@geekmidas/cli 10.0.0-alpha.63 → 10.0.0-alpha.65

package/dist/derive-B4vDpzgP.mjs

@@ -0,0 +1,150 @@
+import { kebabCase } from "@geekmidas/manifest";
+//#region src/workspace/derive.ts
+/**
+* The apps a manifest implies.
+*
+* `gkm.config.ts` used to carry an `apps` block naming every app: its type, its
+* path, its port, its framework, which other apps it depended on. Every one of
+* those facts was already declared. A `StaticSite('Web', { path: 'apps/web' })`
+* and an `apps.web = { type: 'web', path: 'apps/web', framework: 'vite',
+* dependencies: ['api'] }` are the same statement written twice, and only one of
+* them was checked against anything — so the copy in config was free to drift,
+* and a surface config had no entry for simply never deployed.
+*
+* So the list comes from the graph. A `site` is an app, and so is every
+* `rest-api` — one surface, one container, at the `path` it declared.
+*
+* What config still supplies is what no graph can answer: the backends a cache
+* and a mailer resolve to, the deploy endpoint, the stage's domain.
+*/
+/** Which frontend framework builds each site variant. */
+const FRAMEWORKS = {
+	static: "vite",
+	next: "nextjs",
+	tanstack: "tanstack-start"
+};
+/**
+* The app key a construct id becomes.
+*
+* The same kebab form every physical name is built from, so `Api` is `api` in
+* the config, `production-kitchen-sink-api` on Dokploy, and `API_URL` in an
+* environment — one id, three renderings, no second list.
+*/
+function appKey(id) {
+	return kebabCase(id);
+}
+/**
+* The app serving a surface: its own, always.
+*
+* Every surface gets a container. There is no arrangement in which one runs
+* inside another — two surfaces in a process share a filesystem, an
+* environment, and every credential either was granted, so an auth server
+* beside an API is one bug in the API away from being read by it.
+*/
+function hostOf(manifest, id) {
+	const declaration = manifest[id];
+	if (!declaration || declaration.kind !== "rest-api") return void 0;
+	return id;
+}
+/**
+* Local ports, assigned so that adding a site does not renumber the others.
+*
+* Backends first, then the site holding the base domain, then the rest
+* alphabetically. The ordering is arbitrary but it is *fixed*, which is the
+* property that matters: a port that moves when an unrelated app is added is a
+* port nobody can put in a bookmark. A construct that names its own port keeps
+* it, and is skipped here.
+*/
+function assignPorts(apps) {
+	const rank = (name, app) => [
+		app.type === "backend" ? 0 : app.type === "web" ? 1 : 2,
+		app.root ? 0 : 1,
+		name
+	];
+	const ordered = Object.entries(apps).sort(([aName, a], [bName, b]) => {
+		const [at, ar, an] = rank(aName, a);
+		const [bt, br, bn] = rank(bName, b);
+		return at - bt || ar - br || an.localeCompare(bn);
+	});
+	const taken = new Set(ordered.map(([, app]) => app.port).filter((p) => !!p));
+	let next = 3e3;
+	for (const [, app] of ordered) {
+		if (app.port) continue;
+		while (taken.has(next)) next += 1;
+		app.port = next;
+		taken.add(next);
+	}
+}
+/**
+* Whichever site holds the base domain.
+*
+* The convention first — a site named `web` — because it is one people already
+* rely on. Then an explicit `root: true`. A project with one site needs neither.
+*/
+function markRoot(apps) {
+	const sites = Object.entries(apps).filter(([, a]) => a.type === "web");
+	if (sites.length === 0) return;
+	if (sites.some(([, a]) => a.root)) return;
+	const chosen = sites.find(([name]) => name === "web") ?? (sites.length === 1 ? sites[0] : void 0);
+	if (chosen) chosen[1].root = true;
+}
+function derivedApps(manifest, workspace) {
+	const apps = {};
+	const defaultTarget = workspace.deploy?.default ?? "dokploy";
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "site" && declaration.kind !== "mobile-app" && declaration.kind !== "rest-api") continue;
+		const spec = declaration.kind === "site" || declaration.kind === "mobile-app" ? declaration.app : {
+			path: declaration.path,
+			...declaration.telescope ? { telescope: true } : {}
+		};
+		const name = appKey(id);
+		const configured = workspace.apps[name];
+		apps[name] = {
+			...configured,
+			type: declaration.kind === "site" ? "web" : declaration.kind === "mobile-app" ? "mobile" : "backend",
+			path: spec.path,
+			port: spec.port ?? configured?.port ?? 0,
+			...(declaration.kind === "rest-api" || declaration.kind === "site") && declaration.subdomain ? { subdomain: declaration.subdomain } : {},
+			dependencies: [],
+			resolvedDeployTarget: configured?.resolvedDeployTarget ?? defaultTarget,
+			...declaration.kind === "site" ? {
+				framework: configured?.framework ?? FRAMEWORKS[declaration.variant],
+				...declaration.root ? { root: true } : {},
+				...spec.config ? { config: spec.config } : {}
+			} : {},
+			...declaration.kind === "mobile-app" ? {
+				framework: configured?.framework ?? declaration.variant,
+				...spec.config ? { config: spec.config } : {}
+			} : {},
+			...spec.telescope !== void 0 ? { telescope: spec.telescope } : {},
+			...spec.openapi !== void 0 ? { openapi: spec.openapi } : {},
+			...spec.runtime !== void 0 ? { runtime: spec.runtime } : {},
+			...spec.env !== void 0 ? { env: spec.env } : {},
+			...spec.entry !== void 0 ? { entry: spec.entry } : {},
+			...configured?.domain ? { domain: configured.domain } : {}
+		};
+	}
