@geekmidas/cli 10.0.0-alpha.62 → 10.0.0-alpha.64

package/dist/credentials-s0wMeZBU.mjs

@@ -0,0 +1,108 @@
+import { m as readCredentials } from "./local-Cd8ZYQG3.mjs";
+//#region src/deploy/credentials.ts
+/**
+* How a deploy gets the credentials it acts with.
+*
+* `deploy()` never prompts and never reads a terminal: it asks a
+* `CredentialProvider` and, when the provider has nothing, stops with
+* `MissingCredential` naming what it needed and how to supply it. Whether to
+* ask a person, read a vault or fail is the caller's decision — `gkm deploy`
+* prompts at a terminal and stores what was typed; a CI job sets the
+* environment; a host passes its own provider.
+*/
+/**
+* How to supply each kind the CLI knows, for the error that says it is
+* missing. A target's own kinds are its to explain.
+*/
+const HOW_TO_PROVIDE = {
+	dokploy: "Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.",
+	registry: "Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them.",
+	aws: "Set AWS_PROFILE to the stage account's profile, or AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN) — in CI, the keys aws-actions/configure-aws-credentials exports — or pass them through the deploy's CredentialProvider."
+};
+/** A deploy needed a credential, and its provider had none. */
+var MissingCredential = class extends Error {
+	kind;
+	target;
+	howToProvide;
+	constructor(kind, target, howToProvide = HOW_TO_PROVIDE[kind] ?? "Pass it through the deploy's CredentialProvider.") {
+		const what = kind === "dokploy" ? `No Dokploy credentials${target ? ` for ${target}` : ""}.` : kind === "registry" ? `Dokploy has no registry for ${target ?? "the configured registry"}, and there are no credentials to create one with.` : kind === "aws" ? `No AWS credentials${target ? ` for the "${target}" stage` : ""}.` : `No "${String(kind)}" credentials${target ? ` for ${target}` : ""}.`;
+		super(`${what} ${howToProvide}`);
+		this.kind = kind;
+		this.target = target;
+		this.howToProvide = howToProvide;
+		this.name = "MissingCredential";
+	}
+};
+/** Whatever was asked for, from the first provider that has it. */
+function chainCredentials(...providers) {
+	return { async get(request, options) {
+		for (const provider of providers) {
+			const found = await provider.get(request, options);
+			if (found) return found;
+		}
+	} };
+}
+/**
+* Credentials from the environment, then from what `gkm login` stored. What
+* `deploy()` uses when it is handed no provider.
+*
+* - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
+*   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
+*   Each half is read on its own: a token is a secret and belongs in the
+*   environment, an endpoint is configuration and belongs in the config.
+* - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
+* - AWS: `AWS_PROFILE` when it is set, and then nothing else; otherwise
+*   `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`. The
+*   profile winning is `secretsStoreFor`'s rule: a profile is a choice of
+*   account someone made, exported keys may be left over from another.
+*   Read here, by name, and handed only to the command that deploys — the
+*   sandbox every other step runs in passes no `AWS_*` on.
+*/
+function storedCredentials(options = {}) {
+	const env = options.env ?? process.env;
+	return { async get(asked) {
+		const request = asked;
+		switch (request.kind) {
+			case "dokploy": {
+				const stored = (await readCredentials(options.home ? { home: options.home } : void 0)).dokploy;
+				const token = env.DOKPLOY_API_TOKEN ?? stored?.token;
+				const endpoint = env.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;
+				if (!token || !endpoint) return void 0;
+				return {
+					endpoint: endpoint.replace(/\/$/, ""),
+					token
+				};
+			}
+			case "registry": {
+				const username = env.DOCKER_REGISTRY_USERNAME;
+				const password = env.DOCKER_REGISTRY_PASSWORD;
+				if (!username || !password) return void 0;
+				return {
+					username,
+					password
+				};
+			}
+			case "aws": {
+				const region = env.AWS_REGION ?? env.AWS_DEFAULT_REGION;
+				const where = region ? { region } : {};
+				if (env.AWS_PROFILE) return {
+					profile: env.AWS_PROFILE,
+					...where
+				};
+				const accessKeyId = env.AWS_ACCESS_KEY_ID;
+				const secretAccessKey = env.AWS_SECRET_ACCESS_KEY;
+				if (!accessKeyId || !secretAccessKey) return void 0;
+				return {
+					accessKeyId,
+					secretAccessKey,
+					...env.AWS_SESSION_TOKEN ? { sessionToken: env.AWS_SESSION_TOKEN } : {},
+					...where
+				};
+			}
+		}
+	} };
+}
+//#endregion
+export { chainCredentials as n, storedCredentials as r, MissingCredential as t };
+
+//# sourceMappingURL=credentials-s0wMeZBU.mjs.map

package/dist/credentials-s0wMeZBU.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-s0wMeZBU.mjs","names":[],"sources":["../src/deploy/credentials.ts"],"sourcesContent":["/**\n * How a deploy gets the credentials it acts with.\n *\n * `deploy()` never prompts and never reads a terminal: it asks a\n * `CredentialProvider` and, when the provider has nothing, stops with\n * `MissingCredential` naming what it needed and how to supply it. Whether to\n * ask a person, read a vault or fail is the caller's decision — `gkm deploy`\n * prompts at a terminal and stores what was typed; a CI job sets the\n * environment; a host passes its own provider.\n */\n\nimport { readCredentials } from '../auth/credentials';\n\n/**\n * What each kind of credential is asked for with, and what it is.\n *\n * A target that needs a kind the CLI does not know declares it by augmenting\n * this interface, and lists it in its `credentials`:\n *\n * ```ts\n * declare module '@geekmidas/cli/target' {\n *   interface CredentialKinds {\n *     fly: { request: { org: string }; value: { token: string } };\n *   }\n * }\n * ```\n */\nexport interface CredentialKinds {\n\t/** The Dokploy API a stage deploys through. */\n\tdokploy: {\n\t\t/** `deploy.dokploy.endpoint`, when the config names one. */\n\t\trequest: { endpoint?: string };\n\t\tvalue: { endpoint: string; token: string };\n\t};\n\t/**\n\t * A container registry login, for Dokploy to pull with. Asked for only when\n\t * Dokploy has no registry for `deploy.dokploy.registry` and one has to be\n\t * created.