent, S as DataApiKind, T as DiscoveredWorkspace, _ as loadWorkspaceAppInfo, a as ConfigNotFound, b as parseModuleConfig, c as NotABackendApp, d as WorkspaceAppInfo, f as WorkspaceDeclaresNoConstructs, g as loadConfig, h as loadAppConfig, i as ConfigLoadFailed, l as NotInAnApp, m as findWorkspaceRoot, n as CONFIG_LOAD_TIMEOUT_MS, o as ConfigObjectNotSerializable, p as defineConfig, r as ConfigDiscoveryResult, s as LoadConfigOptions, t as AppConfigResult, u as ParsedModuleConfig, v as loadWorkspaceConfig, w as DiscoveredDataApi, x as AppStatus, y as loadWorkspaceSettings } from "./config-DHDtsQrB.cjs";
+import { D as WorkspaceConfig, m as DevConfig, r as GkmConfig, v as LoadedConfig } from "./types-CFU2uvrz.cjs";
+import { l as defineWorkspace } from "./index-4CO0HD27.cjs";
+import { C as DiscoveredApp, D as DiscoveryResponse, E as DiscoveryEvent, S as DataApiKind, T as DiscoveredWorkspace, _ as loadWorkspaceAppInfo, a as ConfigNotFound, b as parseModuleConfig, c as NotABackendApp, d as WorkspaceAppInfo, f as WorkspaceDeclaresNoConstructs, g as loadConfig, h as loadAppConfig, i as ConfigLoadFailed, l as NotInAnApp, m as findWorkspaceRoot, n as CONFIG_LOAD_TIMEOUT_MS, o as ConfigObjectNotSerializable, p as defineConfig, r as ConfigDiscoveryResult, s as LoadConfigOptions, t as AppConfigResult, u as ParsedModuleConfig, v as loadWorkspaceConfig, w as DiscoveredDataApi, x as AppStatus, y as loadWorkspaceSettings } from "./config-IgK6YaGp.cjs";
 export { AppConfigResult, type AppStatus, CONFIG_LOAD_TIMEOUT_MS, ConfigDiscoveryResult, ConfigLoadFailed, ConfigNotFound, ConfigObjectNotSerializable, type DataApiKind, type DevConfig, type DiscoveredApp, type DiscoveredDataApi, type DiscoveredWorkspace, type DiscoveryEvent, type DiscoveryResponse, type GkmConfig, LoadConfigOptions, type LoadedConfig, NotABackendApp, NotInAnApp, ParsedModuleConfig, WorkspaceAppInfo, type WorkspaceConfig, WorkspaceDeclaresNoConstructs, defineConfig, defineWorkspace, findWorkspaceRoot, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig };

package/dist/config.d.mts

@@ -1,4 +1,4 @@
-import { D as WorkspaceConfig, m as DevConfig, r as GkmConfig, v as LoadedConfig } from "./types-HqVPddRK.mjs";
-import { l as defineWorkspace } from "./index-Dpji6Bxq.mjs";
-import { C as DiscoveredApp, D as DiscoveryResponse, E as DiscoveryEvent, S as DataApiKind, T as DiscoveredWorkspace, _ as loadWorkspaceAppInfo, a as ConfigNotFound, b as parseModuleConfig, c as NotABackendApp, d as WorkspaceAppInfo, f as WorkspaceDeclaresNoConstructs, g as loadConfig, h as loadAppConfig, i as ConfigLoadFailed, l as NotInAnApp, m as findWorkspaceRoot, n as CONFIG_LOAD_TIMEOUT_MS, o as ConfigObjectNotSerializable, p as defineConfig, r as ConfigDiscoveryResult, s as LoadConfigOptions, t as AppConfigResult, u as ParsedModuleConfig, v as loadWorkspaceConfig, w as DiscoveredDataApi, x as AppStatus, y as loadWorkspaceSettings } from "./config-D48erO2j.mjs";
+import { D as WorkspaceConfig, m as DevConfig, r as GkmConfig, v as LoadedConfig } from "./types-D3BeGucy.mjs";
+import { l as defineWorkspace } from "./index-DhUf0B0m.mjs";
+import { C as DiscoveredApp, D as DiscoveryResponse, E as DiscoveryEvent, S as DataApiKind, T as DiscoveredWorkspace, _ as loadWorkspaceAppInfo, a as ConfigNotFound, b as parseModuleConfig, c as NotABackendApp, d as WorkspaceAppInfo, f as WorkspaceDeclaresNoConstructs, g as loadConfig, h as loadAppConfig, i as ConfigLoadFailed, l as NotInAnApp, m as findWorkspaceRoot, n as CONFIG_LOAD_TIMEOUT_MS, o as ConfigObjectNotSerializable, p as defineConfig, r as ConfigDiscoveryResult, s as LoadConfigOptions, t as AppConfigResult, u as ParsedModuleConfig, v as loadWorkspaceConfig, w as DiscoveredDataApi, x as AppStatus, y as loadWorkspaceSettings } from "./config-kE-p5hxq.mjs";
 export { AppConfigResult, type AppStatus, CONFIG_LOAD_TIMEOUT_MS, ConfigDiscoveryResult, ConfigLoadFailed, ConfigNotFound, ConfigObjectNotSerializable, type DataApiKind, type DevConfig, type DiscoveredApp, type DiscoveredDataApi, type DiscoveredWorkspace, type DiscoveryEvent, type DiscoveryResponse, type GkmConfig, LoadConfigOptions, type LoadedConfig, NotABackendApp, NotInAnApp, ParsedModuleConfig, WorkspaceAppInfo, type WorkspaceConfig, WorkspaceDeclaresNoConstructs, defineConfig, defineWorkspace, findWorkspaceRoot, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig };

package/dist/config.mjs

@@ -1,8 +1,8 @@
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { a as allConstructGlobs, b as isWorkspaceConfig, d as getAppGkmConfig, l as defineWorkspace, m as processConfig } from "./workspace-D1QbNd55.mjs";
+import { a as allConstructGlobs, b as isWorkspaceConfig, d as getAppGkmConfig, l as defineWorkspace, m as processConfig } from "./workspace-DUnnVjqC.mjs";
 import { a as discriminatedUnion, c as literal, d as object, f as record, g as unknown, n as array, p as string } from "./schemas-BCwKKA42.mjs";
 import { n as derivedApps } from "./derive-B4vDpzgP.mjs";
-import { f as output, i as discover, l as runWorker } from "./discover-C5roJuc9.mjs";
+import { f as output, i as discover, l as runWorker } from "./discover-BvJOVsYG.mjs";
 import { i as activeSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { dirname, join, parse, resolve, sep } from "node:path";
 import { existsSync, realpathSync } from "node:fs";

package/dist/{credentialSchemas-B67WJOOm.cjs → credentialSchemas-AhIBuQxQ.cjs}

@@ -1,6 +1,6 @@
 const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_schemas = require("./schemas-BQ_v0lEX.cjs");
-const require_discover = require("./discover-DozUKs8f.cjs");
+const require_discover = require("./discover-ojkcbxHw.cjs");
 const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let _geekmidas_constructs_credential = require("@geekmidas/constructs/credential");
@@ -269,4 +269,4 @@ Object.defineProperty(exports, "loadCredentialSchemas", {
 	}
 });
 
