@geekmidas/cli 10.0.0-alpha.62 → 10.0.0-alpha.64

package/dist/deploy/public.mjs

@@ -1,10 +1,141 @@
-import { M as StateVersionConflict, k as StateLocked } from "../sniffer-DHE2Nafd.mjs";
-import { n as gkmHome, t as GKM_HOME_ENV } from "../home-GI7pJl1M.mjs";
-import { a as UnknownDeployTarget, i as DeployTargetNotYetSupported } from "../define-CHBIEc5j.mjs";
-import { u as deployIdentity } from "../store-BS8A7NcA.mjs";
-import { i as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-DbakJS8u.mjs";
-import { i as TargetRuntimeMismatch, n as TargetEntryInvalid, r as TargetPackageInvalid, s as ProviderRemoved, t as InvalidTargetOptions } from "../resolve-CFCIkm7m.mjs";
-import { c as MissingCredential, i as UnknownDeployApps, l as chainCredentials, n as NoDeployableApps, r as RollbackFailed, u as storedCredentials } from "../terminal-ByZNjuig.mjs";
-import { t as deploy } from "../deploy-Cg9fae7a.mjs";
-import { d as RegistryNotFound, f as ProjectNotOwned, l as RegistryAmbiguous, n as MissingEnvVars, t as BackendDeployFailed, u as RegistryNotConfigured } from "../deploy-B7jvUORo.mjs";
-export { BackendDeployFailed, DeployTargetNotYetSupported, GKM_HOME_ENV, InvalidTargetOptions, MissingCredential, MissingEnvVars, NoDeployableApps, ProjectNotOwned, ProviderRemoved, RegistryAmbiguous, RegistryNotConfigured, RegistryNotFound, RollbackFailed, StateLocked, StateVersionConflict, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployApps, UnknownDeployTarget, chainCredentials, deploy, deployIdentity, gkmHome, storedCredentials };
+import { M as StateVersionConflict, k as StateLocked, u as detectPackageManager } from "../sniffer-49KPbDgq.mjs";
+import { a as CommandTimedOut, i as CommandFailed, n as SANDBOX_ENV_ALLOWLIST, r as allowlistedEnv, t as LocalSandbox, v as GKM_HOME_ENV, y as gkmHome } from "../local-Cd8ZYQG3.mjs";
+import { n as ConstructsNotSerializable, o as SandboxWorkerFailed, t as ConstructDiscoveryFailed } from "../discover-LMrqsWSU.mjs";
+import { n as SandboxCwdEscape, o as confineCwd, r as SecretNameInvalid, t as SECRETS_DIR_ENV } from "../sandbox-Dm247NGx.mjs";
+import { a as UnknownDeployTarget, i as DeployTargetNotYetSupported } from "../define-CYs0PEfZ.mjs";
+import { ConfigLoadFailed, ConfigObjectNotSerializable } from "../config.mjs";
+import { u as deployIdentity } from "../store-BaaonhkJ.mjs";
+import { i as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-Cmn-FeYO.mjs";
+import { i as TargetRuntimeMismatch, n as TargetEntryInvalid, r as TargetPackageInvalid, s as ProviderRemoved, t as InvalidTargetOptions } from "../resolve-DZ2IJ0qY.mjs";
+import { n as chainCredentials, r as storedCredentials, t as MissingCredential } from "../credentials-s0wMeZBU.mjs";
+import { i as SurfacesUnhealthy, r as SstOutputsUnreadable, t as SstConfigNotFound } from "../sst-Cper040I.mjs";
+import { i as UnknownDeployApps, n as NoDeployableApps, r as RollbackFailed } from "../terminal-D7Ntz6WE.mjs";
+import { t as deploy } from "../deploy-Dc2LBJaK.mjs";
+import { d as RegistryNotFound, f as ProjectNotOwned, l as RegistryAmbiguous, n as MissingEnvVars, t as BackendDeployFailed, u as RegistryNotConfigured } from "../deploy-ZRXIPp1c.mjs";
+import { join, resolve } from "node:path";
+import { existsSync } from "node:fs";
+//#region src/sandbox/install.ts
+/**
+* Installing a project's dependencies in a sandbox, with or without their
+* lifecycle scripts.
+*
+* `postinstall` is the oldest way into a build machine: any package in the
+* lockfile — a dependency of a dependency — runs whatever it likes the moment
+* it is installed. For a build the host trusts that is how native modules get
+* built. For one it does not, the scripts are skipped, and the few packages
+* that genuinely need theirs (esbuild's binary, a database driver) are named
+* and rebuilt — with nothing but the sandbox's environment either way.
+*/
+/** Long enough for a cold install of a large monorepo. */
+const INSTALL_TIMEOUT_MS = 9e5;
+/** A name in `allowScripts` that is not a package name. */
+var InstallAllowlistNameInvalid = class extends Error {
+	packageName;
+	constructor(packageName) {
+		super(`'${packageName}' is not a package name, so its scripts cannot be allowed. Name the package as it appears in package.json — 'esbuild', '@prisma/client'.`);
+		this.packageName = packageName;
+		this.name = "InstallAllowlistNameInvalid";
+	}
+};
+/** The package manager has no way to run only some packages' scripts. */
+var InstallScriptsAllowlistUnsupported = class extends Error {
+	packageManager;
+	allowScripts;
+	constructor(packageManager, allowScripts) {
+		super(`${packageManager} cannot rebuild named packages after an install without scripts, so ${allowScripts.join(", ")} cannot be allowed theirs. Use pnpm, npm or Yarn 2+, or install with every script skipped.`);
+		this.packageManager = packageManager;
+		this.allowScripts = allowScripts;
+		this.name = "InstallScriptsAllowlistUnsupported";
+	}
+};
+/**
+* npm's package-name grammar, less a leading `-`: each name is an argument to
+* `rebuild`, and must never be read as a flag.
