@geekmidas/cli 10.0.0-alpha.63 → 10.0.0-alpha.64

package/dist/config.mjs

@@ -1,3 +1,402 @@
-import { a as NotABackendApp, c as defineConfig, d as loadConfig, f as loadWorkspaceAppInfo, h as parseModuleConfig, i as ConfigObjectNotSerializable, l as findWorkspaceRoot, m as loadWorkspaceSettings, n as ConfigLoadFailed, o as NotInAnApp, p as loadWorkspaceConfig, r as ConfigNotFound, s as WorkspaceDeclaresNoConstructs, t as CONFIG_LOAD_TIMEOUT_MS, u as loadAppConfig } from "./config-LKKCVCnC.mjs";
-import { i as defineWorkspace } from "./workspace-Dh7rr7l4.mjs";
+import { a as discriminatedUnion, c as object, l as record, n as array, o as literal, p as unknown, u as string } from "./schemas-D2LCF689.mjs";
+import { c as runWorker, d as output, r as discover } from "./discover-LMrqsWSU.mjs";
+import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
+import { n as derivedApps } from "./derive-B4vDpzgP.mjs";
+import { h as isWorkspaceConfig, i as defineWorkspace, l as processConfig, o as getAppGkmConfig, t as allConstructGlobs } from "./workspace-Bwit4q9O.mjs";
+import { dirname, join, parse, resolve, sep } from "node:path";
+import { existsSync, realpathSync } from "node:fs";
+//#region src/config.ts
+/**
+* Define GKM configuration with full TypeScript support.
+* This is an identity function that provides type safety and autocomplete.
+*
+* @example
+* ```ts
+* // gkm.config.ts
+* import { defineConfig } from '@geekmidas/cli/config';
+*
+* export default defineConfig({
+*   routes: './src/endpoints/**\/*.ts',
+*   envParser: './src/config/env',
+*   logger: './src/config/logger',
+*   telescope: true,
+* });
+* ```
+*/
+function defineConfig(config) {
+	return config;
+}
+/**
+* Parse a module config string into path and import pattern.
+*
+* @param configString - Config string in format "./path/to/module" or "./path/to/module#exportName"
+* @param defaultAlias - The default alias name to use if no export name specified
+* @returns Object with path and import pattern
+*
+* @example
+* parseModuleConfig('./src/config/env', 'envParser')
+* // { path: './src/config/env', importPattern: 'envParser' }
+*
+* parseModuleConfig('./src/config/env#envParser', 'envParser')
+* // { path: './src/config/env', importPattern: '{ envParser }' }
+*
+* parseModuleConfig('./src/config/env#myEnv', 'envParser')
+* // { path: './src/config/env', importPattern: '{ myEnv as envParser }' }
+*/
+function parseModuleConfig(configString, defaultAlias) {
+	const parts = configString.split("#");
+	const path = parts[0] ?? configString;
+	const exportName = parts[1];
+	return {
+		path,
+		importPattern: !exportName ? defaultAlias : exportName === defaultAlias ? `{ ${defaultAlias} }` : `{ ${exportName} as ${defaultAlias} }`
+	};
+}
+/**
+* Find and return the path to the config file.
+*
+* Resolution order:
+* 1. GKM_CONFIG_PATH env var (set by workspace dev command)
+* 2. Walk up directory tree from cwd
+*/
+function findConfigPath(cwd) {
+	const files = [
+		"gkm.config.json",
+		"gkm.config.ts",
+		"gkm.config.js"
+	];
+	const envConfigPath = process.env.GKM_CONFIG_PATH;
+	if (envConfigPath && existsSync(envConfigPath)) return {
+		configPath: envConfigPath,
+		workspaceRoot: dirname(envConfigPath)
+	};
+	let currentDir = cwd;
+	const { root } = parse(currentDir);
+	while (currentDir !== root) {
+		for (const file of files) {
+			const configPath = join(currentDir, file);
+			if (existsSync(configPath)) return {
+				configPath,
+				workspaceRoot: currentDir
+			};
+		}
+		currentDir = dirname(currentDir);
+	}
+	throw new ConfigNotFound(cwd);
+}
+/**
+* The directory holding the gkm config that `cwd` belongs to — the project a
+* sandbox for it is confined to.
+*
+* @throws {ConfigNotFound} when neither `cwd` nor any parent has one.
+*/
+function findWorkspaceRoot(cwd) {
+	return findConfigPath(cwd).workspaceRoot;
+}
+/** No gkm config in a directory or any of its parents. */
+var ConfigNotFound = class extends Error {
+	cwd;
+	constructor(cwd) {
+		super("Configuration file not found. Please create gkm.config.json, gkm.config.ts, or gkm.config.js in the project root.");
+		this.cwd = cwd;
+		this.name = "ConfigNotFound";
+	}
+};
+/**
+* How long loading a config, or discovering its constructs, may take in a
+* sandbox: room for tsx to compile a large project cold, and not a deploy
+* held open by a config that never finishes importing.
+*/
+const CONFIG_LOAD_TIMEOUT_MS = 6e4;
+/** The config failed to import, or threw while it ran. */
+var ConfigLoadFailed = class extends Error {
+	configPath;
+	detail;
+	constructor(configPath, detail) {
+		super(`Failed to load config: ${detail}`);
+		this.configPath = configPath;
+		this.detail = detail;
+		this.name = "ConfigLoadFailed";
+	}
+};
+/**
+* The config holds something that is not data — a custom state store, an
+* inline deploy target, a function — and the sandbox it was loaded in hands
+* the deploy nothing but data.
+*/
+var ConfigObjectNotSerializable = class extends Error {
+	configPath;
+	paths;
+	constructor(configPath, paths) {
+		super(`${configPath} holds values that are not plain data at: ${paths.join(", ")}. It was loaded in an isolating sandbox, which hands the deploy the config as JSON, so a live object — a custom store, an inline target, a function — cannot reach it. Configure these with plain values instead, or deploy this project with a sandbox that is not isolating (the default) if the host trusts it.`);
+		this.configPath = configPath;
+		this.paths = paths;
+		this.name = "ConfigObjectNotSerializable";
+	}
+};
+/** What the config worker answers. Checked: the worker ran project code. */
+const ConfigAnswer = discriminatedUnion("reason", [
+	object({
+		reason: literal("loaded"),
+		config: record(string(), unknown())
+	}),
+	object({
+		reason: literal("live"),
+		paths: array(string())
+	}),
+	object({
+		reason: literal("failed"),
+		error: object({
+			name: string(),
+			message: string()
+		})
+	})
+]);
+/** Import the config in this process — live objects and all. */
+async function importConfig(configPath) {
+	try {
+		return (await import(configPath)).default;
+	} catch (error) {
+		throw new ConfigLoadFailed(configPath, error.message);
+	}
+}
+/**
+* The config, loaded in `sandbox` and handed back as JSON.
+*
+* A config holding live objects cannot come back that way. An isolating
+* sandbox refuses it with {@link ConfigObjectNotSerializable}; any other
+* imports it here as well, as before, since the host already runs this
+* project's code as its own.
+*/
+async function loadConfigInSandbox(sandbox, configPath, workspaceRoot, timeoutMs = CONFIG_LOAD_TIMEOUT_MS) {
+	const { value } = await runWorker(sandbox, "config load", {
+		name: "config-worker",
+		args: [configPath],
+		cwd: workspaceRoot,
+		timeoutMs,
+		schema: ConfigAnswer
+	});
+	switch (value.reason) {
+		case "loaded": return value.config;
+		case "failed": throw new ConfigLoadFailed(configPath, value.error.message);
+		case "live":
+			if (sandbox.isolating) throw new ConfigObjectNotSerializable(configPath, value.paths);
+			return importConfig(configPath);
+	}
+}
+/**
+* Load raw configuration from file.
+*/
+async function loadRawConfig(cwd, options = {}) {
+	const { configPath, workspaceRoot } = findConfigPath(cwd);
+	const sandbox = options.sandbox ?? activeSandbox();
+	return {
+		config: sandbox ? await loadConfigInSandbox(sandbox, configPath, workspaceRoot, options.timeoutMs) : await importConfig(configPath),
+		workspaceRoot
+	};
+}
+/**
+* Load configuration file (single-app format).
