@geekmidas/cli 10.0.0-alpha.62 → 10.0.0-alpha.64

package/dist/deploy/public.d.cts

@@ -1,5 +1,8 @@
-import { $ as DeployEventError, Q as DeployEvent, _t as StateVersionConflict, at as DeployResult, bt as deployIdentity, ct as CredentialKinds, dt as MissingCredential, et as DeployEventType, ft as StoredCredentialsOptions, ht as StateLocked, it as AppDeployResult, lt as CredentialProvider, mt as storedCredentials, nt as ResourceChange, ot as Credential, pt as chainCredentials, rt as ResourceVia, st as CredentialKind, tt as DeployPhase, ut as CredentialRequest, yt as DeployIdentity, z as AnyDeployTarget } from "../types-DIA7Li-J.cjs";
-import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-Dn_n-29S.cjs";
+import { $ as DeployEventError, Q as DeployEvent, at as DeployResult, bt as DeployIdentity, ct as CredentialKind, dt as CredentialRequest, et as DeployEventType, ft as MissingCredential, gt as StateLocked, ht as storedCredentials, it as AppDeployResult, lt as CredentialKinds, mt as chainCredentials, nt as ResourceChange, ot as AwsCredential, pt as StoredCredentialsOptions, rt as ResourceVia, st as Credential, tt as DeployPhase, ut as CredentialProvider, vt as StateVersionConflict, xt as deployIdentity, z as AnyDeployTarget } from "../types-DkrDOMxw.cjs";
+import { a as SandboxOutput, c as confineCwd, i as SandboxExecOptions, n as Sandbox, o as SandboxResult, r as SandboxCwdEscape, s as SecretNameInvalid, t as SECRETS_DIR_ENV } from "../sandbox-M8UnLhXE.cjs";
+import { i as ConfigLoadFailed, o as ConfigObjectNotSerializable } from "../config-Be-4_I6H.cjs";
+import { n as ConstructsNotSerializable, t as ConstructDiscoveryFailed } from "../discover-B_IkPukx.cjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-Cjq1jlVX.cjs";
 import { ConstructManifest } from "@geekmidas/manifest";
 import "@geekmidas/envkit/sniffer";
 //#region src/home.d.ts
@@ -16,6 +19,212 @@ export declare const GKM_HOME_ENV = "GKM_HOME";
 /** The CLI's home: `GKM_HOME` if set, else `~/.gkm`. */
 export declare function gkmHome(env?: NodeJS.ProcessEnv): string;
 //#endregion
+//#region src/run.d.ts
+/** The program ran and exited unsuccessfully; its own output said why. */
+export declare class CommandFailed extends Error {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly exitCode: number | null;
+  readonly signal: NodeJS.Signals | null;
+  constructor(command: string, args: readonly string[], exitCode: number | null, signal: NodeJS.Signals | null);
+}
+/** The program ran past its timeout and was killed. */
+export declare class CommandTimedOut extends Error {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly timeoutMs: number;
+  constructor(command: string, args: readonly string[], timeoutMs: number);
+}
+//#endregion
+//#region src/sandbox/env.d.ts
+/**
+ * What of the host's environment a local sandbox passes on.
+ *
+ * An allowlist, not a denylist: a credential's variable has any name its
+ * owner chose (`DOKPLOY_TOKEN`, `AWS_SECRET_ACCESS_KEY`, `MY_VAULT_TOKEN`), so
+ * the only safe default is to name what a program needs to *run* and pass
+ * nothing else.
+ */
+/**
+ * Variables a command needs to find programs, write temp files, print in the
+ * user's locale and reach the network through the host's proxy — and nothing
+ * that authenticates as anyone.
+ *
+ * Deliberately left out:
+ * - `NODE_OPTIONS`: it can `--require` or `--import` code into every node
+ *   process, and CI often holds `--import tsx` there. A step that needs a
+ *   loader passes its own.
+ * - `NODE_AUTH_TOKEN`, `NPM_TOKEN`, `npm_config_*`: registry tokens
+ *   (`actions/setup-node` writes `NODE_AUTH_TOKEN`), which is why there is no
+ *   `NODE_*` wildcard.
+ * - `AWS_*`, `DOCKER_*`, `DOKPLOY_*`, `GITHUB_TOKEN`, `TURBO_TOKEN`, `GKM_*`:
+ *   credentials, or where the deploy keeps them.
+ * - `SHELL`, `EDITOR` and the rest of a login session: nothing here starts a
+ *   shell.
