@geekmidas/cli 10.0.0-alpha.62 → 10.0.0-alpha.63

package/dist/config.d.cts

@@ -1,211 +1,4 @@
-import { C as WorkspaceConfig, _ as LoadedConfig, b as NormalizedWorkspace, p as DevConfig, r as GkmConfig, y as NormalizedAppConfig } from "./types-DIA7Li-J.cjs";
+import { C as WorkspaceConfig, _ as LoadedConfig, p as DevConfig, r as GkmConfig } from "./types-DIA7Li-J.cjs";
 import { i as defineWorkspace } from "./index-BtXDZQuF.cjs";
-import { ConstructManifest } from "@geekmidas/manifest";
-//#region src/dev/discovery.d.ts
-/** Where an app is in its life. `stopped` is a server that exited on its own. */
-type AppStatus = 'starting' | 'ready' | 'reloading' | 'stopped';
-/** A JSON API an app serves about itself. */
-type DataApiKind = 'telescope' | 'database' | 'openapi';
-interface DiscoveredDataApi {
-  kind: DataApiKind;
-  /** Where the app serves it. */
-  path: string;
-  /** The app's own address for it — `http://localhost:<port><path>`. */
-  url: string;
-  /** The same API through this endpoint, relative to its origin. */
-  proxy: string;
-}
-interface DiscoveredApp {
-  name: string;
-  type: 'backend' | 'web' | 'mobile';
-  port: number;
-  /** `http://localhost:<port>`. */
-  url: string;
-  publicUrl: string | null;
-  status: AppStatus;
-  reloads: number;
-  /** The `gkm dev` running it, when it runs in one of its own. */
-  pid: number | null;
-  dataApis: DiscoveredDataApi[];
-}
-interface DiscoveredWorkspace {
-  /** Stable for a workspace's root: its name, and a hash of where it is. */
-  id: string;
-  name: string;
-  root: string;
-  stage: string;
-  manifest: ConstructManifest | null;
-  apps: DiscoveredApp[];
-}
-/** The body of `GET /__gkm`. */
-interface DiscoveryResponse {
-  version: 1;
-  /** The `gkm dev` serving this endpoint, which may change while you watch. */
-  host: {
-    pid: number;
-    port: number;
-  };
-  /** Where the changes stream, as server-sent events. */
-  events: string;
-  workspaces: DiscoveredWorkspace[];
-}
-/** One message on `GET /__gkm/events`; its SSE `event:` is its `type`. */
-type DiscoveryEvent = {
-  type: 'snapshot';
-  snapshot: DiscoveryResponse;
-} | {
-  type: 'workspace.started' | 'workspace.stopped';
-  workspace: string;
-} | {
-  type: 'app.started' | 'app.stopped' | 'app.reloaded' | 'app.status';
-  workspace: string;
-  app: DiscoveredApp;
-};
-//#endregion
-//#region src/config.d.ts
-/**
- * Define GKM configuration with full TypeScript support.
- * This is an identity function that provides type safety and autocomplete.
- *
- * @example
- * ```ts
- * // gkm.config.ts
- * import { defineConfig } from '@geekmidas/cli/config';
- *
- * export default defineConfig({
- *   routes: './src/endpoints/**\/*.ts',
- *   envParser: './src/config/env',
- *   logger: './src/config/logger',
- *   telescope: true,
- * });
- * ```
- */
-export declare function defineConfig(config: GkmConfig): GkmConfig;
-export interface ParsedModuleConfig {
-  path: string;
-  importPattern: string;
-}
-/**
- * Parse a module config string into path and import pattern.
- *
- * @param configString - Config string in format "./path/to/module" or "./path/to/module#exportName"
- * @param defaultAlias - The default alias name to use if no export name specified
- * @returns Object with path and import pattern
- *
- * @example
- * parseModuleConfig('./src/config/env', 'envParser')
- * // { path: './src/config/env', importPattern: 'envParser' }
- *
- * parseModuleConfig('./src/config/env#envParser', 'envParser')
- * // { path: './src/config/env', importPattern: '{ envParser }' }
- *
- * parseModuleConfig('./src/config/env#myEnv', 'envParser')
- * // { path: './src/config/env', importPattern: '{ myEnv as envParser }' }
- */
-export declare function parseModuleConfig(configString: string, defaultAlias: string): ParsedModuleConfig;
-export interface ConfigDiscoveryResult {
-  configPath: string;
-  workspaceRoot: string;
-}
-/** No gkm config in a directory or any of its parents. */
-export declare class ConfigNotFound extends Error {
-  readonly cwd: string;
-  constructor(cwd: string);
-}
-/**
- * Load configuration file (single-app format).
- * For backwards compatibility with existing code.
- *
- * @deprecated Use loadWorkspaceConfig for new code
- */
-export declare function loadConfig(cwd?: string): Promise<GkmConfig>;
-/**
- * Load configuration file and process it as a workspace.
- * Works with both single-app and workspace configurations.
- *
- * Single-app configs are automatically wrapped as a workspace with one app.
- *
- * @example
- * ```ts
- * const { type, workspace } = await loadWorkspaceConfig();
- *
- * if (type === 'workspace') {
- *   console.log('Multi-app workspace:', workspace.apps);
- * } else {
- *   console.log('Single app wrapped as workspace');
- * }
- * ```
- */
-/**
- * The workspace a directory belongs to, as its config states it — without
- * discovering its constructs.
- *
- * For callers that need a fact the config holds (where a stage's secrets are
- * stored) and nothing the graph adds. `loadWorkspaceConfig` imports every
- * construct module to derive the apps, which is a cost a secrets read should
- * not pay.