+* For backwards compatibility with existing code.
+*
+* @deprecated Use loadWorkspaceConfig for new code
+*/
+async function loadConfig(cwd = process.cwd()) {
+	const { config } = await loadRawConfig(cwd);
+	if (isWorkspaceConfig(config)) throw new Error("Workspace configuration detected. Use loadWorkspaceConfig() instead.");
+	return config;
+}
+/**
+* Load configuration file and process it as a workspace.
+* Works with both single-app and workspace configurations.
+*
+* Single-app configs are automatically wrapped as a workspace with one app.
+*
+* @example
+* ```ts
+* const { type, workspace } = await loadWorkspaceConfig();
+*
+* if (type === 'workspace') {
+*   console.log('Multi-app workspace:', workspace.apps);
+* } else {
+*   console.log('Single app wrapped as workspace');
+* }
+* ```
+*/
+/**
+* The workspace a directory belongs to, as its config states it — without
+* discovering its constructs.
+*
+* For callers that need a fact the config holds (where a stage's secrets are
+* stored) and nothing the graph adds. `loadWorkspaceConfig` imports every
+* construct module to derive the apps, which is a cost a secrets read should
+* not pay.
+*/
+async function loadWorkspaceSettings(cwd = process.cwd(), options = {}) {
+	const { config, workspaceRoot } = await loadRawConfig(cwd, options);
+	return processConfig(config, workspaceRoot).workspace;
+}
+async function loadWorkspaceConfig(cwd = process.cwd(), options = {}) {
+	const { config, workspaceRoot } = await loadRawConfig(cwd, options);
+	return withDerivedApps(processConfig(config, workspaceRoot), options.sandbox);
+}
+/**
+* The loaded config, with its apps read off the graph.
+*
+* Here rather than at each call site because every command needs the same
+* answer, and the ones that forgot to ask were exactly the bugs: a site that
+* never deployed, a surface that could not be its own process. `gkm dev`,
+* `gkm build`, `gkm docker` and `gkm deploy` now all see the same apps without
+* any of them knowing a derivation happened.
+*
+* Discovery imports the construct modules — declarations only, not endpoints —
+* which is the same import the reconciler and the build already do. A workspace
+* with no `constructs` glob discovers nothing and keeps whatever its config
+* said, so nothing that worked before changes.
+*
+* A construct file that throws is reported and skipped rather than taking the
+* command down: `gkm dev` failing to start because a half-written declaration
+* cannot be imported is a worse failure than starting with the app it does not
+* describe yet.
+*/
+async function withDerivedApps(loaded, sandbox) {
+	const globs = allConstructGlobs(loaded.workspace);
+	if (globs.length === 0) throw new WorkspaceDeclaresNoConstructs(loaded.workspace.root);
+	try {
+		const manifest = await discover({
+			patterns: globs,
+			cwd: loaded.workspace.root,
+			...sandbox ? { sandbox } : {}
+		});
+		return {
+			...loaded,
+			manifest,
+			workspace: {
+				...loaded.workspace,
+				apps: derivedApps(manifest, loaded.workspace)
+			}
+		};
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		output.warn(`⚠️  Could not read constructs, so apps come from config alone: ${message}`);
+		return loaded;
+	}
+}
+/**
+* A workspace with no `constructs` glob.
+*
+* In v10 every address, container and app comes from what the workspace
+* declares — there is no second path that reads a hand-written compose file or
+* an `apps` block's ports. A config that declares nothing has nothing to run.
+*/
+var WorkspaceDeclaresNoConstructs = class extends Error {
+	root;
+	constructor(root) {
+		super(`The workspace at ${root} declares no constructs. Every workspace names where its constructs live — \`constructs: ['./constructs/**/*.ts', './apps/*/endpoints/**/*.ts']\` in gkm.config.ts — and its apps, containers and URLs are derived from them.`);
+		this.root = root;
+		this.name = "WorkspaceDeclaresNoConstructs";
+	}
+};
+/**
+* The app a directory is part of: the one whose `path` contains it.
+*
+* An app's path is the one its construct declares — `new RestApi('Api',
+* { path: 'apps/api' })` — read off the workspace the constructs were derived
+* into, never off the filesystem's package names. The deepest match wins, so
+* an app inside another app's folder is its own; the workspace root belongs to
+* no app unless one lives there.
+*/
+function resolveWorkspaceApp(loadedConfig, cwd) {
+	const here = real(cwd);
+	let found;
+	for (const [key, app] of Object.entries(loadedConfig.workspace.apps)) {
+		const dir = real(join(loadedConfig.workspace.root, app.path));
+		if ((here === dir || here.startsWith(`${dir}${sep}`)) && (!found || dir.length > found.dir.length)) found = {
+			key,
+			app,
+			dir
+		};
+	}
+	return found && {
+		key: found.key,
+		app: found.app
+	};
+}
+/** A path with its symlinks resolved, where it exists — `/tmp` is `/private/tmp`. */
+function real(path) {
+	const absolute = resolve(path);
+	return existsSync(absolute) ? realpathSync(absolute) : absolute;
+}
+/** A directory that no app in the workspace lives in. */
+var NotInAnApp = class extends Error {
+	cwd;
+	apps;
+	constructor(cwd, apps) {
+		super(`${cwd} is not inside any app's path. Apps: ` + Object.entries(apps).map(([key, path]) => `${key} (${path})`).join(", ") + ".");
+		this.cwd = cwd;
+		this.apps = apps;
+		this.name = "NotInAnApp";
+	}
+};
+/** Every app's path, by key — what `NotInAnApp` lists. */
+function appPaths(loadedConfig) {
+	return Object.fromEntries(Object.entries(loadedConfig.workspace.apps).map(([key, app]) => [key, app.path]));
+}
+/**
+* The backend app a directory is part of, with its gkm config — found by the
+* `path` its construct declares.
+*
+* @example
+* ```ts
+* // From apps/api, where a construct declares `path: 'apps/api'`
+* const { app, workspace, workspaceRoot } = await loadAppConfig();
+* ```
+*
+* @throws {NotInAnApp} when no app's path contains the directory.
+* @throws {NotABackendApp} when the app it is in has no gkm config to run.
+*/
+async function loadAppConfig(cwd = process.cwd()) {
+	const { appName, app, workspace, workspaceRoot } = await loadWorkspaceAppInfo(cwd);
+	const gkmConfig = getAppGkmConfig(workspace, appName);
+	if (!gkmConfig) throw new NotABackendApp(appName);
+	return {
+		appName,
+		app,
+		gkmConfig,
+		workspace,
+		workspaceRoot,
+		appRoot: join(workspaceRoot, app.path)
+	};
+}
+/** The app a directory is in has no gkm config — a site, or an entry app. */
+var NotABackendApp = class extends Error {
+	appName;
+	constructor(appName) {
+		super(`App "${appName}" is not a backend app and cannot be run with gkm dev.`);
+		this.appName = appName;
+		this.name = "NotABackendApp";
+	}
+};
+/**
+* The app a directory is part of, frontend or backend — found by the `path`
+* its construct declares. Unlike `loadAppConfig`, the app need not have a
+* gkm config, which is what `gkm exec` and `gkm test` from a site need.
+*
+* @throws {NotInAnApp} when no app's path contains the directory.