+*/
+const PACKAGE_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\/)?[a-z0-9~][a-z0-9._~-]*$/;
+/**
+* The commands an install runs, in order. Exported for the tests, which
+* check each package manager's flags without installing with all four.
+*/
+function installCommands(packageManager, cwd, options = {}) {
+	const ignore = options.ignoreScripts ?? false;
+	const allow = ignore ? [...options.allowScripts ?? []] : [];
+	for (const name of allow) if (!PACKAGE_NAME.test(name)) throw new InstallAllowlistNameInvalid(name);
+	switch (packageManager) {
+		case "pnpm": return [["pnpm", [
+			"install",
+			"--frozen-lockfile",
+			...ignore ? ["--ignore-scripts"] : []
+		]], ...allow.length > 0 ? [["pnpm", [
+			"rebuild",
+			"--config.dangerouslyAllowAllBuilds=true",
+			...allow
+		]]] : []];
+		case "npm": return [["npm", [existsSync(join(cwd, "package-lock.json")) ? "ci" : "install", ...ignore ? ["--ignore-scripts"] : []]], ...allow.length > 0 ? [["npm", [
+			"rebuild",
+			"--dangerously-allow-all-scripts",
+			...allow
+		]]] : []];
+		case "yarn":
+			if (existsSync(join(cwd, ".yarnrc.yml"))) return [["yarn", [
+				"install",
+				"--immutable",
+				...ignore ? ["--mode=skip-build"] : []
+			]], ...allow.length > 0 ? [["yarn", ["rebuild", ...allow]]] : []];
+			if (allow.length > 0) throw new InstallScriptsAllowlistUnsupported("Yarn 1", allow);
+			return [["yarn", [
+				"install",
+				"--frozen-lockfile",
+				...ignore ? ["--ignore-scripts"] : []
+			]]];
+		case "bun":
+			if (allow.length > 0) throw new InstallScriptsAllowlistUnsupported("bun", allow);
+			return [["bun", [
+				"install",
+				"--frozen-lockfile",
+				...ignore ? ["--ignore-scripts"] : []
+			]]];
+	}
+}
+/**
+* Install the project's dependencies in `sandbox`.
+*
+* ```ts
+* // A checkout nobody has reviewed: no scripts but esbuild's.
+* await installDependencies(sandbox, {
+*   ignoreScripts: true,
+*   allowScripts: ['esbuild'],
+* });
+* ```
+*
+* Resolves with each command's result, in order — with its output when
+* `output` is `capture`.
+*
+* @throws {CommandFailed} when the package manager exits unsuccessfully.
+* @throws {InstallScriptsAllowlistUnsupported} for an allowlist the package
+*   manager cannot honour, before anything is installed.
+*/
+async function installDependencies(sandbox, options = {}) {
+	const cwd = options.cwd ?? sandbox.root;
+	const results = [];
+	const packageManager = options.packageManager ?? detectPackageManager(resolve(sandbox.root, cwd));
+	for (const [command, args] of installCommands(packageManager, resolve(sandbox.root, cwd), options)) {
+		const result = await sandbox.exec(command, args, {
+			cwd,
+			env: {
+				...sandbox.env,
+				...options.env
+			},
+			timeoutMs: options.timeoutMs ?? 9e5,
+			output: options.output ?? "inherit",
+			...options.signal ? { signal: options.signal } : {}
+		});
+		results.push(result);
+		if (result.exitCode !== 0) throw new CommandFailed(command, args, result.exitCode, result.signal);
+	}
+	return results;
+}
+//#endregion
+export { BackendDeployFailed, CommandFailed, CommandTimedOut, ConfigLoadFailed, ConfigObjectNotSerializable, ConstructDiscoveryFailed, ConstructsNotSerializable, DeployTargetNotYetSupported, GKM_HOME_ENV, INSTALL_TIMEOUT_MS, InstallAllowlistNameInvalid, InstallScriptsAllowlistUnsupported, InvalidTargetOptions, LocalSandbox, MissingCredential, MissingEnvVars, NoDeployableApps, ProjectNotOwned, ProviderRemoved, RegistryAmbiguous, RegistryNotConfigured, RegistryNotFound, RollbackFailed, SANDBOX_ENV_ALLOWLIST, SECRETS_DIR_ENV, SandboxCwdEscape, SandboxWorkerFailed, SecretNameInvalid, SstConfigNotFound, SstOutputsUnreadable, StateLocked, StateVersionConflict, SurfacesUnhealthy, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployApps, UnknownDeployTarget, allowlistedEnv, chainCredentials, confineCwd, deploy, deployIdentity, gkmHome, installDependencies, storedCredentials };
+
+//# sourceMappingURL=public.mjs.map

