@geekmidas/cli 10.0.0-alpha.63 → 10.0.0-alpha.65

package/dist/resolve-DLkIXTct.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-DLkIXTct.mjs","names":[],"sources":["../src/target/package.ts","../src/target/runtime.ts","../src/target/resolve.ts"],"sourcesContent":["/**\n * A target package, found the way the project would find it.\n *\n * From the workspace root, never from the CLI's own location or the process's\n * working directory: the package is the project's dependency, and a CLI run\n * through `pnpm dlx` — or a host deploying a checkout elsewhere — has neither\n * in common with the project.\n */\n\nimport { existsSync, readFileSync, realpathSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\nexport interface TargetPackageManifest {\n\tname?: string;\n\tmain?: string;\n\tmodule?: string;\n\texports?: unknown;\n\tgkm?: { runtime?: unknown };\n}\n\nexport interface LocatedPackage {\n\t/** The package's directory, symlinks resolved. */\n\tdir: string;\n\tmanifest: TargetPackageManifest;\n}\n\n/** A target package the project does not have installed. */\nexport class TargetPackageNotFound extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t\treadonly from: string,\n\t) {\n\t\tsuper(\n\t\t\t`deploy.targets.${target} names the package \"${packageName}\", which is not installed in ${from}. Add it to the workspace root: pnpm add -D ${packageName}`,\n\t\t);\n\t\tthis.name = 'TargetPackageNotFound';\n\t}\n}\n\n/**\n * `name`'s directory and `package.json`, from the nearest `node_modules` at\n * or above `from` — Node's own lookup, without the exports map getting in\n * the way of reading `package.json`.\n */\nexport function locatePackage(\n\tname: string,\n\tfrom: string,\n): LocatedPackage | undefined {\n\tlet dir = from;\n\twhile (true) {\n\t\tconst manifestPath = join(dir, 'node_modules', name, 'package.json');\n\t\tif (existsSync(manifestPath)) {\n\t\t\treturn {\n\t\t\t\tdir: realpathSync(dirname(manifestPath)),\n\t\t\t\tmanifest: JSON.parse(\n\t\t\t\t\treadFileSync(manifestPath, 'utf-8'),\n\t\t\t\t) as TargetPackageManifest,\n\t\t\t};\n\t\t}\n\t\tconst parent = dirname(dir);\n\t\tif (parent === dir) return undefined;\n\t\tdir = parent;\n\t}\n}\n\n/** The first file a conditions object leads to, as an `import` would. */\nfunction pick(node: unknown): string | undefined {\n\tif (typeof node === 'string') return node;\n\tif (Array.isArray(node)) {\n\t\tfor (const option of node) {\n\t\t\tconst found = pick(option);\n\t\t\tif (found) return found;\n\t\t}\n\t\treturn undefined;\n\t}\n\tif (node && typeof node === 'object') {\n\t\tconst conditions = node as Record<string, unknown>;\n\t\tfor (const condition of ['import', 'node', 'default', 'require']) {\n\t\t\tif (condition in conditions) {\n\t\t\t\tconst found = pick(conditions[condition]);\n\t\t\t\tif (found) return found;\n\t\t\t}\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** The file `import(name)` loads, relative to the package directory. */\nexport function packageEntry(manifest: TargetPackageManifest): string {\n\tconst { exports } = manifest;\n\tlet root: unknown = exports;\n\tif (exports && typeof exports === 'object' && !Array.isArray(exports)) {\n\t\tconst keys = Object.keys(exports);\n\t\t// A subpath map — `{ \".\": …, \"./x\": … }` — rather than one conditions\n\t\t// object for the root.\n\t\tif (keys.some((key) => key.startsWith('.'))) {\n\t\t\troot = (exports as Record<string, unknown>)['.'];\n\t\t}\n\t}\n\treturn pick(root) ?? manifest.module ?? manifest.main ?? 'index.js';\n}\n\n/** The module `name` is, imported from where the project would import it. */\nexport async function importPackage(\n\ttarget: string,\n\tname: string,\n\tfrom: string,\n): Promise<Record<string, unknown>> {\n\tconst located = locatePackage(name, from);\n\tif (!located) throw new TargetPackageNotFound(target, name, from);\n\n\tconst entry = join(located.dir, packageEntry(located.manifest));\n\treturn (await import(pathToFileURL(entry).href)) as Record<string, unknown>;\n}\n","/**\n * A target's runtime, without loading the target.\n *\n * `gkm dev` and `gkm build` choose a project's backends by it on every start,\n * synchronously, and must not import a deploy plugin to do so — a plugin may\n * pull in a cloud SDK, and a broken one would stop `gkm dev` for a project\n * that is only being developed. So a built-in's runtime is in the table, an\n * inline target carries its own, and a package declares it in its\n * `package.json`:\n *\n * ```json\n * { \"name\": \"@acme/gkm-target\", \"gkm\": { \"runtime\": \"server\" } }\n * ```\n */\n\nimport {\n\tbuiltinTarget,\n\tconfigurableBuiltins,\n\tconfiguredTarget,\n\tUnknownDeployTarget,\n} from './builtins';\nimport { locatePackage, TargetPackageNotFound } from './package';\nimport type { DeployRuntime, DeployTargetEntry } from './types';\n\nconst RUNTIMES: readonly DeployRuntime[] = ['server', 'aws'];\n\n/** A target package whose `package.json` does not say where it runs. */\nexport class TargetRuntimeUndeclared extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t\t/** What `gkm.runtime` held instead, when it held anything. */\n\t\treadonly found?: unknown,\n\t) {\n\t\tsuper(\n\t\t\t`The deploy target \"${target}\" (${packageName}) does not declare its runtime${found === undefined ? '' : ` (gkm.runtime is ${JSON.stringify(found)})`}. Its package.json needs \"gkm\": { \"runtime\": \"server\" } or \"aws\", so gkm dev and gkm build can choose backends without loading it.`,\n\t\t);\n\t\tthis.name = 'TargetRuntimeUndeclared';\n\t}\n}\n\n/** What a workspace's deploy config is read for here. */\nexport interface TargetSource {\n\t/** Where the target packages are installed from. */\n\troot?: string;\n\tdeploy?:\n\t\t| { default?: string; targets?: Record<string, DeployTargetEntry> }\n\t\t| undefined;\n}\n\n/** The runtime a target package declares in `package.json#gkm.runtime`. */\nexport function declaredRuntime(\n\ttarget: string,\n\tpackageName: string,\n\troot: string | undefined,\n): DeployRuntime {\n\tconst located = root ? locatePackage(packageName, root) : undefined;\n\tif (!located) {\n\t\tthrow new TargetPackageNotFound(\n\t\t\ttarget,\n\t\t\tpackageName,\n\t\t\troot ?? 'the workspace',\n\t\t);\n\t}\n\tconst runtime = located.manifest.gkm?.runtime;\n\tif (!RUNTIMES.includes(runtime as DeployRuntime)) {\n\t\tthrow new TargetRuntimeUndeclared(target, packageName, runtime);\n\t}\n\treturn runtime as DeployRuntime;\n}\n\n/** The runtime of the target `name`, as the workspace resolves it. */\nexport function runtimeOf(\n\tname: string,\n\tworkspace: TargetSource,\n): DeployRuntime {\n\tconst builtin = builtinTarget(name);\n\tif (builtin) return builtin.runtime;\n\n\tconst entry = configuredTarget(workspace.deploy, name);\n\tif (entry === undefined) {\n\t\tthrow new UnknownDeployTarget(name, [\n\t\t\t...configurableBuiltins(),\n\t\t\t...Object.keys(workspace.deploy?.targets ?? {}),\n\t\t]);\n\t}\n\n\tconst implementation = Array.isArray(entry) ? entry[0] : entry;\n\treturn typeof implementation === 'string'\n\t\t? declaredRuntime(name, implementation, workspace.root)\n\t\t: (implementation as { runtime: DeployRuntime }).runtime;\n}\n","/**\n * From a target's name to the target.\n *\n * In this order, the first that has the name wins:\n *\n * 1. the host's own targets — what a program calling `deploy()` passes\n * 2. the built-ins — `dokploy`, `compose`, `sst`\n * 3. `deploy.targets` in gkm.config.ts — a package, an object, or either\n *    with options\n *\n * Built-ins come before the config so that a dependency cannot take over\n * `dokploy` by being listed under its name. A name nothing has is\n * `UnknownDeployTarget`. There is deliberately no fourth step that guesses a\n * package from the name (`acme` → `@acme/gkm-target`): an npm scope nobody\n * has claimed can be claimed by anyone, and a deploy would then run their\n * code with the stage's credentials. A target is installed and named.\n */\n\nimport {\n\tbuiltinTarget,\n\tconfigurableBuiltins,\n\tconfiguredTarget,\n\tDeployTargetNotYetSupported,\n\tUnknownDeployTarget,\n} from './builtins';\nimport { isDeployTarget } from './define';\nimport { importPackage } from './package';\nimport { declaredRuntime } from './runtime';\nimport type {\n\tAnyDeployTarget,\n\tDeployRuntime,\n\tDeployTargetEntry,\n\tTargetOptionsIssue,\n} from './types';\n\n/** Where a target came from. */\nexport type TargetSourceKind = 'host' | 'builtin' | 'config';\n\nexport interface ResolvedTarget {\n\t/** The name it was asked for by. */\n\tname: string;\n\ttarget: AnyDeployTarget;\n\tsource: TargetSourceKind;\n\t/** Its options as written in the config, before its schema parsed them. */\n\toptions: unknown;\n}\n\nexport interface ResolveTargetOptions {\n\t/** The workspace whose `deploy.targets` is consulted. */\n\tworkspace: {\n\t\troot: string;\n\t\tdeploy?: { targets?: Record<string, DeployTargetEntry> } | undefined;\n\t};\n\t/** The host's targets, consulted first. */\n\thost?: Record<string, AnyDeployTarget>;\n\t/** The stage being deployed, for what to do instead of a refused target. */\n\tstage: string;\n}\n\n/** A target package whose default export is not a target. */\nexport class TargetPackageInvalid extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t) {\n\t\tsuper(\n\t\t\t`deploy.targets.