+*/
+async function loadWorkspaceAppInfo(cwd = process.cwd()) {
+	const { config, workspaceRoot } = await loadRawConfig(cwd);
+	const loadedConfig = await withDerivedApps(processConfig(config, workspaceRoot));
+	const resolved = resolveWorkspaceApp(loadedConfig, cwd);
+	if (!resolved) throw new NotInAnApp(cwd, appPaths(loadedConfig));
+	return {
+		appName: resolved.key,
+		app: resolved.app,
+		workspace: loadedConfig.workspace,
+		workspaceRoot
+	};
+}
+//#endregion
 export { CONFIG_LOAD_TIMEOUT_MS, ConfigLoadFailed, ConfigNotFound, ConfigObjectNotSerializable, NotABackendApp, NotInAnApp, WorkspaceDeclaresNoConstructs, defineConfig, defineWorkspace, findWorkspaceRoot, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig };
+
+//# sourceMappingURL=config.mjs.map

package/dist/config.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.mjs","names":["z.discriminatedUnion","z.object","z.literal","z.record","z.string","z.unknown","z.array"],"sources":["../src/config.ts"],"sourcesContent":["import { existsSync, realpathSync } from 'node:fs';\nimport { dirname, join, parse, resolve, sep } from 'node:path';\nimport { z } from 'zod';\nimport { output } from './output.js';\nimport { discover } from './reconcile/discover.js';\nimport { activeSandbox, type Sandbox } from './sandbox/sandbox.js';\nimport { runWorker } from './sandbox/worker.js';\nimport type { GkmConfig } from './types.js';\nimport { derivedApps } from './workspace/derive.js';\nimport {\n\tallConstructGlobs,\n\tgetAppGkmConfig,\n\tisWorkspaceConfig,\n\ttype LoadedConfig,\n\ttype NormalizedAppConfig,\n\ttype NormalizedWorkspace,\n\tprocessConfig,\n\ttype WorkspaceConfig,\n} from './workspace/index.js';\n\n// What `gkm dev`'s discovery endpoint answers, for the tools that read it.\nexport type {\n\tAppStatus,\n\tDataApiKind,\n\tDiscoveredApp,\n\tDiscoveredDataApi,\n\tDiscoveredWorkspace,\n\tDiscoveryEvent,\n\tDiscoveryResponse,\n} from './dev/discovery.js';\nexport type { GkmConfig } from './types.js';\nexport type { LoadedConfig, WorkspaceConfig } from './workspace/index.js';\nexport { defineWorkspace } from './workspace/index.js';\nexport type { DevConfig } from './workspace/types.js';\n/**\n * Define GKM configuration with full TypeScript support.\n * This is an identity function that provides type safety and autocomplete.\n *\n * @example\n * ```ts\n * // gkm.config.ts\n * import { defineConfig } from '@geekmidas/cli/config';\n *\n * export default defineConfig({\n *   routes: './src/endpoints/**\\/*.ts',\n *   envParser: './src/config/env',\n *   logger: './src/config/logger',\n *   telescope: true,\n * });\n * ```\n */\nexport function defineConfig(config: GkmConfig): GkmConfig {\n\treturn config;\n}\n\nexport interface ParsedModuleConfig {\n\tpath: string;\n\timportPattern: string;\n}\n\n/**\n * Parse a module config string into path and import pattern.\n *\n * @param configString - Config string in format \"./path/to/module\" or \"./path/to/module#exportName\"\n * @param defaultAlias - The default alias name to use if no export name specified\n * @returns Object with path and import pattern\n *\n * @example\n * parseModuleConfig('./src/config/env', 'envParser')\n * // { path: './src/config/env', importPattern: 'envParser' }\n *\n * parseModuleConfig('./src/config/env#envParser', 'envParser')\n * // { path: './src/config/env', importPattern: '{ envParser }' }\n *\n * parseModuleConfig('./src/config/env#myEnv', 'envParser')\n * // { path: './src/config/env', importPattern: '{ myEnv as envParser }' }\n */\nexport function parseModuleConfig(\n\tconfigString: string,\n\tdefaultAlias: string,\n): ParsedModuleConfig {\n\tconst parts = configString.split('#');\n\tconst path = parts[0] ?? configString;\n\tconst exportName = parts[1];\n\tconst importPattern = !exportName\n\t\t? defaultAlias\n\t\t: exportName === defaultAlias\n\t\t\t? `{ ${defaultAlias} }`\n\t\t\t: `{ ${exportName} as ${defaultAlias} }`;\n\n\treturn { path, importPattern };\n}\n\nexport interface ConfigDiscoveryResult {\n\tconfigPath: string;\n\tworkspaceRoot: string;\n}\n\n/**\n * Find and return the path to the config file.\n *\n * Resolution order:\n * 1. GKM_CONFIG_PATH env var (set by workspace dev command)\n * 2. Walk up directory tree from cwd\n */\nfunction findConfigPath(cwd: string): ConfigDiscoveryResult {\n\tconst files = ['gkm.config.json', 'gkm.config.ts', 'gkm.config.js'];\n\n\t// Check GKM_CONFIG_PATH env var first (set by workspace dev command)\n\tconst envConfigPath = process.env.GKM_CONFIG_PATH;\n\tif (envConfigPath && existsSync(envConfigPath)) {\n\t\treturn {\n\t\t\tconfigPath: envConfigPath,\n\t\t\tworkspaceRoot: dirname(envConfigPath),\n\t\t};\n\t}\n\n\t// Walk up directory tree to find config\n\tlet currentDir = cwd;\n\tconst { root } = parse(currentDir);\n\n\twhile (currentDir !== root) {\n\t\tfor (const file of files) {\n\t\t\tconst configPath = join(currentDir, file);\n\t\t\tif (existsSync(configPath)) {\n\t\t\t\treturn {\n\t\t\t\t\tconfigPath,\n\t\t\t\t\tworkspaceRoot: currentDir,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t\tcurrentDir = dirname(currentDir);\n\t}\n\n\tthrow new ConfigNotFound(cwd);\n}\n\n/**\n * The directory holding the gkm config that `cwd` belongs to — the project a\n * sandbox for it is confined to.\n *\n * @throws {ConfigNotFound} when neither `cwd` nor any parent has one.\n */\nexport function findWorkspaceRoot(cwd: string): string {\n\treturn findConfigPath(cwd).workspaceRoot;\n}\n\n/** No gkm config in a directory or any of its parents. */\nexport class ConfigNotFound extends Error {\n\tconstructor(readonly cwd: string) {\n\t\tsuper(\n\t\t\t'Configuration file not found. Please create gkm.config.json, gkm.config.ts, or gkm.config.js in the project root.',\n\t\t);\n\t\tthis.name = 'ConfigNotFound';\n\t}\n}\n\ninterface RawConfigResult {\n\tconfig: GkmConfig | WorkspaceConfig;\n\tworkspaceRoot: string;\n}\n\nexport interface LoadConfigOptions {\n\t/**\n\t * Load the config — and discover the constructs it names — in this\n\t * sandbox rather than in this process. The config then arrives as data;\n\t * see {@link Sandbox.isolating} for what happens to one holding live\n\t * objects. Defaults to the run's own (`withSandbox`); with neither, the\n\t * config is imported here, as `gkm` always has.\n\t */\n\tsandbox?: Sandbox;\n\t/**\n\t * How long the sandboxed config load may run. Defaults to\n\t * {@link CONFIG_LOAD_TIMEOUT_MS}.