@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.67

package/dist/run-fVZ-rLnc.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-fVZ-rLnc.cjs","names":["resolve","join","homedir","spawn"],"sources":["../src/home.ts","../src/run.ts"],"sourcesContent":["/**\n * Where the CLI keeps what belongs to a person rather than a project: stage\n * keys and stored provider credentials.\n *\n * `GKM_HOME` names it, so a CI job, a shared build runner or a test can give\n * every run its own instead of reaching into whoever's home directory the\n * process happens to have. Unset, it is `~/.gkm`, where it has always been.\n */\n\nimport { homedir } from 'node:os';\nimport { join, resolve } from 'node:path';\n\n/** The environment variable that moves the CLI's home. */\nexport const GKM_HOME_ENV = 'GKM_HOME';\n\n/** The CLI's home: `GKM_HOME` if set, else `~/.gkm`. */\nexport function gkmHome(env: NodeJS.ProcessEnv = process.env): string {\n\tconst configured = env[GKM_HOME_ENV];\n\treturn configured ? resolve(configured) : join(homedir(), '.gkm');\n}\n","/**\n * Start a program with an argument array, never a shell string.\n *\n * `gkm build`, `gkm docker` and `gkm deploy` pass values that come from the\n * workspace — image refs, tags, build args, package names — to `docker` and\n * `turbo`. Joined into a string and handed to a shell, a package named\n * `x;curl …|sh` or a tag holding `$(…)` became part of the command line, which\n * matters most where the CLI builds a repository it didn't write: a CI job for a\n * fork, a shared build runner. Here every value reaches the program as one\n * `argv` element, whatever it contains.\n */\n\nimport { type SpawnOptions, spawn } from 'node:child_process';\n\n/** Long enough for a cold image build; short enough that a hung one ends. */\nexport const DEFAULT_TIMEOUT_MS = 30 * 60_000;\n\n/** How long a timed-out child has to exit on SIGTERM before it is killed. */\nconst KILL_GRACE_MS = 5_000;\n\nexport interface RunOptions {\n\tcwd?: string;\n\tenv?: NodeJS.ProcessEnv;\n\tstdio?: SpawnOptions['stdio'];\n\t/** Kill the child after this long. Defaults to {@link DEFAULT_TIMEOUT_MS}. */\n\ttimeoutMs?: number;\n\t/**\n\t * Kills the child when aborted, and rejects with the signal's reason — the\n\t * same as a stopped deploy's other calls.\n\t */\n\tsignal?: AbortSignal;\n}\n\n/** The command line as a person would read it — for messages, never to run. */\nfunction display(command: string, args: readonly string[]): string {\n\treturn [command, ...args].join(' ');\n}\n\n/** The program ran and exited unsuccessfully; its own output said why. */\nexport class CommandFailed extends Error {\n\tconstructor(\n\t\treadonly command: string,\n\t\treadonly args: readonly string[],\n\t\treadonly exitCode: number | null,\n\t\treadonly signal: NodeJS.Signals | null,\n\t) {\n\t\tsuper(\n\t\t\t`\\`${display(command, args)}\\` ${exitCode === null ? `was stopped by ${signal ?? 