@geekmidas/cli 10.0.0-alpha.91 → 10.0.0-alpha.92

package/dist/{config-pST7E0CS.d.cts → config-BJo8Wggp.d.mts}

@@ -1,6 +1,6 @@
-import { b as NormalizedAppConfig, r as GkmConfig, v as LoadedConfig, x as NormalizedWorkspace } from "./types-NqX1Hz4P.cjs";
-import { n as Sandbox } from "./sandbox-M8UnLhXE.cjs";
-import "./index-D-F_hTDz.cjs";
+import { Dt as GkmError, b as NormalizedAppConfig, r as GkmConfig, v as LoadedConfig, x as NormalizedWorkspace } from "./types-B3Gqs175.mjs";
+import { n as Sandbox } from "./sandbox-C3WsTa5m.mjs";
+import "./index-D1pHwqkK.mjs";
 import { ConstructManifest } from "@geekmidas/manifest";
 //#region src/dev/discovery.d.ts
 /** Where an app is in its life. `stopped` is a server that exited on its own. */
@@ -129,7 +129,7 @@ interface ConfigDiscoveryResult {
  */
 declare function findWorkspaceRoot(cwd: string): string;
 /** No gkm config in a directory or any of its parents. */
-declare class ConfigNotFound extends Error {
+declare class ConfigNotFound extends GkmError {
   readonly cwd: string;
   constructor(cwd: string);
 }
@@ -212,7 +212,7 @@ declare function loadWorkspaceConfig(cwd?: string, options?: LoadConfigOptions):
  * declares — there is no second path that reads a hand-written compose file or
  * an `apps` block's ports. A config that declares nothing has nothing to run.
  */
-declare class WorkspaceDeclaresNoConstructs extends Error {
+declare class WorkspaceDeclaresNoConstructs extends GkmError {
   readonly root: string;
   constructor(root: string);
 }
@@ -225,7 +225,7 @@ interface AppConfigResult {
   appRoot: string;
 }
 /** A directory that no app in the workspace lives in. */
-declare class NotInAnApp extends Error {
+declare class NotInAnApp extends GkmError {
   readonly cwd: string;
   readonly apps: Readonly<Record<string, string>>;
   constructor(cwd: string, apps: Readonly<Record<string, string>>);
@@ -245,7 +245,7 @@ declare class NotInAnApp extends Error {
  */
 declare function loadAppConfig(cwd?: string): Promise<AppConfigResult>;
 /** The app a directory is in has no gkm config — a site, or an entry app. */
-declare class NotABackendApp extends Error {
+declare class NotABackendApp extends GkmError {
   readonly appName: string;
   constructor(appName: string);
 }
@@ -266,4 +266,4 @@ interface WorkspaceAppInfo {
 declare function loadWorkspaceAppInfo(cwd?: string): Promise<WorkspaceAppInfo>;
 //#endregion
 export { DiscoveredApp as C, DiscoveryResponse as D, DiscoveryEvent as E, DataApiKind as S, DiscoveredWorkspace as T, loadWorkspaceAppInfo as _, ConfigNotFound as a, parseModuleConfig as b, NotABackendApp as c, WorkspaceAppInfo as d, WorkspaceDeclaresNoConstructs as f, loadConfig as g, loadAppConfig as h, ConfigLoadFailed as i, NotInAnApp as l, findWorkspaceRoot as m, CONFIG_LOAD_TIMEOUT_MS as n, ConfigObjectNotSerializable as o, defineConfig as p, ConfigDiscoveryResult as r, LoadConfigOptions as s, AppConfigResult as t, ParsedModuleConfig as u, loadWorkspaceConfig as v, DiscoveredDataApi as w, AppStatus as x, loadWorkspaceSettings as y };
-//# sourceMappingURL=config-pST7E0CS.d.cts.map
+//# sourceMappingURL=config-BJo8Wggp.d.mts.map

package/dist/{config-CdEcTrjG.d.mts.map → config-BJo8Wggp.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"config-CdEcTrjG.d.mts","names":[],"sources":["../src/dev/discovery.ts","../src/config.ts"],"mappings":";;;;;;KAoFY;;KAGA;;;;;;UAyBK;;EAEhB;;EAEA;;UA8BgB;EAChB,MAAM;;EAEN;;EAEA;;EAEA;;UAGgB;EAChB;EACA;EACA;;EAEA;EACA;EACA,QAAQ;EACR;;EAEA;EACA,UAAU;;UAGM;;EAEhB;EACA;EACA;EACA;EACA,UAAU;;EAEV,WAAW;EACX,MAAM;;;UAIU;EAChB;;EAEA;IAAQ;IAAa;;;EAErB;EACA,YAAY;;;KAID;EACP;EAAkB,UAAU;;EAC5B;EAAiD;;EAEnD;EACA;EACA,KAAK;;;;;;;;;;;;;;;;;;;;;iBCpJQ,aAAa,QAAQ,YAAY;UAIhC;EAChB;EACA;;;;;;;;;;;;;;;;;;;iBAoBe,kBACf,sBACA,uBACE;UAac;EAChB;EACA;;;;;;;;iBAgDe,kBAAkB;;cAKrB,uBAAuB;WACd;EAArB,YAAqB;;UAaL;;;;;;;;EAQhB,UAAU;;;;;EAKV;;;;;;;cAQY;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,oBACA;;;;;;;cAYE,oCAAoC;WAEtC;WACA;EAFV,YACU,oBACA;;;;;;;;iBA0GW,WACrB,eACE,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuCW,sBACrB,cACA,UAAS,oBACP,QAAQ;iBAKW,oBACrB,cACA,UAAS,oBACP,QAAQ;;;;;;;;cAmEE,sCAAsC;WAC7B;EAArB,YAAqB;;UAWL;EAChB;EACA,KAAK;EACL,WAAW;EACX,WAAW;EACX;EACA;;;cAqCY,mBAAmB;WAErB;WACA,MAAM,SAAS;EAFzB,YACU,aACA,MAAM,SAAS;;;;;;;;;;;;;;;iBAoCJ,cACrB,eACE,QAAQ;;cAkBE,uBAAuB;WACd;EAArB,YAAqB;;UAQL;;EAEhB;EACA,KAAK;EACL,WAAW;EACX;;;;;;;;;iBAUqB,qBACrB,eACE,QAAQ"}
+{"version":3,"file":"config-BJo8Wggp.d.mts","names":[],"sources":["../src/dev/discovery.ts","../src/config.ts"],"mappings":";;;;;;KAqFY;;KAGA;;;;;;UAyBK;;EAEhB;;EAEA;;UA8BgB;EAChB,MAAM;;EAEN;;EAEA;;EAEA;;UAGgB;EAChB;EACA;EACA;;EAEA;EACA;EACA,QAAQ;EACR;;EAEA;EACA,UAAU;;UAGM;;EAEhB;EACA;EACA;EACA;EACA,UAAU;;EAEV,WAAW;EACX,MAAM;;;UAIU;EAChB;;EAEA;IAAQ;IAAa;;;EAErB;EACA,YAAY;;;KAID;EACP;EAAkB,UAAU;;EAC5B;EAAiD;;EAEnD;EACA;EACA,KAAK;;;;;;;;;;;;;;;;;;;;;iBCpJQ,aAAa,QAAQ,YAAY;UAIhC;EAChB;EACA;;;;;;;;;;;;;;;;;;;iBAoBe,kBACf,sBACA,uBACE;UAac;EAChB;EACA;;;;;;;;iBAgDe,kBAAkB;;cAKrB,uBAAuB;WACd;EAArB,YAAqB;;UAaL;;;;;;;;EAQhB,UAAU;;;;;EAKV;;;;;;;cAQY;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,oBACA;;;;;;;cAYE,oCAAoC;WAEtC;WACA;EAFV,YACU,oBACA;;;;;;;;iBA0GW,WACrB,eACE,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuCW,sBACrB,cACA,UAAS,oBACP,QAAQ;iBAKW,oBACrB,cACA,UAAS,oBACP,QAAQ;;;;;;;;cAmEE,sCAAsC;WAC7B;EAArB,YAAqB;;UAWL;EAChB;EACA,KAAK;EACL,WAAW;EACX,WAAW;EACX;EACA;;;cAqCY,mBAAmB;WAErB;WACA,MAAM,SAAS;EAFzB,YACU,aACA,MAAM,SAAS;;;;;;;;;;;;;;;iBAoCJ,cACrB,eACE,QAAQ;;cAkBE,uBAAuB;WACd;EAArB,YAAqB;;UAQL;;EAEhB;EACA,KAAK;EACL,WAAW;EACX;;;;;;;;;iBAUqB,qBACrB,eACE,QAAQ"}

package/dist/{config-CdEcTrjG.d.mts → config-C9zx7KsX.d.cts}

@@ -1,6 +1,6 @@
-import { n as Sandbox } from "./sandbox-M8UnLhXE.mjs";
-import { b as NormalizedAppConfig, r as GkmConfig, v as LoadedConfig, x as NormalizedWorkspace } from "./types-ZHuZ89hv.mjs";
-import "./index-YFNxR5Ns.mjs";
+import { Dt as GkmError, b as NormalizedAppConfig, r as GkmConfig, v as LoadedConfig, x as NormalizedWorkspace } from "./types-Bk9st2cd.cjs";
+import { n as Sandbox } from "./sandbox-MaxSeU92.cjs";
+import "./index-B5uuwx-Y.cjs";
 import { ConstructManifest } from "@geekmidas/manifest";
 //#region src/dev/discovery.d.ts
 /** Where an app is in its life. `stopped` is a server that exited on its own. */
@@ -129,7 +129,7 @@ interface ConfigDiscoveryResult {
  */
 declare function findWorkspaceRoot(cwd: string): string;
 /** No gkm config in a directory or any of its parents. */
-declare class ConfigNotFound extends Error {
+declare class ConfigNotFound extends GkmError {
   readonly cwd: string;
   constructor(cwd: string);
 }
@@ -212,7 +212,7 @@ declare function loadWorkspaceConfig(cwd?: string, options?: LoadConfigOptions):
  * declares — there is no second path that reads a hand-written compose file or
  * an `apps` block's ports. A config that declares nothing has nothing to run.
  */
-declare class WorkspaceDeclaresNoConstructs extends Error {
+declare class WorkspaceDeclaresNoConstructs extends GkmError {
   readonly root: string;
   constructor(root: string);
 }
@@ -225,7 +225,7 @@ interface AppConfigResult {
   appRoot: string;
 }
 /** A directory that no app in the workspace lives in. */
-declare class NotInAnApp extends Error {
+declare class NotInAnApp extends GkmError {
   readonly cwd: string;
   readonly apps: Readonly<Record<string, string>>;
   constructor(cwd: string, apps: Readonly<Record<string, string>>);
@@ -245,7 +245,7 @@ declare class NotInAnApp extends Error {
  */
 declare function loadAppConfig(cwd?: string): Promise<AppConfigResult>;
 /** The app a directory is in has no gkm config — a site, or an entry app. */
-declare class NotABackendApp extends Error {
+declare class NotABackendApp extends GkmError {
   readonly appName: string;
   constructor(appName: string);
 }
@@ -266,4 +266,4 @@ interface WorkspaceAppInfo {
 declare function loadWorkspaceAppInfo(cwd?: string): Promise<WorkspaceAppInfo>;
 //#endregion
 export { DiscoveredApp as C, DiscoveryResponse as D, DiscoveryEvent as E, DataApiKind as S, DiscoveredWorkspace as T, loadWorkspaceAppInfo as _, ConfigNotFound as a, parseModuleConfig as b, NotABackendApp as c, WorkspaceAppInfo as d, WorkspaceDeclaresNoConstructs as f, loadConfig as g, loadAppConfig as h, ConfigLoadFailed as i, NotInAnApp as l, findWorkspaceRoot as m, CONFIG_LOAD_TIMEOUT_MS as n, ConfigObjectNotSerializable as o, defineConfig as p, ConfigDiscoveryResult as r, LoadConfigOptions as s, AppConfigResult as t, ParsedModuleConfig as u, loadWorkspaceConfig as v, DiscoveredDataApi as w, AppStatus as x, loadWorkspaceSettings as y };
-//# sourceMappingURL=config-CdEcTrjG.d.mts.map
+//# sourceMappingURL=config-C9zx7KsX.d.cts.map

package/dist/{config-pST7E0CS.d.cts.map → config-C9zx7KsX.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"config-pST7E0CS.d.cts","names":[],"sources":["../src/dev/discovery.ts","../src/config.ts"],"mappings":";;;;;;KAoFY;;KAGA;;;;;;UAyBK;;EAEhB;;EAEA;;UA8BgB;EAChB,MAAM;;EAEN;;EAEA;;EAEA;;UAGgB;EAChB;EACA;EACA;;EAEA;EACA;EACA,QAAQ;EACR;;EAEA;EACA,UAAU;;UAGM;;EAEhB;EACA;EACA;EACA;EACA,UAAU;;EAEV,WAAW;EACX,MAAM;;;UAIU;EAChB;;EAEA;IAAQ;IAAa;;;EAErB;EACA,YAAY;;;KAID;EACP;EAAkB,UAAU;;EAC5B;EAAiD;;EAEnD;EACA;EACA,KAAK;;;;;;;;;;;;;;;;;;;;;iBCpJQ,aAAa,QAAQ,YAAY;UAIhC;EAChB;EACA;;;;;;;;;;;;;;;;;;;iBAoBe,kBACf,sBACA,uBACE;UAac;EAChB;EACA;;;;;;;;iBAgDe,kBAAkB;;cAKrB,uBAAuB;WACd;EAArB,YAAqB;;UAaL;;;;;;;;EAQhB,UAAU;;;;;EAKV;;;;;;;cAQY;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,oBACA;;;;;;;cAYE,oCAAoC;WAEtC;WACA;EAFV,YACU,oBACA;;;;;;;;iBA0GW,WACrB,eACE,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuCW,sBACrB,cACA,UAAS,oBACP,QAAQ;iBAKW,oBACrB,cACA,UAAS,oBACP,QAAQ;;;;;;;;cAmEE,sCAAsC;WAC7B;EAArB,YAAqB;;UAWL;EAChB;EACA,KAAK;EACL,WAAW;EACX,WAAW;EACX;EACA;;;cAqCY,mBAAmB;WAErB;WACA,MAAM,SAAS;EAFzB,YACU,aACA,MAAM,SAAS;;;;;;;;;;;;;;;iBAoCJ,cACrB,eACE,QAAQ;;cAkBE,uBAAuB;WACd;EAArB,YAAqB;;UAQL;;EAEhB;EACA,KAAK;EACL,WAAW;EACX;;;;;;;;;iBAUqB,qBACrB,eACE,QAAQ"}
+{"version":3,"file":"config-C9zx7KsX.d.cts","names":[],"sources":["../src/dev/discovery.ts","../src/config.ts"],"mappings":";;;;;;KAqFY;;KAGA;;;;;;UAyBK;;EAEhB;;EAEA;;UA8BgB;EAChB,MAAM;;EAEN;;EAEA;;EAEA;;UAGgB;EAChB;EACA;EACA;;EAEA;EACA;EACA,QAAQ;EACR;;EAEA;EACA,UAAU;;UAGM;;EAEhB;EACA;EACA;EACA;EACA,UAAU;;EAEV,WAAW;EACX,MAAM;;;UAIU;EAChB;;EAEA;IAAQ;IAAa;;;EAErB;EACA,YAAY;;;KAID;EACP;EAAkB,UAAU;;EAC5B;EAAiD;;EAEnD;EACA;EACA,KAAK;;;;;;;;;;;;;;;;;;;;;iBCpJQ,aAAa,QAAQ,YAAY;UAIhC;EAChB;EACA;;;;;;;;;;;;;;;;;;;iBAoBe,kBACf,sBACA,uBACE;UAac;EAChB;EACA;;;;;;;;iBAgDe,kBAAkB;;cAKrB,uBAAuB;WACd;EAArB,YAAqB;;UAaL;;;;;;;;EAQhB,UAAU;;;;;EAKV;;;;;;;cAQY;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,oBACA;;;;;;;cAYE,oCAAoC;WAEtC;WACA;EAFV,YACU,oBACA;;;;;;;;iBA0GW,WACrB,eACE,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuCW,sBACrB,cACA,UAAS,oBACP,QAAQ;iBAKW,oBACrB,cACA,UAAS,oBACP,QAAQ;;;;;;;;cAmEE,sCAAsC;WAC7B;EAArB,YAAqB;;UAWL;EAChB;EACA,KAAK;EACL,WAAW;EACX,WAAW;EACX;EACA;;;cAqCY,mBAAmB;WAErB;WACA,MAAM,SAAS;EAFzB,YACU,aACA,MAAM,SAAS;;;;;;;;;;;;;;;iBAoCJ,cACrB,eACE,QAAQ;;cAkBE,uBAAuB;WACd;EAArB,YAAqB;;UAQL;;EAEhB;EACA,KAAK;EACL,WAAW;EACX;;;;;;;;;iBAUqB,qBACrB,eACE,QAAQ"}