-//# sourceMappingURL=credentialSchemas-B67WJOOm.cjs.map
+//# sourceMappingURL=credentialSchemas-AhIBuQxQ.cjs.map

package/dist/{credentialSchemas-B67WJOOm.cjs.map → credentialSchemas-AhIBuQxQ.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"credentialSchemas-B67WJOOm.cjs","names":["provideKey","decodeCredentials","activeSandbox","runWorker","ConstructDiscoveryFailed","discover","GkmError"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,MAAA,GAAKA,oBAAAA,WAAAA,CAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAA,gBAAA,aAAsB,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,UAAA,GAASC,iCAAAA,kBAAAA,CAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAA,gBAAA,OAAiB;CAAE,MAAA,gBAAA,OAAe;CAAG,SAAA,gBAAA,OAAkB;AAAE,CAAC;;AAGhE,MAAM,oBAAA,gBAAA,mBAAyC,UAAU,CAAA,gBAAA,OAC/C;CACR,QAAA,gBAAA,QAAkB,WAAW;CAC7B,SAAA,gBAAA,MAAA,gBAAA,OACU;EACR,KAAA,gBAAA,OAAc;EACd,IAAA,gBAAA,OAAa;EACb,MAAA,gBAAA,MAAa,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAA,gBAAA,OAAA,gBAAA,OAA8B,GAAA,gBAAA,QAAa,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAA,gBAAA,OAAA,gBAAA,OACU,GAAA,gBAAA,OACA;EAAE,IAAA,gBAAA,QAAc;EAAG,QAAA,gBAAA,MAAgB,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GAAA,gBAAA,OACQ;CACR,QAAA,gBAAA,QAAkB,QAAQ;CAC1B,OAAA,gBAAA,OAAgB;EAAE,MAAA,gBAAA,OAAe;EAAG,SAAA,gBAAA,OAAkB;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAUC,gBAAAA,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAMC,iBAAAA,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAIC,iBAAAA,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALNC,iBAAAA,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAOH,gBAAAA,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwCI,eAAAA,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}
+{"version":3,"file":"credentialSchemas-AhIBuQxQ.cjs","names":["provideKey","decodeCredentials","activeSandbox","runWorker","ConstructDiscoveryFailed","discover","GkmError"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,MAAA,GAAKA,oBAAAA,WAAAA,CAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAA,gBAAA,aAAsB,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,UAAA,GAASC,iCAAAA,kBAAAA,CAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAA,gBAAA,OAAiB;CAAE,MAAA,gBAAA,OAAe;CAAG,SAAA,gBAAA,OAAkB;AAAE,CAAC;;AAGhE,MAAM,oBAAA,gBAAA,mBAAyC,UAAU,CAAA,gBAAA,OAC/C;CACR,QAAA,gBAAA,QAAkB,WAAW;CAC7B,SAAA,gBAAA,MAAA,gBAAA,OACU;EACR,KAAA,gBAAA,OAAc;EACd,IAAA,gBAAA,OAAa;EACb,MAAA,gBAAA,MAAa,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAA,gBAAA,OAAA,gBAAA,OAA8B,GAAA,gBAAA,QAAa,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAA,gBAAA,OAAA,gBAAA,OACU,GAAA,gBAAA,OACA;EAAE,IAAA,gBAAA,QAAc;EAAG,QAAA,gBAAA,MAAgB,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GAAA,gBAAA,OACQ;CACR,QAAA,gBAAA,QAAkB,QAAQ;CAC1B,OAAA,gBAAA,OAAgB;EAAE,MAAA,gBAAA,OAAe;EAAG,SAAA,gBAAA,OAAkB;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAUC,gBAAAA,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAMC,iBAAAA,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAIC,iBAAAA,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALNC,iBAAAA,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAOH,gBAAAA,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwCI,eAAAA,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}

package/dist/{credentialSchemas-DDOLRCLF.mjs → credentialSchemas-DLKbxYBy.mjs}

@@ -1,6 +1,6 @@
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { a as discriminatedUnion, c as literal, d as object, f as record, g as unknown, n as array, p as string, r as boolean, t as _enum, v as toJSONSchema } from "./schemas-BCwKKA42.mjs";
-import { i as discover, l as runWorker, t as ConstructDiscoveryFailed } from "./discover-C5roJuc9.mjs";
+import { i as discover, l as runWorker, t as ConstructDiscoveryFailed } from "./discover-BvJOVsYG.mjs";
 import { i as activeSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { provideKey } from "@geekmidas/manifest";
 import { decodeCredentials } from "@geekmidas/constructs/credential";
@@ -234,4 +234,4 @@ async function assertStageCredentials(options) {
 //#endregion
 export { liveCredentials as a, issueLine as i, assertStageCredentials as n, loadCredentialSchemas as o, inspectLive as r, CredentialsInvalid as t };
 
-//# sourceMappingURL=credentialSchemas-DDOLRCLF.mjs.map
+//# sourceMappingURL=credentialSchemas-DLKbxYBy.mjs.map

package/dist/{credentialSchemas-DDOLRCLF.mjs.map → credentialSchemas-DLKbxYBy.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"credentialSchemas-DDOLRCLF.mjs","names":["z.toJSONSchema","z.object","z.string","z.discriminatedUnion","z.literal","z.array","z.enum","z.record","z.unknown","z.boolean"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,KAAK,WAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAOA,aAAe,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,SAAS,kBAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAQC,OAAS;CAAE,MAAMC,OAAS;CAAG,SAASA,OAAS;AAAE,CAAC;;AAGhE,MAAM,oBAAoBC,mBAAqB,UAAU,CACxDF,OAAS;CACR,QAAQG,QAAU,WAAW;CAC7B,SAASC,MACRJ,OAAS;EACR,KAAKC,OAAS;EACd,IAAIA,OAAS;EACb,MAAMI,MAAO,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAYC,OAASL,OAAS,GAAGM,QAAU,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAQD,OACPL,OAAS,GACTD,OAAS;EAAE,IAAIQ,QAAU;EAAG,QAAQJ,MAAQ,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GACDJ,OAAS;CACR,QAAQG,QAAU,QAAQ;CAC1B,OAAOH,OAAS;EAAE,MAAMC,OAAS;EAAG,SAASA,OAAS;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAU,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAI,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALN,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAO,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwC,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}
+{"version":3,"file":"credentialSchemas-DLKbxYBy.mjs","names":["z.toJSONSchema","z.object","z.string","z.discriminatedUnion","z.literal","z.array","z.enum","z.record","z.unknown","z.boolean"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,KAAK,WAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAOA,aAAe,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,SAAS,kBAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAQC,OAAS;CAAE,MAAMC,OAAS;CAAG,SAASA,OAAS;AAAE,CAAC;;AAGhE,MAAM,oBAAoBC,mBAAqB,UAAU,CACxDF,OAAS;CACR,QAAQG,QAAU,WAAW;CAC7B,SAASC,MACRJ,OAAS;EACR,KAAKC,OAAS;EACd,IAAIA,OAAS;EACb,MAAMI,MAAO,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAYC,OAASL,OAAS,GAAGM,QAAU,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAQD,OACPL,OAAS,GACTD,OAAS;EAAE,IAAIQ,QAAU;EAAG,QAAQJ,MAAQ,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GACDJ,OAAS;CACR,QAAQG,QAAU,QAAQ;CAC1B,OAAOH,OAAS;EAAE,MAAMC,OAAS;EAAG,SAASA,OAAS;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAU,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAI,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALN,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAO,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwC,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}