+ *
+ * Proxies are passed: behind one, nothing installs or builds without it. A
+ * proxy URL with a password in it reaches the command too — a host that keeps
+ * one there and builds code it does not trust should pass a sandbox of its
+ * own.
+ */
+export declare const SANDBOX_ENV_ALLOWLIST: readonly (string | RegExp)[];
+/**
+ * The allowlisted part of `source`, plus each of `extra` the host chose to
+ * pass on by name.
+ */
+export declare function allowlistedEnv(source?: NodeJS.ProcessEnv, extra?: readonly string[]): Record<string, string>;
+//#endregion
+//#region src/docker/templates.d.ts
+type PackageManager = 'pnpm' | 'npm' | 'yarn' | 'bun';
+//#endregion
+//#region src/sandbox/install.d.ts
+/** Long enough for a cold install of a large monorepo. */
+export declare const INSTALL_TIMEOUT_MS: number;
+interface InstallOptions {
+  /** The directory to install in. Defaults to the sandbox's root. */
+  cwd?: string;
+  /** Defaults to the one the lockfile above `cwd` names. */
+  packageManager?: PackageManager;
+  /**
+   * Skip every lifecycle script — dependencies' and the project's own —
+   * except those of {@link allowScripts}. Defaults to false: scripts run as
+   * a plain install runs them, under the package manager's own policy —
+   * npm 12 and pnpm 10 skip dependencies' scripts nobody approved.
+   */
+  ignoreScripts?: boolean;
+  /**
+   * With `ignoreScripts`, the packages whose scripts still run: rebuilt by
+   * name once the install is done.
+   */
+  allowScripts?: readonly string[];
+  /** Variables the install needs beyond the sandbox's own. */
+  env?: Readonly<Record<string, string>>;
+  /** Defaults to {@link INSTALL_TIMEOUT_MS}, for each command. */
+  timeoutMs?: number;
+  /** Where the package manager's output goes. Defaults to `inherit`. */
+  output?: SandboxOutput;
+  signal?: AbortSignal;
+}
+/** A name in `allowScripts` that is not a package name. */
+export declare class InstallAllowlistNameInvalid extends Error {
+  readonly packageName: string;
+  constructor(packageName: string);
+}
+/** The package manager has no way to run only some packages' scripts. */
+export declare class InstallScriptsAllowlistUnsupported extends Error {
+  readonly packageManager: string;
+  readonly allowScripts: readonly string[];
+  constructor(packageManager: string, allowScripts: readonly string[]);
+}
+/**
+ * Install the project's dependencies in `sandbox`.
+ *
+ * ```ts
+ * // A checkout nobody has reviewed: no scripts but esbuild's.
+ * await installDependencies(sandbox, {
+ *   ignoreScripts: true,
+ *   allowScripts: ['esbuild'],
+ * });
+ * ```
+ *
+ * Resolves with each command's result, in order — with its output when
+ * `output` is `capture`.
+ *
+ * @throws {CommandFailed} when the package manager exits unsuccessfully.
+ * @throws {InstallScriptsAllowlistUnsupported} for an allowlist the package
+ *   manager cannot honour, before anything is installed.
+ */
+export declare function installDependencies(sandbox: Sandbox, options?: InstallOptions): Promise<SandboxResult[]>;
+//#endregion
+//#region src/sandbox/local.d.ts
+interface LocalSandboxOptions {
+  /** The project. Every command runs at or below it. */
+  root: string;
+  /**
+   * `HOME` for every command. Defaults to the host's, because a build
+   * reuses the caches kept there — the pnpm store, corepack's package
+   * managers, turbo's cache — and a cold one re-downloads all of them.
+   * Point it at an empty directory to keep `~/.aws`, `~/.npmrc` and
+   * `~/.docker` out of reach of an SDK's default lookup — though, sharing
+   * the host's filesystem, a command that goes looking still finds them.
+   */
+  home?: string;
+  /**
+   * Host variables to pass on beyond the allowlist, by name — a remote
+   * cache's `TURBO_TOKEN`, for a build the host trusts with it.
+   */
+  passEnv?: readonly string[];
+  /** Where the allowlisted variables are read from. Defaults to `process.env`. */
+  hostEnv?: NodeJS.ProcessEnv;
+}
+/**
+ * A child process on this machine, as this user, with an allowlisted
+ * environment.