\n\t */\n\tregistry: {\n\t\t/** `deploy.dokploy.registry`. */\n\t\trequest: { url: string };\n\t\tvalue: { username: string; password: string };\n\t};\n\t/**\n\t * The AWS account a stage deploys to, for the SST target's `sst deploy`.\n\t * Handed to that one command's environment and to nothing else.\n\t */\n\taws: {\n\t\t/** The stage, for a provider that keeps one account per stage. */\n\t\trequest: { stage: string };\n\t\tvalue: AwsCredential;\n\t};\n}\n\n/**\n * Who to act as on AWS: a named profile, or keys.\n *\n * Never both. Given both, every AWS SDK takes the keys and ignores the\n * profile, so `--profile prod` with staging's keys still exported would deploy\n * production's stack into staging's account — the reason `secretsStoreFor`\n * resolves a named profile on its own, and why this cannot express the mix.\n */\nexport type AwsCredential =\n\t| {\n\t\t\t/** A profile in `~/.aws/config` — keys, SSO, an assumed role. */\n\t\t\tprofile: string;\n\t\t\tregion?: string;\n\t  }\n\t| {\n\t\t\taccessKeyId: string;\n\t\t\tsecretAccessKey: string;\n\t\t\t/** Present for temporary keys: an assumed role, GitHub's OIDC. */\n\t\t\tsessionToken?: string;\n\t\t\tregion?: string;\n\t  };\n\nexport type CredentialKind = keyof CredentialKinds;\n\n/** What a deploy asks a provider for. */\nexport type CredentialRequest<K extends CredentialKind = CredentialKind> = {\n\t[P in K]: { kind: P } & CredentialKinds[P]['request'];\n}[K];\n\n/** What a provider answers with. */\nexport type Credential<K extends CredentialKind> = CredentialKinds[K]['value'];\n\nexport interface CredentialProvider {\n\t/**\n\t * The credential `request` asks for, or `undefined` when this provider has\n\t * none — the deploy then raises {@link MissingCredential}.\n\t */\n\tget<K extends CredentialKind>(\n\t\trequest: CredentialRequest<K>,\n\t\toptions?: { signal?: AbortSignal },\n\t): Promise<Credential<K> | undefined>;\n}\n\n/**\n * How to supply each kind the CLI knows, for the error that says it is\n * missing. A target's own kinds are its to explain.\n */\nconst HOW_TO_PROVIDE: Partial<Record<CredentialKind, string>> = {\n\tdokploy:\n\t\t\"Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.\",\n\tregistry:\n\t\t'Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them.',\n\taws: \"Set AWS_PROFILE to the stage account's profile, or AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN) — in CI, the keys aws-actions/configure-aws-credentials exports — or pass them through the deploy's CredentialProvider.\",\n};\n\n/** A deploy needed a credential, and its provider had none. */\nexport class MissingCredential extends Error {\n\tconstructor(\n\t\treadonly kind: CredentialKind,\n\t\t/** What it was for: the Dokploy endpoint or the registry URL. */\n\t\treadonly target: string | undefined,\n\t\t/** How to supply it. */\n\t\treadonly howToProvide: string = HOW_TO_PROVIDE[kind] ??\n\t\t\t\"Pass it through the deploy's CredentialProvider.\",\n\t) {\n\t\tconst what =\n\t\t\tkind === 'dokploy'\n\t\t\t\t? `No Dokploy credentials${target ? ` for ${target}` : ''}.`\n\t\t\t\t: kind === 'registry'\n\t\t\t\t\t? `Dokploy has no registry for ${target ?? 'the configured registry'}, and there are no credentials to create one with.`\n\t\t\t\t\t: kind === 'aws'\n\t\t\t\t\t\t? `No AWS credentials${target ? ` for the \"${target}\" stage` : ''}.`\n\t\t\t\t\t\t: `No \"${String(kind)}\" credentials${target ? ` for ${target}` : ''}.`;\n\t\tsuper(`${what} ${howToProvide}`);\n\t\tthis.name = 'MissingCredential';\n\t}\n}\n\n/** Whatever was asked for, from the first provider that has it. */\nexport function chainCredentials(\n\t...providers: CredentialProvider[]\n): CredentialProvider {\n\treturn {\n\t\tasync get(request, options) {\n\t\t\tfor (const provider of providers) {\n\t\t\t\tconst found = await provider.get(request, options);\n\t\t\t\tif (found) return found;\n\t\t\t}\n\t\t\treturn undefined;\n\t\t},\n\t};\n}\n\nexport interface StoredCredentialsOptions {\n\t/** Where to read the variables from. Defaults to `process.env`. */\n\tenv?: NodeJS.ProcessEnv;\n\t/**\n\t * The CLI's home, whose `credentials.json` holds stored logins. Defaults\n\t * to `GKM_HOME`, else `~/.gkm`.\n\t */\n\thome?: string;\n}\n\n/**\n * Credentials from the environment, then from what `gkm login` stored. What\n * `deploy()` uses when it is handed no provider.\n *\n * - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to\n *   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.\n *   Each half is read on its own: a token is a secret and belongs in the\n *   environment, an endpoint is configuration and belongs in the config.\n * - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.\n * - AWS: `AWS_PROFILE` when it is set, and then nothing else; otherwise\n *   `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`. The\n *   profile winning is `secretsStoreFor`'s rule: a profile is a choice of\n *   account someone made, exported keys may be left over from another.\n *   Read here, by name, and handed only to the command that deploys — the\n *   sandbox every other step runs in passes no `AWS_*` on.\n */\nexport function storedCredentials(\n\toptions: StoredCredentialsOptions = {},\n): CredentialProvider {\n\tconst env = options.env ?? process.env;\n\n\treturn {\n\t\tasync get(asked) {\n\t\t\t// The union, so a switch on `kind` narrows it: `K` itself never is.\n\t\t\tconst request = asked as CredentialRequest;\n\t\t\tswitch (request.kind) {\n\t\t\t\tcase 'dokploy': {\n\t\t\t\t\tconst stored = (\n\t\t\t\t\t\tawait readCredentials(\n\t\t\t\t\t\t\toptions.home ? { home: options.home } : undefined,\n\t\t\t\t\t\t)\n\t\t\t\t\t).dokploy;\n\t\t\t\t\tconst token = env.DOKPLOY_API_TOKEN ?? stored?.token;\n\t\t\t\t\tconst endpoint =\n\t\t\t\t\t\tenv.