'a signal'}` : `exited with code ${exitCode}`}. Its output above says why; run it by hand to see it again.`,\n\t\t);\n\t\tthis.name = 'CommandFailed';\n\t}\n}\n\n/** The program ran past its timeout and was killed. */\nexport class CommandTimedOut extends Error {\n\tconstructor(\n\t\treadonly command: string,\n\t\treadonly args: readonly string[],\n\t\treadonly timeoutMs: number,\n\t) {\n\t\tsuper(\n\t\t\t`\\`${display(command, args)}\\` was still running after ${Math.round(timeoutMs / 1000)}s and was stopped. Check what it was waiting on — a registry, the Docker daemon, a prompt — and run it again.`,\n\t\t);\n\t\tthis.name = 'CommandTimedOut';\n\t}\n}\n\n/**\n * Run `command` with `args`, resolving when it exits 0.\n *\n * Rejects with {@link CommandFailed} on any other exit, {@link CommandTimedOut}\n * once `timeoutMs` passes (after the child is gone), and with the spawn error\n * itself when the program cannot be started at all — `ENOENT` already names it.\n */\nexport async function run(\n\tcommand: string,\n\targs: readonly string[],\n\toptions: RunOptions = {},\n): Promise<void> {\n\tawait spawnChild(command, args, options, false);\n}\n\n/**\n * {@link run}, resolving with what the program wrote to stdout — for a value\n * the CLI reads back, such as the digest `docker inspect` reports. stderr still\n * reaches the terminal, so a failure explains itself the same way.\n */\nexport function runOutput(\n\tcommand: string,\n\targs: readonly string[],\n\toptions: Omit<RunOptions, 'stdio'> = {},\n): Promise<string> {\n\treturn spawnChild(command, args, options, true);\n}\n\nfunction spawnChild(\n\tcommand: string,\n\targs: readonly string[],\n\toptions: RunOptions,\n\tcapture: boolean,\n): Promise<string> {\n\tconst { timeoutMs = DEFAULT_TIMEOUT_MS, ...spawnOptions } = options;\n\n\treturn new Promise<string>((resolve, reject) => {\n\t\tconst child = spawn(command, [...args], {\n\t\t\tstdio: 'inherit',\n\t\t\t...spawnOptions,\n\t\t\t...(capture ? { stdio: ['ignore', 'pipe', 'inherit'] } : {}),\n\t\t\tshell: false,\n\t\t});\n\n\t\tlet stdout = '';\n\t\tchild.stdout?.on('data', (chunk: Buffer) => {\n\t\t\tstdout += chunk.toString();\n\t\t});\n\n\t\tlet timedOut = false;\n\t\tlet killer: NodeJS.Timeout | undefined;\n\t\tconst timer = setTimeout(() => {\n\t\t\ttimedOut = true;\n\t\t\tchild.kill('SIGTERM');\n\t\t\t// A child that ignores SIGTERM would hold the deploy open forever.\n\t\t\tkiller = setTimeout(() => child.kill('SIGKILL'), KILL_GRACE_MS);\n\t\t\tkiller.unref?.();\n\t\t}, timeoutMs);\n\t\ttimer.unref?.