@geekmidas/cli 10.0.0-alpha.62 → 10.0.0-alpha.63

package/dist/{resolve-wbv66HjD.cjs.map → resolve-xytBTtG4.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"resolve-wbv66HjD.cjs","names":["DeployTargetNotYetSupported","builtinTarget","DeployTargetNotYetSupported","configuredTarget","UnknownDeployTarget","configurableBuiltins","declaredRuntime","importPackage","isDeployTarget"],"sources":["../src/target/provider.ts","../src/target/resolve.ts"],"sourcesContent":["/**\n * `gkm deploy --provider`, from before there were targets.\n *\n * It named three things, and only one of them ever deployed a workspace:\n * `dokploy` is now the target of that name; `docker` and `aws-lambda` were\n * accepted and always failed, so they are gone with a pointer to what does\n * the job.\n */\n\nimport { DeployTargetNotYetSupported } from './builtins';\n\n/** What each removed provider's job is done with now. */\nconst REMOVED: Record<string, string> = {\n\tdocker:\n\t\t'Build images with `gkm docker`, or run the stage as one Docker Compose stack with `gkm compose`',\n\t'aws-lambda':\n\t\t\"Deploy to AWS with SST: set deploy: { default: 'sst' } and run `gkm build && sst deploy --stage <stage>`\",\n};\n\n/** A `--provider` that no longer exists. */\nexport class ProviderRemoved extends Error {\n\tconstructor(\n\t\treadonly provider: string,\n\t\t/** What to use instead. */\n\t\treadonly instead: string,\n\t) {\n\t\tsuper(`--provider ${provider} has been removed. ${instead}.`);\n\t\tthis.name = 'ProviderRemoved';\n\t}\n}\n\n/** The deprecation `--provider` prints when it still means something. */\nexport function providerDeprecation(provider: string): string {\n\treturn `--provider is deprecated; use --target ${provider}.`;\n}\n\n/**\n * The target a `--provider` value means. `warn` hears the deprecation; a\n * provider that is gone, or a target not deployable yet, throws.\n */\nexport function targetForProvider(\n\tprovider: string,\n\twarn: (message: string) => void,\n): string {\n\tconst removed = REMOVED[provider];\n\tif (removed) throw new ProviderRemoved(provider, removed);\n\tif (provider === 'vercel' || provider === 'cloudflare') {\n\t\tthrow new DeployTargetNotYetSupported(provider);\n\t}\n\twarn(providerDeprecation(provider));\n\treturn provider;\n}\n","/**\n * From a target's name to the target.\n *\n * In this order, the first that has the name wins:\n *\n * 1. the host's own targets — what a program calling `deploy()` passes\n * 2. the built-ins — `dokploy`\n * 3. `deploy.targets` in gkm.config.ts — a package, an object, or either\n *    with options\n *\n * Built-ins come before the config so that a dependency cannot take over\n * `dokploy` by being listed under its name. A name nothing has is\n * `UnknownDeployTarget`. There is deliberately no fourth step that guesses a\n * package from the name (`acme` → `@acme/gkm-target`): an npm scope nobody\n * has claimed can be claimed by anyone, and a deploy would then run their\n * code with the stage's credentials. A target is installed and named.\n */\n\nimport {\n\tbuiltinTarget,\n\tconfigurableBuiltins,\n\tconfiguredTarget,\n\tDeployTargetNotYetSupported,\n\tUnknownDeployTarget,\n} from './builtins';\nimport { isDeployTarget } from './define';\nimport { importPackage } from './package';\nimport { declaredRuntime } from './runtime';\nimport type {\n\tAnyDeployTarget,\n\tDeployRuntime,\n\tDeployTargetEntry,\n\tTargetOptionsIssue,\n} from './types';\n\n/** Where a target came from. */\nexport type TargetSourceKind = 'host' | 'builtin' | 'config';\n\nexport interface ResolvedTarget {\n\t/** The name it was asked for by. */\n\tname: string;\n\ttarget: AnyDeployTarget;\n\tsource: TargetSourceKind;\n\t/** Its options as written in the config, before its schema parsed them. */\n\toptions: unknown;\n}\n\nexport interface ResolveTargetOptions {\n\t/** The workspace whose `deploy.targets` is consulted. */\n\tworkspace: {\n\t\troot: string;\n\t\tdeploy?: { targets?: Record<string, DeployTargetEntry> } | undefined;\n\t};\n\t/** The host's targets, consulted first. */\n\thost?: Record<string, AnyDeployTarget>;\n\t/** The stage being deployed, for what to do instead of a refused target. */\n\tstage: string;\n}\n\n/** A target package whose default export is not a target. */\nexport class TargetPackageInvalid extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t) {\n\t\tsuper(\n\t\t\t`deploy.targets.${target} names \"${packageName}\", whose default export is not a deploy target. A target package exports one as default: export default defineTarget({ … }) from '@geekmidas/cli/target'.`,\n\t\t);\n\t\tthis.name = 'TargetPackageInvalid';\n\t}\n}\n\n/** A `deploy.targets` entry that is not a target, a package name or a pair. */\nexport class TargetEntryInvalid extends Error {\n\tconstructor(readonly target: string) {\n\t\tsuper(\n\t\t\t`deploy.targets.${target} must be a package name, a target object (defineTarget), or [package or target, options].`,\n\t\t);\n\t\tthis.name = 'TargetEntryInvalid';\n\t}\n}\n\n/** A target whose `runtime` is not the one its package declares. */\nexport class TargetRuntimeMismatch extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t\treadonly declared: DeployRuntime,\n\t\treadonly actual: DeployRuntime,\n\t) {\n\t\tsuper(\n\t\t\t`The deploy target \"${target}\" runs on \"${actual}\", but ${packageName}'s package.json declares gkm.runtime \"${declared}\". gkm dev and gkm build chose backends for \"${declared}\", so the two must agree — fix the package.`,\n\t\t);\n\t\tthis.name = 'TargetRuntimeMismatch';\n\t}\n}\n\n/** Options a target's schema rejected. */\nexport class InvalidTargetOptions extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly issues: readonly TargetOptionsIssue[],\n\t) {\n\t\tconst lines = issues.map((issue) => {\n\t\t\tconst path = (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.');\n\t\t\treturn `  - ${path ? `${path}: ` : ''}${issue.message}`;\n\t\t});\n\t\tsuper(\n\t\t\t`The options for deploy target \"${target}\" are invalid — fix them in deploy.targets.