+ *
+ * What it withholds from the command: the host's environment beyond
+ * {@link SANDBOX_ENV_ALLOWLIST}, a shell, a working directory outside the
+ * project, and any time past the timeout. What it does not: the host's
+ * filesystem, which the command can read and write as the user running the
+ * deploy. So it is not `isolating`, and it is the default for projects the
+ * host already trusts — the developer's own, a team's own CI. Code nobody
+ * vetted belongs in a sandbox that is.
+ *
+ * A timed-out command is sent SIGTERM, then SIGKILL; processes it started
+ * itself are its to stop.
+ */
+export declare class LocalSandbox implements Sandbox {
+  readonly root: string;
+  readonly isolating = false;
+  readonly env: Readonly<Record<string, string>>;
+  constructor(options: LocalSandboxOptions);
+  exec(command: string, args: readonly string[], options: SandboxExecOptions): Promise<SandboxResult>;
+}
+//#endregion
+//#region src/sandbox/worker.d.ts
+/** A worker ended without the answer it exists to give. */
+export declare class SandboxWorkerFailed extends Error {
+  readonly step: string;
+  readonly exitCode: number | null;
+  readonly stderr: string;
+  constructor(step: string, exitCode: number | null, stderr: string);
+}
+//#endregion
+//#region src/target/sst/health.d.ts
+/** Surfaces that never answered healthy. */
+export declare class SurfacesUnhealthy extends Error {
+  readonly stage: string;
+  /** Each surface that failed, with the last thing it answered. */
+  readonly surfaces: readonly {
+    app: string;
+    url: string;
+    status?: number;
+    error?: string;
+  }[];
+  constructor(stage: string,
+  /** Each surface that failed, with the last thing it answered. */
+  surfaces: readonly {
+    app: string;
+    url: string;
+    status?: number;
+    error?: string;
+  }[]);
+}
+//#endregion
+//#region src/target/sst/outputs.d.ts
+/** `.sst/outputs.json` is there, and is not JSON. */
+export declare class SstOutputsUnreadable extends Error {
+  readonly path: string;
+  readonly reason: string;
+  constructor(path: string, reason: string);
+}
+//#endregion
+//#region src/target/sst/index.d.ts
+/** The workspace has no `sst.config.ts` for `sst deploy` to run. */
+export declare class SstConfigNotFound extends Error {
+  readonly cwd: string;
+  constructor(cwd: string);
+}
+//#endregion
 //#region src/deploy/deploy.d.ts
 /**
  * Where a run's progress lines go, besides its events. `@geekmidas/logger`'s
@@ -79,6 +288,18 @@ interface DeployInput {
    * default), its stderr, or nowhere.
    */
   childOutput?: 'inherit' | 'stderr' | 'ignore';
+  /**
+   * Where the project's own code runs: loading `gkm.config.ts`, discovering
+   * its constructs, sniffing each app's environment. Defaults to a
+   * `LocalSandbox` on the project — a child process here with an
+   * allowlisted environment, for a project the host trusts.
+   *
+   * A host deploying repositories it does not trust passes one that
+   * isolates — a container per build — and the config then reaches the
+   * deploy only as data. Credentials never enter a sandbox: they go from
+   * `credentials` to the steps that provision, push and release.
+   */
+  sandbox?: Sandbox;
 }
 /** A deploy in progress. */
 interface DeployRun extends AsyncIterable<DeployEvent> {
@@ -178,5 +399,5 @@ export declare class RegistryAmbiguous extends Error {
   constructor(registry: string, registryIds: readonly string[]);
 }
 //#endregion
-export { type AppDeployResult, type Credential, type CredentialKind, type CredentialKinds, type CredentialProvider, type CredentialRequest, type DeployEvent, type DeployEventError, type DeployEventType, type DeployIdentity, type DeployInput, type DeployLogger, type DeployPhase, type DeployResult, type DeployRun, DeployTargetNotYetSupported, InvalidTargetOptions, MissingCredential, ProviderRemoved, type ResourceChange, type ResourceVia, StateLocked, StateVersionConflict, type StoredCredentialsOptions, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, chainCredentials, deployIdentity, storedCredentials };