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "site" && declaration.kind !== "mobile-app" && declaration.kind !== "rest-api") continue;
+		const app = apps[appKey(id)];
+		if (!app) continue;
+		const edges = declaration.kind === "rest-api" ? declaration.calls ?? [] : declaration.dependencies ?? [];
+		const names = /* @__PURE__ */ new Set();
+		for (const edge of edges) {
+			if (edge.kind !== "rest-api") continue;
+			const host = hostOf(manifest, edge.target);
+			if (!host) continue;
+			const key = appKey(host);
+			if (key !== appKey(id) && apps[key]) names.add(key);
+		}
+		app.dependencies = [...names].sort();
+	}
+	markRoot(apps);
+	assignPorts(apps);
+	for (const [name, app] of Object.entries(workspace.apps)) if (!apps[name]) apps[name] = app;
+	return apps;
+}
+//#endregion
+export { derivedApps as n, appKey as t };
+
+//# sourceMappingURL=derive-B4vDpzgP.mjs.map

package/dist/derive-B4vDpzgP.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-B4vDpzgP.mjs","names":[],"sources":["../src/workspace/derive.ts"],"sourcesContent":["/**\n * The apps a manifest implies.\n *\n * `gkm.config.ts` used to carry an `apps` block naming every app: its type, its\n * path, its port, its framework, which other apps it depended on. Every one of\n * those facts was already declared. A `StaticSite('Web', { path: 'apps/web' })`\n * and an `apps.web = { type: 'web', path: 'apps/web', framework: 'vite',\n * dependencies: ['api'] }` are the same statement written twice, and only one of\n * them was checked against anything — so the copy in config was free to drift,\n * and a surface config had no entry for simply never deployed.\n *\n * So the list comes from the graph. A `site` is an app, and so is every\n * `rest-api` — one surface, one container, at the `path` it declared.\n *\n * What config still supplies is what no graph can answer: the backends a cache\n * and a mailer resolve to, the deploy endpoint, the stage's domain.\n */\n\nimport {\n\ttype AppSpec,\n\ttype ConstructManifest,\n\tkebabCase,\n} from '@geekmidas/manifest';\nimport type {\n\tAppDomainConfig,\n\tDeployTargetName,\n\tFramework,\n\tNormalizedAppConfig,\n\tNormalizedWorkspace,\n} from './types.js';\n\n/** Which frontend framework builds each site variant. */\nconst FRAMEWORKS: Record<string, Framework> = {\n\tstatic: 'vite',\n\tnext: 'nextjs',\n\ttanstack: 'tanstack-start',\n};\n\n/**\n * The app key a construct id becomes.\n *\n * The same kebab form every physical name is built from, so `Api` is `api` in\n * the config, `production-kitchen-sink-api` on Dokploy, and `API_URL` in an\n * environment — one id, three renderings, no second list.\n */\nexport function appKey(id: string): string {\n\treturn kebabCase(id);\n}\n\n/**\n * The app serving a surface: its own, always.\n *\n * Every surface gets a container. There is no arrangement in which one runs\n * inside another — two surfaces in a process share a filesystem, an\n * environment, and every credential either was granted, so an auth server\n * beside an API is one bug in the API away from being read by it.\n */\nexport function hostOf(\n\tmanifest: ConstructManifest,\n\tid: string,\n): string | undefined {\n\tconst declaration = manifest[id];\n\tif (!declaration || declaration.kind !== 'rest-api') return undefined;\n\n\treturn id;\n}\n\n/**\n * Local ports, assigned so that adding a site does not renumber the others.\n *\n * Backends first, then the site holding the base domain, then the rest\n * alphabetically. The ordering is arbitrary but it is *fixed*, which is the\n * property that matters: a port that moves when an unrelated app is added is a\n * port nobody can put in a bookmark. A construct that names its own port keeps\n * it, and is skipped here.\n */\nfunction assignPorts(apps: Record<string, NormalizedAppConfig>): void {\n\tconst rank = (\n\t\tname: string,\n\t\tapp: NormalizedAppConfig,\n\t): [number, number, string] => [\n\t\tapp.type === 'backend' ? 0 : app.type === 'web' ? 1 : 2,\n\t\tapp.root ? 0 : 1,\n\t\tname,\n\t];\n\n\tconst ordered = Object.entries(apps).sort(([aName, a], [bName, b]) => {\n\t\tconst [at, ar, an] = rank(aName, a);\n\t\tconst [bt, br, bn] = rank(bName, b);\n\t\treturn at - bt || ar - br || an.localeCompare(bn);\n\t});\n\n\tconst taken = new Set(\n\t\tordered.map(([, app]) => app.port).filter((p): p is number => !!p),\n\t);\n\n\tlet next = 3000;\n\tfor (const [, app] of ordered) {\n\t\tif (app.port) continue;\n\t\twhile (taken.has(next)) next += 1;\n\t\tapp.port = next;\n\t\ttaken.add(next);\n\t}\n}\n\n/**\n * Whichever site holds the base domain.\n *\n * The convention first — a site named `web` — because it is one people already\n * rely on. Then an explicit `root: true`. A project with one site needs neither.\n */\nfunction markRoot(apps: Record<string, NormalizedAppConfig>): void {\n\tconst sites = Object.entries(apps).filter(([, a]) => a.type === 'web');\n\tif (sites.length === 0) return;\n\tif (sites.some(([, a]) => a.root)) return;\n\n\tconst chosen =\n\t\tsites.find(([name]) => name === 'web') ??\n\t\t(sites.length === 1 ? sites[0] : undefined);\n\tif (chosen) chosen[1].root = true;\n}\n\nexport function derivedApps(\n\tmanifest: ConstructManifest,\n\tworkspace: NormalizedWorkspace,\n): Record<string, NormalizedAppConfig> {\n\tconst apps: Record<string, NormalizedAppConfig> = {};\n\tconst defaultTarget: DeployTargetName =\n\t\tworkspace.deploy?.default ?? 