@geekmidas/cli 10.0.0-alpha.61 → 10.0.0-alpha.63

package/dist/discover-C_6COHEv.cjs

@@ -0,0 +1,729 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_schemas = require("./schemas-Ckm_aBnF.cjs");
+const require_workerRuntime = require("./workerRuntime-BXfhbe13.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_async_hooks = require("node:async_hooks");
+let node_util = require("node:util");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let fast_glob = require("fast-glob");
+fast_glob = require_rolldown_runtime.__toESM(fast_glob, 1);
+let lodash_kebabcase = require("lodash.kebabcase");
+lodash_kebabcase = require_rolldown_runtime.__toESM(lodash_kebabcase, 1);
+let node_module = require("node:module");
+let node_url = require("node:url");
+//#region src/output.ts
+/**
+* Where the CLI's progress lines go.
+*
+* Commands write their progress through `output` rather than `console`. Run
+* from the terminal that is the same thing. Run inside `deploy()`, each line
+* goes to the run that wrote it instead — as an event its caller can iterate,
+* and to the logger it was handed — so a deploy embedded in another program
+* does not print over that program's own output.
+*
+* Carried by `AsyncLocalStorage` rather than passed down, because the lines
+* come from everywhere a deploy reaches — the Dockerfile generator, the env
+* sniffer, construct discovery — and two deploys running in one process must
+* not hear each other.
+*/
+const current = new node_async_hooks.AsyncLocalStorage();
+/** Runs `fn` with every line written through `output` sent to `sink`. */
+function withOutput(sink, fn) {
+	return current.run(sink, fn);
+}
+function write(level, fallback) {
+	return (...args) => {
+		const sink = current.getStore();
+		if (sink) sink(level, (0, node_util.format)(...args));
+		else fallback(...args);
+	};
+}
+/**
+* `console`, for the methods the CLI logs through — routed to the current
+* run's sink when there is one.
+*/
+const output = {
+	log: write("info", (...args) => console.log(...args)),
+	info: write("info", (...args) => console.info(...args)),
+	warn: write("warn", (...args) => console.warn(...args)),
+	error: write("error", (...args) => console.error(...args))
+};
+//#endregion
+//#region src/generators/Generator.ts
+/**
+* Zod v4 maintains a process-wide registry of schemas registered via
+* `.meta({ id })`. When we cache-bust user module imports (by appending a
+* `?t=timestamp` query), those modules re-execute and try to register the
+* same ids again, which throws `ID X already exists in the registry`.
+*
+* Clearing the registry in the CLI process is safe: the user's running
+* server lives in a subprocess and has its own isolated registry.
+*
+* Exported for tests.
+*/
+function clearZodGlobalRegistry() {
+	const registry = globalThis.__zod_globalRegistry;
+	if (registry && typeof registry.clear === "function") registry.clear();
+}
+var ConstructGenerator = class {
+	static async build(context, outputDir, generator, patterns, options) {
+		const constructs = await generator.load(patterns);
+		return generator.build(context, constructs, outputDir, options);
+	}
+	async load(patterns, cwd = process.cwd(), bustCache = false) {
+		const logger = console;
+		const globPatterns = Array.isArray(patterns) ? patterns : patterns ? [patterns] : [];
+		const files = fast_glob.default.stream(globPatterns, {
+			cwd,
+			absolute: true
+		});
+		if (bustCache) clearZodGlobalRegistry();
+		const constructs = [];
+		for await (const f of files) try {
+			const file = f.toString();
+			const module = await (bustCache ? import(`${file}?t=${Date.now()}`) : import(file));
+			for (const [key, construct] of Object.entries(module)) if (this.isConstruct(construct)) constructs.push({
+				key,
+				name: (0, lodash_kebabcase.default)(key),
+				construct,
+				path: {
+					absolute: file,
+					relative: (0, node_path.relative)(process.cwd(), file)
+				}
+			});
+		} catch (error) {
+			const err = error;
+			logger.error(`Failed to load ${f}: ${err.message}`);
+			if (err.stack) logger.error(err.stack);
+			throw error;
+		}
+		return constructs;
+	}
+};
+//#endregion
+//#region src/sandbox/sandbox.ts
+/**
+* Where a deploy runs the project's own code.