+export { type AppDeployResult, type AwsCredential, ConfigLoadFailed, ConfigObjectNotSerializable, ConstructDiscoveryFailed, ConstructsNotSerializable, type Credential, type CredentialKind, type CredentialKinds, type CredentialProvider, type CredentialRequest, type DeployEvent, type DeployEventError, type DeployEventType, type DeployIdentity, type DeployInput, type DeployLogger, type DeployPhase, type DeployResult, type DeployRun, DeployTargetNotYetSupported, type InstallOptions, InvalidTargetOptions, type LocalSandboxOptions, MissingCredential, ProviderRemoved, type ResourceChange, type ResourceVia, SECRETS_DIR_ENV, type Sandbox, SandboxCwdEscape, type SandboxExecOptions, type SandboxOutput, type SandboxResult, SecretNameInvalid, StateLocked, StateVersionConflict, type StoredCredentialsOptions, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, chainCredentials, confineCwd, deployIdentity, storedCredentials };
 //# sourceMappingURL=public.d.cts.map

package/dist/deploy/public.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/home.ts","../../src/deploy/deploy.ts","../../src/deploy/index.ts","../../src/deploy/orchestrate.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;;qBAaa;;wBAGG,QAAQ,MAAK,OAAO;;;;;;;UCanB;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;EAEA;;;;;EAKA;;;;;;EAMA,UAAU,eAAe;;EAEzB;;EAEA;;;;;;EAMA;;;;;;EAMA,cAAc;;EAEd,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;UAIgB,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBAqEV,OAAO,OAAO,cAAc;;;;qBCqV/B,4BAA4B;WAE9B;EADV,YACU,aACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;qBCvcE,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAE3B;WACA;EAFV,YACU,eACA;;;qBAUE,uBAAuB;WAEzB;;WAEA;EAHV,YACU,gBAEA;;EAAA,kBACT;;;;;;;;qBC1EW,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}
+{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/home.ts","../../src/run.ts","../../src/sandbox/env.ts","../../src/docker/templates.ts","../../src/sandbox/install.ts","../../src/sandbox/local.ts","../../src/sandbox/worker.ts","../../src/target/sst/health.ts","../../src/target/sst/outputs.ts","../../src/target/sst/index.ts","../../src/deploy/deploy.ts","../../src/deploy/index.ts","../../src/deploy/orchestrate.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;;;;;qBAaa;;wBAGG,QAAQ,MAAK,OAAO;;;;qBCuBvB,sBAAsB;WAExB;WACA;WACA;WACA,QAAQ,OAAO;EAJzB,YACU,iBACA,yBACA,yBACA,QAAQ,OAAO;;;qBAUb,wBAAwB;WAE1B;WACA;WACA;EAHV,YACU,iBACA,yBACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC3BE,0CAA0C;;;;;wBAyDvC,eACf,SAAQ,OAAO,YACf,4BACE;;;KCvFS;;;;qBCeC;UAEI;;EAEhB;;EAEA,iBAAiB;;;;;;;EAOjB;;;;;EAKA;;EAEA,MAAM,SAAS;;EAEf;;EAEA,SAAS;EACT,SAAS;;;qBAIG,oCAAoC;WAC3B;EAArB,YAAqB;;;qBAWT,2CAA2C;WAE7C;WACA;EAFV,YACU,wBACA;;;;;;;;;;;;;;;;;;;;wBAqJW,oBACrB,SAAS,SACT,UAAS,iBACP,QAAQ;;;UCpMM;;EAEhB;;;;;;;;;EASA;;;;;EAKA;;EAEA,UAAU,OAAO;;;;;;;;;;;;;;;;;qBA0BL,wBAAwB;WAC3B;WACA;WACA,KAAK,SAAS;EAEvB,YAAY,SAAS;EAUf,KACL,iBACA,yBACA,SAAS,qBACP,QAAQ;;;;;qBCpBC,4BAA4B;WAE9B;WACA;WACA;EAHV,YACU,cACA,yBACA;;;;;qBC1CE,0BAA0B;WAE5B;;WAEA;IACR;IACA;IACA;IACA;;EAPF,YACU,eAEA;;EAAA;IACR;IACA;IACA;IACA;;;;;;qBCZU,6BAA6B;WAE/B;WACA;EAFV,YACU,cACA;;;;;qBC2BE,0BAA0B;WACjB;EAArB,YAAqB;;;;;;;;UCpBL;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;EAEA;;;;;EAKA;;;;;;EAMA,UAAU,eAAe;;EAEzB;;EAEA;;;;;;EAMA;;;;;;EAMA,cAAc;;EAEd,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;;;;;;;;;;EAYA,UAAU;;;UAIM,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBAqEV,OAAO,OAAO,cAAc;;;;qBCuU/B,4BAA4B;WAE9B;EADV,YACU,aACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;qBCvcE,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAE3B;WACA;EAFV,YACU,eACA;;;qBAUE,uBAAuB;WAEzB;;WAEA;EAHV,YACU,gBAEA;;EAAA,kBACT;;;;;;;;qBC1EW,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}

package/dist/deploy/public.d.mts

@@ -1,5 +1,8 @@