package/dist/deploy/public.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.mjs","names":[],"sources":["../../src/sandbox/install.ts"],"sourcesContent":["/**\n * Installing a project's dependencies in a sandbox, with or without their\n * lifecycle scripts.\n *\n * `postinstall` is the oldest way into a build machine: any package in the\n * lockfile — a dependency of a dependency — runs whatever it likes the moment\n * it is installed. For a build the host trusts that is how native modules get\n * built. For one it does not, the scripts are skipped, and the few packages\n * that genuinely need theirs (esbuild's binary, a database driver) are named\n * and rebuilt — with nothing but the sandbox's environment either way.\n */\n\nimport { existsSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { detectPackageManager, type PackageManager } from '../docker/templates';\nimport { CommandFailed } from '../run';\nimport type { Sandbox, SandboxOutput, SandboxResult } from './sandbox';\n\n/** Long enough for a cold install of a large monorepo. */\nexport const INSTALL_TIMEOUT_MS = 15 * 60_000;\n\nexport interface InstallOptions {\n\t/** The directory to install in. Defaults to the sandbox's root. */\n\tcwd?: string;\n\t/** Defaults to the one the lockfile above `cwd` names. */\n\tpackageManager?: PackageManager;\n\t/**\n\t * Skip every lifecycle script — dependencies' and the project's own —\n\t * except those of {@link allowScripts}. Defaults to false: scripts run as\n\t * a plain install runs them, under the package manager's own policy —\n\t * npm 12 and pnpm 10 skip dependencies' scripts nobody approved.\n\t */\n\tignoreScripts?: boolean;\n\t/**\n\t * With `ignoreScripts`, the packages whose scripts still run: rebuilt by\n\t * name once the install is done.\n\t */\n\tallowScripts?: readonly string[];\n\t/** Variables the install needs beyond the sandbox's own. */\n\tenv?: Readonly<Record<string, string>>;\n\t/** Defaults to {@link INSTALL_TIMEOUT_MS}, for each command. */\n\ttimeoutMs?: number;\n\t/** Where the package manager's output goes. Defaults to `inherit`. */\n\toutput?: SandboxOutput;\n\tsignal?: AbortSignal;\n}\n\n/** A name in `allowScripts` that is not a package name. */\nexport class InstallAllowlistNameInvalid extends Error {\n\tconstructor(readonly packageName: string) {\n\t\tsuper(\n\t\t\t`'${packageName}' is not a package name, so its scripts cannot be ` +\n\t\t\t\t'allowed. Name the package as it appears in package.json — ' +\n\t\t\t\t\"'esbuild', '@prisma/client'.\",\n\t\t);\n\t\tthis.name = 'InstallAllowlistNameInvalid';\n\t}\n}\n\n/** The package manager has no way to run only some packages' scripts. */\nexport class InstallScriptsAllowlistUnsupported extends Error {\n\tconstructor(\n\t\treadonly packageManager: string,\n\t\treadonly allowScripts: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`${packageManager} cannot rebuild named packages after an install ` +\n\t\t\t\t`without scripts, so ${allowScripts.join(', ')} cannot be allowed ` +\n\t\t\t\t'theirs. Use pnpm, npm or Yarn 2+, or install with every script ' +\n\t\t\t\t'skipped.',\n\t\t);\n\t\tthis.name = 'InstallScriptsAllowlistUnsupported';\n\t}\n}\n\n/**\n * npm's package-name grammar, less a leading `-`: each name is an argument to\n * `rebuild`, and must never be read as a flag.\n */\nconst PACKAGE_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\\/)?[a-z0-9~][a-z0-9._~-]*$/;\n\n/**\n * The commands an install runs, in order. Exported for the tests, which\n * check each package manager's flags without installing with all four.\n */\nexport function installCommands(\n\tpackageManager: PackageManager,\n\tcwd: string,\n\toptions: Pick<InstallOptions, 'ignoreScripts' | 'allowScripts'> = {},\n): [string, string[]][] {\n\tconst ignore = options.ignoreScripts ?? false;\n\tconst allow = ignore ? [...(options.allowScripts ?? [])] : [];\n\tfor (const name of allow) {\n\t\tif (!PACKAGE_NAME.test(name)) throw new InstallAllowlistNameInvalid(name);\n\t}\n\n\tswitch (packageManager) {\n\t\tcase 'pnpm':\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'pnpm',\n\t\t\t\t\t[\n\t\t\t\t\t\t'install',\n\t\t\t\t\t\t'--frozen-lockfile',\n\t\t\t\t\t\t...(ignore ? ['--ignore-scripts'] : []),\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t\t// pnpm 10 builds no dependency it was not told to, even by name;\n\t\t\t\t// this command names exactly the ones allowed, so it may build\n\t\t\t\t// what it names.