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;\n\t\t\t\t\tif (!token || !endpoint) return undefined;\n\t\t\t\t\treturn { endpoint: endpoint.replace(/\\/$/, ''), token } as never;\n\t\t\t\t}\n\t\t\t\tcase 'registry': {\n\t\t\t\t\tconst username = env.DOCKER_REGISTRY_USERNAME;\n\t\t\t\t\tconst password = env.DOCKER_REGISTRY_PASSWORD;\n\t\t\t\t\tif (!username || !password) return undefined;\n\t\t\t\t\treturn { username, password } as never;\n\t\t\t\t}\n\t\t\t\tcase 'aws': {\n\t\t\t\t\tconst region = env.AWS_REGION ?? env.AWS_DEFAULT_REGION;\n\t\t\t\t\tconst where = region ? { region } : {};\n\t\t\t\t\tif (env.AWS_PROFILE) {\n\t\t\t\t\t\treturn { profile: env.AWS_PROFILE, ...where } as never;\n\t\t\t\t\t}\n\t\t\t\t\tconst accessKeyId = env.AWS_ACCESS_KEY_ID;\n\t\t\t\t\tconst secretAccessKey = env.AWS_SECRET_ACCESS_KEY;\n\t\t\t\t\tif (!accessKeyId || !secretAccessKey) return undefined;\n\t\t\t\t\treturn {\n\t\t\t\t\t\taccessKeyId,\n\t\t\t\t\t\tsecretAccessKey,\n\t\t\t\t\t\t...(env.AWS_SESSION_TOKEN\n\t\t\t\t\t\t\t? { sessionToken: env.AWS_SESSION_TOKEN }\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t...where,\n\t\t\t\t\t} as never;\n\t\t\t\t}\n\t\t\t}\n\t\t\t// A kind a target declared: nothing stored here can answer it.\n\t\t\treturn undefined;\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAsGA,MAAM,iBAA0D;CAC/D,SACC;CACD,UACC;CACD,KAAK;AACN;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CAEA;CAEA;CALV,YACC,MAEA,QAEA,eAAgC,eAAe,SAC9C,oDACA;EACD,MAAM,OACL,SAAS,YACN,yBAAyB,SAAS,QAAQ,WAAW,GAAG,KACxD,SAAS,aACR,+BAA+B,UAAU,0BAA0B,sDACnE,SAAS,QACR,qBAAqB,SAAS,aAAa,OAAO,WAAW,GAAG,KAChE,OAAO,OAAO,IAAI,EAAE,eAAe,SAAS,QAAQ,WAAW,GAAG;EACxE,MAAM,GAAG,KAAK,GAAG,cAAc;EAftB,KAAA,OAAA;EAEA,KAAA,SAAA;EAEA,KAAA,eAAA;EAYT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,iBACf,GAAG,WACkB;CACrB,OAAO,EACN,MAAM,IAAI,SAAS,SAAS;EAC3B,KAAK,MAAM,YAAY,WAAW;GACjC,MAAM,QAAQ,MAAM,SAAS,IAAI,SAAS,OAAO;GACjD,IAAI,OAAO,OAAO;EACnB;CAED,EACD;AACD;;;;;;;;;;;;;;;;;AA4BA,SAAgB,kBACf,UAAoC,CAAC,GAChB;CACrB,MAAM,MAAM,QAAQ,OAAO,QAAQ;CAEnC,OAAO,EACN,MAAM,IAAI,OAAO;EAEhB,MAAM,UAAU;EAChB,QAAQ,QAAQ,MAAhB;GACC,KAAK,WAAW;IACf,MAAM,UACL,MAAM,gBACL,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,KAAA,CACzC,EAAA,CACC;IACF,MAAM,QAAQ,IAAI,qBAAqB,QAAQ;IAC/C,MAAM,WACL,IAAI,oBAAoB,QAAQ,YAAY,QAAQ;IACrD,IAAI,CAAC,SAAS,CAAC,UAAU,OAAO,KAAA;IAChC,OAAO;KAAE,UAAU,SAAS,QAAQ,OAAO,EAAE;KAAG;IAAM;GACvD;GACA,KAAK,YAAY;IAChB,MAAM,WAAW,IAAI;IACrB,MAAM,WAAW,IAAI;IACrB,IAAI,CAAC,YAAY,CAAC,UAAU,OAAO,KAAA;IACnC,OAAO;KAAE;KAAU;IAAS;GAC7B;GACA,KAAK,OAAO;IACX,MAAM,SAAS,IAAI,cAAc,IAAI;IACrC,MAAM,QAAQ,SAAS,EAAE,OAAO,IAAI,CAAC;IACrC,IAAI,IAAI,aACP,OAAO;KAAE,SAAS,IAAI;KAAa,GAAG;IAAM;IAE7C,MAAM,cAAc,IAAI;IACxB,MAAM,kBAAkB,IAAI;IAC5B,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;IAC7C,OAAO;KACN;KACA;KACA,GAAI,IAAI,oBACL,EAAE,cAAc,IAAI,kBAAkB,IACtC,CAAC;KACJ,GAAG;IACJ;GACD;EACD;CAGD,EACD;AACD"}

package/dist/{define-CHBIEc5j.mjs → define-CYs0PEfZ.mjs}

@@ -6,8 +6,7 @@ const BUILTIN_TARGETS = {
 	},
 	sst: {
 		runtime: "aws",
-		status: "external",
-		instead: (stage) => `run \`gkm build && sst deploy --stage ${stage}\``
+		status: "available"
 	},
 	vercel: {
 		runtime: "aws",
@@ -91,4 +90,4 @@ function isDeployTarget(value) {
 //#endregion
 export { UnknownDeployTarget as a, configuredTarget as c, DeployTargetNotYetSupported as i, isDeployTarget as n, builtinTarget as o, BUILTIN_TARGETS as r, configurableBuiltins as s, defineTarget as t };
 
-//# sourceMappingURL=define-CHBIEc5j.mjs.map
+//# sourceMappingURL=define-CYs0PEfZ.mjs.map

package/dist/define-CYs0PEfZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-CYs0PEfZ.mjs","names":[],"sources":["../src/target/builtins.ts","../src/target/define.ts"],"sourcesContent":["/**\n * The target names the CLI knows without being told, and how a name is\n * looked up.\n *\n * Plain data, so the config schema and `providerOf` — which `gkm dev` and\n * `gkm build` call synchronously on every start — can ask what a name means\n * without importing a deploy engine.\n */\n\nimport type { DeployRuntime, DeployTargetEntry } from './types';\n\n/**\n * - `available`: `gkm deploy` deploys through it.\n * - `external`: a valid `deploy.default` that builds and runs locally, but is\n *   deployed by its own tool — `gkm deploy` refuses it and says which.\n * - `planned`: reserved, and refused everywhere.\n */\nexport type BuiltinStatus = 'available' | 'external' | 'planned';\n\nexport interface BuiltinTarget {\n\treadonly runtime: DeployRuntime;\n\treadonly status: BuiltinStatus;\n\t/** What to do instead, for a target `gkm deploy` cannot deploy through yet. */\n\treadonly instead?: (stage: string) => string;\n}\n\nexport const BUILTIN_TARGETS = {\n\tdokploy: { runtime: 'server', status: 'available' },\n\tsst: { runtime: 'aws', status: 'available' },\n\t// Neither runs containers the project controls, so both take the managed\n\t// defaults when they arrive.\n\tvercel: { runtime: 'aws', status: 'planned' },\n\tcloudflare: { runtime: 'aws', status: 'planned' },\n} as const satisfies Record<string, BuiltinTarget>;\n\nexport type BuiltinTargetName = keyof typeof BUILTIN_TARGETS;\n\n/** The built-in target called `name`, if one is. */\nexport function builtinTarget(name: string): BuiltinTarget | undefined {\n\treturn Object.hasOwn(BUILTIN_TARGETS, name)\n\t\t? BUILTIN_TARGETS[name as BuiltinTargetName]\n\t\t: undefined;\n}\n\n/** Built-in names a config may use. */\nexport function configurableBuiltins(): string[] {\n\treturn Object.entries(BUILTIN_TARGETS)\n\t\t.filter(([, target]) => target.status !== 'planned')\n\t\t.map(([name]) => name);\n}\n\n/** The `deploy.targets` entry called `name`, if the config has one. */\nexport function configuredTarget(\n\tdeploy: { targets?: Record<string, DeployTargetEntry> } | undefined,\n\tname: string,\n): DeployTargetEntry | undefined {\n\tconst targets = deploy?.targets;\n\treturn targets && Object.hasOwn(targets, name) ? targets[name] : undefined;\n}\n\n/** A target name that is neither built in nor in `deploy.targets`. */\nexport class UnknownDeployTarget extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\t/** The names that would have resolved. */\n\t\treadonly known: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Unknown deploy target \"${target}\". Use one of ${known.join(', ')}, or name the package that provides it in gkm.config.ts: deploy: { targets: { ${JSON.stringify(target)}: '<package>' } }.