\n\t */\n\ttimeoutMs?: number;\n}\n\n/**\n * How long loading a config, or discovering its constructs, may take in a\n * sandbox: room for tsx to compile a large project cold, and not a deploy\n * held open by a config that never finishes importing.\n */\nexport const CONFIG_LOAD_TIMEOUT_MS = 60_000;\n\n/** The config failed to import, or threw while it ran. */\nexport class ConfigLoadFailed extends Error {\n\tconstructor(\n\t\treadonly configPath: string,\n\t\treadonly detail: string,\n\t) {\n\t\tsuper(`Failed to load config: ${detail}`);\n\t\tthis.name = 'ConfigLoadFailed';\n\t}\n}\n\n/**\n * The config holds something that is not data — a custom state store, an\n * inline deploy target, a function — and the sandbox it was loaded in hands\n * the deploy nothing but data.\n */\nexport class ConfigObjectNotSerializable extends Error {\n\tconstructor(\n\t\treadonly configPath: string,\n\t\treadonly paths: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`${configPath} holds values that are not plain data at: ` +\n\t\t\t\t`${paths.join(', ')}. It was loaded in an isolating sandbox, which ` +\n\t\t\t\t'hands the deploy the config as JSON, so a live object — a custom ' +\n\t\t\t\t'store, an inline target, a function — cannot reach it. Configure ' +\n\t\t\t\t'these with plain values instead, or deploy this project with a ' +\n\t\t\t\t'sandbox that is not isolating (the default) if the host trusts it.',\n\t\t);\n\t\tthis.name = 'ConfigObjectNotSerializable';\n\t}\n}\n\n/** What the config worker answers. Checked: the worker ran project code. */\nconst ConfigAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('loaded'),\n\t\tconfig: z.record(z.string(), z.unknown()),\n\t}),\n\tz.object({ reason: z.literal('live'), paths: z.array(z.string()) }),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }),\n\t}),\n]);\n\n/** Import the config in this process — live objects and all. */\nasync function importConfig(\n\tconfigPath: string,\n): Promise<GkmConfig | WorkspaceConfig> {\n\ttry {\n\t\tconst config = await import(configPath);\n\t\treturn config.default;\n\t} catch (error) {\n\t\tthrow new ConfigLoadFailed(configPath, (error as Error).message);\n\t}\n}\n\n/**\n * The config, loaded in `sandbox` and handed back as JSON.\n *\n * A config holding live objects cannot come back that way. An isolating\n * sandbox refuses it with {@link ConfigObjectNotSerializable}; any other\n * imports it here as well, as before, since the host already runs this\n * project's code as its own.\n */\nasync function loadConfigInSandbox(\n\tsandbox: Sandbox,\n\tconfigPath: string,\n\tworkspaceRoot: string,\n\ttimeoutMs = CONFIG_LOAD_TIMEOUT_MS,\n): Promise<GkmConfig | WorkspaceConfig> {\n\tconst { value } = await runWorker(sandbox, 'config load', {\n\t\tname: 'config-worker',\n\t\targs: [configPath],\n\t\tcwd: workspaceRoot,\n\t\ttimeoutMs,\n\t\tschema: ConfigAnswer,\n\t});\n\n\tswitch (value.reason) {\n\t\tcase 'loaded':\n\t\t\t// Its shape is `processConfig`'s to check, against the workspace\n\t\t\t// schema, exactly as for a config imported here.\n\t\t\treturn value.config as unknown as GkmConfig | WorkspaceConfig;\n\t\tcase 'failed':\n\t\t\tthrow new ConfigLoadFailed(configPath, value.error.message);\n\t\tcase 'live':\n\t\t\tif (sandbox.isolating) {\n\t\t\t\tthrow new ConfigObjectNotSerializable(configPath, value.paths);\n\t\t\t}\n\t\t\treturn importConfig(configPath);\n\t}\n}\n\n/**\n * Load raw configuration from file.\n */\nasync function loadRawConfig(\n\tcwd: string,\n\toptions: LoadConfigOptions = {},\n): Promise<RawConfigResult> {\n\tconst { configPath, workspaceRoot } = findConfigPath(cwd);\n\t// The run's own sandbox when none is given: a deploy reloads the config\n\t// deep in the engine (generating Dockerfiles), and that load is the\n\t// project's code as much as the first.\n\tconst sandbox = options.sandbox ?? activeSandbox();\n\tconst config = sandbox\n\t\t? await loadConfigInSandbox(\n\t\t\t\tsandbox,\n\t\t\t\tconfigPath,\n\t\t\t\tworkspaceRoot,\n\t\t\t\toptions.timeoutMs,\n\t\t\t)\n\t\t: await importConfig(configPath);\n\n\treturn { config, workspaceRoot };\n}\n\n/**\n * Load configuration file (single-app format).\n * For backwards compatibility with existing code.\n *\n * @deprecated Use loadWorkspaceConfig for new code\n */\nexport async function loadConfig(\n\tcwd: string = process.cwd(),\n): Promise<GkmConfig> {\n\tconst { config } = await loadRawConfig(cwd);\n\n\t// If it's a workspace config, throw an error\n\tif (isWorkspaceConfig(config)) {\n\t\tthrow new Error(\n\t\t\t'Workspace configuration detected. Use loadWorkspaceConfig() instead.',\n\t\t);\n\t}\n\n\treturn config;\n}\n\n/**\n * Load configuration file and process it as a workspace.\n * Works with both single-app and workspace configurations.\n *\n * Single-app configs are automatically wrapped as a workspace with one app.\n *\n * @example\n * ```ts\n * const { type, workspace } = await loadWorkspaceConfig();\n *\n * if (type === 'workspace') {\n *   console.log('Multi-app workspace:', workspace.apps);\n * } else {\n *   console.log('Single app wrapped as workspace');\n * }\n * ```\n */\n/**\n * The workspace a directory belongs to, as its config states it — without\n * discovering its constructs.\n *\n * For callers that need a fact the config holds (where a stage's secrets are\n * stored) and nothing the graph adds. `loadWorkspaceConfig` imports every\n * construct module to derive the apps, which is a cost a secrets read should\n * not pay.\n */\nexport async function loadWorkspaceSettings(\n\tcwd: string = process.cwd(),\n\toptions: LoadConfigOptions = {},\n): Promise<LoadedConfig['workspace']> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd, options);\n\treturn processConfig(config, workspaceRoot).workspace;\n}\n\nexport async function loadWorkspaceConfig(\n\tcwd: string = process.cwd(),\n\toptions: LoadConfigOptions = {},\n): Promise<LoadedConfig> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd, options);\n\treturn withDerivedApps(processConfig(config, workspaceRoot), options.sandbox);\n}\n\n/**\n * The loaded config, with its apps read off the graph.\n *\n * Here rather than at each call site because every command needs the same\n * answer, and the ones that forgot to ask were exactly the bugs: a site that\n * never deployed, a surface that could not be its own process. `gkm dev`,\n * `gkm build`, `gkm docker` and `gkm deploy` now all see the same apps without\n * any of them knowing a derivation happened.