package/dist/config.cjs

@@ -1,9 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_schemas = require("./schemas-BObwxB_t.cjs");
-const require_discover = require("./discover-D1It5r_h.cjs");
-const require_sandbox = require("./sandbox-CL--ZDui.cjs");
+const require_discover = require("./discover-DPgu-ScS.cjs");
+const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-CwW3Gkru.cjs");
+const require_workspace = require("./workspace-CHOB2Xg3.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 //#region src/config.ts
@@ -95,7 +96,7 @@ function findWorkspaceRoot(cwd) {
 	return findConfigPath(cwd).workspaceRoot;
 }
 /** No gkm config in a directory or any of its parents. */
-var ConfigNotFound = class extends Error {
+var ConfigNotFound = class extends require_errors.GkmError {
 	cwd;
 	constructor(cwd) {
 		super("Configuration file not found. Please create gkm.config.json, gkm.config.ts, or gkm.config.js in the project root.");
@@ -293,7 +294,7 @@ async function withDerivedApps(loaded, sandbox) {
 * declares — there is no second path that reads a hand-written compose file or
 * an `apps` block's ports. A config that declares nothing has nothing to run.
 */
-var WorkspaceDeclaresNoConstructs = class extends Error {
+var WorkspaceDeclaresNoConstructs = class extends require_errors.GkmError {
 	root;
 	constructor(root) {
 		super(`The workspace at ${root} declares no constructs. Every workspace names where its constructs live — \`constructs: ['./constructs/**/*.ts', './apps/*/endpoints/**/*.ts']\` in gkm.config.ts — and its apps, containers and URLs are derived from them.`);
@@ -332,7 +333,7 @@ function real(path) {
 	return (0, node_fs.existsSync)(absolute) ? (0, node_fs.realpathSync)(absolute) : absolute;
 }
 /** A directory that no app in the workspace lives in. */
-var NotInAnApp = class extends Error {
+var NotInAnApp = class extends require_errors.GkmError {
 	cwd;
 	apps;
 	constructor(cwd, apps) {
@@ -373,7 +374,7 @@ async function loadAppConfig(cwd = process.cwd()) {
 	};
 }
 /** The app a directory is in has no gkm config — a site, or an entry app. */
-var NotABackendApp = class extends Error {
+var NotABackendApp = class extends require_errors.GkmError {
 	appName;
 	constructor(appName) {
 		super(`App "${appName}" is not a backend app and cannot be run with gkm dev.`);