'dokploy';\n\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\t// Three kinds are apps: a site, a mobile app and an HTTP surface. A worker\n\t\t// is not one — it names the process that runs a cron or a subscriber, and\n\t\t// that process is the app's server, which already exists. Everything else\n\t\t// is a resource one of them uses.\n\t\tif (\n\t\t\tdeclaration.kind !== 'site' &&\n\t\t\tdeclaration.kind !== 'mobile-app' &&\n\t\t\tdeclaration.kind !== 'rest-api'\n\t\t)\n\t\t\tcontinue;\n\n\t\t// No opt-in to be had. Each says where it lives.\n\t\tconst spec: AppSpec =\n\t\t\tdeclaration.kind === 'site' || declaration.kind === 'mobile-app'\n\t\t\t\t? declaration.app\n\t\t\t\t: {\n\t\t\t\t\t\tpath: declaration.path,\n\t\t\t\t\t\t...(declaration.telescope ? { telescope: true } : {}),\n\t\t\t\t\t};\n\n\t\tconst name = appKey(id);\n\t\t// A config entry of the same name still wins, so a workspace can override\n\t\t// one field without restating the app. Nothing in this repo needs to.\n\t\tconst configured = workspace.apps[name];\n\n\t\tapps[name] = {\n\t\t\t...configured,\n\t\t\ttype:\n\t\t\t\tdeclaration.kind === 'site'\n\t\t\t\t\t? 'web'\n\t\t\t\t\t: declaration.kind === 'mobile-app'\n\t\t\t\t\t\t? 'mobile'\n\t\t\t\t\t\t: 'backend',\n\t\t\tpath: spec.path,\n\t\t\tport: spec.port ?? configured?.port ?? 0,\n\t\t\t// The label it answers on, under a stage's domain and locally alike.\n\t\t\t...((declaration.kind === 'rest-api' || declaration.kind === 'site') &&\n\t\t\tdeclaration.subdomain\n\t\t\t\t? { subdomain: declaration.subdomain }\n\t\t\t\t: {}),\n\t\t\tdependencies: [],\n\t\t\tresolvedDeployTarget: configured?.resolvedDeployTarget ?? defaultTarget,\n\t\t\t...(declaration.kind === 'site'\n\t\t\t\t? {\n\t\t\t\t\t\tframework: configured?.framework ?? FRAMEWORKS[declaration.variant],\n\t\t\t\t\t\t...(declaration.root ? { root: true } : {}),\n\t\t\t\t\t\t...(spec.config ? { config: spec.config } : {}),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t...(declaration.kind === 'mobile-app'\n\t\t\t\t? {\n\t\t\t\t\t\tframework: configured?.framework ?? declaration.variant,\n\t\t\t\t\t\t...(spec.config ? { config: spec.config } : {}),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t// One glob fans out to the six the build reads, because each generator\n\t\t\t// already inspects every export and keeps what it recognises. A\n\t\t\t// per-kind field still wins where one was given.\n\t\t\t...(spec.telescope !== undefined ? { telescope: spec.telescope } : {}),\n\t\t\t...(spec.openapi !== undefined ? { openapi: spec.openapi } : {}),\n\t\t\t...(spec.runtime !== undefined ? { runtime: spec.runtime } : {}),\n\t\t\t...(spec.env !== undefined ? { env: spec.env } : {}),\n\t\t\t...(spec.entry !== undefined ? { entry: spec.entry } : {}),\n\t\t\t...(configured?.domain\n\t\t\t\t? { domain: configured.domain as AppDomainConfig }\n\t\t\t\t: {}),\n\t\t} as NormalizedAppConfig;\n\t}\n\n\t// Build order, from the edges rather than from a hand-kept list. A site that\n\t// depends on a surface depends on the app that serves it — which for a\n\t// mounted auth server is its host, not a container that does not exist.\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\tif (\n\t\t\tdeclaration.kind !== 'site' &&\n\t\t\tdeclaration.kind !== 'mobile-app' &&\n\t\t\tdeclaration.kind !== 'rest-api'\n\t\t)\n\t\t\tcontinue;\n\n\t\tconst app = apps[appKey(id)];\n\t\tif (!app) continue;\n\n\t\t// A site names its edges `dependencies`; a surface names them `calls`.\n\t\tconst edges =\n\t\t\tdeclaration.kind === 'rest-api'\n\t\t\t\t? (declaration.calls ?? [])\n\t\t\t\t: (declaration.dependencies ?? []);\n\n\t\tconst names = new Set<string>();\n\t\tfor (const edge of edges) {\n\t\t\tif (edge.kind !== 'rest-api') continue;\n\t\t\tconst host = hostOf(manifest, edge.target);\n\t\t\tif (!host) continue;\n\t\t\tconst key = appKey(host);\n\t\t\tif (key !== appKey(id) && apps[key]) names.add(key);\n\t\t}\n\n\t\tapp.dependencies = [...names].sort();\n\t}\n\n\tmarkRoot(apps);\n\tassignPorts(apps);\n\n\t// Apps config declared that the graph knows nothing about — a `type: 'mobile'`\n\t// entry, or a hand-run process. Kept rather than dropped: config is still the\n\t// escape hatch for what nothing declares.\n\tfor (const [name, app] of Object.entries(workspace.apps)) {\n\t\tif (!apps[name]) apps[name] = app;\n\t}\n\n\treturn apps;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgCA,MAAM,aAAwC;CAC7C,QAAQ;CACR,MAAM;CACN,UAAU;AACX;;;;;;;;AASA,SAAgB,OAAO,IAAoB;CAC1C,OAAO,UAAU,EAAE;AACpB;;;;;;;;;AAUA,SAAgB,OACf,UACA,IACqB;CACrB,MAAM,cAAc,SAAS;CAC7B,IAAI,CAAC,eAAe,YAAY,SAAS,YAAY,OAAO,KAAA;CAE5D,OAAO;AACR;;;;;;;;;;AAWA,SAAS,YAAY,MAAiD;CACrE,MAAM,QACL,MACA,QAC8B;EAC9B,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,QAAQ,IAAI;EACtD,IAAI,OAAO,IAAI;EACf;CACD;CAEA,MAAM,UAAU,OAAO,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,OAAO;EACrE,MAAM,CAAC,IAAI,IAAI,MAAM,KAAK,OAAO,CAAC;EAClC,MAAM,CAAC,IAAI,IAAI,MAAM,KAAK,OAAO,CAAC;EAClC,OAAO,KAAK,MAAM,KAAK,MAAM,GAAG,cAAc,EAAE;CACjD,CAAC;CAED,MAAM,QAAQ,IAAI,IACjB,QAAQ,KAAK,GAAG,SAAS,IAAI,IAAI,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,CAAC,CAClE;CAEA,IAAI,OAAO;CACX,KAAK,MAAM,GAAG,QAAQ,SAAS;EAC9B,IAAI,IAAI,MAAM;EACd,OAAO,MAAM,IAAI,IAAI,GAAG,QAAQ;EAChC,IAAI,OAAO;EACX,MAAM,IAAI,IAAI;CACf;AACD;;;;;;;AAQA,SAAS,SAAS,MAAiD;CAClE,MAAM,QAAQ,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAQ,GAAG,OAAO,EAAE,SAAS,KAAK;CACrE,IAAI,MAAM,WAAW,GAAG;CACxB,IAAI,MAAM,MAAM,GAAG,OAAO,EAAE,IAAI,GAAG;CAEnC,MAAM,SACL,MAAM,MAAM,CAAC,UAAU,SAAS,KAAK,MACpC,MAAM,WAAW,IAAI,MAAM,KAAK,KAAA;CAClC,IAAI,QAAQ,OAAO,EAAE,CAAC,OAAO;AAC9B;AAEA,SAAgB,YACf,UACA,WACsC;CACtC,MAAM,OAA4C,CAAC;CACnD,MAAM,gBACL,UAAU,QAAQ,WAAW;CAE9B,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EAKzD,IACC,YAAY,SAAS,UACrB,YAAY,SAAS,gBACrB,YAAY,SAAS,YAErB;EAGD,MAAM,OACL,YAAY,SAAS,UAAU,YAAY,SAAS,eACjD,YAAY,MACZ;GACA,MAAM,YAAY;GAClB,GAAI,YAAY,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;EACpD;EAEH,MAAM,OAAO,OAAO,EAAE;EAGtB,MAAM,aAAa,UAAU,KAAK;EAElC,KAAK,QAAQ;GACZ,GAAG;GACH,MACC,YAAY,SAAS,SAClB,QACA,YAAY,SAAS,eACpB,WACA;GACL,MAAM,KAAK;GACX,MAAM,KAAK,QAAQ,YAAY,QAAQ;GAEvC,IAAK,YAAY,SAAS,cAAc,YAAY,SAAS,WAC7D,YAAY,YACT,EAAE,WAAW,YAAY,UAAU,IACnC,CAAC;GACJ,cAAc,CAAC;GACf,sBAAsB,YAAY,wBAAwB;GAC1D,GAAI,YAAY,SAAS,SACtB;IACA,WAAW,YAAY,aAAa,WAAW,YAAY;IAC3D,GAAI,YAAY,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;GAC9C,IACC,CAAC;GACJ,GAAI,YAAY,SAAS,eACtB;IACA,WAAW,YAAY,aAAa,YAAY;IAChD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;GAC9C,IACC,CAAC;GAIJ,GAAI,KAAK,cAAc,KAAA,IAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;GACpE,GAAI,KAAK,YAAY,KAAA,IAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;GAC9D,GAAI,KAAK,YAAY,KAAA,IAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;GAC9D,GAAI,KAAK,QAAQ,KAAA,IAAY,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC;GAClD,GAAI,KAAK,UAAU,KAAA,IAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;GACxD,GAAI,YAAY,SACb,EAAE,QAAQ,WAAW,OAA0B,IAC/C,CAAC;EACL;CACD;CAKA,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EACzD,IACC,YAAY,SAAS,UACrB,YAAY,SAAS,gBACrB,YAAY,SAAS,YAErB;EAED,MAAM,MAAM,KAAK,OAAO,EAAE;EAC1B,IAAI,CAAC,KAAK;EAGV,MAAM,QACL,YAAY,SAAS,aACjB,YAAY,SAAS,CAAC,IACtB,YAAY,gBAAgB,CAAC;EAElC,MAAM,wBAAQ,IAAI,IAAY;EAC9B,KAAK,MAAM,QAAQ,OAAO;GACzB,IAAI,KAAK,SAAS,YAAY;GAC9B,MAAM,OAAO,OAAO,UAAU,KAAK,MAAM;GACzC,IAAI,CAAC,MAAM;GACX,MAAM,MAAM,OAAO,IAAI;GACvB,IAAI,QAAQ,OAAO,EAAE,KAAK,KAAK,MAAM,MAAM,IAAI,GAAG;EACnD;EAEA,IAAI,eAAe,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK;CACpC;CAEA,SAAS,IAAI;CACb,YAAY,IAAI;CAKhB,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,UAAU,IAAI,GACtD,IAAI,CAAC,KAAK,OAAO,KAAK,QAAQ;CAG/B,OAAO;AACR"}

package/dist/derive-DAbo49sm.cjs

@@ -0,0 +1,161 @@
+let _geekmidas_manifest = require("@geekmidas/manifest");
+//#region src/workspace/derive.ts
+/**
+* The apps a manifest implies.
+*
+* `gkm.config.ts` used to carry an `apps` block naming every app: its type, its
+* path, its port, its framework, which other apps it depended on. Every one of
+* those facts was already declared. A `StaticSite('Web', { path: 'apps/web' })`
+* and an `apps.web = { type: 'web', path: 'apps/web', framework: 'vite',
+* dependencies: ['api'] }` are the same statement written twice, and only one of
+* them was checked against anything — so the copy in config was free to drift,
+* and a surface config had no entry for simply never deployed.
+*
+* So the list comes from the graph. A `site` is an app, and so is every
+* `rest-api` — one surface, one container, at the `path` it declared.
+*
+* What config still supplies is what no graph can answer: the backends a cache
+* and a mailer resolve to, the deploy endpoint, the stage's domain.
+*/
+/** Which frontend framework builds each site variant. */
+const FRAMEWORKS = {
+	static: "vite",
+	next: "nextjs",
+	tanstack: "tanstack-start"
+};
+/**
+* The app key a construct id becomes.
+*
+* The same kebab form every physical name is built from, so `Api` is `api` in
+* the config, `production-kitchen-sink-api` on Dokploy, and `API_URL` in an
+* environment — one id, three renderings, no second list.
+*/
+function appKey(id) {
+	return (0, _geekmidas_manifest.kebabCase)(id);
+}
+/**
+* The app serving a surface: its own, always.
+*
+* Every surface gets a container. There is no arrangement in which one runs
+* inside another — two surfaces in a process share a filesystem, an
+* environment, and every credential either was granted, so an auth server
+* beside an API is one bug in the API away from being read by it.
+*/
+function hostOf(manifest, id) {
+	const declaration = manifest[id];
+	if (!declaration || declaration.kind !== "rest-api") return void 0;
+	return id;
+}
+/**
+* Local ports, assigned so that adding a site does not renumber the others.
+*
+* Backends first, then the site holding the base domain, then the rest
+* alphabetically. The ordering is arbitrary but it is *fixed*, which is the
+* property that matters: a port that moves when an unrelated app is added is a
+* port nobody can put in a bookmark. A construct that names its own port keeps
+* it, and is skipped here.
+*/
+function assignPorts(apps) {
+	const rank = (name, app) => [
+		app.type === "backend" ? 0 : app.type === "web" ? 1 : 2,
+		app.root ? 0 : 1,
+		name
+	];
+	const ordered = Object.entries(apps).sort(([aName, a], [bName, b]) => {
+		const [at, ar, an] = rank(aName, a);
+		const [bt, br, bn] = rank(bName, b);
+		return at - bt || ar - br || an.localeCompare(bn);
+	});
+	const taken = new Set(ordered.map(([, app]) => app.port).filter((p) => !!p));
+	let next = 3e3;
+	for (const [, app] of ordered) {
+		if (app.port) continue;
+		while (taken.has(next)) next += 1;
+		app.port = next;
+		taken.add(next);
+	}
+}
+/**
+* Whichever site holds the base domain.
+*
+* The convention first — a site named `web` — because it is one people already
+* rely on. Then an explicit `root: true`. A project with one site needs neither.