\n *\n * Discovery imports the construct modules — declarations only, not endpoints —\n * which is the same import the reconciler and the build already do. A workspace\n * with no `constructs` glob discovers nothing and keeps whatever its config\n * said, so nothing that worked before changes.\n *\n * A construct file that throws is reported and skipped rather than taking the\n * command down: `gkm dev` failing to start because a half-written declaration\n * cannot be imported is a worse failure than starting with the app it does not\n * describe yet.\n */\nasync function withDerivedApps(\n\tloaded: LoadedConfig,\n\tsandbox?: Sandbox,\n): Promise<LoadedConfig> {\n\tconst globs = allConstructGlobs(loaded.workspace);\n\tif (globs.length === 0) {\n\t\tthrow new WorkspaceDeclaresNoConstructs(loaded.workspace.root);\n\t}\n\n\ttry {\n\t\tconst manifest = await discover({\n\t\t\tpatterns: globs,\n\t\t\tcwd: loaded.workspace.root,\n\t\t\t...(sandbox ? { sandbox } : {}),\n\t\t});\n\n\t\treturn {\n\t\t\t...loaded,\n\t\t\tmanifest,\n\t\t\tworkspace: {\n\t\t\t\t...loaded.workspace,\n\t\t\t\tapps: derivedApps(manifest, loaded.workspace),\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\toutput.warn(\n\t\t\t`⚠️  Could not read constructs, so apps come from config alone: ${message}`,\n\t\t);\n\t\treturn loaded;\n\t}\n}\n\n/**\n * A workspace with no `constructs` glob.\n *\n * In v10 every address, container and app comes from what the workspace\n * declares — there is no second path that reads a hand-written compose file or\n * an `apps` block's ports. A config that declares nothing has nothing to run.\n */\nexport class WorkspaceDeclaresNoConstructs extends Error {\n\tconstructor(readonly root: string) {\n\t\tsuper(\n\t\t\t`The workspace at ${root} declares no constructs. Every workspace names ` +\n\t\t\t\t\"where its constructs live — `constructs: ['./constructs/**/*.ts', \" +\n\t\t\t\t\"'./apps/*/endpoints/**/*.ts']` in gkm.config.ts — and its apps, \" +\n\t\t\t\t'containers and URLs are derived from them.',\n\t\t);\n\t\tthis.name = 'WorkspaceDeclaresNoConstructs';\n\t}\n}\n\nexport interface AppConfigResult {\n\tappName: string;\n\tapp: NormalizedAppConfig;\n\tgkmConfig: GkmConfig;\n\tworkspace: NormalizedWorkspace;\n\tworkspaceRoot: string;\n\tappRoot: string;\n}\n\n/**\n * The app a directory is part of: the one whose `path` contains it.\n *\n * An app's path is the one its construct declares — `new RestApi('Api',\n * { path: 'apps/api' })` — read off the workspace the constructs were derived\n * into, never off the filesystem's package names. The deepest match wins, so\n * an app inside another app's folder is its own; the workspace root belongs to\n * no app unless one lives there.\n */\nfunction resolveWorkspaceApp(\n\tloadedConfig: LoadedConfig,\n\tcwd: string,\n): { key: string; app: NormalizedAppConfig } | undefined {\n\tconst here = real(cwd);\n\tlet found: { key: string; app: NormalizedAppConfig; dir: string } | undefined;\n\n\tfor (const [key, app] of Object.entries(loadedConfig.workspace.apps)) {\n\t\tconst dir = real(join(loadedConfig.workspace.root, app.path));\n\t\tconst inside = here === dir || here.startsWith(`${dir}${sep}`);\n\t\tif (inside && (!found || dir.length > found.dir.length)) {\n\t\t\tfound = { key, app, dir };\n\t\t}\n\t}\n\n\treturn found && { key: found.key, app: found.app };\n}\n\n/** A path with its symlinks resolved, where it exists — `/tmp` is `/private/tmp`. */\nfunction real(path: string): string {\n\tconst absolute = resolve(path);\n\treturn existsSync(absolute) ? realpathSync(absolute) : absolute;\n}\n\n/** A directory that no app in the workspace lives in. */\nexport class NotInAnApp extends Error {\n\tconstructor(\n\t\treadonly cwd: string,\n\t\treadonly apps: Readonly<Record<string, string>>,\n\t) {\n\t\tsuper(\n\t\t\t`${cwd} is not inside any app's path. Apps: ` +\n\t\t\t\tObject.entries(apps)\n\t\t\t\t\t.map(([key, path]) => `${key} (${path})`)\n\t\t\t\t\t.join(', ') +\n\t\t\t\t'.',\n\t\t);\n\t\tthis.name = 'NotInAnApp';\n\t}\n}\n\n/** Every app's path, by key — what `NotInAnApp` lists. */\nfunction appPaths(loadedConfig: LoadedConfig): Record<string, string> {\n\treturn Object.fromEntries(\n\t\tObject.entries(loadedConfig.workspace.apps).map(([key, app]) => [\n\t\t\tkey,\n\t\t\tapp.path,\n\t\t]),\n\t);\n}\n\n/**\n * The backend app a directory is part of, with its gkm config — found by the\n * `path` its construct declares.\n *\n * @example\n * ```ts\n * // From apps/api, where a construct declares `path: 'apps/api'`\n * const { app, workspace, workspaceRoot } = await loadAppConfig();\n * ```\n *\n * @throws {NotInAnApp} when no app's path contains the directory.\n * @throws {NotABackendApp} when the app it is in has no gkm config to run.\n */\nexport async function loadAppConfig(\n\tcwd: string = process.cwd(),\n): Promise<AppConfigResult> {\n\tconst { appName, app, workspace, workspaceRoot } =\n\t\tawait loadWorkspaceAppInfo(cwd);\n\n\tconst gkmConfig = getAppGkmConfig(workspace, appName);\n\tif (!gkmConfig) throw new NotABackendApp(appName);\n\n\treturn {\n\t\tappName,\n\t\tapp,\n\t\tgkmConfig,\n\t\tworkspace,\n\t\tworkspaceRoot,\n\t\tappRoot: join(workspaceRoot, app.path),\n\t};\n}\n\n/** The app a directory is in has no gkm config — a site, or an entry app. */\nexport class NotABackendApp extends Error {\n\tconstructor(readonly appName: string) {\n\t\tsuper(\n\t\t\t`App \"${appName}\" is not a backend app and cannot be run with gkm dev.`,\n\t\t);\n\t\tthis.name = 'NotABackendApp';\n\t}\n}\n\nexport interface WorkspaceAppInfo {\n\t/** The app's key in the workspace. */\n\tappName: string;\n\tapp: NormalizedAppConfig;\n\tworkspace: NormalizedWorkspace;\n\tworkspaceRoot: string;\n}\n\n/**\n * The app a directory is part of, frontend or backend — found by the `path`\n * its construct declares. Unlike `loadAppConfig`, the app need not have a\n * gkm config, which is what `gkm exec` and `gkm test` from a site need.\n *\n * @throws {NotInAnApp} when no app's path contains the directory.