`,\n\t\t);\n\t\tthis.name = 'UnknownDeployTarget';\n\t}\n}\n\n/** A built-in target `gkm deploy` cannot deploy through yet. */\nexport class DeployTargetNotYetSupported extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\t/** What to do instead, when there is something. */\n\t\treadonly instead?: string,\n\t) {\n\t\tsuper(\n\t\t\tinstead\n\t\t\t\t? `gkm deploy cannot deploy through \"${target}\" yet: ${instead}.`\n\t\t\t\t: `Deploy target \"${target}\" is not supported yet. Deploy with dokploy, or name a target package in deploy.targets.`,\n\t\t);\n\t\tthis.name = 'DeployTargetNotYetSupported';\n\t}\n}\n","import type { AnyDeployTarget, DeployTarget } from './types';\n\n/**\n * A deploy target, typed from what it is written with: the options from its\n * `options` schema, the run state from what `validate` returns. Nothing\n * happens at runtime — it returns the target as given.\n *\n * ```ts\n * export default defineTarget({\n *   name: 'fly',\n *   runtime: 'server',\n *   capabilities: { rollback: true, migrations: 'target', images: true },\n *   options: z.object({ org: z.string() }),\n *   async validate(ctx) {\n *     return { org: ctx.options.org }; // ctx.options: { org: string }\n *   },\n *   async release(ctx, run) { … },       // run: { org: string }\n *   …\n * });\n * ```\n */\nexport function defineTarget<Options = undefined, Run = void>(\n\ttarget: DeployTarget<Options, Run>,\n): DeployTarget<Options, Run> {\n\treturn target;\n}\n\n/** Whether `value` has the shape of a target. */\nexport function isDeployTarget(value: unknown): value is AnyDeployTarget {\n\tif (!value || typeof value !== 'object') return false;\n\tconst candidate = value as Record<string, unknown>;\n\treturn (\n\t\ttypeof candidate.name === 'string' &&\n\t\t(candidate.runtime === 'server' || candidate.runtime === 'aws') &&\n\t\ttypeof candidate.capabilities === 'object' &&\n\t\tcandidate.capabilities !== null &&\n\t\t['validate', 'plan', 'release', 'result'].every(\n\t\t\t(phase) => typeof candidate[phase] === 'function',\n\t\t)\n\t);\n}\n"],"mappings":";AA0BA,MAAa,kBAAkB;CAC9B,SAAS;EAAE,SAAS;EAAU,QAAQ;CAAY;CAClD,KAAK;EAAE,SAAS;EAAO,QAAQ;CAAY;CAG3C,QAAQ;EAAE,SAAS;EAAO,QAAQ;CAAU;CAC5C,YAAY;EAAE,SAAS;EAAO,QAAQ;CAAU;AACjD;;AAKA,SAAgB,cAAc,MAAyC;CACtE,OAAO,OAAO,OAAO,iBAAiB,IAAI,IACvC,gBAAgB,QAChB,KAAA;AACJ;;AAGA,SAAgB,uBAAiC;CAChD,OAAO,OAAO,QAAQ,eAAe,CAAC,CACpC,QAAQ,GAAG,YAAY,OAAO,WAAW,SAAS,CAAC,CACnD,KAAK,CAAC,UAAU,IAAI;AACvB;;AAGA,SAAgB,iBACf,QACA,MACgC;CAChC,MAAM,UAAU,QAAQ;CACxB,OAAO,WAAW,OAAO,OAAO,SAAS,IAAI,IAAI,QAAQ,QAAQ,KAAA;AAClE;;AAGA,IAAa,sBAAb,cAAyC,MAAM;CAEpC;CAEA;CAHV,YACC,QAEA,OACC;EACD,MACC,0BAA0B,OAAO,gBAAgB,MAAM,KAAK,IAAI,EAAE,gFAAgF,KAAK,UAAU,MAAM,EAAE,mBAC1K;EANS,KAAA,SAAA;EAEA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,8BAAb,cAAiD,MAAM;CAE5C;CAEA;CAHV,YACC,QAEA,SACC;EACD,MACC,UACG,qCAAqC,OAAO,SAAS,QAAQ,KAC7D,kBAAkB,OAAO,yFAC7B;EARS,KAAA,SAAA;EAEA,KAAA,UAAA;EAOT,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;;;;;;;;;;ACnEA,SAAgB,aACf,QAC6B;CAC7B,OAAO;AACR;;AAGA,SAAgB,eAAe,OAA0C;CACxE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,YAAY;CAClB,OACC,OAAO,UAAU,SAAS,aACzB,UAAU,YAAY,YAAY,UAAU,YAAY,UACzD,OAAO,UAAU,iBAAiB,YAClC,UAAU,iBAAiB,QAC3B;EAAC;EAAY;EAAQ;EAAW;CAAQ,CAAC,CAAC,OACxC,UAAU,OAAO,UAAU,WAAW,UACxC;AAEF"}

package/dist/{define-Cv_QvDrg.cjs → define-zUsP72ym.cjs}

@@ -6,8 +6,7 @@ const BUILTIN_TARGETS = {
 	},
 	sst: {
 		runtime: "aws",
-		status: "external",
-		instead: (stage) => `run \`gkm build && sst deploy --stage ${stage}\``
+		status: "available"
 	},
 	vercel: {
 		runtime: "aws",
@@ -138,4 +137,4 @@ Object.defineProperty(exports, "isDeployTarget", {
 	}
 });
 
-//# sourceMappingURL=define-Cv_QvDrg.cjs.map
+//# sourceMappingURL=define-zUsP72ym.cjs.map

package/dist/define-zUsP72ym.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-zUsP72ym.cjs","names":[],"sources":["../src/target/builtins.ts","../src/target/define.ts"],"sourcesContent":["/**\n * The target names the CLI knows without being told, and how a name is\n * looked up.\n *\n * Plain data, so the config schema and `providerOf` — which `gkm dev` and\n * `gkm build` call synchronously on every start — can ask what a name means\n * without importing a deploy engine.\n */\n\nimport type { DeployRuntime, DeployTargetEntry } from './types';\n\n/**\n * - `available`: `gkm deploy` deploys through it.\n * - `external`: a valid `deploy.default` that builds and runs locally, but is\n *   deployed by its own tool — `gkm deploy` refuses it and says which.\n * - `planned`: reserved, and refused everywhere.\n */\nexport type BuiltinStatus = 'available' | 'external' | 'planned';\n\nexport interface BuiltinTarget {\n\treadonly runtime: DeployRuntime;\n\treadonly status: BuiltinStatus;\n\t/** What to do instead, for a target `gkm deploy` cannot deploy through yet. */\n\treadonly instead?: (stage: string) => string;\n}\n\nexport const BUILTIN_TARGETS = {\n\tdokploy: { runtime: 'server', status: 'available' },\n\tsst: { runtime: 'aws', status: 'available' },\n\t// Neither runs containers the project controls, so both take the managed\n\t// defaults when they arrive.\n\tvercel: { runtime: 'aws', status: 'planned' },\n\tcloudflare: { runtime: 'aws', status: 'planned' },\n} as const satisfies Record<string, BuiltinTarget>;\n\nexport type BuiltinTargetName = keyof typeof BUILTIN_TARGETS;\n\n/** The built-in target called `name`, if one is. */\nexport function builtinTarget(name: string): BuiltinTarget | undefined {\n\treturn Object.hasOwn(BUILTIN_TARGETS, name)\n\t\t? BUILTIN_TARGETS[name as BuiltinTargetName]\n\t\t: undefined;\n}\n\n/** Built-in names a config may use. */\nexport function configurableBuiltins(): string[] {\n\treturn Object.entries(BUILTIN_TARGETS)\n\t\t.filter(([, target]) => target.status !