package/dist/{credentials-Zqr3QQYB.cjs → credentials-D7XJypNd.cjs}

@@ -1,15 +1,33 @@
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_run = require("./run-fVZ-rLnc.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
+let node_os = require("node:os");
+let node_child_process = require("node:child_process");
+//#region src/home.ts
+/**
+* Where the CLI keeps what belongs to a person rather than a project: stage
+* keys and stored provider credentials.
+*
+* `GKM_HOME` names it, so a CI job, a shared build runner or a test can give
+* every run its own instead of reaching into whoever's home directory the
+* process happens to have. Unset, it is `~/.gkm`, where it has always been.
+*/
+/** The environment variable that moves the CLI's home. */
+const GKM_HOME_ENV = "GKM_HOME";
+/** The CLI's home: `GKM_HOME` if set, else `~/.gkm`. */
+function gkmHome(env = process.env) {
+	const configured = env[GKM_HOME_ENV];
+	return configured ? (0, node_path.resolve)(configured) : (0, node_path.join)((0, node_os.homedir)(), ".gkm");
+}
+//#endregion
 //#region src/auth/credentials.ts
 /**
 * Get the path to the credentials directory
 */
 function getCredentialsDir(options) {
 	if (options?.home) return options.home;
-	return options?.root ? (0, node_path.join)(options.root, ".gkm") : require_run.gkmHome();
+	return options?.root ? (0, node_path.join)(options.root, ".gkm") : gkmHome();
 }
 /**
 * Get the path to the credentials file
@@ -146,6 +164,116 @@ async function removeGoDaddyCredentials(options) {
 	return true;
 }
 //#endregion
+//#region src/run.ts
+/**
+* Start a program with an argument array, never a shell string.
+*
+* `gkm build`, `gkm docker` and `gkm deploy` pass values that come from the
+* workspace — image refs, tags, build args, package names — to `docker` and
+* `turbo`. Joined into a string and handed to a shell, a package named
+* `x;curl …|sh` or a tag holding `$(…)` became part of the command line, which
+* matters most where the CLI builds a repository it didn't write: a CI job for a
+* fork, a shared build runner. Here every value reaches the program as one
+* `argv` element, whatever it contains.
+*/
+/** Long enough for a cold image build; short enough that a hung one ends. */
+const DEFAULT_TIMEOUT_MS = 18e5;
+/** How long a timed-out child has to exit on SIGTERM before it is killed. */
+const KILL_GRACE_MS = 5e3;
+/** The command line as a person would read it — for messages, never to run. */
+function display(command, args) {
+	return [command, ...args].join(" ");
+}
+/** The program ran and exited unsuccessfully; its own output said why. */
+var CommandFailed = class extends Error {
+	command;
+	args;
+	exitCode;
+	signal;
+	constructor(command, args, exitCode, signal) {
+		super(`\`${display(command, args)}\` ${exitCode === null ? `was stopped by ${signal ?? "a signal"}` : `exited with code ${exitCode}`}. Its output above says why; run it by hand to see it again.`);
+		this.command = command;
+		this.args = args;
+		this.exitCode = exitCode;
+		this.signal = signal;
+		this.name = "CommandFailed";
+	}
+};
+/** The program ran past its timeout and was killed. */
+var CommandTimedOut = class extends Error {
+	command;
+	args;
+	timeoutMs;
+	constructor(command, args, timeoutMs) {
+		super(`\`${display(command, args)}\` was still running after ${Math.round(timeoutMs / 1e3)}s and was stopped. Check what it was waiting on — a registry, the Docker daemon, a prompt — and run it again.`);
+		this.command = command;
+		this.args = args;
+		this.timeoutMs = timeoutMs;
+		this.name = "CommandTimedOut";
+	}
+};
+/**
+* Run `command` with `args`, resolving when it exits 0.
+*
+* Rejects with {@link CommandFailed} on any other exit, {@link CommandTimedOut}
+* once `timeoutMs` passes (after the child is gone), and with the spawn error
+* itself when the program cannot be started at all — `ENOENT` already names it.
+*/
+async function run(command, args, options = {}) {
+	await spawnChild(command, args, options, false);
+}
+/**
+* {@link run}, resolving with what the program wrote to stdout — for a value
+* the CLI reads back, such as the digest `docker inspect` reports. stderr still
+* reaches the terminal, so a failure explains itself the same way.
+*/
+function runOutput(command, args, options = {}) {
+	return spawnChild(command, args, options, true);
+}
+function spawnChild(command, args, options, capture) {
+	const { timeoutMs = DEFAULT_TIMEOUT_MS, ...spawnOptions } = options;
+	return new Promise((resolve, reject) => {
+		const child = (0, node_child_process.spawn)(command, [...args], {
+			stdio: "inherit",
+			...spawnOptions,
+			...capture ? { stdio: [
+				"ignore",
+				"pipe",
+				"inherit"
+			] } : {},
+			shell: false
+		});
+		let stdout = "";
+		child.stdout?.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		let timedOut = false;
+		let killer;
+		const timer = setTimeout(() => {
+			timedOut = true;
+			child.kill("SIGTERM");
+			killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS);
+			killer.unref?.();
+		}, timeoutMs);
+		timer.unref?.();
+		const settle = () => {
+			clearTimeout(timer);
+			if (killer) clearTimeout(killer);
+		};
+		child.on("error", (error) => {
+			settle();
+			reject(spawnOptions.signal?.aborted ? spawnOptions.signal.reason : error);
+		});
+		child.on("close", (code, signal) => {
+			settle();
+			if (spawnOptions.signal?.aborted) reject(spawnOptions.signal.reason);
+			else if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));
+			else if (code === 0) resolve(stdout);
+			else reject(new CommandFailed(command, args, code, signal));
+		});
+	});
+}
+//#endregion
 //#region src/deploy/credentials.ts
 /**
 * How a deploy gets the credentials it acts with.
@@ -262,6 +390,30 @@ function storedCredentials(options = {}) {
 	} };
 }
 //#endregion
+Object.defineProperty(exports, "CommandFailed", {
+	enumerable: true,
+	get: function() {
+		return CommandFailed;
+	}
+});
+Object.defineProperty(exports, "CommandTimedOut", {
+	enumerable: true,
+	get: function() {
+		return CommandTimedOut;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_TIMEOUT_MS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_TIMEOUT_MS;
+	}
+});
+Object.defineProperty(exports, "GKM_HOME_ENV", {
+	enumerable: true,
+	get: function() {
+		return GKM_HOME_ENV;
+	}
+});
 Object.defineProperty(exports, "MissingCredential", {
 	enumerable: true,
 	get: function() {
@@ -304,6 +456,12 @@ Object.defineProperty(exports, "getHostingerToken", {
 		return getHostingerToken;
 	}
 });
+Object.defineProperty(exports, "gkmHome", {
+	enumerable: true,
+	get: function() {
+		return gkmHome;
+	}
+});
 Object.defineProperty(exports, "readCredentials", {
 	enumerable: true,
 	get: function() {
@@ -322,6 +480,18 @@ Object.defineProperty(exports, "removeGoDaddyCredentials", {
 		return removeGoDaddyCredentials;
 	}
 });
+Object.defineProperty(exports, "run", {
+	enumerable: true,
+	get: function() {
+		return run;
+	}
+});
+Object.defineProperty(exports, "runOutput", {
+	enumerable: true,
+	get: function() {
+		return runOutput;
+	}
+});
 Object.defineProperty(exports, "storeDokployCredentials", {
 	enumerable: true,
 	get: function() {
@@ -347,4 +517,4 @@ Object.defineProperty(exports, "storedCredentials", {
 	}
 });
 
-//# sourceMappingURL=credentials-Zqr3QQYB.cjs.map
+//# sourceMappingURL=credentials-D7XJypNd.cjs.map