\n\t\t\t\t...(allow.length > 0\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'pnpm',\n\t\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t\t'rebuild',\n\t\t\t\t\t\t\t\t\t'--config.dangerouslyAllowAllBuilds=true',\n\t\t\t\t\t\t\t\t\t...allow,\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t] as [string, string[]],\n\t\t\t\t\t\t]\n\t\t\t\t\t: []),\n\t\t\t];\n\t\tcase 'npm': {\n\t\t\tconst locked = existsSync(join(cwd, 'package-lock.json'));\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'npm',\n\t\t\t\t\t[locked ? 'ci' : 'install', ...(ignore ? ['--ignore-scripts'] : [])],\n\t\t\t\t],\n\t\t\t\t// npm 12 runs no dependency's install script its `allowScripts`\n\t\t\t\t// policy does not approve, rebuilt by name or not, and refuses\n\t\t\t\t// `--allow-scripts` on a project's command line. This command\n\t\t\t\t// names exactly the packages allowed, so it may run what it names.\n\t\t\t\t...(allow.length > 0\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'npm',\n\t\t\t\t\t\t\t\t['rebuild', '--dangerously-allow-all-scripts', ...allow],\n\t\t\t\t\t\t\t] as [string, string[]],\n\t\t\t\t\t\t]\n\t\t\t\t\t: []),\n\t\t\t];\n\t\t}\n\t\tcase 'yarn': {\n\t\t\t// Yarn 2+ keeps a `.yarnrc.yml`; it skips builds by mode and can\n\t\t\t// rebuild by name. Yarn 1 can only skip them all.\n\t\t\tconst berry = existsSync(join(cwd, '.yarnrc.yml'));\n\t\t\tif (berry) {\n\t\t\t\treturn [\n\t\t\t\t\t[\n\t\t\t\t\t\t'yarn',\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'install',\n\t\t\t\t\t\t\t'--immutable',\n\t\t\t\t\t\t\t...(ignore ? ['--mode=skip-build'] : []),\n\t\t\t\t\t\t],\n\t\t\t\t\t],\n\t\t\t\t\t...(allow.length > 0\n\t\t\t\t\t\t? [['yarn', ['rebuild', ...allow]] as [string, string[]]]\n\t\t\t\t\t\t: []),\n\t\t\t\t];\n\t\t\t}\n\t\t\tif (allow.length > 0) {\n\t\t\t\tthrow new InstallScriptsAllowlistUnsupported('Yarn 1', allow);\n\t\t\t}\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'yarn',\n\t\t\t\t\t[\n\t\t\t\t\t\t'install',\n\t\t\t\t\t\t'--frozen-lockfile',\n\t\t\t\t\t\t...(ignore ? ['--ignore-scripts'] : []),\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t];\n\t\t}\n\t\tcase 'bun':\n\t\t\tif (allow.length > 0) {\n\t\t\t\tthrow new InstallScriptsAllowlistUnsupported('bun', allow);\n\t\t\t}\n\t\t\treturn [\n\t\t\t\t[\n\t\t\t\t\t'bun',\n\t\t\t\t\t[\n\t\t\t\t\t\t'install',\n\t\t\t\t\t\t'--frozen-lockfile',\n\t\t\t\t\t\t...(ignore ? ['--ignore-scripts'] : []),\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t];\n\t}\n}\n\n/**\n * Install the project's dependencies in `sandbox`.\n *\n * ```ts\n * // A checkout nobody has reviewed: no scripts but esbuild's.\n * await installDependencies(sandbox, {\n *   ignoreScripts: true,\n *   allowScripts: ['esbuild'],\n * });\n * ```\n *\n * Resolves with each command's result, in order — with its output when\n * `output` is `capture`.\n *\n * @throws {CommandFailed} when the package manager exits unsuccessfully.\n * @throws {InstallScriptsAllowlistUnsupported} for an allowlist the package\n *   manager cannot honour, before anything is installed.\n */\nexport async function installDependencies(\n\tsandbox: Sandbox,\n\toptions: InstallOptions = {},\n): Promise<SandboxResult[]> {\n\tconst cwd = options.cwd ?? sandbox.root;\n\tconst results: SandboxResult[] = [];\n\tconst packageManager =\n\t\toptions.packageManager ?? detectPackageManager(resolve(sandbox.root, cwd));\n\n\tfor (const [command, args] of installCommands(\n\t\tpackageManager,\n\t\tresolve(sandbox.root, cwd),\n\t\toptions,\n\t)) {\n\t\tconst result = await sandbox.exec(command, args, {\n\t\t\tcwd,\n\t\t\tenv: { ...sandbox.env, ...options.env },\n\t\t\ttimeoutMs: options.timeoutMs ?? INSTALL_TIMEOUT_MS,\n\t\t\toutput: options.output ?? 'inherit',\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t});\n\t\tresults.push(result);\n\t\tif (result.exitCode !