@geekmidas/cli 10.0.0-alpha.61 → 10.0.0-alpha.63

package/dist/deploy/public.d.cts

@@ -1,53 +1,10 @@
-import { B as StateVersionConflict, z as StateLocked } from "../types-efNLu9xu.cjs";
+import { $ as DeployEventError, Q as DeployEvent, _t as StateVersionConflict, at as DeployResult, bt as deployIdentity, ct as CredentialKinds, dt as MissingCredential, et as DeployEventType, ft as StoredCredentialsOptions, ht as StateLocked, it as AppDeployResult, lt as CredentialProvider, mt as storedCredentials, nt as ResourceChange, ot as Credential, pt as chainCredentials, rt as ResourceVia, st as CredentialKind, tt as DeployPhase, ut as CredentialRequest, yt as DeployIdentity, z as AnyDeployTarget } from "../types-DIA7Li-J.cjs";
+import { a as SandboxOutput, c as confineCwd, i as SandboxExecOptions, n as Sandbox, o as SandboxResult, r as SandboxCwdEscape, s as SecretNameInvalid, t as SECRETS_DIR_ENV } from "../sandbox-M8UnLhXE.cjs";
+import { i as ConfigLoadFailed, o as ConfigObjectNotSerializable } from "../config-CemHVcIr.cjs";
+import { n as ConstructsNotSerializable, t as ConstructDiscoveryFailed } from "../discover-B_IkPukx.cjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-Dn_n-29S.cjs";
 import { ConstructManifest } from "@geekmidas/manifest";
-//#region src/deploy/identity.d.ts
-/**
- * Who a deploy is, on a target it shares with other workspaces.
- *
- * A Dokploy server is one flat namespace of projects, images and Docker
- * service names. Deploys used to identify everything they made by the
- * workspace name alone, so two workspaces called `shop` — or `Shop` and
- * `shop` — deploying to one server landed in the same project, pushed over
- * each other's images and redeployed each other's applications. A
- * `DeployIdentity` is what a deploy names and claims its resources by instead.
- */
-interface DeployIdentity {
-  /**
-   * Whose deploy this is — an organisation, a team, a repository. Two
-   * workspaces with the same name are told apart by it. Defaults to the
-   * kebab-cased workspace name; set `deploy.namespace` to choose one.
-   */
-  readonly namespace: string;
-  /** The workspace name as the target spells it: lowercase, `[a-z0-9-]`. */
-  readonly project: string;
-  readonly stage: string;
-  /**
-   * `<namespace>/<project>`: what a Dokploy project is claimed by.
-   *
-   * The stage is not part of it because one Dokploy project holds every stage
-   * of a workspace, each as an environment — the key has to be the same from
-   * every stage that deploys into it.
-   */
-  readonly key: string;
-  /**
-   * The prefix every name on the target carries: the project alone in the
-   * default namespace, `<namespace>-<project>` in any other.
-   *
-   * The default adds nothing so that a workspace that never set a namespace
-   * keeps the names it was already deployed under — a Postgres is found by
-   * its name, and a new name would be a new, empty database.
-   */
-  readonly scope: string;
-}
-/** What an identity is derived from: a workspace's name and namespace. */
-interface IdentitySource {
-  name: string;
-  deploy?: {
-    namespace?: string;
-  };
-}
-export declare function deployIdentity(workspace: IdentitySource, stage: string): DeployIdentity;
-//#endregion
+import "@geekmidas/envkit/sniffer";
 //#region src/home.d.ts
 /**
  * Where the CLI keeps what belongs to a person rather than a project: stage
@@ -62,259 +19,175 @@ export declare const GKM_HOME_ENV = "GKM_HOME";
 /** The CLI's home: `GKM_HOME` if set, else `~/.gkm`. */
 export declare function gkmHome(env?: NodeJS.ProcessEnv): string;
 //#endregion
-//#region src/deploy/credentials.d.ts
+//#region src/run.d.ts
+/** The program ran and exited unsuccessfully; its own output said why. */
+export declare class CommandFailed extends Error {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly exitCode: number | null;
+  readonly signal: NodeJS.Signals | null;
+  constructor(command: string, args: readonly string[], exitCode: number | null, signal: NodeJS.Signals | null);
+}
+/** The program ran past its timeout and was killed. */
+export declare class CommandTimedOut extends Error {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly timeoutMs: number;
+  constructor(command: string, args: readonly string[], timeoutMs: number);
+}
+//#endregion
+//#region src/sandbox/env.d.ts
 /**
- * How a deploy gets the credentials it acts with.