package/dist/credentials-D7XJypNd.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-D7XJypNd.cjs","names":["resolve","join","homedir","join","existsSync","readFile","writeFile","spawn","GkmError"],"sources":["../src/home.ts","../src/auth/credentials.ts","../src/run.ts","../src/deploy/credentials.ts"],"sourcesContent":["/**\n * Where the CLI keeps what belongs to a person rather than a project: stage\n * keys and stored provider credentials.\n *\n * `GKM_HOME` names it, so a CI job, a shared build runner or a test can give\n * every run its own instead of reaching into whoever's home directory the\n * process happens to have. Unset, it is `~/.gkm`, where it has always been.\n */\n\nimport { homedir } from 'node:os';\nimport { join, resolve } from 'node:path';\n\n/** The environment variable that moves the CLI's home. */\nexport const GKM_HOME_ENV = 'GKM_HOME';\n\n/** The CLI's home: `GKM_HOME` if set, else `~/.gkm`. */\nexport function gkmHome(env: NodeJS.ProcessEnv = process.env): string {\n\tconst configured = env[GKM_HOME_ENV];\n\treturn configured ? resolve(configured) : join(homedir(), '.gkm');\n}\n","import { existsSync, mkdirSync } from 'node:fs';\nimport { readFile, unlink, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { gkmHome } from '../home';\n\n/**\n * Stored credentials for various services\n */\nexport interface StoredCredentials {\n\tdokploy?: {\n\t\t/** API token */\n\t\ttoken: string;\n\t\t/** Dokploy endpoint URL */\n\t\tendpoint: string;\n\t\t/** Registry ID in Dokploy (for Docker image pulls) */\n\t\tregistryId?: string;\n\t\t/** When the credentials were stored */\n\t\tstoredAt: string;\n\t};\n\thostinger?: {\n\t\t/** API token from hpanel.hostinger.com/profile/api */\n\t\ttoken: string;\n\t\t/** When the credentials were stored */\n\t\tstoredAt: string;\n\t};\n\tgodaddy?: {\n\t\t/** A Personal Access Token, scoped to domains.dns:update */\n\t\ttoken: string;\n\t\t/** When the credentials were stored */\n\t\tstoredAt: string;\n\t};\n}\n\n/**\n * Options for credential operations\n */\nexport interface CredentialOptions {\n\t/**\n\t * A directory whose `.gkm` holds the credentials. Default: the CLI's home\n\t * (`GKM_HOME`, else `~/.gkm`).\n\t */\n\troot?: string;\n\t/** The CLI's home itself, holding `credentials.json`. Wins over `root`. */\n\thome?: string;\n}\n\n/**\n * Get the path to the credentials directory\n */\nexport function getCredentialsDir(options?: CredentialOptions): string {\n\tif (options?.home) return options.home;\n\treturn options?.root ? join(options.root, '.gkm') : gkmHome();\n}\n\n/**\n * Get the path to the credentials file\n */\nexport function getCredentialsPath(options?: CredentialOptions): string {\n\treturn join(getCredentialsDir(options), 'credentials.json');\n}\n\n/**\n * Ensure the credentials directory exists\n */\nfunction ensureCredentialsDir(options?: CredentialOptions): void {\n\tconst dir = getCredentialsDir(options);\n\tif (!existsSync(dir)) {\n\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t}\n}\n\n/**\n * Read stored credentials from disk\n */\nexport async function readCredentials(\n\toptions?: CredentialOptions,\n): Promise<StoredCredentials> {\n\tconst path = getCredentialsPath(options);\n\n\tif (!existsSync(path)) {\n\t\treturn {};\n\t}\n\n\ttry {\n\t\tconst content = await readFile(path, 'utf-8');\n\t\treturn JSON.parse(content) as StoredCredentials;\n\t} catch {\n\t\treturn {};\n\t}\n}\n\n/**\n * Write credentials to disk\n */\nexport async function writeCredentials(\n\tcredentials: StoredCredentials,\n\toptions?: CredentialOptions,\n): Promise<void> {\n\tensureCredentialsDir(options);\n\tconst path = getCredentialsPath(options);\n\n\tawait writeFile(path, JSON.stringify(credentials, null, 2), {\n\t\tmode: 0o600, // Owner read/write only\n\t});\n}\n\n/**\n * Store Dokploy credentials\n */\nexport async function storeDokployCredentials(\n\ttoken: string,\n\tendpoint: string,\n\toptions?: CredentialOptions,\n): Promise<void> {\n\tconst credentials = await readCredentials(options);\n\n\tcredentials.dokploy = {\n\t\ttoken,\n\t\tendpoint,\n\t\tstoredAt: new Date().toISOString(),\n\t};\n\n\tawait writeCredentials(credentials, options);\n}\n\n/**\n * Get stored Dokploy credentials\n */\nexport async function getDokployCredentials(\n\toptions?: CredentialOptions,\n): Promise<{\n\ttoken: string;\n\tendpoint: string;\n\tregistryId?: string;\n} | null> {\n\tconst credentials = await readCredentials(options);\n\n\t// The environment first, and each half independently.\n\t//\n\t// `getDokployToken` has always read `DOKPLOY_API_TOKEN` while this — the\n\t// function the deploy path actually calls — read only the file. So a CI job\n\t// given the token as a secret had a token and nowhere to send it, and the\n\t// only way through was committing a credentials file or running an\n\t// interactive login on the runner.\n\t//\n\t// Read separately rather than as a pair because they arrive separately: a\n\t// token is a secret and belongs in the environment, while an endpoint is\n\t// configuration and usually belongs in `deploy.dokploy.endpoint`. Requiring\n\t// both from the same place is what made either one useless alone.\n\tconst token = process.env.DOKPLOY_API_TOKEN ?? credentials.dokploy?.token;\n\tconst endpoint =\n\t\tprocess.env.DOKPLOY_ENDPOINT ?? credentials.dokploy?.endpoint;\n\n\tif (!token || !endpoint) return null;\n\n\treturn {\n\t\ttoken,\n\t\tendpoint: endpoint.replace(/\\/$/, ''),\n\t\t...(credentials.dokploy?.registryId\n\t\t\t? { registryId: credentials.dokploy.registryId }\n\t\t\t: {}),\n\t};\n}\n\n/**\n * Remove Dokploy credentials\n */\nexport async function removeDokployCredentials(\n\toptions?: CredentialOptions,\n): Promise<boolean> {\n\tconst credentials = await readCredentials(options);\n\n\tif (!credentials.dokploy) {\n\t\treturn false;\n\t}\n\n\tdelete credentials.dokploy;\n\tawait writeCredentials(credentials, options);\n\treturn true;\n}\n\n/**\n * Remove all stored credentials\n */\nexport async function removeAllCredentials(\n\toptions?: CredentialOptions,\n): Promise<void> {\n\tconst path = getCredentialsPath(options);\n\n\tif (existsSync(path)) {\n\t\tawait unlink(path);\n\t}\n}\n\n/**\n * Get Dokploy API token, checking stored credentials first, then environment\n */\nexport async function getDokployToken(\n\toptions?: CredentialOptions,\n): Promise<string | null> {\n\t// First check environment variable (takes precedence)\n\tconst