\n */\nexport async function loadWorkspaceAppInfo(\n\tcwd: string = process.cwd(),\n): Promise<WorkspaceAppInfo> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd);\n\tconst loadedConfig = await withDerivedApps(\n\t\tprocessConfig(config, workspaceRoot),\n\t);\n\n\tconst resolved = resolveWorkspaceApp(loadedConfig, cwd);\n\tif (!resolved) throw new NotInAnApp(cwd, appPaths(loadedConfig));\n\n\treturn {\n\t\tappName: resolved.key,\n\t\tapp: resolved.app,\n\t\tworkspace: loadedConfig.workspace,\n\t\tworkspaceRoot,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,aAAa,QAA8B;CAC1D,OAAO;AACR;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,kBACf,cACA,cACqB;CACrB,MAAM,QAAQ,aAAa,MAAM,GAAG;CACpC,MAAM,OAAO,MAAM,MAAM;CACzB,MAAM,aAAa,MAAM;CAOzB,OAAO;EAAE;EAAM,eANO,CAAC,aACpB,eACA,eAAe,eACd,KAAK,aAAa,MAClB,KAAK,WAAW,MAAM,aAAa;CAEV;AAC9B;;;;;;;;AAcA,SAAS,eAAe,KAAoC;CAC3D,MAAM,QAAQ;EAAC;EAAmB;EAAiB;CAAe;CAGlE,MAAM,gBAAgB,QAAQ,IAAI;CAClC,IAAI,iBAAiB,WAAW,aAAa,GAC5C,OAAO;EACN,YAAY;EACZ,eAAe,QAAQ,aAAa;CACrC;CAID,IAAI,aAAa;CACjB,MAAM,EAAE,SAAS,MAAM,UAAU;CAEjC,OAAO,eAAe,MAAM;EAC3B,KAAK,MAAM,QAAQ,OAAO;GACzB,MAAM,aAAa,KAAK,YAAY,IAAI;GACxC,IAAI,WAAW,UAAU,GACxB,OAAO;IACN;IACA,eAAe;GAChB;EAEF;EACA,aAAa,QAAQ,UAAU;CAChC;CAEA,MAAM,IAAI,eAAe,GAAG;AAC7B;;;;;;;AAQA,SAAgB,kBAAkB,KAAqB;CACtD,OAAO,eAAe,GAAG,CAAC,CAAC;AAC5B;;AAGA,IAAa,iBAAb,cAAoC,MAAM;CACpB;CAArB,YAAY,KAAsB;EACjC,MACC,mHACD;EAHoB,KAAA,MAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;AA4BA,MAAa,yBAAyB;;AAGtC,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CACA;CAFV,YACC,YACA,QACC;EACD,MAAM,0BAA0B,QAAQ;EAH/B,KAAA,aAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACb;AACD;;;;;;AAOA,IAAa,8BAAb,cAAiD,MAAM;CAE5C;CACA;CAFV,YACC,YACA,OACC;EACD,MACC,GAAG,WAAW,4CACV,MAAM,KAAK,IAAI,EAAE,mTAKtB;EAVS,KAAA,aAAA;EACA,KAAA,QAAA;EAUT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,eAAeA,mBAAqB,UAAU;CACnDC,OAAS;EACR,QAAQC,QAAU,QAAQ;EAC1B,QAAQC,OAASC,OAAS,GAAGC,QAAU,CAAC;CACzC,CAAC;CACDJ,OAAS;EAAE,QAAQC,QAAU,MAAM;EAAG,OAAOI,MAAQF,OAAS,CAAC;CAAE,CAAC;CAClEH,OAAS;EACR,QAAQC,QAAU,QAAQ;EAC1B,OAAOD,OAAS;GAAE,MAAMG,OAAS;GAAG,SAASA,OAAS;EAAE,CAAC;CAC1D,CAAC;AACF,CAAC;;AAGD,eAAe,aACd,YACuC;CACvC,IAAI;EAEH,QAAO,MADc,OAAO,YAAA,CACd;CACf,SAAS,OAAO;EACf,MAAM,IAAI,iBAAiB,YAAa,MAAgB,OAAO;CAChE;AACD;;;;;;;;;AAUA,eAAe,oBACd,SACA,YACA,eACA,YAAY,wBAC2B;CACvC,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,eAAe;EACzD,MAAM;EACN,MAAM,CAAC,UAAU;EACjB,KAAK;EACL;EACA,QAAQ;CACT,CAAC;CAED,QAAQ,MAAM,QAAd;EACC,KAAK,UAGJ,OAAO,MAAM;EACd,KAAK,UACJ,MAAM,IAAI,iBAAiB,YAAY,MAAM,MAAM,OAAO;EAC3D,KAAK;GACJ,IAAI,QAAQ,WACX,MAAM,IAAI,4BAA4B,YAAY,MAAM,KAAK;GAE9D,OAAO,aAAa,UAAU;CAChC;AACD;;;;AAKA,eAAe,cACd,KACA,UAA6B,CAAC,GACH;CAC3B,MAAM,EAAE,YAAY,kBAAkB,eAAe,GAAG;CAIxD,MAAM,UAAU,QAAQ,WAAW,cAAc;CAUjD,OAAO;EAAE,QATM,UACZ,MAAM,oBACN,SACA,YACA,eACA,QAAQ,SACT,IACC,MAAM,aAAa,UAAU;EAEf;CAAc;AAChC;;;;;;;AAQA,eAAsB,WACrB,MAAc,QAAQ,IAAI,GACL;CACrB,MAAM,EAAE,WAAW,MAAM,cAAc,GAAG;CAG1C,IAAI,kBAAkB,MAAM,GAC3B,MAAM,IAAI,MACT,sEACD;CAGD,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,sBACrB,MAAc,QAAQ,IAAI,GAC1B,UAA6B,CAAC,GACO;CACrC,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,KAAK,OAAO;CAClE,OAAO,cAAc,QAAQ,aAAa,CAAC,CAAC;AAC7C;AAEA,eAAsB,oBACrB,MAAc,QAAQ,IAAI,GAC1B,UAA6B,CAAC,GACN;CACxB,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,KAAK,OAAO;CAClE,OAAO,gBAAgB,cAAc,QAAQ,aAAa,GAAG,QAAQ,OAAO;AAC7E;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,gBACd,QACA,SACwB;CACxB,MAAM,QAAQ,kBAAkB,OAAO,SAAS;CAChD,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,8BAA8B,OAAO,UAAU,IAAI;CAG9D,IAAI;EACH,MAAM,WAAW,MAAM,SAAS;GAC/B,UAAU;GACV,KAAK,OAAO,UAAU;GACtB,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC9B,CAAC;EAED,OAAO;GACN,GAAG;GACH;GACA,WAAW;IACV,GAAG,OAAO;IACV,MAAM,YAAY,UAAU,OAAO,SAAS;GAC7C;EACD;CACD,SAAS,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,OAAO,KACN,kEAAkE,SACnE;EACA,OAAO;CACR;AACD;;;;;;;;AASA,IAAa,gCAAb,cAAmD,MAAM;CACnC;CAArB,YAAY,MAAuB;EAClC,MACC,oBAAoB,KAAK,8NAI1B;EANoB,KAAA,OAAA;EAOpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;AAoBA,SAAS,oBACR,cACA,KACwD;CACxD,MAAM,OAAO,KAAK,GAAG;CACrB,IAAI;CAEJ,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,aAAa,UAAU,IAAI,GAAG;EACrE,MAAM,MAAM,KAAK,KAAK,aAAa,UAAU,MAAM,IAAI,IAAI,CAAC;EAE5D,KADe,SAAS,OAAO,KAAK,WAAW,GAAG,MAAM,KAAK,OAC9C,CAAC,SAAS,IAAI,SAAS,MAAM,IAAI,SAC/C,QAAQ;GAAE;GAAK;GAAK;EAAI;CAE1B;CAEA,OAAO,SAAS;EAAE,KAAK,MAAM;EAAK,KAAK,MAAM;CAAI;AAClD;;AAGA,SAAS,KAAK,MAAsB;CACnC,MAAM,WAAW,QAAQ,IAAI;CAC7B,OAAO,WAAW,QAAQ,IAAI,aAAa,QAAQ,IAAI;AACxD;;AAGA,IAAa,aAAb,cAAgC,MAAM;CAE3B;CACA;CAFV,YACC,KACA,MACC;EACD,MACC,GAAG,IAAI,yCACN,OAAO,QAAQ,IAAI,CAAC,CAClB,KAAK,CAAC,KAAK,UAAU,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CACxC,KAAK,IAAI,IACX,GACF;EATS,KAAA,MAAA;EACA,KAAA,OAAA;EAST,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,SAAS,cAAoD;CACrE,OAAO,OAAO,YACb,OAAO,QAAQ,aAAa,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,CAC/D,KACA,IAAI,IACL,CAAC,CACF;AACD;;;;;;;;;;;;;;AAeA,eAAsB,cACrB,MAAc,QAAQ,IAAI,GACC;CAC3B,MAAM,EAAE,SAAS,KAAK,WAAW,kBAChC,MAAM,qBAAqB,GAAG;CAE/B,MAAM,YAAY,gBAAgB,WAAW,OAAO;CACpD,IAAI,CAAC,WAAW,MAAM,IAAI,eAAe,OAAO;CAEhD,OAAO;EACN;EACA;EACA;EACA;EACA;EACA,SAAS,KAAK,eAAe,IAAI,IAAI;CACtC;AACD;;AAGA,IAAa,iBAAb,cAAoC,MAAM;CACpB;CAArB,YAAY,SAA0B;EACrC,MACC,QAAQ,QAAQ,uDACjB;EAHoB,KAAA,UAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;AAiBA,eAAsB,qBACrB,MAAc,QAAQ,IAAI,GACE;CAC5B,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,GAAG;CACzD,MAAM,eAAe,MAAM,gBAC1B,cAAc,QAAQ,aAAa,CACpC;CAEA,MAAM,WAAW,oBAAoB,cAAc,GAAG;CACtD,IAAI,CAAC,UAAU,MAAM,IAAI,WAAW,KAAK,SAAS,YAAY,CAAC;CAE/D,OAAO;EACN,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,WAAW,aAAa;EACxB;CACD;AACD"}

package/dist/credentials-B70vmLcm.cjs

@@ -0,0 +1,125 @@
+const require_local = require("./local-C7wnrcYK.cjs");
+//#region src/deploy/credentials.ts
+/**
+* How a deploy gets the credentials it acts with.
+*
+* `deploy()` never prompts and never reads a terminal: it asks a
+* `CredentialProvider` and, when the provider has nothing, stops with
+* `MissingCredential` naming what it needed and how to supply it. Whether to
+* ask a person, read a vault or fail is the caller's decision — `gkm deploy`
+* prompts at a terminal and stores what was typed; a CI job sets the
+* environment; a host passes its own provider.
+*/
+/**
+* How to supply each kind the CLI knows, for the error that says it is
+* missing. A target's own kinds are its to explain.
+*/
+const HOW_TO_PROVIDE = {
+	dokploy: "Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.",
+	registry: "Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them.",
+	aws: "Set AWS_PROFILE to the stage account's profile, or AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN) — in CI, the keys aws-actions/configure-aws-credentials exports — or pass them through the deploy's CredentialProvider."