();\n\n\t\tconst settle = () => {\n\t\t\tclearTimeout(timer);\n\t\t\tif (killer) clearTimeout(killer);\n\t\t};\n\n\t\tchild.on('error', (error) => {\n\t\t\tsettle();\n\t\t\t// Node reports an abort as its own `AbortError`; the caller asked\n\t\t\t// with a reason, and that is what it should get back.\n\t\t\treject(spawnOptions.signal?.aborted ? spawnOptions.signal.reason : error);\n\t\t});\n\n\t\tchild.on('close', (code: number | null, signal: NodeJS.Signals | null) => {\n\t\t\tsettle();\n\t\t\tif (spawnOptions.signal?.aborted) reject(spawnOptions.signal.reason);\n\t\t\telse if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));\n\t\t\telse if (code === 0) resolve(stdout);\n\t\t\telse reject(new CommandFailed(command, args, code, signal));\n\t\t});\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,eAAe;;AAG5B,SAAgB,QAAQ,MAAyB,QAAQ,KAAa;CACrE,MAAM,aAAa,IAAI;CACvB,OAAO,cAAA,GAAaA,UAAAA,QAAAA,CAAQ,UAAU,KAAA,GAAIC,UAAAA,KAAAA,EAAAA,GAAKC,QAAAA,QAAAA,CAAQ,GAAG,MAAM;AACjE;;;;;;;;;;;;;;;ACJA,MAAa,qBAAqB;;AAGlC,MAAM,gBAAgB;;AAgBtB,SAAS,QAAQ,SAAiB,MAAiC;CAClE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;AACnC;;AAGA,IAAa,gBAAb,cAAmC,MAAM;CAE9B;CACA;CACA;CACA;CAJV,YACC,SACA,MACA,UACA,QACC;EACD,MACC,KAAK,QAAQ,SAAS,IAAI,EAAE,KAAK,aAAa,OAAO,kBAAkB,UAAU,eAAe,oBAAoB,WAAW,6DAChI;EAPS,KAAA,UAAA;EACA,KAAA,OAAA;EACA,KAAA,WAAA;EACA,KAAA,SAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,kBAAb,cAAqC,MAAM;CAEhC;CACA;CACA;CAHV,YACC,SACA,MACA,WACC;EACD,MACC,KAAK,QAAQ,SAAS,IAAI,EAAE,6BAA6B,KAAK,MAAM,YAAY,GAAI,EAAE,8GACvF;EANS,KAAA,UAAA;EACA,KAAA,OAAA;EACA,KAAA,YAAA;EAKT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,IACrB,SACA,MACA,UAAsB,CAAC,GACP;CAChB,MAAM,WAAW,SAAS,MAAM,SAAS,KAAK;AAC/C;;;;;;AAOA,SAAgB,UACf,SACA,MACA,UAAqC,CAAC,GACpB;CAClB,OAAO,WAAW,SAAS,MAAM,SAAS,IAAI;AAC/C;AAEA,SAAS,WACR,SACA,MACA,SACA,SACkB;CAClB,MAAM,EAAE,YAAY,oBAAoB,GAAG,iBAAiB;CAE5D,OAAO,IAAI,SAAiB,SAAS,WAAW;EAC/C,MAAM,SAAA,GAAQC,mBAAAA,MAAAA,CAAM,SAAS,CAAC,GAAG,IAAI,GAAG;GACvC,OAAO;GACP,GAAG;GACH,GAAI,UAAU,EAAE,OAAO;IAAC;IAAU;IAAQ;GAAS,EAAE,IAAI,CAAC;GAC1D,OAAO;EACR,CAAC;EAED,IAAI,SAAS;EACb,MAAM,QAAQ,GAAG,SAAS,UAAkB;GAC3C,UAAU,MAAM,SAAS;EAC1B,CAAC;EAED,IAAI,WAAW;EACf,IAAI;EACJ,MAAM,QAAQ,iBAAiB;GAC9B,WAAW;GACX,MAAM,KAAK,SAAS;GAEpB,SAAS,iBAAiB,MAAM,KAAK,SAAS,GAAG,aAAa;GAC9D,OAAO,QAAQ;EAChB,GAAG,SAAS;EACZ,MAAM,QAAQ;EAEd,MAAM,eAAe;GACpB,aAAa,KAAK;GAClB,IAAI,QAAQ,aAAa,MAAM;EAChC;EAEA,MAAM,GAAG,UAAU,UAAU;GAC5B,OAAO;GAGP,OAAO,aAAa,QAAQ,UAAU,aAAa,OAAO,SAAS,KAAK;EACzE,CAAC;EAED,MAAM,GAAG,UAAU,MAAqB,WAAkC;GACzE,OAAO;GACP,IAAI,aAAa,QAAQ,SAAS,OAAO,aAAa,OAAO,MAAM;QAC9D,IAAI,UAAU,OAAO,IAAI,gBAAgB,SAAS,MAAM,SAAS,CAAC;QAClE,IAAI,SAAS,GAAG,QAAQ,MAAM;QAC9B,OAAO,IAAI,cAAc,SAAS,MAAM,MAAM,MAAM,CAAC;EAC3D,CAAC;CACF,CAAC;AACF"}