== 'planned')\n\t\t.map(([name]) => name);\n}\n\n/** The `deploy.targets` entry called `name`, if the config has one. */\nexport function configuredTarget(\n\tdeploy: { targets?: Record<string, DeployTargetEntry> } | undefined,\n\tname: string,\n): DeployTargetEntry | undefined {\n\tconst targets = deploy?.targets;\n\treturn targets && Object.hasOwn(targets, name) ? targets[name] : undefined;\n}\n\n/** A target name that is neither built in nor in `deploy.targets`. */\nexport class UnknownDeployTarget extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\t/** The names that would have resolved. */\n\t\treadonly known: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Unknown deploy target \"${target}\". Use one of ${known.join(', ')}, or name the package that provides it in gkm.config.ts: deploy: { targets: { ${JSON.stringify(target)}: '<package>' } }.`,\n\t\t);\n\t\tthis.name = 'UnknownDeployTarget';\n\t}\n}\n\n/** A built-in target `gkm deploy` cannot deploy through yet. */\nexport class DeployTargetNotYetSupported extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\t/** What to do instead, when there is something. */\n\t\treadonly instead?: string,\n\t) {\n\t\tsuper(\n\t\t\tinstead\n\t\t\t\t? `gkm deploy cannot deploy through \"${target}\" yet: ${instead}.`\n\t\t\t\t: `Deploy target \"${target}\" is not supported yet. Deploy with dokploy, or name a target package in deploy.targets.`,\n\t\t);\n\t\tthis.name = 'DeployTargetNotYetSupported';\n\t}\n}\n","import type { AnyDeployTarget, DeployTarget } from './types';\n\n/**\n * A deploy target, typed from what it is written with: the options from its\n * `options` schema, the run state from what `validate` returns. Nothing\n * happens at runtime — it returns the target as given.\n *\n * ```ts\n * export default defineTarget({\n *   name: 'fly',\n *   runtime: 'server',\n *   capabilities: { rollback: true, migrations: 'target', images: true },\n *   options: z.object({ org: z.string() }),\n *   async validate(ctx) {\n *     return { org: ctx.options.org }; // ctx.options: { org: string }\n *   },\n *   async release(ctx, run) { … },       // run: { org: string }\n *   …\n * });\n * ```\n */\nexport function defineTarget<Options = undefined, Run = void>(\n\ttarget: DeployTarget<Options, Run>,\n): DeployTarget<Options, Run> {\n\treturn target;\n}\n\n/** Whether `value` has the shape of a target. */\nexport function isDeployTarget(value: unknown): value is AnyDeployTarget {\n\tif (!value || typeof value !== 'object') return false;\n\tconst candidate = value as Record<string, unknown>;\n\treturn (\n\t\ttypeof candidate.name === 'string' &&\n\t\t(candidate.runtime === 'server' || candidate.runtime === 'aws') &&\n\t\ttypeof candidate.capabilities === 'object' &&\n\t\tcandidate.capabilities !== null &&\n\t\t['validate', 'plan', 'release', 'result'].every(\n\t\t\t(phase) => typeof candidate[phase] === 'function',\n\t\t)\n\t);\n}\n"],"mappings":";AA0BA,MAAa,kBAAkB;CAC9B,SAAS;EAAE,SAAS;EAAU,QAAQ;CAAY;CAClD,KAAK;EAAE,SAAS;EAAO,QAAQ;CAAY;CAG3C,QAAQ;EAAE,SAAS;EAAO,QAAQ;CAAU;CAC5C,YAAY;EAAE,SAAS;EAAO,QAAQ;CAAU;AACjD;;AAKA,SAAgB,cAAc,MAAyC;CACtE,OAAO,OAAO,OAAO,iBAAiB,IAAI,IACvC,gBAAgB,QAChB,KAAA;AACJ;;AAGA,SAAgB,uBAAiC;CAChD,OAAO,OAAO,QAAQ,eAAe,CAAC,CACpC,QAAQ,GAAG,YAAY,OAAO,WAAW,SAAS,CAAC,CACnD,KAAK,CAAC,UAAU,IAAI;AACvB;;AAGA,SAAgB,iBACf,QACA,MACgC;CAChC,MAAM,UAAU,QAAQ;CACxB,OAAO,WAAW,OAAO,OAAO,SAAS,IAAI,IAAI,QAAQ,QAAQ,KAAA;AAClE;;AAGA,IAAa,sBAAb,cAAyC,MAAM;CAEpC;CAEA;CAHV,YACC,QAEA,OACC;EACD,MACC,0BAA0B,OAAO,gBAAgB,MAAM,KAAK,IAAI,EAAE,gFAAgF,KAAK,UAAU,MAAM,EAAE,mBAC1K;EANS,KAAA,SAAA;EAEA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,8BAAb,cAAiD,MAAM;CAE5C;CAEA;CAHV,YACC,QAEA,SACC;EACD,MACC,UACG,qCAAqC,OAAO,SAAS,QAAQ,KAC7D,kBAAkB,OAAO,yFAC7B;EARS,KAAA,SAAA;EAEA,KAAA,UAAA;EAOT,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;;;;;;;;;;ACnEA,SAAgB,aACf,QAC6B;CAC7B,OAAO;AACR;;AAGA,SAAgB,eAAe,OAA0C;CACxE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,YAAY;CAClB,OACC,OAAO,UAAU,SAAS,aACzB,UAAU,YAAY,YAAY,UAAU,YAAY,UACzD,OAAO,UAAU,iBAAiB,YAClC,UAAU,iBAAiB,QAC3B;EAAC;EAAY;EAAQ;EAAW;CAAQ,CAAC,CAAC,OACxC,UAAU,OAAO,UAAU,WAAW,UACxC;AAEF"}

package/dist/deploy/public.cjs

@@ -1,18 +1,157 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sniffer = require("../sniffer-BsfPa-GA.cjs");
-const require_home = require("../home-DOzBaWaL.cjs");
-const require_define = require("../define-Cv_QvDrg.cjs");
-const require_store = require("../store-KvNQwYaB.cjs");
-const require_runtime = require("../runtime-CMwtq0AL.cjs");
-const require_resolve = require("../resolve-wbv66HjD.cjs");
-const require_terminal = require("../terminal-6oL0vANs.cjs");
-const require_deploy = require("../deploy-D8Qr-Xto.cjs");
-const require_deploy$1 = require("../deploy-DSaCYvcO.cjs");
+const require_sniffer = require("../sniffer-ByhbEW5A.cjs");
+const require_local = require("../local-C7wnrcYK.cjs");
+const require_discover = require("../discover-DHdECueV.cjs");
+const require_sandbox = require("../sandbox-CL--ZDui.cjs");
+const require_define = require("../define-zUsP72ym.cjs");
+const require_config = require("../config.cjs");
+const require_store = require("../store-D_2ByRtW.cjs");
+const require_runtime = require("../runtime-BGNDrHzh.cjs");
+const require_resolve = require("../resolve-BXsNQjMR.cjs");
+const require_credentials = require("../credentials-B70vmLcm.cjs");
+const require_sst = require("../sst-BdALKEas.cjs");
+const require_terminal = require("../terminal-Bdv--jhY.cjs");
+const require_deploy = require("../deploy-yUcR2OlW.cjs");
+const require_deploy$1 = require("../deploy-55rJkdKz.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+//#region src/sandbox/install.ts
+/**
+* Installing a project's dependencies in a sandbox, with or without their
+* lifecycle scripts.
+*
+* `postinstall` is the oldest way into a build machine: any package in the
+* lockfile — a dependency of a dependency — runs whatever it likes the moment
+* it is installed. For a build the host trusts that is how native modules get
+* built. For one it does not, the scripts are skipped, and the few packages
+* that genuinely need theirs (esbuild's binary, a database driver) are named
+* and rebuilt — with nothing but the sandbox's environment either way.