+ * What of the host's environment a local sandbox passes on.
  *
- * `deploy()` never prompts and never reads a terminal: it asks a
- * `CredentialProvider` and, when the provider has nothing, stops with
- * `MissingCredential` naming what it needed and how to supply it. Whether to
- * ask a person, read a vault or fail is the caller's decision — `gkm deploy`
- * prompts at a terminal and stores what was typed; a CI job sets the
- * environment; a host passes its own provider.
+ * An allowlist, not a denylist: a credential's variable has any name its
+ * owner chose (`DOKPLOY_TOKEN`, `AWS_SECRET_ACCESS_KEY`, `MY_VAULT_TOKEN`), so
+ * the only safe default is to name what a program needs to *run* and pass
+ * nothing else.
  */
-/** What each kind of credential is asked for with, and what it is. */
-interface CredentialKinds {
-  /** The Dokploy API a stage deploys through. */
-  dokploy: {
-    /** `deploy.dokploy.endpoint`, when the config names one. */
-    request: {
-      endpoint?: string;
-    };
-    value: {
-      endpoint: string;
-      token: string;
-    };
-  };
+/**
+ * Variables a command needs to find programs, write temp files, print in the
+ * user's locale and reach the network through the host's proxy — and nothing
+ * that authenticates as anyone.
+ *
+ * Deliberately left out:
+ * - `NODE_OPTIONS`: it can `--require` or `--import` code into every node
+ *   process, and CI often holds `--import tsx` there. A step that needs a
+ *   loader passes its own.
+ * - `NODE_AUTH_TOKEN`, `NPM_TOKEN`, `npm_config_*`: registry tokens
+ *   (`actions/setup-node` writes `NODE_AUTH_TOKEN`), which is why there is no
+ *   `NODE_*` wildcard.
+ * - `AWS_*`, `DOCKER_*`, `DOKPLOY_*`, `GITHUB_TOKEN`, `TURBO_TOKEN`, `GKM_*`:
+ *   credentials, or where the deploy keeps them.
+ * - `SHELL`, `EDITOR` and the rest of a login session: nothing here starts a
+ *   shell.
+ *
+ * Proxies are passed: behind one, nothing installs or builds without it. A
+ * proxy URL with a password in it reaches the command too — a host that keeps
+ * one there and builds code it does not trust should pass a sandbox of its
+ * own.
+ */
+export declare const SANDBOX_ENV_ALLOWLIST: readonly (string | RegExp)[];
+/**
+ * The allowlisted part of `source`, plus each of `extra` the host chose to
+ * pass on by name.
+ */
+export declare function allowlistedEnv(source?: NodeJS.ProcessEnv, extra?: readonly string[]): Record<string, string>;
+//#endregion
+//#region src/docker/templates.d.ts
+type PackageManager = 'pnpm' | 'npm' | 'yarn' | 'bun';
+//#endregion
+//#region src/sandbox/install.d.ts
+/** Long enough for a cold install of a large monorepo. */
+export declare const INSTALL_TIMEOUT_MS: number;
+interface InstallOptions {
+  /** The directory to install in. Defaults to the sandbox's root. */
+  cwd?: string;
+  /** Defaults to the one the lockfile above `cwd` names. */
+  packageManager?: PackageManager;
   /**
-   * A container registry login, for Dokploy to pull with. Asked for only when
-   * Dokploy has no registry for `deploy.dokploy.registry` and one has to be
-   * created.