package/dist/{runtime-BnD7Nn96.d.cts → runtime-BRqFOvPM.d.cts}

@@ -1,4 +1,4 @@
-import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-ByMWkXKP.cjs";
+import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-D5WIxRDP.cjs";
 //#region src/target/builtins.d.ts
 /** A target name that is neither built in nor in `deploy.targets`. */
 declare class UnknownDeployTarget extends Error {
@@ -87,4 +87,4 @@ declare class TargetRuntimeUndeclared extends Error {
 }
 //#endregion
 export { TargetRuntimeMismatch as a, DeployTargetNotYetSupported as c, TargetPackageInvalid as i, UnknownDeployTarget as l, InvalidTargetOptions as n, ProviderRemoved as o, TargetEntryInvalid as r, TargetPackageNotFound as s, TargetRuntimeUndeclared as t };
-//# sourceMappingURL=runtime-BnD7Nn96.d.cts.map
+//# sourceMappingURL=runtime-BRqFOvPM.d.cts.map

package/dist/{runtime-BnD7Nn96.d.cts.map → runtime-BRqFOvPM.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"runtime-BnD7Nn96.d.cts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cA+Da,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}
+{"version":3,"file":"runtime-BRqFOvPM.d.cts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cA+Da,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}

package/dist/{runtime-j-tmFL65.d.mts → runtime-CEk5n4VH.d.mts}

@@ -1,4 +1,4 @@
-import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-BCzMWBb6.mjs";
+import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-CSw2w69a.mjs";
 //#region src/target/builtins.d.ts
 /** A target name that is neither built in nor in `deploy.targets`. */
 declare class UnknownDeployTarget extends Error {
@@ -87,4 +87,4 @@ declare class TargetRuntimeUndeclared extends Error {
 }
 //#endregion
 export { TargetRuntimeMismatch as a, DeployTargetNotYetSupported as c, TargetPackageInvalid as i, UnknownDeployTarget as l, InvalidTargetOptions as n, ProviderRemoved as o, TargetEntryInvalid as r, TargetPackageNotFound as s, TargetRuntimeUndeclared as t };
-//# sourceMappingURL=runtime-j-tmFL65.d.mts.map
+//# sourceMappingURL=runtime-CEk5n4VH.d.mts.map

package/dist/{runtime-j-tmFL65.d.mts.map → runtime-CEk5n4VH.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"runtime-j-tmFL65.d.mts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cA+Da,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}
+{"version":3,"file":"runtime-CEk5n4VH.d.mts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cA+Da,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}

package/dist/sandbox/discover-worker.cjs

@@ -1,4 +1,4 @@
-const require_discover = require("../discover-DHdECueV.cjs");
+const require_discover = require("../discover-OEfZ9OkA.cjs");
 const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
 //#region src/sandbox/discover-worker.ts
 /**

package/dist/sandbox/discover-worker.mjs

@@ -1,4 +1,4 @@
-import { r as discover } from "../discover-LMrqsWSU.mjs";
+import { r as discover } from "../discover-BFoJWKGD.mjs";
 import { a as registerAdjacentTsconfig, i as liveValuePaths, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
 //#region src/sandbox/discover-worker.ts
 /**

package/dist/sandbox/migrate-worker.cjs

@@ -0,0 +1,61 @@
+const require_discover = require("../discover-OEfZ9OkA.cjs");
+const require_sandbox = require("../sandbox-CL--ZDui.cjs");
+const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
+const require_databases = require("../databases-C2p5LGAp.cjs");
+let node_path = require("node:path");
+let node_fs_promises = require("node:fs/promises");
+//#region src/sandbox/migrate-worker.ts
+/**
+* Applies a deployed stage's migrations in a sandbox — the migrator
+* `gkm migrate` runs, against URLs the deploy hands it as secret files.
+*
+* Usage (by the Dokploy target's release, never by hand):
+*   node --import=<tsx> migrate-worker.ts '{"root":"…","manifest":{…},"patterns":[…]}'
+*
+* Migrations are the project's own code, which is why they run here rather
+* than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,
+* named by its key, and is read into this process's memory only: never into
+* `process.env`, where a child the migration starts would inherit it.
+*/
+/** Every secret file the sandbox mounted, by name. */
+async function mountedSecrets() {
+	const dir = process.env[require_sandbox.SECRETS_DIR_ENV];
+	if (!dir) return {};
+	const secrets = {};
+	for (const name of await (0, node_fs_promises.readdir)(dir)) secrets[name] = (await (0, node_fs_promises.readFile)((0, node_path.join)(dir, name), "utf8")).trim();
+	return secrets;
+}
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await require_workerRuntime.registerAdjacentTsconfig();
+		const sources = {};
+		if (request.patterns.length > 0) await require_discover.discover({
+			patterns: request.patterns,
+			cwd: request.root,
+			sources
+		});
+		const runs = await require_databases.migrateDatabases({
+			root: request.root,
+			manifest: request.manifest,
+			sources,
+			env: await mountedSecrets()
+		});
+		require_workerRuntime.answer({
+			reason: "migrated",
+			runs: runs.map(({ target, applied }) => ({
+				migrations: target.migrations,
+				applied
+			}))
+		});
+	} catch (error) {
+		require_workerRuntime.answer({
+			reason: "failed",
+			error: require_workerRuntime.errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+
+//# sourceMappingURL=migrate-worker.cjs.map