${target} in gkm.config.ts:\\n${lines.join('\\n')}`,\n\t\t);\n\t\tthis.name = 'InvalidTargetOptions';\n\t}\n}\n\n/** The built-ins `gkm deploy` deploys through, loaded only when used. */\nconst BUILTIN_LOADERS: Record<string, () => Promise<AnyDeployTarget>> = {\n\tdokploy: async () => (await import('./dokploy')).dokployTarget,\n};\n\n/** The target `name` means, in this workspace, for this host. */\nexport async function resolveTarget(\n\tname: string,\n\t{ workspace, host, stage }: ResolveTargetOptions,\n): Promise<ResolvedTarget> {\n\tif (host && Object.hasOwn(host, name)) {\n\t\treturn { name, target: host[name]!, source: 'host', options: undefined };\n\t}\n\n\tconst builtin = builtinTarget(name);\n\tif (builtin) {\n\t\tconst load = BUILTIN_LOADERS[name];\n\t\tif (builtin.status !== 'available' || !load) {\n\t\t\tthrow new DeployTargetNotYetSupported(name, builtin.instead?.(stage));\n\t\t}\n\t\treturn {\n\t\t\tname,\n\t\t\ttarget: await load(),\n\t\t\tsource: 'builtin',\n\t\t\toptions: undefined,\n\t\t};\n\t}\n\n\tconst entry = configuredTarget(workspace.deploy, name);\n\tif (entry === undefined) {\n\t\tthrow new UnknownDeployTarget(name, [\n\t\t\t...configurableBuiltins(),\n\t\t\t...Object.keys(workspace.deploy?.targets ?? {}),\n\t\t]);\n\t}\n\n\tconst [implementation, options] = Array.isArray(entry)\n\t\t? (entry as readonly [unknown, unknown])\n\t\t: [entry, undefined];\n\n\tif (typeof implementation === 'string') {\n\t\t// Before the import: a package that does not say where it runs is\n\t\t// refused without running any of its code.\n\t\tconst declared = declaredRuntime(name, implementation, workspace.root);\n\t\tconst loaded = await importPackage(name, implementation, workspace.root);\n\t\tconst target = loaded.default;\n\t\tif (!isDeployTarget(target)) {\n\t\t\tthrow new TargetPackageInvalid(name, implementation);\n\t\t}\n\t\tif (target.runtime !== declared) {\n\t\t\tthrow new TargetRuntimeMismatch(\n\t\t\t\tname,\n\t\t\t\timplementation,\n\t\t\t\tdeclared,\n\t\t\t\ttarget.runtime,\n\t\t\t);\n\t\t}\n\t\treturn { name, target, source: 'config', options };\n\t}\n\n\tif (!isDeployTarget(implementation)) throw new TargetEntryInvalid(name);\n\treturn { name, target: implementation, source: 'config', options };\n}\n\n/** The target's options, parsed by its schema. */\nexport async function parseTargetOptions(\n\tresolved: ResolvedTarget,\n): Promise<unknown> {\n\tconst { name, target, options } = resolved;\n\tif (!target.options) {\n\t\tif (options !== undefined) {\n\t\t\tthrow new InvalidTargetOptions(name, [\n\t\t\t\t{ message: 'this target takes no options' },\n\t\t\t]);\n\t\t}\n\t\treturn undefined;\n\t}\n\n\tconst result = await target.options['~standard'].validate(options);\n\tif (result.issues) throw new InvalidTargetOptions(name, result.issues);\n\treturn result.value;\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,UAAkC;CACvC,QACC;CACD,cACC;AACF;;AAGA,IAAa,kBAAb,cAAqC,MAAM;CAEhC;CAEA;CAHV,YACC,UAEA,SACC;EACD,MAAM,cAAc,SAAS,qBAAqB,QAAQ,EAAE;EAJnD,KAAA,WAAA;EAEA,KAAA,UAAA;EAGT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,oBAAoB,UAA0B;CAC7D,OAAO,0CAA0C,SAAS;AAC3D;;;;;AAMA,SAAgB,kBACf,UACA,MACS;CACT,MAAM,UAAU,QAAQ;CACxB,IAAI,SAAS,MAAM,IAAI,gBAAgB,UAAU,OAAO;CACxD,IAAI,aAAa,YAAY,aAAa,cACzC,MAAM,IAAIA,eAAAA,4BAA4B,QAAQ;CAE/C,KAAK,oBAAoB,QAAQ,CAAC;CAClC,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;ACSA,IAAa,uBAAb,cAA0C,MAAM;CAErC;CACA;CAFV,YACC,QACA,aACC;EACD,MACC,kBAAkB,OAAO,UAAU,YAAY,0JAChD;EALS,KAAA,SAAA;EACA,KAAA,cAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CACxB;CAArB,YAAY,QAAyB;EACpC,MACC,kBAAkB,OAAO,0FAC1B;EAHoB,KAAA,SAAA;EAIpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CACA;CACA;CAJV,YACC,QACA,aACA,UACA,QACC;EACD,MACC,sBAAsB,OAAO,aAAa,OAAO,SAAS,YAAY,wCAAwC,SAAS,+CAA+C,SAAS,4CAChL;EAPS,KAAA,SAAA;EACA,KAAA,cAAA;EACA,KAAA,WAAA;EACA,KAAA,SAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,uBAAb,cAA0C,MAAM;CAErC;CACA;CAFV,YACC,QACA,QACC;EACD,MAAM,QAAQ,OAAO,KAAK,UAAU;GACnC,MAAM,QAAQ,MAAM,QAAQ,CAAC,EAAA,CAC3B,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,OAAO,OAAO,OAAO,GAAG,KAAK,MAAM,KAAK,MAAM;EAC/C,CAAC;EACD,MACC,kCAAkC,OAAO,6CAA6C,OAAO,sBAAsB,MAAM,KAAK,IAAI,GACnI;EAbS,KAAA,SAAA;EACA,KAAA,SAAA;EAaT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,kBAAkE,EACvE,SAAS,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,EAAA,CAAqB,cAClD;;AAGA,eAAsB,cACrB,MACA,EAAE,WAAW,MAAM,SACO;CAC1B,IAAI,QAAQ,OAAO,OAAO,MAAM,IAAI,GACnC,OAAO;EAAE;EAAM,QAAQ,KAAK;EAAQ,QAAQ;EAAQ,SAAS,KAAA;CAAU;CAGxE,MAAM,UAAUC,eAAAA,cAAc,IAAI;CAClC,IAAI,SAAS;EACZ,MAAM,OAAO,gBAAgB;EAC7B,IAAI,QAAQ,WAAW,eAAe,CAAC,MACtC,MAAM,IAAIC,eAAAA,4BAA4B,MAAM,QAAQ,UAAU,KAAK,CAAC;EAErE,OAAO;GACN;GACA,QAAQ,MAAM,KAAK;GACnB,QAAQ;GACR,SAAS,KAAA;EACV;CACD;CAEA,MAAM,QAAQC,eAAAA,iBAAiB,UAAU,QAAQ,IAAI;CACrD,IAAI,UAAU,KAAA,GACb,MAAM,IAAIC,eAAAA,oBAAoB,MAAM,CACnC,GAAGC,eAAAA,qBAAqB,GACxB,GAAG,OAAO,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,CAC/C,CAAC;CAGF,MAAM,CAAC,gBAAgB,WAAW,MAAM,QAAQ,KAAK,IACjD,QACD,CAAC,OAAO,KAAA,CAAS;CAEpB,IAAI,OAAO,mBAAmB,UAAU;EAGvC,MAAM,WAAWC,gBAAAA,gBAAgB,MAAM,gBAAgB,UAAU,IAAI;EAErE,MAAM,UAAS,MADMC,gBAAAA,cAAc,MAAM,gBAAgB,UAAU,IAAI,EAAA,CACjD;EACtB,IAAI,CAACC,eAAAA,eAAe,MAAM,GACzB,MAAM,IAAI,qBAAqB,MAAM,cAAc;EAEpD,IAAI,OAAO,YAAY,UACtB,MAAM,IAAI,sBACT,MACA,gBACA,UACA,OAAO,OACR;EAED,OAAO;GAAE;GAAM;GAAQ,QAAQ;GAAU;EAAQ;CAClD;CAEA,IAAI,CAACA,eAAAA,eAAe,cAAc,GAAG,MAAM,IAAI,mBAAmB,IAAI;CACtE,OAAO;EAAE;EAAM,QAAQ;EAAgB,QAAQ;EAAU;CAAQ;AAClE;;AAGA,eAAsB,mBACrB,UACmB;CACnB,MAAM,EAAE,MAAM,QAAQ,YAAY;CAClC,IAAI,CAAC,OAAO,SAAS;EACpB,IAAI,YAAY,KAAA,GACf,MAAM,IAAI,qBAAqB,MAAM,CACpC,EAAE,SAAS,+BAA+B,CAC3C,CAAC;EAEF;CACD;CAEA,MAAM,SAAS,MAAM,OAAO,QAAQ,YAAY,CAAC,SAAS,OAAO;CACjE,IAAI,OAAO,QAAQ,MAAM,IAAI,qBAAqB,MAAM,OAAO,MAAM;CACrE,OAAO,OAAO;AACf"}
