@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.124

package/dist/sandbox-DvNqr6od.d.cts

@@ -1,104 +0,0 @@
-import { jt as GkmError } from "./types-Q2SC_ly2.cjs";
-//#region src/sandbox/sandbox.d.ts
-/** Where a command's output goes. */
-type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
-interface SandboxExecOptions {
-  /**
-   * Where the command runs: the project root or a directory below it, as an
-   * absolute path or relative to the root. Anywhere else is refused with
-   * {@link SandboxCwdEscape}.
-   */
-  cwd: string;
-  /**
-   * The command's whole environment. Nothing of the host's is added to it:
-   * start from {@link Sandbox.env} and add what the step needs.
-   */
-  env: Readonly<Record<string, string>>;
-  /**
-   * How long the command may run before it is killed. Required: a step that
-   * waits forever — a sniffed entry that opens a server, a build stuck on a
-   * prompt — would otherwise hold the deploy, and its lock, forever.
-   */
-  timeoutMs: number;
-  /**
-   * Files the command can read, by name. Mounted in a directory of their own
-   * — named by `GKM_SECRETS_DIR` in the command's environment — and removed
-   * when it exits. Never set as variables, which every child inherits, a
-   * crash report prints and `/proc/<pid>/environ` shows.
-   */
-  secrets?: Readonly<Record<string, string>>;
-  /**
-   * `capture` (the default) returns stdout and stderr in the result;
-   * `inherit` gives the command the host's terminal; `stderr` sends both
-   * streams to the host's stderr; `ignore` discards them.
-   */
-  output?: SandboxOutput;
-  /** Kills the command when aborted; `exec` rejects with the signal's reason. */
-  signal?: AbortSignal;
-}
-/** How a command ended. A non-zero exit is a result, not an error. */
-interface SandboxResult {
-  exitCode: number | null;
-  signal: string | null;
-  /** What it wrote to stdout, when its output was captured. */
-  stdout: string;
-  /** What it wrote to stderr, when its output was captured. */
-  stderr: string;
-}
-/**
- * Runs a command against the project, and nothing else of the host's.
- *
- * `exec` resolves with the result however the command exited. It rejects
- * with {@link CommandTimedOut} once the timeout passes — after the command is
- * gone — with {@link SandboxCwdEscape} for a directory outside the project,
- * with the signal's reason when aborted, and with the spawn error when the
- * program cannot be started.
- */
-interface Sandbox {
-  /** The project: the directory every command runs at or below. */
-  readonly root: string;
-  /**
-   * Whether the code it runs is kept from the host: its files, its
-   * processes, its memory.
-   *
-   * An isolating sandbox shares nothing but what crosses `exec`, so a config
-   * reaches the deploy as data — a live object in it (a custom state store,
-   * an inline target) cannot cross, and is refused with
-   * `ConfigObjectNotSerializable`. A non-isolating one, like
-   * {@link LocalSandbox}, runs on the host as the host's user; a project
-   * whose config holds live objects is then loaded in-process as before,
-   * because a project trusted to run there is trusted to do that.
-   */
-  readonly isolating: boolean;
-  /**
-   * The environment a command starts from: what any program needs to run
-   * here — `PATH`, `HOME`, the locale — and no credential.
-   */
-  readonly env: Readonly<Record<string, string>>;
-  exec(command: string, args: readonly string[], options: SandboxExecOptions): Promise<SandboxResult>;
-}
-/** The variable naming the directory a command's secrets are mounted in. */
-declare const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
-/** A command was asked to run outside the project. */
-declare class SandboxCwdEscape extends GkmError {
-  readonly cwd: string;
-  readonly root: string;
-  constructor(cwd: string, root: string);
-}
-/**
- * `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.
- *
- * Symlinks are resolved on both sides first, so a link inside the project
- * that points out of it is an escape, and a project reached through a link
- * (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call
- * before it runs anything.
- */
-declare function confineCwd(root: string, cwd: string): string;
-/** A secret's file name: one path segment, so it cannot be written elsewhere. */
-declare class SecretNameInvalid extends GkmError {
-  readonly secretName: string;
-  constructor(secretName: string);
-}
-//#endregion
-export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
-//# sourceMappingURL=sandbox-DvNqr6od.d.cts.map

package/dist/sandbox-DvNqr6od.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-DvNqr6od.d.cts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}