${target} names \"${packageName}\", whose default export is not a deploy target. A target package exports one as default: export default defineTarget({ … }) from '@geekmidas/cli/target'.`,\n\t\t);\n\t\tthis.name = 'TargetPackageInvalid';\n\t}\n}\n\n/** A `deploy.targets` entry that is not a target, a package name or a pair. */\nexport class TargetEntryInvalid extends Error {\n\tconstructor(readonly target: string) {\n\t\tsuper(\n\t\t\t`deploy.targets.${target} must be a package name, a target object (defineTarget), or [package or target, options].`,\n\t\t);\n\t\tthis.name = 'TargetEntryInvalid';\n\t}\n}\n\n/** A target whose `runtime` is not the one its package declares. */\nexport class TargetRuntimeMismatch extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t\treadonly declared: DeployRuntime,\n\t\treadonly actual: DeployRuntime,\n\t) {\n\t\tsuper(\n\t\t\t`The deploy target \"${target}\" runs on \"${actual}\", but ${packageName}'s package.json declares gkm.runtime \"${declared}\". gkm dev and gkm build chose backends for \"${declared}\", so the two must agree — fix the package.`,\n\t\t);\n\t\tthis.name = 'TargetRuntimeMismatch';\n\t}\n}\n\n/** Options a target's schema rejected. */\nexport class InvalidTargetOptions extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly issues: readonly TargetOptionsIssue[],\n\t) {\n\t\tconst lines = issues.map((issue) => {\n\t\t\tconst path = (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.');\n\t\t\treturn `  - ${path ? `${path}: ` : ''}${issue.message}`;\n\t\t});\n\t\tsuper(\n\t\t\t`The options for deploy target \"${target}\" are invalid — fix them in deploy.targets.${target} in gkm.config.ts:\\n${lines.join('\\n')}`,\n\t\t);\n\t\tthis.name = 'InvalidTargetOptions';\n\t}\n}\n\n/** The built-ins `gkm deploy` deploys through, loaded only when used. */\nconst BUILTIN_LOADERS: Record<string, () => Promise<AnyDeployTarget>> = {\n\tdokploy: async () => (await import('./dokploy')).dokployTarget,\n\tcompose: async () => (await import('./compose/index')).composeTarget(),\n\tsst: async () => (await import('./sst/index')).sstTarget,\n};\n\n/** The target `name` means, in this workspace, for this host. */\nexport async function resolveTarget(\n\tname: string,\n\t{ workspace, host, stage }: ResolveTargetOptions,\n): Promise<ResolvedTarget> {\n\tif (host && Object.hasOwn(host, name)) {\n\t\treturn { name, target: host[name]!, source: 'host', options: undefined };\n\t}\n\n\tconst builtin = builtinTarget(name);\n\tif (builtin) {\n\t\tconst load = BUILTIN_LOADERS[name];\n\t\tif (builtin.status !== 'available' || !load) {\n\t\t\tthrow new DeployTargetNotYetSupported(name, builtin.instead?.(stage));\n\t\t}\n\t\treturn {\n\t\t\tname,\n\t\t\ttarget: await load(),\n\t\t\tsource: 'builtin',\n\t\t\toptions: undefined,\n\t\t};\n\t}\n\n\tconst entry = configuredTarget(workspace.deploy, name);\n\tif (entry === undefined) {\n\t\tthrow new UnknownDeployTarget(name, [\n\t\t\t...configurableBuiltins(),\n\t\t\t...Object.keys(workspace.deploy?.targets ?? {}),\n\t\t]);\n\t}\n\n\tconst [implementation, options] = Array.isArray(entry)\n\t\t? (entry as readonly [unknown, unknown])\n\t\t: [entry, undefined];\n\n\tif (typeof implementation === 'string') {\n\t\t// Before the import: a package that does not say where it runs is\n\t\t// refused without running any of its code.\n\t\tconst declared = declaredRuntime(name, implementation, workspace.root);\n\t\tconst loaded = await importPackage(name, implementation, workspace.root);\n\t\tconst target = loaded.default;\n\t\tif (!isDeployTarget(target)) {\n\t\t\tthrow new TargetPackageInvalid(name, implementation);\n\t\t}\n\t\tif (target.runtime !== declared) {\n\t\t\tthrow new TargetRuntimeMismatch(\n\t\t\t\tname,\n\t\t\t\timplementation,\n\t\t\t\tdeclared,\n\t\t\t\ttarget.runtime,\n\t\t\t);\n\t\t}\n\t\treturn { name, target, source: 'config', options };\n\t}\n\n\tif (!isDeployTarget(implementation)) throw new TargetEntryInvalid(name);\n\treturn { name, target: implementation, source: 'config', options };\n}\n\n/** The target's options, parsed by its schema. */\nexport async function parseTargetOptions(\n\tresolved: ResolvedTarget,\n): Promise<unknown> {\n\tconst { name, target, options } = resolved;\n\tif (!target.options) {\n\t\tif (options !== undefined) {\n\t\t\tthrow new InvalidTargetOptions(name, [\n\t\t\t\t{ message: 'this target takes no options' },\n\t\t\t]);\n\t\t}\n\t\treturn undefined;\n\t}\n\n\tconst result = await target.options['~standard'].validate(options);\n\tif (result.issues) throw new InvalidTargetOptions(name, result.issues);\n\treturn result.value;\n}\n"],"mappings":";;;;;;;;;;;;;;AA4BA,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CACA;CAHV,YACC,QACA,aACA,MACC;EACD,MACC,kBAAkB,OAAO,sBAAsB,YAAY,+BAA+B,KAAK,8CAA8C,aAC9I;EANS,KAAA,SAAA;EACA,KAAA,cAAA;EACA,KAAA,OAAA;EAKT,KAAK,OAAO;CACb;AACD;;;;;;AAOA,SAAgB,cACf,MACA,MAC6B;CAC7B,IAAI,MAAM;CACV,OAAO,MAAM;EACZ,MAAM,eAAe,KAAK,KAAK,gBAAgB,MAAM,cAAc;EACnE,IAAI,WAAW,YAAY,GAC1B,OAAO;GACN,KAAK,aAAa,QAAQ,YAAY,CAAC;GACvC,UAAU,KAAK,MACd,aAAa,cAAc,OAAO,CACnC;EACD;EAED,MAAM,SAAS,QAAQ,GAAG;EAC1B,IAAI,WAAW,KAAK,OAAO,KAAA;EAC3B,MAAM;CACP;AACD;;AAGA,SAAS,KAAK,MAAmC;CAChD,IAAI,OAAO,SAAS,UAAU,OAAO;CACrC,IAAI,MAAM,QAAQ,IAAI,GAAG;EACxB,KAAK,MAAM,UAAU,MAAM;GAC1B,MAAM,QAAQ,KAAK,MAAM;GACzB,IAAI,OAAO,OAAO;EACnB;EACA;CACD;CACA,IAAI,QAAQ,OAAO,SAAS,UAAU;EACrC,MAAM,aAAa;EACnB,KAAK,MAAM,aAAa;GAAC;GAAU;GAAQ;GAAW;EAAS,GAC9D,IAAI,aAAa,YAAY;GAC5B,MAAM,QAAQ,KAAK,WAAW,UAAU;GACxC,IAAI,OAAO,OAAO;EACnB;CAEF;AAED;;AAGA,SAAgB,aAAa,UAAyC;CACrE,MAAM,EAAE,YAAY;CACpB,IAAI,OAAgB;CACpB,IAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GACtD;MAAA,OAAO,KAAK,OAGlB,CAAC,CAAC,MAAM,QAAQ,IAAI,WAAW,GAAG,CAAC,GACzC,OAAQ,QAAoC;CAAA;CAG9C,OAAO,KAAK,IAAI,KAAK,SAAS,UAAU,SAAS,QAAQ;AAC1D;;AAGA,eAAsB,cACrB,QACA,MACA,MACmC;CACnC,MAAM,UAAU,cAAc,MAAM,IAAI;CACxC,IAAI,CAAC,SAAS,MAAM,IAAI,sBAAsB,QAAQ,MAAM,IAAI;CAEhE,MAAM,QAAQ,KAAK,QAAQ,KAAK,aAAa,QAAQ,QAAQ,CAAC;CAC9D,OAAQ,MAAM,OAAO,cAAc,KAAK,CAAC,CAAC;AAC3C;;;;;;;;;;;;;;;;;AC3FA,MAAM,WAAqC,CAAC,UAAU,KAAK;;AAG3D,IAAa,0BAAb,cAA6C,MAAM;CAExC;CACA;CAEA;CAJV,YACC,QACA,aAEA,OACC;EACD,MACC,sBAAsB,OAAO,KAAK,YAAY,gCAAgC,UAAU,KAAA,IAAY,KAAK,oBAAoB,KAAK,UAAU,KAAK,EAAE,GAAG,mIACvJ;EAPS,KAAA,SAAA;EACA,KAAA,cAAA;EAEA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAYA,SAAgB,gBACf,QACA,aACA,MACgB;CAChB,MAAM,UAAU,OAAO,cAAc,aAAa,IAAI,IAAI,KAAA;CAC1D,IAAI,CAAC,SACJ,MAAM,IAAI,sBACT,QACA,aACA,QAAQ,eACT;CAED,MAAM,UAAU,QAAQ,SAAS,KAAK;CACtC,IAAI,CAAC,SAAS,SAAS,OAAwB,GAC9C,MAAM,IAAI,wBAAwB,QAAQ,aAAa,OAAO;CAE/D,OAAO;AACR;;AAGA,SAAgB,UACf,MACA,WACgB;CAChB,MAAM,UAAU,cAAc,IAAI;CAClC,IAAI,SAAS,OAAO,QAAQ;CAE5B,MAAM,QAAQ,iBAAiB,UAAU,QAAQ,IAAI;CACrD,IAAI,UAAU,KAAA,GACb,MAAM,IAAI,oBAAoB,MAAM,CACnC,GAAG,qBAAqB,GACxB,GAAG,OAAO,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,CAC/C,CAAC;CAGF,MAAM,iBAAiB,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;CACzD,OAAO,OAAO,mBAAmB,WAC9B,gBAAgB,MAAM,gBAAgB,UAAU,IAAI,IACnD,eAA8C;AACnD;;;;;;;;;;;;;;;;;;;;;AC/BA,IAAa,uBAAb,cAA0C,MAAM;CAErC;CACA;CAFV,YACC,QACA,aACC;EACD,MACC,kBAAkB,OAAO,UAAU,YAAY,0JAChD;EALS,KAAA,SAAA;EACA,KAAA,cAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CACxB;CAArB,YAAY,QAAyB;EACpC,MACC,kBAAkB,OAAO,0FAC1B;EAHoB,KAAA,SAAA;EAIpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CACA;CACA;CAJV,YACC,QACA,aACA,UACA,QACC;EACD,MACC,sBAAsB,OAAO,aAAa,OAAO,SAAS,YAAY,wCAAwC,SAAS,+CAA+C,SAAS,4CAChL;EAPS,KAAA,SAAA;EACA,KAAA,cAAA;EACA,KAAA,WAAA;EACA,KAAA,SAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,uBAAb,cAA0C,MAAM;CAErC;CACA;CAFV,YACC,QACA,QACC;EACD,MAAM,QAAQ,OAAO,KAAK,UAAU;GACnC,MAAM,QAAQ,MAAM,QAAQ,CAAC,EAAA,CAC3B,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,OAAO,OAAO,OAAO,GAAG,KAAK,MAAM,KAAK,MAAM;EAC/C,CAAC;EACD,MACC,kCAAkC,OAAO,6CAA6C,OAAO,sBAAsB,MAAM,KAAK,IAAI,GACnI;EAbS,KAAA,SAAA;EACA,KAAA,SAAA;EAaT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,kBAAkE;CACvE,SAAS,aAAa,MAAM,OAAO,0BAAA,CAAc;CACjD,SAAS,aAAa,MAAM,OAAO,yBAAkB,CAAA,MAAA,MAAA,EAAA,CAAA,EAAA,CAAE,cAAc;CACrE,KAAK,aAAa,MAAM,OAAO,qBAAc,CAAA,MAAA,MAAA,EAAA,CAAA,EAAA,CAAE;AAChD;;AAGA,eAAsB,cACrB,MACA,EAAE,WAAW,MAAM,SACO;CAC1B,IAAI,QAAQ,OAAO,OAAO,MAAM,IAAI,GACnC,OAAO;EAAE;EAAM,QAAQ,KAAK;EAAQ,QAAQ;EAAQ,SAAS,KAAA;CAAU;CAGxE,MAAM,UAAU,cAAc,IAAI;CAClC,IAAI,SAAS;EACZ,MAAM,OAAO,gBAAgB;EAC7B,IAAI,QAAQ,WAAW,eAAe,CAAC,MACtC,MAAM,IAAI,4BAA4B,MAAM,QAAQ,UAAU,KAAK,CAAC;EAErE,OAAO;GACN;GACA,QAAQ,MAAM,KAAK;GACnB,QAAQ;GACR,SAAS,KAAA;EACV;CACD;CAEA,MAAM,QAAQ,iBAAiB,UAAU,QAAQ,IAAI;CACrD,IAAI,UAAU,KAAA,GACb,MAAM,IAAI,oBAAoB,MAAM,CACnC,GAAG,qBAAqB,GACxB,GAAG,OAAO,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,CAC/C,CAAC;CAGF,MAAM,CAAC,gBAAgB,WAAW,MAAM,QAAQ,KAAK,IACjD,QACD,CAAC,OAAO,KAAA,CAAS;CAEpB,IAAI,OAAO,mBAAmB,UAAU;EAGvC,MAAM,WAAW,gBAAgB,MAAM,gBAAgB,UAAU,IAAI;EAErE,MAAM,UAAS,MADM,cAAc,MAAM,gBAAgB,UAAU,IAAI,EAAA,CACjD;EACtB,IAAI,CAAC,eAAe,MAAM,GACzB,MAAM,IAAI,qBAAqB,MAAM,cAAc;EAEpD,IAAI,OAAO,YAAY,UACtB,MAAM,IAAI,sBACT,MACA,gBACA,UACA,OAAO,OACR;EAED,OAAO;GAAE;GAAM;GAAQ,QAAQ;GAAU;EAAQ;CAClD;CAEA,IAAI,CAAC,eAAe,cAAc,GAAG,MAAM,IAAI,mBAAmB,IAAI;CACtE,OAAO;EAAE;EAAM,QAAQ;EAAgB,QAAQ;EAAU;CAAQ;AAClE;;AAGA,eAAsB,mBACrB,UACmB;CACnB,MAAM,EAAE,MAAM,QAAQ,YAAY;CAClC,IAAI,CAAC,OAAO,SAAS;EACpB,IAAI,YAAY,KAAA,GACf,MAAM,IAAI,qBAAqB,MAAM,CACpC,EAAE,SAAS,+BAA+B,CAC3C,CAAC;EAEF;CACD;CAEA,MAAM,SAAS,MAAM,OAAO,QAAQ,YAAY,CAAC,SAAS,OAAO;CACjE,IAAI,OAAO,QAAQ,MAAM,IAAI,qBAAqB,MAAM,OAAO,MAAM;CACrE,OAAO,OAAO;AACf"}

