@geekmidas/cli 10.0.0-alpha.61 → 10.0.0-alpha.63

package/dist/discover-BaT6bpnA.mjs

@@ -0,0 +1,614 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { a as discriminatedUnion, c as object, l as record, n as array, o as literal, u as string } from "./schemas-D2LCF689.mjs";
+import { t as WORKER_RESULT_MARKER } from "./workerRuntime-CsOyBRx2.mjs";
+import { createRequire } from "node:module";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { existsSync, realpathSync } from "node:fs";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { format } from "node:util";
+import { assertDerivations, canonicalId } from "@geekmidas/manifest";
+import fg from "fast-glob";
+import kebabCase$1 from "lodash.kebabcase";
+import { fileURLToPath, pathToFileURL } from "node:url";
+//#region src/output.ts
+/**
+* Where the CLI's progress lines go.
+*
+* Commands write their progress through `output` rather than `console`. Run
+* from the terminal that is the same thing. Run inside `deploy()`, each line
+* goes to the run that wrote it instead — as an event its caller can iterate,
+* and to the logger it was handed — so a deploy embedded in another program
+* does not print over that program's own output.
+*
+* Carried by `AsyncLocalStorage` rather than passed down, because the lines
+* come from everywhere a deploy reaches — the Dockerfile generator, the env
+* sniffer, construct discovery — and two deploys running in one process must
+* not hear each other.
+*/
+const current = new AsyncLocalStorage();
+/** Runs `fn` with every line written through `output` sent to `sink`. */
+function withOutput(sink, fn) {
+	return current.run(sink, fn);
+}
+function write(level, fallback) {
+	return (...args) => {
+		const sink = current.getStore();
+		if (sink) sink(level, format(...args));
+		else fallback(...args);
+	};
+}
+/**
+* `console`, for the methods the CLI logs through — routed to the current
+* run's sink when there is one.
+*/
+const output = {
+	log: write("info", (...args) => console.log(...args)),
+	info: write("info", (...args) => console.info(...args)),
+	warn: write("warn", (...args) => console.warn(...args)),
+	error: write("error", (...args) => console.error(...args))
+};
+//#endregion
+//#region src/generators/Generator.ts
+/**
+* Zod v4 maintains a process-wide registry of schemas registered via
+* `.meta({ id })`. When we cache-bust user module imports (by appending a
+* `?t=timestamp` query), those modules re-execute and try to register the
+* same ids again, which throws `ID X already exists in the registry`.
+*
+* Clearing the registry in the CLI process is safe: the user's running
+* server lives in a subprocess and has its own isolated registry.
+*
+* Exported for tests.
+*/
+function clearZodGlobalRegistry() {
+	const registry = globalThis.__zod_globalRegistry;
+	if (registry && typeof registry.clear === "function") registry.clear();
+}
+var ConstructGenerator = class {
+	static async build(context, outputDir, generator, patterns, options) {
+		const constructs = await generator.load(patterns);
+		return generator.build(context, constructs, outputDir, options);
+	}
+	async load(patterns, cwd = process.cwd(), bustCache = false) {
+		const logger = console;
+		const globPatterns = Array.isArray(patterns) ? patterns : patterns ? [patterns] : [];
+		const files = fg.stream(globPatterns, {
+			cwd,
+			absolute: true
+		});
+		if (bustCache) clearZodGlobalRegistry();
+		const constructs = [];
+		for await (const f of files) try {
+			const file = f.toString();
+			const module = await (bustCache ? import(`${file}?t=${Date.now()}`) : import(file));
+			for (const [key, construct] of Object.entries(module)) if (this.isConstruct(construct)) constructs.push({
+				key,
+				name: kebabCase$1(key),
+				construct,
+				path: {
+					absolute: file,
+					relative: relative(process.cwd(), file)
+				}
+			});
+		} catch (error) {
+			const err = error;
+			logger.error(`Failed to load ${f}: ${err.message}`);
+			if (err.stack) logger.error(err.stack);
+			throw error;
+		}
+		return constructs;
+	}
+};
+//#endregion
+//#region src/sandbox/sandbox.ts
+/**
+* Where a deploy runs the project's own code.