+};
+/** A deploy needed a credential, and its provider had none. */
+var MissingCredential = class extends Error {
+	kind;
+	target;
+	howToProvide;
+	constructor(kind, target, howToProvide = HOW_TO_PROVIDE[kind] ?? "Pass it through the deploy's CredentialProvider.") {
+		const what = kind === "dokploy" ? `No Dokploy credentials${target ? ` for ${target}` : ""}.` : kind === "registry" ? `Dokploy has no registry for ${target ?? "the configured registry"}, and there are no credentials to create one with.` : kind === "aws" ? `No AWS credentials${target ? ` for the "${target}" stage` : ""}.` : `No "${String(kind)}" credentials${target ? ` for ${target}` : ""}.`;
+		super(`${what} ${howToProvide}`);
+		this.kind = kind;
+		this.target = target;
+		this.howToProvide = howToProvide;
+		this.name = "MissingCredential";
+	}
+};
+/** Whatever was asked for, from the first provider that has it. */
+function chainCredentials(...providers) {
+	return { async get(request, options) {
+		for (const provider of providers) {
+			const found = await provider.get(request, options);
+			if (found) return found;
+		}
+	} };
+}
+/**
+* Credentials from the environment, then from what `gkm login` stored. What
+* `deploy()` uses when it is handed no provider.
+*
+* - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
+*   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
+*   Each half is read on its own: a token is a secret and belongs in the
+*   environment, an endpoint is configuration and belongs in the config.
+* - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
+* - AWS: `AWS_PROFILE` when it is set, and then nothing else; otherwise
+*   `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`. The
+*   profile winning is `secretsStoreFor`'s rule: a profile is a choice of
+*   account someone made, exported keys may be left over from another.
+*   Read here, by name, and handed only to the command that deploys — the
+*   sandbox every other step runs in passes no `AWS_*` on.
+*/
+function storedCredentials(options = {}) {
+	const env = options.env ?? process.env;
+	return { async get(asked) {
+		const request = asked;
+		switch (request.kind) {
+			case "dokploy": {
+				const stored = (await require_local.readCredentials(options.home ? { home: options.home } : void 0)).dokploy;
+				const token = env.DOKPLOY_API_TOKEN ?? stored?.token;
+				const endpoint = env.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;
+				if (!token || !endpoint) return void 0;
+				return {
+					endpoint: endpoint.replace(/\/$/, ""),
+					token
+				};
+			}
+			case "registry": {
+				const username = env.DOCKER_REGISTRY_USERNAME;
+				const password = env.DOCKER_REGISTRY_PASSWORD;
+				if (!username || !password) return void 0;
+				return {
+					username,
+					password
+				};
+			}
+			case "aws": {
+				const region = env.AWS_REGION ?? env.AWS_DEFAULT_REGION;
+				const where = region ? { region } : {};
+				if (env.AWS_PROFILE) return {
+					profile: env.AWS_PROFILE,
+					...where
+				};
+				const accessKeyId = env.AWS_ACCESS_KEY_ID;
+				const secretAccessKey = env.AWS_SECRET_ACCESS_KEY;
+				if (!accessKeyId || !secretAccessKey) return void 0;
+				return {
+					accessKeyId,
+					secretAccessKey,
+					...env.AWS_SESSION_TOKEN ? { sessionToken: env.AWS_SESSION_TOKEN } : {},
+					...where
+				};
+			}
+		}
+	} };
+}
+//#endregion
+Object.defineProperty(exports, "MissingCredential", {
+	enumerable: true,
+	get: function() {
+		return MissingCredential;
+	}
+});
+Object.defineProperty(exports, "chainCredentials", {
+	enumerable: true,
+	get: function() {
+		return chainCredentials;
+	}
+});
+Object.defineProperty(exports, "storedCredentials", {
+	enumerable: true,
+	get: function() {
+		return storedCredentials;
+	}
+});
+
+//# sourceMappingURL=credentials-B70vmLcm.cjs.map

package/dist/credentials-B70vmLcm.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-B70vmLcm.cjs","names":["readCredentials"],"sources":["../src/deploy/credentials.ts"],"sourcesContent":["/**\n * How a deploy gets the credentials it acts with.\n *\n * `deploy()` never prompts and never reads a terminal: it asks a\n * `CredentialProvider` and, when the provider has nothing, stops with\n * `MissingCredential` naming what it needed and how to supply it. Whether to\n * ask a person, read a vault or fail is the caller's decision — `gkm deploy`\n * prompts at a terminal and stores what was typed; a CI job sets the\n * environment; a host passes its own provider.\n */\n\nimport { readCredentials } from '../auth/credentials';\n\n/**\n * What each kind of credential is asked for with, and what it is.\n *\n * A target that needs a kind the CLI does not know declares it by augmenting\n * this interface, and lists it in its `credentials`:\n *\n * ```ts\n * declare module '@geekmidas/cli/target' {\n *   interface CredentialKinds {\n *     fly: { request: { org: string }; value: { token: string } };\n *   }\n * }\n * ```\n */\nexport interface CredentialKinds {\n\t/** The Dokploy API a stage deploys through. */\n\tdokploy: {\n\t\t/** `deploy.dokploy.endpoint`, when the config names one. */\n\t\trequest: { endpoint?: string };\n\t\tvalue: { endpoint: string; token: string };\n\t};\n\t/**\n\t * A container registry login, for Dokploy to pull with. Asked for only when\n\t * Dokploy has no registry for `deploy.dokploy.registry` and one has to be\n\t * created.\n\t */\n\tregistry: {\n\t\t/** `deploy.dokploy.registry`. */\n\t\trequest: { url: string };\n\t\tvalue: { username: string; password: string };\n\t};\n\t/**\n\t * The AWS account a stage deploys to, for the SST target's `sst deploy`.\n\t * Handed to that one command's environment and to nothing else.\n\t */\n\taws: {\n\t\t/** The stage, for a provider that keeps one account per stage. */\n\t\trequest: { stage: string };\n\t\tvalue: AwsCredential;\n\t};\n}\n\n/**\n * Who to act as on AWS: a named profile, or keys.\n *\n * Never both. Given both, every AWS SDK takes the keys and ignores the\n * profile, so `--profile prod` with staging's keys still exported would deploy\n * production's stack into staging's account — the reason `secretsStoreFor`\n * resolves a named profile on its own, and why this cannot express the mix.\n */\nexport type AwsCredential =\n\t| {\n\t\t\t/** A profile in `~/.aws/config` — keys, SSO, an assumed role. */\n\t\t\tprofile: string;\n\t\t\tregion?: string;\n\t  }\n\t| {\n\t\t\taccessKeyId: string;\n\t\t\tsecretAccessKey: string;\n\t\t\t/** Present for temporary keys: an assumed role, GitHub's OIDC. */\n\t\t\tsessionToken?: string;\n\t\t\tregion?: string;\n\t  };\n\nexport type CredentialKind = keyof CredentialKinds;\n\n/** What a deploy asks a provider for. */\nexport type CredentialRequest<K extends CredentialKind = CredentialKind> = {\n\t[P in K]: { kind: P } & CredentialKinds[P]['request'];\n}[K];\n\n/** What a provider answers with. */\nexport type Credential<K extends CredentialKind> = CredentialKinds[K]['value'];\n\nexport interface CredentialProvider {\n\t/**\n\t * The credential `request` asks for, or `undefined` when this provider has\n\t * none — the deploy then raises {@link MissingCredential}.