+*
+* A deploy holds credentials — Dokploy's token, a registry login, an AWS key —
+* and loading `gkm.config.ts`, sniffing an app's environment and building it
+* all execute code from the repository being deployed. On a developer's own
+* laptop that is the developer's code. On a CI job for a fork, or a shared
+* build runner, it is not, and that code should not be able to read the
+* credentials used to deploy it, hang the deploy, or reach outside the
+* checkout.
+*
+* So every step that runs project code goes through a `Sandbox`: one call,
+* with an argument array rather than a shell line, the complete environment
+* the step needs rather than the host's, a timeout it cannot outlive, secrets
+* as files rather than variables, and a working directory inside the project.
+* The steps that need credentials — provisioning, pushing, releasing — are
+* the deploy's own code and never run in one.
+*
+* `LocalSandbox` is the default: a child process on this machine with an
+* allowlisted environment. A host that builds repositories it does not trust
+* passes its own — a container per build, a VM — through `deploy()`'s
+* `sandbox`.
+*/
+/** The variable naming the directory a command's secrets are mounted in. */
+const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
+/** A command was asked to run outside the project. */
+var SandboxCwdEscape = class extends Error {
+	cwd;
+	root;
+	constructor(cwd, root) {
+		super(`Refusing to run in '${cwd}': it is outside the project at '${root}'. A sandboxed step only runs inside the project it was given — check the app paths in gkm.config.ts for \`..\` or an absolute path.`);
+		this.cwd = cwd;
+		this.root = root;
+		this.name = "SandboxCwdEscape";
+	}
+};
+/** A path with its symlinks resolved where it exists — `/tmp` is `/private/tmp`. */
+function real(path) {
+	return (0, node_fs.existsSync)(path) ? (0, node_fs.realpathSync)(path) : path;
+}
+/**
+* `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.
+*
+* Symlinks are resolved on both sides first, so a link inside the project
+* that points out of it is an escape, and a project reached through a link
+* (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call
+* before it runs anything.
+*/
+function confineCwd(root, cwd) {
+	const absolute = (0, node_path.resolve)(root, cwd);
+	const from = (0, node_path.relative)(real((0, node_path.resolve)(root)), real(absolute));
+	if (from === ".." || from.startsWith(`..${node_path.sep}`) || (0, node_path.isAbsolute)(from)) throw new SandboxCwdEscape(cwd, root);
+	return absolute;
+}
+/** A secret's file name: one path segment, so it cannot be written elsewhere. */
+var SecretNameInvalid = class extends Error {
+	secretName;
+	constructor(secretName) {
+		super(`'${secretName}' cannot be a secret's name: it becomes a file name in the secrets directory, so it must be one segment of letters, digits, '.', '-' or '_' and not start with '.'.`);
+		this.secretName = secretName;
+		this.name = "SecretNameInvalid";
+	}
+};
+const SECRET_NAME = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
+/** Every secret name, checked before anything is written. */
+function assertSecretNames(secrets) {
+	for (const name of Object.keys(secrets ?? {})) if (!SECRET_NAME.test(name)) throw new SecretNameInvalid(name);
+}
+const active = new node_async_hooks.AsyncLocalStorage();
+/**
+* Run `fn` with `sandbox` as the one its steps use.
+*
+* Per run rather than global, as `withOutput` routes a run's lines: two
+* deploys in one host process each build in their own sandbox. A step deep in
+* the engine — discovering constructs, sniffing an app — asks
+* {@link activeSandbox} rather than every function between `deploy()` and it
+* taking one more parameter.
+*/
+function withSandbox(sandbox, fn) {
+	return active.run({
+		sandbox,
+		answers: /* @__PURE__ */ new Map()
+	}, fn);
+}
+/** The sandbox of the run this is part of, if it was started with one. */
+function activeSandbox() {
+	return active.getStore()?.sandbox;
+}
+/**
+* `ask()`'s answer, asked once per run.
+*
+* A deploy loads its config and discovers its constructs from several places
+* — the first load, the engine, the Dockerfile generator — and in a sandbox
+* each was a child process of its own, for the same answer: the checkout does
+* not change while it deploys. Within a run in `sandbox`, the first answer
+* for `key` is the one every later ask gets. Outside one, or for another
+* sandbox, `ask()` runs each time.