envToken = process.env.DOKPLOY_API_TOKEN;\n\tif (envToken) {\n\t\treturn envToken;\n\t}\n\n\t// Then check stored credentials\n\tconst stored = await getDokployCredentials(options);\n\tif (stored) {\n\t\treturn stored.token;\n\t}\n\n\treturn null;\n}\n\n/**\n * Get Dokploy endpoint from stored credentials\n */\nexport async function getDokployEndpoint(\n\toptions?: CredentialOptions,\n): Promise<string | null> {\n\tconst stored = await getDokployCredentials(options);\n\treturn stored?.endpoint ?? null;\n}\n\n/**\n * Store Dokploy registry ID\n */\nexport async function storeDokployRegistryId(\n\tregistryId: string,\n\toptions?: CredentialOptions,\n): Promise<void> {\n\tconst credentials = await readCredentials(options);\n\n\tif (!credentials.dokploy) {\n\t\tthrow new Error(\n\t\t\t'Dokploy credentials not found. Run \"gkm login --service dokploy\" first.',\n\t\t);\n\t}\n\n\tcredentials.dokploy.registryId = registryId;\n\tawait writeCredentials(credentials, options);\n}\n\n/**\n * Get Dokploy registry ID from stored credentials\n */\nexport async function getDokployRegistryId(\n\toptions?: CredentialOptions,\n): Promise<string | undefined> {\n\tconst stored = await getDokployCredentials(options);\n\treturn stored?.registryId ?? undefined;\n}\n\n// ============================================\n// Hostinger credentials\n// ============================================\n\n/**\n * Store Hostinger API token\n *\n * @param token - API token from hpanel.hostinger.com/profile/api\n */\nexport async function storeHostingerToken(\n\ttoken: string,\n\toptions?: CredentialOptions,\n): Promise<void> {\n\tconst credentials = await readCredentials(options);\n\n\tcredentials.hostinger = {\n\t\ttoken,\n\t\tstoredAt: new Date().toISOString(),\n\t};\n\n\tawait writeCredentials(credentials, options);\n}\n\n/**\n * Get stored Hostinger API token\n *\n * Checks environment variable first (HOSTINGER_API_TOKEN),\n * then falls back to stored credentials.\n */\nexport async function getHostingerToken(\n\toptions?: CredentialOptions,\n): Promise<string | null> {\n\t// First check environment variable (takes precedence)\n\tconst envToken = process.env.HOSTINGER_API_TOKEN;\n\tif (envToken) {\n\t\treturn envToken;\n\t}\n\n\t// Then check stored credentials\n\tconst credentials = await readCredentials(options);\n\treturn credentials.hostinger?.token ?? null;\n}\n\n/**\n * Remove Hostinger credentials\n */\nexport async function removeHostingerCredentials(\n\toptions?: CredentialOptions,\n): Promise<boolean> {\n\tconst credentials = await readCredentials(options);\n\n\tif (!credentials.hostinger) {\n\t\treturn false;\n\t}\n\n\tdelete credentials.hostinger;\n\tawait writeCredentials(credentials, options);\n\treturn true;\n}\n\n// ============================================\n// GoDaddy credentials\n// ============================================\n\n/**\n * Store a GoDaddy Personal Access Token.\n */\nexport async function storeGoDaddyToken(\n\ttoken: string,\n\toptions?: CredentialOptions,\n): Promise<void> {\n\tconst credentials = await readCredentials(options);\n\n\tcredentials.godaddy = {\n\t\ttoken,\n\t\tstoredAt: new Date().toISOString(),\n\t};\n\n\tawait writeCredentials(credentials, options);\n}\n\n/**\n * Remove GoDaddy credentials\n */\nexport async function removeGoDaddyCredentials(\n\toptions?: CredentialOptions,\n): Promise<boolean> {\n\tconst credentials = await readCredentials(options);\n\n\tif (!credentials.godaddy) {\n\t\treturn false;\n\t}\n\n\tdelete credentials.godaddy;\n\tawait writeCredentials(credentials, options);\n\treturn true;\n}\n","/**\n * Start a program with an argument array, never a shell string.\n *\n * `gkm build`, `gkm docker` and `gkm deploy` pass values that come from the\n * workspace — image refs, tags, build args, package names — to `docker` and\n * `turbo`. Joined into a string and handed to a shell, a package named\n * `x;curl …|sh` or a tag holding `$(…)` became part of the command line, which\n * matters most where the CLI builds a repository it didn't write: a CI job for a\n * fork, a shared build runner. Here every value reaches the program as one\n * `argv` element, whatever it contains.\n */\n\nimport { type SpawnOptions, spawn } from 'node:child_process';\n\n/** Long enough for a cold image build; short enough that a hung one ends. */\nexport const DEFAULT_TIMEOUT_MS = 30 * 60_000;\n\n/** How long a timed-out child has to exit on SIGTERM before it is killed. */\nconst KILL_GRACE_MS = 5_000;\n\nexport interface RunOptions {\n\tcwd?: string;\n\tenv?: NodeJS.ProcessEnv;\n\tstdio?: SpawnOptions['stdio'];\n\t/** Kill the child after this long. Defaults to {@link DEFAULT_TIMEOUT_MS}. */\n\ttimeoutMs?: number;\n\t/**\n\t * Kills the child when aborted, and rejects with the signal's reason — the\n\t * same as a stopped deploy's other calls.\n\t */\n\tsignal?: AbortSignal;\n}\n\n/** The command line as a person would read it — for messages, never to run. */\nfunction display(command: string, args: readonly string[]): string {\n\treturn [command, ...args].join(' ');\n}\n\n/** The program ran and exited unsuccessfully; its own output said why. */\nexport class CommandFailed extends Error {\n\tconstructor(\n\t\treadonly command: string,\n\t\treadonly args: readonly string[],\n\t\treadonly exitCode: number | null,\n\t\treadonly signal: NodeJS.Signals | null,\n\t) {\n\t\tsuper(\n\t\t\t`\\`${display(command, args)}\\` ${exitCode === null ? `was stopped by ${signal ?? 'a signal'}` : `exited with code ${exitCode}`}. Its output above says why; run it by hand to see it again.`,\n\t\t);\n\t\tthis.name = 'CommandFailed';\n\t}\n}\n\n/** The program ran past its timeout and was killed. */\nexport class CommandTimedOut extends Error {\n\tconstructor(\n\t\treadonly command: string,\n\t\treadonly args: readonly string[],\n\t\treadonly timeoutMs: number,\n\t) {\n\t\tsuper(\n\t\t\t`\\`${display(command, args)}\\` was still running after ${Math.round(timeoutMs / 1000)}s and was stopped. Check what it was waiting on — a registry, the Docker daemon, a prompt — and run it again.`,\n\t\t);\n\t\tthis.name = 'CommandTimedOut';\n\t}\n}\n\n/**\n * Run `command` with `args`, resolving when it exits 0.\n *\n * Rejects with {@link CommandFailed} on any other exit, {@link CommandTimedOut}\n * once `timeoutMs` passes (after the child is gone), and with the spawn error\n * itself when the program cannot be started at all — `ENOENT` already names it.