-import { $ as DeployEventError, Q as DeployEvent, _t as StateVersionConflict, at as DeployResult, bt as deployIdentity, ct as CredentialKinds, dt as MissingCredential, et as DeployEventType, ft as StoredCredentialsOptions, ht as StateLocked, it as AppDeployResult, lt as CredentialProvider, mt as storedCredentials, nt as ResourceChange, ot as Credential, pt as chainCredentials, rt as ResourceVia, st as CredentialKind, tt as DeployPhase, ut as CredentialRequest, yt as DeployIdentity, z as AnyDeployTarget } from "../types-CfLKGfC_.mjs";
-import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-CXPlkZzs.mjs";
+import { a as SandboxOutput, c as confineCwd, i as SandboxExecOptions, n as Sandbox, o as SandboxResult, r as SandboxCwdEscape, s as SecretNameInvalid, t as SECRETS_DIR_ENV } from "../sandbox-M8UnLhXE.mjs";
+import { $ as DeployEventError, Q as DeployEvent, at as DeployResult, bt as DeployIdentity, ct as CredentialKind, dt as CredentialRequest, et as DeployEventType, ft as MissingCredential, gt as StateLocked, ht as storedCredentials, it as AppDeployResult, lt as CredentialKinds, mt as chainCredentials, nt as ResourceChange, ot as AwsCredential, pt as StoredCredentialsOptions, rt as ResourceVia, st as Credential, tt as DeployPhase, ut as CredentialProvider, vt as StateVersionConflict, xt as deployIdentity, z as AnyDeployTarget } from "../types-B_bEQvb9.mjs";
+import { i as ConfigLoadFailed, o as ConfigObjectNotSerializable } from "../config-DqNRiQOp.mjs";
+import { n as ConstructsNotSerializable, t as ConstructDiscoveryFailed } from "../discover-B6yPpvRV.mjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-CJEYK4Gz.mjs";
 import { ConstructManifest } from "@geekmidas/manifest";
 import "@geekmidas/envkit/sniffer";
 //#region src/home.d.ts
@@ -16,6 +19,212 @@ export declare const GKM_HOME_ENV = "GKM_HOME";
 /** The CLI's home: `GKM_HOME` if set, else `~/.gkm`. */
 export declare function gkmHome(env?: NodeJS.ProcessEnv): string;
 //#endregion
+//#region src/run.d.ts
+/** The program ran and exited unsuccessfully; its own output said why. */
+export declare class CommandFailed extends Error {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly exitCode: number | null;
+  readonly signal: NodeJS.Signals | null;
+  constructor(command: string, args: readonly string[], exitCode: number | null, signal: NodeJS.Signals | null);
+}
+/** The program ran past its timeout and was killed. */
+export declare class CommandTimedOut extends Error {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly timeoutMs: number;
+  constructor(command: string, args: readonly string[], timeoutMs: number);
+}
+//#endregion
+//#region src/sandbox/env.d.ts
+/**
+ * What of the host's environment a local sandbox passes on.
+ *
+ * An allowlist, not a denylist: a credential's variable has any name its
+ * owner chose (`DOKPLOY_TOKEN`, `AWS_SECRET_ACCESS_KEY`, `MY_VAULT_TOKEN`), so
+ * the only safe default is to name what a program needs to *run* and pass
+ * nothing else.
+ */
+/**
+ * Variables a command needs to find programs, write temp files, print in the
+ * user's locale and reach the network through the host's proxy — and nothing
+ * that authenticates as anyone.
+ *
+ * Deliberately left out:
+ * - `NODE_OPTIONS`: it can `--require` or `--import` code into every node
+ *   process, and CI often holds `--import tsx` there. A step that needs a
+ *   loader passes its own.
+ * - `NODE_AUTH_TOKEN`, `NPM_TOKEN`, `npm_config_*`: registry tokens
+ *   (`actions/setup-node` writes `NODE_AUTH_TOKEN`), which is why there is no
+ *   `NODE_*` wildcard.
+ * - `AWS_*`, `DOCKER_*`, `DOKPLOY_*`, `GITHUB_TOKEN`, `TURBO_TOKEN`, `GKM_*`:
+ *   credentials, or where the deploy keeps them.
+ * - `SHELL`, `EDITOR` and the rest of a login session: nothing here starts a
+ *   shell.
+ *
+ * Proxies are passed: behind one, nothing installs or builds without it. A
+ * proxy URL with a password in it reaches the command too — a host that keeps
+ * one there and builds code it does not trust should pass a sandbox of its
+ * own.