- */
-export declare function loadWorkspaceSettings(cwd?: string): Promise<LoadedConfig['workspace']>;
-export declare function loadWorkspaceConfig(cwd?: string): Promise<LoadedConfig>;
-/**
- * A workspace with no `constructs` glob.
- *
- * In v10 every address, container and app comes from what the workspace
- * declares — there is no second path that reads a hand-written compose file or
- * an `apps` block's ports. A config that declares nothing has nothing to run.
- */
-export declare class WorkspaceDeclaresNoConstructs extends Error {
-  readonly root: string;
-  constructor(root: string);
-}
-export interface AppConfigResult {
-  appName: string;
-  app: NormalizedAppConfig;
-  gkmConfig: GkmConfig;
-  workspace: NormalizedWorkspace;
-  workspaceRoot: string;
-  appRoot: string;
-}
-/** A directory that no app in the workspace lives in. */
-export declare class NotInAnApp extends Error {
-  readonly cwd: string;
-  readonly apps: Readonly<Record<string, string>>;
-  constructor(cwd: string, apps: Readonly<Record<string, string>>);
-}
-/**
- * The backend app a directory is part of, with its gkm config — found by the
- * `path` its construct declares.
- *
- * @example
- * ```ts
- * // From apps/api, where a construct declares `path: 'apps/api'`
- * const { app, workspace, workspaceRoot } = await loadAppConfig();
- * ```
- *
- * @throws {NotInAnApp} when no app's path contains the directory.
- * @throws {NotABackendApp} when the app it is in has no gkm config to run.
- */
-export declare function loadAppConfig(cwd?: string): Promise<AppConfigResult>;
-/** The app a directory is in has no gkm config — a site, or an entry app. */
-export declare class NotABackendApp extends Error {
-  readonly appName: string;
-  constructor(appName: string);
-}
-export interface WorkspaceAppInfo {
-  /** The app's key in the workspace. */
-  appName: string;
-  app: NormalizedAppConfig;
-  workspace: NormalizedWorkspace;
-  workspaceRoot: string;
-}
-/**
- * The app a directory is part of, frontend or backend — found by the `path`
- * its construct declares. Unlike `loadAppConfig`, the app need not have a
- * gkm config, which is what `gkm exec` and `gkm test` from a site need.
- *
- * @throws {NotInAnApp} when no app's path contains the directory.
- */
-export declare function loadWorkspaceAppInfo(cwd?: string): Promise<WorkspaceAppInfo>;
-//#endregion
-export { type AppStatus, type DataApiKind, type DevConfig, type DiscoveredApp, type DiscoveredDataApi, type DiscoveredWorkspace, type DiscoveryEvent, type DiscoveryResponse, type GkmConfig, type LoadedConfig, type WorkspaceConfig, defineWorkspace };
-//# sourceMappingURL=config.d.cts.map
+import { C as DiscoveredApp, D as DiscoveryResponse, E as DiscoveryEvent, S as DataApiKind, T as DiscoveredWorkspace, _ as loadWorkspaceAppInfo, a as ConfigNotFound, b as parseModuleConfig, c as NotABackendApp, d as WorkspaceAppInfo, f as WorkspaceDeclaresNoConstructs, g as loadConfig, h as loadAppConfig, i as ConfigLoadFailed, l as NotInAnApp, m as findWorkspaceRoot, n as CONFIG_LOAD_TIMEOUT_MS, o as ConfigObjectNotSerializable, p as defineConfig, r as ConfigDiscoveryResult, s as LoadConfigOptions, t as AppConfigResult, u as ParsedModuleConfig, v as loadWorkspaceConfig, w as DiscoveredDataApi, x as AppStatus, y as loadWorkspaceSettings } from "./config-CemHVcIr.cjs";
+export { AppConfigResult, type AppStatus, CONFIG_LOAD_TIMEOUT_MS, ConfigDiscoveryResult, ConfigLoadFailed, ConfigNotFound, ConfigObjectNotSerializable, type DataApiKind, type DevConfig, type DiscoveredApp, type DiscoveredDataApi, type DiscoveredWorkspace, type DiscoveryEvent, type DiscoveryResponse, type GkmConfig, LoadConfigOptions, type LoadedConfig, NotABackendApp, NotInAnApp, ParsedModuleConfig, WorkspaceAppInfo, type WorkspaceConfig, WorkspaceDeclaresNoConstructs, defineConfig, defineWorkspace, findWorkspaceRoot, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig };

package/dist/config.d.mts

@@ -1,211 +1,4 @@
-import { C as WorkspaceConfig, _ as LoadedConfig, b as NormalizedWorkspace, p as DevConfig, r as GkmConfig, y as NormalizedAppConfig } from "./types-CfLKGfC_.mjs";
+import { C as WorkspaceConfig, _ as LoadedConfig, p as DevConfig, r as GkmConfig } from "./types-CfLKGfC_.mjs";
 import { i as defineWorkspace } from "./index-DrKzpHl-.mjs";
-import { ConstructManifest } from "@geekmidas/manifest";
-//#region src/dev/discovery.d.ts
-/** Where an app is in its life. `stopped` is a server that exited on its own. */
-type AppStatus = 'starting' | 'ready' | 'reloading' | 'stopped';
-/** A JSON API an app serves about itself. */
-type DataApiKind = 'telescope' | 'database' | 'openapi';
-interface DiscoveredDataApi {
-  kind: DataApiKind;
-  /** Where the app serves it. */
-  path: string;
-  /** The app's own address for it — `http://localhost:<port><path>`. */
-  url: string;
-  /** The same API through this endpoint, relative to its origin. */
-  proxy: string;
-}
-interface DiscoveredApp {
-  name: string;
-  type: 'backend' | 'web' | 'mobile';
-  port: number;
-  /** `http://localhost:<port>`. */
-  url: string;
-  publicUrl: string | null;
-  status: AppStatus;
-  reloads: number;
-  /** The `gkm dev` running it, when it runs in one of its own. */
-  pid: number | null;
-  dataApis: DiscoveredDataApi[];
-}
-interface DiscoveredWorkspace {
-  /** Stable for a workspace's root: its name, and a hash of where it is. */
-  id: string;
-  name: string;
-  root: string;
-  stage: string;
-  manifest: ConstructManifest | null;
-  apps: DiscoveredApp[];
-}
-/** The body of `GET /__gkm`. */
-interface DiscoveryResponse {
-  version: 1;
-  /** The `gkm dev` serving this endpoint, which may change while you watch. */
-  host: {
-    pid: number;
-    port: number;
-  };
-  /** Where the changes stream, as server-sent events. */
-  events: string;
-  workspaces: DiscoveredWorkspace[];
-}
-/** One message on `GET /__gkm/events`; its SSE `event:` is its `type`. */
-type DiscoveryEvent = {
-  type: 'snapshot';
-  snapshot: DiscoveryResponse;
-} | {
-  type: 'workspace.started' | 'workspace.stopped';
-  workspace: string;
-} | {
-  type: 'app.started' | 'app.stopped' | 'app.reloaded' | 'app.status';
-  workspace: string;
-  app: DiscoveredApp;
-};
-//#endregion
-//#region src/config.d.ts
-/**
- * Define GKM configuration with full TypeScript support.