\n */\nexport async function run(\n\tcommand: string,\n\targs: readonly string[],\n\toptions: RunOptions = {},\n): Promise<void> {\n\tawait spawnChild(command, args, options, false);\n}\n\n/**\n * {@link run}, resolving with what the program wrote to stdout — for a value\n * the CLI reads back, such as the digest `docker inspect` reports. stderr still\n * reaches the terminal, so a failure explains itself the same way.\n */\nexport function runOutput(\n\tcommand: string,\n\targs: readonly string[],\n\toptions: Omit<RunOptions, 'stdio'> = {},\n): Promise<string> {\n\treturn spawnChild(command, args, options, true);\n}\n\nfunction spawnChild(\n\tcommand: string,\n\targs: readonly string[],\n\toptions: RunOptions,\n\tcapture: boolean,\n): Promise<string> {\n\tconst { timeoutMs = DEFAULT_TIMEOUT_MS, ...spawnOptions } = options;\n\n\treturn new Promise<string>((resolve, reject) => {\n\t\tconst child = spawn(command, [...args], {\n\t\t\tstdio: 'inherit',\n\t\t\t...spawnOptions,\n\t\t\t...(capture ? { stdio: ['ignore', 'pipe', 'inherit'] } : {}),\n\t\t\tshell: false,\n\t\t});\n\n\t\tlet stdout = '';\n\t\tchild.stdout?.on('data', (chunk: Buffer) => {\n\t\t\tstdout += chunk.toString();\n\t\t});\n\n\t\tlet timedOut = false;\n\t\tlet killer: NodeJS.Timeout | undefined;\n\t\tconst timer = setTimeout(() => {\n\t\t\ttimedOut = true;\n\t\t\tchild.kill('SIGTERM');\n\t\t\t// A child that ignores SIGTERM would hold the deploy open forever.\n\t\t\tkiller = setTimeout(() => child.kill('SIGKILL'), KILL_GRACE_MS);\n\t\t\tkiller.unref?.();\n\t\t}, timeoutMs);\n\t\ttimer.unref?.();\n\n\t\tconst settle = () => {\n\t\t\tclearTimeout(timer);\n\t\t\tif (killer) clearTimeout(killer);\n\t\t};\n\n\t\tchild.on('error', (error) => {\n\t\t\tsettle();\n\t\t\t// Node reports an abort as its own `AbortError`; the caller asked\n\t\t\t// with a reason, and that is what it should get back.\n\t\t\treject(spawnOptions.signal?.aborted ? spawnOptions.signal.reason : error);\n\t\t});\n\n\t\tchild.on('close', (code: number | null, signal: NodeJS.Signals | null) => {\n\t\t\tsettle();\n\t\t\tif (spawnOptions.signal?.aborted) reject(spawnOptions.signal.reason);\n\t\t\telse if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));\n\t\t\telse if (code === 0) resolve(stdout);\n\t\t\telse reject(new CommandFailed(command, args, code, signal));\n\t\t});\n\t});\n}\n","/**\n * How a deploy gets the credentials it acts with.\n *\n * `deploy()` never prompts and never reads a terminal: it asks a\n * `CredentialProvider` and, when the provider has nothing, stops with\n * `MissingCredential` naming what it needed and how to supply it. Whether to\n * ask a person, read a vault or fail is the caller's decision — `gkm deploy`\n * prompts at a terminal and stores what was typed; a CI job sets the\n * environment; a host passes its own provider.\n */\n\nimport { readCredentials } from '../auth/credentials';\nimport { GkmError } from '../errors';\n\n/**\n * What each kind of credential is asked for with, and what it is.\n *\n * A target that needs a kind the CLI does not know declares it by augmenting\n * this interface, and lists it in its `credentials`:\n *\n * ```ts\n * declare module '@geekmidas/cli/target' {\n *   interface CredentialKinds {\n *     fly: { request: { org: string }; value: { token: string } };\n *   }\n * }\n * ```\n */\nexport interface CredentialKinds {\n\t/** The Dokploy API a stage deploys through. */\n\tdokploy: {\n\t\t/** `deploy.dokploy.endpoint`, when the config names one. */\n\t\trequest: { endpoint?: string };\n\t\tvalue: { endpoint: string; token: string };\n\t};\n\t/**\n\t * A container registry login, for Dokploy to pull with. Asked for only when\n\t * Dokploy has no registry for `deploy.registry` and one has to be\n\t * created.\n\t */\n\tregistry: {\n\t\t/** `deploy.registry`. */\n\t\trequest: { url: string };\n\t\tvalue: { username: string; password: string };\n\t};\n\t/**\n\t * The AWS account a stage deploys to, for the SST target's `sst deploy`.\n\t * Handed to that one command's environment and to nothing else.\n\t */\n\taws: {\n\t\t/** The stage, for a provider that keeps one account per stage. */\n\t\trequest: { stage: string };\n\t\tvalue: AwsCredential;\n\t};\n\t/**\n\t * A GoDaddy Personal Access Token, for a `dns` domain whose provider is\n\t * `godaddy`. Read on the machine that writes the records — never the\n\t * server's.\n\t */\n\tgodaddy: {\n\t\trequest: Record<never, never>;\n\t\tvalue: GoDaddyCredential;\n\t};\n\t/**\n\t * A Hostinger API token, for a `dns` domain whose provider is\n\t * `hostinger`. Like GoDaddy's, read where the records are written.\n\t */\n\thostinger: {\n\t\trequest: Record<never, never>;\n\t\tvalue: HostingerCredential;\n\t};\n}\n\n/** A Hostinger API token, from hpanel.hostinger.com/profile/api. */\nexport interface HostingerCredential {\n\ttoken: string;\n}\n\n/** A GoDaddy Personal Access Token, sent as `Authorization: Bearer <token>`. */\nexport interface GoDaddyCredential {\n\ttoken: string;\n}\n\n/**\n * Who to act as on AWS: a named profile, or keys.\n *\n * Never both. Given both, every AWS SDK takes the keys and ignores the\n * profile, so `--profile prod` with staging's keys still exported would deploy\n * production's stack into staging's account — the reason `secretsStoreFor`\n * resolves a named profile on its own, and why this cannot express the mix.\n */\nexport type AwsCredential =\n\t| {\n\t\t\t/** A profile in `~/.aws/config` — keys, SSO, an assumed role. */\n\t\t\tprofile: string;\n\t\t\tregion?: string;\n\t  }\n\t| {\n\t\t\taccessKeyId: string;\n\t\t\tsecretAccessKey: string;\n\t\t\t/** Present for temporary keys: an assumed role, GitHub's OIDC. */\n\t\t\tsessionToken?: string;\n\t\t\tregion?: string;\n\t  };\n\nexport type CredentialKind = keyof CredentialKinds;\n\n/** What a deploy asks a provider for. */\nexport type CredentialRequest<K extends CredentialKind = CredentialKind> = {\n\t[P in K]: { kind: P } & CredentialKinds[P]['request'];\n}[K];\n\n/** What a provider answers with. */\nexport type Credential<K extends CredentialKind> = CredentialKinds[K]['value'];\n\nexport interface CredentialProvider {\n\t/**\n\t * The credential `request` asks for, or `undefined` when this provider has\n\t * none — the deploy then raises {@link MissingCredential}.\n\t */\n\tget<K extends CredentialKind>(\n\t\trequest: CredentialRequest<K>,\n\t\toptions?: { signal?: AbortSignal },\n\t): Promise<Credential<K> | undefined>;\n}\n\n/**\n * How to supply each kind the CLI knows, for the error that says it is\n * missing. A target's own kinds are its to explain.