+*
+* A deploy holds credentials — Dokploy's token, a registry login, an AWS key —
+* and loading `gkm.config.ts`, sniffing an app's environment and building it
+* all execute code from the repository being deployed. On a developer's own
+* laptop that is the developer's code. On a CI job for a fork, or a shared
+* build runner, it is not, and that code should not be able to read the
+* credentials used to deploy it, hang the deploy, or reach outside the
+* checkout.
+*
+* So every step that runs project code goes through a `Sandbox`: one call,
+* with an argument array rather than a shell line, the complete environment
+* the step needs rather than the host's, a timeout it cannot outlive, secrets
+* as files rather than variables, and a working directory inside the project.
+* The steps that need credentials — provisioning, pushing, releasing — are
+* the deploy's own code and never run in one.
+*
+* `LocalSandbox` is the default: a child process on this machine with an
+* allowlisted environment. A host that builds repositories it does not trust
+* passes its own — a container per build, a VM — through `deploy()`'s
+* `sandbox`.
+*/
+/** The variable naming the directory a command's secrets are mounted in. */
+const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
+/** A command was asked to run outside the project. */
+var SandboxCwdEscape = class extends Error {
+	cwd;
+	root;
+	constructor(cwd, root) {
+		super(`Refusing to run in '${cwd}': it is outside the project at '${root}'. A sandboxed step only runs inside the project it was given — check the app paths in gkm.config.ts for \`..\` or an absolute path.`);
+		this.cwd = cwd;
+		this.root = root;
+		this.name = "SandboxCwdEscape";
+	}
+};
+/** A path with its symlinks resolved where it exists — `/tmp` is `/private/tmp`. */
+function real(path) {
+	return existsSync(path) ? realpathSync(path) : path;
+}
+/**
+* `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.
+*
+* Symlinks are resolved on both sides first, so a link inside the project
+* that points out of it is an escape, and a project reached through a link
+* (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call
+* before it runs anything.
+*/
+function confineCwd(root, cwd) {
+	const absolute = resolve(root, cwd);
+	const from = relative(real(resolve(root)), real(absolute));
+	if (from === ".." || from.startsWith(`..${sep}`) || isAbsolute(from)) throw new SandboxCwdEscape(cwd, root);
+	return absolute;
+}
+/** A secret's file name: one path segment, so it cannot be written elsewhere. */
+var SecretNameInvalid = class extends Error {
+	secretName;
+	constructor(secretName) {
+		super(`'${secretName}' cannot be a secret's name: it becomes a file name in the secrets directory, so it must be one segment of letters, digits, '.', '-' or '_' and not start with '.'.`);
+		this.secretName = secretName;
+		this.name = "SecretNameInvalid";
+	}
+};
+const SECRET_NAME = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
+/** Every secret name, checked before anything is written. */
+function assertSecretNames(secrets) {
+	for (const name of Object.keys(secrets ?? {})) if (!SECRET_NAME.test(name)) throw new SecretNameInvalid(name);
+}
+const active = new AsyncLocalStorage();
+/**
+* Run `fn` with `sandbox` as the one its steps use.
+*
+* Per run rather than global, as `withOutput` routes a run's lines: two
+* deploys in one host process each build in their own sandbox. A step deep in
+* the engine — discovering constructs, sniffing an app — asks
+* {@link activeSandbox} rather than every function between `deploy()` and it
+* taking one more parameter.
+*/
+function withSandbox(sandbox, fn) {
+	return active.run({
+		sandbox,
+		answers: /* @__PURE__ */ new Map()
+	}, fn);
+}
+/** The sandbox of the run this is part of, if it was started with one. */
+function activeSandbox() {
+	return active.getStore()?.sandbox;
+}
+/**
+* `ask()`'s answer, asked once per run.
+*
+* A deploy loads its config and discovers its constructs from several places
+* — the first load, the engine, the Dockerfile generator — and in a sandbox
+* each was a child process of its own, for the same answer: the checkout does
+* not change while it deploys. Within a run in `sandbox`, the first answer
+* for `key` is the one every later ask gets. Outside one, or for another
+* sandbox, `ask()` runs each time.