package/dist/sandbox/migrate-worker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-worker.cjs","names":["SECRETS_DIR_ENV","readdir","readFile","join","registerAdjacentTsconfig","discover","migrateDatabases","errorData"],"sources":["../../src/sandbox/migrate-worker.ts"],"sourcesContent":["/**\n * Applies a deployed stage's migrations in a sandbox — the migrator\n * `gkm migrate` runs, against URLs the deploy hands it as secret files.\n *\n * Usage (by the Dokploy target's release, never by hand):\n *   node --import=<tsx> migrate-worker.ts '{\"root\":\"…\",\"manifest\":{…},\"patterns\":[…]}'\n *\n * Migrations are the project's own code, which is why they run here rather\n * than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,\n * named by its key, and is read into this process's memory only: never into\n * `process.env`, where a child the migration starts would inherit it.\n */\n\nimport { readdir, readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport { migrateDatabases } from '../migrate/databases';\nimport { type ConstructSource, discover } from '../reconcile/discover';\nimport { SECRETS_DIR_ENV } from './sandbox';\nimport { answer, errorData, registerAdjacentTsconfig } from './workerRuntime';\n\n/** Every secret file the sandbox mounted, by name. */\nasync function mountedSecrets(): Promise<Record<string, string>> {\n\tconst dir = process.env[SECRETS_DIR_ENV];\n\tif (!dir) return {};\n\n\tconst secrets: Record<string, string> = {};\n\tfor (const name of await readdir(dir)) {\n\t\tsecrets[name] = (await readFile(join(dir, name), 'utf8')).trim();\n\t}\n\treturn secrets;\n}\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\troot: string;\n\t\t\tmanifest: ConstructManifest;\n\t\t\tpatterns: string[];\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\t// Where each construct is declared, so a migration runs with the Kysely\n\t\t// its own file resolves. The manifest itself is the deploy's: what it\n\t\t// provisioned is what gets migrated, not a second reading of the files.\n\t\tconst sources: Record<string, ConstructSource> = {};\n\t\tif (request.patterns.length > 0) {\n\t\t\tawait discover({\n\t\t\t\tpatterns: request.patterns,\n\t\t\t\tcwd: request.root,\n\t\t\t\tsources,\n\t\t\t});\n\t\t}\n\n\t\tconst runs = await migrateDatabases({\n\t\t\troot: request.root,\n\t\t\tmanifest: request.manifest,\n\t\t\tsources,\n\t\t\tenv: await mountedSecrets(),\n\t\t});\n\n\t\tanswer({\n\t\t\treason: 'migrated',\n\t\t\truns: runs.map(({ target, applied }) => ({\n\t\t\t\tmigrations: target.migrations,\n\t\t\t\tapplied,\n\t\t\t})),\n\t\t});\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAsBA,eAAe,iBAAkD;CAChE,MAAM,MAAM,QAAQ,IAAIA,gBAAAA;CACxB,IAAI,CAAC,KAAK,OAAO,CAAC;CAElB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,QAAAA,CAAQ,GAAG,GACnC,QAAQ,SAAS,OAAA,GAAMC,iBAAAA,SAAAA,EAAAA,GAASC,UAAAA,KAAAA,CAAK,KAAK,IAAI,GAAG,MAAM,EAAA,CAAG,KAAK;CAEhE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAKlD,MAAMC,sBAAAA,yBAAyB;EAK/B,MAAM,UAA2C,CAAC;EAClD,IAAI,QAAQ,SAAS,SAAS,GAC7B,MAAMC,iBAAAA,SAAS;GACd,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAGF,MAAM,OAAO,MAAMC,kBAAAA,iBAAiB;GACnC,MAAM,QAAQ;GACd,UAAU,QAAQ;GAClB;GACA,KAAK,MAAM,eAAe;EAC3B,CAAC;EAED,sBAAA,OAAO;GACN,QAAQ;GACR,MAAM,KAAK,KAAK,EAAE,QAAQ,eAAe;IACxC,YAAY,OAAO;IACnB;GACD,EAAE;EACH,CAAC;CACF,SAAS,OAAO;EACf,sBAAA,OAAO;GAAE,QAAQ;GAAU,OAAOC,sBAAAA,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/migrate-worker.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/migrate-worker.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/migrate-worker.mjs