- * This is an identity function that provides type safety and autocomplete.
- *
- * @example
- * ```ts
- * // gkm.config.ts
- * import { defineConfig } from '@geekmidas/cli/config';
- *
- * export default defineConfig({
- *   routes: './src/endpoints/**\/*.ts',
- *   envParser: './src/config/env',
- *   logger: './src/config/logger',
- *   telescope: true,
- * });
- * ```
- */
-export declare function defineConfig(config: GkmConfig): GkmConfig;
-export interface ParsedModuleConfig {
-  path: string;
-  importPattern: string;
-}
-/**
- * Parse a module config string into path and import pattern.
- *
- * @param configString - Config string in format "./path/to/module" or "./path/to/module#exportName"
- * @param defaultAlias - The default alias name to use if no export name specified
- * @returns Object with path and import pattern
- *
- * @example
- * parseModuleConfig('./src/config/env', 'envParser')
- * // { path: './src/config/env', importPattern: 'envParser' }
- *
- * parseModuleConfig('./src/config/env#envParser', 'envParser')
- * // { path: './src/config/env', importPattern: '{ envParser }' }
- *
- * parseModuleConfig('./src/config/env#myEnv', 'envParser')
- * // { path: './src/config/env', importPattern: '{ myEnv as envParser }' }
- */
-export declare function parseModuleConfig(configString: string, defaultAlias: string): ParsedModuleConfig;
-export interface ConfigDiscoveryResult {
-  configPath: string;
-  workspaceRoot: string;
-}
-/** No gkm config in a directory or any of its parents. */
-export declare class ConfigNotFound extends Error {
-  readonly cwd: string;
-  constructor(cwd: string);
-}
-/**
- * Load configuration file (single-app format).
- * For backwards compatibility with existing code.
- *
- * @deprecated Use loadWorkspaceConfig for new code
- */
-export declare function loadConfig(cwd?: string): Promise<GkmConfig>;
-/**
- * Load configuration file and process it as a workspace.
- * Works with both single-app and workspace configurations.
- *
- * Single-app configs are automatically wrapped as a workspace with one app.
- *
- * @example
- * ```ts
- * const { type, workspace } = await loadWorkspaceConfig();
- *
- * if (type === 'workspace') {
- *   console.log('Multi-app workspace:', workspace.apps);
- * } else {
- *   console.log('Single app wrapped as workspace');
- * }
- * ```
- */
-/**
- * The workspace a directory belongs to, as its config states it — without
- * discovering its constructs.
- *
- * For callers that need a fact the config holds (where a stage's secrets are
- * stored) and nothing the graph adds. `loadWorkspaceConfig` imports every
- * construct module to derive the apps, which is a cost a secrets read should
- * not pay.
- */
-export declare function loadWorkspaceSettings(cwd?: string): Promise<LoadedConfig['workspace']>;
-export declare function loadWorkspaceConfig(cwd?: string): Promise<LoadedConfig>;
-/**
- * A workspace with no `constructs` glob.
- *
- * In v10 every address, container and app comes from what the workspace
- * declares — there is no second path that reads a hand-written compose file or
- * an `apps` block's ports. A config that declares nothing has nothing to run.
- */
-export declare class WorkspaceDeclaresNoConstructs extends Error {
-  readonly root: string;
-  constructor(root: string);
-}
-export interface AppConfigResult {
-  appName: string;
-  app: NormalizedAppConfig;
-  gkmConfig: GkmConfig;
-  workspace: NormalizedWorkspace;
-  workspaceRoot: string;
-  appRoot: string;
-}
-/** A directory that no app in the workspace lives in. */
-export declare class NotInAnApp extends Error {
-  readonly cwd: string;
-  readonly apps: Readonly<Record<string, string>>;
-  constructor(cwd: string, apps: Readonly<Record<string, string>>);
-}
-/**
- * The backend app a directory is part of, with its gkm config — found by the
- * `path` its construct declares.
- *
- * @example
- * ```ts
- * // From apps/api, where a construct declares `path: 'apps/api'`
- * const { app, workspace, workspaceRoot } = await loadAppConfig();
- * ```
- *
- * @throws {NotInAnApp} when no app's path contains the directory.
- * @throws {NotABackendApp} when the app it is in has no gkm config to run.