+*/
+function markRoot(apps) {
+	const sites = Object.entries(apps).filter(([, a]) => a.type === "web");
+	if (sites.length === 0) return;
+	if (sites.some(([, a]) => a.root)) return;
+	const chosen = sites.find(([name]) => name === "web") ?? (sites.length === 1 ? sites[0] : void 0);
+	if (chosen) chosen[1].root = true;
+}
+function derivedApps(manifest, workspace) {
+	const apps = {};
+	const defaultTarget = workspace.deploy?.default ?? "dokploy";
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "site" && declaration.kind !== "mobile-app" && declaration.kind !== "rest-api") continue;
+		const spec = declaration.kind === "site" || declaration.kind === "mobile-app" ? declaration.app : {
+			path: declaration.path,
+			...declaration.telescope ? { telescope: true } : {}
+		};
+		const name = appKey(id);
+		const configured = workspace.apps[name];
+		apps[name] = {
+			...configured,
+			type: declaration.kind === "site" ? "web" : declaration.kind === "mobile-app" ? "mobile" : "backend",
+			path: spec.path,
+			port: spec.port ?? configured?.port ?? 0,
+			...(declaration.kind === "rest-api" || declaration.kind === "site") && declaration.subdomain ? { subdomain: declaration.subdomain } : {},
+			dependencies: [],
+			resolvedDeployTarget: configured?.resolvedDeployTarget ?? defaultTarget,
+			...declaration.kind === "site" ? {
+				framework: configured?.framework ?? FRAMEWORKS[declaration.variant],
+				...declaration.root ? { root: true } : {},
+				...spec.config ? { config: spec.config } : {}
+			} : {},
+			...declaration.kind === "mobile-app" ? {
+				framework: configured?.framework ?? declaration.variant,
+				...spec.config ? { config: spec.config } : {}
+			} : {},
+			...spec.telescope !== void 0 ? { telescope: spec.telescope } : {},
+			...spec.openapi !== void 0 ? { openapi: spec.openapi } : {},
+			...spec.runtime !== void 0 ? { runtime: spec.runtime } : {},
+			...spec.env !== void 0 ? { env: spec.env } : {},
+			...spec.entry !== void 0 ? { entry: spec.entry } : {},
+			...configured?.domain ? { domain: configured.domain } : {}
+		};
+	}
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "site" && declaration.kind !== "mobile-app" && declaration.kind !== "rest-api") continue;
+		const app = apps[appKey(id)];
+		if (!app) continue;
+		const edges = declaration.kind === "rest-api" ? declaration.calls ?? [] : declaration.dependencies ?? [];
+		const names = /* @__PURE__ */ new Set();
+		for (const edge of edges) {
+			if (edge.kind !== "rest-api") continue;
+			const host = hostOf(manifest, edge.target);
+			if (!host) continue;
+			const key = appKey(host);
+			if (key !== appKey(id) && apps[key]) names.add(key);
+		}
+		app.dependencies = [...names].sort();
+	}
+	markRoot(apps);
+	assignPorts(apps);
+	for (const [name, app] of Object.entries(workspace.apps)) if (!apps[name]) apps[name] = app;
+	return apps;
+}
+//#endregion
+Object.defineProperty(exports, "appKey", {
+	enumerable: true,
+	get: function() {
+		return appKey;
+	}
+});
+Object.defineProperty(exports, "derivedApps", {
+	enumerable: true,
+	get: function() {
+		return derivedApps;
+	}
+});
+
+//# sourceMappingURL=derive-DAbo49sm.cjs.map

package/dist/derive-DAbo49sm.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-DAbo49sm.cjs","names":["kebabCase"],"sources":["../src/workspace/derive.ts"],"sourcesContent":["/**\n * The apps a manifest implies.\n *\n * `gkm.config.ts` used to carry an `apps` block naming every app: its type, its\n * path, its port, its framework, which other apps it depended on. Every one of\n * those facts was already declared. A `StaticSite('Web', { path: 'apps/web' })`\n * and an `apps.web = { type: 'web', path: 'apps/web', framework: 'vite',\n * dependencies: ['api'] }` are the same statement written twice, and only one of\n * them was checked against anything — so the copy in config was free to drift,\n * and a surface config had no entry for simply never deployed.\n *\n * So the list comes from the graph. A `site` is an app, and so is every\n * `rest-api` — one surface, one container, at the `path` it declared.\n *\n * What config still supplies is what no graph can answer: the backends a cache\n * and a mailer resolve to, the deploy endpoint, the stage's domain.\n */\n\nimport {\n\ttype AppSpec,\n\ttype ConstructManifest,\n\tkebabCase,\n} from '@geekmidas/manifest';\nimport type {\n\tAppDomainConfig,\n\tDeployTargetName,\n\tFramework,\n\tNormalizedAppConfig,\n\tNormalizedWorkspace,\n} from './types.js';\n\n/** Which frontend framework builds each site variant. */\nconst FRAMEWORKS: Record<string, Framework> = {\n\tstatic: 'vite',\n\tnext: 'nextjs',\n\ttanstack: 'tanstack-start',\n};\n\n/**\n * The app key a construct id becomes.\n *\n * The same kebab form every physical name is built from, so `Api` is `api` in\n * the config, `production-kitchen-sink-api` on Dokploy, and `API_URL` in an\n * environment — one id, three renderings, no second list.\n */\nexport function appKey(id: string): string {\n\treturn kebabCase(id);\n}\n\n/**\n * The app serving a surface: its own, always.\n *\n * Every surface gets a container. There is no arrangement in which one runs\n * inside another — two surfaces in a process share a filesystem, an\n * environment, and every credential either was granted, so an auth server\n * beside an API is one bug in the API away from being read by it.\n */\nexport function hostOf(\n\tmanifest: ConstructManifest,\n\tid: string,\n): string | undefined {\n\tconst declaration = manifest[id];\n\tif (!declaration || declaration.kind !== 'rest-api') return undefined;\n\n\treturn id;\n}\n\n/**\n * Local ports, assigned so that adding a site does not renumber the others.