+ */
+export declare const SANDBOX_ENV_ALLOWLIST: readonly (string | RegExp)[];
+/**
+ * The allowlisted part of `source`, plus each of `extra` the host chose to
+ * pass on by name.
+ */
+export declare function allowlistedEnv(source?: NodeJS.ProcessEnv, extra?: readonly string[]): Record<string, string>;
+//#endregion
+//#region src/docker/templates.d.ts
+type PackageManager = 'pnpm' | 'npm' | 'yarn' | 'bun';
+//#endregion
+//#region src/sandbox/install.d.ts
+/** Long enough for a cold install of a large monorepo. */
+export declare const INSTALL_TIMEOUT_MS: number;
+interface InstallOptions {
+  /** The directory to install in. Defaults to the sandbox's root. */
+  cwd?: string;
+  /** Defaults to the one the lockfile above `cwd` names. */
+  packageManager?: PackageManager;
+  /**
+   * Skip every lifecycle script — dependencies' and the project's own —
+   * except those of {@link allowScripts}. Defaults to false: scripts run as
+   * a plain install runs them, under the package manager's own policy —
+   * npm 12 and pnpm 10 skip dependencies' scripts nobody approved.
+   */
+  ignoreScripts?: boolean;
+  /**
+   * With `ignoreScripts`, the packages whose scripts still run: rebuilt by
+   * name once the install is done.
+   */
+  allowScripts?: readonly string[];
+  /** Variables the install needs beyond the sandbox's own. */
+  env?: Readonly<Record<string, string>>;
+  /** Defaults to {@link INSTALL_TIMEOUT_MS}, for each command. */
+  timeoutMs?: number;
+  /** Where the package manager's output goes. Defaults to `inherit`. */
+  output?: SandboxOutput;
+  signal?: AbortSignal;
+}
+/** A name in `allowScripts` that is not a package name. */
+export declare class InstallAllowlistNameInvalid extends Error {
+  readonly packageName: string;
+  constructor(packageName: string);
+}
+/** The package manager has no way to run only some packages' scripts. */
+export declare class InstallScriptsAllowlistUnsupported extends Error {
+  readonly packageManager: string;
+  readonly allowScripts: readonly string[];
+  constructor(packageManager: string, allowScripts: readonly string[]);
+}
+/**
+ * Install the project's dependencies in `sandbox`.
+ *
+ * ```ts
+ * // A checkout nobody has reviewed: no scripts but esbuild's.
+ * await installDependencies(sandbox, {
+ *   ignoreScripts: true,
+ *   allowScripts: ['esbuild'],
+ * });
+ * ```
+ *
+ * Resolves with each command's result, in order — with its output when
+ * `output` is `capture`.
+ *
+ * @throws {CommandFailed} when the package manager exits unsuccessfully.
+ * @throws {InstallScriptsAllowlistUnsupported} for an allowlist the package
+ *   manager cannot honour, before anything is installed.
+ */
+export declare function installDependencies(sandbox: Sandbox, options?: InstallOptions): Promise<SandboxResult[]>;
+//#endregion
+//#region src/sandbox/local.d.ts
+interface LocalSandboxOptions {
+  /** The project. Every command runs at or below it. */
+  root: string;
+  /**
+   * `HOME` for every command. Defaults to the host's, because a build
+   * reuses the caches kept there — the pnpm store, corepack's package
+   * managers, turbo's cache — and a cold one re-downloads all of them.
+   * Point it at an empty directory to keep `~/.aws`, `~/.npmrc` and
+   * `~/.docker` out of reach of an SDK's default lookup — though, sharing
+   * the host's filesystem, a command that goes looking still finds them.
+   */
+  home?: string;
+  /**
+   * Host variables to pass on beyond the allowlist, by name — a remote
+   * cache's `TURBO_TOKEN`, for a build the host trusts with it.
+   */
+  passEnv?: readonly string[];
+  /** Where the allowlisted variables are read from. Defaults to `process.env`. */
+  hostEnv?: NodeJS.ProcessEnv;
+}
+/**
+ * A child process on this machine, as this user, with an allowlisted
+ * environment.
+ *
+ * What it withholds from the command: the host's environment beyond
+ * {@link SANDBOX_ENV_ALLOWLIST}, a shell, a working directory outside the
+ * project, and any time past the timeout. What it does not: the host's
+ * filesystem, which the command can read and write as the user running the
+ * deploy. So it is not `isolating`, and it is the default for projects the
+ * host already trusts — the developer's own, a team's own CI. Code nobody
+ * vetted belongs in a sandbox that is.