- */
-export declare function loadAppConfig(cwd?: string): Promise<AppConfigResult>;
-/** The app a directory is in has no gkm config — a site, or an entry app. */
-export declare class NotABackendApp extends Error {
-  readonly appName: string;
-  constructor(appName: string);
-}
-export interface WorkspaceAppInfo {
-  /** The app's key in the workspace. */
-  appName: string;
-  app: NormalizedAppConfig;
-  workspace: NormalizedWorkspace;
-  workspaceRoot: string;
-}
-/**
- * The app a directory is part of, frontend or backend — found by the `path`
- * its construct declares. Unlike `loadAppConfig`, the app need not have a
- * gkm config, which is what `gkm exec` and `gkm test` from a site need.
- *
- * @throws {NotInAnApp} when no app's path contains the directory.
- */
-export declare function loadWorkspaceAppInfo(cwd?: string): Promise<WorkspaceAppInfo>;
-//#endregion
-export { type AppStatus, type DataApiKind, type DevConfig, type DiscoveredApp, type DiscoveredDataApi, type DiscoveredWorkspace, type DiscoveryEvent, type DiscoveryResponse, type GkmConfig, type LoadedConfig, type WorkspaceConfig, defineWorkspace };
-//# sourceMappingURL=config.d.mts.map
+import { C as DiscoveredApp, D as DiscoveryResponse, E as DiscoveryEvent, S as DataApiKind, T as DiscoveredWorkspace, _ as loadWorkspaceAppInfo, a as ConfigNotFound, b as parseModuleConfig, c as NotABackendApp, d as WorkspaceAppInfo, f as WorkspaceDeclaresNoConstructs, g as loadConfig, h as loadAppConfig, i as ConfigLoadFailed, l as NotInAnApp, m as findWorkspaceRoot, n as CONFIG_LOAD_TIMEOUT_MS, o as ConfigObjectNotSerializable, p as defineConfig, r as ConfigDiscoveryResult, s as LoadConfigOptions, t as AppConfigResult, u as ParsedModuleConfig, v as loadWorkspaceConfig, w as DiscoveredDataApi, x as AppStatus, y as loadWorkspaceSettings } from "./config-C2BUosLm.mjs";
+export { AppConfigResult, type AppStatus, CONFIG_LOAD_TIMEOUT_MS, ConfigDiscoveryResult, ConfigLoadFailed, ConfigNotFound, ConfigObjectNotSerializable, type DataApiKind, type DevConfig, type DiscoveredApp, type DiscoveredDataApi, type DiscoveredWorkspace, type DiscoveryEvent, type DiscoveryResponse, type GkmConfig, LoadConfigOptions, type LoadedConfig, NotABackendApp, NotInAnApp, ParsedModuleConfig, WorkspaceAppInfo, type WorkspaceConfig, WorkspaceDeclaresNoConstructs, defineConfig, defineWorkspace, findWorkspaceRoot, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig };

package/dist/config.mjs

@@ -1,3 +1,3 @@
-import { a as defineConfig, c as loadWorkspaceAppInfo, d as parseModuleConfig, i as WorkspaceDeclaresNoConstructs, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-Bf4-bROQ.mjs";
-import { i as defineWorkspace } from "./workspace-BFe57es7.mjs";
-export { ConfigNotFound, NotABackendApp, NotInAnApp, WorkspaceDeclaresNoConstructs, defineConfig, defineWorkspace, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig };
+import { a as NotABackendApp, c as defineConfig, d as loadConfig, f as loadWorkspaceAppInfo, h as parseModuleConfig, i as ConfigObjectNotSerializable, l as findWorkspaceRoot, m as loadWorkspaceSettings, n as ConfigLoadFailed, o as NotInAnApp, p as loadWorkspaceConfig, r as ConfigNotFound, s as WorkspaceDeclaresNoConstructs, t as CONFIG_LOAD_TIMEOUT_MS, u as loadAppConfig } from "./config-LKKCVCnC.mjs";
+import { i as defineWorkspace } from "./workspace-Dh7rr7l4.mjs";
+export { CONFIG_LOAD_TIMEOUT_MS, ConfigLoadFailed, ConfigNotFound, ConfigObjectNotSerializable, NotABackendApp, NotInAnApp, WorkspaceDeclaresNoConstructs, defineConfig, defineWorkspace, findWorkspaceRoot, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig };

package/dist/deploy/public.cjs

@@ -1,17 +1,153 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sniffer = require("../sniffer-BsfPa-GA.cjs");
+const require_sniffer = require("../sniffer-D_SYc_pO.cjs");
 const require_home = require("../home-DOzBaWaL.cjs");
+const require_discover = require("../discover-C_6COHEv.cjs");
+const require_config = require("../config-BEJYKd4s.cjs");
 const require_define = require("../define-Cv_QvDrg.cjs");
 const require_store = require("../store-KvNQwYaB.cjs");
 const require_runtime = require("../runtime-CMwtq0AL.cjs");
-const require_resolve = require("../resolve-wbv66HjD.cjs");
-const require_terminal = require("../terminal-6oL0vANs.cjs");
-const require_deploy = require("../deploy-D8Qr-Xto.cjs");
-const require_deploy$1 = require("../deploy-DSaCYvcO.cjs");
+const require_resolve = require("../resolve-xytBTtG4.cjs");
+const require_terminal = require("../terminal-D0f1u0LG.cjs");
+const require_deploy = require("../deploy-BiMrP9i7.cjs");
+const require_deploy$1 = require("../deploy-ABBI0lf1.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+//#region src/sandbox/install.ts
+/**
+* Installing a project's dependencies in a sandbox, with or without their
+* lifecycle scripts.