\n *\n * Backends first, then the site holding the base domain, then the rest\n * alphabetically. The ordering is arbitrary but it is *fixed*, which is the\n * property that matters: a port that moves when an unrelated app is added is a\n * port nobody can put in a bookmark. A construct that names its own port keeps\n * it, and is skipped here.\n */\nfunction assignPorts(apps: Record<string, NormalizedAppConfig>): void {\n\tconst rank = (\n\t\tname: string,\n\t\tapp: NormalizedAppConfig,\n\t): [number, number, string] => [\n\t\tapp.type === 'backend' ? 0 : app.type === 'web' ? 1 : 2,\n\t\tapp.root ? 0 : 1,\n\t\tname,\n\t];\n\n\tconst ordered = Object.entries(apps).sort(([aName, a], [bName, b]) => {\n\t\tconst [at, ar, an] = rank(aName, a);\n\t\tconst [bt, br, bn] = rank(bName, b);\n\t\treturn at - bt || ar - br || an.localeCompare(bn);\n\t});\n\n\tconst taken = new Set(\n\t\tordered.map(([, app]) => app.port).filter((p): p is number => !!p),\n\t);\n\n\tlet next = 3000;\n\tfor (const [, app] of ordered) {\n\t\tif (app.port) continue;\n\t\twhile (taken.has(next)) next += 1;\n\t\tapp.port = next;\n\t\ttaken.add(next);\n\t}\n}\n\n/**\n * Whichever site holds the base domain.\n *\n * The convention first — a site named `web` — because it is one people already\n * rely on. Then an explicit `root: true`. A project with one site needs neither.\n */\nfunction markRoot(apps: Record<string, NormalizedAppConfig>): void {\n\tconst sites = Object.entries(apps).filter(([, a]) => a.type === 'web');\n\tif (sites.length === 0) return;\n\tif (sites.some(([, a]) => a.root)) return;\n\n\tconst chosen =\n\t\tsites.find(([name]) => name === 'web') ??\n\t\t(sites.length === 1 ? sites[0] : undefined);\n\tif (chosen) chosen[1].root = true;\n}\n\nexport function derivedApps(\n\tmanifest: ConstructManifest,\n\tworkspace: NormalizedWorkspace,\n): Record<string, NormalizedAppConfig> {\n\tconst apps: Record<string, NormalizedAppConfig> = {};\n\tconst defaultTarget: DeployTargetName =\n\t\tworkspace.deploy?.default ?? 'dokploy';\n\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\t// Three kinds are apps: a site, a mobile app and an HTTP surface. A worker\n\t\t// is not one — it names the process that runs a cron or a subscriber, and\n\t\t// that process is the app's server, which already exists. Everything else\n\t\t// is a resource one of them uses.\n\t\tif (\n\t\t\tdeclaration.kind !== 'site' &&\n\t\t\tdeclaration.kind !== 'mobile-app' &&\n\t\t\tdeclaration.kind !== 'rest-api'\n\t\t)\n\t\t\tcontinue;\n\n\t\t// No opt-in to be had. Each says where it lives.\n\t\tconst spec: AppSpec =\n\t\t\tdeclaration.kind === 'site' || declaration.kind === 'mobile-app'\n\t\t\t\t? declaration.app\n\t\t\t\t: {\n\t\t\t\t\t\tpath: declaration.path,\n\t\t\t\t\t\t...(declaration.telescope ? { telescope: true } : {}),\n\t\t\t\t\t};\n\n\t\tconst name = appKey(id);\n\t\t// A config entry of the same name still wins, so a workspace can override\n\t\t// one field without restating the app. Nothing in this repo needs to.\n\t\tconst configured = workspace.apps[name];\n\n\t\tapps[name] = {\n\t\t\t...configured,\n\t\t\ttype:\n\t\t\t\tdeclaration.kind === 'site'\n\t\t\t\t\t? 'web'\n\t\t\t\t\t: declaration.kind === 'mobile-app'\n\t\t\t\t\t\t? 'mobile'\n\t\t\t\t\t\t: 'backend',\n\t\t\tpath: spec.path,\n\t\t\tport: spec.port ?? configured?.port ?? 0,\n\t\t\t// The label it answers on, under a stage's domain and locally alike.\n\t\t\t...((declaration.kind === 'rest-api' || declaration.kind === 'site') &&\n\t\t\tdeclaration.subdomain\n\t\t\t\t? { subdomain: declaration.subdomain }\n\t\t\t\t: {}),\n\t\t\tdependencies: [],\n\t\t\tresolvedDeployTarget: configured?.resolvedDeployTarget ?? defaultTarget,\n\t\t\t...(declaration.kind === 'site'\n\t\t\t\t? {\n\t\t\t\t\t\tframework: configured?.framework ?? FRAMEWORKS[declaration.variant],\n\t\t\t\t\t\t...(declaration.root ? { root: true } : {}),\n\t\t\t\t\t\t...(spec.config ? { config: spec.config } : {}),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t...(declaration.kind === 'mobile-app'\n\t\t\t\t? {\n\t\t\t\t\t\tframework: configured?.framework ?? declaration.variant,\n\t\t\t\t\t\t...(spec.config ? { config: spec.config } : {}),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t// One glob fans out to the six the build reads, because each generator\n\t\t\t// already inspects every export and keeps what it recognises. A\n\t\t\t// per-kind field still wins where one was given.\n\t\t\t...(spec.telescope !== undefined ? { telescope: spec.telescope } : {}),\n\t\t\t...(spec.openapi !== undefined ? { openapi: spec.openapi } : {}),\n\t\t\t...(spec.runtime !== undefined ? { runtime: spec.runtime } : {}),\n\t\t\t...(spec.env !== undefined ? { env: spec.env } : {}),\n\t\t\t...(spec.entry !== undefined ? { entry: spec.entry } : {}),\n\t\t\t...(configured?.domain\n\t\t\t\t? { domain: configured.domain as AppDomainConfig }\n\t\t\t\t: {}),\n\t\t} as NormalizedAppConfig;\n\t}\n\n\t// Build order, from the edges rather than from a hand-kept list. A site that\n\t// depends on a surface depends on the app that serves it — which for a\n\t// mounted auth server is its host, not a container that does not exist.\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\tif (\n\t\t\tdeclaration.kind !== 'site' &&\n\t\t\tdeclaration.kind !== 'mobile-app' &&\n\t\t\tdeclaration.kind !== 'rest-api'\n\t\t)\n\t\t\tcontinue;\n\n\t\tconst app = apps[appKey(id)];\n\t\tif (!app) continue;\n\n\t\t// A site names its edges `dependencies`; a surface names them `calls`.\n\t\tconst edges =\n\t\t\tdeclaration.kind === 'rest-api'\n\t\t\t\t? (declaration.calls ?? [])\n\t\t\t\t: (declaration.dependencies ?? []);\n\n\t\tconst names = new Set<string>();\n\t\tfor (const edge of edges) {\n\t\t\tif (edge.kind !