+   * Skip every lifecycle script — dependencies' and the project's own —
+   * except those of {@link allowScripts}. Defaults to false: scripts run as
+   * a plain install runs them, under the package manager's own policy —
+   * npm 12 and pnpm 10 skip dependencies' scripts nobody approved.
    */
-  registry: {
-    /** `deploy.dokploy.registry`. */
-    request: {
-      url: string;
-    };
-    value: {
-      username: string;
-      password: string;
-    };
-  };
-}
-type CredentialKind = keyof CredentialKinds;
-/** What a deploy asks a provider for. */
-type CredentialRequest<K extends CredentialKind = CredentialKind> = { [P in K]: {
-  kind: P;
-} & CredentialKinds[P]['request']; }[K];
-/** What a provider answers with. */
-type Credential<K extends CredentialKind> = CredentialKinds[K]['value'];
-interface CredentialProvider {
+  ignoreScripts?: boolean;
   /**
-   * The credential `request` asks for, or `undefined` when this provider has
-   * none — the deploy then raises {@link MissingCredential}.
+   * With `ignoreScripts`, the packages whose scripts still run: rebuilt by
+   * name once the install is done.
    */
-  get<K extends CredentialKind>(request: CredentialRequest<K>, options?: {
-    signal?: AbortSignal;
-  }): Promise<Credential<K> | undefined>;
+  allowScripts?: readonly string[];
+  /** Variables the install needs beyond the sandbox's own. */
+  env?: Readonly<Record<string, string>>;
+  /** Defaults to {@link INSTALL_TIMEOUT_MS}, for each command. */
+  timeoutMs?: number;
+  /** Where the package manager's output goes. Defaults to `inherit`. */
+  output?: SandboxOutput;
+  signal?: AbortSignal;
 }
-/** A deploy needed a credential, and its provider had none. */
-export declare class MissingCredential extends Error {
-  readonly kind: CredentialKind;
-  /** What it was for: the Dokploy endpoint or the registry URL. */
-  readonly target: string | undefined;
-  /** How to supply it. */
-  readonly howToProvide: string;
-  constructor(kind: CredentialKind,
-  /** What it was for: the Dokploy endpoint or the registry URL. */
-  target: string | undefined,
-  /** How to supply it. */
-  howToProvide?: string);
+/** A name in `allowScripts` that is not a package name. */
+export declare class InstallAllowlistNameInvalid extends Error {
+  readonly packageName: string;
+  constructor(packageName: string);
 }
-/** Whatever was asked for, from the first provider that has it. */
-export declare function chainCredentials(...providers: CredentialProvider[]): CredentialProvider;
-interface StoredCredentialsOptions {
-  /** Where to read the variables from. Defaults to `process.env`. */
-  env?: NodeJS.ProcessEnv;
-  /**
-   * The CLI's home, whose `credentials.json` holds stored logins. Defaults
-   * to `GKM_HOME`, else `~/.gkm`.
-   */
-  home?: string;
+/** The package manager has no way to run only some packages' scripts. */
+export declare class InstallScriptsAllowlistUnsupported extends Error {
+  readonly packageManager: string;
+  readonly allowScripts: readonly string[];
+  constructor(packageManager: string, allowScripts: readonly string[]);
 }
 /**
- * Credentials from the environment, then from what `gkm login` stored. What
- * `deploy()` uses when it is handed no provider.
+ * Install the project's dependencies in `sandbox`.
  *
- * - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
- *   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
- *   Each half is read on its own: a token is a secret and belongs in the
- *   environment, an endpoint is configuration and belongs in the config.
- * - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
+ * ```ts
+ * // A checkout nobody has reviewed: no scripts but esbuild's.