+*
+* `postinstall` is the oldest way into a build machine: any package in the
+* lockfile — a dependency of a dependency — runs whatever it likes the moment
+* it is installed. For a build the host trusts that is how native modules get
+* built. For one it does not, the scripts are skipped, and the few packages
+* that genuinely need theirs (esbuild's binary, a database driver) are named
+* and rebuilt — with nothing but the sandbox's environment either way.
+*/
+/** Long enough for a cold install of a large monorepo. */
+const INSTALL_TIMEOUT_MS = 9e5;
+/** A name in `allowScripts` that is not a package name. */
+var InstallAllowlistNameInvalid = class extends Error {
+	packageName;
+	constructor(packageName) {
+		super(`'${packageName}' is not a package name, so its scripts cannot be allowed. Name the package as it appears in package.json — 'esbuild', '@prisma/client'.`);
+		this.packageName = packageName;
+		this.name = "InstallAllowlistNameInvalid";
+	}
+};
+/** The package manager has no way to run only some packages' scripts. */
+var InstallScriptsAllowlistUnsupported = class extends Error {
+	packageManager;
+	allowScripts;
+	constructor(packageManager, allowScripts) {
+		super(`${packageManager} cannot rebuild named packages after an install without scripts, so ${allowScripts.join(", ")} cannot be allowed theirs. Use pnpm, npm or Yarn 2+, or install with every script skipped.`);
+		this.packageManager = packageManager;
+		this.allowScripts = allowScripts;
+		this.name = "InstallScriptsAllowlistUnsupported";
+	}
+};
+/**
+* npm's package-name grammar, less a leading `-`: each name is an argument to
+* `rebuild`, and must never be read as a flag.
+*/
+const PACKAGE_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\/)?[a-z0-9~][a-z0-9._~-]*$/;
+/**
+* The commands an install runs, in order. Exported for the tests, which
+* check each package manager's flags without installing with all four.
+*/
+function installCommands(packageManager, cwd, options = {}) {
+	const ignore = options.ignoreScripts ?? false;
+	const allow = ignore ? [...options.allowScripts ?? []] : [];
+	for (const name of allow) if (!PACKAGE_NAME.test(name)) throw new InstallAllowlistNameInvalid(name);
+	switch (packageManager) {
+		case "pnpm": return [["pnpm", [
+			"install",
+			"--frozen-lockfile",
+			...ignore ? ["--ignore-scripts"] : []
+		]], ...allow.length > 0 ? [["pnpm", [
+			"rebuild",
+			"--config.dangerouslyAllowAllBuilds=true",
+			...allow
+		]]] : []];
+		case "npm": return [["npm", [(0, node_fs.existsSync)((0, node_path.join)(cwd, "package-lock.json")) ? "ci" : "install", ...ignore ? ["--ignore-scripts"] : []]], ...allow.length > 0 ? [["npm", [
+			"rebuild",
+			"--dangerously-allow-all-scripts",
+			...allow
+		]]] : []];
+		case "yarn":
+			if ((0, node_fs.existsSync)((0, node_path.join)(cwd, ".yarnrc.yml"))) return [["yarn", [
+				"install",
+				"--immutable",
+				...ignore ? ["--mode=skip-build"] : []
+			]], ...allow.length > 0 ? [["yarn", ["rebuild", ...allow]]] : []];
+			if (allow.length > 0) throw new InstallScriptsAllowlistUnsupported("Yarn 1", allow);
+			return [["yarn", [
+				"install",
+				"--frozen-lockfile",
+				...ignore ? ["--ignore-scripts"] : []
+			]]];
+		case "bun":
+			if (allow.length > 0) throw new InstallScriptsAllowlistUnsupported("bun", allow);
+			return [["bun", [
+				"install",
+				"--frozen-lockfile",
+				...ignore ? ["--ignore-scripts"] : []
+			]]];
+	}
+}
+/**
+* Install the project's dependencies in `sandbox`.
+*
+* ```ts
+* // A checkout nobody has reviewed: no scripts but esbuild's.
+* await installDependencies(sandbox, {
+*   ignoreScripts: true,
+*   allowScripts: ['esbuild'],
+* });
+* ```
+*
+* Resolves with each command's result, in order — with its output when
+* `output` is `capture`.
+*
+* @throws {CommandFailed} when the package manager exits unsuccessfully.
+* @throws {InstallScriptsAllowlistUnsupported} for an allowlist the package
+*   manager cannot honour, before anything is installed.