+{"version":3,"file":"resolve-xytBTtG4.cjs","names":["DeployTargetNotYetSupported","builtinTarget","DeployTargetNotYetSupported","configuredTarget","UnknownDeployTarget","configurableBuiltins","declaredRuntime","importPackage","isDeployTarget"],"sources":["../src/target/provider.ts","../src/target/resolve.ts"],"sourcesContent":["/**\n * `gkm deploy --provider`, from before there were targets.\n *\n * It named three things, and only one of them ever deployed a workspace:\n * `dokploy` is now the target of that name; `docker` and `aws-lambda` were\n * accepted and always failed, so they are gone with a pointer to what does\n * the job.\n */\n\nimport { DeployTargetNotYetSupported } from './builtins';\n\n/** What each removed provider's job is done with now. */\nconst REMOVED: Record<string, string> = {\n\tdocker:\n\t\t'Build images with `gkm docker`, or run the stage as one Docker Compose stack with `gkm compose`',\n\t'aws-lambda':\n\t\t\"Deploy to AWS with SST: set deploy: { default: 'sst' } and run `gkm build && sst deploy --stage <stage>`\",\n};\n\n/** A `--provider` that no longer exists. */\nexport class ProviderRemoved extends Error {\n\tconstructor(\n\t\treadonly provider: string,\n\t\t/** What to use instead. */\n\t\treadonly instead: string,\n\t) {\n\t\tsuper(`--provider ${provider} has been removed. ${instead}.`);\n\t\tthis.name = 'ProviderRemoved';\n\t}\n}\n\n/** The deprecation `--provider` prints when it still means something. */\nexport function providerDeprecation(provider: string): string {\n\treturn `--provider is deprecated; use --target ${provider}.`;\n}\n\n/**\n * The target a `--provider` value means. `warn` hears the deprecation; a\n * provider that is gone, or a target not deployable yet, throws.\n */\nexport function targetForProvider(\n\tprovider: string,\n\twarn: (message: string) => void,\n): string {\n\tconst removed = REMOVED[provider];\n\tif (removed) throw new ProviderRemoved(provider, removed);\n\tif (provider === 'vercel' || provider === 'cloudflare') {\n\t\tthrow new DeployTargetNotYetSupported(provider);\n\t}\n\twarn(providerDeprecation(provider));\n\treturn provider;\n}\n","/**\n * From a target's name to the target.\n *\n * In this order, the first that has the name wins:\n *\n * 1. the host's own targets — what a program calling `deploy()` passes\n * 2. the built-ins — `dokploy`\n * 3. `deploy.targets` in gkm.config.ts — a package, an object, or either\n *    with options\n *\n * Built-ins come before the config so that a dependency cannot take over\n * `dokploy` by being listed under its name. A name nothing has is\n * `UnknownDeployTarget`. There is deliberately no fourth step that guesses a\n * package from the name (`acme` → `@acme/gkm-target`): an npm scope nobody\n * has claimed can be claimed by anyone, and a deploy would then run their\n * code with the stage's credentials. A target is installed and named.\n */\n\nimport {\n\tbuiltinTarget,\n\tconfigurableBuiltins,\n\tconfiguredTarget,\n\tDeployTargetNotYetSupported,\n\tUnknownDeployTarget,\n} from './builtins';\nimport { isDeployTarget } from './define';\nimport { importPackage } from './package';\nimport { declaredRuntime } from './runtime';\nimport type {\n\tAnyDeployTarget,\n\tDeployRuntime,\n\tDeployTargetEntry,\n\tTargetOptionsIssue,\n} from './types';\n\n/** Where a target came from. */\nexport type TargetSourceKind = 'host' | 'builtin' | 'config';\n\nexport interface ResolvedTarget {\n\t/** The name it was asked for by. */\n\tname: string;\n\ttarget: AnyDeployTarget;\n\tsource: TargetSourceKind;\n\t/** Its options as written in the config, before its schema parsed them. */\n\toptions: unknown;\n}\n\nexport interface ResolveTargetOptions {\n\t/** The workspace whose `deploy.targets` is consulted. */\n\tworkspace: {\n\t\troot: string;\n\t\tdeploy?: { targets?: Record<string, DeployTargetEntry> } | undefined;\n\t};\n\t/** The host's targets, consulted first. */\n\thost?: Record<string, AnyDeployTarget>;\n\t/** The stage being deployed, for what to do instead of a refused target. */\n\tstage: string;\n}\n\n/** A target package whose default export is not a target. */\nexport class TargetPackageInvalid extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t) {\n\t\tsuper(\n\t\t\t`deploy.targets.${target} names \"${packageName}\", whose default export is not a deploy target. A target package exports one as default: export default defineTarget({ … }) from '@geekmidas/cli/target'.`,\n\t\t);\n\t\tthis.name = 'TargetPackageInvalid';\n\t}\n}\n\n/** A `deploy.targets` entry that is not a target, a package name or a pair. */\nexport class TargetEntryInvalid extends Error {\n\tconstructor(readonly target: string) {\n\t\tsuper(\n\t\t\t`deploy.targets.${target} must be a package name, a target object (defineTarget), or [package or target, options].`,\n\t\t);\n\t\tthis.name = 'TargetEntryInvalid';\n\t}\n}\n\n/** A target whose `runtime` is not the one its package declares. */\nexport class TargetRuntimeMismatch extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t\treadonly declared: DeployRuntime,\n\t\treadonly actual: DeployRuntime,\n\t) {\n\t\tsuper(\n\t\t\t`The deploy target \"${target}\" runs on \"${actual}\", but ${packageName}'s package.json declares gkm.runtime \"${declared}\". gkm dev and gkm build chose backends for \"${declared}\", so the two must agree — fix the package.`,\n\t\t);\n\t\tthis.name = 'TargetRuntimeMismatch';\n\t}\n}\n\n/** Options a target's schema rejected. */\nexport class InvalidTargetOptions extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly issues: readonly TargetOptionsIssue[],\n\t) {\n\t\tconst lines = issues.map((issue) => {\n\t\t\tconst path = (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.');\n\t\t\treturn `  - ${path ? `${path}: ` : ''}${issue.message}`;\n\t\t});\n\t\tsuper(\n\t\t\t`The options for deploy target \"${target}\" are invalid — fix them in deploy.targets.