\n */\nconst HOW_TO_PROVIDE: Partial<Record<CredentialKind, string>> = {\n\tdokploy:\n\t\t\"Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.\",\n\tregistry:\n\t\t'Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them.',\n\tgodaddy:\n\t\t'Set GODADDY_API_TOKEN to a Personal Access Token scoped to domains.dns:update (create one in the GoDaddy developer dashboard), or run `gkm login --provider godaddy`.',\n\thostinger:\n\t\t'Set HOSTINGER_API_TOKEN to a token from hpanel.hostinger.com/profile/api, or run `gkm login --provider hostinger`.',\n\taws: \"Set AWS_PROFILE to the stage account's profile, or AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN) — in CI, the keys aws-actions/configure-aws-credentials exports — or pass them through the deploy's CredentialProvider.\",\n};\n\n/** A deploy needed a credential, and its provider had none. */\nexport class MissingCredential extends GkmError {\n\tconstructor(\n\t\treadonly kind: CredentialKind,\n\t\t/** What it was for: the Dokploy endpoint or the registry URL. */\n\t\treadonly target: string | undefined,\n\t\t/** How to supply it. */\n\t\treadonly howToProvide: string = HOW_TO_PROVIDE[kind] ??\n\t\t\t\"Pass it through the deploy's CredentialProvider.\",\n\t) {\n\t\tconst what =\n\t\t\tkind === 'dokploy'\n\t\t\t\t? `No Dokploy credentials${target ? ` for ${target}` : ''}.`\n\t\t\t\t: kind === 'registry'\n\t\t\t\t\t? `Dokploy has no registry for ${target ?? 'the configured registry'}, and there are no credentials to create one with.`\n\t\t\t\t\t: kind === 'aws'\n\t\t\t\t\t\t? `No AWS credentials${target ? ` for the \"${target}\" stage` : ''}.`\n\t\t\t\t\t\t: kind === 'godaddy'\n\t\t\t\t\t\t\t? `No GoDaddy API token${target ? ` for ${target}` : ''}.`\n\t\t\t\t\t\t\t: kind === 'hostinger'\n\t\t\t\t\t\t\t\t? `No Hostinger API token${target ? ` for ${target}` : ''}.`\n\t\t\t\t\t\t\t\t: `No \"${String(kind)}\" credentials${target ? ` for ${target}` : ''}.`;\n\t\tsuper(`${what} ${howToProvide}`);\n\t\tthis.name = 'MissingCredential';\n\t}\n}\n\n/** Whatever was asked for, from the first provider that has it. */\nexport function chainCredentials(\n\t...providers: CredentialProvider[]\n): CredentialProvider {\n\treturn {\n\t\tasync get(request, options) {\n\t\t\tfor (const provider of providers) {\n\t\t\t\tconst found = await provider.get(request, options);\n\t\t\t\tif (found) return found;\n\t\t\t}\n\t\t\treturn undefined;\n\t\t},\n\t};\n}\n\nexport interface StoredCredentialsOptions {\n\t/** Where to read the variables from. Defaults to `process.env`. */\n\tenv?: NodeJS.ProcessEnv;\n\t/**\n\t * The CLI's home, whose `credentials.json` holds stored logins. Defaults\n\t * to `GKM_HOME`, else `~/.gkm`.\n\t */\n\thome?: string;\n}\n\n/**\n * Credentials from the environment, then from what `gkm login` stored. What\n * `deploy()` uses when it is handed no provider.\n *\n * - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to\n *   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.\n *   Each half is read on its own: a token is a secret and belongs in the\n *   environment, an endpoint is configuration and belongs in the config.\n * - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.\n * - AWS: `AWS_PROFILE` when it is set, and then nothing else; otherwise\n *   `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`. The\n *   profile winning is `secretsStoreFor`'s rule: a profile is a choice of\n *   account someone made, exported keys may be left over from another.\n *   Read here, by name, and handed only to the command that deploys — the\n *   sandbox every other step runs in passes no `AWS_*` on.\n */\nexport function storedCredentials(\n\toptions: StoredCredentialsOptions = {},\n): CredentialProvider {\n\tconst env = options.env ?? process.env;\n\n\treturn {\n\t\tasync get(asked) {\n\t\t\t// The union, so a switch on `kind` narrows it: `K` itself never is.\n\t\t\tconst request = asked as CredentialRequest;\n\t\t\tswitch (request.kind) {\n\t\t\t\tcase 'dokploy': {\n\t\t\t\t\tconst stored = (\n\t\t\t\t\t\tawait readCredentials(\n\t\t\t\t\t\t\toptions.home ? { home: options.home } : undefined,\n\t\t\t\t\t\t)\n\t\t\t\t\t).dokploy;\n\t\t\t\t\tconst token = env.DOKPLOY_API_TOKEN ?? stored?.token;\n\t\t\t\t\tconst endpoint =\n\t\t\t\t\t\tenv.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;\n\t\t\t\t\tif (!token || !endpoint) return undefined;\n\t\t\t\t\treturn { endpoint: endpoint.replace(/\\/$/, ''), token } as never;\n\t\t\t\t}\n\t\t\t\tcase 'registry': {\n\t\t\t\t\tconst username = env.DOCKER_REGISTRY_USERNAME;\n\t\t\t\t\tconst password = env.DOCKER_REGISTRY_PASSWORD;\n\t\t\t\t\tif (!username || !password) return undefined;\n\t\t\t\t\treturn { username, password } as never;\n\t\t\t\t}\n\t\t\t\tcase 'godaddy': {\n\t\t\t\t\t// The environment first, then the stored login.\n\t\t\t\t\tconst token =\n\t\t\t\t\t\tenv.GODADDY_API_TOKEN ||\n\t\t\t\t\t\t(\n\t\t\t\t\t\t\tawait readCredentials(\n\t\t\t\t\t\t\t\toptions.home ? { home: options.home } : undefined,\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t).godaddy?.token;\n\t\t\t\t\tif (!token) return undefined;\n\t\t\t\t\treturn { token } as never;\n\t\t\t\t}\n\t\t\t\tcase 'hostinger': {\n\t\t\t\t\tconst token =\n\t\t\t\t\t\tenv.HOSTINGER_API_TOKEN ||\n\t\t\t\t\t\t(\n\t\t\t\t\t\t\tawait readCredentials(\n\t\t\t\t\t\t\t\toptions.home ? { home: options.home } : undefined,\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t).hostinger?.token;\n\t\t\t\t\tif (!token) return undefined;\n\t\t\t\t\treturn { token } as never;\n\t\t\t\t}\n\t\t\t\tcase 'aws': {\n\t\t\t\t\tconst region = env.AWS_REGION ?? env.AWS_DEFAULT_REGION;\n\t\t\t\t\tconst where = region ? { region } : {};\n\t\t\t\t\tif (env.AWS_PROFILE) {\n\t\t\t\t\t\treturn { profile: env.AWS_PROFILE, ...where } as never;\n\t\t\t\t\t}\n\t\t\t\t\tconst accessKeyId = env.AWS_ACCESS_KEY_ID;\n\t\t\t\t\tconst secretAccessKey = env.AWS_SECRET_ACCESS_KEY;\n\t\t\t\t\tif (!accessKeyId || !secretAccessKey) return undefined;\n\t\t\t\t\treturn {\n\t\t\t\t\t\taccessKeyId,\n\t\t\t\t\t\tsecretAccessKey,\n\t\t\t\t\t\t...(env.AWS_SESSION_TOKEN\n\t\t\t\t\t\t\t? { sessionToken: env.AWS_SESSION_TOKEN }\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t...where,\n\t\t\t\t\t} as never;\n\t\t\t\t}\n\t\t\t}\n\t\t\t// A kind a target declared: nothing stored here can answer it.