+ * await installDependencies(sandbox, {
+ *   ignoreScripts: true,
+ *   allowScripts: ['esbuild'],
+ * });
+ * ```
+ *
+ * Resolves with each command's result, in order — with its output when
+ * `output` is `capture`.
+ *
+ * @throws {CommandFailed} when the package manager exits unsuccessfully.
+ * @throws {InstallScriptsAllowlistUnsupported} for an allowlist the package
+ *   manager cannot honour, before anything is installed.
  */
-export declare function storedCredentials(options?: StoredCredentialsOptions): CredentialProvider;
+export declare function installDependencies(sandbox: Sandbox, options?: InstallOptions): Promise<SandboxResult[]>;
 //#endregion
-//#region src/deploy/types.d.ts
-/** Result for a single app deployment in workspace mode */
-interface AppDeployResult {
-  /** App name */
-  appName: string;
-  /** App type */
-  type: 'backend' | 'web' | 'mobile';
-  /** Whether deployment succeeded */
-  success: boolean;
-  /** Dokploy application ID */
-  applicationId?: string;
-  /** Docker image reference */
-  imageRef?: string;
-  /** The registry's digest for the image, `sha256:…`, once pushed */
-  digest?: string;
-  /** Deployment URL */
-  url?: string;
-  /** Error message if failed */
-  error?: string;
-}
-/** Result from workspace deployment */
-interface WorkspaceDeployResult {
-  /** Results for each app */
-  apps: AppDeployResult[];
-  /** Dokploy project ID */
-  projectId: string;
-  /** Total number of successful deployments */
-  successCount: number;
-  /** Total number of failed deployments */
-  failedCount: number;
-}
-/**
- * What a deploy did — or, for a dry run, would do. Plain JSON, so it can be
- * written out as is (`gkm deploy --json` ends with it).
- */
-interface DeployResult extends WorkspaceDeployResult {
-  stage: string;
-  /** `<namespace>/<project>`. */
-  identity: string;
-  /** The image tag every app was built with. */
-  tag: string;
-  /** Whether this was a dry run: nothing was created, built or pushed. */
-  dryRun: boolean;
-  /** Dokploy's environment for the stage; empty when a dry run would create it. */
-  environmentId: string;
-  /** Apps left out, and why — a mobile app, another deploy target. */
-  skipped: {
-    app: string;
-    reason: string;
-  }[];
-  /** Each deployed app's public URL. */
-  urls: Record<string, string>;
+//#region src/sandbox/local.d.ts
+interface LocalSandboxOptions {
+  /** The project. Every command runs at or below it. */
+  root: string;
   /**
-   * Every resource the run touched, in order: what it applied, or for a dry
-   * run, what it would.
+   * `HOME` for every command. Defaults to the host's, because a build
+   * reuses the caches kept there — the pnpm store, corepack's package
+   * managers, turbo's cache — and a cold one re-downloads all of them.
+   * Point it at an empty directory to keep `~/.aws`, `~/.npmrc` and
+   * `~/.docker` out of reach of an SDK's default lookup — though, sharing
+   * the host's filesystem, a command that goes looking still finds them.
    */
-  changes: ResourceChange[];
+  home?: string;
+  /**
+   * Host variables to pass on beyond the allowlist, by name — a remote
+   * cache's `TURBO_TOKEN`, for a build the host trusts with it.
+   */
+  passEnv?: readonly string[];
+  /** Where the allowlisted variables are read from. Defaults to `process.env`. */
+  hostEnv?: NodeJS.ProcessEnv;
 }
-//#endregion
-//#region src/deploy/events.d.ts
 /**
- * The stretch of a deploy an event belongs to.
+ * A child process on this machine, as this user, with an allowlisted
+ * environment.