+*/
+/** Long enough for a cold install of a large monorepo. */
+const INSTALL_TIMEOUT_MS = 9e5;
+/** A name in `allowScripts` that is not a package name. */
+var InstallAllowlistNameInvalid = class extends Error {
+	packageName;
+	constructor(packageName) {
+		super(`'${packageName}' is not a package name, so its scripts cannot be allowed. Name the package as it appears in package.json — 'esbuild', '@prisma/client'.`);
+		this.packageName = packageName;
+		this.name = "InstallAllowlistNameInvalid";
+	}
+};
+/** The package manager has no way to run only some packages' scripts. */
+var InstallScriptsAllowlistUnsupported = class extends Error {
+	packageManager;
+	allowScripts;
+	constructor(packageManager, allowScripts) {
+		super(`${packageManager} cannot rebuild named packages after an install without scripts, so ${allowScripts.join(", ")} cannot be allowed theirs. Use pnpm, npm or Yarn 2+, or install with every script skipped.`);
+		this.packageManager = packageManager;
+		this.allowScripts = allowScripts;
+		this.name = "InstallScriptsAllowlistUnsupported";
+	}
+};
+/**
+* npm's package-name grammar, less a leading `-`: each name is an argument to
+* `rebuild`, and must never be read as a flag.
+*/
+const PACKAGE_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\/)?[a-z0-9~][a-z0-9._~-]*$/;
+/**
+* The commands an install runs, in order. Exported for the tests, which
+* check each package manager's flags without installing with all four.
+*/
+function installCommands(packageManager, cwd, options = {}) {
+	const ignore = options.ignoreScripts ?? false;
+	const allow = ignore ? [...options.allowScripts ?? []] : [];
+	for (const name of allow) if (!PACKAGE_NAME.test(name)) throw new InstallAllowlistNameInvalid(name);
+	switch (packageManager) {
+		case "pnpm": return [["pnpm", [
+			"install",
+			"--frozen-lockfile",
+			...ignore ? ["--ignore-scripts"] : []
+		]], ...allow.length > 0 ? [["pnpm", [
+			"rebuild",
+			"--config.dangerouslyAllowAllBuilds=true",
+			...allow
+		]]] : []];
+		case "npm": return [["npm", [(0, node_fs.existsSync)((0, node_path.join)(cwd, "package-lock.json")) ? "ci" : "install", ...ignore ? ["--ignore-scripts"] : []]], ...allow.length > 0 ? [["npm", [
+			"rebuild",
+			"--dangerously-allow-all-scripts",
+			...allow
+		]]] : []];
+		case "yarn":
+			if ((0, node_fs.existsSync)((0, node_path.join)(cwd, ".yarnrc.yml"))) return [["yarn", [
+				"install",
+				"--immutable",
+				...ignore ? ["--mode=skip-build"] : []
+			]], ...allow.length > 0 ? [["yarn", ["rebuild", ...allow]]] : []];
+			if (allow.length > 0) throw new InstallScriptsAllowlistUnsupported("Yarn 1", allow);
+			return [["yarn", [
+				"install",
+				"--frozen-lockfile",
+				...ignore ? ["--ignore-scripts"] : []
+			]]];
+		case "bun":
+			if (allow.length > 0) throw new InstallScriptsAllowlistUnsupported("bun", allow);
+			return [["bun", [
+				"install",
+				"--frozen-lockfile",
+				...ignore ? ["--ignore-scripts"] : []
+			]]];
+	}
+}
+/**
+* Install the project's dependencies in `sandbox`.
+*
+* ```ts
+* // A checkout nobody has reviewed: no scripts but esbuild's.
+* await installDependencies(sandbox, {
+*   ignoreScripts: true,
+*   allowScripts: ['esbuild'],
+* });
+* ```
+*
+* Resolves with each command's result, in order — with its output when
+* `output` is `capture`.
+*
+* @throws {CommandFailed} when the package manager exits unsuccessfully.
+* @throws {InstallScriptsAllowlistUnsupported} for an allowlist the package
+*   manager cannot honour, before anything is installed.
+*/
+async function installDependencies(sandbox, options = {}) {
+	const cwd = options.cwd ?? sandbox.root;
+	const results = [];
+	const packageManager = options.packageManager ?? require_sniffer.detectPackageManager((0, node_path.resolve)(sandbox.root, cwd));
+	for (const [command, args] of installCommands(packageManager, (0, node_path.resolve)(sandbox.root, cwd), options)) {
+		const result = await sandbox.exec(command, args, {
+			cwd,
+			env: {
+				...sandbox.env,
+				...options.env
+			},
+			timeoutMs: options.timeoutMs ?? 9e5,
+			output: options.output ?? "inherit",
+			...options.signal ? { signal: options.signal } : {}
+		});
+		results.push(result);
+		if (result.exitCode !== 0) throw new require_local.CommandFailed(command, args, result.exitCode, result.signal);
+	}
+	return results;
+}
+//#endregion
 exports.BackendDeployFailed = require_deploy$1.BackendDeployFailed;
+exports.CommandFailed = require_local.CommandFailed;
+exports.CommandTimedOut = require_local.CommandTimedOut;
+exports.ConfigLoadFailed = require_config.ConfigLoadFailed;
+exports.ConfigObjectNotSerializable = require_config.ConfigObjectNotSerializable;
+exports.ConstructDiscoveryFailed = require_discover.ConstructDiscoveryFailed;
+exports.ConstructsNotSerializable = require_discover.ConstructsNotSerializable;
 exports.DeployTargetNotYetSupported = require_define.DeployTargetNotYetSupported;
-exports.GKM_HOME_ENV = require_home.GKM_HOME_ENV;
+exports.GKM_HOME_ENV = require_local.GKM_HOME_ENV;
+exports.INSTALL_TIMEOUT_MS = INSTALL_TIMEOUT_MS;
+exports.InstallAllowlistNameInvalid = InstallAllowlistNameInvalid;
+exports.InstallScriptsAllowlistUnsupported = InstallScriptsAllowlistUnsupported;
 exports.InvalidTargetOptions = require_resolve.InvalidTargetOptions;
-exports.MissingCredential = require_terminal.MissingCredential;
+exports.LocalSandbox = require_local.LocalSandbox;
+exports.MissingCredential = require_credentials.MissingCredential;
 exports.MissingEnvVars = require_deploy$1.MissingEnvVars;
 exports.NoDeployableApps = require_terminal.NoDeployableApps;
 exports.ProjectNotOwned = require_deploy$1.ProjectNotOwned;
@@ -21,8 +160,16 @@ exports.RegistryAmbiguous = require_deploy$1.RegistryAmbiguous;
 exports.RegistryNotConfigured = require_deploy$1.RegistryNotConfigured;
 exports.RegistryNotFound = require_deploy$1.RegistryNotFound;
 exports.RollbackFailed = require_terminal.RollbackFailed;
+exports.SANDBOX_ENV_ALLOWLIST = require_local.SANDBOX_ENV_ALLOWLIST;
+exports.SECRETS_DIR_ENV = require_sandbox.SECRETS_DIR_ENV;
+exports.SandboxCwdEscape = require_sandbox.SandboxCwdEscape;
+exports.SandboxWorkerFailed = require_discover.SandboxWorkerFailed;