package/dist/resolve-N_i4XNd-.cjs

@@ -0,0 +1,315 @@
+const require_define = require("./define-DzRz8FgH.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_url = require("node:url");
+//#region src/target/package.ts
+/**
+* A target package, found the way the project would find it.
+*
+* From the workspace root, never from the CLI's own location or the process's
+* working directory: the package is the project's dependency, and a CLI run
+* through `pnpm dlx` — or a host deploying a checkout elsewhere — has neither
+* in common with the project.
+*/
+/** A target package the project does not have installed. */
+var TargetPackageNotFound = class extends Error {
+	target;
+	packageName;
+	from;
+	constructor(target, packageName, from) {
+		super(`deploy.targets.${target} names the package "${packageName}", which is not installed in ${from}. Add it to the workspace root: pnpm add -D ${packageName}`);
+		this.target = target;
+		this.packageName = packageName;
+		this.from = from;
+		this.name = "TargetPackageNotFound";
+	}
+};
+/**
+* `name`'s directory and `package.json`, from the nearest `node_modules` at
+* or above `from` — Node's own lookup, without the exports map getting in
+* the way of reading `package.json`.
+*/
+function locatePackage(name, from) {
+	let dir = from;
+	while (true) {
+		const manifestPath = (0, node_path.join)(dir, "node_modules", name, "package.json");
+		if ((0, node_fs.existsSync)(manifestPath)) return {
+			dir: (0, node_fs.realpathSync)((0, node_path.dirname)(manifestPath)),
+			manifest: JSON.parse((0, node_fs.readFileSync)(manifestPath, "utf-8"))
+		};
+		const parent = (0, node_path.dirname)(dir);
+		if (parent === dir) return void 0;
+		dir = parent;
+	}
+}
+/** The first file a conditions object leads to, as an `import` would. */
+function pick(node) {
+	if (typeof node === "string") return node;
+	if (Array.isArray(node)) {
+		for (const option of node) {
+			const found = pick(option);
+			if (found) return found;
+		}
+		return;
+	}
+	if (node && typeof node === "object") {
+		const conditions = node;
+		for (const condition of [
+			"import",
+			"node",
+			"default",
+			"require"
+		]) if (condition in conditions) {
+			const found = pick(conditions[condition]);
+			if (found) return found;
+		}
+	}
+}
+/** The file `import(name)` loads, relative to the package directory. */
+function packageEntry(manifest) {
+	const { exports } = manifest;
+	let root = exports;
+	if (exports && typeof exports === "object" && !Array.isArray(exports)) {
+		if (Object.keys(exports).some((key) => key.startsWith("."))) root = exports["."];
+	}
+	return pick(root) ?? manifest.module ?? manifest.main ?? "index.js";
+}
+/** The module `name` is, imported from where the project would import it. */
+async function importPackage(target, name, from) {
+	const located = locatePackage(name, from);
+	if (!located) throw new TargetPackageNotFound(target, name, from);
+	const entry = (0, node_path.join)(located.dir, packageEntry(located.manifest));
+	return await import((0, node_url.pathToFileURL)(entry).href);
+}
+//#endregion
+//#region src/target/runtime.ts
+/**
+* A target's runtime, without loading the target.
+*
+* `gkm dev` and `gkm build` choose a project's backends by it on every start,
+* synchronously, and must not import a deploy plugin to do so — a plugin may
+* pull in a cloud SDK, and a broken one would stop `gkm dev` for a project
+* that is only being developed. So a built-in's runtime is in the table, an
+* inline target carries its own, and a package declares it in its
+* `package.json`:
+*
+* ```json
+* { "name": "@acme/gkm-target", "gkm": { "runtime": "server" } }
+* ```
+*/
+const RUNTIMES = ["server", "aws"];
+/** A target package whose `package.json` does not say where it runs. */
+var TargetRuntimeUndeclared = class extends Error {
+	target;
+	packageName;
+	found;
+	constructor(target, packageName, found) {
+		super(`The deploy target "${target}" (${packageName}) does not declare its runtime${found === void 0 ? "" : ` (gkm.runtime is ${JSON.stringify(found)})`}. Its package.json needs "gkm": { "runtime": "server" } or "aws", so gkm dev and gkm build can choose backends without loading it.`);
+		this.target = target;
+		this.packageName = packageName;
+		this.found = found;
+		this.name = "TargetRuntimeUndeclared";
+	}
+};
+/** The runtime a target package declares in `package.json#gkm.runtime`. */
+function declaredRuntime(target, packageName, root) {
+	const located = root ? locatePackage(packageName, root) : void 0;
+	if (!located) throw new TargetPackageNotFound(target, packageName, root ?? "the workspace");
+	const runtime = located.manifest.gkm?.runtime;
+	if (!RUNTIMES.includes(runtime)) throw new TargetRuntimeUndeclared(target, packageName, runtime);
+	return runtime;
+}
+/** The runtime of the target `name`, as the workspace resolves it. */
+function runtimeOf(name, workspace) {
+	const builtin = require_define.builtinTarget(name);
+	if (builtin) return builtin.runtime;
+	const entry = require_define.configuredTarget(workspace.deploy, name);
+	if (entry === void 0) throw new require_define.UnknownDeployTarget(name, [...require_define.configurableBuiltins(), ...Object.keys(workspace.deploy?.targets ?? {})]);
+	const implementation = Array.isArray(entry) ? entry[0] : entry;
+	return typeof implementation === "string" ? declaredRuntime(name, implementation, workspace.root) : implementation.runtime;
+}
+//#endregion
+//#region src/target/resolve.ts
+/**
+* From a target's name to the target.
+*
+* In this order, the first that has the name wins:
+*
+* 1. the host's own targets — what a program calling `deploy()` passes
+* 2. the built-ins — `dokploy`, `compose`, `sst`
+* 3. `deploy.targets` in gkm.config.ts — a package, an object, or either
+*    with options
+*
+* Built-ins come before the config so that a dependency cannot take over
+* `dokploy` by being listed under its name. A name nothing has is
+* `UnknownDeployTarget`. There is deliberately no fourth step that guesses a
+* package from the name (`acme` → `@acme/gkm-target`): an npm scope nobody
+* has claimed can be claimed by anyone, and a deploy would then run their
+* code with the stage's credentials. A target is installed and named.
+*/
+/** A target package whose default export is not a target. */
+var TargetPackageInvalid = class extends Error {
+	target;
+	packageName;
+	constructor(target, packageName) {
+		super(`deploy.targets.${target} names "${packageName}", whose default export is not a deploy target. A target package exports one as default: export default defineTarget({ … }) from '@geekmidas/cli/target'.`);
+		this.target = target;
+		this.packageName = packageName;
+		this.name = "TargetPackageInvalid";
+	}
+};
+/** A `deploy.targets` entry that is not a target, a package name or a pair. */
+var TargetEntryInvalid = class extends Error {
+	target;
+	constructor(target) {
+		super(`deploy.targets.${target} must be a package name, a target object (defineTarget), or [package or target, options].`);
+		this.target = target;
+		this.name = "TargetEntryInvalid";
+	}
+};
+/** A target whose `runtime` is not the one its package declares. */
+var TargetRuntimeMismatch = class extends Error {
+	target;
+	packageName;
+	declared;
+	actual;
+	constructor(target, packageName, declared, actual) {
+		super(`The deploy target "${target}" runs on "${actual}", but ${packageName}'s package.json declares gkm.runtime "${declared}". gkm dev and gkm build chose backends for "${declared}", so the two must agree — fix the package.`);
+		this.target = target;
+		this.packageName = packageName;
+		this.declared = declared;
+		this.actual = actual;
+		this.name = "TargetRuntimeMismatch";
+	}
+};
+/** Options a target's schema rejected. */
+var InvalidTargetOptions = class extends Error {
+	target;
+	issues;
+	constructor(target, issues) {
+		const lines = issues.map((issue) => {
+			const path = (issue.path ?? []).map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".");
+			return `  - ${path ? `${path}: ` : ""}${issue.message}`;
+		});
+		super(`The options for deploy target "${target}" are invalid — fix them in deploy.targets.${target} in gkm.config.ts:\n${lines.join("\n")}`);
+		this.target = target;
+		this.issues = issues;
+		this.name = "InvalidTargetOptions";
+	}
+};
+/** The built-ins `gkm deploy` deploys through, loaded only when used. */
+const BUILTIN_LOADERS = {
+	dokploy: async () => (await Promise.resolve().then(() => require("./dokploy-iFY8MY-L.cjs"))).dokployTarget,
+	compose: async () => (await Promise.resolve().then(() => require("./compose-391oEKj1.cjs")).then((n) => n.compose_exports)).composeTarget(),
+	sst: async () => (await Promise.resolve().then(() => require("./sst-DcfsVH6x.cjs")).then((n) => n.sst_exports)).sstTarget
+};
+/** The target `name` means, in this workspace, for this host. */
+async function resolveTarget(name, { workspace, host, stage }) {
+	if (host && Object.hasOwn(host, name)) return {
+		name,
+		target: host[name],
+		source: "host",
+		options: void 0
+	};
+	const builtin = require_define.builtinTarget(name);
+	if (builtin) {
+		const load = BUILTIN_LOADERS[name];
+		if (builtin.status !== "available" || !load) throw new require_define.DeployTargetNotYetSupported(name, builtin.instead?.(stage));
+		return {
+			name,
+			target: await load(),
+			source: "builtin",
+			options: void 0
+		};
+	}
+	const entry = require_define.configuredTarget(workspace.deploy, name);
+	if (entry === void 0) throw new require_define.UnknownDeployTarget(name, [...require_define.configurableBuiltins(), ...Object.keys(workspace.deploy?.targets ?? {})]);
+	const [implementation, options] = Array.isArray(entry) ? entry : [entry, void 0];
+	if (typeof implementation === "string") {
+		const declared = declaredRuntime(name, implementation, workspace.root);
+		const target = (await importPackage(name, implementation, workspace.root)).default;
+		if (!require_define.isDeployTarget(target)) throw new TargetPackageInvalid(name, implementation);
+		if (target.runtime !== declared) throw new TargetRuntimeMismatch(name, implementation, declared, target.runtime);
+		return {
+			name,
+			target,
+			source: "config",
+			options
+		};
+	}
+	if (!require_define.isDeployTarget(implementation)) throw new TargetEntryInvalid(name);
+	return {
+		name,
+		target: implementation,
+		source: "config",
+		options
+	};
+}
+/** The target's options, parsed by its schema. */
+async function parseTargetOptions(resolved) {
+	const { name, target, options } = resolved;
+	if (!target.options) {
+		if (options !== void 0) throw new InvalidTargetOptions(name, [{ message: "this target takes no options" }]);
+		return;
+	}
+	const result = await target.options["~standard"].validate(options);
+	if (result.issues) throw new InvalidTargetOptions(name, result.issues);
+	return result.value;
+}
+//#endregion
+Object.defineProperty(exports, "InvalidTargetOptions", {
+	enumerable: true,
+	get: function() {
+		return InvalidTargetOptions;
+	}
+});
+Object.defineProperty(exports, "TargetEntryInvalid", {
+	enumerable: true,
+	get: function() {
+		return TargetEntryInvalid;
+	}
+});
+Object.defineProperty(exports, "TargetPackageInvalid", {
+	enumerable: true,
+	get: function() {
+		return TargetPackageInvalid;
+	}
+});
+Object.defineProperty(exports, "TargetPackageNotFound", {
+	enumerable: true,
+	get: function() {
+		return TargetPackageNotFound;
+	}
+});
+Object.defineProperty(exports, "TargetRuntimeMismatch", {
+	enumerable: true,
+	get: function() {
+		return TargetRuntimeMismatch;
+	}
+});
+Object.defineProperty(exports, "TargetRuntimeUndeclared", {
+	enumerable: true,
+	get: function() {
+		return TargetRuntimeUndeclared;
+	}
+});
+Object.defineProperty(exports, "parseTargetOptions", {
+	enumerable: true,
+	get: function() {
+		return parseTargetOptions;
+	}
+});
+Object.defineProperty(exports, "resolveTarget", {
+	enumerable: true,
+	get: function() {
+		return resolveTarget;
+	}
+});
+Object.defineProperty(exports, "runtimeOf", {
+	enumerable: true,
+	get: function() {
+		return runtimeOf;
+	}
+});
+
+//# sourceMappingURL=resolve-N_i4XNd-.cjs.map