+*/
+function oncePerRun(sandbox, key, ask) {
+	const run = active.getStore();
+	if (!run || run.sandbox !== sandbox) return ask();
+	let answer = run.answers.get(key);
+	if (!answer) {
+		answer = ask();
+		run.answers.set(key, answer);
+		answer.catch(() => run.answers.delete(key));
+	}
+	return answer;
+}
+//#endregion
+//#region src/owningTsconfigJsx.ts
+const REGISTER = "owning-tsconfig-jsx-register.mjs";
+/** The CLI's `bin/` was not found above the module looking for it. */
+var OwningTsconfigJsxHookMissing = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not find bin/${REGISTER} in any directory above '${from}'. It ships with @geekmidas/cli beside bin/gkm.mjs; reinstall the package if it is missing.`);
+		this.from = from;
+		this.name = "OwningTsconfigJsxHookMissing";
+	}
+};
+/**
+* The CLI's `bin/owning-tsconfig-jsx-register.mjs`, as a file URL. Searched
+* upward because this module runs from `src/` in the repo and from a chunk in
+* `dist/` once built, and `bin/` sits beside both.
+*/
+function registerUrl() {
+	const from = (0, node_path.dirname)((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
+	for (let dir = from;; dir = (0, node_path.dirname)(dir)) {
+		const candidate = (0, node_path.join)(dir, "bin", REGISTER);
+		if ((0, node_fs.existsSync)(candidate)) return (0, node_url.pathToFileURL)(candidate).href;
+		if ((0, node_path.dirname)(dir) === dir) throw new OwningTsconfigJsxHookMissing(from);
+	}
+}
+/**
+* `NODE_OPTIONS` for a process that runs app code through tsx, with the hook
+* that compiles each `.tsx` with its own tsconfig's JSX settings (see
+* `bin/owning-tsconfig-jsx.mjs`) put in front of every other `--import`, so it
+* is registered before tsx and reads the source on tsx's behalf.
+*
+* `bin/gkm.mjs` already starts the CLI this way, and its children inherit it;
+* this is for those that set `NODE_OPTIONS` themselves, or whose CLI was
+* started with tsx already imported.
+*/
+function withOwningTsconfigJsx(nodeOptions = "") {
+	if (nodeOptions.includes(REGISTER)) return nodeOptions;
+	return [`--import=${registerUrl()}`, nodeOptions].filter(Boolean).join(" ");
+}
+//#endregion
+//#region src/sandbox/worker.ts
+/**
+* Running one of the CLI's own worker scripts inside a sandbox, and reading
+* back the one JSON value it answers with.
+*
+* The worker imports the project's TypeScript — `gkm.config.ts`, construct
+* modules, an app's entry — so it starts with the CLI's own tsx and the two
+* hooks `gkm` itself runs with (JSX by the owning tsconfig, path aliases by
+* the adjacent one). The host process needs none of them loaded: a program
+* calling `deploy()` without `--import tsx` still loads a TypeScript config.
+*/
+const here = (0, node_path.dirname)((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
+/**
+* A worker's file: `dist/sandbox/<name>.mjs` once built — whether this module
+* was bundled into `dist/` or sits beside it — or the `.ts` source under tsx.
+*/
+function workerFile(name) {
+	return [
+		(0, node_path.join)(here, "sandbox", `${name}.mjs`),
+		(0, node_path.join)(here, `${name}.mjs`),
+		(0, node_path.join)(here, "..", "sandbox", `${name}.mjs`),
+		(0, node_path.join)(here, `${name}.ts`)
+	].find((path) => (0, node_fs.existsSync)(path)) ?? (0, node_path.join)(here, `${name}.ts`);
+}
+/** tsx, from the CLI's own dependencies — never the project's. */
+function tsxUrl() {
+	return (0, node_url.pathToFileURL)((0, node_module.createRequire)(require("url").pathToFileURL(__filename).href).resolve("tsx")).href;
+}
+/**
+* `node`'s arguments for `script`: the CLI's TypeScript loaders, then any
+* further `imports`, then the script and its `args` — an argument array, so
+* nothing about a path is read by a shell.