== 0) {\n\t\t\tthrow new CommandFailed(\n\t\t\t\tcommand,\n\t\t\t\targs,\n\t\t\t\tresult.exitCode,\n\t\t\t\tresult.signal as NodeJS.Signals | null,\n\t\t\t);\n\t\t}\n\t}\n\treturn results;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,MAAa,qBAAqB;;AA6BlC,IAAa,8BAAb,cAAiD,MAAM;CACjC;CAArB,YAAY,aAA8B;EACzC,MACC,IAAI,YAAY,yIAGjB;EALoB,KAAA,cAAA;EAMpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qCAAb,cAAwD,MAAM;CAEnD;CACA;CAFV,YACC,gBACA,cACC;EACD,MACC,GAAG,eAAe,sEACM,aAAa,KAAK,IAAI,EAAE,2FAGjD;EARS,KAAA,iBAAA;EACA,KAAA,eAAA;EAQT,KAAK,OAAO;CACb;AACD;;;;;AAMA,MAAM,eAAe;;;;;AAMrB,SAAgB,gBACf,gBACA,KACA,UAAkE,CAAC,GAC5C;CACvB,MAAM,SAAS,QAAQ,iBAAiB;CACxC,MAAM,QAAQ,SAAS,CAAC,GAAI,QAAQ,gBAAgB,CAAC,CAAE,IAAI,CAAC;CAC5D,KAAK,MAAM,QAAQ,OAClB,IAAI,CAAC,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI,4BAA4B,IAAI;CAGzE,QAAQ,gBAAR;EACC,KAAK,QACJ,OAAO,CACN,CACC,QACA;GACC;GACA;GACA,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC;EACtC,CACD,GAIA,GAAI,MAAM,SAAS,IAChB,CACA,CACC,QACA;GACC;GACA;GACA,GAAG;EACJ,CACD,CACD,IACC,CAAC,CACL;EACD,KAAK,OAEJ,OAAO,CACN,CACC,OACA,CAJa,WAAW,KAAK,KAAK,mBAAmB,CAI/C,IAAI,OAAO,WAAW,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC,CAAE,CACpE,GAKA,GAAI,MAAM,SAAS,IAChB,CACA,CACC,OACA;GAAC;GAAW;GAAmC,GAAG;EAAK,CACxD,CACD,IACC,CAAC,CACL;EAED,KAAK;GAIJ,IADc,WAAW,KAAK,KAAK,aAAa,CACxC,GACP,OAAO,CACN,CACC,QACA;IACC;IACA;IACA,GAAI,SAAS,CAAC,mBAAmB,IAAI,CAAC;GACvC,CACD,GACA,GAAI,MAAM,SAAS,IAChB,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,CAAuB,IACtD,CAAC,CACL;GAED,IAAI,MAAM,SAAS,GAClB,MAAM,IAAI,mCAAmC,UAAU,KAAK;GAE7D,OAAO,CACN,CACC,QACA;IACC;IACA;IACA,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC;GACtC,CACD,CACD;EAED,KAAK;GACJ,IAAI,MAAM,SAAS,GAClB,MAAM,IAAI,mCAAmC,OAAO,KAAK;GAE1D,OAAO,CACN,CACC,OACA;IACC;IACA;IACA,GAAI,SAAS,CAAC,kBAAkB,IAAI,CAAC;GACtC,CACD,CACD;CACF;AACD;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,oBACrB,SACA,UAA0B,CAAC,GACA;CAC3B,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,UAA2B,CAAC;CAClC,MAAM,iBACL,QAAQ,kBAAkB,qBAAqB,QAAQ,QAAQ,MAAM,GAAG,CAAC;CAE1E,KAAK,MAAM,CAAC,SAAS,SAAS,gBAC7B,gBACA,QAAQ,QAAQ,MAAM,GAAG,GACzB,OACD,GAAG;EACF,MAAM,SAAS,MAAM,QAAQ,KAAK,SAAS,MAAM;GAChD;GACA,KAAK;IAAE,GAAG,QAAQ;IAAK,GAAG,QAAQ;GAAI;GACtC,WAAW,QAAQ,aAAA;GACnB,QAAQ,QAAQ,UAAU;GAC1B,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACpD,CAAC;EACD,QAAQ,KAAK,MAAM;EACnB,IAAI,OAAO,aAAa,GACvB,MAAM,IAAI,cACT,SACA,MACA,OAAO,UACP,OAAO,MACR;CAEF;CACA,OAAO;AACR"}

package/dist/deploy/sniffer-envparser-worker.cjs

@@ -0,0 +1,54 @@
+let node_url = require("node:url");
+let _geekmidas_envkit_sniffer = require("@geekmidas/envkit/sniffer");
+//#region src/deploy/sniffer-envparser-worker.ts
+/**
+* Subprocess worker for envParser sniffing.
+*
+* Imports an app's envParser module, hands it a SnifferEnvironmentParser and
+* reports which variables it read. A subprocess, like the entry and route
+* sniffers, so the module runs in the sandbox rather than in the deploy, with
+* none of the deploy's environment.
+*
+* Usage:
+*   node --import tsx ./sniffer-envparser-worker.ts /path/to/env.ts envParser
+*
+* Output (JSON, last line of stdout):
+*   { "envVars": [...], "optionalEnvVars": [...], "unhandledRejections": [...],
+*     "warnings": [...], "error": null }
+*/
+const modulePath = process.argv[2];
+const exportName = process.argv[3] ?? "default";
+async function sniff() {
+	const warnings = [];
+	const sniffer = new _geekmidas_envkit_sniffer.SnifferEnvironmentParser();
+	const result = await (0, _geekmidas_envkit_sniffer.sniffWithFireAndForget)(sniffer, async () => {
+		if (!modulePath) throw new TypeError("No envParser module was given.");
+		const envParser = (await import((0, node_url.pathToFileURL)(modulePath).href))[exportName];
+		if (typeof envParser !== "function") {
+			warnings.push(`[sniffer] Export "${exportName}" from "${modulePath}" is not a function`);
+			return;
+		}
+		const parser = envParser(sniffer);
+		if (parser && typeof parser.parse === "function") try {
+			parser.parse();
+		} catch {}
+	});
+	const line = JSON.stringify({
+		envVars: result.envVars,
+		optionalEnvVars: result.optionalEnvVars,
+		unhandledRejections: result.unhandledRejections.map((e) => e.message),
+		warnings,
+		error: result.error ? result.error.message : null
+	});
+	process.stdout.write(`${line}\n`, () => process.exit(0));
+}
+sniff().catch((e) => {
+	console.log(JSON.stringify({
+		envVars: [],
+		error: e.message || String(e)
+	}));
+	process.exit(1);
+});
+//#endregion