package/dist/resolve-N_i4XNd-.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-N_i4XNd-.cjs","names":["join","existsSync","realpathSync","dirname","readFileSync","pathToFileURL","builtinTarget","configuredTarget","UnknownDeployTarget","configurableBuiltins","builtinTarget","DeployTargetNotYetSupported","configuredTarget","UnknownDeployTarget","configurableBuiltins","isDeployTarget"],"sources":["../src/target/package.ts","../src/target/runtime.ts","../src/target/resolve.ts"],"sourcesContent":["/**\n * A target package, found the way the project would find it.\n *\n * From the workspace root, never from the CLI's own location or the process's\n * working directory: the package is the project's dependency, and a CLI run\n * through `pnpm dlx` — or a host deploying a checkout elsewhere — has neither\n * in common with the project.\n */\n\nimport { existsSync, readFileSync, realpathSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\nexport interface TargetPackageManifest {\n\tname?: string;\n\tmain?: string;\n\tmodule?: string;\n\texports?: unknown;\n\tgkm?: { runtime?: unknown };\n}\n\nexport interface LocatedPackage {\n\t/** The package's directory, symlinks resolved. */\n\tdir: string;\n\tmanifest: TargetPackageManifest;\n}\n\n/** A target package the project does not have installed. */\nexport class TargetPackageNotFound extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t\treadonly from: string,\n\t) {\n\t\tsuper(\n\t\t\t`deploy.targets.${target} names the package \"${packageName}\", which is not installed in ${from}. Add it to the workspace root: pnpm add -D ${packageName}`,\n\t\t);\n\t\tthis.name = 'TargetPackageNotFound';\n\t}\n}\n\n/**\n * `name`'s directory and `package.json`, from the nearest `node_modules` at\n * or above `from` — Node's own lookup, without the exports map getting in\n * the way of reading `package.json`.\n */\nexport function locatePackage(\n\tname: string,\n\tfrom: string,\n): LocatedPackage | undefined {\n\tlet dir = from;\n\twhile (true) {\n\t\tconst manifestPath = join(dir, 'node_modules', name, 'package.json');\n\t\tif (existsSync(manifestPath)) {\n\t\t\treturn {\n\t\t\t\tdir: realpathSync(dirname(manifestPath)),\n\t\t\t\tmanifest: JSON.parse(\n\t\t\t\t\treadFileSync(manifestPath, 'utf-8'),\n\t\t\t\t) as TargetPackageManifest,\n\t\t\t};\n\t\t}\n\t\tconst parent = dirname(dir);\n\t\tif (parent === dir) return undefined;\n\t\tdir = parent;\n\t}\n}\n\n/** The first file a conditions object leads to, as an `import` would. */\nfunction pick(node: unknown): string | undefined {\n\tif (typeof node === 'string') return node;\n\tif (Array.isArray(node)) {\n\t\tfor (const option of node) {\n\t\t\tconst found = pick(option);\n\t\t\tif (found) return found;\n\t\t}\n\t\treturn undefined;\n\t}\n\tif (node && typeof node === 'object') {\n\t\tconst conditions = node as Record<string, unknown>;\n\t\tfor (const condition of ['import', 'node', 'default', 'require']) {\n\t\t\tif (condition in conditions) {\n\t\t\t\tconst found = pick(conditions[condition]);\n\t\t\t\tif (found) return found;\n\t\t\t}\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** The file `import(name)` loads, relative to the package directory. */\nexport function packageEntry(manifest: TargetPackageManifest): string {\n\tconst { exports } = manifest;\n\tlet root: unknown = exports;\n\tif (exports && typeof exports === 'object' && !Array.isArray(exports)) {\n\t\tconst keys = Object.keys(exports);\n\t\t// A subpath map — `{ \".\": …, \"./x\": … }` — rather than one conditions\n\t\t// object for the root.\n\t\tif (keys.some((key) => key.startsWith('.'))) {\n\t\t\troot = (exports as Record<string, unknown>)['.'];\n\t\t}\n\t}\n\treturn pick(root) ?? manifest.module ?? manifest.main ?? 'index.js';\n}\n\n/** The module `name` is, imported from where the project would import it. */\nexport async function importPackage(\n\ttarget: string,\n\tname: string,\n\tfrom: string,\n): Promise<Record<string, unknown>> {\n\tconst located = locatePackage(name, from);\n\tif (!located) throw new TargetPackageNotFound(target, name, from);\n\n\tconst entry = join(located.dir, packageEntry(located.manifest));\n\treturn (await import(pathToFileURL(entry).href)) as Record<string, unknown>;\n}\n","/**\n * A target's runtime, without loading the target.\n *\n * `gkm dev` and `gkm build` choose a project's backends by it on every start,\n * synchronously, and must not import a deploy plugin to do so — a plugin may\n * pull in a cloud SDK, and a broken one would stop `gkm dev` for a project\n * that is only being developed. So a built-in's runtime is in the table, an\n * inline target carries its own, and a package declares it in its\n * `package.json`:\n *\n * ```json\n * { \"name\": \"@acme/gkm-target\", \"gkm\": { \"runtime\": \"server\" } }\n * ```\n */\n\nimport {\n\tbuiltinTarget,\n\tconfigurableBuiltins,\n\tconfiguredTarget,\n\tUnknownDeployTarget,\n} from './builtins';\nimport { locatePackage, TargetPackageNotFound } from './package';\nimport type { DeployRuntime, DeployTargetEntry } from './types';\n\nconst RUNTIMES: readonly DeployRuntime[] = ['server', 'aws'];\n\n/** A target package whose `package.json` does not say where it runs. */\nexport class TargetRuntimeUndeclared extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t\t/** What `gkm.runtime` held instead, when it held anything. */\n\t\treadonly found?: unknown,\n\t) {\n\t\tsuper(\n\t\t\t`The deploy target \"${target}\" (${packageName}) does not declare its runtime${found === undefined ? '' : ` (gkm.runtime is ${JSON.stringify(found)})`}. Its package.json needs \"gkm\": { \"runtime\": \"server\" } or \"aws\", so gkm dev and gkm build can choose backends without loading it.`,\n\t\t);\n\t\tthis.name = 'TargetRuntimeUndeclared';\n\t}\n}\n\n/** What a workspace's deploy config is read for here. */\nexport interface TargetSource {\n\t/** Where the target packages are installed from. */\n\troot?: string;\n\tdeploy?:\n\t\t| { default?: string; targets?: Record<string, DeployTargetEntry> }\n\t\t| undefined;\n}\n\n/** The runtime a target package declares in `package.json#gkm.runtime`. */\nexport function declaredRuntime(\n\ttarget: string,\n\tpackageName: string,\n\troot: string | undefined,\n): DeployRuntime {\n\tconst located = root ? locatePackage(packageName, root) : undefined;\n\tif (!located) {\n\t\tthrow new TargetPackageNotFound(\n\t\t\ttarget,\n\t\t\tpackageName,\n\t\t\troot ?? 