  *
- * - `validate`: the config, the stage, the apps, the lock, the stage's secrets
- *   and what each app reads from its environment
- * - `plan`: a dry run's lookups — what would be created and what reused
- * - `provision`: the Dokploy project, environment and registry, and the
- *   declared constructs
- * - `release`: each app's image built, pushed and deployed
- * - `verify`: DNS records and Dokploy's domain validation
+ * What it withholds from the command: the host's environment beyond
+ * {@link SANDBOX_ENV_ALLOWLIST}, a shell, a working directory outside the
+ * project, and any time past the timeout. What it does not: the host's
+ * filesystem, which the command can read and write as the user running the
+ * deploy. So it is not `isolating`, and it is the default for projects the
+ * host already trusts — the developer's own, a team's own CI. Code nobody
+ * vetted belongs in a sandbox that is.
+ *
+ * A timed-out command is sent SIGTERM, then SIGKILL; processes it started
+ * itself are its to stop.
  */
-type DeployPhase = 'validate' | 'plan' | 'provision' | 'release' | 'verify';
-/** An error, as an event carries it. */
-interface DeployEventError {
-  /** The error's class name — `MissingCredential`, `StateLocked`. */
-  name: string;
-  message: string;
+export declare class LocalSandbox implements Sandbox {
+  readonly root: string;
+  readonly isolating = false;
+  readonly env: Readonly<Record<string, string>>;
+  constructor(options: LocalSandboxOptions);
+  exec(command: string, args: readonly string[], options: SandboxExecOptions): Promise<SandboxResult>;
 }
-/**
- * How a resource came to be used:
- * - `recorded`: the id the stage's state holds still resolves
- * - `resumed`: a run that died after creating it is picked up
- * - `found`: it existed and was looked up
- * - `created`: this run created it
- */
-type ResourceVia = 'recorded' | 'resumed' | 'found' | 'created';
-/** One resource a deploy touches, planned or applied. */
-interface ResourceChange {
-  /** `<type>:<name>`, unique within the stage — `application:api`. */
-  key: string;
-  /** `project`, `environment`, `registry`, `application`, `domain`, `image`, or a construct's kind. */
-  resourceType: string;
-  /**
-   * For a plan: whether the run would create it, reuse what exists, or
-   * ensure it (look it up, and create it if missing). For an applied change:
-   * what was done.
-   */
-  action: 'create' | 'reuse' | 'ensure' | 'build';
-  /** The target's id, once there is one. */
-  id?: string;
+//#endregion
+//#region src/sandbox/worker.d.ts
+/** A worker ended without the answer it exists to give. */
+export declare class SandboxWorkerFailed extends Error {
+  readonly step: string;
+  readonly exitCode: number | null;
+  readonly stderr: string;
+  constructor(step: string, exitCode: number | null, stderr: string);
 }
-type DeployEvent = {
-  type: 'deploy.started';
-  stage: string;
-  /** `<namespace>/<project>`. */
-  identity: string;
-  tag: string;
-  /** The apps this run deploys, in order. */
-  apps: string[];
-  dryRun: boolean;
-} | {
-  type: 'phase.started';
-  phase: DeployPhase;
-} | {
-  type: 'phase.finished';
-  phase: DeployPhase;
-} |
-/**
- * A progress line, exactly as `gkm deploy` prints it — leading newline and
- * indentation included, so a terminal renderer prints `message` as is.