+*/
+function oncePerRun(sandbox, key, ask) {
+	const run = active.getStore();
+	if (!run || run.sandbox !== sandbox) return ask();
+	let answer = run.answers.get(key);
+	if (!answer) {
+		answer = ask();
+		run.answers.set(key, answer);
+		answer.catch(() => run.answers.delete(key));
+	}
+	return answer;
+}
+//#endregion
+//#region src/owningTsconfigJsx.ts
+const REGISTER = "owning-tsconfig-jsx-register.mjs";
+/** The CLI's `bin/` was not found above the module looking for it. */
+var OwningTsconfigJsxHookMissing = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not find bin/${REGISTER} in any directory above '${from}'. It ships with @geekmidas/cli beside bin/gkm.mjs; reinstall the package if it is missing.`);
+		this.from = from;
+		this.name = "OwningTsconfigJsxHookMissing";
+	}
+};
+/**
+* The CLI's `bin/owning-tsconfig-jsx-register.mjs`, as a file URL. Searched
+* upward because this module runs from `src/` in the repo and from a chunk in
+* `dist/` once built, and `bin/` sits beside both.
+*/
+function registerUrl() {
+	const from = dirname(fileURLToPath(import.meta.url));
+	for (let dir = from;; dir = dirname(dir)) {
+		const candidate = join(dir, "bin", REGISTER);
+		if (existsSync(candidate)) return pathToFileURL(candidate).href;
+		if (dirname(dir) === dir) throw new OwningTsconfigJsxHookMissing(from);
+	}
+}
+/**
+* `NODE_OPTIONS` for a process that runs app code through tsx, with the hook
+* that compiles each `.tsx` with its own tsconfig's JSX settings (see
+* `bin/owning-tsconfig-jsx.mjs`) put in front of every other `--import`, so it
+* is registered before tsx and reads the source on tsx's behalf.
+*
+* `bin/gkm.mjs` already starts the CLI this way, and its children inherit it;
+* this is for those that set `NODE_OPTIONS` themselves, or whose CLI was
+* started with tsx already imported.
+*/
+function withOwningTsconfigJsx(nodeOptions = "") {
+	if (nodeOptions.includes(REGISTER)) return nodeOptions;
+	return [`--import=${registerUrl()}`, nodeOptions].filter(Boolean).join(" ");
+}
+//#endregion
+//#region src/sandbox/worker.ts
+/**
+* Running one of the CLI's own worker scripts inside a sandbox, and reading
+* back the one JSON value it answers with.
+*
+* The worker imports the project's TypeScript — `gkm.config.ts`, construct
+* modules, an app's entry — so it starts with the CLI's own tsx and the two
+* hooks `gkm` itself runs with (JSX by the owning tsconfig, path aliases by
+* the adjacent one). The host process needs none of them loaded: a program
+* calling `deploy()` without `--import tsx` still loads a TypeScript config.
+*/
+const here = dirname(fileURLToPath(import.meta.url));
+/**
+* A worker's file: `dist/sandbox/<name>.mjs` once built — whether this module
+* was bundled into `dist/` or sits beside it — or the `.ts` source under tsx.
+*/
+function workerFile(name) {
+	return [
+		join(here, "sandbox", `${name}.mjs`),
+		join(here, `${name}.mjs`),
+		join(here, "..", "sandbox", `${name}.mjs`),
+		join(here, `${name}.ts`)
+	].find((path) => existsSync(path)) ?? join(here, `${name}.ts`);
+}
+/** tsx, from the CLI's own dependencies — never the project's. */
+function tsxUrl() {
+	return pathToFileURL(createRequire(import.meta.url).resolve("tsx")).href;
+}
+/**
+* `node`'s arguments for `script`: the CLI's TypeScript loaders, then any
+* further `imports`, then the script and its `args` — an argument array, so
+* nothing about a path is read by a shell.
+*/
+function nodeWithTsx(script, args, imports = []) {
+	return [
+		...withOwningTsconfigJsx(`--import=${tsxUrl()}`).split(" "),
+		...imports.map((path) => `--import=${pathToFileURL(path).href}`),
+		script,
+		...args
+	];
+}
+/** A worker ended without the answer it exists to give. */
+var SandboxWorkerFailed = class extends Error {
+	step;
+	exitCode;
+	stderr;
+	constructor(step, exitCode, stderr) {
+		super(`The sandboxed ${step} ended (exit code ${exitCode}) without an answer.${stderr.trim() ? `\n${stderr.trim()}` : ""}\nIts output above says why; the sandbox must be able to run \`node\` with the CLI's own files at the paths they have here.`);
+		this.step = step;
+		this.exitCode = exitCode;
+		this.stderr = stderr;
+		this.name = "SandboxWorkerFailed";
+	}
+};
+/**
+* Run worker `name` in `sandbox`, and parse its answer with `schema`.