'the workspace',\n\t\t);\n\t}\n\tconst runtime = located.manifest.gkm?.runtime;\n\tif (!RUNTIMES.includes(runtime as DeployRuntime)) {\n\t\tthrow new TargetRuntimeUndeclared(target, packageName, runtime);\n\t}\n\treturn runtime as DeployRuntime;\n}\n\n/** The runtime of the target `name`, as the workspace resolves it. */\nexport function runtimeOf(\n\tname: string,\n\tworkspace: TargetSource,\n): DeployRuntime {\n\tconst builtin = builtinTarget(name);\n\tif (builtin) return builtin.runtime;\n\n\tconst entry = configuredTarget(workspace.deploy, name);\n\tif (entry === undefined) {\n\t\tthrow new UnknownDeployTarget(name, [\n\t\t\t...configurableBuiltins(),\n\t\t\t...Object.keys(workspace.deploy?.targets ?? {}),\n\t\t]);\n\t}\n\n\tconst implementation = Array.isArray(entry) ? entry[0] : entry;\n\treturn typeof implementation === 'string'\n\t\t? declaredRuntime(name, implementation, workspace.root)\n\t\t: (implementation as { runtime: DeployRuntime }).runtime;\n}\n","/**\n * From a target's name to the target.\n *\n * In this order, the first that has the name wins:\n *\n * 1. the host's own targets — what a program calling `deploy()` passes\n * 2. the built-ins — `dokploy`, `compose`, `sst`\n * 3. `deploy.targets` in gkm.config.ts — a package, an object, or either\n *    with options\n *\n * Built-ins come before the config so that a dependency cannot take over\n * `dokploy` by being listed under its name. A name nothing has is\n * `UnknownDeployTarget`. There is deliberately no fourth step that guesses a\n * package from the name (`acme` → `@acme/gkm-target`): an npm scope nobody\n * has claimed can be claimed by anyone, and a deploy would then run their\n * code with the stage's credentials. A target is installed and named.\n */\n\nimport {\n\tbuiltinTarget,\n\tconfigurableBuiltins,\n\tconfiguredTarget,\n\tDeployTargetNotYetSupported,\n\tUnknownDeployTarget,\n} from './builtins';\nimport { isDeployTarget } from './define';\nimport { importPackage } from './package';\nimport { declaredRuntime } from './runtime';\nimport type {\n\tAnyDeployTarget,\n\tDeployRuntime,\n\tDeployTargetEntry,\n\tTargetOptionsIssue,\n} from './types';\n\n/** Where a target came from. */\nexport type TargetSourceKind = 'host' | 'builtin' | 'config';\n\nexport interface ResolvedTarget {\n\t/** The name it was asked for by. */\n\tname: string;\n\ttarget: AnyDeployTarget;\n\tsource: TargetSourceKind;\n\t/** Its options as written in the config, before its schema parsed them. */\n\toptions: unknown;\n}\n\nexport interface ResolveTargetOptions {\n\t/** The workspace whose `deploy.targets` is consulted. */\n\tworkspace: {\n\t\troot: string;\n\t\tdeploy?: { targets?: Record<string, DeployTargetEntry> } | undefined;\n\t};\n\t/** The host's targets, consulted first. */\n\thost?: Record<string, AnyDeployTarget>;\n\t/** The stage being deployed, for what to do instead of a refused target. */\n\tstage: string;\n}\n\n/** A target package whose default export is not a target. */\nexport class TargetPackageInvalid extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t) {\n\t\tsuper(\n\t\t\t`deploy.targets.${target} names \"${packageName}\", whose default export is not a deploy target. A target package exports one as default: export default defineTarget({ … }) from '@geekmidas/cli/target'.`,\n\t\t);\n\t\tthis.name = 'TargetPackageInvalid';\n\t}\n}\n\n/** A `deploy.targets` entry that is not a target, a package name or a pair. */\nexport class TargetEntryInvalid extends Error {\n\tconstructor(readonly target: string) {\n\t\tsuper(\n\t\t\t`deploy.targets.${target} must be a package name, a target object (defineTarget), or [package or target, options].`,\n\t\t);\n\t\tthis.name = 'TargetEntryInvalid';\n\t}\n}\n\n/** A target whose `runtime` is not the one its package declares. */\nexport class TargetRuntimeMismatch extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly packageName: string,\n\t\treadonly declared: DeployRuntime,\n\t\treadonly actual: DeployRuntime,\n\t) {\n\t\tsuper(\n\t\t\t`The deploy target \"${target}\" runs on \"${actual}\", but ${packageName}'s package.json declares gkm.runtime \"${declared}\". gkm dev and gkm build chose backends for \"${declared}\", so the two must agree — fix the package.`,\n\t\t);\n\t\tthis.name = 'TargetRuntimeMismatch';\n\t}\n}\n\n/** Options a target's schema rejected. */\nexport class InvalidTargetOptions extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\treadonly issues: readonly TargetOptionsIssue[],\n\t) {\n\t\tconst lines = issues.map((issue) => {\n\t\t\tconst path = (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.');\n\t\t\treturn `  - ${path ? `${path}: ` : ''}${issue.message}`;\n\t\t});\n\t\tsuper(\n\t\t\t`The options for deploy target \"${target}\" are invalid — fix them in deploy.targets.${target} in gkm.config.ts:\\n${lines.join('\\n')}`,\n\t\t);\n\t\tthis.name = 'InvalidTargetOptions';\n\t}\n}\n\n/** The built-ins `gkm deploy` deploys through, loaded only when used. */\nconst BUILTIN_LOADERS: Record<string, () => Promise<AnyDeployTarget>> = {\n\tdokploy: async () => (await import('./dokploy')).dokployTarget,\n\tcompose: async () => (await import('./compose/index')).composeTarget(),\n\tsst: async () => (await import('./sst/index')).sstTarget,\n};\n\n/** The target `name` means, in this workspace, for this host. */\nexport async function resolveTarget(\n\tname: string,\n\t{ workspace, host, stage }: ResolveTargetOptions,\n): Promise<ResolvedTarget> {\n\tif (host && Object.hasOwn(host, name)) {\n\t\treturn { name, target: host[name]!, source: 'host', options: undefined };\n\t}\n\n\tconst builtin = builtinTarget(name);\n\tif (builtin) {\n\t\tconst load = BUILTIN_LOADERS[name];\n\t\tif (builtin.status !== 'available' || !load) {\n\t\t\tthrow new DeployTargetNotYetSupported(name, builtin.instead?.(stage));\n\t\t}\n\t\treturn {\n\t\t\tname,\n\t\t\ttarget: await load(),\n\t\t\tsource: 'builtin',\n\t\t\toptions: undefined,\n\t\t};\n\t}\n\n\tconst entry = configuredTarget(workspace.deploy, name);\n\tif (entry === undefined) {\n\t\tthrow new UnknownDeployTarget(name, [\n\t\t\t...configurableBuiltins(),\n\t\t\t...Object.keys(workspace.deploy?.targets ?? {}),\n\t\t]);\n\t}\n\n\tconst [implementation, options] = Array.isArray(entry)\n\t\t? (entry as readonly [unknown, unknown])\n\t\t: [entry, undefined];\n\n\tif (typeof implementation === 'string') {\n\t\t// Before the import: a package that does not say where it runs is\n\t\t// refused without running any of its code.