\n\t\t\treturn undefined;\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAaA,MAAa,eAAe;;AAG5B,SAAgB,QAAQ,MAAyB,QAAQ,KAAa;CACrE,MAAM,aAAa,IAAI;CACvB,OAAO,cAAA,GAAaA,UAAAA,QAAAA,CAAQ,UAAU,KAAA,GAAIC,UAAAA,KAAAA,EAAAA,GAAKC,QAAAA,QAAAA,CAAQ,GAAG,MAAM;AACjE;;;;;;AC8BA,SAAgB,kBAAkB,SAAqC;CACtE,IAAI,SAAS,MAAM,OAAO,QAAQ;CAClC,OAAO,SAAS,QAAA,GAAOC,UAAAA,KAAAA,CAAK,QAAQ,MAAM,MAAM,IAAI,QAAQ;AAC7D;;;;AAKA,SAAgB,mBAAmB,SAAqC;CACvE,QAAA,GAAOA,UAAAA,KAAAA,CAAK,kBAAkB,OAAO,GAAG,kBAAkB;AAC3D;;;;AAKA,SAAS,qBAAqB,SAAmC;CAChE,MAAM,MAAM,kBAAkB,OAAO;CACrC,IAAI,EAAA,GAACC,QAAAA,WAAAA,CAAW,GAAG,GAClB,CAAA,GAAA,QAAA,UAAA,CAAU,KAAK;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;AAEjD;;;;AAKA,eAAsB,gBACrB,SAC6B;CAC7B,MAAM,OAAO,mBAAmB,OAAO;CAEvC,IAAI,EAAA,GAACA,QAAAA,WAAAA,CAAW,IAAI,GACnB,OAAO,CAAC;CAGT,IAAI;EACH,MAAM,UAAU,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,MAAM,OAAO;EAC5C,OAAO,KAAK,MAAM,OAAO;CAC1B,QAAQ;EACP,OAAO,CAAC;CACT;AACD;;;;AAKA,eAAsB,iBACrB,aACA,SACgB;CAChB,qBAAqB,OAAO;CAC5B,MAAM,OAAO,mBAAmB,OAAO;CAEvC,OAAA,GAAMC,iBAAAA,UAAAA,CAAU,MAAM,KAAK,UAAU,aAAa,MAAM,CAAC,GAAG,EAC3D,MAAM,IACP,CAAC;AACF;;;;AAKA,eAAsB,wBACrB,OACA,UACA,SACgB;CAChB,MAAM,cAAc,MAAM,gBAAgB,OAAO;CAEjD,YAAY,UAAU;EACrB;EACA;EACA,2BAAU,IAAI,KAAK,EAAA,CAAE,YAAY;CAClC;CAEA,MAAM,iBAAiB,aAAa,OAAO;AAC5C;;;;AAKA,eAAsB,sBACrB,SAKS;CACT,MAAM,cAAc,MAAM,gBAAgB,OAAO;CAcjD,MAAM,QAAQ,QAAQ,IAAI,qBAAqB,YAAY,SAAS;CACpE,MAAM,WACL,QAAQ,IAAI,oBAAoB,YAAY,SAAS;CAEtD,IAAI,CAAC,SAAS,CAAC,UAAU,OAAO;CAEhC,OAAO;EACN;EACA,UAAU,SAAS,QAAQ,OAAO,EAAE;EACpC,GAAI,YAAY,SAAS,aACtB,EAAE,YAAY,YAAY,QAAQ,WAAW,IAC7C,CAAC;CACL;AACD;;;;AAKA,eAAsB,yBACrB,SACmB;CACnB,MAAM,cAAc,MAAM,gBAAgB,OAAO;CAEjD,IAAI,CAAC,YAAY,SAChB,OAAO;CAGR,OAAO,YAAY;CACnB,MAAM,iBAAiB,aAAa,OAAO;CAC3C,OAAO;AACR;;;;AAkBA,eAAsB,gBACrB,SACyB;CAEzB,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI,UACH,OAAO;CAIR,MAAM,SAAS,MAAM,sBAAsB,OAAO;CAClD,IAAI,QACH,OAAO,OAAO;CAGf,OAAO;AACR;;;;AAkCA,eAAsB,qBACrB,SAC8B;CAE9B,QAAO,MADc,sBAAsB,OAAO,EAAA,EACnC,cAAc,KAAA;AAC9B;;;;;;AAWA,eAAsB,oBACrB,OACA,SACgB;CAChB,MAAM,cAAc,MAAM,gBAAgB,OAAO;CAEjD,YAAY,YAAY;EACvB;EACA,2BAAU,IAAI,KAAK,EAAA,CAAE,YAAY;CAClC;CAEA,MAAM,iBAAiB,aAAa,OAAO;AAC5C;;;;;;;AAQA,eAAsB,kBACrB,SACyB;CAEzB,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI,UACH,OAAO;CAKR,QAAO,MADmB,gBAAgB,OAAO,EAAA,CAC9B,WAAW,SAAS;AACxC;;;;AA0BA,eAAsB,kBACrB,OACA,SACgB;CAChB,MAAM,cAAc,MAAM,gBAAgB,OAAO;CAEjD,YAAY,UAAU;EACrB;EACA,2BAAU,IAAI,KAAK,EAAA,CAAE,YAAY;CAClC;CAEA,MAAM,iBAAiB,aAAa,OAAO;AAC5C;;;;AAKA,eAAsB,yBACrB,SACmB;CACnB,MAAM,cAAc,MAAM,gBAAgB,OAAO;CAEjD,IAAI,CAAC,YAAY,SAChB,OAAO;CAGR,OAAO,YAAY;CACnB,MAAM,iBAAiB,aAAa,OAAO;CAC3C,OAAO;AACR;;;;;;;;;;;;;;;AC/UA,MAAa,qBAAqB;;AAGlC,MAAM,gBAAgB;;AAgBtB,SAAS,QAAQ,SAAiB,MAAiC;CAClE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;AACnC;;AAGA,IAAa,gBAAb,cAAmC,MAAM;CAE9B;CACA;CACA;CACA;CAJV,YACC,SACA,MACA,UACA,QACC;EACD,MACC,KAAK,QAAQ,SAAS,IAAI,EAAE,KAAK,aAAa,OAAO,kBAAkB,UAAU,eAAe,oBAAoB,WAAW,6DAChI;EAPS,KAAA,UAAA;EACA,KAAA,OAAA;EACA,KAAA,WAAA;EACA,KAAA,SAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,kBAAb,cAAqC,MAAM;CAEhC;CACA;CACA;CAHV,YACC,SACA,MACA,WACC;EACD,MACC,KAAK,QAAQ,SAAS,IAAI,EAAE,6BAA6B,KAAK,MAAM,YAAY,GAAI,EAAE,8GACvF;EANS,KAAA,UAAA;EACA,KAAA,OAAA;EACA,KAAA,YAAA;EAKT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,IACrB,SACA,MACA,UAAsB,CAAC,GACP;CAChB,MAAM,WAAW,SAAS,MAAM,SAAS,KAAK;AAC/C;;;;;;AAOA,SAAgB,UACf,SACA,MACA,UAAqC,CAAC,GACpB;CAClB,OAAO,WAAW,SAAS,MAAM,SAAS,IAAI;AAC/C;AAEA,SAAS,WACR,SACA,MACA,SACA,SACkB;CAClB,MAAM,EAAE,YAAY,oBAAoB,GAAG,iBAAiB;CAE5D,OAAO,IAAI,SAAiB,SAAS,WAAW;EAC/C,MAAM,SAAA,GAAQC,mBAAAA,MAAAA,CAAM,SAAS,CAAC,GAAG,IAAI,GAAG;GACvC,OAAO;GACP,GAAG;GACH,GAAI,UAAU,EAAE,OAAO;IAAC;IAAU;IAAQ;GAAS,EAAE,IAAI,CAAC;GAC1D,OAAO;EACR,CAAC;EAED,IAAI,SAAS;EACb,MAAM,QAAQ,GAAG,SAAS,UAAkB;GAC3C,UAAU,MAAM,SAAS;EAC1B,CAAC;EAED,IAAI,WAAW;EACf,IAAI;EACJ,MAAM,QAAQ,iBAAiB;GAC9B,WAAW;GACX,MAAM,KAAK,SAAS;GAEpB,SAAS,iBAAiB,MAAM,KAAK,SAAS,GAAG,aAAa;GAC9D,OAAO,QAAQ;EAChB,GAAG,SAAS;EACZ,MAAM,QAAQ;EAEd,MAAM,eAAe;GACpB,aAAa,KAAK;GAClB,IAAI,QAAQ,aAAa,MAAM;EAChC;EAEA,MAAM,GAAG,UAAU,UAAU;GAC5B,OAAO;GAGP,OAAO,aAAa,QAAQ,UAAU,aAAa,OAAO,SAAS,KAAK;EACzE,CAAC;EAED,MAAM,GAAG,UAAU,MAAqB,WAAkC;GACzE,OAAO;GACP,IAAI,aAAa,QAAQ,SAAS,OAAO,aAAa,OAAO,MAAM;QAC9D,IAAI,UAAU,OAAO,IAAI,gBAAgB,SAAS,MAAM,SAAS,CAAC;QAClE,IAAI,SAAS,GAAG,QAAQ,MAAM;QAC9B,OAAO,IAAI,cAAc,SAAS,MAAM,MAAM,MAAM,CAAC;EAC3D,CAAC;CACF,CAAC;AACF;;;;;;;;;;;;;;;;;ACjBA,MAAM,iBAA0D;CAC/D,SACC;CACD,UACC;CACD,SACC;CACD,WACC;CACD,KAAK;AACN;;AAGA,IAAa,oBAAb,cAAuCC,eAAAA,SAAS;CAErC;CAEA;CAEA;CALV,YACC,MAEA,QAEA,eAAgC,eAAe,SAC9C,oDACA;EACD,MAAM,OACL,SAAS,YACN,yBAAyB,SAAS,QAAQ,WAAW,GAAG,KACxD,SAAS,aACR,+BAA+B,UAAU,0BAA0B,sDACnE,SAAS,QACR,qBAAqB,SAAS,aAAa,OAAO,WAAW,GAAG,KAChE,SAAS,YACR,uBAAuB,SAAS,QAAQ,WAAW,GAAG,KACtD,SAAS,cACR,yBAAyB,SAAS,QAAQ,WAAW,GAAG,KACxD,OAAO,OAAO,IAAI,EAAE,eAAe,SAAS,QAAQ,WAAW,GAAG;EAC1E,MAAM,GAAG,KAAK,GAAG,cAAc;EAnBtB,KAAA,OAAA;EAEA,KAAA,SAAA;EAEA,KAAA,eAAA;EAgBT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,iBACf,GAAG,WACkB;CACrB,OAAO,EACN,MAAM,IAAI,SAAS,SAAS;EAC3B,KAAK,MAAM,YAAY,WAAW;GACjC,MAAM,QAAQ,MAAM,SAAS,IAAI,SAAS,OAAO;GACjD,IAAI,OAAO,OAAO;EACnB;CAED,EACD;AACD;;;;;;;;;;;;;;;;;AA4BA,SAAgB,kBACf,UAAoC,CAAC,GAChB;CACrB,MAAM,MAAM,QAAQ,OAAO,QAAQ;CAEnC,OAAO,EACN,MAAM,IAAI,OAAO;EAEhB,MAAM,UAAU;EAChB,QAAQ,QAAQ,MAAhB;GACC,KAAK,WAAW;IACf,MAAM,UACL,MAAM,gBACL,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,KAAA,CACzC,EAAA,CACC;IACF,MAAM,QAAQ,IAAI,qBAAqB,QAAQ;IAC/C,MAAM,WACL,IAAI,oBAAoB,QAAQ,YAAY,QAAQ;IACrD,IAAI,CAAC,SAAS,CAAC,UAAU,OAAO,KAAA;IAChC,OAAO;KAAE,UAAU,SAAS,QAAQ,OAAO,EAAE;KAAG;IAAM;GACvD;GACA,KAAK,YAAY;IAChB,MAAM,WAAW,IAAI;IACrB,MAAM,WAAW,IAAI;IACrB,IAAI,CAAC,YAAY,CAAC,UAAU,OAAO,KAAA;IACnC,OAAO;KAAE;KAAU;IAAS;GAC7B;GACA,KAAK,WAAW;IAEf,MAAM,QACL,IAAI,sBAEH,MAAM,gBACL,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,KAAA,CACzC,EAAA,CACC,SAAS;IACZ,IAAI,CAAC,OAAO,OAAO,KAAA;IACnB,OAAO,EAAE,MAAM;GAChB;GACA,KAAK,aAAa;IACjB,MAAM,QACL,IAAI,wBAEH,MAAM,gBACL,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,KAAA,CACzC,EAAA,CACC,WAAW;IACd,IAAI,CAAC,OAAO,OAAO,KAAA;IACnB,OAAO,EAAE,MAAM;GAChB;GACA,KAAK,OAAO;IACX,MAAM,SAAS,IAAI,cAAc,IAAI;IACrC,MAAM,QAAQ,SAAS,EAAE,OAAO,IAAI,CAAC;IACrC,IAAI,IAAI,aACP,OAAO;KAAE,SAAS,IAAI;KAAa,GAAG;IAAM;IAE7C,MAAM,cAAc,IAAI;IACxB,MAAM,kBAAkB,IAAI;IAC5B,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;IAC7C,OAAO;KACN;KACA;KACA,GAAI,IAAI,oBACL,EAAE,cAAc,IAAI,kBAAkB,IACtC,CAAC;KACJ,GAAG;IACJ;GACD;EACD;CAGD,EACD;AACD"}