+*
+* The answer is the last marked line on stdout. Anything else the project's
+* code printed is ignored, and an answer the schema refuses is a failure
+* rather than data — a worker in an isolating sandbox runs code the host does
+* not trust.
+*
+* Within a run (`withSandbox`), the same worker asked the same question is
+* started once; every ask gets its own copy of the answer, and its stderr, as
+* though it had run again.
+*/
+async function runWorker(sandbox, step, options) {
+	const answer = await oncePerRun(sandbox, JSON.stringify([
+		options.name,
+		options.cwd,
+		options.args,
+		options.env ?? {}
+	]), () => startWorker(sandbox, step, options));
+	return structuredClone(answer);
+}
+async function startWorker(sandbox, step, options) {
+	const result = await sandbox.exec("node", nodeWithTsx(workerFile(options.name), options.args), {
+		cwd: options.cwd,
+		env: {
+			...sandbox.env,
+			...options.env
+		},
+		timeoutMs: options.timeoutMs,
+		output: "capture",
+		...options.signal ? { signal: options.signal } : {}
+	});
+	const line = result.stdout.split("\n").reverse().find((l) => l.startsWith(WORKER_RESULT_MARKER));
+	if (line) try {
+		const parsed = options.schema.safeParse(JSON.parse(line.slice(WORKER_RESULT_MARKER.length)));
+		if (parsed.success) return {
+			value: parsed.data,
+			stderr: result.stderr
+		};
+	} catch {}
+	throw new SandboxWorkerFailed(step, result.exitCode, result.stderr);
+}
+//#endregion
+//#region src/reconcile/discover.ts
+/**
+* Discovery — one glob, one structural test.
+*
+* A glob per kind is the same specialness the construct model removes, and
+* resources have no kind to be listed under: a declared `ObjectStorage` would
+* never be found by `routes:` or `crons:`. So there is one `constructs` glob,
+* every export of every matching module is inspected, and the per-kind
+* `isConstruct` checks collapse into a single question — does it have an id and
+* can it declare?
+*
+* Structural rather than `instanceof` on purpose. A construct from a different
+* copy of `@geekmidas/constructs` — a linked workspace, two versions in a
+* lockfile — is still a construct, and `instanceof` is exactly the check that
+* says otherwise.
+*/
+var discover_exports = /* @__PURE__ */ __exportAll({
+	ConstructDiscoveryFailed: () => ConstructDiscoveryFailed,
+	ConstructsNotSerializable: () => ConstructsNotSerializable,
+	DuplicateConstruct: () => DuplicateConstruct,
+	LiveConstructsUnavailable: () => LiveConstructsUnavailable,
+	discover: () => discover,
+	isDeclarable: () => isDeclarable
+});
+/** `console`, or the deploy run discovering the manifest. */
+const logger = output;
+/**
+* Whether a module export is a construct.
+*
+* Deliberately loose about what else it carries — a construct that also has a
+* `service` is still a construct, and requiring one would exclude the kinds that
+* own no address.
+*/
+function isDeclarable(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.id === "string" && candidate.id.length > 0 && typeof candidate.declare === "function";
+}
+/** What the discovery worker answers. Checked: the worker ran project code. */
+const DiscoverAnswer = discriminatedUnion("reason", [
+	object({
+		reason: literal("discovered"),
+		manifest: record(string(), object({
+			id: string(),
+			kind: string()
+		}).loose()),
+		runnables: record(string(), array(string()))
+	}),
+	object({
+		reason: literal("live"),
+		paths: array(string())
+	}),
+	object({
+		reason: literal("failed"),
+		error: object({
+			name: string(),
+			message: string(),
+			id: string().optional(),
+			sources: array(string()).optional()
+		}).loose()
+	})
+]);
+/**
+* The manifest, discovered in `sandbox` and handed back as JSON — or
+* `undefined` when it holds something JSON cannot carry and the sandbox is
+* not isolating, for the caller to discover here as before.