+*/
+function nodeWithTsx(script, args, imports = []) {
+	return [
+		...withOwningTsconfigJsx(`--import=${tsxUrl()}`).split(" "),
+		...imports.map((path) => `--import=${(0, node_url.pathToFileURL)(path).href}`),
+		script,
+		...args
+	];
+}
+/** A worker ended without the answer it exists to give. */
+var SandboxWorkerFailed = class extends Error {
+	step;
+	exitCode;
+	stderr;
+	constructor(step, exitCode, stderr) {
+		super(`The sandboxed ${step} ended (exit code ${exitCode}) without an answer.${stderr.trim() ? `\n${stderr.trim()}` : ""}\nIts output above says why; the sandbox must be able to run \`node\` with the CLI's own files at the paths they have here.`);
+		this.step = step;
+		this.exitCode = exitCode;
+		this.stderr = stderr;
+		this.name = "SandboxWorkerFailed";
+	}
+};
+/**
+* Run worker `name` in `sandbox`, and parse its answer with `schema`.
+*
+* The answer is the last marked line on stdout. Anything else the project's
+* code printed is ignored, and an answer the schema refuses is a failure
+* rather than data — a worker in an isolating sandbox runs code the host does
+* not trust.
+*
+* Within a run (`withSandbox`), the same worker asked the same question is
+* started once; every ask gets its own copy of the answer, and its stderr, as
+* though it had run again.
+*/
+async function runWorker(sandbox, step, options) {
+	const answer = await oncePerRun(sandbox, JSON.stringify([
+		options.name,
+		options.cwd,
+		options.args,
+		options.env ?? {}
+	]), () => startWorker(sandbox, step, options));
+	return structuredClone(answer);
+}
+async function startWorker(sandbox, step, options) {
+	const result = await sandbox.exec("node", nodeWithTsx(workerFile(options.name), options.args), {
+		cwd: options.cwd,
+		env: {
+			...sandbox.env,
+			...options.env
+		},
+		timeoutMs: options.timeoutMs,
+		output: "capture",
+		...options.signal ? { signal: options.signal } : {}
+	});
+	const line = result.stdout.split("\n").reverse().find((l) => l.startsWith(require_workerRuntime.WORKER_RESULT_MARKER));
+	if (line) try {
+		const parsed = options.schema.safeParse(JSON.parse(line.slice(require_workerRuntime.WORKER_RESULT_MARKER.length)));
+		if (parsed.success) return {
+			value: parsed.data,
+			stderr: result.stderr
+		};
+	} catch {}
+	throw new SandboxWorkerFailed(step, result.exitCode, result.stderr);
+}
+//#endregion
+//#region src/reconcile/discover.ts
+/**
+* Discovery — one glob, one structural test.
+*
+* A glob per kind is the same specialness the construct model removes, and
+* resources have no kind to be listed under: a declared `ObjectStorage` would
+* never be found by `routes:` or `crons:`. So there is one `constructs` glob,
+* every export of every matching module is inspected, and the per-kind
+* `isConstruct` checks collapse into a single question — does it have an id and
+* can it declare?
+*
+* Structural rather than `instanceof` on purpose. A construct from a different
+* copy of `@geekmidas/constructs` — a linked workspace, two versions in a
+* lockfile — is still a construct, and `instanceof` is exactly the check that
+* says otherwise.
+*/
+var discover_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	ConstructDiscoveryFailed: () => ConstructDiscoveryFailed,
+	ConstructsNotSerializable: () => ConstructsNotSerializable,
+	DuplicateConstruct: () => DuplicateConstruct,
+	LiveConstructsUnavailable: () => LiveConstructsUnavailable,
+	discover: () => discover,
+	isDeclarable: () => isDeclarable
+});
+/** `console`, or the deploy run discovering the manifest. */
+const logger = output;
+/**
+* Whether a module export is a construct.
+*
+* Deliberately loose about what else it carries — a construct that also has a
+* `service` is still a construct, and requiring one would exclude the kinds that
+* own no address.