+exports.SecretNameInvalid = require_sandbox.SecretNameInvalid;
+exports.SstConfigNotFound = require_sst.SstConfigNotFound;
+exports.SstOutputsUnreadable = require_sst.SstOutputsUnreadable;
 exports.StateLocked = require_sniffer.StateLocked;
 exports.StateVersionConflict = require_sniffer.StateVersionConflict;
+exports.SurfacesUnhealthy = require_sst.SurfacesUnhealthy;
 exports.TargetEntryInvalid = require_resolve.TargetEntryInvalid;
 exports.TargetPackageInvalid = require_resolve.TargetPackageInvalid;
 exports.TargetPackageNotFound = require_runtime.TargetPackageNotFound;
@@ -30,8 +177,13 @@ exports.TargetRuntimeMismatch = require_resolve.TargetRuntimeMismatch;
 exports.TargetRuntimeUndeclared = require_runtime.TargetRuntimeUndeclared;
 exports.UnknownDeployApps = require_terminal.UnknownDeployApps;
 exports.UnknownDeployTarget = require_define.UnknownDeployTarget;
-exports.chainCredentials = require_terminal.chainCredentials;
+exports.allowlistedEnv = require_local.allowlistedEnv;
+exports.chainCredentials = require_credentials.chainCredentials;
+exports.confineCwd = require_sandbox.confineCwd;
 exports.deploy = require_deploy.deploy;
 exports.deployIdentity = require_store.deployIdentity;
-exports.gkmHome = require_home.gkmHome;
-exports.storedCredentials = require_terminal.storedCredentials;
+exports.gkmHome = require_local.gkmHome;
+exports.installDependencies = installDependencies;
+exports.storedCredentials = require_credentials.storedCredentials;
+
+//# sourceMappingURL=public.cjs.map

package/dist/deploy/public.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.cjs","names":["existsSync","join","detectPackageManager","resolve","CommandFailed"],"sources":["../../src/sandbox/install.ts"],"sourcesContent":["/**\n * Installing a project's dependencies in a sandbox, with or without their\n * lifecycle scripts.\n *\n * `postinstall` is the oldest way into a build machine: any package in the\n * lockfile — a dependency of a dependency — runs whatever it likes the moment\n * it is installed. For a build the host trusts that is how native modules get\n * built. For one it does not, the scripts are skipped, and the few packages\n * that genuinely need theirs (esbuild's binary, a database driver) are named\n * and rebuilt — with nothing but the sandbox's environment either way.\n */\n\nimport { existsSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { detectPackageManager, type PackageManager } from '../docker/templates';\nimport { CommandFailed } from '../run';\nimport type { Sandbox, SandboxOutput, SandboxResult } from './sandbox';\n\n/** Long enough for a cold install of a large monorepo. */\nexport const INSTALL_TIMEOUT_MS = 15 * 60_000;\n\nexport interface InstallOptions {\n\t/** The directory to install in. Defaults to the sandbox's root. */\n\tcwd?: string;\n\t/** Defaults to the one the lockfile above `cwd` names. */\n\tpackageManager?: PackageManager;\n\t/**\n\t * Skip every lifecycle script — dependencies' and the project's own —\n\t * except those of {@link allowScripts}. Defaults to false: scripts run as\n\t * a plain install runs them, under the package manager's own policy —\n\t * npm 12 and pnpm 10 skip dependencies' scripts nobody approved.\n\t */\n\tignoreScripts?: boolean;\n\t/**\n\t * With `ignoreScripts`, the packages whose scripts still run: rebuilt by\n\t * name once the install is done.\n\t */\n\tallowScripts?: readonly string[];\n\t/** Variables the install needs beyond the sandbox's own. */\n\tenv?: Readonly<Record<string, string>>;\n\t/** Defaults to {@link INSTALL_TIMEOUT_MS}, for each command. */\n\ttimeoutMs?: number;\n\t/** Where the package manager's output goes. Defaults to `inherit`. */\n\toutput?: SandboxOutput;\n\tsignal?: AbortSignal;\n}\n\n/** A name in `allowScripts` that is not a package name. */\nexport class InstallAllowlistNameInvalid extends Error {\n\tconstructor(readonly packageName: string) {\n\t\tsuper(\n\t\t\t`'${packageName}' is not a package name, so its scripts cannot be ` +\n\t\t\t\t'allowed. Name the package as it appears in package.json — ' +\n\t\t\t\t\"'esbuild', '@prisma/client'.\",\n\t\t);\n\t\tthis.name = 'InstallAllowlistNameInvalid';\n\t}\n}\n\n/** The package manager has no way to run only some packages' scripts. */\nexport class InstallScriptsAllowlistUnsupported extends Error {\n\tconstructor(\n\t\treadonly packageManager: string,\n\t\treadonly allowScripts: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`${packageManager} cannot rebuild named packages after an install ` +\n\t\t\t\t`without scripts, so ${allowScripts.join(', ')} cannot be allowed ` +\n\t\t\t\t'theirs. Use pnpm, npm or Yarn 2+, or install with every script ' +\n\t\t\t\t'skipped.',\n\t\t);\n\t\tthis.name = 'InstallScriptsAllowlistUnsupported';\n\t}\n}\n\n/**\n * npm's package-name grammar, less a leading `-`: each name is an argument to\n * `rebuild`, and must never be read as a flag.\n */\nconst PACKAGE_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\\/)?[a-z0-9~][a-z0-9._~-]*$/;\n\n/**\n * The commands an install runs, in order. Exported for the tests, which\n * check each package manager's flags without installing with all four.\n */\nexport function installCommands(\n\tpackageManager: PackageManager,\n\tcwd: string,\n\toptions: Pick<InstallOptions, 'ignoreScripts' | 'allowScripts'> = {},\n): [string, string[]][] {\n\tconst ignore = options.ignoreScripts ?? false;\n\tconst allow = ignore ? [...(options.allowScripts ?? [])] : [];\n\tfor (const name of allow) {\n\t\tif (!PACKAGE_NAME.test(name)) throw new InstallAllowlistNameInvalid(name);\n\t}\n\n\tswitch (packageManager) {\n\t\tcase 'pnpm':\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'pnpm',\n\t\t\t\t\t[\n\t\t\t\t\t\t'install',\n\t\t\t\t\t\t'--frozen-lockfile',\n\t\t\t\t\t\t...(ignore ? ['--ignore-scripts'] : []),\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t\t// pnpm 10 builds no dependency it was not told to, even by name;\n\t\t\t\t// this command names exactly the ones allowed, so it may build\n\t\t\t\t// what it names.\n\t\t\t\t...