\n\t\tconst declared = declaredRuntime(name, implementation, workspace.root);\n\t\tconst loaded = await importPackage(name, implementation, workspace.root);\n\t\tconst target = loaded.default;\n\t\tif (!isDeployTarget(target)) {\n\t\t\tthrow new TargetPackageInvalid(name, implementation);\n\t\t}\n\t\tif (target.runtime !== declared) {\n\t\t\tthrow new TargetRuntimeMismatch(\n\t\t\t\tname,\n\t\t\t\timplementation,\n\t\t\t\tdeclared,\n\t\t\t\ttarget.runtime,\n\t\t\t);\n\t\t}\n\t\treturn { name, target, source: 'config', options };\n\t}\n\n\tif (!isDeployTarget(implementation)) throw new TargetEntryInvalid(name);\n\treturn { name, target: implementation, source: 'config', options };\n}\n\n/** The target's options, parsed by its schema. */\nexport async function parseTargetOptions(\n\tresolved: ResolvedTarget,\n): Promise<unknown> {\n\tconst { name, target, options } = resolved;\n\tif (!target.options) {\n\t\tif (options !== undefined) {\n\t\t\tthrow new InvalidTargetOptions(name, [\n\t\t\t\t{ message: 'this target takes no options' },\n\t\t\t]);\n\t\t}\n\t\treturn undefined;\n\t}\n\n\tconst result = await target.options['~standard'].validate(options);\n\tif (result.issues) throw new InvalidTargetOptions(name, result.issues);\n\treturn result.value;\n}\n"],"mappings":";;;;;;;;;;;;;;AA4BA,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CACA;CAHV,YACC,QACA,aACA,MACC;EACD,MACC,kBAAkB,OAAO,sBAAsB,YAAY,+BAA+B,KAAK,8CAA8C,aAC9I;EANS,KAAA,SAAA;EACA,KAAA,cAAA;EACA,KAAA,OAAA;EAKT,KAAK,OAAO;CACb;AACD;;;;;;AAOA,SAAgB,cACf,MACA,MAC6B;CAC7B,IAAI,MAAM;CACV,OAAO,MAAM;EACZ,MAAM,gBAAA,GAAeA,UAAAA,KAAAA,CAAK,KAAK,gBAAgB,MAAM,cAAc;EACnE,KAAA,GAAIC,QAAAA,WAAAA,CAAW,YAAY,GAC1B,OAAO;GACN,MAAA,GAAKC,QAAAA,aAAAA,EAAAA,GAAaC,UAAAA,QAAAA,CAAQ,YAAY,CAAC;GACvC,UAAU,KAAK,OAAA,GACdC,QAAAA,aAAAA,CAAa,cAAc,OAAO,CACnC;EACD;EAED,MAAM,UAAA,GAASD,UAAAA,QAAAA,CAAQ,GAAG;EAC1B,IAAI,WAAW,KAAK,OAAO,KAAA;EAC3B,MAAM;CACP;AACD;;AAGA,SAAS,KAAK,MAAmC;CAChD,IAAI,OAAO,SAAS,UAAU,OAAO;CACrC,IAAI,MAAM,QAAQ,IAAI,GAAG;EACxB,KAAK,MAAM,UAAU,MAAM;GAC1B,MAAM,QAAQ,KAAK,MAAM;GACzB,IAAI,OAAO,OAAO;EACnB;EACA;CACD;CACA,IAAI,QAAQ,OAAO,SAAS,UAAU;EACrC,MAAM,aAAa;EACnB,KAAK,MAAM,aAAa;GAAC;GAAU;GAAQ;GAAW;EAAS,GAC9D,IAAI,aAAa,YAAY;GAC5B,MAAM,QAAQ,KAAK,WAAW,UAAU;GACxC,IAAI,OAAO,OAAO;EACnB;CAEF;AAED;;AAGA,SAAgB,aAAa,UAAyC;CACrE,MAAM,EAAE,YAAY;CACpB,IAAI,OAAgB;CACpB,IAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GACtD;MAAA,OAAO,KAAK,OAGlB,CAAC,CAAC,MAAM,QAAQ,IAAI,WAAW,GAAG,CAAC,GACzC,OAAQ,QAAoC;CAAA;CAG9C,OAAO,KAAK,IAAI,KAAK,SAAS,UAAU,SAAS,QAAQ;AAC1D;;AAGA,eAAsB,cACrB,QACA,MACA,MACmC;CACnC,MAAM,UAAU,cAAc,MAAM,IAAI;CACxC,IAAI,CAAC,SAAS,MAAM,IAAI,sBAAsB,QAAQ,MAAM,IAAI;CAEhE,MAAM,SAAA,GAAQH,UAAAA,KAAAA,CAAK,QAAQ,KAAK,aAAa,QAAQ,QAAQ,CAAC;CAC9D,OAAQ,MAAM,QAAA,GAAOK,SAAAA,cAAAA,CAAc,KAAK,CAAC,CAAC;AAC3C;;;;;;;;;;;;;;;;;AC3FA,MAAM,WAAqC,CAAC,UAAU,KAAK;;AAG3D,IAAa,0BAAb,cAA6C,MAAM;CAExC;CACA;CAEA;CAJV,YACC,QACA,aAEA,OACC;EACD,MACC,sBAAsB,OAAO,KAAK,YAAY,gCAAgC,UAAU,KAAA,IAAY,KAAK,oBAAoB,KAAK,UAAU,KAAK,EAAE,GAAG,mIACvJ;EAPS,KAAA,SAAA;EACA,KAAA,cAAA;EAEA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAYA,SAAgB,gBACf,QACA,aACA,MACgB;CAChB,MAAM,UAAU,OAAO,cAAc,aAAa,IAAI,IAAI,KAAA;CAC1D,IAAI,CAAC,SACJ,MAAM,IAAI,sBACT,QACA,aACA,QAAQ,eACT;CAED,MAAM,UAAU,QAAQ,SAAS,KAAK;CACtC,IAAI,CAAC,SAAS,SAAS,OAAwB,GAC9C,MAAM,IAAI,wBAAwB,QAAQ,aAAa,OAAO;CAE/D,OAAO;AACR;;AAGA,SAAgB,UACf,MACA,WACgB;CAChB,MAAM,UAAUC,eAAAA,cAAc,IAAI;CAClC,IAAI,SAAS,OAAO,QAAQ;CAE5B,MAAM,QAAQC,eAAAA,iBAAiB,UAAU,QAAQ,IAAI;CACrD,IAAI,UAAU,KAAA,GACb,MAAM,IAAIC,eAAAA,oBAAoB,MAAM,CACnC,GAAGC,eAAAA,qBAAqB,GACxB,GAAG,OAAO,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,CAC/C,CAAC;CAGF,MAAM,iBAAiB,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;CACzD,OAAO,OAAO,mBAAmB,WAC9B,gBAAgB,MAAM,gBAAgB,UAAU,IAAI,IACnD,eAA8C;AACnD;;;;;;;;;;;;;;;;;;;;;AC/BA,IAAa,uBAAb,cAA0C,MAAM;CAErC;CACA;CAFV,YACC,QACA,aACC;EACD,MACC,kBAAkB,OAAO,UAAU,YAAY,0JAChD;EALS,KAAA,SAAA;EACA,KAAA,cAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CACxB;CAArB,YAAY,QAAyB;EACpC,MACC,kBAAkB,OAAO,0FAC1B;EAHoB,KAAA,SAAA;EAIpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CACA;CACA;CAJV,YACC,QACA,aACA,UACA,QACC;EACD,MACC,sBAAsB,OAAO,aAAa,OAAO,SAAS,YAAY,wCAAwC,SAAS,+CAA+C,SAAS,4CAChL;EAPS,KAAA,SAAA;EACA,KAAA,cAAA;EACA,KAAA,WAAA;EACA,KAAA,SAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,uBAAb,cAA0C,MAAM;CAErC;CACA;CAFV,YACC,QACA,QACC;EACD,MAAM,QAAQ,OAAO,KAAK,UAAU;GACnC,MAAM,QAAQ,MAAM,QAAQ,CAAC,EAAA,CAC3B,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,OAAO,OAAO,OAAO,GAAG,KAAK,MAAM,KAAK,MAAM;EAC/C,CAAC;EACD,MACC,kCAAkC,OAAO,6CAA6C,OAAO,sBAAsB,MAAM,KAAK,IAAI,GACnI;EAbS,KAAA,SAAA;EACA,KAAA,SAAA;EAaT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,kBAAkE;CACvE,SAAS,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,EAAA,CAAqB;CACjD,SAAS,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,eAAA,EAAA,CAA2B,cAAc;CACrE,KAAK,aAAa,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,oBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,WAAA,EAAA,CAAuB;AAChD;;AAGA,eAAsB,cACrB,MACA,EAAE,WAAW,MAAM,SACO;CAC1B,IAAI,QAAQ,OAAO,OAAO,MAAM,IAAI,GACnC,OAAO;EAAE;EAAM,QAAQ,KAAK;EAAQ,QAAQ;EAAQ,SAAS,KAAA;CAAU;CAGxE,MAAM,UAAUC,eAAAA,cAAc,IAAI;CAClC,IAAI,SAAS;EACZ,MAAM,OAAO,gBAAgB;EAC7B,IAAI,QAAQ,WAAW,eAAe,CAAC,MACtC,MAAM,IAAIC,eAAAA,4BAA4B,MAAM,QAAQ,UAAU,KAAK,CAAC;EAErE,OAAO;GACN;GACA,QAAQ,MAAM,KAAK;GACnB,QAAQ;GACR,SAAS,KAAA;EACV;CACD;CAEA,MAAM,QAAQC,eAAAA,iBAAiB,UAAU,QAAQ,IAAI;CACrD,IAAI,UAAU,KAAA,GACb,MAAM,IAAIC,eAAAA,oBAAoB,MAAM,CACnC,GAAGC,eAAAA,qBAAqB,GACxB,GAAG,OAAO,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,CAC/C,CAAC;CAGF,MAAM,CAAC,gBAAgB,WAAW,MAAM,QAAQ,KAAK,IACjD,QACD,CAAC,OAAO,KAAA,CAAS;CAEpB,IAAI,OAAO,mBAAmB,UAAU;EAGvC,MAAM,WAAW,gBAAgB,MAAM,gBAAgB,UAAU,IAAI;EAErE,MAAM,UAAS,MADM,cAAc,MAAM,gBAAgB,UAAU,IAAI,EAAA,CACjD;EACtB,IAAI,CAACC,eAAAA,eAAe,MAAM,GACzB,MAAM,IAAI,qBAAqB,MAAM,cAAc;EAEpD,IAAI,OAAO,YAAY,UACtB,MAAM,IAAI,sBACT,MACA,gBACA,UACA,OAAO,OACR;EAED,OAAO;GAAE;GAAM;GAAQ,QAAQ;GAAU;EAAQ;CAClD;CAEA,IAAI,CAACA,eAAAA,eAAe,cAAc,GAAG,MAAM,IAAI,mBAAmB,IAAI;CACtE,OAAO;EAAE;EAAM,QAAQ;EAAgB,QAAQ;EAAU;CAAQ;AAClE;;AAGA,eAAsB,mBACrB,UACmB;CACnB,MAAM,EAAE,MAAM,QAAQ,YAAY;CAClC,IAAI,CAAC,OAAO,SAAS;EACpB,IAAI,YAAY,KAAA,GACf,MAAM,IAAI,qBAAqB,MAAM,CACpC,EAAE,SAAS,+BAA+B,CAC3C,CAAC;EAEF;CACD;CAEA,MAAM,SAAS,MAAM,OAAO,QAAQ,YAAY,CAAC,SAAS,OAAO;CACjE,IAAI,OAAO,QAAQ,MAAM,IAAI,qBAAqB,MAAM,OAAO,MAAM;CACrE,OAAO,OAAO;AACf"}