+*/
+function isDeclarable(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.id === "string" && candidate.id.length > 0 && typeof candidate.declare === "function";
+}
+/** What the discovery worker answers. Checked: the worker ran project code. */
+const DiscoverAnswer = require_schemas.discriminatedUnion("reason", [
+	require_schemas.object({
+		reason: require_schemas.literal("discovered"),
+		manifest: require_schemas.record(require_schemas.string(), require_schemas.object({
+			id: require_schemas.string(),
+			kind: require_schemas.string()
+		}).loose()),
+		runnables: require_schemas.record(require_schemas.string(), require_schemas.array(require_schemas.string()))
+	}),
+	require_schemas.object({
+		reason: require_schemas.literal("live"),
+		paths: require_schemas.array(require_schemas.string())
+	}),
+	require_schemas.object({
+		reason: require_schemas.literal("failed"),
+		error: require_schemas.object({
+			name: require_schemas.string(),
+			message: require_schemas.string(),
+			id: require_schemas.string().optional(),
+			sources: require_schemas.array(require_schemas.string()).optional()
+		}).loose()
+	})
+]);
+/**
+* The manifest, discovered in `sandbox` and handed back as JSON — or
+* `undefined` when it holds something JSON cannot carry and the sandbox is
+* not isolating, for the caller to discover here as before.
+*/
+async function discoverInSandbox(sandbox, options) {
+	const cwd = options.cwd ?? sandbox.root;
+	const patterns = typeof options.patterns === "string" ? [options.patterns] : [...options.patterns];
+	const { value, stderr } = await runWorker(sandbox, "construct discovery", {
+		name: "discover-worker",
+		args: [JSON.stringify({
+			patterns,
+			cwd
+		})],
+		cwd,
+		timeoutMs: DISCOVER_TIMEOUT_MS,
+		schema: DiscoverAnswer
+	});
+	if (stderr.trim()) logger.warn(stderr.replace(/\n$/, ""));
+	switch (value.reason) {
+		case "discovered":
+			if (options.runnables) for (const [owner, edges] of Object.entries(value.runnables)) options.runnables[owner] = edges;
+			return value.manifest;
+		case "failed":
+			if (value.error.name === "DuplicateConstruct" && value.error.id) throw new DuplicateConstruct(value.error.id, value.error.sources ?? []);
+			throw new ConstructDiscoveryFailed(value.error.name, value.error.message);
+		case "live":
+			if (sandbox.isolating) throw new ConstructsNotSerializable(value.paths);
+			return;
+	}
+}
+/**
+* A caller asked for the construct objects (`sources`) or a watcher's
+* re-import under an isolating sandbox, where only data comes back.
+*/
+var LiveConstructsUnavailable = class extends Error {
+	constructor() {
+		super("Discovery was asked for the construct objects themselves under an isolating sandbox, which hands back only data. Run this step without one, or ask only for the manifest.");
+		this.name = "LiveConstructsUnavailable";
+	}
+};
+/** How long discovering a project's constructs may take in a sandbox. */
+const DISCOVER_TIMEOUT_MS = 6e4;
+/** Importing a construct module, or declaring one, threw in the sandbox. */
+var ConstructDiscoveryFailed = class extends Error {
+	errorName;
+	detail;
+	constructor(errorName, detail) {
+		super(`Discovering constructs failed (${errorName}): ${detail}`);
+		this.errorName = errorName;
+		this.detail = detail;
+		this.name = "ConstructDiscoveryFailed";
+	}
+};
+/**
+* The constructs' declarations hold something that is not data, and the
+* sandbox they were discovered in hands the deploy nothing but data.
+*/
+var ConstructsNotSerializable = class extends Error {
+	paths;
+	constructor(paths) {
+		super(`The construct manifest holds values that are not plain data at: ${paths.join(", ")}. Under an isolating sandbox the deploy only receives what JSON can carry; deploy with a sandbox that is not isolating if the host trusts this project.`);
+		this.paths = paths;
+		this.name = "ConstructsNotSerializable";
+	}
+};
+/**
+* Build the construct manifest for a project.
+*
+* Runs the manifest's own validation before returning, so an app is wrong here
+* — where the error names a file — rather than at deploy.
+*
+* @throws {DuplicateConstruct} when two exports claim one id.