== 'rest-api') continue;\n\t\t\tconst host = hostOf(manifest, edge.target);\n\t\t\tif (!host) continue;\n\t\t\tconst key = appKey(host);\n\t\t\tif (key !== appKey(id) && apps[key]) names.add(key);\n\t\t}\n\n\t\tapp.dependencies = [...names].sort();\n\t}\n\n\tmarkRoot(apps);\n\tassignPorts(apps);\n\n\t// Apps config declared that the graph knows nothing about — a `type: 'mobile'`\n\t// entry, or a hand-run process. Kept rather than dropped: config is still the\n\t// escape hatch for what nothing declares.\n\tfor (const [name, app] of Object.entries(workspace.apps)) {\n\t\tif (!apps[name]) apps[name] = app;\n\t}\n\n\treturn apps;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgCA,MAAM,aAAwC;CAC7C,QAAQ;CACR,MAAM;CACN,UAAU;AACX;;;;;;;;AASA,SAAgB,OAAO,IAAoB;CAC1C,QAAA,GAAOA,oBAAAA,UAAAA,CAAU,EAAE;AACpB;;;;;;;;;AAUA,SAAgB,OACf,UACA,IACqB;CACrB,MAAM,cAAc,SAAS;CAC7B,IAAI,CAAC,eAAe,YAAY,SAAS,YAAY,OAAO,KAAA;CAE5D,OAAO;AACR;;;;;;;;;;AAWA,SAAS,YAAY,MAAiD;CACrE,MAAM,QACL,MACA,QAC8B;EAC9B,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,QAAQ,IAAI;EACtD,IAAI,OAAO,IAAI;EACf;CACD;CAEA,MAAM,UAAU,OAAO,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,OAAO;EACrE,MAAM,CAAC,IAAI,IAAI,MAAM,KAAK,OAAO,CAAC;EAClC,MAAM,CAAC,IAAI,IAAI,MAAM,KAAK,OAAO,CAAC;EAClC,OAAO,KAAK,MAAM,KAAK,MAAM,GAAG,cAAc,EAAE;CACjD,CAAC;CAED,MAAM,QAAQ,IAAI,IACjB,QAAQ,KAAK,GAAG,SAAS,IAAI,IAAI,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,CAAC,CAClE;CAEA,IAAI,OAAO;CACX,KAAK,MAAM,GAAG,QAAQ,SAAS;EAC9B,IAAI,IAAI,MAAM;EACd,OAAO,MAAM,IAAI,IAAI,GAAG,QAAQ;EAChC,IAAI,OAAO;EACX,MAAM,IAAI,IAAI;CACf;AACD;;;;;;;AAQA,SAAS,SAAS,MAAiD;CAClE,MAAM,QAAQ,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAQ,GAAG,OAAO,EAAE,SAAS,KAAK;CACrE,IAAI,MAAM,WAAW,GAAG;CACxB,IAAI,MAAM,MAAM,GAAG,OAAO,EAAE,IAAI,GAAG;CAEnC,MAAM,SACL,MAAM,MAAM,CAAC,UAAU,SAAS,KAAK,MACpC,MAAM,WAAW,IAAI,MAAM,KAAK,KAAA;CAClC,IAAI,QAAQ,OAAO,EAAE,CAAC,OAAO;AAC9B;AAEA,SAAgB,YACf,UACA,WACsC;CACtC,MAAM,OAA4C,CAAC;CACnD,MAAM,gBACL,UAAU,QAAQ,WAAW;CAE9B,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EAKzD,IACC,YAAY,SAAS,UACrB,YAAY,SAAS,gBACrB,YAAY,SAAS,YAErB;EAGD,MAAM,OACL,YAAY,SAAS,UAAU,YAAY,SAAS,eACjD,YAAY,MACZ;GACA,MAAM,YAAY;GAClB,GAAI,YAAY,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;EACpD;EAEH,MAAM,OAAO,OAAO,EAAE;EAGtB,MAAM,aAAa,UAAU,KAAK;EAElC,KAAK,QAAQ;GACZ,GAAG;GACH,MACC,YAAY,SAAS,SAClB,QACA,YAAY,SAAS,eACpB,WACA;GACL,MAAM,KAAK;GACX,MAAM,KAAK,QAAQ,YAAY,QAAQ;GAEvC,IAAK,YAAY,SAAS,cAAc,YAAY,SAAS,WAC7D,YAAY,YACT,EAAE,WAAW,YAAY,UAAU,IACnC,CAAC;GACJ,cAAc,CAAC;GACf,sBAAsB,YAAY,wBAAwB;GAC1D,GAAI,YAAY,SAAS,SACtB;IACA,WAAW,YAAY,aAAa,WAAW,YAAY;IAC3D,GAAI,YAAY,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;GAC9C,IACC,CAAC;GACJ,GAAI,YAAY,SAAS,eACtB;IACA,WAAW,YAAY,aAAa,YAAY;IAChD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;GAC9C,IACC,CAAC;GAIJ,GAAI,KAAK,cAAc,KAAA,IAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;GACpE,GAAI,KAAK,YAAY,KAAA,IAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;GAC9D,GAAI,KAAK,YAAY,KAAA,IAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;GAC9D,GAAI,KAAK,QAAQ,KAAA,IAAY,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC;GAClD,GAAI,KAAK,UAAU,KAAA,IAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;GACxD,GAAI,YAAY,SACb,EAAE,QAAQ,WAAW,OAA0B,IAC/C,CAAC;EACL;CACD;CAKA,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EACzD,IACC,YAAY,SAAS,UACrB,YAAY,SAAS,gBACrB,YAAY,SAAS,YAErB;EAED,MAAM,MAAM,KAAK,OAAO,EAAE;EAC1B,IAAI,CAAC,KAAK;EAGV,MAAM,QACL,YAAY,SAAS,aACjB,YAAY,SAAS,CAAC,IACtB,YAAY,gBAAgB,CAAC;EAElC,MAAM,wBAAQ,IAAI,IAAY;EAC9B,KAAK,MAAM,QAAQ,OAAO;GACzB,IAAI,KAAK,SAAS,YAAY;GAC9B,MAAM,OAAO,OAAO,UAAU,KAAK,MAAM;GACzC,IAAI,CAAC,MAAM;GACX,MAAM,MAAM,OAAO,IAAI;GACvB,IAAI,QAAQ,OAAO,EAAE,KAAK,KAAK,MAAM,MAAM,IAAI,GAAG;EACnD;EAEA,IAAI,eAAe,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK;CACpC;CAEA,SAAS,IAAI;CACb,YAAY,IAAI;CAKhB,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,UAAU,IAAI,GACtD,IAAI,CAAC,KAAK,OAAO,KAAK,QAAQ;CAG/B,OAAO;AACR"}

package/dist/{discover-C_6COHEv.cjs → discover-DHdECueV.cjs}

@@ -1,5 +1,6 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_schemas = require("./schemas-Ckm_aBnF.cjs");
+const require_sandbox = require("./sandbox-CL--ZDui.cjs");
 const require_workerRuntime = require("./workerRuntime-BXfhbe13.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -102,117 +103,6 @@ var ConstructGenerator = class {
 	}
 };
 //#endregion
-//#region src/sandbox/sandbox.ts
-/**
-* Where a deploy runs the project's own code.
-*
-* A deploy holds credentials — Dokploy's token, a registry login, an AWS key —
-* and loading `gkm.config.ts`, sniffing an app's environment and building it
-* all execute code from the repository being deployed. On a developer's own
-* laptop that is the developer's code. On a CI job for a fork, or a shared
-* build runner, it is not, and that code should not be able to read the
-* credentials used to deploy it, hang the deploy, or reach outside the
-* checkout.
-*
-* So every step that runs project code goes through a `Sandbox`: one call,
-* with an argument array rather than a shell line, the complete environment
-* the step needs rather than the host's, a timeout it cannot outlive, secrets
-* as files rather than variables, and a working directory inside the project.
-* The steps that need credentials — provisioning, pushing, releasing — are
-* the deploy's own code and never run in one.
-*
-* `LocalSandbox` is the default: a child process on this machine with an
-* allowlisted environment. A host that builds repositories it does not trust
-* passes its own — a container per build, a VM — through `deploy()`'s
-* `sandbox`.