${target} in gkm.config.ts:\\n${lines.join('\\n')}`,\n\t\t);\n\t\tthis.name = 'InvalidTargetOptions';\n\t}\n}\n\n/** The built-ins `gkm deploy` deploys through, loaded only when used. */\nconst BUILTIN_LOADERS: Record<string, () => Promise<AnyDeployTarget>> = {\n\tdokploy: async () => (await import('./dokploy')).dokployTarget,\n};\n\n/** The target `name` means, in this workspace, for this host. */\nexport async function resolveTarget(\n\tname: string,\n\t{ workspace, host, stage }: ResolveTargetOptions,\n): Promise<ResolvedTarget> {\n\tif (host && Object.hasOwn(host, name)) {\n\t\treturn { name, target: host[name]!, source: 'host', options: undefined };\n\t}\n\n\tconst builtin = builtinTarget(name);\n\tif (builtin) {\n\t\tconst load = BUILTIN_LOADERS[name];\n\t\tif (builtin.status !== 'available' || !load) {\n\t\t\tthrow new DeployTargetNotYetSupported(name, builtin.instead?.(stage));\n\t\t}\n\t\treturn {\n\t\t\tname,\n\t\t\ttarget: await load(),\n\t\t\tsource: 'builtin',\n\t\t\toptions: undefined,\n\t\t};\n\t}\n\n\tconst entry = configuredTarget(workspace.deploy, name);\n\tif (entry === undefined) {\n\t\tthrow new UnknownDeployTarget(name, [\n\t\t\t...configurableBuiltins(),\n\t\t\t...Object.keys(workspace.deploy?.targets ?? {}),\n\t\t]);\n\t}\n\n\tconst [implementation, options] = Array.isArray(entry)\n\t\t? (entry as readonly [unknown, unknown])\n\t\t: [entry, undefined];\n\n\tif (typeof implementation === 'string') {\n\t\t// Before the import: a package that does not say where it runs is\n\t\t// refused without running any of its code.\n\t\tconst declared = declaredRuntime(name, implementation, workspace.root);\n\t\tconst loaded = await importPackage(name, implementation, workspace.root);\n\t\tconst target = loaded.default;\n\t\tif (!isDeployTarget(target)) {\n\t\t\tthrow new TargetPackageInvalid(name, implementation);\n\t\t}\n\t\tif (target.runtime !== declared) {\n\t\t\tthrow new TargetRuntimeMismatch(\n\t\t\t\tname,\n\t\t\t\timplementation,\n\t\t\t\tdeclared,\n\t\t\t\ttarget.runtime,\n\t\t\t);\n\t\t}\n\t\treturn { name, target, source: 'config', options };\n\t}\n\n\tif (!isDeployTarget(implementation)) throw new TargetEntryInvalid(name);\n\treturn { name, target: implementation, source: 'config', options };\n}\n\n/** The target's options, parsed by its schema. */\nexport async function parseTargetOptions(\n\tresolved: ResolvedTarget,\n): Promise<unknown> {\n\tconst { name, target, options } = resolved;\n\tif (!target.options) {\n\t\tif (options !== undefined) {\n\t\t\tthrow new InvalidTargetOptions(name, [\n\t\t\t\t{ message: 'this target takes no options' },\n\t\t\t]);\n\t\t}\n\t\treturn undefined;\n\t}\n\n\tconst result = await target.options['~standard'].validate(options);\n\tif (result.issues) throw new InvalidTargetOptions(name, result.issues);\n\treturn result.value;\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,UAAkC;CACvC,QACC;CACD,cACC;AACF;;AAGA,IAAa,kBAAb,cAAqC,MAAM;CAEhC;CAEA;CAHV,YACC,UAEA,SACC;EACD,MAAM,cAAc,SAAS,qBAAqB,QAAQ,EAAE;EAJnD,KAAA,WAAA;EAEA,KAAA,UAAA;EAGT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,oBAAoB,UAA0B;CAC7D,OAAO,0CAA0C,SAAS;AAC3D;;;;;AAMA,SAAgB,kBACf,UACA,MACS;CACT,MAAM,UAAU,QAAQ;CACxB,IAAI,SAAS,MAAM,IAAI,gBAAgB,UAAU,OAAO;CACxD,IAAI,aAAa,YAAY,aAAa,cACzC,MAAM,IAAIA,eAAAA,4BAA4B,QAAQ;CAE/C,KAAK,oBAAoB,QAAQ,CAAC;CAClC,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;ACSA,IAAa,uBAAb,cAA0C,MAAM;CAErC;CACA;CAFV,YACC,QACA,aACC;EACD,MACC,kBAAkB,OAAO,UAAU,YAAY,0JAChD;EALS,KAAA,SAAA;EACA,KAAA,cAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CACxB;CAArB,YAAY,QAAyB;EACpC,MACC,kBAAkB,OAAO,0FAC1B;EAHoB,KAAA,SAAA;EAIpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CACA;CACA;CAJV,YACC,QACA,aACA,UACA,QACC;EACD,MACC,sBAAsB,OAAO,aAAa,OAAO,SAAS,YAAY,wCAAwC,SAAS,+CAA+C,SAAS,4CAChL;EAPS,KAAA,SAAA;EACA,KAAA,cAAA;EACA,KAAA,WAAA;EACA,KAAA,SAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,uBAAb,cAA0C,MAAM;CAErC;CACA;CAFV,YACC,QACA,QACC;EACD,MAAM,QAAQ,OAAO,KAAK,UAAU;GACnC,MAAM,QAAQ,MAAM,QAAQ,CAAC,EAAA,CAC3B,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,OAAO,OAAO,OAAO,GAAG,KAAK,MAAM,KAAK,MAAM;EAC/C,CAAC;EACD,MACC,kCAAkC,OAAO,6CAA6C,OAAO,sBAAsB,MAAM,KAAK,IAAI,GACnI;EAbS,KAAA,SAAA;EACA,KAAA,SAAA;EAaT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,kBAAkE,EACvE,SAAS,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,EAAA,CAAqB,cAClD;;AAGA,eAAsB,cACrB,MACA,EAAE,WAAW,MAAM,SACO;CAC1B,IAAI,QAAQ,OAAO,OAAO,MAAM,IAAI,GACnC,OAAO;EAAE;EAAM,QAAQ,KAAK;EAAQ,QAAQ;EAAQ,SAAS,KAAA;CAAU;CAGxE,MAAM,UAAUC,eAAAA,cAAc,IAAI;CAClC,IAAI,SAAS;EACZ,MAAM,OAAO,gBAAgB;EAC7B,IAAI,QAAQ,WAAW,eAAe,CAAC,MACtC,MAAM,IAAIC,eAAAA,4BAA4B,MAAM,QAAQ,UAAU,KAAK,CAAC;EAErE,OAAO;GACN;GACA,QAAQ,MAAM,KAAK;GACnB,QAAQ;GACR,SAAS,KAAA;EACV;CACD;CAEA,MAAM,QAAQC,eAAAA,iBAAiB,UAAU,QAAQ,IAAI;CACrD,IAAI,UAAU,KAAA,GACb,MAAM,IAAIC,eAAAA,oBAAoB,MAAM,CACnC,GAAGC,eAAAA,qBAAqB,GACxB,GAAG,OAAO,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,CAC/C,CAAC;CAGF,MAAM,CAAC,gBAAgB,WAAW,MAAM,QAAQ,KAAK,IACjD,QACD,CAAC,OAAO,KAAA,CAAS;CAEpB,IAAI,OAAO,mBAAmB,UAAU;EAGvC,MAAM,WAAWC,gBAAAA,gBAAgB,MAAM,gBAAgB,UAAU,IAAI;EAErE,MAAM,UAAS,MADMC,gBAAAA,cAAc,MAAM,gBAAgB,UAAU,IAAI,EAAA,CACjD;EACtB,IAAI,CAACC,eAAAA,eAAe,MAAM,GACzB,MAAM,IAAI,qBAAqB,MAAM,cAAc;EAEpD,IAAI,OAAO,YAAY,UACtB,MAAM,IAAI,sBACT,MACA,gBACA,UACA,OAAO,OACR;EAED,OAAO;GAAE;GAAM;GAAQ,QAAQ;GAAU;EAAQ;CAClD;CAEA,IAAI,CAACA,eAAAA,eAAe,cAAc,GAAG,MAAM,IAAI,mBAAmB,IAAI;CACtE,OAAO;EAAE;EAAM,QAAQ;EAAgB,QAAQ;EAAU;CAAQ;AAClE;;AAGA,eAAsB,mBACrB,UACmB;CACnB,MAAM,EAAE,MAAM,QAAQ,YAAY;CAClC,IAAI,CAAC,OAAO,SAAS;EACpB,IAAI,YAAY,KAAA,GACf,MAAM,IAAI,qBAAqB,MAAM,CACpC,EAAE,SAAS,+BAA+B,CAC3C,CAAC;EAEF;CACD;CAEA,MAAM,SAAS,MAAM,OAAO,QAAQ,YAAY,CAAC,SAAS,OAAO;CACjE,IAAI,OAAO,QAAQ,MAAM,IAAI,qBAAqB,MAAM,OAAO,MAAM;CACrE,OAAO,OAAO;AACf"}