+*/
+async function discover(options) {
+	const sandbox = options.sandbox ?? activeSandbox();
+	if (sandbox) {
+		if (!options.sources && !options.bustCache) {
+			const sandboxed = await discoverInSandbox(sandbox, options);
+			if (sandboxed) return sandboxed;
+		} else if (sandbox.isolating) throw new LiveConstructsUnavailable();
+	}
+	const { patterns, cwd = process.cwd(), bustCache = false, sources: out } = options;
+	if (bustCache) clearZodGlobalRegistry();
+	const manifest = {};
+	/** Which file declared each id, for the error when two of them do. */
+	const sources = {};
+	/**
+	* Constructs already seen, by identity.
+	*
+	* A re-export is the *same object* reached through a second file — ESM
+	* bindings are live, so `export * from './database.js'` hands back the
+	* binding rather than a copy. Without this, a barrel file made every
+	* construct in it appear declared twice, and `constructs/index.ts` is the
+	* first thing anyone writes in a shared folder.
+	*
+	* Identity rather than file is also the more honest rule: what may not
+	* happen twice is two *different* constructs claiming one id, and that is
+	* still an error below.
+	*/
+	const seen = /* @__PURE__ */ new WeakSet();
+	const globs = Array.isArray(patterns) ? [...patterns] : [patterns];
+	const files = fast_glob.default.stream(globs, {
+		cwd,
+		absolute: true
+	});
+	/** Matched files, for the diagnostic below. */
+	let matched = 0;
+	for await (const found of files) {
+		matched++;
+		const file = found.toString();
+		const module = await (bustCache ? import(`${file}?t=${Date.now()}`) : import(file));
+		for (const [exportName, exported] of Object.entries(module)) {
+			if (!isDeclarable(exported)) {
+				if (options.runnables) recordRunnable(options.runnables, exported);
+				continue;
+			}
+			if (seen.has(exported)) continue;
+			seen.add(exported);
+			if (options.runnables && typeof exported.owner === "string") recordRunnable(options.runnables, exported);
+			for (const declaration of exported.declare()) {
+				const id = (0, _geekmidas_manifest.canonicalId)(declaration.id);
+				const source = (0, node_path.relative)(cwd, file);
+				const claimed = sources[id];
+				if (claimed !== void 0 && claimed !== source) throw new DuplicateConstruct(id, [claimed, source]);
+				manifest[id] = {
+					...declaration,
+					id
+				};
+				sources[id] = source;
+				if (out) out[id] = {
+					file,
+					exportName,
+					construct: exported
+				};
+			}
+		}
+	}
+	(0, _geekmidas_manifest.assertDerivations)(manifest);
+	warnIfNothingFound(globs, matched, Object.keys(manifest).length);
+	return manifest;
+}
+/**
+* Record a runnable's edges under the construct that owns it — the surface an
+* endpoint was built from, or the worker a cron or subscriber was. Anything
+* with no owner, or that is not a runnable at all, is left alone.
+*/
+function recordRunnable(runnables, exported) {
+	if (typeof exported !== "object" || exported === null) return;
+	const runnable = exported;
+	const owner = typeof runnable.surface?.id === "string" ? runnable.surface.id : typeof runnable.owner === "string" ? runnable.owner : void 0;
+	if (!owner || !Array.isArray(runnable.constructs)) return;
+	const key = (0, _geekmidas_manifest.canonicalId)(owner);
+	const edges = runnables[key] ?? [];
+	runnables[key] = edges;
+	for (const id of runnable.constructs) {
+		if (typeof id !== "string") continue;
+		const target = (0, _geekmidas_manifest.canonicalId)(id);
+		if (!edges.includes(target)) edges.push(target);
+	}
+}
+/**
+* Say so when a glob was configured and found nothing.
+*
+* The glob is not a filter over declarations already known — it is *how they
+* are found*, by importing what it matches. So a file it misses is a
+* declaration that does not exist, and every symptom of that appears somewhere
+* other than the cause: no container starts, no env key is written, and the
+* application fails on first use against a resource it can see in its own
+* source.
+*
+* Nothing reported it before, because an unmatched file is indistinguishable
+* from a file nobody wrote. These two cases are the ones that are *not*
+* ambiguous — a glob was configured, so something was expected.
+*
+* Silent when no glob is configured at all: that is a project which has not
+* adopted constructs, and has nothing to be missing.