package/dist/{runtime-Dn_n-29S.d.cts → runtime-BnD7Nn96.d.cts}

@@ -1,4 +1,4 @@
-import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-DIA7Li-J.cjs";
+import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-ByMWkXKP.cjs";
 //#region src/target/builtins.d.ts
 /** A target name that is neither built in nor in `deploy.targets`. */
 declare class UnknownDeployTarget extends Error {
@@ -87,4 +87,4 @@ declare class TargetRuntimeUndeclared extends Error {
 }
 //#endregion
 export { TargetRuntimeMismatch as a, DeployTargetNotYetSupported as c, TargetPackageInvalid as i, UnknownDeployTarget as l, InvalidTargetOptions as n, ProviderRemoved as o, TargetEntryInvalid as r, TargetPackageNotFound as s, TargetRuntimeUndeclared as t };
-//# sourceMappingURL=runtime-Dn_n-29S.d.cts.map
+//# sourceMappingURL=runtime-BnD7Nn96.d.cts.map

package/dist/{runtime-CXPlkZzs.d.mts.map → runtime-BnD7Nn96.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"runtime-CXPlkZzs.d.mts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cAiEa,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCvDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}
+{"version":3,"file":"runtime-BnD7Nn96.d.cts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cA+Da,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}

package/dist/{runtime-CXPlkZzs.d.mts → runtime-j-tmFL65.d.mts}

@@ -1,4 +1,4 @@
-import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-CfLKGfC_.mjs";
+import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-BCzMWBb6.mjs";
 //#region src/target/builtins.d.ts
 /** A target name that is neither built in nor in `deploy.targets`. */
 declare class UnknownDeployTarget extends Error {
@@ -87,4 +87,4 @@ declare class TargetRuntimeUndeclared extends Error {
 }
 //#endregion
 export { TargetRuntimeMismatch as a, DeployTargetNotYetSupported as c, TargetPackageInvalid as i, UnknownDeployTarget as l, InvalidTargetOptions as n, ProviderRemoved as o, TargetEntryInvalid as r, TargetPackageNotFound as s, TargetRuntimeUndeclared as t };
-//# sourceMappingURL=runtime-CXPlkZzs.d.mts.map
+//# sourceMappingURL=runtime-j-tmFL65.d.mts.map

package/dist/{runtime-Dn_n-29S.d.cts.map → runtime-j-tmFL65.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"runtime-Dn_n-29S.d.cts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cAiEa,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCvDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}
+{"version":3,"file":"runtime-j-tmFL65.d.mts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cA+Da,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}

package/dist/sandbox/discover-worker.cjs

@@ -1,4 +1,4 @@
-const require_discover = require("../discover-C_6COHEv.cjs");
+const require_discover = require("../discover-DHdECueV.cjs");
 const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
 //#region src/sandbox/discover-worker.ts
 /**

package/dist/sandbox/discover-worker.mjs

@@ -1,4 +1,4 @@
-import { r as discover } from "../discover-BaT6bpnA.mjs";
+import { r as discover } from "../discover-LMrqsWSU.mjs";
 import { a as registerAdjacentTsconfig, i as liveValuePaths, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
 //#region src/sandbox/discover-worker.ts
 /**

package/dist/sandbox-CL--ZDui.cjs

@@ -0,0 +1,164 @@
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_async_hooks = require("node:async_hooks");
+//#region src/sandbox/sandbox.ts
+/**
+* Where a deploy runs the project's own code.
+*
+* A deploy holds credentials — Dokploy's token, a registry login, an AWS key —
+* and loading `gkm.config.ts`, sniffing an app's environment and building it
+* all execute code from the repository being deployed. On a developer's own
+* laptop that is the developer's code. On a CI job for a fork, or a shared
+* build runner, it is not, and that code should not be able to read the
+* credentials used to deploy it, hang the deploy, or reach outside the
+* checkout.
+*
+* So every step that runs project code goes through a `Sandbox`: one call,
+* with an argument array rather than a shell line, the complete environment
+* the step needs rather than the host's, a timeout it cannot outlive, secrets
+* as files rather than variables, and a working directory inside the project.
+* The steps that need credentials — provisioning, pushing, releasing — are
+* the deploy's own code and never run in one.
+*
+* `LocalSandbox` is the default: a child process on this machine with an
+* allowlisted environment. A host that builds repositories it does not trust
+* passes its own — a container per build, a VM — through `deploy()`'s
+* `sandbox`.
+*/
+/** The variable naming the directory a command's secrets are mounted in. */
+const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
+/** A command was asked to run outside the project. */
+var SandboxCwdEscape = class extends Error {
+	cwd;
+	root;
+	constructor(cwd, root) {
+		super(`Refusing to run in '${cwd}': it is outside the project at '${root}'. A sandboxed step only runs inside the project it was given — check the app paths in gkm.config.ts for \`..\` or an absolute path.`);
+		this.cwd = cwd;
+		this.root = root;
+		this.name = "SandboxCwdEscape";
+	}
+};
+/** A path with its symlinks resolved where it exists — `/tmp` is `/private/tmp`. */
+function real(path) {
+	return (0, node_fs.existsSync)(path) ? (0, node_fs.realpathSync)(path) : path;
+}
+/**
+* `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.
+*
+* Symlinks are resolved on both sides first, so a link inside the project
+* that points out of it is an escape, and a project reached through a link
+* (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call
+* before it runs anything.
+*/
+function confineCwd(root, cwd) {
+	const absolute = (0, node_path.resolve)(root, cwd);
+	const from = (0, node_path.relative)(real((0, node_path.resolve)(root)), real(absolute));
+	if (from === ".." || from.startsWith(`..${node_path.sep}`) || (0, node_path.isAbsolute)(from)) throw new SandboxCwdEscape(cwd, root);
+	return absolute;
+}
+/** A secret's file name: one path segment, so it cannot be written elsewhere. */
+var SecretNameInvalid = class extends Error {
+	secretName;
+	constructor(secretName) {
+		super(`'${secretName}' cannot be a secret's name: it becomes a file name in the secrets directory, so it must be one segment of letters, digits, '.', '-' or '_' and not start with '.'.`);
+		this.secretName = secretName;
+		this.name = "SecretNameInvalid";
+	}
+};
+const SECRET_NAME = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
+/** Every secret name, checked before anything is written. */
+function assertSecretNames(secrets) {
+	for (const name of Object.keys(secrets ?? {})) if (!SECRET_NAME.test(name)) throw new SecretNameInvalid(name);
+}
+const active = new node_async_hooks.AsyncLocalStorage();
+/**
+* Run `fn` with `sandbox` as the one its steps use.
+*
+* Per run rather than global, as `withOutput` routes a run's lines: two
+* deploys in one host process each build in their own sandbox. A step deep in
+* the engine — discovering constructs, sniffing an app — asks
+* {@link activeSandbox} rather than every function between `deploy()` and it
+* taking one more parameter.
+*/
+function withSandbox(sandbox, fn) {
+	return active.run({
+		sandbox,
+		answers: /* @__PURE__ */ new Map()
+	}, fn);
+}
+/** The sandbox of the run this is part of, if it was started with one. */
+function activeSandbox() {
+	return active.getStore()?.sandbox;
+}
+/**
+* `ask()`'s answer, asked once per run.
+*
+* A deploy loads its config and discovers its constructs from several places
+* — the first load, the engine, the Dockerfile generator — and in a sandbox
+* each was a child process of its own, for the same answer: the checkout does
+* not change while it deploys. Within a run in `sandbox`, the first answer
+* for `key` is the one every later ask gets. Outside one, or for another
+* sandbox, `ask()` runs each time.
+*/
+function oncePerRun(sandbox, key, ask) {
+	const run = active.getStore();
+	if (!run || run.sandbox !== sandbox) return ask();
+	let answer = run.answers.get(key);
+	if (!answer) {
+		answer = ask();
+		run.answers.set(key, answer);
+		answer.catch(() => run.answers.delete(key));
+	}
+	return answer;
+}
+//#endregion
+Object.defineProperty(exports, "SECRETS_DIR_ENV", {
+	enumerable: true,
+	get: function() {
+		return SECRETS_DIR_ENV;
+	}
+});
+Object.defineProperty(exports, "SandboxCwdEscape", {
+	enumerable: true,
+	get: function() {
+		return SandboxCwdEscape;
+	}
+});
+Object.defineProperty(exports, "SecretNameInvalid", {
+	enumerable: true,
+	get: function() {
+		return SecretNameInvalid;
+	}
+});
+Object.defineProperty(exports, "activeSandbox", {
+	enumerable: true,
+	get: function() {
+		return activeSandbox;
+	}
+});
+Object.defineProperty(exports, "assertSecretNames", {
+	enumerable: true,
+	get: function() {
+		return assertSecretNames;
+	}
+});
+Object.defineProperty(exports, "confineCwd", {
+	enumerable: true,
+	get: function() {
+		return confineCwd;
+	}
+});
+Object.defineProperty(exports, "oncePerRun", {
+	enumerable: true,
+	get: function() {
+		return oncePerRun;
+	}
+});
+Object.defineProperty(exports, "withSandbox", {
+	enumerable: true,
+	get: function() {
+		return withSandbox;
+	}
+});
+
+//# sourceMappingURL=sandbox-CL--ZDui.cjs.map