package/dist/config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.cjs","names":["existsSync","dirname","parse","join","runWorker","activeSandbox","isWorkspaceConfig","processConfig","allConstructGlobs","discover","derivedApps","sep","resolve","realpathSync","getAppGkmConfig"],"sources":["../src/config.ts"],"sourcesContent":["import { existsSync, realpathSync } from 'node:fs';\nimport { dirname, join, parse, resolve, sep } from 'node:path';\nimport { z } from 'zod';\nimport { output } from './output.js';\nimport { discover } from './reconcile/discover.js';\nimport { activeSandbox, type Sandbox } from './sandbox/sandbox.js';\nimport { runWorker } from './sandbox/worker.js';\nimport type { GkmConfig } from './types.js';\nimport { derivedApps } from './workspace/derive.js';\nimport {\n\tallConstructGlobs,\n\tgetAppGkmConfig,\n\tisWorkspaceConfig,\n\ttype LoadedConfig,\n\ttype NormalizedAppConfig,\n\ttype NormalizedWorkspace,\n\tprocessConfig,\n\ttype WorkspaceConfig,\n} from './workspace/index.js';\n\n// What `gkm dev`'s discovery endpoint answers, for the tools that read it.\nexport type {\n\tAppStatus,\n\tDataApiKind,\n\tDiscoveredApp,\n\tDiscoveredDataApi,\n\tDiscoveredWorkspace,\n\tDiscoveryEvent,\n\tDiscoveryResponse,\n} from './dev/discovery.js';\nexport type { GkmConfig } from './types.js';\nexport type { LoadedConfig, WorkspaceConfig } from './workspace/index.js';\nexport { defineWorkspace } from './workspace/index.js';\nexport type { DevConfig } from './workspace/types.js';\n/**\n * Define GKM configuration with full TypeScript support.\n * This is an identity function that provides type safety and autocomplete.\n *\n * @example\n * ```ts\n * // gkm.config.ts\n * import { defineConfig } from '@geekmidas/cli/config';\n *\n * export default defineConfig({\n *   routes: './src/endpoints/**\\/*.ts',\n *   envParser: './src/config/env',\n *   logger: './src/config/logger',\n *   telescope: true,\n * });\n * ```\n */\nexport function defineConfig(config: GkmConfig): GkmConfig {\n\treturn config;\n}\n\nexport interface ParsedModuleConfig {\n\tpath: string;\n\timportPattern: string;\n}\n\n/**\n * Parse a module config string into path and import pattern.\n *\n * @param configString - Config string in format \"./path/to/module\" or \"./path/to/module#exportName\"\n * @param defaultAlias - The default alias name to use if no export name specified\n * @returns Object with path and import pattern\n *\n * @example\n * parseModuleConfig('./src/config/env', 'envParser')\n * // { path: './src/config/env', importPattern: 'envParser' }\n *\n * parseModuleConfig('./src/config/env#envParser', 'envParser')\n * // { path: './src/config/env', importPattern: '{ envParser }' }\n *\n * parseModuleConfig('./src/config/env#myEnv', 'envParser')\n * // { path: './src/config/env', importPattern: '{ myEnv as envParser }' }\n */\nexport function parseModuleConfig(\n\tconfigString: string,\n\tdefaultAlias: string,\n): ParsedModuleConfig {\n\tconst parts = configString.split('#');\n\tconst path = parts[0] ?? configString;\n\tconst exportName = parts[1];\n\tconst importPattern = !exportName\n\t\t? defaultAlias\n\t\t: exportName === defaultAlias\n\t\t\t? `{ ${defaultAlias} }`\n\t\t\t: `{ ${exportName} as ${defaultAlias} }`;\n\n\treturn { path, importPattern };\n}\n\nexport interface ConfigDiscoveryResult {\n\tconfigPath: string;\n\tworkspaceRoot: string;\n}\n\n/**\n * Find and return the path to the config file.\n *\n * Resolution order:\n * 1. GKM_CONFIG_PATH env var (set by workspace dev command)\n * 2. Walk up directory tree from cwd\n */\nfunction findConfigPath(cwd: string): ConfigDiscoveryResult {\n\tconst files = ['gkm.config.json', 'gkm.config.ts', 'gkm.config.js'];\n\n\t// Check GKM_CONFIG_PATH env var first (set by workspace dev command)\n\tconst envConfigPath = process.env.GKM_CONFIG_PATH;\n\tif (envConfigPath && existsSync(envConfigPath)) {\n\t\treturn {\n\t\t\tconfigPath: envConfigPath,\n\t\t\tworkspaceRoot: dirname(envConfigPath),\n\t\t};\n\t}\n\n\t// Walk up directory tree to find config\n\tlet currentDir = cwd;\n\tconst { root } = parse(currentDir);\n\n\twhile (currentDir !== root) {\n\t\tfor (const file of files) {\n\t\t\tconst configPath = join(currentDir, file);\n\t\t\tif (existsSync(configPath)) {\n\t\t\t\treturn {\n\t\t\t\t\tconfigPath,\n\t\t\t\t\tworkspaceRoot: currentDir,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t\tcurrentDir = dirname(currentDir);\n\t}\n\n\tthrow new ConfigNotFound(cwd);\n}\n\n/**\n * The directory holding the gkm config that `cwd` belongs to — the project a\n * sandbox for it is confined to.\n *\n * @throws {ConfigNotFound} when neither `cwd` nor any parent has one.\n */\nexport function findWorkspaceRoot(cwd: string): string {\n\treturn findConfigPath(cwd).workspaceRoot;\n}\n\n/** No gkm config in a directory or any of its parents. */\nexport class ConfigNotFound extends Error {\n\tconstructor(readonly cwd: string) {\n\t\tsuper(\n\t\t\t'Configuration file not found. Please create gkm.config.json, gkm.config.ts, or gkm.config.js in the project root.',\n\t\t);\n\t\tthis.name = 'ConfigNotFound';\n\t}\n}\n\ninterface RawConfigResult {\n\tconfig: GkmConfig | WorkspaceConfig;\n\tworkspaceRoot: string;\n}\n\nexport interface LoadConfigOptions {\n\t/**\n\t * Load the config — and discover the constructs it names — in this\n\t * sandbox rather than in this process. The config then arrives as data;\n\t * see {@link Sandbox.isolating} for what happens to one holding live\n\t * objects. Defaults to the run's own (`withSandbox`); with neither, the\n\t * config is imported here, as `gkm` always has.\n\t */\n\tsandbox?: Sandbox;\n\t/**\n\t * How long the sandboxed config load may run. Defaults to\n\t * {@link CONFIG_LOAD_TIMEOUT_MS}.\n\t */\n\ttimeoutMs?: number;\n}\n\n/**\n * How long loading a config, or discovering its constructs, may take in a\n * sandbox: room for tsx to compile a large project cold, and not a deploy\n * held open by a config that never finishes importing.\n */\nexport const CONFIG_LOAD_TIMEOUT_MS = 60_000;\n\n/** The config failed to import, or threw while it ran. */\nexport class ConfigLoadFailed extends Error {\n\tconstructor(\n\t\treadonly configPath: string,\n\t\treadonly detail: string,\n\t) {\n\t\tsuper(`Failed to load config: ${detail}`);\n\t\tthis.name = 'ConfigLoadFailed';\n\t}\n}\n\n/**\n * The config holds something that is not data — a custom state store, an\n * inline deploy target, a function — and the sandbox it was loaded in hands\n * the deploy nothing but data.\n */\nexport class ConfigObjectNotSerializable extends Error {\n\tconstructor(\n\t\treadonly configPath: string,\n\t\treadonly paths: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`${configPath} holds values that are not plain data at: ` +\n\t\t\t\t`${paths.join(', ')}. It was loaded in an isolating sandbox, which ` +\n\t\t\t\t'hands the deploy the config as JSON, so a live object — a custom ' +\n\t\t\t\t'store, an inline target, a function — cannot reach it. Configure ' +\n\t\t\t\t'these with plain values instead, or deploy this project with a ' +\n\t\t\t\t'sandbox that is not isolating (the default) if the host trusts it.',\n\t\t);\n\t\tthis.name = 'ConfigObjectNotSerializable';\n\t}\n}\n\n/** What the config worker answers. Checked: the worker ran project code. */\nconst ConfigAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('loaded'),\n\t\tconfig: z.record(z.string(), z.unknown()),\n\t}),\n\tz.object({ reason: z.literal('live'), paths: z.array(z.string()) }),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }),\n\t}),\n]);\n\n/** Import the config in this process — live objects and all. */\nasync function importConfig(\n\tconfigPath: string,\n): Promise<GkmConfig | WorkspaceConfig> {\n\ttry {\n\t\tconst config = await import(configPath);\n\t\treturn config.default;\n\t} catch (error) {\n\t\tthrow new ConfigLoadFailed(configPath, (error as Error).message);\n\t}\n}\n\n/**\n * The config, loaded in `sandbox` and handed back as JSON.\n *\n * A config holding live objects cannot come back that way. An isolating\n * sandbox refuses it with {@link ConfigObjectNotSerializable}; any other\n * imports it here as well, as before, since the host already runs this\n * project's code as its own.\n */\nasync function loadConfigInSandbox(\n\tsandbox: Sandbox,\n\tconfigPath: string,\n\tworkspaceRoot: string,\n\ttimeoutMs = CONFIG_LOAD_TIMEOUT_MS,\n): Promise<GkmConfig | WorkspaceConfig> {\n\tconst { value } = await runWorker(sandbox, 'config load', {\n\t\tname: 'config-worker',\n\t\targs: [configPath],\n\t\tcwd: workspaceRoot,\n\t\ttimeoutMs,\n\t\tschema: ConfigAnswer,\n\t});\n\n\tswitch (value.reason) {\n\t\tcase 'loaded':\n\t\t\t// Its shape is `processConfig`'s to check, against the workspace\n\t\t\t// schema, exactly as for a config imported here.\n\t\t\treturn value.config as unknown as GkmConfig | WorkspaceConfig;\n\t\tcase 'failed':\n\t\t\tthrow new ConfigLoadFailed(configPath, value.error.message);\n\t\tcase 'live':\n\t\t\tif (sandbox.isolating) {\n\t\t\t\tthrow new ConfigObjectNotSerializable(configPath, value.paths);\n\t\t\t}\n\t\t\treturn importConfig(configPath);\n\t}\n}\n\n/**\n * Load raw configuration from file.\n */\nasync function loadRawConfig(\n\tcwd: string,\n\toptions: LoadConfigOptions = {},\n): Promise<RawConfigResult> {\n\tconst { configPath, workspaceRoot } = findConfigPath(cwd);\n\t// The run's own sandbox when none is given: a deploy reloads the config\n\t// deep in the engine (generating Dockerfiles), and that load is the\n\t// project's code as much as the first.\n\tconst sandbox = options.sandbox ?? activeSandbox();\n\tconst config = sandbox\n\t\t? await loadConfigInSandbox(\n\t\t\t\tsandbox,\n\t\t\t\tconfigPath,\n\t\t\t\tworkspaceRoot,\n\t\t\t\toptions.timeoutMs,\n\t\t\t)\n\t\t: await importConfig(configPath);\n\n\treturn { config, workspaceRoot };\n}\n\n/**\n * Load configuration file (single-app format).\n * For backwards compatibility with existing code.\n *\n * @deprecated Use loadWorkspaceConfig for new code\n */\nexport async function loadConfig(\n\tcwd: string = process.cwd(),\n): Promise<GkmConfig> {\n\tconst { config } = await loadRawConfig(cwd);\n\n\t// If it's a workspace config, throw an error\n\tif (isWorkspaceConfig(config)) {\n\t\tthrow new Error(\n\t\t\t'Workspace configuration detected. Use loadWorkspaceConfig() instead.',\n\t\t);\n\t}\n\n\treturn config;\n}\n\n/**\n * Load configuration file and process it as a workspace.\n * Works with both single-app and workspace configurations.\n *\n * Single-app configs are automatically wrapped as a workspace with one app.\n *\n * @example\n * ```ts\n * const { type, workspace } = await loadWorkspaceConfig();\n *\n * if (type === 'workspace') {\n *   console.log('Multi-app workspace:', workspace.apps);\n * } else {\n *   console.log('Single app wrapped as workspace');\n * }\n * ```\n */\n/**\n * The workspace a directory belongs to, as its config states it — without\n * discovering its constructs.\n *\n * For callers that need a fact the config holds (where a stage's secrets are\n * stored) and nothing the graph adds. `loadWorkspaceConfig` imports every\n * construct module to derive the apps, which is a cost a secrets read should\n * not pay.\n */\nexport async function loadWorkspaceSettings(\n\tcwd: string = process.cwd(),\n\toptions: LoadConfigOptions = {},\n): Promise<LoadedConfig['workspace']> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd, options);\n\treturn processConfig(config, workspaceRoot).workspace;\n}\n\nexport async function loadWorkspaceConfig(\n\tcwd: string = process.cwd(),\n\toptions: LoadConfigOptions = {},\n): Promise<LoadedConfig> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd, options);\n\treturn withDerivedApps(processConfig(config, workspaceRoot), options.sandbox);\n}\n\n/**\n * The loaded config, with its apps read off the graph.\n *\n * Here rather than at each call site because every command needs the same\n * answer, and the ones that forgot to ask were exactly the bugs: a site that\n * never deployed, a surface that could not be its own process. `gkm dev`,\n * `gkm build`, `gkm docker` and `gkm deploy` now all see the same apps without\n * any of them knowing a derivation happened.\n *\n * Discovery imports the construct modules — declarations only, not endpoints —\n * which is the same import the reconciler and the build already do. A workspace\n * with no `constructs` glob discovers nothing and keeps whatever its config\n * said, so nothing that worked before changes.\n *\n * A construct file that throws is reported and skipped rather than taking the\n * command down: `gkm dev` failing to start because a half-written declaration\n * cannot be imported is a worse failure than starting with the app it does not\n * describe yet.\n */\nasync function withDerivedApps(\n\tloaded: LoadedConfig,\n\tsandbox?: Sandbox,\n): Promise<LoadedConfig> {\n\tconst globs = allConstructGlobs(loaded.workspace);\n\tif (globs.length === 0) {\n\t\tthrow new WorkspaceDeclaresNoConstructs(loaded.workspace.root);\n\t}\n\n\ttry {\n\t\tconst background: Record<string, string[]> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: globs,\n\t\t\tcwd: loaded.workspace.root,\n\t\t\tbackground,\n\t\t\t...(sandbox ? { sandbox } : {}),\n\t\t});\n\n\t\treturn {\n\t\t\t...loaded,\n\t\t\tmanifest,\n\t\t\tbackground,\n\t\t\tworkspace: {\n\t\t\t\t...loaded.workspace,\n\t\t\t\tapps: derivedApps(manifest, loaded.workspace),\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\toutput.warn(\n\t\t\t`⚠️  Could not read constructs, so apps come from config alone: ${message}`,\n\t\t);\n\t\treturn loaded;\n\t}\n}\n\n/**\n * A workspace with no `constructs` glob.\n *\n * In v10 every address, container and app comes from what the workspace\n * declares — there is no second path that reads a hand-written compose file or\n * an `apps` block's ports. A config that declares nothing has nothing to run.\n */\nexport class WorkspaceDeclaresNoConstructs extends Error {\n\tconstructor(readonly root: string) {\n\t\tsuper(\n\t\t\t`The workspace at ${root} declares no constructs. Every workspace names ` +\n\t\t\t\t\"where its constructs live — `constructs: ['./constructs/**/*.ts', \" +\n\t\t\t\t\"'./apps/*/endpoints/**/*.ts']` in gkm.config.ts — and its apps, \" +\n\t\t\t\t'containers and URLs are derived from them.',\n\t\t);\n\t\tthis.name = 'WorkspaceDeclaresNoConstructs';\n\t}\n}\n\nexport interface AppConfigResult {\n\tappName: string;\n\tapp: NormalizedAppConfig;\n\tgkmConfig: GkmConfig;\n\tworkspace: NormalizedWorkspace;\n\tworkspaceRoot: string;\n\tappRoot: string;\n}\n\n/**\n * The app a directory is part of: the one whose `path` contains it.\n *\n * An app's path is the one its construct declares — `new RestApi('Api',\n * { path: 'apps/api' })` — read off the workspace the constructs were derived\n * into, never off the filesystem's package names. The deepest match wins, so\n * an app inside another app's folder is its own; the workspace root belongs to\n * no app unless one lives there.\n */\nfunction resolveWorkspaceApp(\n\tloadedConfig: LoadedConfig,\n\tcwd: string,\n): { key: string; app: NormalizedAppConfig } | undefined {\n\tconst here = real(cwd);\n\tlet found: { key: string; app: NormalizedAppConfig; dir: string } | undefined;\n\n\tfor (const [key, app] of Object.entries(loadedConfig.workspace.apps)) {\n\t\tconst dir = real(join(loadedConfig.workspace.root, app.path));\n\t\tconst inside = here === dir || here.startsWith(`${dir}${sep}`);\n\t\tif (inside && (!found || dir.length > found.dir.length)) {\n\t\t\tfound = { key, app, dir };\n\t\t}\n\t}\n\n\treturn found && { key: found.key, app: found.app };\n}\n\n/** A path with its symlinks resolved, where it exists — `/tmp` is `/private/tmp`. */\nfunction real(path: string): string {\n\tconst absolute = resolve(path);\n\treturn existsSync(absolute) ? realpathSync(absolute) : absolute;\n}\n\n/** A directory that no app in the workspace lives in. */\nexport class NotInAnApp extends Error {\n\tconstructor(\n\t\treadonly cwd: string,\n\t\treadonly apps: Readonly<Record<string, string>>,\n\t) {\n\t\tsuper(\n\t\t\t`${cwd} is not inside any app's path. Apps: ` +\n\t\t\t\tObject.entries(apps)\n\t\t\t\t\t.map(([key, path]) => `${key} (${path})`)\n\t\t\t\t\t.join(', ') +\n\t\t\t\t'.',\n\t\t);\n\t\tthis.name = 'NotInAnApp';\n\t}\n}\n\n/** Every app's path, by key — what `NotInAnApp` lists. */\nfunction appPaths(loadedConfig: LoadedConfig): Record<string, string> {\n\treturn Object.fromEntries(\n\t\tObject.entries(loadedConfig.workspace.apps).map(([key, app]) => [\n\t\t\tkey,\n\t\t\tapp.path,\n\t\t]),\n\t);\n}\n\n/**\n * The backend app a directory is part of, with its gkm config — found by the\n * `path` its construct declares.\n *\n * @example\n * ```ts\n * // From apps/api, where a construct declares `path: 'apps/api'`\n * const { app, workspace, workspaceRoot } = await loadAppConfig();\n * ```\n *\n * @throws {NotInAnApp} when no app's path contains the directory.\n * @throws {NotABackendApp} when the app it is in has no gkm config to run.\n */\nexport async function loadAppConfig(\n\tcwd: string = process.cwd(),\n): Promise<AppConfigResult> {\n\tconst { appName, app, workspace, workspaceRoot } =\n\t\tawait loadWorkspaceAppInfo(cwd);\n\n\tconst gkmConfig = getAppGkmConfig(workspace, appName);\n\tif (!gkmConfig) throw new NotABackendApp(appName);\n\n\treturn {\n\t\tappName,\n\t\tapp,\n\t\tgkmConfig,\n\t\tworkspace,\n\t\tworkspaceRoot,\n\t\tappRoot: join(workspaceRoot, app.path),\n\t};\n}\n\n/** The app a directory is in has no gkm config — a site, or an entry app. */\nexport class NotABackendApp extends Error {\n\tconstructor(readonly appName: string) {\n\t\tsuper(\n\t\t\t`App \"${appName}\" is not a backend app and cannot be run with gkm dev.`,\n\t\t);\n\t\tthis.name = 'NotABackendApp';\n\t}\n}\n\nexport interface WorkspaceAppInfo {\n\t/** The app's key in the workspace. */\n\tappName: string;\n\tapp: NormalizedAppConfig;\n\tworkspace: NormalizedWorkspace;\n\tworkspaceRoot: string;\n}\n\n/**\n * The app a directory is part of, frontend or backend — found by the `path`\n * its construct declares. Unlike `loadAppConfig`, the app need not have a\n * gkm config, which is what `gkm exec` and `gkm test` from a site need.\n *\n * @throws {NotInAnApp} when no app's path contains the directory.\n */\nexport async function loadWorkspaceAppInfo(\n\tcwd: string = process.cwd(),\n): Promise<WorkspaceAppInfo> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd);\n\tconst loadedConfig = await withDerivedApps(\n\t\tprocessConfig(config, workspaceRoot),\n\t);\n\n\tconst resolved = resolveWorkspaceApp(loadedConfig, cwd);\n\tif (!resolved) throw new NotInAnApp(cwd, appPaths(loadedConfig));\n\n\treturn {\n\t\tappName: resolved.key,\n\t\tapp: resolved.app,\n\t\tworkspace: loadedConfig.workspace,\n\t\tworkspaceRoot,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,aAAa,QAA8B;CAC1D,OAAO;AACR;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,kBACf,cACA,cACqB;CACrB,MAAM,QAAQ,aAAa,MAAM,GAAG;CACpC,MAAM,OAAO,MAAM,MAAM;CACzB,MAAM,aAAa,MAAM;CAOzB,OAAO;EAAE;EAAM,eANO,CAAC,aACpB,eACA,eAAe,eACd,KAAK,aAAa,MAClB,KAAK,WAAW,MAAM,aAAa;CAEV;AAC9B;;;;;;;;AAcA,SAAS,eAAe,KAAoC;CAC3D,MAAM,QAAQ;EAAC;EAAmB;EAAiB;CAAe;CAGlE,MAAM,gBAAgB,QAAQ,IAAI;CAClC,IAAI,kBAAA,GAAiBA,QAAAA,WAAAA,CAAW,aAAa,GAC5C,OAAO;EACN,YAAY;EACZ,gBAAA,GAAeC,UAAAA,QAAAA,CAAQ,aAAa;CACrC;CAID,IAAI,aAAa;CACjB,MAAM,EAAE,UAAA,GAASC,UAAAA,MAAAA,CAAM,UAAU;CAEjC,OAAO,eAAe,MAAM;EAC3B,KAAK,MAAM,QAAQ,OAAO;GACzB,MAAM,cAAA,GAAaC,UAAAA,KAAAA,CAAK,YAAY,IAAI;GACxC,KAAA,GAAIH,QAAAA,WAAAA,CAAW,UAAU,GACxB,OAAO;IACN;IACA,eAAe;GAChB;EAEF;EACA,cAAA,GAAaC,UAAAA,QAAAA,CAAQ,UAAU;CAChC;CAEA,MAAM,IAAI,eAAe,GAAG;AAC7B;;;;;;;AAQA,SAAgB,kBAAkB,KAAqB;CACtD,OAAO,eAAe,GAAG,CAAC,CAAC;AAC5B;;AAGA,IAAa,iBAAb,cAAoC,MAAM;CACpB;CAArB,YAAY,KAAsB;EACjC,MACC,mHACD;EAHoB,KAAA,MAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;AA4BA,MAAa,yBAAyB;;AAGtC,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CACA;CAFV,YACC,YACA,QACC;EACD,MAAM,0BAA0B,QAAQ;EAH/B,KAAA,aAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACb;AACD;;;;;;AAOA,IAAa,8BAAb,cAAiD,MAAM;CAE5C;CACA;CAFV,YACC,YACA,OACC;EACD,MACC,GAAG,WAAW,4CACV,MAAM,KAAK,IAAI,EAAE,mTAKtB;EAVS,KAAA,aAAA;EACA,KAAA,QAAA;EAUT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,eAAA,gBAAA,mBAAoC,UAAU;CAC1C,gBAAA,OAAA;EACR,QAAA,gBAAA,QAAkB,QAAQ;EAC1B,QAAA,gBAAA,OAAA,gBAAA,OAA0B,GAAA,gBAAA,QAAa,CAAC;CACzC,CAAC;CACQ,gBAAA,OAAA;EAAE,QAAA,gBAAA,QAAkB,MAAM;EAAG,OAAA,gBAAA,MAAA,gBAAA,OAAwB,CAAC;CAAE,CAAC;CACzD,gBAAA,OAAA;EACR,QAAA,gBAAA,QAAkB,QAAQ;EAC1B,OAAA,gBAAA,OAAgB;GAAE,MAAA,gBAAA,OAAe;GAAG,SAAA,gBAAA,OAAkB;EAAE,CAAC;CAC1D,CAAC;AACF,CAAC;;AAGD,eAAe,aACd,YACuC;CACvC,IAAI;EAEH,QAAO,MADc,OAAO,YAAA,CACd;CACf,SAAS,OAAO;EACf,MAAM,IAAI,iBAAiB,YAAa,MAAgB,OAAO;CAChE;AACD;;;;;;;;;AAUA,eAAe,oBACd,SACA,YACA,eACA,YAAY,wBAC2B;CACvC,MAAM,EAAE,UAAU,MAAMG,iBAAAA,UAAU,SAAS,eAAe;EACzD,MAAM;EACN,MAAM,CAAC,UAAU;EACjB,KAAK;EACL;EACA,QAAQ;CACT,CAAC;CAED,QAAQ,MAAM,QAAd;EACC,KAAK,UAGJ,OAAO,MAAM;EACd,KAAK,UACJ,MAAM,IAAI,iBAAiB,YAAY,MAAM,MAAM,OAAO;EAC3D,KAAK;GACJ,IAAI,QAAQ,WACX,MAAM,IAAI,4BAA4B,YAAY,MAAM,KAAK;GAE9D,OAAO,aAAa,UAAU;CAChC;AACD;;;;AAKA,eAAe,cACd,KACA,UAA6B,CAAC,GACH;CAC3B,MAAM,EAAE,YAAY,kBAAkB,eAAe,GAAG;CAIxD,MAAM,UAAU,QAAQ,WAAWC,gBAAAA,cAAc;CAUjD,OAAO;EAAE,QATM,UACZ,MAAM,oBACN,SACA,YACA,eACA,QAAQ,SACT,IACC,MAAM,aAAa,UAAU;EAEf;CAAc;AAChC;;;;;;;AAQA,eAAsB,WACrB,MAAc,QAAQ,IAAI,GACL;CACrB,MAAM,EAAE,WAAW,MAAM,cAAc,GAAG;CAG1C,IAAIC,kBAAAA,kBAAkB,MAAM,GAC3B,MAAM,IAAI,MACT,sEACD;CAGD,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,sBACrB,MAAc,QAAQ,IAAI,GAC1B,UAA6B,CAAC,GACO;CACrC,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,KAAK,OAAO;CAClE,OAAOC,kBAAAA,cAAc,QAAQ,aAAa,CAAC,CAAC;AAC7C;AAEA,eAAsB,oBACrB,MAAc,QAAQ,IAAI,GAC1B,UAA6B,CAAC,GACN;CACxB,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,KAAK,OAAO;CAClE,OAAO,gBAAgBA,kBAAAA,cAAc,QAAQ,aAAa,GAAG,QAAQ,OAAO;AAC7E;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,gBACd,QACA,SACwB;CACxB,MAAM,QAAQC,kBAAAA,kBAAkB,OAAO,SAAS;CAChD,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,8BAA8B,OAAO,UAAU,IAAI;CAG9D,IAAI;EACH,MAAM,aAAuC,CAAC;EAC9C,MAAM,WAAW,MAAMC,iBAAAA,SAAS;GAC/B,UAAU;GACV,KAAK,OAAO,UAAU;GACtB;GACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC9B,CAAC;EAED,OAAO;GACN,GAAG;GACH;GACA;GACA,WAAW;IACV,GAAG,OAAO;IACV,MAAMC,eAAAA,YAAY,UAAU,OAAO,SAAS;GAC7C;EACD;CACD,SAAS,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,iBAAA,OAAO,KACN,kEAAkE,SACnE;EACA,OAAO;CACR;AACD;;;;;;;;AASA,IAAa,gCAAb,cAAmD,MAAM;CACnC;CAArB,YAAY,MAAuB;EAClC,MACC,oBAAoB,KAAK,8NAI1B;EANoB,KAAA,OAAA;EAOpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;AAoBA,SAAS,oBACR,cACA,KACwD;CACxD,MAAM,OAAO,KAAK,GAAG;CACrB,IAAI;CAEJ,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,aAAa,UAAU,IAAI,GAAG;EACrE,MAAM,MAAM,MAAA,GAAKP,UAAAA,KAAAA,CAAK,aAAa,UAAU,MAAM,IAAI,IAAI,CAAC;EAE5D,KADe,SAAS,OAAO,KAAK,WAAW,GAAG,MAAMQ,UAAAA,KAAK,OAC9C,CAAC,SAAS,IAAI,SAAS,MAAM,IAAI,SAC/C,QAAQ;GAAE;GAAK;GAAK;EAAI;CAE1B;CAEA,OAAO,SAAS;EAAE,KAAK,MAAM;EAAK,KAAK,MAAM;CAAI;AAClD;;AAGA,SAAS,KAAK,MAAsB;CACnC,MAAM,YAAA,GAAWC,UAAAA,QAAAA,CAAQ,IAAI;CAC7B,QAAA,GAAOZ,QAAAA,WAAAA,CAAW,QAAQ,KAAA,GAAIa,QAAAA,aAAAA,CAAa,QAAQ,IAAI;AACxD;;AAGA,IAAa,aAAb,cAAgC,MAAM;CAE3B;CACA;CAFV,YACC,KACA,MACC;EACD,MACC,GAAG,IAAI,yCACN,OAAO,QAAQ,IAAI,CAAC,CAClB,KAAK,CAAC,KAAK,UAAU,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CACxC,KAAK,IAAI,IACX,GACF;EATS,KAAA,MAAA;EACA,KAAA,OAAA;EAST,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,SAAS,cAAoD;CACrE,OAAO,OAAO,YACb,OAAO,QAAQ,aAAa,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,CAC/D,KACA,IAAI,IACL,CAAC,CACF;AACD;;;;;;;;;;;;;;AAeA,eAAsB,cACrB,MAAc,QAAQ,IAAI,GACC;CAC3B,MAAM,EAAE,SAAS,KAAK,WAAW,kBAChC,MAAM,qBAAqB,GAAG;CAE/B,MAAM,YAAYC,kBAAAA,gBAAgB,WAAW,OAAO;CACpD,IAAI,CAAC,WAAW,MAAM,IAAI,eAAe,OAAO;CAEhD,OAAO;EACN;EACA;EACA;EACA;EACA;EACA,UAAA,GAASX,UAAAA,KAAAA,CAAK,eAAe,IAAI,IAAI;CACtC;AACD;;AAGA,IAAa,iBAAb,cAAoC,MAAM;CACpB;CAArB,YAAY,SAA0B;EACrC,MACC,QAAQ,QAAQ,uDACjB;EAHoB,KAAA,UAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;AAiBA,eAAsB,qBACrB,MAAc,QAAQ,IAAI,GACE;CAC5B,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,GAAG;CACzD,MAAM,eAAe,MAAM,gBAC1BI,kBAAAA,cAAc,QAAQ,aAAa,CACpC;CAEA,MAAM,WAAW,oBAAoB,cAAc,GAAG;CACtD,IAAI,CAAC,UAAU,MAAM,IAAI,WAAW,KAAK,SAAS,YAAY,CAAC;CAE/D,OAAO;EACN,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,WAAW,aAAa;EACxB;CACD;AACD"}