(allow.length > 0\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'pnpm',\n\t\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t\t'rebuild',\n\t\t\t\t\t\t\t\t\t'--config.dangerouslyAllowAllBuilds=true',\n\t\t\t\t\t\t\t\t\t...allow,\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t] as [string, string[]],\n\t\t\t\t\t\t]\n\t\t\t\t\t: []),\n\t\t\t];\n\t\tcase 'npm': {\n\t\t\tconst locked = existsSync(join(cwd, 'package-lock.json'));\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'npm',\n\t\t\t\t\t[locked ? 'ci' : 'install', ...(ignore ? ['--ignore-scripts'] : [])],\n\t\t\t\t],\n\t\t\t\t// npm 12 runs no dependency's install script its `allowScripts`\n\t\t\t\t// policy does not approve, rebuilt by name or not, and refuses\n\t\t\t\t// `--allow-scripts` on a project's command line. This command\n\t\t\t\t// names exactly the packages allowed, so it may run what it names.\n\t\t\t\t...(allow.length > 0\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'npm',\n\t\t\t\t\t\t\t\t['rebuild', '--dangerously-allow-all-scripts', ...allow],\n\t\t\t\t\t\t\t] as [string, string[]],\n\t\t\t\t\t\t]\n\t\t\t\t\t: []),\n\t\t\t];\n\t\t}\n\t\tcase 'yarn': {\n\t\t\t// Yarn 2+ keeps a `.yarnrc.yml`; it skips builds by mode and can\n\t\t\t// rebuild by name. Yarn 1 can only skip them all.\n\t\t\tconst berry = existsSync(join(cwd, '.yarnrc.yml'));\n\t\t\tif (berry) {\n\t\t\t\treturn [\n\t\t\t\t\t[\n\t\t\t\t\t\t'yarn',\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'install',\n\t\t\t\t\t\t\t'--immutable',\n\t\t\t\t\t\t\t...(ignore ? ['--mode=skip-build'] : []),\n\t\t\t\t\t\t],\n\t\t\t\t\t],\n\t\t\t\t\t...(allow.length > 0\n\t\t\t\t\t\t? [['yarn', ['rebuild', ...allow]] as [string, string[]]]\n\t\t\t\t\t\t: []),\n\t\t\t\t];\n\t\t\t}\n\t\t\tif (allow.length > 0) {\n\t\t\t\tthrow new InstallScriptsAllowlistUnsupported('Yarn 1', allow);\n\t\t\t}\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'yarn',\n\t\t\t\t\t[\n\t\t\t\t\t\t'install',\n\t\t\t\t\t\t'--frozen-lockfile',\n\t\t\t\t\t\t...(ignore ? ['--ignore-scripts'] : []),\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t];\n\t\t}\n\t\tcase 'bun':\n\t\t\tif (allow.length > 0) {\n\t\t\t\tthrow new InstallScriptsAllowlistUnsupported('bun', allow);\n\t\t\t}\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'bun',\n\t\t\t\t\t[\n\t\t\t\t\t\t'install',\n\t\t\t\t\t\t'--frozen-lockfile',\n\t\t\t\t\t\t...(ignore ? ['--ignore-scripts'] : []),\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t];\n\t}\n}\n\n/**\n * Install the project's dependencies in `sandbox`.\n *\n * ```ts\n * // A checkout nobody has reviewed: no scripts but esbuild's.\n * await installDependencies(sandbox, {\n *   ignoreScripts: true,\n *   allowScripts: ['esbuild'],\n * });\n * ```\n *\n * Resolves with each command's result, in order — with its output when\n * `output` is `capture`.\n *\n * @throws {CommandFailed} when the package manager exits unsuccessfully.\n * @throws {InstallScriptsAllowlistUnsupported} for an allowlist the package\n *   manager cannot honour, before anything is installed.\n */\nexport async function installDependencies(\n\tsandbox: Sandbox,\n\toptions: InstallOptions = {},\n): Promise<SandboxResult[]> {\n\tconst cwd = options.cwd ?? sandbox.root;\n\tconst results: SandboxResult[] = [];\n\tconst packageManager =\n\t\toptions.packageManager ?? detectPackageManager(resolve(sandbox.root, cwd));\n\n\tfor (const [command, args] of installCommands(\n\t\tpackageManager,\n\t\tresolve(sandbox.root, cwd),\n\t\toptions,\n\t)) {\n\t\tconst result = await sandbox.exec(command, args, {\n\t\t\tcwd,\n\t\t\tenv: { ...sandbox.env, ...options.env },\n\t\t\ttimeoutMs: options.timeoutMs ?? INSTALL_TIMEOUT_MS,\n\t\t\toutput: options.output ?? 'inherit',\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t});\n\t\tresults.push(result);\n\t\tif (result.exitCode !== 0) {\n\t\t\tthrow new CommandFailed(\n\t\t\t\tcommand,\n\t\t\t\targs,\n\t\t\t\tresult.exitCode,\n\t\t\t\tresult.signal as NodeJS.Signals | null,\n\t\t\t);\n\t\t}\n\t}\n\treturn results;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,MAAa,qBAAqB;;AA6BlC,IAAa,8BAAb,cAAiD,MAAM;CACjC;CAArB,YAAY,aAA8B;EACzC,MACC,IAAI,YAAY,yIAGjB;EALoB,KAAA,cAAA;EAMpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qCAAb,cAAwD,MAAM;CAEnD;CACA;CAFV,YACC,gBACA,cACC;EACD,MACC,GAAG,eAAe,sEACM,aAAa,KAAK,IAAI,EAAE,2FAGjD;EARS,KAAA,iBAAA;EACA,KAAA,eAAA;EAQT,KAAK,OAAO;CACb;AACD;;;;;AAMA,MAAM,eAAe;;;;;AAMrB,SAAgB,gBACf,gBACA,KACA,UAAkE,CAAC,GAC5C;CACvB,MAAM,SAAS,QAAQ,iBAAiB;CACxC,MAAM,QAAQ,SAAS,CAAC,GAAI,QAAQ,gBAAgB,CAAC,CAAE,IAAI,CAAC;CAC5D,KAAK,MAAM,QAAQ,OAClB,IAAI,CAAC,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI,4BAA4B,IAAI;CAGzE,QAAQ,gBAAR;EACC,KAAK,QACJ,OAAO,CACN,CACC,QACA;GACC;GACA;GACA,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC;EACtC,CACD,GAIA,GAAI,MAAM,SAAS,IAChB,CACA,CACC,QACA;GACC;GACA;GACA,GAAG;EACJ,CACD,CACD,IACC,CAAC,CACL;EACD,KAAK,OAEJ,OAAO,CACN,CACC,OACA,EAAA,GAJaA,QAAAA,WAAAA,EAAAA,GAAWC,UAAAA,KAAAA,CAAK,KAAK,mBAAmB,CAI/C,IAAI,OAAO,WAAW,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC,CAAE,CACpE,GAKA,GAAI,MAAM,SAAS,IAChB,CACA,CACC,OACA;GAAC;GAAW;GAAmC,GAAG;EAAK,CACxD,CACD,IACC,CAAC,CACL;EAED,KAAK;GAIJ,KAAA,GADcD,QAAAA,WAAAA,EAAAA,GAAWC,UAAAA,KAAAA,CAAK,KAAK,aAAa,CACxC,GACP,OAAO,CACN,CACC,QACA;IACC;IACA;IACA,GAAI,SAAS,CAAC,mBAAmB,IAAI,CAAC;GACvC,CACD,GACA,GAAI,MAAM,SAAS,IAChB,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,CAAuB,IACtD,CAAC,CACL;GAED,IAAI,MAAM,SAAS,GAClB,MAAM,IAAI,mCAAmC,UAAU,KAAK;GAE7D,OAAO,CACN,CACC,QACA;IACC;IACA;IACA,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC;GACtC,CACD,CACD;EAED,KAAK;GACJ,IAAI,MAAM,SAAS,GAClB,MAAM,IAAI,mCAAmC,OAAO,KAAK;GAE1D,OAAO,CACN,CACC,OACA;IACC;IACA;IACA,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC;GACtC,CACD,CACD;CACF;AACD;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,oBACrB,SACA,UAA0B,CAAC,GACA;CAC3B,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,UAA2B,CAAC;CAClC,MAAM,iBACL,QAAQ,kBAAkBC,gBAAAA,sBAAAA,GAAqBC,UAAAA,QAAAA,CAAQ,QAAQ,MAAM,GAAG,CAAC;CAE1E,KAAK,MAAM,CAAC,SAAS,SAAS,gBAC7B,iBAAA,GACAA,UAAAA,QAAAA,CAAQ,QAAQ,MAAM,GAAG,GACzB,OACD,GAAG;EACF,MAAM,SAAS,MAAM,QAAQ,KAAK,SAAS,MAAM;GAChD;GACA,KAAK;IAAE,GAAG,QAAQ;IAAK,GAAG,QAAQ;GAAI;GACtC,WAAW,QAAQ,aAAA;GACnB,QAAQ,QAAQ,UAAU;GAC1B,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACpD,CAAC;EACD,QAAQ,KAAK,MAAM;EACnB,IAAI,OAAO,aAAa,GACvB,MAAM,IAAIC,cAAAA,cACT,SACA,MACA,OAAO,UACP,OAAO,MACR;CAEF;CACA,OAAO;AACR"}