+ *
+ * A timed-out command is sent SIGTERM, then SIGKILL; processes it started
+ * itself are its to stop.
+ */
+export declare class LocalSandbox implements Sandbox {
+  readonly root: string;
+  readonly isolating = false;
+  readonly env: Readonly<Record<string, string>>;
+  constructor(options: LocalSandboxOptions);
+  exec(command: string, args: readonly string[], options: SandboxExecOptions): Promise<SandboxResult>;
+}
+//#endregion
+//#region src/sandbox/worker.d.ts
+/** A worker ended without the answer it exists to give. */
+export declare class SandboxWorkerFailed extends Error {
+  readonly step: string;
+  readonly exitCode: number | null;
+  readonly stderr: string;
+  constructor(step: string, exitCode: number | null, stderr: string);
+}
+//#endregion
+//#region src/target/sst/health.d.ts
+/** Surfaces that never answered healthy. */
+export declare class SurfacesUnhealthy extends Error {
+  readonly stage: string;
+  /** Each surface that failed, with the last thing it answered. */
+  readonly surfaces: readonly {
+    app: string;
+    url: string;
+    status?: number;
+    error?: string;
+  }[];
+  constructor(stage: string,
+  /** Each surface that failed, with the last thing it answered. */
+  surfaces: readonly {
+    app: string;
+    url: string;
+    status?: number;
+    error?: string;
+  }[]);
+}
+//#endregion
+//#region src/target/sst/outputs.d.ts
+/** `.sst/outputs.json` is there, and is not JSON. */
+export declare class SstOutputsUnreadable extends Error {
+  readonly path: string;
+  readonly reason: string;
+  constructor(path: string, reason: string);
+}
+//#endregion
+//#region src/target/sst/index.d.ts
+/** The workspace has no `sst.config.ts` for `sst deploy` to run. */
+export declare class SstConfigNotFound extends Error {
+  readonly cwd: string;
+  constructor(cwd: string);
+}
+//#endregion
 //#region src/deploy/deploy.d.ts
 /**
  * Where a run's progress lines go, besides its events. `@geekmidas/logger`'s
@@ -79,6 +288,18 @@ interface DeployInput {
    * default), its stderr, or nowhere.
    */
   childOutput?: 'inherit' | 'stderr' | 'ignore';
+  /**
+   * Where the project's own code runs: loading `gkm.config.ts`, discovering
+   * its constructs, sniffing each app's environment. Defaults to a
+   * `LocalSandbox` on the project — a child process here with an
+   * allowlisted environment, for a project the host trusts.
+   *
+   * A host deploying repositories it does not trust passes one that
+   * isolates — a container per build — and the config then reaches the
+   * deploy only as data. Credentials never enter a sandbox: they go from
+   * `credentials` to the steps that provision, push and release.
+   */
+  sandbox?: Sandbox;
 }
 /** A deploy in progress. */
 interface DeployRun extends AsyncIterable<DeployEvent> {
@@ -178,5 +399,5 @@ export declare class RegistryAmbiguous extends Error {
   constructor(registry: string, registryIds: readonly string[]);
 }
 //#endregion
-export { type AppDeployResult, type Credential, type CredentialKind, type CredentialKinds, type CredentialProvider, type CredentialRequest, type DeployEvent, type DeployEventError, type DeployEventType, type DeployIdentity, type DeployInput, type DeployLogger, type DeployPhase, type DeployResult, type DeployRun, DeployTargetNotYetSupported, InvalidTargetOptions, MissingCredential, ProviderRemoved, type ResourceChange, type ResourceVia, StateLocked, StateVersionConflict, type StoredCredentialsOptions, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, chainCredentials, deployIdentity, storedCredentials };