+*/
+async function discoverInSandbox(sandbox, options) {
+	const cwd = options.cwd ?? sandbox.root;
+	const patterns = typeof options.patterns === "string" ? [options.patterns] : [...options.patterns];
+	const { value, stderr } = await runWorker(sandbox, "construct discovery", {
+		name: "discover-worker",
+		args: [JSON.stringify({
+			patterns,
+			cwd
+		})],
+		cwd,
+		timeoutMs: DISCOVER_TIMEOUT_MS,
+		schema: DiscoverAnswer
+	});
+	if (stderr.trim()) logger.warn(stderr.replace(/\n$/, ""));
+	switch (value.reason) {
+		case "discovered":
+			if (options.runnables) for (const [owner, edges] of Object.entries(value.runnables)) options.runnables[owner] = edges;
+			return value.manifest;
+		case "failed":
+			if (value.error.name === "DuplicateConstruct" && value.error.id) throw new DuplicateConstruct(value.error.id, value.error.sources ?? []);
+			throw new ConstructDiscoveryFailed(value.error.name, value.error.message);
+		case "live":
+			if (sandbox.isolating) throw new ConstructsNotSerializable(value.paths);
+			return;
+	}
+}
+/**
+* A caller asked for the construct objects (`sources`) or a watcher's
+* re-import under an isolating sandbox, where only data comes back.
+*/
+var LiveConstructsUnavailable = class extends Error {
+	constructor() {
+		super("Discovery was asked for the construct objects themselves under an isolating sandbox, which hands back only data. Run this step without one, or ask only for the manifest.");
+		this.name = "LiveConstructsUnavailable";
+	}
+};
+/** How long discovering a project's constructs may take in a sandbox. */
+const DISCOVER_TIMEOUT_MS = 6e4;
+/** Importing a construct module, or declaring one, threw in the sandbox. */
+var ConstructDiscoveryFailed = class extends Error {
+	errorName;
+	detail;
+	constructor(errorName, detail) {
+		super(`Discovering constructs failed (${errorName}): ${detail}`);
+		this.errorName = errorName;
+		this.detail = detail;
+		this.name = "ConstructDiscoveryFailed";
+	}
+};
+/**
+* The constructs' declarations hold something that is not data, and the
+* sandbox they were discovered in hands the deploy nothing but data.
+*/
+var ConstructsNotSerializable = class extends Error {
+	paths;
+	constructor(paths) {
+		super(`The construct manifest holds values that are not plain data at: ${paths.join(", ")}. Under an isolating sandbox the deploy only receives what JSON can carry; deploy with a sandbox that is not isolating if the host trusts this project.`);
+		this.paths = paths;
+		this.name = "ConstructsNotSerializable";
+	}
+};
+/**
+* Build the construct manifest for a project.
+*
+* Runs the manifest's own validation before returning, so an app is wrong here
+* — where the error names a file — rather than at deploy.
+*
+* @throws {DuplicateConstruct} when two exports claim one id.
+*/
+async function discover(options) {
+	const sandbox = options.sandbox ?? activeSandbox();
+	if (sandbox) {
+		if (!options.sources && !options.bustCache) {
+			const sandboxed = await discoverInSandbox(sandbox, options);
+			if (sandboxed) return sandboxed;
+		} else if (sandbox.isolating) throw new LiveConstructsUnavailable();
+	}
+	const { patterns, cwd = process.cwd(), bustCache = false, sources: out } = options;
+	if (bustCache) clearZodGlobalRegistry();
+	const manifest = {};
+	/** Which file declared each id, for the error when two of them do. */
+	const sources = {};
+	/**
+	* Constructs already seen, by identity.
+	*
+	* A re-export is the *same object* reached through a second file — ESM
+	* bindings are live, so `export * from './database.js'` hands back the
+	* binding rather than a copy. Without this, a barrel file made every
+	* construct in it appear declared twice, and `constructs/index.ts` is the
+	* first thing anyone writes in a shared folder.
+	*
+	* Identity rather than file is also the more honest rule: what may not
+	* happen twice is two *different* constructs claiming one id, and that is
+	* still an error below.