package/dist/sandbox-CL--ZDui.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-CL--ZDui.cjs","names":["existsSync","realpathSync","resolve","relative","sep","isAbsolute","AsyncLocalStorage"],"sources":["../src/sandbox/sandbox.ts"],"sourcesContent":["/**\n * Where a deploy runs the project's own code.\n *\n * A deploy holds credentials — Dokploy's token, a registry login, an AWS key —\n * and loading `gkm.config.ts`, sniffing an app's environment and building it\n * all execute code from the repository being deployed. On a developer's own\n * laptop that is the developer's code. On a CI job for a fork, or a shared\n * build runner, it is not, and that code should not be able to read the\n * credentials used to deploy it, hang the deploy, or reach outside the\n * checkout.\n *\n * So every step that runs project code goes through a `Sandbox`: one call,\n * with an argument array rather than a shell line, the complete environment\n * the step needs rather than the host's, a timeout it cannot outlive, secrets\n * as files rather than variables, and a working directory inside the project.\n * The steps that need credentials — provisioning, pushing, releasing — are\n * the deploy's own code and never run in one.\n *\n * `LocalSandbox` is the default: a child process on this machine with an\n * allowlisted environment. A host that builds repositories it does not trust\n * passes its own — a container per build, a VM — through `deploy()`'s\n * `sandbox`.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { existsSync, realpathSync } from 'node:fs';\nimport { isAbsolute, relative, resolve, sep } from 'node:path';\n\n/** Where a command's output goes. */\nexport type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';\n\nexport interface SandboxExecOptions {\n\t/**\n\t * Where the command runs: the project root or a directory below it, as an\n\t * absolute path or relative to the root. Anywhere else is refused with\n\t * {@link SandboxCwdEscape}.\n\t */\n\tcwd: string;\n\t/**\n\t * The command's whole environment. Nothing of the host's is added to it:\n\t * start from {@link Sandbox.env} and add what the step needs.\n\t */\n\tenv: Readonly<Record<string, string>>;\n\t/**\n\t * How long the command may run before it is killed. Required: a step that\n\t * waits forever — a sniffed entry that opens a server, a build stuck on a\n\t * prompt — would otherwise hold the deploy, and its lock, forever.\n\t */\n\ttimeoutMs: number;\n\t/**\n\t * Files the command can read, by name. Mounted in a directory of their own\n\t * — named by `GKM_SECRETS_DIR` in the command's environment — and removed\n\t * when it exits. Never set as variables, which every child inherits, a\n\t * crash report prints and `/proc/<pid>/environ` shows.\n\t */\n\tsecrets?: Readonly<Record<string, string>>;\n\t/**\n\t * `capture` (the default) returns stdout and stderr in the result;\n\t * `inherit` gives the command the host's terminal; `stderr` sends both\n\t * streams to the host's stderr; `ignore` discards them.\n\t */\n\toutput?: SandboxOutput;\n\t/** Kills the command when aborted; `exec` rejects with the signal's reason. */\n\tsignal?: AbortSignal;\n}\n\n/** How a command ended. A non-zero exit is a result, not an error. */\nexport interface SandboxResult {\n\texitCode: number | null;\n\tsignal: string | null;\n\t/** What it wrote to stdout, when its output was captured. */\n\tstdout: string;\n\t/** What it wrote to stderr, when its output was captured. */\n\tstderr: string;\n}\n\n/**\n * Runs a command against the project, and nothing else of the host's.\n *\n * `exec` resolves with the result however the command exited. It rejects\n * with {@link CommandTimedOut} once the timeout passes — after the command is\n * gone — with {@link SandboxCwdEscape} for a directory outside the project,\n * with the signal's reason when aborted, and with the spawn error when the\n * program cannot be started.\n */\nexport interface Sandbox {\n\t/** The project: the directory every command runs at or below. */\n\treadonly root: string;\n\t/**\n\t * Whether the code it runs is kept from the host: its files, its\n\t * processes, its memory.\n\t *\n\t * An isolating sandbox shares nothing but what crosses `exec`, so a config\n\t * reaches the deploy as data — a live object in it (a custom state store,\n\t * an inline target) cannot cross, and is refused with\n\t * `ConfigObjectNotSerializable`. A non-isolating one, like\n\t * {@link LocalSandbox}, runs on the host as the host's user; a project\n\t * whose config holds live objects is then loaded in-process as before,\n\t * because a project trusted to run there is trusted to do that.\n\t */\n\treadonly isolating: boolean;\n\t/**\n\t * The environment a command starts from: what any program needs to run\n\t * here — `PATH`, `HOME`, the locale — and no credential.\n\t */\n\treadonly env: Readonly<Record<string, string>>;\n\texec(\n\t\tcommand: string,\n\t\targs: readonly string[],\n\t\toptions: SandboxExecOptions,\n\t): Promise<SandboxResult>;\n}\n\n/** The variable naming the directory a command's secrets are mounted in. */\nexport const SECRETS_DIR_ENV = 'GKM_SECRETS_DIR';\n\n/** A command was asked to run outside the project. */\nexport class SandboxCwdEscape extends Error {\n\tconstructor(\n\t\treadonly cwd: string,\n\t\treadonly root: string,\n\t) {\n\t\tsuper(\n\t\t\t`Refusing to run in '${cwd}': it is outside the project at '${root}'. ` +\n\t\t\t\t'A sandboxed step only runs inside the project it was given — check ' +\n\t\t\t\t'the app paths in gkm.config.ts for `..` or an absolute path.',\n\t\t);\n\t\tthis.name = 'SandboxCwdEscape';\n\t}\n}\n\n/** A path with its symlinks resolved where it exists — `/tmp` is `/private/tmp`. */\nfunction real(path: string): string {\n\treturn existsSync(path) ? realpathSync(path) : path;\n}\n\n/**\n * `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.\n *\n * Symlinks are resolved on both sides first, so a link inside the project\n * that points out of it is an escape, and a project reached through a link\n * (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call\n * before it runs anything.\n */\nexport function confineCwd(root: string, cwd: string): string {\n\tconst absolute = resolve(root, cwd);\n\tconst from = relative(real(resolve(root)), real(absolute));\n\tif (from === '..' || from.startsWith(`..${sep}`) || isAbsolute(from)) {\n\t\tthrow new SandboxCwdEscape(cwd, root);\n\t}\n\treturn absolute;\n}\n\n/** A secret's file name: one path segment, so it cannot be written elsewhere. */\nexport class SecretNameInvalid extends Error {\n\tconstructor(readonly secretName: string) {\n\t\tsuper(\n\t\t\t`'${secretName}' cannot be a secret's name: it becomes a file name in ` +\n\t\t\t\t'the secrets directory, so it must be one segment of letters, digits, ' +\n\t\t\t\t\"'.', '-' or '_' and not start with '.'.\",\n\t\t);\n\t\tthis.name = 'SecretNameInvalid';\n\t}\n}\n\nconst SECRET_NAME = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;\n\n/** Every secret name, checked before anything is written. */\nexport function assertSecretNames(\n\tsecrets: Readonly<Record<string, string>> | undefined,\n): void {\n\tfor (const name of Object.keys(secrets ?? {})) {\n\t\tif (!SECRET_NAME.test(name)) throw new SecretNameInvalid(name);\n\t}\n}\n\n/** A run's sandbox, and what its workers already answered. */\ninterface SandboxRun {\n\tsandbox: Sandbox;\n\tanswers: Map<string, Promise<unknown>>;\n}\n\nconst active = new AsyncLocalStorage<SandboxRun>();\n\n/**\n * Run `fn` with `sandbox` as the one its steps use.\n *\n * Per run rather than global, as `withOutput` routes a run's lines: two\n * deploys in one host process each build in their own sandbox. A step deep in\n * the engine — discovering constructs, sniffing an app — asks\n * {@link activeSandbox} rather than every function between `deploy()` and it\n * taking one more parameter.\n */\nexport function withSandbox<T>(sandbox: Sandbox, fn: () => T): T {\n\treturn active.run({ sandbox, answers: new Map() }, fn);\n}\n\n/** The sandbox of the run this is part of, if it was started with one. */\nexport function activeSandbox(): Sandbox | undefined {\n\treturn active.getStore()?.sandbox;\n}\n\n/**\n * `ask()`'s answer, asked once per run.\n *\n * A deploy loads its config and discovers its constructs from several places\n * — the first load, the engine, the Dockerfile generator — and in a sandbox\n * each was a child process of its own, for the same answer: the checkout does\n * not change while it deploys. Within a run in `sandbox`, the first answer\n * for `key` is the one every later ask gets. Outside one, or for another\n * sandbox, `ask()` runs each time.\n */\nexport function oncePerRun<T>(\n\tsandbox: Sandbox,\n\tkey: string,\n\task: () => Promise<T>,\n): Promise<T> {\n\tconst run = active.getStore();\n\tif (!run || run.sandbox !== sandbox) return ask();\n\n\tlet answer = run.answers.get(key) as Promise<T> | undefined;\n\tif (!answer) {\n\t\tanswer = ask();\n\t\trun.answers.set(key, answer);\n\t\t// A failure is not remembered: the next ask tries again.\n\t\tanswer.catch(() => run.answers.delete(key));\n\t}\n\treturn answer;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkHA,MAAa,kBAAkB;;AAG/B,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CACA;CAFV,YACC,KACA,MACC;EACD,MACC,uBAAuB,IAAI,mCAAmC,KAAK,qIAGpE;EAPS,KAAA,MAAA;EACA,KAAA,OAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,KAAK,MAAsB;CACnC,QAAA,GAAOA,QAAAA,WAAAA,CAAW,IAAI,KAAA,GAAIC,QAAAA,aAAAA,CAAa,IAAI,IAAI;AAChD;;;;;;;;;AAUA,SAAgB,WAAW,MAAc,KAAqB;CAC7D,MAAM,YAAA,GAAWC,UAAAA,QAAAA,CAAQ,MAAM,GAAG;CAClC,MAAM,QAAA,GAAOC,UAAAA,SAAAA,CAAS,MAAA,GAAKD,UAAAA,QAAAA,CAAQ,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC;CACzD,IAAI,SAAS,QAAQ,KAAK,WAAW,KAAKE,UAAAA,KAAK,MAAA,GAAKC,UAAAA,WAAAA,CAAW,IAAI,GAClE,MAAM,IAAI,iBAAiB,KAAK,IAAI;CAErC,OAAO;AACR;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CACvB;CAArB,YAAY,YAA6B;EACxC,MACC,IAAI,WAAW,oKAGhB;EALoB,KAAA,aAAA;EAMpB,KAAK,OAAO;CACb;AACD;AAEA,MAAM,cAAc;;AAGpB,SAAgB,kBACf,SACO;CACP,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,CAAC,CAAC,GAC3C,IAAI,CAAC,YAAY,KAAK,IAAI,GAAG,MAAM,IAAI,kBAAkB,IAAI;AAE/D;AAQA,MAAM,SAAS,IAAIC,iBAAAA,kBAA8B;;;;;;;;;;AAWjD,SAAgB,YAAe,SAAkB,IAAgB;CAChE,OAAO,OAAO,IAAI;EAAE;EAAS,yBAAS,IAAI,IAAI;CAAE,GAAG,EAAE;AACtD;;AAGA,SAAgB,gBAAqC;CACpD,OAAO,OAAO,SAAS,CAAC,EAAE;AAC3B;;;;;;;;;;;AAYA,SAAgB,WACf,SACA,KACA,KACa;CACb,MAAM,MAAM,OAAO,SAAS;CAC5B,IAAI,CAAC,OAAO,IAAI,YAAY,SAAS,OAAO,IAAI;CAEhD,IAAI,SAAS,IAAI,QAAQ,IAAI,GAAG;CAChC,IAAI,CAAC,QAAQ;EACZ,SAAS,IAAI;EACb,IAAI,QAAQ,IAAI,KAAK,MAAM;EAE3B,OAAO,YAAY,IAAI,QAAQ,OAAO,GAAG,CAAC;CAC3C;CACA,OAAO;AACR"}