+{"version":3,"file":"config.cjs","names":["existsSync","dirname","parse","join","GkmError","runWorker","activeSandbox","isWorkspaceConfig","processConfig","allConstructGlobs","discover","derivedApps","sep","resolve","realpathSync","getAppGkmConfig"],"sources":["../src/config.ts"],"sourcesContent":["import { existsSync, realpathSync } from 'node:fs';\nimport { dirname, join, parse, resolve, sep } from 'node:path';\nimport { z } from 'zod';\nimport { GkmError } from './errors';\nimport { output } from './output.js';\nimport { discover } from './reconcile/discover.js';\nimport { activeSandbox, type Sandbox } from './sandbox/sandbox.js';\nimport { runWorker } from './sandbox/worker.js';\nimport type { GkmConfig } from './types.js';\nimport { derivedApps } from './workspace/derive.js';\nimport {\n\tallConstructGlobs,\n\tgetAppGkmConfig,\n\tisWorkspaceConfig,\n\ttype LoadedConfig,\n\ttype NormalizedAppConfig,\n\ttype NormalizedWorkspace,\n\tprocessConfig,\n\ttype WorkspaceConfig,\n} from './workspace/index.js';\n\n// What `gkm dev`'s discovery endpoint answers, for the tools that read it.\nexport type {\n\tAppStatus,\n\tDataApiKind,\n\tDiscoveredApp,\n\tDiscoveredDataApi,\n\tDiscoveredWorkspace,\n\tDiscoveryEvent,\n\tDiscoveryResponse,\n} from './dev/discovery.js';\nexport type { GkmConfig } from './types.js';\nexport type { LoadedConfig, WorkspaceConfig } from './workspace/index.js';\nexport { defineWorkspace } from './workspace/index.js';\nexport type { DevConfig } from './workspace/types.js';\n/**\n * Define GKM configuration with full TypeScript support.\n * This is an identity function that provides type safety and autocomplete.\n *\n * @example\n * ```ts\n * // gkm.config.ts\n * import { defineConfig } from '@geekmidas/cli/config';\n *\n * export default defineConfig({\n *   routes: './src/endpoints/**\\/*.ts',\n *   envParser: './src/config/env',\n *   logger: './src/config/logger',\n *   telescope: true,\n * });\n * ```\n */\nexport function defineConfig(config: GkmConfig): GkmConfig {\n\treturn config;\n}\n\nexport interface ParsedModuleConfig {\n\tpath: string;\n\timportPattern: string;\n}\n\n/**\n * Parse a module config string into path and import pattern.\n *\n * @param configString - Config string in format \"./path/to/module\" or \"./path/to/module#exportName\"\n * @param defaultAlias - The default alias name to use if no export name specified\n * @returns Object with path and import pattern\n *\n * @example\n * parseModuleConfig('./src/config/env', 'envParser')\n * // { path: './src/config/env', importPattern: 'envParser' }\n *\n * parseModuleConfig('./src/config/env#envParser', 'envParser')\n * // { path: './src/config/env', importPattern: '{ envParser }' }\n *\n * parseModuleConfig('./src/config/env#myEnv', 'envParser')\n * // { path: './src/config/env', importPattern: '{ myEnv as envParser }' }\n */\nexport function parseModuleConfig(\n\tconfigString: string,\n\tdefaultAlias: string,\n): ParsedModuleConfig {\n\tconst parts = configString.split('#');\n\tconst path = parts[0] ?? configString;\n\tconst exportName = parts[1];\n\tconst importPattern = !exportName\n\t\t? defaultAlias\n\t\t: exportName === defaultAlias\n\t\t\t? `{ ${defaultAlias} }`\n\t\t\t: `{ ${exportName} as ${defaultAlias} }`;\n\n\treturn { path, importPattern };\n}\n\nexport interface ConfigDiscoveryResult {\n\tconfigPath: string;\n\tworkspaceRoot: string;\n}\n\n/**\n * Find and return the path to the config file.\n *\n * Resolution order:\n * 1. GKM_CONFIG_PATH env var (set by workspace dev command)\n * 2. Walk up directory tree from cwd\n */\nfunction findConfigPath(cwd: string): ConfigDiscoveryResult {\n\tconst files = ['gkm.config.json', 'gkm.config.ts', 'gkm.config.js'];\n\n\t// Check GKM_CONFIG_PATH env var first (set by workspace dev command)\n\tconst envConfigPath = process.env.GKM_CONFIG_PATH;\n\tif (envConfigPath && existsSync(envConfigPath)) {\n\t\treturn {\n\t\t\tconfigPath: envConfigPath,\n\t\t\tworkspaceRoot: dirname(envConfigPath),\n\t\t};\n\t}\n\n\t// Walk up directory tree to find config\n\tlet currentDir = cwd;\n\tconst { root } = parse(currentDir);\n\n\twhile (currentDir !== root) {\n\t\tfor (const file of files) {\n\t\t\tconst configPath = join(currentDir, file);\n\t\t\tif (existsSync(configPath)) {\n\t\t\t\treturn {\n\t\t\t\t\tconfigPath,\n\t\t\t\t\tworkspaceRoot: currentDir,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t\tcurrentDir = dirname(currentDir);\n\t}\n\n\tthrow new ConfigNotFound(cwd);\n}\n\n/**\n * The directory holding the gkm config that `cwd` belongs to — the project a\n * sandbox for it is confined to.\n *\n * @throws {ConfigNotFound} when neither `cwd` nor any parent has one.\n */\nexport function findWorkspaceRoot(cwd: string): string {\n\treturn findConfigPath(cwd).workspaceRoot;\n}\n\n/** No gkm config in a directory or any of its parents. */\nexport class ConfigNotFound extends GkmError {\n\tconstructor(readonly cwd: string) {\n\t\tsuper(\n\t\t\t'Configuration file not found. Please create gkm.config.json, gkm.config.ts, or gkm.config.js in the project root.',\n\t\t);\n\t\tthis.name = 'ConfigNotFound';\n\t}\n}\n\ninterface RawConfigResult {\n\tconfig: GkmConfig | WorkspaceConfig;\n\tworkspaceRoot: string;\n}\n\nexport interface LoadConfigOptions {\n\t/**\n\t * Load the config — and discover the constructs it names — in this\n\t * sandbox rather than in this process. The config then arrives as data;\n\t * see {@link Sandbox.isolating} for what happens to one holding live\n\t * objects. Defaults to the run's own (`withSandbox`); with neither, the\n\t * config is imported here, as `gkm` always has.\n\t */\n\tsandbox?: Sandbox;\n\t/**\n\t * How long the sandboxed config load may run. Defaults to\n\t * {@link CONFIG_LOAD_TIMEOUT_MS}.\n\t */\n\ttimeoutMs?: number;\n}\n\n/**\n * How long loading a config, or discovering its constructs, may take in a\n * sandbox: room for tsx to compile a large project cold, and not a deploy\n * held open by a config that never finishes importing.\n */\nexport const CONFIG_LOAD_TIMEOUT_MS = 60_000;\n\n/** The config failed to import, or threw while it ran. */\nexport class ConfigLoadFailed extends Error {\n\tconstructor(\n\t\treadonly configPath: string,\n\t\treadonly detail: string,\n\t) {\n\t\tsuper(`Failed to load config: ${detail}`);\n\t\tthis.name = 'ConfigLoadFailed';\n\t}\n}\n\n/**\n * The config holds something that is not data — a custom state store, an\n * inline deploy target, a function — and the sandbox it was loaded in hands\n * the deploy nothing but data.\n */\nexport class ConfigObjectNotSerializable extends Error {\n\tconstructor(\n\t\treadonly configPath: string,\n\t\treadonly paths: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`${configPath} holds values that are not plain data at: ` +\n\t\t\t\t`${paths.join(', ')}. It was loaded in an isolating sandbox, which ` +\n\t\t\t\t'hands the deploy the config as JSON, so a live object — a custom ' +\n\t\t\t\t'store, an inline target, a function — cannot reach it. Configure ' +\n\t\t\t\t'these with plain values instead, or deploy this project with a ' +\n\t\t\t\t'sandbox that is not isolating (the default) if the host trusts it.',\n\t\t);\n\t\tthis.name = 'ConfigObjectNotSerializable';\n\t}\n}\n\n/** What the config worker answers. Checked: the worker ran project code. */\nconst ConfigAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('loaded'),\n\t\tconfig: z.record(z.string(), z.unknown()),\n\t}),\n\tz.object({ reason: z.literal('live'), paths: z.array(z.string()) }),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }),\n\t}),\n]);\n\n/** Import the config in this process — live objects and all. */\nasync function importConfig(\n\tconfigPath: string,\n): Promise<GkmConfig | WorkspaceConfig> {\n\ttry {\n\t\tconst config = await import(configPath);\n\t\treturn config.default;\n\t} catch (error) {\n\t\tthrow new ConfigLoadFailed(configPath, (error as Error).message);\n\t}\n}\n\n/**\n * The config, loaded in `sandbox` and handed back as JSON.\n *\n * A config holding live objects cannot come back that way. An isolating\n * sandbox refuses it with {@link ConfigObjectNotSerializable}; any other\n * imports it here as well, as before, since the host already runs this\n * project's code as its own.\n */\nasync function loadConfigInSandbox(\n\tsandbox: Sandbox,\n\tconfigPath: string,\n\tworkspaceRoot: string,\n\ttimeoutMs = CONFIG_LOAD_TIMEOUT_MS,\n): Promise<GkmConfig | WorkspaceConfig> {\n\tconst { value } = await runWorker(sandbox, 'config load', {\n\t\tname: 'config-worker',\n\t\targs: [configPath],\n\t\tcwd: workspaceRoot,\n\t\ttimeoutMs,\n\t\tschema: ConfigAnswer,\n\t});\n\n\tswitch (value.reason) {\n\t\tcase 'loaded':\n\t\t\t// Its shape is `processConfig`'s to check, against the workspace\n\t\t\t// schema, exactly as for a config imported here.\n\t\t\treturn value.config as unknown as GkmConfig | WorkspaceConfig;\n\t\tcase 'failed':\n\t\t\tthrow new ConfigLoadFailed(configPath, value.error.message);\n\t\tcase 'live':\n\t\t\tif (sandbox.isolating) {\n\t\t\t\tthrow new ConfigObjectNotSerializable(configPath, value.paths);\n\t\t\t}\n\t\t\treturn importConfig(configPath);\n\t}\n}\n\n/**\n * Load raw configuration from file.\n */\nasync function loadRawConfig(\n\tcwd: string,\n\toptions: LoadConfigOptions = {},\n): Promise<RawConfigResult> {\n\tconst { configPath, workspaceRoot } = findConfigPath(cwd);\n\t// The run's own sandbox when none is given: a deploy reloads the config\n\t// deep in the engine (generating Dockerfiles), and that load is the\n\t// project's code as much as the first.\n\tconst sandbox = options.sandbox ?? activeSandbox();\n\tconst config = sandbox\n\t\t? await loadConfigInSandbox(\n\t\t\t\tsandbox,\n\t\t\t\tconfigPath,\n\t\t\t\tworkspaceRoot,\n\t\t\t\toptions.timeoutMs,\n\t\t\t)\n\t\t: await importConfig(configPath);\n\n\treturn { config, workspaceRoot };\n}\n\n/**\n * Load configuration file (single-app format).\n * For backwards compatibility with existing code.\n *\n * @deprecated Use loadWorkspaceConfig for new code\n */\nexport async function loadConfig(\n\tcwd: string = process.cwd(),\n): Promise<GkmConfig> {\n\tconst { config } = await loadRawConfig(cwd);\n\n\t// If it's a workspace config, throw an error\n\tif (isWorkspaceConfig(config)) {\n\t\tthrow new Error(\n\t\t\t'Workspace configuration detected. Use loadWorkspaceConfig() instead.',\n\t\t);\n\t}\n\n\treturn config;\n}\n\n/**\n * Load configuration file and process it as a workspace.\n * Works with both single-app and workspace configurations.\n *\n * Single-app configs are automatically wrapped as a workspace with one app.\n *\n * @example\n * ```ts\n * const { type, workspace } = await loadWorkspaceConfig();\n *\n * if (type === 'workspace') {\n *   console.log('Multi-app workspace:', workspace.apps);\n * } else {\n *   console.log('Single app wrapped as workspace');\n * }\n * ```\n */\n/**\n * The workspace a directory belongs to, as its config states it — without\n * discovering its constructs.\n *\n * For callers that need a fact the config holds (where a stage's secrets are\n * stored) and nothing the graph adds. `loadWorkspaceConfig` imports every\n * construct module to derive the apps, which is a cost a secrets read should\n * not pay.\n */\nexport async function loadWorkspaceSettings(\n\tcwd: string = process.cwd(),\n\toptions: LoadConfigOptions = {},\n): Promise<LoadedConfig['workspace']> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd, options);\n\treturn processConfig(config, workspaceRoot).workspace;\n}\n\nexport async function loadWorkspaceConfig(\n\tcwd: string = process.cwd(),\n\toptions: LoadConfigOptions = {},\n): Promise<LoadedConfig> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd, options);\n\treturn withDerivedApps(processConfig(config, workspaceRoot), options.sandbox);\n}\n\n/**\n * The loaded config, with its apps read off the graph.\n *\n * Here rather than at each call site because every command needs the same\n * answer, and the ones that forgot to ask were exactly the bugs: a site that\n * never deployed, a surface that could not be its own process. `gkm dev`,\n * `gkm build`, `gkm docker` and `gkm deploy` now all see the same apps without\n * any of them knowing a derivation happened.\n *\n * Discovery imports the construct modules — declarations only, not endpoints —\n * which is the same import the reconciler and the build already do. A workspace\n * with no `constructs` glob discovers nothing and keeps whatever its config\n * said, so nothing that worked before changes.\n *\n * A construct file that throws is reported and skipped rather than taking the\n * command down: `gkm dev` failing to start because a half-written declaration\n * cannot be imported is a worse failure than starting with the app it does not\n * describe yet.\n */\nasync function withDerivedApps(\n\tloaded: LoadedConfig,\n\tsandbox?: Sandbox,\n): Promise<LoadedConfig> {\n\tconst globs = allConstructGlobs(loaded.workspace);\n\tif (globs.length === 0) {\n\t\tthrow new WorkspaceDeclaresNoConstructs(loaded.workspace.root);\n\t}\n\n\ttry {\n\t\tconst background: Record<string, string[]> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: globs,\n\t\t\tcwd: loaded.workspace.root,\n\t\t\tbackground,\n\t\t\t...(sandbox ? { sandbox } : {}),\n\t\t});\n\n\t\treturn {\n\t\t\t...loaded,\n\t\t\tmanifest,\n\t\t\tbackground,\n\t\t\tworkspace: {\n\t\t\t\t...loaded.workspace,\n\t\t\t\tapps: derivedApps(manifest, loaded.workspace),\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\toutput.warn(\n\t\t\t`⚠️  Could not read constructs, so apps come from config alone: ${message}`,\n\t\t);\n\t\treturn loaded;\n\t}\n}\n\n/**\n * A workspace with no `constructs` glob.\n *\n * In v10 every address, container and app comes from what the workspace\n * declares — there is no second path that reads a hand-written compose file or\n * an `apps` block's ports. A config that declares nothing has nothing to run.\n */\nexport class WorkspaceDeclaresNoConstructs extends GkmError {\n\tconstructor(readonly root: string) {\n\t\tsuper(\n\t\t\t`The workspace at ${root} declares no constructs. Every workspace names ` +\n\t\t\t\t\"where its constructs live — `constructs: ['./constructs/**/*.ts', \" +\n\t\t\t\t\"'./apps/*/endpoints/**/*.ts']` in gkm.config.ts — and its apps, \" +\n\t\t\t\t'containers and URLs are derived from them.',\n\t\t);\n\t\tthis.name = 'WorkspaceDeclaresNoConstructs';\n\t}\n}\n\nexport interface AppConfigResult {\n\tappName: string;\n\tapp: NormalizedAppConfig;\n\tgkmConfig: GkmConfig;\n\tworkspace: NormalizedWorkspace;\n\tworkspaceRoot: string;\n\tappRoot: string;\n}\n\n/**\n * The app a directory is part of: the one whose `path` contains it.\n *\n * An app's path is the one its construct declares — `new RestApi('Api',\n * { path: 'apps/api' })` — read off the workspace the constructs were derived\n * into, never off the filesystem's package names. The deepest match wins, so\n * an app inside another app's folder is its own; the workspace root belongs to\n * no app unless one lives there.\n */\nfunction resolveWorkspaceApp(\n\tloadedConfig: LoadedConfig,\n\tcwd: string,\n): { key: string; app: NormalizedAppConfig } | undefined {\n\tconst here = real(cwd);\n\tlet found: { key: string; app: NormalizedAppConfig; dir: string } | undefined;\n\n\tfor (const [key, app] of Object.entries(loadedConfig.workspace.apps)) {\n\t\tconst dir = real(join(loadedConfig.workspace.root, app.path));\n\t\tconst inside = here === dir || here.startsWith(`${dir}${sep}`);\n\t\tif (inside && (!found || dir.length > found.dir.length)) {\n\t\t\tfound = { key, app, dir };\n\t\t}\n\t}\n\n\treturn found && { key: found.key, app: found.app };\n}\n\n/** A path with its symlinks resolved, where it exists — `/tmp` is `/private/tmp`. */\nfunction real(path: string): string {\n\tconst absolute = resolve(path);\n\treturn existsSync(absolute) ? realpathSync(absolute) : absolute;\n}\n\n/** A directory that no app in the workspace lives in. */\nexport class NotInAnApp extends GkmError {\n\tconstructor(\n\t\treadonly cwd: string,\n\t\treadonly apps: Readonly<Record<string, string>>,\n\t) {\n\t\tsuper(\n\t\t\t`${cwd} is not inside any app's path. Apps: ` +\n\t\t\t\tObject.entries(apps)\n\t\t\t\t\t.map(([key, path]) => `${key} (${path})`)\n\t\t\t\t\t.join(', ') +\n\t\t\t\t'.',\n\t\t);\n\t\tthis.name = 'NotInAnApp';\n\t}\n}\n\n/** Every app's path, by key — what `NotInAnApp` lists. */\nfunction appPaths(loadedConfig: LoadedConfig): Record<string, string> {\n\treturn Object.fromEntries(\n\t\tObject.entries(loadedConfig.workspace.apps).map(([key, app]) => [\n\t\t\tkey,\n\t\t\tapp.path,\n\t\t]),\n\t);\n}\n\n/**\n * The backend app a directory is part of, with its gkm config — found by the\n * `path` its construct declares.\n *\n * @example\n * ```ts\n * // From apps/api, where a construct declares `path: 'apps/api'`\n * const { app, workspace, workspaceRoot } = await loadAppConfig();\n * ```\n *\n * @throws {NotInAnApp} when no app's path contains the directory.\n * @throws {NotABackendApp} when the app it is in has no gkm config to run.\n */\nexport async function loadAppConfig(\n\tcwd: string = process.cwd(),\n): Promise<AppConfigResult> {\n\tconst { appName, app, workspace, workspaceRoot } =\n\t\tawait loadWorkspaceAppInfo(cwd);\n\n\tconst gkmConfig = getAppGkmConfig(workspace, appName);\n\tif (!gkmConfig) throw new NotABackendApp(appName);\n\n\treturn {\n\t\tappName,\n\t\tapp,\n\t\tgkmConfig,\n\t\tworkspace,\n\t\tworkspaceRoot,\n\t\tappRoot: join(workspaceRoot, app.path),\n\t};\n}\n\n/** The app a directory is in has no gkm config — a site, or an entry app. */\nexport class NotABackendApp extends GkmError {\n\tconstructor(readonly appName: string) {\n\t\tsuper(\n\t\t\t`App \"${appName}\" is not a backend app and cannot be run with gkm dev.`,\n\t\t);\n\t\tthis.name = 'NotABackendApp';\n\t}\n}\n\nexport interface WorkspaceAppInfo {\n\t/** The app's key in the workspace. */\n\tappName: string;\n\tapp: NormalizedAppConfig;\n\tworkspace: NormalizedWorkspace;\n\tworkspaceRoot: string;\n}\n\n/**\n * The app a directory is part of, frontend or backend — found by the `path`\n * its construct declares. Unlike `loadAppConfig`, the app need not have a\n * gkm config, which is what `gkm exec` and `gkm test` from a site need.\n *\n * @throws {NotInAnApp} when no app's path contains the directory.\n */\nexport async function loadWorkspaceAppInfo(\n\tcwd: string = process.cwd(),\n): Promise<WorkspaceAppInfo> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd);\n\tconst loadedConfig = await withDerivedApps(\n\t\tprocessConfig(config, workspaceRoot),\n\t);\n\n\tconst resolved = resolveWorkspaceApp(loadedConfig, cwd);\n\tif (!resolved) throw new NotInAnApp(cwd, appPaths(loadedConfig));\n\n\treturn {\n\t\tappName: resolved.key,\n\t\tapp: resolved.app,\n\t\tworkspace: loadedConfig.workspace,\n\t\tworkspaceRoot,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDA,SAAgB,aAAa,QAA8B;CAC1D,OAAO;AACR;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,kBACf,cACA,cACqB;CACrB,MAAM,QAAQ,aAAa,MAAM,GAAG;CACpC,MAAM,OAAO,MAAM,MAAM;CACzB,MAAM,aAAa,MAAM;CAOzB,OAAO;EAAE;EAAM,eANO,CAAC,aACpB,eACA,eAAe,eACd,KAAK,aAAa,MAClB,KAAK,WAAW,MAAM,aAAa;CAEV;AAC9B;;;;;;;;AAcA,SAAS,eAAe,KAAoC;CAC3D,MAAM,QAAQ;EAAC;EAAmB;EAAiB;CAAe;CAGlE,MAAM,gBAAgB,QAAQ,IAAI;CAClC,IAAI,kBAAA,GAAiBA,QAAAA,WAAAA,CAAW,aAAa,GAC5C,OAAO;EACN,YAAY;EACZ,gBAAA,GAAeC,UAAAA,QAAAA,CAAQ,aAAa;CACrC;CAID,IAAI,aAAa;CACjB,MAAM,EAAE,UAAA,GAASC,UAAAA,MAAAA,CAAM,UAAU;CAEjC,OAAO,eAAe,MAAM;EAC3B,KAAK,MAAM,QAAQ,OAAO;GACzB,MAAM,cAAA,GAAaC,UAAAA,KAAAA,CAAK,YAAY,IAAI;GACxC,KAAA,GAAIH,QAAAA,WAAAA,CAAW,UAAU,GACxB,OAAO;IACN;IACA,eAAe;GAChB;EAEF;EACA,cAAA,GAAaC,UAAAA,QAAAA,CAAQ,UAAU;CAChC;CAEA,MAAM,IAAI,eAAe,GAAG;AAC7B;;;;;;;AAQA,SAAgB,kBAAkB,KAAqB;CACtD,OAAO,eAAe,GAAG,CAAC,CAAC;AAC5B;;AAGA,IAAa,iBAAb,cAAoCG,eAAAA,SAAS;CACvB;CAArB,YAAY,KAAsB;EACjC,MACC,mHACD;EAHoB,KAAA,MAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;AA4BA,MAAa,yBAAyB;;AAGtC,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CACA;CAFV,YACC,YACA,QACC;EACD,MAAM,0BAA0B,QAAQ;EAH/B,KAAA,aAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACb;AACD;;;;;;AAOA,IAAa,8BAAb,cAAiD,MAAM;CAE5C;CACA;CAFV,YACC,YACA,OACC;EACD,MACC,GAAG,WAAW,4CACV,MAAM,KAAK,IAAI,EAAE,mTAKtB;EAVS,KAAA,aAAA;EACA,KAAA,QAAA;EAUT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,eAAA,gBAAA,mBAAoC,UAAU;CAC1C,gBAAA,OAAA;EACR,QAAA,gBAAA,QAAkB,QAAQ;EAC1B,QAAA,gBAAA,OAAA,gBAAA,OAA0B,GAAA,gBAAA,QAAa,CAAC;CACzC,CAAC;CACQ,gBAAA,OAAA;EAAE,QAAA,gBAAA,QAAkB,MAAM;EAAG,OAAA,gBAAA,MAAA,gBAAA,OAAwB,CAAC;CAAE,CAAC;CACzD,gBAAA,OAAA;EACR,QAAA,gBAAA,QAAkB,QAAQ;EAC1B,OAAA,gBAAA,OAAgB;GAAE,MAAA,gBAAA,OAAe;GAAG,SAAA,gBAAA,OAAkB;EAAE,CAAC;CAC1D,CAAC;AACF,CAAC;;AAGD,eAAe,aACd,YACuC;CACvC,IAAI;EAEH,QAAO,MADc,OAAO,YAAA,CACd;CACf,SAAS,OAAO;EACf,MAAM,IAAI,iBAAiB,YAAa,MAAgB,OAAO;CAChE;AACD;;;;;;;;;AAUA,eAAe,oBACd,SACA,YACA,eACA,YAAY,wBAC2B;CACvC,MAAM,EAAE,UAAU,MAAMC,iBAAAA,UAAU,SAAS,eAAe;EACzD,MAAM;EACN,MAAM,CAAC,UAAU;EACjB,KAAK;EACL;EACA,QAAQ;CACT,CAAC;CAED,QAAQ,MAAM,QAAd;EACC,KAAK,UAGJ,OAAO,MAAM;EACd,KAAK,UACJ,MAAM,IAAI,iBAAiB,YAAY,MAAM,MAAM,OAAO;EAC3D,KAAK;GACJ,IAAI,QAAQ,WACX,MAAM,IAAI,4BAA4B,YAAY,MAAM,KAAK;GAE9D,OAAO,aAAa,UAAU;CAChC;AACD;;;;AAKA,eAAe,cACd,KACA,UAA6B,CAAC,GACH;CAC3B,MAAM,EAAE,YAAY,kBAAkB,eAAe,GAAG;CAIxD,MAAM,UAAU,QAAQ,WAAWC,gBAAAA,cAAc;CAUjD,OAAO;EAAE,QATM,UACZ,MAAM,oBACN,SACA,YACA,eACA,QAAQ,SACT,IACC,MAAM,aAAa,UAAU;EAEf;CAAc;AAChC;;;;;;;AAQA,eAAsB,WACrB,MAAc,QAAQ,IAAI,GACL;CACrB,MAAM,EAAE,WAAW,MAAM,cAAc,GAAG;CAG1C,IAAIC,kBAAAA,kBAAkB,MAAM,GAC3B,MAAM,IAAI,MACT,sEACD;CAGD,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,sBACrB,MAAc,QAAQ,IAAI,GAC1B,UAA6B,CAAC,GACO;CACrC,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,KAAK,OAAO;CAClE,OAAOC,kBAAAA,cAAc,QAAQ,aAAa,CAAC,CAAC;AAC7C;AAEA,eAAsB,oBACrB,MAAc,QAAQ,IAAI,GAC1B,UAA6B,CAAC,GACN;CACxB,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,KAAK,OAAO;CAClE,OAAO,gBAAgBA,kBAAAA,cAAc,QAAQ,aAAa,GAAG,QAAQ,OAAO;AAC7E;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,gBACd,QACA,SACwB;CACxB,MAAM,QAAQC,kBAAAA,kBAAkB,OAAO,SAAS;CAChD,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,8BAA8B,OAAO,UAAU,IAAI;CAG9D,IAAI;EACH,MAAM,aAAuC,CAAC;EAC9C,MAAM,WAAW,MAAMC,iBAAAA,SAAS;GAC/B,UAAU;GACV,KAAK,OAAO,UAAU;GACtB;GACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC9B,CAAC;EAED,OAAO;GACN,GAAG;GACH;GACA;GACA,WAAW;IACV,GAAG,OAAO;IACV,MAAMC,eAAAA,YAAY,UAAU,OAAO,SAAS;GAC7C;EACD;CACD,SAAS,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,iBAAA,OAAO,KACN,kEAAkE,SACnE;EACA,OAAO;CACR;AACD;;;;;;;;AASA,IAAa,gCAAb,cAAmDP,eAAAA,SAAS;CACtC;CAArB,YAAY,MAAuB;EAClC,MACC,oBAAoB,KAAK,8NAI1B;EANoB,KAAA,OAAA;EAOpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;AAoBA,SAAS,oBACR,cACA,KACwD;CACxD,MAAM,OAAO,KAAK,GAAG;CACrB,IAAI;CAEJ,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,aAAa,UAAU,IAAI,GAAG;EACrE,MAAM,MAAM,MAAA,GAAKD,UAAAA,KAAAA,CAAK,aAAa,UAAU,MAAM,IAAI,IAAI,CAAC;EAE5D,KADe,SAAS,OAAO,KAAK,WAAW,GAAG,MAAMS,UAAAA,KAAK,OAC9C,CAAC,SAAS,IAAI,SAAS,MAAM,IAAI,SAC/C,QAAQ;GAAE;GAAK;GAAK;EAAI;CAE1B;CAEA,OAAO,SAAS;EAAE,KAAK,MAAM;EAAK,KAAK,MAAM;CAAI;AAClD;;AAGA,SAAS,KAAK,MAAsB;CACnC,MAAM,YAAA,GAAWC,UAAAA,QAAAA,CAAQ,IAAI;CAC7B,QAAA,GAAOb,QAAAA,WAAAA,CAAW,QAAQ,KAAA,GAAIc,QAAAA,aAAAA,CAAa,QAAQ,IAAI;AACxD;;AAGA,IAAa,aAAb,cAAgCV,eAAAA,SAAS;CAE9B;CACA;CAFV,YACC,KACA,MACC;EACD,MACC,GAAG,IAAI,yCACN,OAAO,QAAQ,IAAI,CAAC,CAClB,KAAK,CAAC,KAAK,UAAU,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CACxC,KAAK,IAAI,IACX,GACF;EATS,KAAA,MAAA;EACA,KAAA,OAAA;EAST,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,SAAS,cAAoD;CACrE,OAAO,OAAO,YACb,OAAO,QAAQ,aAAa,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,CAC/D,KACA,IAAI,IACL,CAAC,CACF;AACD;;;;;;;;;;;;;;AAeA,eAAsB,cACrB,MAAc,QAAQ,IAAI,GACC;CAC3B,MAAM,EAAE,SAAS,KAAK,WAAW,kBAChC,MAAM,qBAAqB,GAAG;CAE/B,MAAM,YAAYW,kBAAAA,gBAAgB,WAAW,OAAO;CACpD,IAAI,CAAC,WAAW,MAAM,IAAI,eAAe,OAAO;CAEhD,OAAO;EACN;EACA;EACA;EACA;EACA;EACA,UAAA,GAASZ,UAAAA,KAAAA,CAAK,eAAe,IAAI,IAAI;CACtC;AACD;;AAGA,IAAa,iBAAb,cAAoCC,eAAAA,SAAS;CACvB;CAArB,YAAY,SAA0B;EACrC,MACC,QAAQ,QAAQ,uDACjB;EAHoB,KAAA,UAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;AAiBA,eAAsB,qBACrB,MAAc,QAAQ,IAAI,GACE;CAC5B,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,GAAG;CACzD,MAAM,eAAe,MAAM,gBAC1BI,kBAAAA,cAAc,QAAQ,aAAa,CACpC;CAEA,MAAM,WAAW,oBAAoB,cAAc,GAAG;CACtD,IAAI,CAAC,UAAU,MAAM,IAAI,WAAW,KAAK,SAAS,YAAY,CAAC;CAE/D,OAAO;EACN,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,WAAW,aAAa;EACxB;CACD;AACD"}