- */
-{
-  type: 'log';
-  level: 'info' | 'warn' | 'error';
-  message: string;
-} | {
-  type: 'app.skipped';
-  app: string;
-  reason: string;
-} | ({
-  type: 'resource.planned';
-} & ResourceChange) | ({
-  type: 'resource.applied';
-  via: ResourceVia;
-} & ResourceChange & {
-  id: string;
-}) | {
-  type: 'artifact.built';
-  app: string;
-  imageRef: string;
-  /** The registry's digest, `sha256:…`, once pushed. */
-  digest?: string;
-} | {
-  type: 'app.deployed';
-  app: string;
-  applicationId: string;
-  imageRef: string;
-  url: string;
-} | {
-  type: 'app.failed';
-  app: string;
-  error: DeployEventError;
-} | {
-  type: 'deploy.finished';
-  result: DeployResult;
-} | {
-  type: 'deploy.failed';
-  error: DeployEventError;
-};
-/** Every `type` a deploy event can have. */
-type DeployEventType = DeployEvent['type'];
 //#endregion
 //#region src/deploy/deploy.d.ts
 /**
@@ -334,6 +207,17 @@ interface DeployInput {
   cwd: string;
   /** The stage to deploy — one of the config's deployed stages. */
   stage: string;
+  /**
+   * The target to deploy through, by name. Defaults to `deploy.default`,
+   * else `dokploy`.
+   */
+  target?: string;
+  /**
+   * The host's own targets, by name. Consulted before the built-ins and the
+   * config's `deploy.targets`, so a host can deploy through an
+   * implementation of its own — `{ dokploy: myDokploy }` included.
+   */
+  targets?: Record<string, AnyDeployTarget>;
   /** The image tag. Defaults to `<stage>-<timestamp>`. */
   tag?: string;
   /** Deploy only these apps (in dependency order). Defaults to all. */
@@ -368,6 +252,18 @@ interface DeployInput {
    * default), its stderr, or nowhere.
    */
   childOutput?: 'inherit' | 'stderr' | 'ignore';
+  /**
+   * Where the project's own code runs: loading `gkm.config.ts`, discovering
+   * its constructs, sniffing each app's environment. Defaults to a
+   * `LocalSandbox` on the project — a child process here with an
+   * allowlisted environment, for a project the host trusts.
+   *
+   * A host deploying repositories it does not trust passes one that
+   * isolates — a container per build — and the config then reaches the
+   * deploy only as data. Credentials never enter a sandbox: they go from
+   * `credentials` to the steps that provision, push and release.
+   */
+  sandbox?: Sandbox;
 }
 /** A deploy in progress. */
 interface DeployRun extends AsyncIterable<DeployEvent> {
@@ -397,17 +293,6 @@ interface DeployRun extends AsyncIterable<DeployEvent> {
 export declare function deploy(input: DeployInput): DeployRun;
 //#endregion
 //#region src/deploy/index.d.ts
-/** Apps were asked for by name that the workspace does not have. */
-export declare class UnknownDeployApps extends Error {
-  readonly apps: readonly string[];
-  readonly available: readonly string[];
-  constructor(apps: readonly string[], available: readonly string[]);
-}
-/** Every app asked for deploys somewhere other than Dokploy. */
-export declare class NoDeployableApps extends Error {
-  readonly stage: string;
-  constructor(stage: string);
-}
 /** A backend failed, so the run stopped before deploying anything after it. */
 export declare class BackendDeployFailed extends Error {