package/dist/sandbox/config-worker.cjs

@@ -0,0 +1,43 @@
+const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
+let node_fs_promises = require("node:fs/promises");
+let node_url = require("node:url");
+//#region src/sandbox/config-worker.ts
+/**
+* Loads `gkm.config.ts` in a sandbox and answers with it as data.
+*
+* Usage (by `loadWorkspaceConfig` with a sandbox, never by hand):
+*   node --import=<tsx> config-worker.ts /path/to/gkm.config.ts
+*
+* Answers `{ reason: 'loaded', config }`, `{ reason: 'live', paths }` when the
+* config holds something JSON cannot carry, or `{ reason: 'failed', error }`
+* when it could not be loaded at all.
+*/
+async function load(configPath) {
+	if (configPath.endsWith(".json")) return JSON.parse(await (0, node_fs_promises.readFile)(configPath, "utf8"));
+	return (await import((0, node_url.pathToFileURL)(configPath).href)).default;
+}
+async function main() {
+	const configPath = process.argv[2];
+	try {
+		if (!configPath) throw new TypeError("No config path was given.");
+		await require_workerRuntime.registerAdjacentTsconfig();
+		const config = await load(configPath);
+		const paths = require_workerRuntime.liveValuePaths(config);
+		require_workerRuntime.answer(paths.length > 0 ? {
+			reason: "live",
+			paths
+		} : {
+			reason: "loaded",
+			config
+		});
+	} catch (error) {
+		require_workerRuntime.answer({
+			reason: "failed",
+			error: require_workerRuntime.errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+
+//# sourceMappingURL=config-worker.cjs.map

package/dist/sandbox/config-worker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-worker.cjs","names":["readFile","pathToFileURL","registerAdjacentTsconfig","liveValuePaths","errorData"],"sources":["../../src/sandbox/config-worker.ts"],"sourcesContent":["/**\n * Loads `gkm.config.ts` in a sandbox and answers with it as data.\n *\n * Usage (by `loadWorkspaceConfig` with a sandbox, never by hand):\n *   node --import=<tsx> config-worker.ts /path/to/gkm.config.ts\n *\n * Answers `{ reason: 'loaded', config }`, `{ reason: 'live', paths }` when the\n * config holds something JSON cannot carry, or `{ reason: 'failed', error }`\n * when it could not be loaded at all.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { pathToFileURL } from 'node:url';\nimport {\n\tanswer,\n\terrorData,\n\tliveValuePaths,\n\tregisterAdjacentTsconfig,\n} from './workerRuntime';\n\nasync function load(configPath: string): Promise<unknown> {\n\tif (configPath.endsWith('.json')) {\n\t\treturn JSON.parse(await readFile(configPath, 'utf8'));\n\t}\n\tconst module = await import(pathToFileURL(configPath).href);\n\treturn module.default;\n}\n\nasync function main(): Promise<void> {\n\tconst configPath = process.argv[2];\n\ttry {\n\t\tif (!configPath) throw new TypeError('No config path was given.');\n\t\tawait registerAdjacentTsconfig();\n\t\tconst config = await load(configPath);\n\t\tconst paths = liveValuePaths(config);\n\t\tanswer(\n\t\t\tpaths.length > 0\n\t\t\t\t? { reason: 'live', paths }\n\t\t\t\t: { reason: 'loaded', config },\n\t\t);\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAe,KAAK,YAAsC;CACzD,IAAI,WAAW,SAAS,OAAO,GAC9B,OAAO,KAAK,MAAM,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,YAAY,MAAM,CAAC;CAGrD,QAAO,MADc,QAAA,GAAOC,SAAAA,cAAAA,CAAc,UAAU,CAAC,CAAC,MAAA,CACxC;AACf;AAEA,eAAe,OAAsB;CACpC,MAAM,aAAa,QAAQ,KAAK;CAChC,IAAI;EACH,IAAI,CAAC,YAAY,MAAM,IAAI,UAAU,2BAA2B;EAChE,MAAMC,sBAAAA,yBAAyB;EAC/B,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,MAAM,QAAQC,sBAAAA,eAAe,MAAM;EACnC,sBAAA,OACC,MAAM,SAAS,IACZ;GAAE,QAAQ;GAAQ;EAAM,IACxB;GAAE,QAAQ;GAAU;EAAO,CAC/B;CACD,SAAS,OAAO;EACf,sBAAA,OAAO;GAAE,QAAQ;GAAU,OAAOC,sBAAAA,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/config-worker.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/config-worker.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/config-worker.mjs