+*/
+async function installDependencies(sandbox, options = {}) {
+	const cwd = options.cwd ?? sandbox.root;
+	const results = [];
+	const packageManager = options.packageManager ?? require_sniffer.detectPackageManager((0, node_path.resolve)(sandbox.root, cwd));
+	for (const [command, args] of installCommands(packageManager, (0, node_path.resolve)(sandbox.root, cwd), options)) {
+		const result = await sandbox.exec(command, args, {
+			cwd,
+			env: {
+				...sandbox.env,
+				...options.env
+			},
+			timeoutMs: options.timeoutMs ?? 9e5,
+			output: options.output ?? "inherit",
+			...options.signal ? { signal: options.signal } : {}
+		});
+		results.push(result);
+		if (result.exitCode !== 0) throw new require_sniffer.CommandFailed(command, args, result.exitCode, result.signal);
+	}
+	return results;
+}
+//#endregion
 exports.BackendDeployFailed = require_deploy$1.BackendDeployFailed;
+exports.CommandFailed = require_sniffer.CommandFailed;
+exports.CommandTimedOut = require_sniffer.CommandTimedOut;
+exports.ConfigLoadFailed = require_config.ConfigLoadFailed;
+exports.ConfigObjectNotSerializable = require_config.ConfigObjectNotSerializable;
+exports.ConstructDiscoveryFailed = require_discover.ConstructDiscoveryFailed;
+exports.ConstructsNotSerializable = require_discover.ConstructsNotSerializable;
 exports.DeployTargetNotYetSupported = require_define.DeployTargetNotYetSupported;
 exports.GKM_HOME_ENV = require_home.GKM_HOME_ENV;
+exports.INSTALL_TIMEOUT_MS = INSTALL_TIMEOUT_MS;
+exports.InstallAllowlistNameInvalid = InstallAllowlistNameInvalid;
+exports.InstallScriptsAllowlistUnsupported = InstallScriptsAllowlistUnsupported;
 exports.InvalidTargetOptions = require_resolve.InvalidTargetOptions;
+exports.LocalSandbox = require_sniffer.LocalSandbox;
 exports.MissingCredential = require_terminal.MissingCredential;
 exports.MissingEnvVars = require_deploy$1.MissingEnvVars;
 exports.NoDeployableApps = require_terminal.NoDeployableApps;
@@ -21,6 +157,11 @@ exports.RegistryAmbiguous = require_deploy$1.RegistryAmbiguous;
 exports.RegistryNotConfigured = require_deploy$1.RegistryNotConfigured;
 exports.RegistryNotFound = require_deploy$1.RegistryNotFound;
 exports.RollbackFailed = require_terminal.RollbackFailed;
+exports.SANDBOX_ENV_ALLOWLIST = require_sniffer.SANDBOX_ENV_ALLOWLIST;
+exports.SECRETS_DIR_ENV = require_discover.SECRETS_DIR_ENV;
+exports.SandboxCwdEscape = require_discover.SandboxCwdEscape;
+exports.SandboxWorkerFailed = require_discover.SandboxWorkerFailed;
+exports.SecretNameInvalid = require_discover.SecretNameInvalid;
 exports.StateLocked = require_sniffer.StateLocked;
 exports.StateVersionConflict = require_sniffer.StateVersionConflict;
 exports.TargetEntryInvalid = require_resolve.TargetEntryInvalid;
@@ -30,8 +171,13 @@ exports.TargetRuntimeMismatch = require_resolve.TargetRuntimeMismatch;
 exports.TargetRuntimeUndeclared = require_runtime.TargetRuntimeUndeclared;
 exports.UnknownDeployApps = require_terminal.UnknownDeployApps;
 exports.UnknownDeployTarget = require_define.UnknownDeployTarget;
+exports.allowlistedEnv = require_sniffer.allowlistedEnv;
 exports.chainCredentials = require_terminal.chainCredentials;
+exports.confineCwd = require_discover.confineCwd;
 exports.deploy = require_deploy.deploy;
 exports.deployIdentity = require_store.deployIdentity;
 exports.gkmHome = require_home.gkmHome;
+exports.installDependencies = installDependencies;
 exports.storedCredentials = require_terminal.storedCredentials;
+
+//# sourceMappingURL=public.cjs.map

package/dist/deploy/public.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.cjs","names":["existsSync","join","detectPackageManager","resolve","CommandFailed"],"sources":["../../src/sandbox/install.ts"],"sourcesContent":["/**\n * Installing a project's dependencies in a sandbox, with or without their\n * lifecycle scripts.\n *\n * `postinstall` is the oldest way into a build machine: any package in the\n * lockfile — a dependency of a dependency — runs whatever it likes the moment\n * it is installed. For a build the host trusts that is how native modules get\n * built. For one it does not, the scripts are skipped, and the few packages\n * that genuinely need theirs (esbuild's binary, a database driver) are named\n * and rebuilt — with nothing but the sandbox's environment either way.\n */\n\nimport { existsSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { detectPackageManager, type PackageManager } from '../docker/templates';\nimport { CommandFailed } from '../run';\nimport type { Sandbox, SandboxOutput, SandboxResult } from './sandbox';\n\n/** Long enough for a cold install of a large monorepo. */\nexport const INSTALL_TIMEOUT_MS = 15 * 60_000;\n\nexport interface InstallOptions {\n\t/** The directory to install in. Defaults to the sandbox's root. */\n\tcwd?: string;\n\t/** Defaults to the one the lockfile above `cwd` names. */\n\tpackageManager?: PackageManager;\n\t/**\n\t * Skip every lifecycle script — dependencies' and the project's own —\n\t * except those of {@link allowScripts}. Defaults to false: scripts run as\n\t * a plain install runs them, under the package manager's own policy —\n\t * npm 12 and pnpm 10 skip dependencies' scripts nobody approved.