+*/
+function warnIfNothingFound(globs, matched, declared) {
+	if (globs.length === 0) return;
+	if (matched === 0) {
+		logger.warn(`\n⚠️  The constructs glob matched no files, so nothing was declared.\n   Patterns: ${globs.join(", ")}\n   Nothing will be provisioned — no containers, no env keys, no resources.\n   A common cause is depth: '*.ts' matches one level, '**/*.ts' matches any.`);
+		return;
+	}
+	if (declared === 0) logger.warn(`\n⚠️  The constructs glob matched ${matched} file(s) but none declared anything.\n   Patterns: ${globs.join(", ")}\n   Discovery keeps exports with an 'id' that can 'declare()'. A construct that is\n   built but never exported is invisible to it.`);
+}
+/** Two constructs claiming one id. */
+var DuplicateConstruct = class extends Error {
+	/** The id claimed twice. */
+	id;
+	/** The files that claimed it. */
+	sources;
+	constructor(id, sources) {
+		super("Two constructs declare the same id");
+		this.name = "DuplicateConstruct";
+		this.id = id;
+		this.sources = sources;
+	}
+};
+//#endregion
+Object.defineProperty(exports, "ConstructDiscoveryFailed", {
+	enumerable: true,
+	get: function() {
+		return ConstructDiscoveryFailed;
+	}
+});
+Object.defineProperty(exports, "ConstructGenerator", {
+	enumerable: true,
+	get: function() {
+		return ConstructGenerator;
+	}
+});
+Object.defineProperty(exports, "ConstructsNotSerializable", {
+	enumerable: true,
+	get: function() {
+		return ConstructsNotSerializable;
+	}
+});
+Object.defineProperty(exports, "SECRETS_DIR_ENV", {
+	enumerable: true,
+	get: function() {
+		return SECRETS_DIR_ENV;
+	}
+});
+Object.defineProperty(exports, "SandboxCwdEscape", {
+	enumerable: true,
+	get: function() {
+		return SandboxCwdEscape;
+	}
+});
+Object.defineProperty(exports, "SandboxWorkerFailed", {
+	enumerable: true,
+	get: function() {
+		return SandboxWorkerFailed;
+	}
+});
+Object.defineProperty(exports, "SecretNameInvalid", {
+	enumerable: true,
+	get: function() {
+		return SecretNameInvalid;
+	}
+});
+Object.defineProperty(exports, "activeSandbox", {
+	enumerable: true,
+	get: function() {
+		return activeSandbox;
+	}
+});
+Object.defineProperty(exports, "assertSecretNames", {
+	enumerable: true,
+	get: function() {
+		return assertSecretNames;
+	}
+});
+Object.defineProperty(exports, "confineCwd", {
+	enumerable: true,
+	get: function() {
+		return confineCwd;
+	}
+});
+Object.defineProperty(exports, "discover", {
+	enumerable: true,
+	get: function() {
+		return discover;
+	}
+});
+Object.defineProperty(exports, "discover_exports", {
+	enumerable: true,
+	get: function() {
+		return discover_exports;
+	}
+});
+Object.defineProperty(exports, "isDeclarable", {
+	enumerable: true,
+	get: function() {
+		return isDeclarable;
+	}
+});
+Object.defineProperty(exports, "nodeWithTsx", {
+	enumerable: true,
+	get: function() {
+		return nodeWithTsx;
+	}
+});
+Object.defineProperty(exports, "output", {
+	enumerable: true,
+	get: function() {
+		return output;
+	}
+});
+Object.defineProperty(exports, "runWorker", {
+	enumerable: true,
+	get: function() {
+		return runWorker;
+	}
+});
+Object.defineProperty(exports, "withOutput", {
+	enumerable: true,
+	get: function() {
+		return withOutput;
+	}
+});
+Object.defineProperty(exports, "withOwningTsconfigJsx", {
+	enumerable: true,
+	get: function() {
+		return withOwningTsconfigJsx;
+	}
+});
+Object.defineProperty(exports, "withSandbox", {
+	enumerable: true,
+	get: function() {
+		return withSandbox;
+	}
+});
+
+//# sourceMappingURL=discover-C_6COHEv.cjs.map