@@ -0,0 +1,44 @@
+import { a as registerAdjacentTsconfig, i as liveValuePaths, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
+import { readFile } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
+//#region src/sandbox/config-worker.ts
+/**
+* Loads `gkm.config.ts` in a sandbox and answers with it as data.
+*
+* Usage (by `loadWorkspaceConfig` with a sandbox, never by hand):
+*   node --import=<tsx> config-worker.ts /path/to/gkm.config.ts
+*
+* Answers `{ reason: 'loaded', config }`, `{ reason: 'live', paths }` when the
+* config holds something JSON cannot carry, or `{ reason: 'failed', error }`
+* when it could not be loaded at all.
+*/
+async function load(configPath) {
+	if (configPath.endsWith(".json")) return JSON.parse(await readFile(configPath, "utf8"));
+	return (await import(pathToFileURL(configPath).href)).default;
+}
+async function main() {
+	const configPath = process.argv[2];
+	try {
+		if (!configPath) throw new TypeError("No config path was given.");
+		await registerAdjacentTsconfig();
+		const config = await load(configPath);
+		const paths = liveValuePaths(config);
+		answer(paths.length > 0 ? {
+			reason: "live",
+			paths
+		} : {
+			reason: "loaded",
+			config
+		});
+	} catch (error) {
+		answer({
+			reason: "failed",
+			error: errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+export {};
+
+//# sourceMappingURL=config-worker.mjs.map

package/dist/sandbox/config-worker.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-worker.mjs","names":[],"sources":["../../src/sandbox/config-worker.ts"],"sourcesContent":["/**\n * Loads `gkm.config.ts` in a sandbox and answers with it as data.\n *\n * Usage (by `loadWorkspaceConfig` with a sandbox, never by hand):\n *   node --import=<tsx> config-worker.ts /path/to/gkm.config.ts\n *\n * Answers `{ reason: 'loaded', config }`, `{ reason: 'live', paths }` when the\n * config holds something JSON cannot carry, or `{ reason: 'failed', error }`\n * when it could not be loaded at all.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { pathToFileURL } from 'node:url';\nimport {\n\tanswer,\n\terrorData,\n\tliveValuePaths,\n\tregisterAdjacentTsconfig,\n} from './workerRuntime';\n\nasync function load(configPath: string): Promise<unknown> {\n\tif (configPath.endsWith('.json')) {\n\t\treturn JSON.parse(await readFile(configPath, 'utf8'));\n\t}\n\tconst module = await import(pathToFileURL(configPath).href);\n\treturn module.default;\n}\n\nasync function main(): Promise<void> {\n\tconst configPath = process.argv[2];\n\ttry {\n\t\tif (!configPath) throw new TypeError('No config path was given.');\n\t\tawait registerAdjacentTsconfig();\n\t\tconst config = await load(configPath);\n\t\tconst paths = liveValuePaths(config);\n\t\tanswer(\n\t\t\tpaths.length > 0\n\t\t\t\t? { reason: 'live', paths }\n\t\t\t\t: { reason: 'loaded', config },\n\t\t);\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAe,KAAK,YAAsC;CACzD,IAAI,WAAW,SAAS,OAAO,GAC9B,OAAO,KAAK,MAAM,MAAM,SAAS,YAAY,MAAM,CAAC;CAGrD,QAAO,MADc,OAAO,cAAc,UAAU,CAAC,CAAC,MAAA,CACxC;AACf;AAEA,eAAe,OAAsB;CACpC,MAAM,aAAa,QAAQ,KAAK;CAChC,IAAI;EACH,IAAI,CAAC,YAAY,MAAM,IAAI,UAAU,2BAA2B;EAChE,MAAM,yBAAyB;EAC/B,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,MAAM,QAAQ,eAAe,MAAM;EACnC,OACC,MAAM,SAAS,IACZ;GAAE,QAAQ;GAAQ;EAAM,IACxB;GAAE,QAAQ;GAAU;EAAO,CAC/B;CACD,SAAS,OAAO;EACf,OAAO;GAAE,QAAQ;GAAU,OAAO,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/discover-worker.cjs

@@ -0,0 +1,44 @@
+const require_discover = require("../discover-C_6COHEv.cjs");
+const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
+//#region src/sandbox/discover-worker.ts
+/**
+* Discovers a project's constructs in a sandbox and answers with the
+* manifest as data.
+*
+* Usage (by `discover` under a sandbox, never by hand):
+*   node --import=<tsx> discover-worker.ts '{"patterns":[…],"cwd":"…"}'
+*
+* Discovery imports every construct module — the project's code — which is
+* why it runs here rather than in the deploy. Its warnings go to stderr, where
+* the host passes them on.
+*/
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await require_workerRuntime.registerAdjacentTsconfig();
+		const runnables = {};
+		const manifest = await require_discover.discover({
+			patterns: request.patterns,
+			cwd: request.cwd,
+			runnables
+		});
+		const paths = require_workerRuntime.liveValuePaths(manifest);
+		require_workerRuntime.answer(paths.length > 0 ? {
+			reason: "live",
+			paths
+		} : {
+			reason: "discovered",
+			manifest,
+			runnables
+		});
+	} catch (error) {
+		require_workerRuntime.answer({
+			reason: "failed",
+			error: require_workerRuntime.errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+
+//# sourceMappingURL=discover-worker.cjs.map

package/dist/sandbox/discover-worker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover-worker.cjs","names":["registerAdjacentTsconfig","discover","liveValuePaths","errorData"],"sources":["../../src/sandbox/discover-worker.ts"],"sourcesContent":["/**\n * Discovers a project's constructs in a sandbox and answers with the\n * manifest as data.\n *\n * Usage (by `discover` under a sandbox, never by hand):\n *   node --import=<tsx> discover-worker.ts '{\"patterns\":[…],\"cwd\":\"…\"}'\n *\n * Discovery imports every construct module — the project's code — which is\n * why it runs here rather than in the deploy. Its warnings go to stderr, where\n * the host passes them on.\n */\n\nimport { discover } from '../reconcile/discover';\nimport {\n\tanswer,\n\terrorData,\n\tliveValuePaths,\n\tregisterAdjacentTsconfig,\n} from './workerRuntime';\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\tpatterns: string[];\n\t\t\tcwd: string;\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\tconst runnables: Record<string, string[]> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: request.patterns,\n\t\t\tcwd: request.cwd,\n\t\t\trunnables,\n\t\t});\n\n\t\tconst paths = liveValuePaths(manifest);\n\t\tanswer(\n\t\t\tpaths.length > 0\n\t\t\t\t? { reason: 'live', paths }\n\t\t\t\t: { reason: 'discovered', manifest, runnables },\n\t\t);\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAIlD,MAAMA,sBAAAA,yBAAyB;EAE/B,MAAM,YAAsC,CAAC;EAC7C,MAAM,WAAW,MAAMC,iBAAAA,SAAS;GAC/B,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAED,MAAM,QAAQC,sBAAAA,eAAe,QAAQ;EACrC,sBAAA,OACC,MAAM,SAAS,IACZ;GAAE,QAAQ;GAAQ;EAAM,IACxB;GAAE,QAAQ;GAAc;GAAU;EAAU,CAChD;CACD,SAAS,OAAO;EACf,sBAAA,OAAO;GAAE,QAAQ;GAAU,OAAOC,sBAAAA,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/discover-worker.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/discover-worker.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/discover-worker.mjs