package/dist/config.d.cts

@@ -1,4 +1,4 @@
-import { D as WorkspaceConfig, m as DevConfig, r as GkmConfig, v as LoadedConfig } from "./types-NqX1Hz4P.cjs";
-import { l as defineWorkspace } from "./index-D-F_hTDz.cjs";
-import { C as DiscoveredApp, D as DiscoveryResponse, E as DiscoveryEvent, S as DataApiKind, T as DiscoveredWorkspace, _ as loadWorkspaceAppInfo, a as ConfigNotFound, b as parseModuleConfig, c as NotABackendApp, d as WorkspaceAppInfo, f as WorkspaceDeclaresNoConstructs, g as loadConfig, h as loadAppConfig, i as ConfigLoadFailed, l as NotInAnApp, m as findWorkspaceRoot, n as CONFIG_LOAD_TIMEOUT_MS, o as ConfigObjectNotSerializable, p as defineConfig, r as ConfigDiscoveryResult, s as LoadConfigOptions, t as AppConfigResult, u as ParsedModuleConfig, v as loadWorkspaceConfig, w as DiscoveredDataApi, x as AppStatus, y as loadWorkspaceSettings } from "./config-pST7E0CS.cjs";
+import { D as WorkspaceConfig, m as DevConfig, r as GkmConfig, v as LoadedConfig } from "./types-Bk9st2cd.cjs";
+import { l as defineWorkspace } from "./index-B5uuwx-Y.cjs";
+import { C as DiscoveredApp, D as DiscoveryResponse, E as DiscoveryEvent, S as DataApiKind, T as DiscoveredWorkspace, _ as loadWorkspaceAppInfo, a as ConfigNotFound, b as parseModuleConfig, c as NotABackendApp, d as WorkspaceAppInfo, f as WorkspaceDeclaresNoConstructs, g as loadConfig, h as loadAppConfig, i as ConfigLoadFailed, l as NotInAnApp, m as findWorkspaceRoot, n as CONFIG_LOAD_TIMEOUT_MS, o as ConfigObjectNotSerializable, p as defineConfig, r as ConfigDiscoveryResult, s as LoadConfigOptions, t as AppConfigResult, u as ParsedModuleConfig, v as loadWorkspaceConfig, w as DiscoveredDataApi, x as AppStatus, y as loadWorkspaceSettings } from "./config-C9zx7KsX.cjs";
 export { AppConfigResult, type AppStatus, CONFIG_LOAD_TIMEOUT_MS, ConfigDiscoveryResult, ConfigLoadFailed, ConfigNotFound, ConfigObjectNotSerializable, type DataApiKind, type DevConfig, type DiscoveredApp, type DiscoveredDataApi, type DiscoveredWorkspace, type DiscoveryEvent, type DiscoveryResponse, type GkmConfig, LoadConfigOptions, type LoadedConfig, NotABackendApp, NotInAnApp, ParsedModuleConfig, WorkspaceAppInfo, type WorkspaceConfig, WorkspaceDeclaresNoConstructs, defineConfig, defineWorkspace, findWorkspaceRoot, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig };

package/dist/config.d.mts

@@ -1,4 +1,4 @@
-import { D as WorkspaceConfig, m as DevConfig, r as GkmConfig, v as LoadedConfig } from "./types-ZHuZ89hv.mjs";
-import { l as defineWorkspace } from "./index-YFNxR5Ns.mjs";
-import { C as DiscoveredApp, D as DiscoveryResponse, E as DiscoveryEvent, S as DataApiKind, T as DiscoveredWorkspace, _ as loadWorkspaceAppInfo, a as ConfigNotFound, b as parseModuleConfig, c as NotABackendApp, d as WorkspaceAppInfo, f as WorkspaceDeclaresNoConstructs, g as loadConfig, h as loadAppConfig, i as ConfigLoadFailed, l as NotInAnApp, m as findWorkspaceRoot, n as CONFIG_LOAD_TIMEOUT_MS, o as ConfigObjectNotSerializable, p as defineConfig, r as ConfigDiscoveryResult, s as LoadConfigOptions, t as AppConfigResult, u as ParsedModuleConfig, v as loadWorkspaceConfig, w as DiscoveredDataApi, x as AppStatus, y as loadWorkspaceSettings } from "./config-CdEcTrjG.mjs";
+import { D as WorkspaceConfig, m as DevConfig, r as GkmConfig, v as LoadedConfig } from "./types-B3Gqs175.mjs";
+import { l as defineWorkspace } from "./index-D1pHwqkK.mjs";
+import { C as DiscoveredApp, D as DiscoveryResponse, E as DiscoveryEvent, S as DataApiKind, T as DiscoveredWorkspace, _ as loadWorkspaceAppInfo, a as ConfigNotFound, b as parseModuleConfig, c as NotABackendApp, d as WorkspaceAppInfo, f as WorkspaceDeclaresNoConstructs, g as loadConfig, h as loadAppConfig, i as ConfigLoadFailed, l as NotInAnApp, m as findWorkspaceRoot, n as CONFIG_LOAD_TIMEOUT_MS, o as ConfigObjectNotSerializable, p as defineConfig, r as ConfigDiscoveryResult, s as LoadConfigOptions, t as AppConfigResult, u as ParsedModuleConfig, v as loadWorkspaceConfig, w as DiscoveredDataApi, x as AppStatus, y as loadWorkspaceSettings } from "./config-BJo8Wggp.mjs";
 export { AppConfigResult, type AppStatus, CONFIG_LOAD_TIMEOUT_MS, ConfigDiscoveryResult, ConfigLoadFailed, ConfigNotFound, ConfigObjectNotSerializable, type DataApiKind, type DevConfig, type DiscoveredApp, type DiscoveredDataApi, type DiscoveredWorkspace, type DiscoveryEvent, type DiscoveryResponse, type GkmConfig, LoadConfigOptions, type LoadedConfig, NotABackendApp, NotInAnApp, ParsedModuleConfig, WorkspaceAppInfo, type WorkspaceConfig, WorkspaceDeclaresNoConstructs, defineConfig, defineWorkspace, findWorkspaceRoot, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig };

package/dist/config.mjs

@@ -1,8 +1,9 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { a as discriminatedUnion, d as record, f as string, h as unknown, n as array, s as literal, u as object } from "./schemas-D-xeKJDD.mjs";
-import { c as runWorker, d as output, r as discover } from "./discover-BPelzeGW.mjs";
-import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
+import { c as runWorker, d as output, r as discover } from "./discover-qjFapetL.mjs";
+import { i as activeSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { n as derivedApps } from "./derive-B4vDpzgP.mjs";
-import { a as allConstructGlobs, b as isWorkspaceConfig, d as getAppGkmConfig, l as defineWorkspace, m as processConfig } from "./workspace-CJ0lKFq-.mjs";
+import { a as allConstructGlobs, b as isWorkspaceConfig, d as getAppGkmConfig, l as defineWorkspace, m as processConfig } from "./workspace-Bzw7Zs82.mjs";
 import { dirname, join, parse, resolve, sep } from "node:path";
 import { existsSync, realpathSync } from "node:fs";
 //#region src/config.ts
@@ -94,7 +95,7 @@ function findWorkspaceRoot(cwd) {
 	return findConfigPath(cwd).workspaceRoot;
 }
 /** No gkm config in a directory or any of its parents. */
-var ConfigNotFound = class extends Error {
+var ConfigNotFound = class extends GkmError {
 	cwd;
 	constructor(cwd) {
 		super("Configuration file not found. Please create gkm.config.json, gkm.config.ts, or gkm.config.js in the project root.");
@@ -292,7 +293,7 @@ async function withDerivedApps(loaded, sandbox) {
 * declares — there is no second path that reads a hand-written compose file or
 * an `apps` block's ports. A config that declares nothing has nothing to run.
 */
-var WorkspaceDeclaresNoConstructs = class extends Error {
+var WorkspaceDeclaresNoConstructs = class extends GkmError {
 	root;
 	constructor(root) {
 		super(`The workspace at ${root} declares no constructs. Every workspace names where its constructs live — \`constructs: ['./constructs/**/*.ts', './apps/*/endpoints/**/*.ts']\` in gkm.config.ts — and its apps, containers and URLs are derived from them.`);
@@ -331,7 +332,7 @@ function real(path) {
 	return existsSync(absolute) ? realpathSync(absolute) : absolute;
 }
 /** A directory that no app in the workspace lives in. */
-var NotInAnApp = class extends Error {
+var NotInAnApp = class extends GkmError {
 	cwd;
 	apps;
 	constructor(cwd, apps) {
@@ -372,7 +373,7 @@ async function loadAppConfig(cwd = process.cwd()) {
 	};
 }
 /** The app a directory is in has no gkm config — a site, or an entry app. */
-var NotABackendApp = class extends Error {
+var NotABackendApp = class extends GkmError {
 	appName;
 	constructor(appName) {
 		super(`App "${appName}" is not a backend app and cannot be run with gkm dev.`);