+
+//# sourceMappingURL=sniffer-envparser-worker.cjs.map

package/dist/deploy/sniffer-envparser-worker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sniffer-envparser-worker.cjs","names":["SnifferEnvironmentParser","sniffWithFireAndForget","pathToFileURL"],"sources":["../../src/deploy/sniffer-envparser-worker.ts"],"sourcesContent":["/**\n * Subprocess worker for envParser sniffing.\n *\n * Imports an app's envParser module, hands it a SnifferEnvironmentParser and\n * reports which variables it read. A subprocess, like the entry and route\n * sniffers, so the module runs in the sandbox rather than in the deploy, with\n * none of the deploy's environment.\n *\n * Usage:\n *   node --import tsx ./sniffer-envparser-worker.ts /path/to/env.ts envParser\n *\n * Output (JSON, last line of stdout):\n *   { \"envVars\": [...], \"optionalEnvVars\": [...], \"unhandledRejections\": [...],\n *     \"warnings\": [...], \"error\": null }\n */\n\nimport { pathToFileURL } from 'node:url';\nimport {\n\tSnifferEnvironmentParser,\n\tsniffWithFireAndForget,\n} from '@geekmidas/envkit/sniffer';\n\nconst modulePath = process.argv[2];\nconst exportName = process.argv[3] ?? 'default';\n\nasync function sniff(): Promise<void> {\n\tconst warnings: string[] = [];\n\tconst sniffer = new SnifferEnvironmentParser();\n\n\tconst result = await sniffWithFireAndForget(sniffer, async () => {\n\t\tif (!modulePath) throw new TypeError('No envParser module was given.');\n\t\tconst module = await import(pathToFileURL(modulePath).href);\n\n\t\tconst envParser = module[exportName];\n\t\tif (typeof envParser !== 'function') {\n\t\t\twarnings.push(\n\t\t\t\t`[sniffer] Export \"${exportName}\" from \"${modulePath}\" is not a function`,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\t// The envParser function typically creates and configures an\n\t\t// EnvironmentParser; the sniffer implements the same interface.\n\t\tconst parser = envParser(sniffer);\n\n\t\t// A ConfigParser's parse() is what reads the variables.\n\t\tif (parser && typeof parser.parse === 'function') {\n\t\t\ttry {\n\t\t\t\tparser.parse();\n\t\t\t} catch {\n\t\t\t\t// Parsing may fail on the sniffer's mock values; expected.\n\t\t\t}\n\t\t}\n\t});\n\n\tconst line = JSON.stringify({\n\t\tenvVars: result.envVars,\n\t\toptionalEnvVars: result.optionalEnvVars,\n\t\tunhandledRejections: result.unhandledRejections.map((e) => e.message),\n\t\twarnings,\n\t\terror: result.error ? result.error.message : null,\n\t});\n\t// The module may have left a pool or a timer open, so exit — once the\n\t// answer has drained: a pipe on macOS is written asynchronously.\n\tprocess.stdout.write(`${line}\\n`, () => process.exit(0));\n}\n\nsniff().catch((e) => {\n\tconsole.log(JSON.stringify({ envVars: [], error: e.message || String(e) }));\n\tprocess.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsBA,MAAM,aAAa,QAAQ,KAAK;AAChC,MAAM,aAAa,QAAQ,KAAK,MAAM;AAEtC,eAAe,QAAuB;CACrC,MAAM,WAAqB,CAAC;CAC5B,MAAM,UAAU,IAAIA,0BAAAA,yBAAyB;CAE7C,MAAM,SAAS,OAAA,GAAMC,0BAAAA,uBAAAA,CAAuB,SAAS,YAAY;EAChE,IAAI,CAAC,YAAY,MAAM,IAAI,UAAU,gCAAgC;EAGrE,MAAM,aAAY,MAFG,QAAA,GAAOC,SAAAA,cAAAA,CAAc,UAAU,CAAC,CAAC,MAAA,CAE7B;EACzB,IAAI,OAAO,cAAc,YAAY;GACpC,SAAS,KACR,qBAAqB,WAAW,UAAU,WAAW,oBACtD;GACA;EACD;EAIA,MAAM,SAAS,UAAU,OAAO;EAGhC,IAAI,UAAU,OAAO,OAAO,UAAU,YACrC,IAAI;GACH,OAAO,MAAM;EACd,QAAQ,CAER;CAEF,CAAC;CAED,MAAM,OAAO,KAAK,UAAU;EAC3B,SAAS,OAAO;EAChB,iBAAiB,OAAO;EACxB,qBAAqB,OAAO,oBAAoB,KAAK,MAAM,EAAE,OAAO;EACpE;EACA,OAAO,OAAO,QAAQ,OAAO,MAAM,UAAU;CAC9C,CAAC;CAGD,QAAQ,OAAO,MAAM,GAAG,KAAK,WAAW,QAAQ,KAAK,CAAC,CAAC;AACxD;AAEA,MAAM,CAAC,CAAC,OAAO,MAAM;CACpB,QAAQ,IAAI,KAAK,UAAU;EAAE,SAAS,CAAC;EAAG,OAAO,EAAE,WAAW,OAAO,CAAC;CAAE,CAAC,CAAC;CAC1E,QAAQ,KAAK,CAAC;AACf,CAAC"}

package/dist/deploy/sniffer-envparser-worker.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/deploy/sniffer-envparser-worker.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/deploy/sniffer-envparser-worker.mjs

@@ -0,0 +1,55 @@
+import { pathToFileURL } from "node:url";
+import { SnifferEnvironmentParser, sniffWithFireAndForget } from "@geekmidas/envkit/sniffer";
+//#region src/deploy/sniffer-envparser-worker.ts
+/**
+* Subprocess worker for envParser sniffing.