@@ -0,0 +1,62 @@
+import { r as discover } from "../discover-BFoJWKGD.mjs";
+import { t as SECRETS_DIR_ENV } from "../sandbox-Dm247NGx.mjs";
+import { a as registerAdjacentTsconfig, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
+import { u as migrateDatabases } from "../databases-hUHTuwhx.mjs";
+import { join } from "node:path";
+import { readFile, readdir } from "node:fs/promises";
+//#region src/sandbox/migrate-worker.ts
+/**
+* Applies a deployed stage's migrations in a sandbox — the migrator
+* `gkm migrate` runs, against URLs the deploy hands it as secret files.
+*
+* Usage (by the Dokploy target's release, never by hand):
+*   node --import=<tsx> migrate-worker.ts '{"root":"…","manifest":{…},"patterns":[…]}'
+*
+* Migrations are the project's own code, which is why they run here rather
+* than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,
+* named by its key, and is read into this process's memory only: never into
+* `process.env`, where a child the migration starts would inherit it.
+*/
+/** Every secret file the sandbox mounted, by name. */
+async function mountedSecrets() {
+	const dir = process.env[SECRETS_DIR_ENV];
+	if (!dir) return {};
+	const secrets = {};
+	for (const name of await readdir(dir)) secrets[name] = (await readFile(join(dir, name), "utf8")).trim();
+	return secrets;
+}
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await registerAdjacentTsconfig();
+		const sources = {};
+		if (request.patterns.length > 0) await discover({
+			patterns: request.patterns,
+			cwd: request.root,
+			sources
+		});
+		const runs = await migrateDatabases({
+			root: request.root,
+			manifest: request.manifest,
+			sources,
+			env: await mountedSecrets()
+		});
+		answer({
+			reason: "migrated",
+			runs: runs.map(({ target, applied }) => ({
+				migrations: target.migrations,
+				applied
+			}))
+		});
+	} catch (error) {
+		answer({
+			reason: "failed",
+			error: errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+export {};
+
+//# sourceMappingURL=migrate-worker.mjs.map