   readonly app: string;
@@ -421,6 +306,29 @@ export declare class MissingEnvVars extends Error {
   constructor(app: string, missing: readonly string[], stage: string);
 }
 //#endregion
+//#region src/deploy/orchestrate.d.ts
+/** Apps were asked for by name that the workspace does not have. */
+export declare class UnknownDeployApps extends Error {
+  readonly apps: readonly string[];
+  readonly available: readonly string[];
+  constructor(apps: readonly string[], available: readonly string[]);
+}
+/** Every app asked for deploys through some other target. */
+export declare class NoDeployableApps extends Error {
+  readonly stage: string;
+  readonly target: string;
+  constructor(stage: string, target: string);
+}
+/** A failed rollback, after the failure that called for it. */
+export declare class RollbackFailed extends Error {
+  readonly target: string;
+  /** What failed first, and was being rolled back. */
+  readonly failure: unknown;
+  constructor(target: string,
+  /** What failed first, and was being rolled back. */
+  failure: unknown, cause: unknown);
+}
+//#endregion
 //#region src/deploy/ownership.d.ts
 /**
  * A Dokploy project with the name this deploy would use exists, and nothing
@@ -455,5 +363,5 @@ export declare class RegistryAmbiguous extends Error {
   constructor(registry: string, registryIds: readonly string[]);
 }
 //#endregion
-export { type AppDeployResult, type Credential, type CredentialKind, type CredentialKinds, type CredentialProvider, type CredentialRequest, type DeployEvent, type DeployEventError, type DeployEventType, type DeployIdentity, type DeployInput, type DeployLogger, type DeployPhase, type DeployResult, type DeployRun, type ResourceChange, type ResourceVia, StateLocked, StateVersionConflict, type StoredCredentialsOptions };
+export { type AppDeployResult, ConfigLoadFailed, ConfigObjectNotSerializable, ConstructDiscoveryFailed, ConstructsNotSerializable, type Credential, type CredentialKind, type CredentialKinds, type CredentialProvider, type CredentialRequest, type DeployEvent, type DeployEventError, type DeployEventType, type DeployIdentity, type DeployInput, type DeployLogger, type DeployPhase, type DeployResult, type DeployRun, DeployTargetNotYetSupported, type InstallOptions, InvalidTargetOptions, type LocalSandboxOptions, MissingCredential, ProviderRemoved, type ResourceChange, type ResourceVia, SECRETS_DIR_ENV, type Sandbox, SandboxCwdEscape, type SandboxExecOptions, type SandboxOutput, type SandboxResult, SecretNameInvalid, StateLocked, StateVersionConflict, type StoredCredentialsOptions, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, chainCredentials, confineCwd, deployIdentity, storedCredentials };
 //# sourceMappingURL=public.d.cts.map