+*
+* Imports an app's envParser module, hands it a SnifferEnvironmentParser and
+* reports which variables it read. A subprocess, like the entry and route
+* sniffers, so the module runs in the sandbox rather than in the deploy, with
+* none of the deploy's environment.
+*
+* Usage:
+*   node --import tsx ./sniffer-envparser-worker.ts /path/to/env.ts envParser
+*
+* Output (JSON, last line of stdout):
+*   { "envVars": [...], "optionalEnvVars": [...], "unhandledRejections": [...],
+*     "warnings": [...], "error": null }
+*/
+const modulePath = process.argv[2];
+const exportName = process.argv[3] ?? "default";
+async function sniff() {
+	const warnings = [];
+	const sniffer = new SnifferEnvironmentParser();
+	const result = await sniffWithFireAndForget(sniffer, async () => {
+		if (!modulePath) throw new TypeError("No envParser module was given.");
+		const envParser = (await import(pathToFileURL(modulePath).href))[exportName];
+		if (typeof envParser !== "function") {
+			warnings.push(`[sniffer] Export "${exportName}" from "${modulePath}" is not a function`);
+			return;
+		}
+		const parser = envParser(sniffer);
+		if (parser && typeof parser.parse === "function") try {
+			parser.parse();
+		} catch {}
+	});
+	const line = JSON.stringify({
+		envVars: result.envVars,
+		optionalEnvVars: result.optionalEnvVars,
+		unhandledRejections: result.unhandledRejections.map((e) => e.message),
+		warnings,
+		error: result.error ? result.error.message : null
+	});
+	process.stdout.write(`${line}\n`, () => process.exit(0));
+}
+sniff().catch((e) => {
+	console.log(JSON.stringify({
+		envVars: [],
+		error: e.message || String(e)
+	}));
+	process.exit(1);
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=sniffer-envparser-worker.mjs.map

package/dist/deploy/sniffer-envparser-worker.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sniffer-envparser-worker.mjs","names":[],"sources":["../../src/deploy/sniffer-envparser-worker.ts"],"sourcesContent":["/**\n * Subprocess worker for envParser sniffing.\n *\n * Imports an app's envParser module, hands it a SnifferEnvironmentParser and\n * reports which variables it read. A subprocess, like the entry and route\n * sniffers, so the module runs in the sandbox rather than in the deploy, with\n * none of the deploy's environment.\n *\n * Usage:\n *   node --import tsx ./sniffer-envparser-worker.ts /path/to/env.ts envParser\n *\n * Output (JSON, last line of stdout):\n *   { \"envVars\": [...], \"optionalEnvVars\": [...], \"unhandledRejections\": [...],\n *     \"warnings\": [...], \"error\": null }\n */\n\nimport { pathToFileURL } from 'node:url';\nimport {\n\tSnifferEnvironmentParser,\n\tsniffWithFireAndForget,\n} from '@geekmidas/envkit/sniffer';\n\nconst modulePath = process.argv[2];\nconst exportName = process.argv[3] ?? 'default';\n\nasync function sniff(): Promise<void> {\n\tconst warnings: string[] = [];\n\tconst sniffer = new SnifferEnvironmentParser();\n\n\tconst result = await sniffWithFireAndForget(sniffer, async () => {\n\t\tif (!modulePath) throw new TypeError('No envParser module was given.');\n\t\tconst module = await import(pathToFileURL(modulePath).href);\n\n\t\tconst envParser = module[exportName];\n\t\tif (typeof envParser !== 'function') {\n\t\t\twarnings.push(\n\t\t\t\t`[sniffer] Export \"${exportName}\" from \"${modulePath}\" is not a function`,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\t// The envParser function typically creates and configures an\n\t\t// EnvironmentParser; the sniffer implements the same interface.\n\t\tconst parser = envParser(sniffer);\n\n\t\t// A ConfigParser's parse() is what reads the variables.\n\t\tif (parser && typeof parser.parse === 'function') {\n\t\t\ttry {\n\t\t\t\tparser.parse();\n\t\t\t} catch {\n\t\t\t\t// Parsing may fail on the sniffer's mock values; expected.\n\t\t\t}\n\t\t}\n\t});\n\n\tconst line = JSON.stringify({\n\t\tenvVars: result.envVars,\n\t\toptionalEnvVars: result.optionalEnvVars,\n\t\tunhandledRejections: result.unhandledRejections.map((e) => e.message),\n\t\twarnings,\n\t\terror: result.error ? result.error.message : null,\n\t});\n\t// The module may have left a pool or a timer open, so exit — once the\n\t// answer has drained: a pipe on macOS is written asynchronously.\n\tprocess.stdout.write(`${line}\\n`, () => process.exit(0));\n}\n\nsniff().catch((e) => {\n\tconsole.log(JSON.stringify({ envVars: [], error: e.message || String(e) }));\n\tprocess.