package/dist/sandbox/migrate-worker.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-worker.mjs","names":[],"sources":["../../src/sandbox/migrate-worker.ts"],"sourcesContent":["/**\n * Applies a deployed stage's migrations in a sandbox — the migrator\n * `gkm migrate` runs, against URLs the deploy hands it as secret files.\n *\n * Usage (by the Dokploy target's release, never by hand):\n *   node --import=<tsx> migrate-worker.ts '{\"root\":\"…\",\"manifest\":{…},\"patterns\":[…]}'\n *\n * Migrations are the project's own code, which is why they run here rather\n * than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,\n * named by its key, and is read into this process's memory only: never into\n * `process.env`, where a child the migration starts would inherit it.\n */\n\nimport { readdir, readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport { migrateDatabases } from '../migrate/databases';\nimport { type ConstructSource, discover } from '../reconcile/discover';\nimport { SECRETS_DIR_ENV } from './sandbox';\nimport { answer, errorData, registerAdjacentTsconfig } from './workerRuntime';\n\n/** Every secret file the sandbox mounted, by name. */\nasync function mountedSecrets(): Promise<Record<string, string>> {\n\tconst dir = process.env[SECRETS_DIR_ENV];\n\tif (!dir) return {};\n\n\tconst secrets: Record<string, string> = {};\n\tfor (const name of await readdir(dir)) {\n\t\tsecrets[name] = (await readFile(join(dir, name), 'utf8')).trim();\n\t}\n\treturn secrets;\n}\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\troot: string;\n\t\t\tmanifest: ConstructManifest;\n\t\t\tpatterns: string[];\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\t// Where each construct is declared, so a migration runs with the Kysely\n\t\t// its own file resolves. The manifest itself is the deploy's: what it\n\t\t// provisioned is what gets migrated, not a second reading of the files.\n\t\tconst sources: Record<string, ConstructSource> = {};\n\t\tif (request.patterns.length > 0) {\n\t\t\tawait discover({\n\t\t\t\tpatterns: request.patterns,\n\t\t\t\tcwd: request.root,\n\t\t\t\tsources,\n\t\t\t});\n\t\t}\n\n\t\tconst runs = await migrateDatabases({\n\t\t\troot: request.root,\n\t\t\tmanifest: request.manifest,\n\t\t\tsources,\n\t\t\tenv: await mountedSecrets(),\n\t\t});\n\n\t\tanswer({\n\t\t\treason: 'migrated',\n\t\t\truns: runs.map(({ target, applied }) => ({\n\t\t\t\tmigrations: target.migrations,\n\t\t\t\tapplied,\n\t\t\t})),\n\t\t});\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAsBA,eAAe,iBAAkD;CAChE,MAAM,MAAM,QAAQ,IAAI;CACxB,IAAI,CAAC,KAAK,OAAO,CAAC;CAElB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,MAAM,QAAQ,GAAG,GACnC,QAAQ,SAAS,MAAM,SAAS,KAAK,KAAK,IAAI,GAAG,MAAM,EAAA,CAAG,KAAK;CAEhE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAKlD,MAAM,yBAAyB;EAK/B,MAAM,UAA2C,CAAC;EAClD,IAAI,QAAQ,SAAS,SAAS,GAC7B,MAAM,SAAS;GACd,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAGF,MAAM,OAAO,MAAM,iBAAiB;GACnC,MAAM,QAAQ;GACd,UAAU,QAAQ;GAClB;GACA,KAAK,MAAM,eAAe;EAC3B,CAAC;EAED,OAAO;GACN,QAAQ;GACR,MAAM,KAAK,KAAK,EAAE,QAAQ,eAAe;IACxC,YAAY,OAAO;IACnB;GACD,EAAE;EACH,CAAC;CACF,SAAS,OAAO;EACf,OAAO;GAAE,QAAQ;GAAU,OAAO,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/{schemas-D2LCF689.mjs → schemas-Cfhtpdo0.mjs}

@@ -5439,6 +5439,14 @@ function object(shape, params) {
 	};
 	return new ZodObject(def);
 }
+function looseObject(shape, params) {
+	return new ZodObject({
+		type: "object",
+		shape,
+		catchall: unknown(),
+		...normalizeParams(params)
+	});
+}
 const ZodUnion = /*@__PURE__*/ $constructor("ZodUnion", (inst, def) => {
 	$ZodUnion.init(inst, def);
 	ZodType.init(inst, def);
@@ -5754,6 +5762,6 @@ function superRefine(fn, params) {
 	return /* @__PURE__ */ _superRefine(fn, params);
 }
 //#endregion
-export { discriminatedUnion as a, object as c, tuple as d, union as f, custom as i, record as l, url as m, array as n, literal as o, unknown as p, boolean as r, number as s, _enum as t, string as u };
+export { discriminatedUnion as a, number as c, string as d, tuple as f, url as h, custom as i, object as l, unknown as m, array as n, literal as o, union as p, boolean as r, looseObject as s, _enum as t, record as u };
 
-//# sourceMappingURL=schemas-D2LCF689.mjs.map
+//# sourceMappingURL=schemas-Cfhtpdo0.mjs.map