package/dist/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":["z.discriminatedUnion","z.object","z.literal","z.record","z.string","z.unknown","z.array"],"sources":["../src/config.ts"],"sourcesContent":["import { existsSync, realpathSync } from 'node:fs';\nimport { dirname, join, parse, resolve, sep } from 'node:path';\nimport { z } from 'zod';\nimport { output } from './output.js';\nimport { discover } from './reconcile/discover.js';\nimport { activeSandbox, type Sandbox } from './sandbox/sandbox.js';\nimport { runWorker } from './sandbox/worker.js';\nimport type { GkmConfig } from './types.js';\nimport { derivedApps } from './workspace/derive.js';\nimport {\n\tallConstructGlobs,\n\tgetAppGkmConfig,\n\tisWorkspaceConfig,\n\ttype LoadedConfig,\n\ttype NormalizedAppConfig,\n\ttype NormalizedWorkspace,\n\tprocessConfig,\n\ttype WorkspaceConfig,\n} from './workspace/index.js';\n\n// What `gkm dev`'s discovery endpoint answers, for the tools that read it.\nexport type {\n\tAppStatus,\n\tDataApiKind,\n\tDiscoveredApp,\n\tDiscoveredDataApi,\n\tDiscoveredWorkspace,\n\tDiscoveryEvent,\n\tDiscoveryResponse,\n} from './dev/discovery.js';\nexport type { GkmConfig } from './types.js';\nexport type { LoadedConfig, WorkspaceConfig } from './workspace/index.js';\nexport { defineWorkspace } from './workspace/index.js';\nexport type { DevConfig } from './workspace/types.js';\n/**\n * Define GKM configuration with full TypeScript support.\n * This is an identity function that provides type safety and autocomplete.\n *\n * @example\n * ```ts\n * // gkm.config.ts\n * import { defineConfig } from '@geekmidas/cli/config';\n *\n * export default defineConfig({\n *   routes: './src/endpoints/**\\/*.ts',\n *   envParser: './src/config/env',\n *   logger: './src/config/logger',\n *   telescope: true,\n * });\n * ```\n */\nexport function defineConfig(config: GkmConfig): GkmConfig {\n\treturn config;\n}\n\nexport interface ParsedModuleConfig {\n\tpath: string;\n\timportPattern: string;\n}\n\n/**\n * Parse a module config string into path and import pattern.\n *\n * @param configString - Config string in format \"./path/to/module\" or \"./path/to/module#exportName\"\n * @param defaultAlias - The default alias name to use if no export name specified\n * @returns Object with path and import pattern\n *\n * @example\n * parseModuleConfig('./src/config/env', 'envParser')\n * // { path: './src/config/env', importPattern: 'envParser' }\n *\n * parseModuleConfig('./src/config/env#envParser', 'envParser')\n * // { path: './src/config/env', importPattern: '{ envParser }' }\n *\n * parseModuleConfig('./src/config/env#myEnv', 'envParser')\n * // { path: './src/config/env', importPattern: '{ myEnv as envParser }' }\n */\nexport function parseModuleConfig(\n\tconfigString: string,\n\tdefaultAlias: string,\n): ParsedModuleConfig {\n\tconst parts = configString.split('#');\n\tconst path = parts[0] ?? configString;\n\tconst exportName = parts[1];\n\tconst importPattern = !exportName\n\t\t? defaultAlias\n\t\t: exportName === defaultAlias\n\t\t\t? `{ ${defaultAlias} }`\n\t\t\t: `{ ${exportName} as ${defaultAlias} }`;\n\n\treturn { path, importPattern };\n}\n\nexport interface ConfigDiscoveryResult {\n\tconfigPath: string;\n\tworkspaceRoot: string;\n}\n\n/**\n * Find and return the path to the config file.\n *\n * Resolution order:\n * 1. GKM_CONFIG_PATH env var (set by workspace dev command)\n * 2. Walk up directory tree from cwd\n */\nfunction findConfigPath(cwd: string): ConfigDiscoveryResult {\n\tconst files = ['gkm.config.json', 'gkm.config.ts', 'gkm.config.js'];\n\n\t// Check GKM_CONFIG_PATH env var first (set by workspace dev command)\n\tconst envConfigPath = process.env.GKM_CONFIG_PATH;\n\tif (envConfigPath && existsSync(envConfigPath)) {\n\t\treturn {\n\t\t\tconfigPath: envConfigPath,\n\t\t\tworkspaceRoot: dirname(envConfigPath),\n\t\t};\n\t}\n\n\t// Walk up directory tree to find config\n\tlet currentDir = cwd;\n\tconst { root } = parse(currentDir);\n\n\twhile (currentDir !== root) {\n\t\tfor (const file of files) {\n\t\t\tconst configPath = join(currentDir, file);\n\t\t\tif (existsSync(configPath)) {\n\t\t\t\treturn {\n\t\t\t\t\tconfigPath,\n\t\t\t\t\tworkspaceRoot: currentDir,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t\tcurrentDir = dirname(currentDir);\n\t}\n\n\tthrow new ConfigNotFound(cwd);\n}\n\n/**\n * The directory holding the gkm config that `cwd` belongs to — the project a\n * sandbox for it is confined to.\n *\n * @throws {ConfigNotFound} when neither `cwd` nor any parent has one.\n */\nexport function findWorkspaceRoot(cwd: string): string {\n\treturn findConfigPath(cwd).workspaceRoot;\n}\n\n/** No gkm config in a directory or any of its parents. */\nexport class ConfigNotFound extends Error {\n\tconstructor(readonly cwd: string) {\n\t\tsuper(\n\t\t\t'Configuration file not found. Please create gkm.config.json, gkm.config.ts, or gkm.config.js in the project root.',\n\t\t);\n\t\tthis.name = 'ConfigNotFound';\n\t}\n}\n\ninterface RawConfigResult {\n\tconfig: GkmConfig | WorkspaceConfig;\n\tworkspaceRoot: string;\n}\n\nexport interface LoadConfigOptions {\n\t/**\n\t * Load the config — and discover the constructs it names — in this\n\t * sandbox rather than in this process. The config then arrives as data;\n\t * see {@link Sandbox.isolating} for what happens to one holding live\n\t * objects. Defaults to the run's own (`withSandbox`); with neither, the\n\t * config is imported here, as `gkm` always has.\n\t */\n\tsandbox?: Sandbox;\n\t/**\n\t * How long the sandboxed config load may run. Defaults to\n\t * {@link CONFIG_LOAD_TIMEOUT_MS}.\n\t */\n\ttimeoutMs?: number;\n}\n\n/**\n * How long loading a config, or discovering its constructs, may take in a\n * sandbox: room for tsx to compile a large project cold, and not a deploy\n * held open by a config that never finishes importing.\n */\nexport const CONFIG_LOAD_TIMEOUT_MS = 60_000;\n\n/** The config failed to import, or threw while it ran. */\nexport class ConfigLoadFailed extends Error {\n\tconstructor(\n\t\treadonly configPath: string,\n\t\treadonly detail: string,\n\t) {\n\t\tsuper(`Failed to load config: ${detail}`);\n\t\tthis.name = 'ConfigLoadFailed';\n\t}\n}\n\n/**\n * The config holds something that is not data — a custom state store, an\n * inline deploy target, a function — and the sandbox it was loaded in hands\n * the deploy nothing but data.\n */\nexport class ConfigObjectNotSerializable extends Error {\n\tconstructor(\n\t\treadonly configPath: string,\n\t\treadonly paths: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`${configPath} holds values that are not plain data at: ` +\n\t\t\t\t`${paths.join(', ')}. It was loaded in an isolating sandbox, which ` +\n\t\t\t\t'hands the deploy the config as JSON, so a live object — a custom ' +\n\t\t\t\t'store, an inline target, a function — cannot reach it. Configure ' +\n\t\t\t\t'these with plain values instead, or deploy this project with a ' +\n\t\t\t\t'sandbox that is not isolating (the default) if the host trusts it.',\n\t\t);\n\t\tthis.name = 'ConfigObjectNotSerializable';\n\t}\n}\n\n/** What the config worker answers. Checked: the worker ran project code. */\nconst ConfigAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('loaded'),\n\t\tconfig: z.record(z.string(), z.unknown()),\n\t}),\n\tz.object({ reason: z.literal('live'), paths: z.array(z.string()) }),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }),\n\t}),\n]);\n\n/** Import the config in this process — live objects and all. */\nasync function importConfig(\n\tconfigPath: string,\n): Promise<GkmConfig | WorkspaceConfig> {\n\ttry {\n\t\tconst config = await import(configPath);\n\t\treturn config.default;\n\t} catch (error) {\n\t\tthrow new ConfigLoadFailed(configPath, (error as Error).message);\n\t}\n}\n\n/**\n * The config, loaded in `sandbox` and handed back as JSON.\n *\n * A config holding live objects cannot come back that way. An isolating\n * sandbox refuses it with {@link ConfigObjectNotSerializable}; any other\n * imports it here as well, as before, since the host already runs this\n * project's code as its own.\n */\nasync function loadConfigInSandbox(\n\tsandbox: Sandbox,\n\tconfigPath: string,\n\tworkspaceRoot: string,\n\ttimeoutMs = CONFIG_LOAD_TIMEOUT_MS,\n): Promise<GkmConfig | WorkspaceConfig> {\n\tconst { value } = await runWorker(sandbox, 'config load', {\n\t\tname: 'config-worker',\n\t\targs: [configPath],\n\t\tcwd: workspaceRoot,\n\t\ttimeoutMs,\n\t\tschema: ConfigAnswer,\n\t});\n\n\tswitch (value.reason) {\n\t\tcase 'loaded':\n\t\t\t// Its shape is `processConfig`'s to check, against the workspace\n\t\t\t// schema, exactly as for a config imported here.\n\t\t\treturn value.config as unknown as GkmConfig | WorkspaceConfig;\n\t\tcase 'failed':\n\t\t\tthrow new ConfigLoadFailed(configPath, value.error.message);\n\t\tcase 'live':\n\t\t\tif (sandbox.isolating) {\n\t\t\t\tthrow new ConfigObjectNotSerializable(configPath, value.paths);\n\t\t\t}\n\t\t\treturn importConfig(configPath);\n\t}\n}\n\n/**\n * Load raw configuration from file.\n */\nasync function loadRawConfig(\n\tcwd: string,\n\toptions: LoadConfigOptions = {},\n): Promise<RawConfigResult> {\n\tconst { configPath, workspaceRoot } = findConfigPath(cwd);\n\t// The run's own sandbox when none is given: a deploy reloads the config\n\t// deep in the engine (generating Dockerfiles), and that load is the\n\t// project's code as much as the first.\n\tconst sandbox = options.sandbox ?? activeSandbox();\n\tconst config = sandbox\n\t\t? await loadConfigInSandbox(\n\t\t\t\tsandbox,\n\t\t\t\tconfigPath,\n\t\t\t\tworkspaceRoot,\n\t\t\t\toptions.timeoutMs,\n\t\t\t)\n\t\t: await importConfig(configPath);\n\n\treturn { config, workspaceRoot };\n}\n\n/**\n * Load configuration file (single-app format).\n * For backwards compatibility with existing code.\n *\n * @deprecated Use loadWorkspaceConfig for new code\n */\nexport async function loadConfig(\n\tcwd: string = process.cwd(),\n): Promise<GkmConfig> {\n\tconst { config } = await loadRawConfig(cwd);\n\n\t// If it's a workspace config, throw an error\n\tif (isWorkspaceConfig(config)) {\n\t\tthrow new Error(\n\t\t\t'Workspace configuration detected. Use loadWorkspaceConfig() instead.',\n\t\t);\n\t}\n\n\treturn config;\n}\n\n/**\n * Load configuration file and process it as a workspace.\n * Works with both single-app and workspace configurations.\n *\n * Single-app configs are automatically wrapped as a workspace with one app.\n *\n * @example\n * ```ts\n * const { type, workspace } = await loadWorkspaceConfig();\n *\n * if (type === 'workspace') {\n *   console.log('Multi-app workspace:', workspace.apps);\n * } else {\n *   console.log('Single app wrapped as workspace');\n * }\n * ```\n */\n/**\n * The workspace a directory belongs to, as its config states it — without\n * discovering its constructs.\n *\n * For callers that need a fact the config holds (where a stage's secrets are\n * stored) and nothing the graph adds. `loadWorkspaceConfig` imports every\n * construct module to derive the apps, which is a cost a secrets read should\n * not pay.\n */\nexport async function loadWorkspaceSettings(\n\tcwd: string = process.cwd(),\n\toptions: LoadConfigOptions = {},\n): Promise<LoadedConfig['workspace']> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd, options);\n\treturn processConfig(config, workspaceRoot).workspace;\n}\n\nexport async function loadWorkspaceConfig(\n\tcwd: string = process.cwd(),\n\toptions: LoadConfigOptions = {},\n): Promise<LoadedConfig> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd, options);\n\treturn withDerivedApps(processConfig(config, workspaceRoot), options.sandbox);\n}\n\n/**\n * The loaded config, with its apps read off the graph.\n *\n * Here rather than at each call site because every command needs the same\n * answer, and the ones that forgot to ask were exactly the bugs: a site that\n * never deployed, a surface that could not be its own process. `gkm dev`,\n * `gkm build`, `gkm docker` and `gkm deploy` now all see the same apps without\n * any of them knowing a derivation happened.\n *\n * Discovery imports the construct modules — declarations only, not endpoints —\n * which is the same import the reconciler and the build already do. A workspace\n * with no `constructs` glob discovers nothing and keeps whatever its config\n * said, so nothing that worked before changes.\n *\n * A construct file that throws is reported and skipped rather than taking the\n * command down: `gkm dev` failing to start because a half-written declaration\n * cannot be imported is a worse failure than starting with the app it does not\n * describe yet.\n */\nasync function withDerivedApps(\n\tloaded: LoadedConfig,\n\tsandbox?: Sandbox,\n): Promise<LoadedConfig> {\n\tconst globs = allConstructGlobs(loaded.workspace);\n\tif (globs.length === 0) {\n\t\tthrow new WorkspaceDeclaresNoConstructs(loaded.workspace.root);\n\t}\n\n\ttry {\n\t\tconst background: Record<string, string[]> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: globs,\n\t\t\tcwd: loaded.workspace.root,\n\t\t\tbackground,\n\t\t\t...(sandbox ? { sandbox } : {}),\n\t\t});\n\n\t\treturn {\n\t\t\t...loaded,\n\t\t\tmanifest,\n\t\t\tbackground,\n\t\t\tworkspace: {\n\t\t\t\t...loaded.workspace,\n\t\t\t\tapps: derivedApps(manifest, loaded.workspace),\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\toutput.warn(\n\t\t\t`⚠️  Could not read constructs, so apps come from config alone: ${message}`,\n\t\t);\n\t\treturn loaded;\n\t}\n}\n\n/**\n * A workspace with no `constructs` glob.\n *\n * In v10 every address, container and app comes from what the workspace\n * declares — there is no second path that reads a hand-written compose file or\n * an `apps` block's ports. A config that declares nothing has nothing to run.\n */\nexport class WorkspaceDeclaresNoConstructs extends Error {\n\tconstructor(readonly root: string) {\n\t\tsuper(\n\t\t\t`The workspace at ${root} declares no constructs. Every workspace names ` +\n\t\t\t\t\"where its constructs live — `constructs: ['./constructs/**/*.ts', \" +\n\t\t\t\t\"'./apps/*/endpoints/**/*.ts']` in gkm.config.ts — and its apps, \" +\n\t\t\t\t'containers and URLs are derived from them.',\n\t\t);\n\t\tthis.name = 'WorkspaceDeclaresNoConstructs';\n\t}\n}\n\nexport interface AppConfigResult {\n\tappName: string;\n\tapp: NormalizedAppConfig;\n\tgkmConfig: GkmConfig;\n\tworkspace: NormalizedWorkspace;\n\tworkspaceRoot: string;\n\tappRoot: string;\n}\n\n/**\n * The app a directory is part of: the one whose `path` contains it.\n *\n * An app's path is the one its construct declares — `new RestApi('Api',\n * { path: 'apps/api' })` — read off the workspace the constructs were derived\n * into, never off the filesystem's package names. The deepest match wins, so\n * an app inside another app's folder is its own; the workspace root belongs to\n * no app unless one lives there.\n */\nfunction resolveWorkspaceApp(\n\tloadedConfig: LoadedConfig,\n\tcwd: string,\n): { key: string; app: NormalizedAppConfig } | undefined {\n\tconst here = real(cwd);\n\tlet found: { key: string; app: NormalizedAppConfig; dir: string } | undefined;\n\n\tfor (const [key, app] of Object.entries(loadedConfig.workspace.apps)) {\n\t\tconst dir = real(join(loadedConfig.workspace.root, app.path));\n\t\tconst inside = here === dir || here.startsWith(`${dir}${sep}`);\n\t\tif (inside && (!found || dir.length > found.dir.length)) {\n\t\t\tfound = { key, app, dir };\n\t\t}\n\t}\n\n\treturn found && { key: found.key, app: found.app };\n}\n\n/** A path with its symlinks resolved, where it exists — `/tmp` is `/private/tmp`. */\nfunction real(path: string): string {\n\tconst absolute = resolve(path);\n\treturn existsSync(absolute) ? realpathSync(absolute) : absolute;\n}\n\n/** A directory that no app in the workspace lives in. */\nexport class NotInAnApp extends Error {\n\tconstructor(\n\t\treadonly cwd: string,\n\t\treadonly apps: Readonly<Record<string, string>>,\n\t) {\n\t\tsuper(\n\t\t\t`${cwd} is not inside any app's path. Apps: ` +\n\t\t\t\tObject.entries(apps)\n\t\t\t\t\t.map(([key, path]) => `${key} (${path})`)\n\t\t\t\t\t.join(', ') +\n\t\t\t\t'.',\n\t\t);\n\t\tthis.name = 'NotInAnApp';\n\t}\n}\n\n/** Every app's path, by key — what `NotInAnApp` lists. */\nfunction appPaths(loadedConfig: LoadedConfig): Record<string, string> {\n\treturn Object.fromEntries(\n\t\tObject.entries(loadedConfig.workspace.apps).map(([key, app]) => [\n\t\t\tkey,\n\t\t\tapp.path,\n\t\t]),\n\t);\n}\n\n/**\n * The backend app a directory is part of, with its gkm config — found by the\n * `path` its construct declares.\n *\n * @example\n * ```ts\n * // From apps/api, where a construct declares `path: 'apps/api'`\n * const { app, workspace, workspaceRoot } = await loadAppConfig();\n * ```\n *\n * @throws {NotInAnApp} when no app's path contains the directory.\n * @throws {NotABackendApp} when the app it is in has no gkm config to run.\n */\nexport async function loadAppConfig(\n\tcwd: string = process.cwd(),\n): Promise<AppConfigResult> {\n\tconst { appName, app, workspace, workspaceRoot } =\n\t\tawait loadWorkspaceAppInfo(cwd);\n\n\tconst gkmConfig = getAppGkmConfig(workspace, appName);\n\tif (!gkmConfig) throw new NotABackendApp(appName);\n\n\treturn {\n\t\tappName,\n\t\tapp,\n\t\tgkmConfig,\n\t\tworkspace,\n\t\tworkspaceRoot,\n\t\tappRoot: join(workspaceRoot, app.path),\n\t};\n}\n\n/** The app a directory is in has no gkm config — a site, or an entry app. */\nexport class NotABackendApp extends Error {\n\tconstructor(readonly appName: string) {\n\t\tsuper(\n\t\t\t`App \"${appName}\" is not a backend app and cannot be run with gkm dev.`,\n\t\t);\n\t\tthis.name = 'NotABackendApp';\n\t}\n}\n\nexport interface WorkspaceAppInfo {\n\t/** The app's key in the workspace. */\n\tappName: string;\n\tapp: NormalizedAppConfig;\n\tworkspace: NormalizedWorkspace;\n\tworkspaceRoot: string;\n}\n\n/**\n * The app a directory is part of, frontend or backend — found by the `path`\n * its construct declares. Unlike `loadAppConfig`, the app need not have a\n * gkm config, which is what `gkm exec` and `gkm test` from a site need.\n *\n * @throws {NotInAnApp} when no app's path contains the directory.