\n\t */\n\tget<K extends CredentialKind>(\n\t\trequest: CredentialRequest<K>,\n\t\toptions?: { signal?: AbortSignal },\n\t): Promise<Credential<K> | undefined>;\n}\n\n/**\n * How to supply each kind the CLI knows, for the error that says it is\n * missing. A target's own kinds are its to explain.\n */\nconst HOW_TO_PROVIDE: Partial<Record<CredentialKind, string>> = {\n\tdokploy:\n\t\t\"Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.\",\n\tregistry:\n\t\t'Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them.',\n\taws: \"Set AWS_PROFILE to the stage account's profile, or AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN) — in CI, the keys aws-actions/configure-aws-credentials exports — or pass them through the deploy's CredentialProvider.\",\n};\n\n/** A deploy needed a credential, and its provider had none. */\nexport class MissingCredential extends Error {\n\tconstructor(\n\t\treadonly kind: CredentialKind,\n\t\t/** What it was for: the Dokploy endpoint or the registry URL. */\n\t\treadonly target: string | undefined,\n\t\t/** How to supply it. */\n\t\treadonly howToProvide: string = HOW_TO_PROVIDE[kind] ??\n\t\t\t\"Pass it through the deploy's CredentialProvider.\",\n\t) {\n\t\tconst what =\n\t\t\tkind === 'dokploy'\n\t\t\t\t? `No Dokploy credentials${target ? ` for ${target}` : ''}.`\n\t\t\t\t: kind === 'registry'\n\t\t\t\t\t? `Dokploy has no registry for ${target ?? 'the configured registry'}, and there are no credentials to create one with.`\n\t\t\t\t\t: kind === 'aws'\n\t\t\t\t\t\t? `No AWS credentials${target ? ` for the \"${target}\" stage` : ''}.`\n\t\t\t\t\t\t: `No \"${String(kind)}\" credentials${target ? ` for ${target}` : ''}.`;\n\t\tsuper(`${what} ${howToProvide}`);\n\t\tthis.name = 'MissingCredential';\n\t}\n}\n\n/** Whatever was asked for, from the first provider that has it. */\nexport function chainCredentials(\n\t...providers: CredentialProvider[]\n): CredentialProvider {\n\treturn {\n\t\tasync get(request, options) {\n\t\t\tfor (const provider of providers) {\n\t\t\t\tconst found = await provider.get(request, options);\n\t\t\t\tif (found) return found;\n\t\t\t}\n\t\t\treturn undefined;\n\t\t},\n\t};\n}\n\nexport interface StoredCredentialsOptions {\n\t/** Where to read the variables from. Defaults to `process.env`. */\n\tenv?: NodeJS.ProcessEnv;\n\t/**\n\t * The CLI's home, whose `credentials.json` holds stored logins. Defaults\n\t * to `GKM_HOME`, else `~/.gkm`.\n\t */\n\thome?: string;\n}\n\n/**\n * Credentials from the environment, then from what `gkm login` stored. What\n * `deploy()` uses when it is handed no provider.\n *\n * - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to\n *   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.\n *   Each half is read on its own: a token is a secret and belongs in the\n *   environment, an endpoint is configuration and belongs in the config.\n * - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.\n * - AWS: `AWS_PROFILE` when it is set, and then nothing else; otherwise\n *   `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`. The\n *   profile winning is `secretsStoreFor`'s rule: a profile is a choice of\n *   account someone made, exported keys may be left over from another.\n *   Read here, by name, and handed only to the command that deploys — the\n *   sandbox every other step runs in passes no `AWS_*` on.\n */\nexport function storedCredentials(\n\toptions: StoredCredentialsOptions = {},\n): CredentialProvider {\n\tconst env = options.env ?? process.env;\n\n\treturn {\n\t\tasync get(asked) {\n\t\t\t// The union, so a switch on `kind` narrows it: `K` itself never is.\n\t\t\tconst request = asked as CredentialRequest;\n\t\t\tswitch (request.kind) {\n\t\t\t\tcase 'dokploy': {\n\t\t\t\t\tconst stored = (\n\t\t\t\t\t\tawait readCredentials(\n\t\t\t\t\t\t\toptions.home ? { home: options.home } : undefined,\n\t\t\t\t\t\t)\n\t\t\t\t\t).dokploy;\n\t\t\t\t\tconst token = env.DOKPLOY_API_TOKEN ?? stored?.token;\n\t\t\t\t\tconst endpoint =\n\t\t\t\t\t\tenv.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;\n\t\t\t\t\tif (!token || !endpoint) return undefined;\n\t\t\t\t\treturn { endpoint: endpoint.replace(/\\/$/, ''), token } as never;\n\t\t\t\t}\n\t\t\t\tcase 'registry': {\n\t\t\t\t\tconst username = env.DOCKER_REGISTRY_USERNAME;\n\t\t\t\t\tconst password = env.DOCKER_REGISTRY_PASSWORD;\n\t\t\t\t\tif (!username || !password) return undefined;\n\t\t\t\t\treturn { username, password } as never;\n\t\t\t\t}\n\t\t\t\tcase 'aws': {\n\t\t\t\t\tconst region = env.AWS_REGION ?? env.AWS_DEFAULT_REGION;\n\t\t\t\t\tconst where = region ? { region } : {};\n\t\t\t\t\tif (env.AWS_PROFILE) {\n\t\t\t\t\t\treturn { profile: env.AWS_PROFILE, ...where } as never;\n\t\t\t\t\t}\n\t\t\t\t\tconst accessKeyId = env.AWS_ACCESS_KEY_ID;\n\t\t\t\t\tconst secretAccessKey = env.AWS_SECRET_ACCESS_KEY;\n\t\t\t\t\tif (!accessKeyId || !secretAccessKey) return undefined;\n\t\t\t\t\treturn {\n\t\t\t\t\t\taccessKeyId,\n\t\t\t\t\t\tsecretAccessKey,\n\t\t\t\t\t\t...(env.AWS_SESSION_TOKEN\n\t\t\t\t\t\t\t? { sessionToken: env.AWS_SESSION_TOKEN }\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t...where,\n\t\t\t\t\t} as never;\n\t\t\t\t}\n\t\t\t}\n\t\t\t// A kind a target declared: nothing stored here can answer it.\n\t\t\treturn undefined;\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAsGA,MAAM,iBAA0D;CAC/D,SACC;CACD,UACC;CACD,KAAK;AACN;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CAEA;CAEA;CALV,YACC,MAEA,QAEA,eAAgC,eAAe,SAC9C,oDACA;EACD,MAAM,OACL,SAAS,YACN,yBAAyB,SAAS,QAAQ,WAAW,GAAG,KACxD,SAAS,aACR,+BAA+B,UAAU,0BAA0B,sDACnE,SAAS,QACR,qBAAqB,SAAS,aAAa,OAAO,WAAW,GAAG,KAChE,OAAO,OAAO,IAAI,EAAE,eAAe,SAAS,QAAQ,WAAW,GAAG;EACxE,MAAM,GAAG,KAAK,GAAG,cAAc;EAftB,KAAA,OAAA;EAEA,KAAA,SAAA;EAEA,KAAA,eAAA;EAYT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,iBACf,GAAG,WACkB;CACrB,OAAO,EACN,MAAM,IAAI,SAAS,SAAS;EAC3B,KAAK,MAAM,YAAY,WAAW;GACjC,MAAM,QAAQ,MAAM,SAAS,IAAI,SAAS,OAAO;GACjD,IAAI,OAAO,OAAO;EACnB;CAED,EACD;AACD;;;;;;;;;;;;;;;;;AA4BA,SAAgB,kBACf,UAAoC,CAAC,GAChB;CACrB,MAAM,MAAM,QAAQ,OAAO,QAAQ;CAEnC,OAAO,EACN,MAAM,IAAI,OAAO;EAEhB,MAAM,UAAU;EAChB,QAAQ,QAAQ,MAAhB;GACC,KAAK,WAAW;IACf,MAAM,UACL,MAAMA,cAAAA,gBACL,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,KAAA,CACzC,EAAA,CACC;IACF,MAAM,QAAQ,IAAI,qBAAqB,QAAQ;IAC/C,MAAM,WACL,IAAI,oBAAoB,QAAQ,YAAY,QAAQ;IACrD,IAAI,CAAC,SAAS,CAAC,UAAU,OAAO,KAAA;IAChC,OAAO;KAAE,UAAU,SAAS,QAAQ,OAAO,EAAE;KAAG;IAAM;GACvD;GACA,KAAK,YAAY;IAChB,MAAM,WAAW,IAAI;IACrB,MAAM,WAAW,IAAI;IACrB,IAAI,CAAC,YAAY,CAAC,UAAU,OAAO,KAAA;IACnC,OAAO;KAAE;KAAU;IAAS;GAC7B;GACA,KAAK,OAAO;IACX,MAAM,SAAS,IAAI,cAAc,IAAI;IACrC,MAAM,QAAQ,SAAS,EAAE,OAAO,IAAI,CAAC;IACrC,IAAI,IAAI,aACP,OAAO;KAAE,SAAS,IAAI;KAAa,GAAG;IAAM;IAE7C,MAAM,cAAc,IAAI;IACxB,MAAM,kBAAkB,IAAI;IAC5B,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;IAC7C,OAAO;KACN;KACA;KACA,GAAI,IAAI,oBACL,EAAE,cAAc,IAAI,kBAAkB,IACtC,CAAC;KACJ,GAAG;IACJ;GACD;EACD;CAGD,EACD;AACD"}