\n\t */\n\tignoreScripts?: boolean;\n\t/**\n\t * With `ignoreScripts`, the packages whose scripts still run: rebuilt by\n\t * name once the install is done.\n\t */\n\tallowScripts?: readonly string[];\n\t/** Variables the install needs beyond the sandbox's own. */\n\tenv?: Readonly<Record<string, string>>;\n\t/** Defaults to {@link INSTALL_TIMEOUT_MS}, for each command. */\n\ttimeoutMs?: number;\n\t/** Where the package manager's output goes. Defaults to `inherit`. */\n\toutput?: SandboxOutput;\n\tsignal?: AbortSignal;\n}\n\n/** A name in `allowScripts` that is not a package name. */\nexport class InstallAllowlistNameInvalid extends Error {\n\tconstructor(readonly packageName: string) {\n\t\tsuper(\n\t\t\t`'${packageName}' is not a package name, so its scripts cannot be ` +\n\t\t\t\t'allowed. Name the package as it appears in package.json — ' +\n\t\t\t\t\"'esbuild', '@prisma/client'.\",\n\t\t);\n\t\tthis.name = 'InstallAllowlistNameInvalid';\n\t}\n}\n\n/** The package manager has no way to run only some packages' scripts. */\nexport class InstallScriptsAllowlistUnsupported extends Error {\n\tconstructor(\n\t\treadonly packageManager: string,\n\t\treadonly allowScripts: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`${packageManager} cannot rebuild named packages after an install ` +\n\t\t\t\t`without scripts, so ${allowScripts.join(', ')} cannot be allowed ` +\n\t\t\t\t'theirs. Use pnpm, npm or Yarn 2+, or install with every script ' +\n\t\t\t\t'skipped.',\n\t\t);\n\t\tthis.name = 'InstallScriptsAllowlistUnsupported';\n\t}\n}\n\n/**\n * npm's package-name grammar, less a leading `-`: each name is an argument to\n * `rebuild`, and must never be read as a flag.\n */\nconst PACKAGE_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\\/)?[a-z0-9~][a-z0-9._~-]*$/;\n\n/**\n * The commands an install runs, in order. Exported for the tests, which\n * check each package manager's flags without installing with all four.\n */\nexport function installCommands(\n\tpackageManager: PackageManager,\n\tcwd: string,\n\toptions: Pick<InstallOptions, 'ignoreScripts' | 'allowScripts'> = {},\n): [string, string[]][] {\n\tconst ignore = options.ignoreScripts ?? false;\n\tconst allow = ignore ? [...(options.allowScripts ?? [])] : [];\n\tfor (const name of allow) {\n\t\tif (!PACKAGE_NAME.test(name)) throw new InstallAllowlistNameInvalid(name);\n\t}\n\n\tswitch (packageManager) {\n\t\tcase 'pnpm':\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'pnpm',\n\t\t\t\t\t[\n\t\t\t\t\t\t'install',\n\t\t\t\t\t\t'--frozen-lockfile',\n\t\t\t\t\t\t...(ignore ? ['--ignore-scripts'] : []),\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t\t// pnpm 10 builds no dependency it was not told to, even by name;\n\t\t\t\t// this command names exactly the ones allowed, so it may build\n\t\t\t\t// what it names.\n\t\t\t\t...(allow.length > 0\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'pnpm',\n\t\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t\t'rebuild',\n\t\t\t\t\t\t\t\t\t'--config.dangerouslyAllowAllBuilds=true',\n\t\t\t\t\t\t\t\t\t...allow,\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t] as [string, string[]],\n\t\t\t\t\t\t]\n\t\t\t\t\t: []),\n\t\t\t];\n\t\tcase 'npm': {\n\t\t\tconst locked = existsSync(join(cwd, 'package-lock.json'));\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'npm',\n\t\t\t\t\t[locked ? 'ci' : 'install', ...(ignore ? ['--ignore-scripts'] : [])],\n\t\t\t\t],\n\t\t\t\t// npm 12 runs no dependency's install script its `allowScripts`\n\t\t\t\t// policy does not approve, rebuilt by name or not, and refuses\n\t\t\t\t// `--allow-scripts` on a project's command line. This command\n\t\t\t\t// names exactly the packages allowed, so it may run what it names.\n\t\t\t\t...(allow.length > 0\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'npm',\n\t\t\t\t\t\t\t\t['rebuild', '--dangerously-allow-all-scripts', ...allow],\n\t\t\t\t\t\t\t] as [string, string[]],\n\t\t\t\t\t\t]\n\t\t\t\t\t: []),\n\t\t\t];\n\t\t}\n\t\tcase 'yarn': {\n\t\t\t// Yarn 2+ keeps a `.yarnrc.yml`; it skips builds by mode and can\n\t\t\t// rebuild by name. Yarn 1 can only skip them all.\n\t\t\tconst berry = existsSync(join(cwd, '.yarnrc.yml'));\n\t\t\tif (berry) {\n\t\t\t\treturn [\n\t\t\t\t\t[\n\t\t\t\t\t\t'yarn',\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'install',\n\t\t\t\t\t\t\t'--immutable',\n\t\t\t\t\t\t\t...(ignore ? ['--mode=skip-build'] : []),\n\t\t\t\t\t\t],\n\t\t\t\t\t],\n\t\t\t\t\t...