+export { type AppDeployResult, type AwsCredential, ConfigLoadFailed, ConfigObjectNotSerializable, ConstructDiscoveryFailed, ConstructsNotSerializable, type Credential, type CredentialKind, type CredentialKinds, type CredentialProvider, type CredentialRequest, type DeployEvent, type DeployEventError, type DeployEventType, type DeployIdentity, type DeployInput, type DeployLogger, type DeployPhase, type DeployResult, type DeployRun, DeployTargetNotYetSupported, type InstallOptions, InvalidTargetOptions, type LocalSandboxOptions, MissingCredential, ProviderRemoved, type ResourceChange, type ResourceVia, SECRETS_DIR_ENV, type Sandbox, SandboxCwdEscape, type SandboxExecOptions, type SandboxOutput, type SandboxResult, SecretNameInvalid, StateLocked, StateVersionConflict, type StoredCredentialsOptions, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, chainCredentials, confineCwd, deployIdentity, storedCredentials };
 //# sourceMappingURL=public.d.mts.map

package/dist/deploy/public.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.mts","names":[],"sources":["../../src/home.ts","../../src/deploy/deploy.ts","../../src/deploy/index.ts","../../src/deploy/orchestrate.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;;qBAaa;;wBAGG,QAAQ,MAAK,OAAO;;;;;;;UCanB;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;EAEA;;;;;EAKA;;;;;;EAMA,UAAU,eAAe;;EAEzB;;EAEA;;;;;;EAMA;;;;;;EAMA,cAAc;;EAEd,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;UAIgB,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBAqEV,OAAO,OAAO,cAAc;;;;qBCqV/B,4BAA4B;WAE9B;EADV,YACU,aACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;qBCvcE,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAE3B;WACA;EAFV,YACU,eACA;;;qBAUE,uBAAuB;WAEzB;;WAEA;EAHV,YACU,gBAEA;;EAAA,kBACT;;;;;;;;qBC1EW,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}
+{"version":3,"file":"public.d.mts","names":[],"sources":["../../src/home.ts","../../src/run.ts","../../src/sandbox/env.ts","../../src/docker/templates.ts","../../src/sandbox/install.ts","../../src/sandbox/local.ts","../../src/sandbox/worker.ts","../../src/target/sst/health.ts","../../src/target/sst/outputs.ts","../../src/target/sst/index.ts","../../src/deploy/deploy.ts","../../src/deploy/index.ts","../../src/deploy/orchestrate.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;;;;;qBAaa;;wBAGG,QAAQ,MAAK,OAAO;;;;qBCuBvB,sBAAsB;WAExB;WACA;WACA;WACA,QAAQ,OAAO;EAJzB,YACU,iBACA,yBACA,yBACA,QAAQ,OAAO;;;qBAUb,wBAAwB;WAE1B;WACA;WACA;EAHV,YACU,iBACA,yBACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC3BE,0CAA0C;;;;;wBAyDvC,eACf,SAAQ,OAAO,YACf,4BACE;;;KCvFS;;;;qBCeC;UAEI;;EAEhB;;EAEA,iBAAiB;;;;;;;EAOjB;;;;;EAKA;;EAEA,MAAM,SAAS;;EAEf;;EAEA,SAAS;EACT,SAAS;;;qBAIG,oCAAoC;WAC3B;EAArB,YAAqB;;;qBAWT,2CAA2C;WAE7C;WACA;EAFV,YACU,wBACA;;;;;;;;;;;;;;;;;;;;wBAqJW,oBACrB,SAAS,SACT,UAAS,iBACP,QAAQ;;;UCpMM;;EAEhB;;;;;;;;;EASA;;;;;EAKA;;EAEA,UAAU,OAAO;;;;;;;;;;;;;;;;;qBA0BL,wBAAwB;WAC3B;WACA;WACA,KAAK,SAAS;EAEvB,YAAY,SAAS;EAUf,KACL,iBACA,yBACA,SAAS,qBACP,QAAQ;;;;;qBCpBC,4BAA4B;WAE9B;WACA;WACA;EAHV,YACU,cACA,yBACA;;;;;qBC1CE,0BAA0B;WAE5B;;WAEA;IACR;IACA;IACA;IACA;;EAPF,YACU,eAEA;;EAAA;IACR;IACA;IACA;IACA;;;;;;qBCZU,6BAA6B;WAE/B;WACA;EAFV,YACU,cACA;;;;;qBC2BE,0BAA0B;WACjB;EAArB,YAAqB;;;;;;;;UCpBL;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;EAEA;;;;;EAKA;;;;;;EAMA,UAAU,eAAe;;EAEzB;;EAEA;;;;;;EAMA;;;;;;EAMA,cAAc;;EAEd,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;;;;;;;;;;EAYA,UAAU;;;UAIM,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBAqEV,OAAO,OAAO,cAAc;;;;qBCuU/B,4BAA4B;WAE9B;EADV,YACU,aACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;qBCvcE,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAE3B;WACA;EAFV,YACU,eACA;;;qBAUE,uBAAuB;WAEzB;;WAEA;EAHV,YACU,gBAEA;;EAAA,kBACT;;;;;;;;qBC1EW,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}