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsBA,MAAM,aAAa,QAAQ,KAAK;AAChC,MAAM,aAAa,QAAQ,KAAK,MAAM;AAEtC,eAAe,QAAuB;CACrC,MAAM,WAAqB,CAAC;CAC5B,MAAM,UAAU,IAAI,yBAAyB;CAE7C,MAAM,SAAS,MAAM,uBAAuB,SAAS,YAAY;EAChE,IAAI,CAAC,YAAY,MAAM,IAAI,UAAU,gCAAgC;EAGrE,MAAM,aAAY,MAFG,OAAO,cAAc,UAAU,CAAC,CAAC,MAAA,CAE7B;EACzB,IAAI,OAAO,cAAc,YAAY;GACpC,SAAS,KACR,qBAAqB,WAAW,UAAU,WAAW,oBACtD;GACA;EACD;EAIA,MAAM,SAAS,UAAU,OAAO;EAGhC,IAAI,UAAU,OAAO,OAAO,UAAU,YACrC,IAAI;GACH,OAAO,MAAM;EACd,QAAQ,CAER;CAEF,CAAC;CAED,MAAM,OAAO,KAAK,UAAU;EAC3B,SAAS,OAAO;EAChB,iBAAiB,OAAO;EACxB,qBAAqB,OAAO,oBAAoB,KAAK,MAAM,EAAE,OAAO;EACpE;EACA,OAAO,OAAO,QAAQ,OAAO,MAAM,UAAU;CAC9C,CAAC;CAGD,QAAQ,OAAO,MAAM,GAAG,KAAK,WAAW,QAAQ,KAAK,CAAC,CAAC;AACxD;AAEA,MAAM,CAAC,CAAC,OAAO,MAAM;CACpB,QAAQ,IAAI,KAAK,UAAU;EAAE,SAAS,CAAC;EAAG,OAAO,EAAE,WAAW,OAAO,CAAC;CAAE,CAAC,CAAC;CAC1E,QAAQ,KAAK,CAAC;AACf,CAAC"}

package/dist/{deploy-DSaCYvcO.cjs → deploy-55rJkdKz.cjs}

@@ -1,10 +1,13 @@
-const require_sniffer = require("./sniffer-BsfPa-GA.cjs");
-const require_discover = require("./discover-Bc-4eA_p.cjs");
-const require_config = require("./config-BYh9S0cZ.cjs");
-const require_workspace = require("./workspace-B6zQO6RY.cjs");
+const require_sniffer = require("./sniffer-ByhbEW5A.cjs");
+const require_local = require("./local-C7wnrcYK.cjs");
+const require_discover = require("./discover-DHdECueV.cjs");
+const require_derive = require("./derive-DAbo49sm.cjs");
+const require_workspace = require("./workspace-BwgWJK7h.cjs");
+require("./config.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
-const require_store = require("./store-KvNQwYaB.cjs");
-const require_terminal = require("./terminal-6oL0vANs.cjs");
+const require_store = require("./store-D_2ByRtW.cjs");
+const require_credentials = require("./credentials-B70vmLcm.cjs");
+const require_terminal = require("./terminal-Bdv--jhY.cjs");
 let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
@@ -758,7 +761,7 @@ function surfaceAddresses(manifest, appUrls) {
 	const addresses = {};
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "rest-api") continue;
-		const url = appUrls[require_config.appKey(id)];
+		const url = appUrls[require_derive.appKey(id)];
 		if (url) addresses[id] = url;
 	}
 	return addresses;
@@ -785,7 +788,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-DyD1Hin8.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-Bx2lHHvu.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -1218,7 +1221,7 @@ async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio
 	const dockerfilePath = (0, node_path.join)(cwd, ".gkm", "docker", "Dockerfile");
 	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
 	try {
-		await require_sniffer.run("docker", dockerBuildArgs({
+		await require_local.run("docker", dockerBuildArgs({
 			dockerfilePath,
 			imageRef,
 			buildArgs,
@@ -1245,7 +1248,7 @@ async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio
 async function pushImage(imageRef, { cwd, signal, stdio }) {
 	logger$1.log(`\n☁️  Pushing image: ${imageRef}`);
 	try {
-		await require_sniffer.run("docker", ["push", imageRef], {
+		await require_local.run("docker", ["push", imageRef], {
 			cwd,
 			...signal ? { signal } : {},
 			...stdio ? { stdio } : {}
@@ -1267,7 +1270,7 @@ async function pushImage(imageRef, { cwd, signal, stdio }) {
 */
 async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
 	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await require_sniffer.runOutput("docker", [
+	const output = await require_local.runOutput("docker", [
 		"image",
 		"inspect",
 		"--format={{json .RepoDigests}}",
@@ -2245,7 +2248,7 @@ async function provisionDokploy(run) {
 				kind: "registry",
 				url
 			}, { signal: ctx.signal });
-			if (!login) throw new require_terminal.MissingCredential("registry", url);
+			if (!login) throw new require_credentials.MissingCredential("registry", url);
 			const created = await api.createRegistry("Default Registry", url, login.username, login.password);
 			registryCreated = true;
 			logger.log(`   ✓ Registry created: ${created.registryId}`);
@@ -2742,7 +2745,7 @@ async function dokployApi(workspace, ctx) {
 		kind: "dokploy",
 		...configured ? { endpoint: configured } : {}
 	}, { signal: ctx.signal });
-	if (!creds) throw new require_terminal.MissingCredential("dokploy", configured);
+	if (!creds) throw new require_credentials.MissingCredential("dokploy", configured);
 	return {
 		api: new require_sniffer.DokployApi({
 			baseUrl: creds.endpoint,
@@ -2970,4 +2973,4 @@ Object.defineProperty(exports, "verifyDokploy", {
 	}
 });
 
-//# sourceMappingURL=deploy-DSaCYvcO.cjs.map
+//# sourceMappingURL=deploy-55rJkdKz.cjs.map