package/dist/deploy/public.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/deploy/identity.ts","../../src/home.ts","../../src/deploy/credentials.ts","../../src/deploy/types.ts","../../src/deploy/events.ts","../../src/deploy/deploy.ts","../../src/deploy/index.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;UAaiB;;;;;;WAMP;;WAEA;WACA;;;;;;;;WAQA;;;;;;;;;WASA;;;UA0CO;EAChB;EACA;IAAW;;;wBAGI,eACf,WAAW,gBACX,gBACE;;;;;;;;;;;;qBC5EU;;wBAGG,QAAQ,MAAK,OAAO;;;;;;;;;;;;;;UCFnB;;EAEhB;;IAEC;MAAW;;IACX;MAAS;MAAkB;;;;;;;;EAO5B;;IAEC;MAAW;;IACX;MAAS;MAAkB;;;;KAIjB,uBAAuB;;KAGvB,kBAAkB,UAAU,iBAAiB,qBACvD,KAAK;EAAM,MAAM;IAAM,gBAAgB,iBACvC;;KAGU,WAAW,UAAU,kBAAkB,gBAAgB;UAElD;;;;;EAKhB,IAAI,UAAU,gBACb,SAAS,kBAAkB,IAC3B;IAAY,SAAS;MACnB,QAAQ,WAAW;;;qBAYV,0BAA0B;WAE5B,MAAM;;WAEN;;WAEA;EALV,YACU,MAAM,gBAEN;;EAAA,4BAEA;;EAAA;;;wBAYK,oBACZ,WAAW,uBACZ;UAYc;;EAEhB,MAAM,OAAO;;;;;EAKb;;;;;;;;;;;;wBAae,kBACf,UAAS,2BACP;;;;UCzEc;;EAEhB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;UAIgB;;EAEhB,MAAM;;EAEN;;EAEA;;EAEA;;;;;;UAOgB,qBAAqB;EACrC;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;IAAW;IAAa;;;EAExB,MAAM;;;;;EAKN,SAAS;;;;;;;;;;;;;;;KCtEE;;UAQK;;EAEhB;EACA;;;;;;;;;KAUW;;UAGK;;EAEhB;;EAEA;;;;;;EAMA;;EAEA;;KAGW;EAET;EACA;;EAEA;EACA;;EAEA;EACA;;EAEE;EAAuB,OAAO;;EAC9B;EAAwB,OAAO;;;;;;;EAK/B;EAAa;EAAkC;;EAC/C;EAAqB;EAAa;;EACjC;IAA6B;EAC7B;EAA0B,KAAK;IAAgB;EACjD;;EAGD;EACA;EACA;;EAEA;;EAGA;EACA;EACA;EACA;EACA;;EAEE;EAAoB;EAAa,OAAO;;EACxC;EAAyB,QAAQ;;EACjC;EAAuB,OAAO;;;KAGvB,kBAAkB;;;;;;;UChFb;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;EAEA;;EAEA;;EAEA;;;;;;EAMA;;;;;;EAMA,cAAc;;EAEd,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;UAIgB,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBA2EV,OAAO,OAAO,cAAc;;;;qBCwX/B,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAChB;EAArB,YAAqB;;;qBAST,4BAA4B;WAE9B;EADV,YACU,aACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;;;;qBCtiBE,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}
+{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/home.ts","../../src/run.ts","../../src/sandbox/env.ts","../../src/docker/templates.ts","../../src/sandbox/install.ts","../../src/sandbox/local.ts","../../src/sandbox/worker.ts","../../src/deploy/deploy.ts","../../src/deploy/index.ts","../../src/deploy/orchestrate.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;;;;;qBAaa;;wBAGG,QAAQ,MAAK,OAAO;;;;qBCuBvB,sBAAsB;WAExB;WACA;WACA;WACA,QAAQ,OAAO;EAJzB,YACU,iBACA,yBACA,yBACA,QAAQ,OAAO;;;qBAUb,wBAAwB;WAE1B;WACA;WACA;EAHV,YACU,iBACA,yBACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC3BE,0CAA0C;;;;;wBAyDvC,eACf,SAAQ,OAAO,YACf,4BACE;;;KCvFS;;;;qBCeC;UAEI;;EAEhB;;EAEA,iBAAiB;;;;;;;EAOjB;;;;;EAKA;;EAEA,MAAM,SAAS;;EAEf;;EAEA,SAAS;EACT,SAAS;;;qBAIG,oCAAoC;WAC3B;EAArB,YAAqB;;;qBAWT,2CAA2C;WAE7C;WACA;EAFV,YACU,wBACA;;;;;;;;;;;;;;;;;;;;wBAqJW,oBACrB,SAAS,SACT,UAAS,iBACP,QAAQ;;;UCpMM;;EAEhB;;;;;;;;;EASA;;;;;EAKA;;EAEA,UAAU,OAAO;;;;;;;;;;;;;;;;;qBA0BL,wBAAwB;WAC3B;WACA;WACA,KAAK,SAAS;EAEvB,YAAY,SAAS;EAUf,KACL,iBACA,yBACA,SAAS,qBACP,QAAQ;;;;;qBCpBC,4BAA4B;WAE9B;WACA;WACA;EAHV,YACU,cACA,yBACA;;;;;;;;UCnCM;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;EAEA;;;;;EAKA;;;;;;EAMA,UAAU,eAAe;;EAEzB;;EAEA;;;;;;EAMA;;;;;;EAMA,cAAc;;EAEd,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;;;;;;;;;;EAYA,UAAU;;;UAIM,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBAqEV,OAAO,OAAO,cAAc;;;;qBCuU/B,4BAA4B;WAE9B;EADV,YACU,aACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;qBCvcE,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAE3B;WACA;EAFV,YACU,eACA;;;qBAUE,uBAAuB;WAEzB;;WAEA;EAHV,YACU,gBAEA;;EAAA,kBACT;;;;;;;;qBC1EW,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}