(allow.length > 0\n\t\t\t\t\t\t? [['yarn', ['rebuild', ...allow]] as [string, string[]]]\n\t\t\t\t\t\t: []),\n\t\t\t\t];\n\t\t\t}\n\t\t\tif (allow.length > 0) {\n\t\t\t\tthrow new InstallScriptsAllowlistUnsupported('Yarn 1', allow);\n\t\t\t}\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'yarn',\n\t\t\t\t\t[\n\t\t\t\t\t\t'install',\n\t\t\t\t\t\t'--frozen-lockfile',\n\t\t\t\t\t\t...(ignore ? ['--ignore-scripts'] : []),\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t];\n\t\t}\n\t\tcase 'bun':\n\t\t\tif (allow.length > 0) {\n\t\t\t\tthrow new InstallScriptsAllowlistUnsupported('bun', allow);\n\t\t\t}\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'bun',\n\t\t\t\t\t[\n\t\t\t\t\t\t'install',\n\t\t\t\t\t\t'--frozen-lockfile',\n\t\t\t\t\t\t...(ignore ? ['--ignore-scripts'] : []),\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t];\n\t}\n}\n\n/**\n * Install the project's dependencies in `sandbox`.\n *\n * ```ts\n * // A checkout nobody has reviewed: no scripts but esbuild's.\n * await installDependencies(sandbox, {\n *   ignoreScripts: true,\n *   allowScripts: ['esbuild'],\n * });\n * ```\n *\n * Resolves with each command's result, in order — with its output when\n * `output` is `capture`.\n *\n * @throws {CommandFailed} when the package manager exits unsuccessfully.\n * @throws {InstallScriptsAllowlistUnsupported} for an allowlist the package\n *   manager cannot honour, before anything is installed.\n */\nexport async function installDependencies(\n\tsandbox: Sandbox,\n\toptions: InstallOptions = {},\n): Promise<SandboxResult[]> {\n\tconst cwd = options.cwd ?? sandbox.root;\n\tconst results: SandboxResult[] = [];\n\tconst packageManager =\n\t\toptions.packageManager ?? detectPackageManager(resolve(sandbox.root, cwd));\n\n\tfor (const [command, args] of installCommands(\n\t\tpackageManager,\n\t\tresolve(sandbox.root, cwd),\n\t\toptions,\n\t)) {\n\t\tconst result = await sandbox.exec(command, args, {\n\t\t\tcwd,\n\t\t\tenv: { ...sandbox.env, ...options.env },\n\t\t\ttimeoutMs: options.timeoutMs ?? INSTALL_TIMEOUT_MS,\n\t\t\toutput: options.output ?? 'inherit',\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t});\n\t\tresults.push(result);\n\t\tif (result.exitCode !== 0) {\n\t\t\tthrow new CommandFailed(\n\t\t\t\tcommand,\n\t\t\t\targs,\n\t\t\t\tresult.exitCode,\n\t\t\t\tresult.signal as NodeJS.Signals | null,\n\t\t\t);\n\t\t}\n\t}\n\treturn results;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,MAAa,qBAAqB;;AA6BlC,IAAa,8BAAb,cAAiD,MAAM;CACjC;CAArB,YAAY,aAA8B;EACzC,MACC,IAAI,YAAY,yIAGjB;EALoB,KAAA,cAAA;EAMpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qCAAb,cAAwD,MAAM;CAEnD;CACA;CAFV,YACC,gBACA,cACC;EACD,MACC,GAAG,eAAe,sEACM,aAAa,KAAK,IAAI,EAAE,2FAGjD;EARS,KAAA,iBAAA;EACA,KAAA,eAAA;EAQT,KAAK,OAAO;CACb;AACD;;;;;AAMA,MAAM,eAAe;;;;;AAMrB,SAAgB,gBACf,gBACA,KACA,UAAkE,CAAC,GAC5C;CACvB,MAAM,SAAS,QAAQ,iBAAiB;CACxC,MAAM,QAAQ,SAAS,CAAC,GAAI,QAAQ,gBAAgB,CAAC,CAAE,IAAI,CAAC;CAC5D,KAAK,MAAM,QAAQ,OAClB,IAAI,CAAC,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI,4BAA4B,IAAI;CAGzE,QAAQ,gBAAR;EACC,KAAK,QACJ,OAAO,CACN,CACC,QACA;GACC;GACA;GACA,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC;EACtC,CACD,GAIA,GAAI,MAAM,SAAS,IAChB,CACA,CACC,QACA;GACC;GACA;GACA,GAAG;EACJ,CACD,CACD,IACC,CAAC,CACL;EACD,KAAK,OAEJ,OAAO,CACN,CACC,OACA,EAAA,GAJaA,QAAAA,WAAAA,EAAAA,GAAWC,UAAAA,KAAAA,CAAK,KAAK,mBAAmB,CAI/C,IAAI,OAAO,WAAW,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC,CAAE,CACpE,GAKA,GAAI,MAAM,SAAS,IAChB,CACA,CACC,OACA;GAAC;GAAW;GAAmC,GAAG;EAAK,CACxD,CACD,IACC,CAAC,CACL;EAED,KAAK;GAIJ,KAAA,GADcD,QAAAA,WAAAA,EAAAA,GAAWC,UAAAA,KAAAA,CAAK,KAAK,aAAa,CACxC,GACP,OAAO,CACN,CACC,QACA;IACC;IACA;IACA,GAAI,SAAS,CAAC,mBAAmB,IAAI,CAAC;GACvC,CACD,GACA,GAAI,MAAM,SAAS,IAChB,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,CAAuB,IACtD,CAAC,CACL;GAED,IAAI,MAAM,SAAS,GAClB,MAAM,IAAI,mCAAmC,UAAU,KAAK;GAE7D,OAAO,CACN,CACC,QACA;IACC;IACA;IACA,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC;GACtC,CACD,CACD;EAED,KAAK;GACJ,IAAI,MAAM,SAAS,GAClB,MAAM,IAAI,mCAAmC,OAAO,KAAK;GAE1D,OAAO,CACN,CACC,OACA;IACC;IACA;IACA,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC;GACtC,CACD,CACD;CACF;AACD;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,oBACrB,SACA,UAA0B,CAAC,GACA;CAC3B,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,UAA2B,CAAC;CAClC,MAAM,iBACL,QAAQ,kBAAkBC,gBAAAA,sBAAAA,GAAqBC,UAAAA,QAAAA,CAAQ,QAAQ,MAAM,GAAG,CAAC;CAE1E,KAAK,MAAM,CAAC,SAAS,SAAS,gBAC7B,iBAAA,GACAA,UAAAA,QAAAA,CAAQ,QAAQ,MAAM,GAAG,GACzB,OACD,GAAG;EACF,MAAM,SAAS,MAAM,QAAQ,KAAK,SAAS,MAAM;GAChD;GACA,KAAK;IAAE,GAAG,QAAQ;IAAK,GAAG,QAAQ;GAAI;GACtC,WAAW,QAAQ,aAAA;GACnB,QAAQ,QAAQ,UAAU;GAC1B,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACpD,CAAC;EACD,QAAQ,KAAK,MAAM;EACnB,IAAI,OAAO,aAAa,GACvB,MAAM,IAAIC,gBAAAA,cACT,SACA,MACA,OAAO,UACP,OAAO,MACR;CAEF;CACA,OAAO;AACR"}