@@ -0,0 +1,45 @@
+import { r as discover } from "../discover-BaT6bpnA.mjs";
+import { a as registerAdjacentTsconfig, i as liveValuePaths, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
+//#region src/sandbox/discover-worker.ts
+/**
+* Discovers a project's constructs in a sandbox and answers with the
+* manifest as data.
+*
+* Usage (by `discover` under a sandbox, never by hand):
+*   node --import=<tsx> discover-worker.ts '{"patterns":[…],"cwd":"…"}'
+*
+* Discovery imports every construct module — the project's code — which is
+* why it runs here rather than in the deploy. Its warnings go to stderr, where
+* the host passes them on.
+*/
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await registerAdjacentTsconfig();
+		const runnables = {};
+		const manifest = await discover({
+			patterns: request.patterns,
+			cwd: request.cwd,
+			runnables
+		});
+		const paths = liveValuePaths(manifest);
+		answer(paths.length > 0 ? {
+			reason: "live",
+			paths
+		} : {
+			reason: "discovered",
+			manifest,
+			runnables
+		});
+	} catch (error) {
+		answer({
+			reason: "failed",
+			error: errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+export {};
+
+//# sourceMappingURL=discover-worker.mjs.map

package/dist/sandbox/discover-worker.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover-worker.mjs","names":[],"sources":["../../src/sandbox/discover-worker.ts"],"sourcesContent":["/**\n * Discovers a project's constructs in a sandbox and answers with the\n * manifest as data.\n *\n * Usage (by `discover` under a sandbox, never by hand):\n *   node --import=<tsx> discover-worker.ts '{\"patterns\":[…],\"cwd\":\"…\"}'\n *\n * Discovery imports every construct module — the project's code — which is\n * why it runs here rather than in the deploy. Its warnings go to stderr, where\n * the host passes them on.\n */\n\nimport { discover } from '../reconcile/discover';\nimport {\n\tanswer,\n\terrorData,\n\tliveValuePaths,\n\tregisterAdjacentTsconfig,\n} from './workerRuntime';\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\tpatterns: string[];\n\t\t\tcwd: string;\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\tconst runnables: Record<string, string[]> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: request.patterns,\n\t\t\tcwd: request.cwd,\n\t\t\trunnables,\n\t\t});\n\n\t\tconst paths = liveValuePaths(manifest);\n\t\tanswer(\n\t\t\tpaths.length > 0\n\t\t\t\t? { reason: 'live', paths }\n\t\t\t\t: { reason: 'discovered', manifest, runnables },\n\t\t);\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAIlD,MAAM,yBAAyB;EAE/B,MAAM,YAAsC,CAAC;EAC7C,MAAM,WAAW,MAAM,SAAS;GAC/B,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAED,MAAM,QAAQ,eAAe,QAAQ;EACrC,OACC,MAAM,SAAS,IACZ;GAAE,QAAQ;GAAQ;EAAM,IACxB;GAAE,QAAQ;GAAc;GAAU;EAAU,CAChD;CACD,SAAS,OAAO;EACf,OAAO;GAAE,QAAQ;GAAU,OAAO,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox-M8UnLhXE.d.cts

@@ -0,0 +1,126 @@
+//#region src/sandbox/sandbox.d.ts
+/**
+ * Where a deploy runs the project's own code.
+ *
+ * A deploy holds credentials — Dokploy's token, a registry login, an AWS key —
+ * and loading `gkm.config.ts`, sniffing an app's environment and building it
+ * all execute code from the repository being deployed. On a developer's own
+ * laptop that is the developer's code. On a CI job for a fork, or a shared
+ * build runner, it is not, and that code should not be able to read the
+ * credentials used to deploy it, hang the deploy, or reach outside the
+ * checkout.
+ *
+ * So every step that runs project code goes through a `Sandbox`: one call,
+ * with an argument array rather than a shell line, the complete environment
+ * the step needs rather than the host's, a timeout it cannot outlive, secrets
+ * as files rather than variables, and a working directory inside the project.
+ * The steps that need credentials — provisioning, pushing, releasing — are
+ * the deploy's own code and never run in one.
+ *
+ * `LocalSandbox` is the default: a child process on this machine with an
+ * allowlisted environment. A host that builds repositories it does not trust
+ * passes its own — a container per build, a VM — through `deploy()`'s
+ * `sandbox`.
+ */
+/** Where a command's output goes. */
+type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
+interface SandboxExecOptions {
+  /**
+   * Where the command runs: the project root or a directory below it, as an
+   * absolute path or relative to the root. Anywhere else is refused with
+   * {@link SandboxCwdEscape}.
+   */
+  cwd: string;
+  /**
+   * The command's whole environment. Nothing of the host's is added to it:
+   * start from {@link Sandbox.env} and add what the step needs.
+   */
+  env: Readonly<Record<string, string>>;
+  /**
+   * How long the command may run before it is killed. Required: a step that
+   * waits forever — a sniffed entry that opens a server, a build stuck on a
+   * prompt — would otherwise hold the deploy, and its lock, forever.
+   */
+  timeoutMs: number;
+  /**
+   * Files the command can read, by name. Mounted in a directory of their own
+   * — named by `GKM_SECRETS_DIR` in the command's environment — and removed
+   * when it exits. Never set as variables, which every child inherits, a
+   * crash report prints and `/proc/<pid>/environ` shows.
+   */
+  secrets?: Readonly<Record<string, string>>;
+  /**
+   * `capture` (the default) returns stdout and stderr in the result;
+   * `inherit` gives the command the host's terminal; `stderr` sends both
+   * streams to the host's stderr; `ignore` discards them.
+   */
+  output?: SandboxOutput;
+  /** Kills the command when aborted; `exec` rejects with the signal's reason. */
+  signal?: AbortSignal;
+}
+/** How a command ended. A non-zero exit is a result, not an error. */
+interface SandboxResult {
+  exitCode: number | null;
+  signal: string | null;
+  /** What it wrote to stdout, when its output was captured. */
+  stdout: string;
+  /** What it wrote to stderr, when its output was captured. */
+  stderr: string;
+}
+/**
+ * Runs a command against the project, and nothing else of the host's.
+ *
+ * `exec` resolves with the result however the command exited. It rejects
+ * with {@link CommandTimedOut} once the timeout passes — after the command is
+ * gone — with {@link SandboxCwdEscape} for a directory outside the project,
+ * with the signal's reason when aborted, and with the spawn error when the
+ * program cannot be started.
+ */
+interface Sandbox {
+  /** The project: the directory every command runs at or below. */
+  readonly root: string;
+  /**
+   * Whether the code it runs is kept from the host: its files, its
+   * processes, its memory.
+   *
+   * An isolating sandbox shares nothing but what crosses `exec`, so a config
+   * reaches the deploy as data — a live object in it (a custom state store,
+   * an inline target) cannot cross, and is refused with
+   * `ConfigObjectNotSerializable`. A non-isolating one, like
+   * {@link LocalSandbox}, runs on the host as the host's user; a project
+   * whose config holds live objects is then loaded in-process as before,
+   * because a project trusted to run there is trusted to do that.
+   */
+  readonly isolating: boolean;
+  /**
+   * The environment a command starts from: what any program needs to run
+   * here — `PATH`, `HOME`, the locale — and no credential.
+   */
+  readonly env: Readonly<Record<string, string>>;
+  exec(command: string, args: readonly string[], options: SandboxExecOptions): Promise<SandboxResult>;
+}
+/** The variable naming the directory a command's secrets are mounted in. */
+declare const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
+/** A command was asked to run outside the project. */
+declare class SandboxCwdEscape extends Error {
+  readonly cwd: string;
+  readonly root: string;
+  constructor(cwd: string, root: string);
+}
+/**
+ * `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.
+ *
+ * Symlinks are resolved on both sides first, so a link inside the project
+ * that points out of it is an escape, and a project reached through a link
+ * (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call
+ * before it runs anything.
+ */
+declare function confineCwd(root: string, cwd: string): string;
+/** A secret's file name: one path segment, so it cannot be written elsewhere. */
+declare class SecretNameInvalid extends Error {
+  readonly secretName: string;
+  constructor(secretName: string);
+}
+//#endregion
+export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
+//# sourceMappingURL=sandbox-M8UnLhXE.d.cts.map