+	*/
+	const seen = /* @__PURE__ */ new WeakSet();
+	const globs = Array.isArray(patterns) ? [...patterns] : [patterns];
+	const files = fg.stream(globs, {
+		cwd,
+		absolute: true
+	});
+	/** Matched files, for the diagnostic below. */
+	let matched = 0;
+	for await (const found of files) {
+		matched++;
+		const file = found.toString();
+		const module = await (bustCache ? import(`${file}?t=${Date.now()}`) : import(file));
+		for (const [exportName, exported] of Object.entries(module)) {
+			if (!isDeclarable(exported)) {
+				if (options.runnables) recordRunnable(options.runnables, exported);
+				continue;
+			}
+			if (seen.has(exported)) continue;
+			seen.add(exported);
+			if (options.runnables && typeof exported.owner === "string") recordRunnable(options.runnables, exported);
+			for (const declaration of exported.declare()) {
+				const id = canonicalId(declaration.id);
+				const source = relative(cwd, file);
+				const claimed = sources[id];
+				if (claimed !== void 0 && claimed !== source) throw new DuplicateConstruct(id, [claimed, source]);
+				manifest[id] = {
+					...declaration,
+					id
+				};
+				sources[id] = source;
+				if (out) out[id] = {
+					file,
+					exportName,
+					construct: exported
+				};
+			}
+		}
+	}
+	assertDerivations(manifest);
+	warnIfNothingFound(globs, matched, Object.keys(manifest).length);
+	return manifest;
+}
+/**
+* Record a runnable's edges under the construct that owns it — the surface an
+* endpoint was built from, or the worker a cron or subscriber was. Anything
+* with no owner, or that is not a runnable at all, is left alone.
+*/
+function recordRunnable(runnables, exported) {
+	if (typeof exported !== "object" || exported === null) return;
+	const runnable = exported;
+	const owner = typeof runnable.surface?.id === "string" ? runnable.surface.id : typeof runnable.owner === "string" ? runnable.owner : void 0;
+	if (!owner || !Array.isArray(runnable.constructs)) return;
+	const key = canonicalId(owner);
+	const edges = runnables[key] ?? [];
+	runnables[key] = edges;
+	for (const id of runnable.constructs) {
+		if (typeof id !== "string") continue;
+		const target = canonicalId(id);
+		if (!edges.includes(target)) edges.push(target);
+	}
+}
+/**
+* Say so when a glob was configured and found nothing.
+*
+* The glob is not a filter over declarations already known — it is *how they
+* are found*, by importing what it matches. So a file it misses is a
+* declaration that does not exist, and every symptom of that appears somewhere
+* other than the cause: no container starts, no env key is written, and the
+* application fails on first use against a resource it can see in its own
+* source.
+*
+* Nothing reported it before, because an unmatched file is indistinguishable
+* from a file nobody wrote. These two cases are the ones that are *not*
+* ambiguous — a glob was configured, so something was expected.
+*
+* Silent when no glob is configured at all: that is a project which has not
+* adopted constructs, and has nothing to be missing.
+*/
+function warnIfNothingFound(globs, matched, declared) {
+	if (globs.length === 0) return;
+	if (matched === 0) {
+		logger.warn(`\n⚠️  The constructs glob matched no files, so nothing was declared.\n   Patterns: ${globs.join(", ")}\n   Nothing will be provisioned — no containers, no env keys, no resources.\n   A common cause is depth: '*.ts' matches one level, '**/*.ts' matches any.`);
+		return;
+	}
+	if (declared === 0) logger.warn(`\n⚠️  The constructs glob matched ${matched} file(s) but none declared anything.\n   Patterns: ${globs.join(", ")}\n   Discovery keeps exports with an 'id' that can 'declare()'. A construct that is\n   built but never exported is invisible to it.`);
+}
+/** Two constructs claiming one id. */
+var DuplicateConstruct = class extends Error {
+	/** The id claimed twice. */
+	id;
+	/** The files that claimed it. */
+	sources;
+	constructor(id, sources) {
+		super("Two constructs declare the same id");
+		this.name = "DuplicateConstruct";
+		this.id = id;
+		this.sources = sources;
+	}
+};
+//#endregion
+export { ConstructGenerator as _, isDeclarable as a, runWorker as c, SandboxCwdEscape as d, SecretNameInvalid as f, withSandbox as g, confineCwd as h, discover_exports as i, withOwningTsconfigJsx as l, assertSecretNames as m, ConstructsNotSerializable as n, SandboxWorkerFailed as o, activeSandbox as p, discover as r, nodeWithTsx as s, ConstructDiscoveryFailed as t, SECRETS_DIR_ENV as u, output as v, withOutput as y };
+
+//# sourceMappingURL=discover-BaT6bpnA.mjs.map