-*/
-/** The variable naming the directory a command's secrets are mounted in. */
-const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
-/** A command was asked to run outside the project. */
-var SandboxCwdEscape = class extends Error {
-	cwd;
-	root;
-	constructor(cwd, root) {
-		super(`Refusing to run in '${cwd}': it is outside the project at '${root}'. A sandboxed step only runs inside the project it was given — check the app paths in gkm.config.ts for \`..\` or an absolute path.`);
-		this.cwd = cwd;
-		this.root = root;
-		this.name = "SandboxCwdEscape";
-	}
-};
-/** A path with its symlinks resolved where it exists — `/tmp` is `/private/tmp`. */
-function real(path) {
-	return (0, node_fs.existsSync)(path) ? (0, node_fs.realpathSync)(path) : path;
-}
-/**
-* `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.
-*
-* Symlinks are resolved on both sides first, so a link inside the project
-* that points out of it is an escape, and a project reached through a link
-* (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call
-* before it runs anything.
-*/
-function confineCwd(root, cwd) {
-	const absolute = (0, node_path.resolve)(root, cwd);
-	const from = (0, node_path.relative)(real((0, node_path.resolve)(root)), real(absolute));
-	if (from === ".." || from.startsWith(`..${node_path.sep}`) || (0, node_path.isAbsolute)(from)) throw new SandboxCwdEscape(cwd, root);
-	return absolute;
-}
-/** A secret's file name: one path segment, so it cannot be written elsewhere. */
-var SecretNameInvalid = class extends Error {
-	secretName;
-	constructor(secretName) {
-		super(`'${secretName}' cannot be a secret's name: it becomes a file name in the secrets directory, so it must be one segment of letters, digits, '.', '-' or '_' and not start with '.'.`);
-		this.secretName = secretName;
-		this.name = "SecretNameInvalid";
-	}
-};
-const SECRET_NAME = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
-/** Every secret name, checked before anything is written. */
-function assertSecretNames(secrets) {
-	for (const name of Object.keys(secrets ?? {})) if (!SECRET_NAME.test(name)) throw new SecretNameInvalid(name);
-}
-const active = new node_async_hooks.AsyncLocalStorage();
-/**
-* Run `fn` with `sandbox` as the one its steps use.
-*
-* Per run rather than global, as `withOutput` routes a run's lines: two
-* deploys in one host process each build in their own sandbox. A step deep in
-* the engine — discovering constructs, sniffing an app — asks
-* {@link activeSandbox} rather than every function between `deploy()` and it
-* taking one more parameter.
-*/
-function withSandbox(sandbox, fn) {
-	return active.run({
-		sandbox,
-		answers: /* @__PURE__ */ new Map()
-	}, fn);
-}
-/** The sandbox of the run this is part of, if it was started with one. */
-function activeSandbox() {
-	return active.getStore()?.sandbox;
-}
-/**
-* `ask()`'s answer, asked once per run.
-*
-* A deploy loads its config and discovers its constructs from several places
-* — the first load, the engine, the Dockerfile generator — and in a sandbox
-* each was a child process of its own, for the same answer: the checkout does
-* not change while it deploys. Within a run in `sandbox`, the first answer
-* for `key` is the one every later ask gets. Outside one, or for another
-* sandbox, `ask()` runs each time.
-*/
-function oncePerRun(sandbox, key, ask) {
-	const run = active.getStore();
-	if (!run || run.sandbox !== sandbox) return ask();
-	let answer = run.answers.get(key);
-	if (!answer) {
-		answer = ask();
-		run.answers.set(key, answer);
-		answer.catch(() => run.answers.delete(key));
-	}
-	return answer;
-}
-//#endregion
 //#region src/owningTsconfigJsx.ts
 const REGISTER = "owning-tsconfig-jsx-register.mjs";
 /** The CLI's `bin/` was not found above the module looking for it. */
@@ -319,12 +209,13 @@ var SandboxWorkerFailed = class extends Error {
 * though it had run again.
 */
 async function runWorker(sandbox, step, options) {
-	const answer = await oncePerRun(sandbox, JSON.stringify([
+	const key = JSON.stringify([
 		options.name,
 		options.cwd,
 		options.args,
 		options.env ?? {}
-	]), () => startWorker(sandbox, step, options));
+	]);
+	const answer = await require_sandbox.oncePerRun(sandbox, key, () => startWorker(sandbox, step, options));
 	return structuredClone(answer);
 }
 async function startWorker(sandbox, step, options) {
@@ -486,7 +377,7 @@ var ConstructsNotSerializable = class extends Error {
 * @throws {DuplicateConstruct} when two exports claim one id.
 */
 async function discover(options) {
-	const sandbox = options.sandbox ?? activeSandbox();
+	const sandbox = options.sandbox ?? require_sandbox.activeSandbox();
 	if (sandbox) {
 		if (!options.sources && !options.bustCache) {
 			const sandboxed = await discoverInSandbox(sandbox, options);
@@ -629,48 +520,12 @@ Object.defineProperty(exports, "ConstructsNotSerializable", {
 		return ConstructsNotSerializable;
 	}
 });
-Object.defineProperty(exports, "SECRETS_DIR_ENV", {
-	enumerable: true,
-	get: function() {
-		return SECRETS_DIR_ENV;
-	}
-});
-Object.defineProperty(exports, "SandboxCwdEscape", {
-	enumerable: true,
-	get: function() {
-		return SandboxCwdEscape;
-	}
-});
 Object.defineProperty(exports, "SandboxWorkerFailed", {
 	enumerable: true,
 	get: function() {
 		return SandboxWorkerFailed;
 	}
 });
-Object.defineProperty(exports, "SecretNameInvalid", {
-	enumerable: true,
-	get: function() {
-		return SecretNameInvalid;
-	}
-});
-Object.defineProperty(exports, "activeSandbox", {
-	enumerable: true,
-	get: function() {
-		return activeSandbox;
-	}
-});
-Object.defineProperty(exports, "assertSecretNames", {
-	enumerable: true,
-	get: function() {
-		return assertSecretNames;
-	}
-});
-Object.defineProperty(exports, "confineCwd", {
-	enumerable: true,
-	get: function() {
-		return confineCwd;
-	}
-});
 Object.defineProperty(exports, "discover", {
 	enumerable: true,
 	get: function() {
@@ -719,11 +574,5 @@ Object.defineProperty(exports, "withOwningTsconfigJsx", {
 		return withOwningTsconfigJsx;
 	}
 });
-Object.defineProperty(exports, "withSandbox", {
-	enumerable: true,
-	get: function() {
-		return withSandbox;
-	}
-});
 
-//# sourceMappingURL=discover-C_6COHEv.cjs.map
+//# sourceMappingURL=discover-DHdECueV.cjs.map