package/dist/sandbox-M8UnLhXE.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-M8UnLhXE.d.cts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KA6BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}

package/dist/sandbox-M8UnLhXE.d.mts

@@ -0,0 +1,126 @@
+//#region src/sandbox/sandbox.d.ts
+/**
+ * Where a deploy runs the project's own code.
+ *
+ * A deploy holds credentials — Dokploy's token, a registry login, an AWS key —
+ * and loading `gkm.config.ts`, sniffing an app's environment and building it
+ * all execute code from the repository being deployed. On a developer's own
+ * laptop that is the developer's code. On a CI job for a fork, or a shared
+ * build runner, it is not, and that code should not be able to read the
+ * credentials used to deploy it, hang the deploy, or reach outside the
+ * checkout.
+ *
+ * So every step that runs project code goes through a `Sandbox`: one call,
+ * with an argument array rather than a shell line, the complete environment
+ * the step needs rather than the host's, a timeout it cannot outlive, secrets
+ * as files rather than variables, and a working directory inside the project.
+ * The steps that need credentials — provisioning, pushing, releasing — are
+ * the deploy's own code and never run in one.
+ *
+ * `LocalSandbox` is the default: a child process on this machine with an
+ * allowlisted environment. A host that builds repositories it does not trust
+ * passes its own — a container per build, a VM — through `deploy()`'s
+ * `sandbox`.
+ */
+/** Where a command's output goes. */
+type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
+interface SandboxExecOptions {
+  /**
+   * Where the command runs: the project root or a directory below it, as an
+   * absolute path or relative to the root. Anywhere else is refused with
+   * {@link SandboxCwdEscape}.
+   */
+  cwd: string;
+  /**
+   * The command's whole environment. Nothing of the host's is added to it:
+   * start from {@link Sandbox.env} and add what the step needs.
+   */
+  env: Readonly<Record<string, string>>;
+  /**
+   * How long the command may run before it is killed. Required: a step that
+   * waits forever — a sniffed entry that opens a server, a build stuck on a
+   * prompt — would otherwise hold the deploy, and its lock, forever.
+   */
+  timeoutMs: number;
+  /**
+   * Files the command can read, by name. Mounted in a directory of their own
+   * — named by `GKM_SECRETS_DIR` in the command's environment — and removed
+   * when it exits. Never set as variables, which every child inherits, a
+   * crash report prints and `/proc/<pid>/environ` shows.
+   */
+  secrets?: Readonly<Record<string, string>>;
+  /**
+   * `capture` (the default) returns stdout and stderr in the result;
+   * `inherit` gives the command the host's terminal; `stderr` sends both
+   * streams to the host's stderr; `ignore` discards them.
+   */
+  output?: SandboxOutput;
+  /** Kills the command when aborted; `exec` rejects with the signal's reason. */
+  signal?: AbortSignal;
+}
+/** How a command ended. A non-zero exit is a result, not an error. */
+interface SandboxResult {
+  exitCode: number | null;
+  signal: string | null;
+  /** What it wrote to stdout, when its output was captured. */
+  stdout: string;
+  /** What it wrote to stderr, when its output was captured. */
+  stderr: string;
+}
+/**
+ * Runs a command against the project, and nothing else of the host's.
+ *
+ * `exec` resolves with the result however the command exited. It rejects
+ * with {@link CommandTimedOut} once the timeout passes — after the command is
+ * gone — with {@link SandboxCwdEscape} for a directory outside the project,
+ * with the signal's reason when aborted, and with the spawn error when the
+ * program cannot be started.
+ */
+interface Sandbox {
+  /** The project: the directory every command runs at or below. */
+  readonly root: string;
+  /**
+   * Whether the code it runs is kept from the host: its files, its
+   * processes, its memory.
+   *
+   * An isolating sandbox shares nothing but what crosses `exec`, so a config
+   * reaches the deploy as data — a live object in it (a custom state store,
+   * an inline target) cannot cross, and is refused with
+   * `ConfigObjectNotSerializable`. A non-isolating one, like
+   * {@link LocalSandbox}, runs on the host as the host's user; a project
+   * whose config holds live objects is then loaded in-process as before,
+   * because a project trusted to run there is trusted to do that.
+   */
+  readonly isolating: boolean;
+  /**
+   * The environment a command starts from: what any program needs to run
+   * here — `PATH`, `HOME`, the locale — and no credential.
+   */
+  readonly env: Readonly<Record<string, string>>;
+  exec(command: string, args: readonly string[], options: SandboxExecOptions): Promise<SandboxResult>;
+}
+/** The variable naming the directory a command's secrets are mounted in. */
+declare const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
+/** A command was asked to run outside the project. */
+declare class SandboxCwdEscape extends Error {
+  readonly cwd: string;
+  readonly root: string;
+  constructor(cwd: string, root: string);
+}
+/**
+ * `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.
+ *
+ * Symlinks are resolved on both sides first, so a link inside the project
+ * that points out of it is an escape, and a project reached through a link
+ * (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call
+ * before it runs anything.
+ */
+declare function confineCwd(root: string, cwd: string): string;
+/** A secret's file name: one path segment, so it cannot be written elsewhere. */
+declare class SecretNameInvalid extends Error {
+  readonly secretName: string;
+  constructor(secretName: string);
+}
+//#endregion
+export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
+//# sourceMappingURL=sandbox-M8UnLhXE.d.mts.map

package/dist/sandbox-M8UnLhXE.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-M8UnLhXE.d.mts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KA6BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}