\n */\nexport async function loadWorkspaceAppInfo(\n\tcwd: string = process.cwd(),\n): Promise<WorkspaceAppInfo> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd);\n\tconst loadedConfig = await withDerivedApps(\n\t\tprocessConfig(config, workspaceRoot),\n\t);\n\n\tconst resolved = resolveWorkspaceApp(loadedConfig, cwd);\n\tif (!resolved) throw new NotInAnApp(cwd, appPaths(loadedConfig));\n\n\treturn {\n\t\tappName: resolved.key,\n\t\tapp: resolved.app,\n\t\tworkspace: loadedConfig.workspace,\n\t\tworkspaceRoot,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,aAAa,QAA8B;CAC1D,OAAO;AACR;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,kBACf,cACA,cACqB;CACrB,MAAM,QAAQ,aAAa,MAAM,GAAG;CACpC,MAAM,OAAO,MAAM,MAAM;CACzB,MAAM,aAAa,MAAM;CAOzB,OAAO;EAAE;EAAM,eANO,CAAC,aACpB,eACA,eAAe,eACd,KAAK,aAAa,MAClB,KAAK,WAAW,MAAM,aAAa;CAEV;AAC9B;;;;;;;;AAcA,SAAS,eAAe,KAAoC;CAC3D,MAAM,QAAQ;EAAC;EAAmB;EAAiB;CAAe;CAGlE,MAAM,gBAAgB,QAAQ,IAAI;CAClC,IAAI,iBAAiB,WAAW,aAAa,GAC5C,OAAO;EACN,YAAY;EACZ,eAAe,QAAQ,aAAa;CACrC;CAID,IAAI,aAAa;CACjB,MAAM,EAAE,SAAS,MAAM,UAAU;CAEjC,OAAO,eAAe,MAAM;EAC3B,KAAK,MAAM,QAAQ,OAAO;GACzB,MAAM,aAAa,KAAK,YAAY,IAAI;GACxC,IAAI,WAAW,UAAU,GACxB,OAAO;IACN;IACA,eAAe;GAChB;EAEF;EACA,aAAa,QAAQ,UAAU;CAChC;CAEA,MAAM,IAAI,eAAe,GAAG;AAC7B;;;;;;;AAQA,SAAgB,kBAAkB,KAAqB;CACtD,OAAO,eAAe,GAAG,CAAC,CAAC;AAC5B;;AAGA,IAAa,iBAAb,cAAoC,MAAM;CACpB;CAArB,YAAY,KAAsB;EACjC,MACC,mHACD;EAHoB,KAAA,MAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;AA4BA,MAAa,yBAAyB;;AAGtC,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CACA;CAFV,YACC,YACA,QACC;EACD,MAAM,0BAA0B,QAAQ;EAH/B,KAAA,aAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACb;AACD;;;;;;AAOA,IAAa,8BAAb,cAAiD,MAAM;CAE5C;CACA;CAFV,YACC,YACA,OACC;EACD,MACC,GAAG,WAAW,4CACV,MAAM,KAAK,IAAI,EAAE,mTAKtB;EAVS,KAAA,aAAA;EACA,KAAA,QAAA;EAUT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,eAAeA,mBAAqB,UAAU;CACnDC,OAAS;EACR,QAAQC,QAAU,QAAQ;EAC1B,QAAQC,OAASC,OAAS,GAAGC,QAAU,CAAC;CACzC,CAAC;CACDJ,OAAS;EAAE,QAAQC,QAAU,MAAM;EAAG,OAAOI,MAAQF,OAAS,CAAC;CAAE,CAAC;CAClEH,OAAS;EACR,QAAQC,QAAU,QAAQ;EAC1B,OAAOD,OAAS;GAAE,MAAMG,OAAS;GAAG,SAASA,OAAS;EAAE,CAAC;CAC1D,CAAC;AACF,CAAC;;AAGD,eAAe,aACd,YACuC;CACvC,IAAI;EAEH,QAAO,MADc,OAAO,YAAA,CACd;CACf,SAAS,OAAO;EACf,MAAM,IAAI,iBAAiB,YAAa,MAAgB,OAAO;CAChE;AACD;;;;;;;;;AAUA,eAAe,oBACd,SACA,YACA,eACA,YAAY,wBAC2B;CACvC,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,eAAe;EACzD,MAAM;EACN,MAAM,CAAC,UAAU;EACjB,KAAK;EACL;EACA,QAAQ;CACT,CAAC;CAED,QAAQ,MAAM,QAAd;EACC,KAAK,UAGJ,OAAO,MAAM;EACd,KAAK,UACJ,MAAM,IAAI,iBAAiB,YAAY,MAAM,MAAM,OAAO;EAC3D,KAAK;GACJ,IAAI,QAAQ,WACX,MAAM,IAAI,4BAA4B,YAAY,MAAM,KAAK;GAE9D,OAAO,aAAa,UAAU;CAChC;AACD;;;;AAKA,eAAe,cACd,KACA,UAA6B,CAAC,GACH;CAC3B,MAAM,EAAE,YAAY,kBAAkB,eAAe,GAAG;CAIxD,MAAM,UAAU,QAAQ,WAAW,cAAc;CAUjD,OAAO;EAAE,QATM,UACZ,MAAM,oBACN,SACA,YACA,eACA,QAAQ,SACT,IACC,MAAM,aAAa,UAAU;EAEf;CAAc;AAChC;;;;;;;AAQA,eAAsB,WACrB,MAAc,QAAQ,IAAI,GACL;CACrB,MAAM,EAAE,WAAW,MAAM,cAAc,GAAG;CAG1C,IAAI,kBAAkB,MAAM,GAC3B,MAAM,IAAI,MACT,sEACD;CAGD,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,sBACrB,MAAc,QAAQ,IAAI,GAC1B,UAA6B,CAAC,GACO;CACrC,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,KAAK,OAAO;CAClE,OAAO,cAAc,QAAQ,aAAa,CAAC,CAAC;AAC7C;AAEA,eAAsB,oBACrB,MAAc,QAAQ,IAAI,GAC1B,UAA6B,CAAC,GACN;CACxB,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,KAAK,OAAO;CAClE,OAAO,gBAAgB,cAAc,QAAQ,aAAa,GAAG,QAAQ,OAAO;AAC7E;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,gBACd,QACA,SACwB;CACxB,MAAM,QAAQ,kBAAkB,OAAO,SAAS;CAChD,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,8BAA8B,OAAO,UAAU,IAAI;CAG9D,IAAI;EACH,MAAM,aAAuC,CAAC;EAC9C,MAAM,WAAW,MAAM,SAAS;GAC/B,UAAU;GACV,KAAK,OAAO,UAAU;GACtB;GACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC9B,CAAC;EAED,OAAO;GACN,GAAG;GACH;GACA;GACA,WAAW;IACV,GAAG,OAAO;IACV,MAAM,YAAY,UAAU,OAAO,SAAS;GAC7C;EACD;CACD,SAAS,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,OAAO,KACN,kEAAkE,SACnE;EACA,OAAO;CACR;AACD;;;;;;;;AASA,IAAa,gCAAb,cAAmD,MAAM;CACnC;CAArB,YAAY,MAAuB;EAClC,MACC,oBAAoB,KAAK,8NAI1B;EANoB,KAAA,OAAA;EAOpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;AAoBA,SAAS,oBACR,cACA,KACwD;CACxD,MAAM,OAAO,KAAK,GAAG;CACrB,IAAI;CAEJ,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,aAAa,UAAU,IAAI,GAAG;EACrE,MAAM,MAAM,KAAK,KAAK,aAAa,UAAU,MAAM,IAAI,IAAI,CAAC;EAE5D,KADe,SAAS,OAAO,KAAK,WAAW,GAAG,MAAM,KAAK,OAC9C,CAAC,SAAS,IAAI,SAAS,MAAM,IAAI,SAC/C,QAAQ;GAAE;GAAK;GAAK;EAAI;CAE1B;CAEA,OAAO,SAAS;EAAE,KAAK,MAAM;EAAK,KAAK,MAAM;CAAI;AAClD;;AAGA,SAAS,KAAK,MAAsB;CACnC,MAAM,WAAW,QAAQ,IAAI;CAC7B,OAAO,WAAW,QAAQ,IAAI,aAAa,QAAQ,IAAI;AACxD;;AAGA,IAAa,aAAb,cAAgC,MAAM;CAE3B;CACA;CAFV,YACC,KACA,MACC;EACD,MACC,GAAG,IAAI,yCACN,OAAO,QAAQ,IAAI,CAAC,CAClB,KAAK,CAAC,KAAK,UAAU,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CACxC,KAAK,IAAI,IACX,GACF;EATS,KAAA,MAAA;EACA,KAAA,OAAA;EAST,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,SAAS,cAAoD;CACrE,OAAO,OAAO,YACb,OAAO,QAAQ,aAAa,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,CAC/D,KACA,IAAI,IACL,CAAC,CACF;AACD;;;;;;;;;;;;;;AAeA,eAAsB,cACrB,MAAc,QAAQ,IAAI,GACC;CAC3B,MAAM,EAAE,SAAS,KAAK,WAAW,kBAChC,MAAM,qBAAqB,GAAG;CAE/B,MAAM,YAAY,gBAAgB,WAAW,OAAO;CACpD,IAAI,CAAC,WAAW,MAAM,IAAI,eAAe,OAAO;CAEhD,OAAO;EACN;EACA;EACA;EACA;EACA;EACA,SAAS,KAAK,eAAe,IAAI,IAAI;CACtC;AACD;;AAGA,IAAa,iBAAb,cAAoC,MAAM;CACpB;CAArB,YAAY,SAA0B;EACrC,MACC,QAAQ,QAAQ,uDACjB;EAHoB,KAAA,UAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;AAiBA,eAAsB,qBACrB,MAAc,QAAQ,IAAI,GACE;CAC5B,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,GAAG;CACzD,MAAM,eAAe,MAAM,gBAC1B,cAAc,QAAQ,aAAa,CACpC;CAEA,MAAM,WAAW,oBAAoB,cAAc,GAAG;CACtD,IAAI,CAAC,UAAU,MAAM,IAAI,WAAW,KAAK,SAAS,YAAY,CAAC;CAE/D,OAAO;EACN,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,WAAW,aAAa;EACxB;CACD;AACD"}
+{"version":3,"file":"config.mjs","names":["z.discriminatedUnion","z.object","z.literal","z.record","z.string","z.unknown","z.array"],"sources":["../src/config.ts"],"sourcesContent":["import { existsSync, realpathSync } from 'node:fs';\nimport { dirname, join, parse, resolve, sep } from 'node:path';\nimport { z } from 'zod';\nimport { GkmError } from './errors';\nimport { output } from './output.js';\nimport { discover } from './reconcile/discover.js';\nimport { activeSandbox, type Sandbox } from './sandbox/sandbox.js';\nimport { runWorker } from './sandbox/worker.js';\nimport type { GkmConfig } from './types.js';\nimport { derivedApps } from './workspace/derive.js';\nimport {\n\tallConstructGlobs,\n\tgetAppGkmConfig,\n\tisWorkspaceConfig,\n\ttype LoadedConfig,\n\ttype NormalizedAppConfig,\n\ttype NormalizedWorkspace,\n\tprocessConfig,\n\ttype WorkspaceConfig,\n} from './workspace/index.js';\n\n// What `gkm dev`'s discovery endpoint answers, for the tools that read it.\nexport type {\n\tAppStatus,\n\tDataApiKind,\n\tDiscoveredApp,\n\tDiscoveredDataApi,\n\tDiscoveredWorkspace,\n\tDiscoveryEvent,\n\tDiscoveryResponse,\n} from './dev/discovery.js';\nexport type { GkmConfig } from './types.js';\nexport type { LoadedConfig, WorkspaceConfig } from './workspace/index.js';\nexport { defineWorkspace } from './workspace/index.js';\nexport type { DevConfig } from './workspace/types.js';\n/**\n * Define GKM configuration with full TypeScript support.\n * This is an identity function that provides type safety and autocomplete.\n *\n * @example\n * ```ts\n * // gkm.config.ts\n * import { defineConfig } from '@geekmidas/cli/config';\n *\n * export default defineConfig({\n *   routes: './src/endpoints/**\\/*.ts',\n *   envParser: './src/config/env',\n *   logger: './src/config/logger',\n *   telescope: true,\n * });\n * ```\n */\nexport function defineConfig(config: GkmConfig): GkmConfig {\n\treturn config;\n}\n\nexport interface ParsedModuleConfig {\n\tpath: string;\n\timportPattern: string;\n}\n\n/**\n * Parse a module config string into path and import pattern.\n *\n * @param configString - Config string in format \"./path/to/module\" or \"./path/to/module#exportName\"\n * @param defaultAlias - The default alias name to use if no export name specified\n * @returns Object with path and import pattern\n *\n * @example\n * parseModuleConfig('./src/config/env', 'envParser')\n * // { path: './src/config/env', importPattern: 'envParser' }\n *\n * parseModuleConfig('./src/config/env#envParser', 'envParser')\n * // { path: './src/config/env', importPattern: '{ envParser }' }\n *\n * parseModuleConfig('./src/config/env#myEnv', 'envParser')\n * // { path: './src/config/env', importPattern: '{ myEnv as envParser }' }\n */\nexport function parseModuleConfig(\n\tconfigString: string,\n\tdefaultAlias: string,\n): ParsedModuleConfig {\n\tconst parts = configString.split('#');\n\tconst path = parts[0] ?? configString;\n\tconst exportName = parts[1];\n\tconst importPattern = !exportName\n\t\t? defaultAlias\n\t\t: exportName === defaultAlias\n\t\t\t? `{ ${defaultAlias} }`\n\t\t\t: `{ ${exportName} as ${defaultAlias} }`;\n\n\treturn { path, importPattern };\n}\n\nexport interface ConfigDiscoveryResult {\n\tconfigPath: string;\n\tworkspaceRoot: string;\n}\n\n/**\n * Find and return the path to the config file.\n *\n * Resolution order:\n * 1. GKM_CONFIG_PATH env var (set by workspace dev command)\n * 2. Walk up directory tree from cwd\n */\nfunction findConfigPath(cwd: string): ConfigDiscoveryResult {\n\tconst files = ['gkm.config.json', 'gkm.config.ts', 'gkm.config.js'];\n\n\t// Check GKM_CONFIG_PATH env var first (set by workspace dev command)\n\tconst envConfigPath = process.env.GKM_CONFIG_PATH;\n\tif (envConfigPath && existsSync(envConfigPath)) {\n\t\treturn {\n\t\t\tconfigPath: envConfigPath,\n\t\t\tworkspaceRoot: dirname(envConfigPath),\n\t\t};\n\t}\n\n\t// Walk up directory tree to find config\n\tlet currentDir = cwd;\n\tconst { root } = parse(currentDir);\n\n\twhile (currentDir !== root) {\n\t\tfor (const file of files) {\n\t\t\tconst configPath = join(currentDir, file);\n\t\t\tif (existsSync(configPath)) {\n\t\t\t\treturn {\n\t\t\t\t\tconfigPath,\n\t\t\t\t\tworkspaceRoot: currentDir,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t\tcurrentDir = dirname(currentDir);\n\t}\n\n\tthrow new ConfigNotFound(cwd);\n}\n\n/**\n * The directory holding the gkm config that `cwd` belongs to — the project a\n * sandbox for it is confined to.\n *\n * @throws {ConfigNotFound} when neither `cwd` nor any parent has one.\n */\nexport function findWorkspaceRoot(cwd: string): string {\n\treturn findConfigPath(cwd).workspaceRoot;\n}\n\n/** No gkm config in a directory or any of its parents. */\nexport class ConfigNotFound extends GkmError {\n\tconstructor(readonly cwd: string) {\n\t\tsuper(\n\t\t\t'Configuration file not found. Please create gkm.config.json, gkm.config.ts, or gkm.config.js in the project root.',\n\t\t);\n\t\tthis.name = 'ConfigNotFound';\n\t}\n}\n\ninterface RawConfigResult {\n\tconfig: GkmConfig | WorkspaceConfig;\n\tworkspaceRoot: string;\n}\n\nexport interface LoadConfigOptions {\n\t/**\n\t * Load the config — and discover the constructs it names — in this\n\t * sandbox rather than in this process. The config then arrives as data;\n\t * see {@link Sandbox.isolating} for what happens to one holding live\n\t * objects. Defaults to the run's own (`withSandbox`); with neither, the\n\t * config is imported here, as `gkm` always has.\n\t */\n\tsandbox?: Sandbox;\n\t/**\n\t * How long the sandboxed config load may run. Defaults to\n\t * {@link CONFIG_LOAD_TIMEOUT_MS}.\n\t */\n\ttimeoutMs?: number;\n}\n\n/**\n * How long loading a config, or discovering its constructs, may take in a\n * sandbox: room for tsx to compile a large project cold, and not a deploy\n * held open by a config that never finishes importing.\n */\nexport const CONFIG_LOAD_TIMEOUT_MS = 60_000;\n\n/** The config failed to import, or threw while it ran. */\nexport class ConfigLoadFailed extends Error {\n\tconstructor(\n\t\treadonly configPath: string,\n\t\treadonly detail: string,\n\t) {\n\t\tsuper(`Failed to load config: ${detail}`);\n\t\tthis.name = 'ConfigLoadFailed';\n\t}\n}\n\n/**\n * The config holds something that is not data — a custom state store, an\n * inline deploy target, a function — and the sandbox it was loaded in hands\n * the deploy nothing but data.\n */\nexport class ConfigObjectNotSerializable extends Error {\n\tconstructor(\n\t\treadonly configPath: string,\n\t\treadonly paths: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`${configPath} holds values that are not plain data at: ` +\n\t\t\t\t`${paths.join(', ')}. It was loaded in an isolating sandbox, which ` +\n\t\t\t\t'hands the deploy the config as JSON, so a live object — a custom ' +\n\t\t\t\t'store, an inline target, a function — cannot reach it. Configure ' +\n\t\t\t\t'these with plain values instead, or deploy this project with a ' +\n\t\t\t\t'sandbox that is not isolating (the default) if the host trusts it.',\n\t\t);\n\t\tthis.name = 'ConfigObjectNotSerializable';\n\t}\n}\n\n/** What the config worker answers. Checked: the worker ran project code. */\nconst ConfigAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('loaded'),\n\t\tconfig: z.record(z.string(), z.unknown()),\n\t}),\n\tz.object({ reason: z.literal('live'), paths: z.array(z.string()) }),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }),\n\t}),\n]);\n\n/** Import the config in this process — live objects and all. */\nasync function importConfig(\n\tconfigPath: string,\n): Promise<GkmConfig | WorkspaceConfig> {\n\ttry {\n\t\tconst config = await import(configPath);\n\t\treturn config.default;\n\t} catch (error) {\n\t\tthrow new ConfigLoadFailed(configPath, (error as Error).message);\n\t}\n}\n\n/**\n * The config, loaded in `sandbox` and handed back as JSON.\n *\n * A config holding live objects cannot come back that way. An isolating\n * sandbox refuses it with {@link ConfigObjectNotSerializable}; any other\n * imports it here as well, as before, since the host already runs this\n * project's code as its own.\n */\nasync function loadConfigInSandbox(\n\tsandbox: Sandbox,\n\tconfigPath: string,\n\tworkspaceRoot: string,\n\ttimeoutMs = CONFIG_LOAD_TIMEOUT_MS,\n): Promise<GkmConfig | WorkspaceConfig> {\n\tconst { value } = await runWorker(sandbox, 'config load', {\n\t\tname: 'config-worker',\n\t\targs: [configPath],\n\t\tcwd: workspaceRoot,\n\t\ttimeoutMs,\n\t\tschema: ConfigAnswer,\n\t});\n\n\tswitch (value.reason) {\n\t\tcase 'loaded':\n\t\t\t// Its shape is `processConfig`'s to check, against the workspace\n\t\t\t// schema, exactly as for a config imported here.\n\t\t\treturn value.config as unknown as GkmConfig | WorkspaceConfig;\n\t\tcase 'failed':\n\t\t\tthrow new ConfigLoadFailed(configPath, value.error.message);\n\t\tcase 'live':\n\t\t\tif (sandbox.isolating) {\n\t\t\t\tthrow new ConfigObjectNotSerializable(configPath, value.paths);\n\t\t\t}\n\t\t\treturn importConfig(configPath);\n\t}\n}\n\n/**\n * Load raw configuration from file.\n */\nasync function loadRawConfig(\n\tcwd: string,\n\toptions: LoadConfigOptions = {},\n): Promise<RawConfigResult> {\n\tconst { configPath, workspaceRoot } = findConfigPath(cwd);\n\t// The run's own sandbox when none is given: a deploy reloads the config\n\t// deep in the engine (generating Dockerfiles), and that load is the\n\t// project's code as much as the first.\n\tconst sandbox = options.sandbox ?? activeSandbox();\n\tconst config = sandbox\n\t\t? await loadConfigInSandbox(\n\t\t\t\tsandbox,\n\t\t\t\tconfigPath,\n\t\t\t\tworkspaceRoot,\n\t\t\t\toptions.timeoutMs,\n\t\t\t)\n\t\t: await importConfig(configPath);\n\n\treturn { config, workspaceRoot };\n}\n\n/**\n * Load configuration file (single-app format).\n * For backwards compatibility with existing code.\n *\n * @deprecated Use loadWorkspaceConfig for new code\n */\nexport async function loadConfig(\n\tcwd: string = process.cwd(),\n): Promise<GkmConfig> {\n\tconst { config } = await loadRawConfig(cwd);\n\n\t// If it's a workspace config, throw an error\n\tif (isWorkspaceConfig(config)) {\n\t\tthrow new Error(\n\t\t\t'Workspace configuration detected. Use loadWorkspaceConfig() instead.',\n\t\t);\n\t}\n\n\treturn config;\n}\n\n/**\n * Load configuration file and process it as a workspace.\n * Works with both single-app and workspace configurations.\n *\n * Single-app configs are automatically wrapped as a workspace with one app.\n *\n * @example\n * ```ts\n * const { type, workspace } = await loadWorkspaceConfig();\n *\n * if (type === 'workspace') {\n *   console.log('Multi-app workspace:', workspace.apps);\n * } else {\n *   console.log('Single app wrapped as workspace');\n * }\n * ```\n */\n/**\n * The workspace a directory belongs to, as its config states it — without\n * discovering its constructs.\n *\n * For callers that need a fact the config holds (where a stage's secrets are\n * stored) and nothing the graph adds. `loadWorkspaceConfig` imports every\n * construct module to derive the apps, which is a cost a secrets read should\n * not pay.\n */\nexport async function loadWorkspaceSettings(\n\tcwd: string = process.cwd(),\n\toptions: LoadConfigOptions = {},\n): Promise<LoadedConfig['workspace']> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd, options);\n\treturn processConfig(config, workspaceRoot).workspace;\n}\n\nexport async function loadWorkspaceConfig(\n\tcwd: string = process.cwd(),\n\toptions: LoadConfigOptions = {},\n): Promise<LoadedConfig> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd, options);\n\treturn withDerivedApps(processConfig(config, workspaceRoot), options.sandbox);\n}\n\n/**\n * The loaded config, with its apps read off the graph.\n *\n * Here rather than at each call site because every command needs the same\n * answer, and the ones that forgot to ask were exactly the bugs: a site that\n * never deployed, a surface that could not be its own process. `gkm dev`,\n * `gkm build`, `gkm docker` and `gkm deploy` now all see the same apps without\n * any of them knowing a derivation happened.\n *\n * Discovery imports the construct modules — declarations only, not endpoints —\n * which is the same import the reconciler and the build already do. A workspace\n * with no `constructs` glob discovers nothing and keeps whatever its config\n * said, so nothing that worked before changes.\n *\n * A construct file that throws is reported and skipped rather than taking the\n * command down: `gkm dev` failing to start because a half-written declaration\n * cannot be imported is a worse failure than starting with the app it does not\n * describe yet.\n */\nasync function withDerivedApps(\n\tloaded: LoadedConfig,\n\tsandbox?: Sandbox,\n): Promise<LoadedConfig> {\n\tconst globs = allConstructGlobs(loaded.workspace);\n\tif (globs.length === 0) {\n\t\tthrow new WorkspaceDeclaresNoConstructs(loaded.workspace.root);\n\t}\n\n\ttry {\n\t\tconst background: Record<string, string[]> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: globs,\n\t\t\tcwd: loaded.workspace.root,\n\t\t\tbackground,\n\t\t\t...(sandbox ? { sandbox } : {}),\n\t\t});\n\n\t\treturn {\n\t\t\t...loaded,\n\t\t\tmanifest,\n\t\t\tbackground,\n\t\t\tworkspace: {\n\t\t\t\t...loaded.workspace,\n\t\t\t\tapps: derivedApps(manifest, loaded.workspace),\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\toutput.warn(\n\t\t\t`⚠️  Could not read constructs, so apps come from config alone: ${message}`,\n\t\t);\n\t\treturn loaded;\n\t}\n}\n\n/**\n * A workspace with no `constructs` glob.\n *\n * In v10 every address, container and app comes from what the workspace\n * declares — there is no second path that reads a hand-written compose file or\n * an `apps` block's ports. A config that declares nothing has nothing to run.\n */\nexport class WorkspaceDeclaresNoConstructs extends GkmError {\n\tconstructor(readonly root: string) {\n\t\tsuper(\n\t\t\t`The workspace at ${root} declares no constructs. Every workspace names ` +\n\t\t\t\t\"where its constructs live — `constructs: ['./constructs/**/*.ts', \" +\n\t\t\t\t\"'./apps/*/endpoints/**/*.ts']` in gkm.config.ts — and its apps, \" +\n\t\t\t\t'containers and URLs are derived from them.',\n\t\t);\n\t\tthis.name = 'WorkspaceDeclaresNoConstructs';\n\t}\n}\n\nexport interface AppConfigResult {\n\tappName: string;\n\tapp: NormalizedAppConfig;\n\tgkmConfig: GkmConfig;\n\tworkspace: NormalizedWorkspace;\n\tworkspaceRoot: string;\n\tappRoot: string;\n}\n\n/**\n * The app a directory is part of: the one whose `path` contains it.\n *\n * An app's path is the one its construct declares — `new RestApi('Api',\n * { path: 'apps/api' })` — read off the workspace the constructs were derived\n * into, never off the filesystem's package names. The deepest match wins, so\n * an app inside another app's folder is its own; the workspace root belongs to\n * no app unless one lives there.\n */\nfunction resolveWorkspaceApp(\n\tloadedConfig: LoadedConfig,\n\tcwd: string,\n): { key: string; app: NormalizedAppConfig } | undefined {\n\tconst here = real(cwd);\n\tlet found: { key: string; app: NormalizedAppConfig; dir: string } | undefined;\n\n\tfor (const [key, app] of Object.entries(loadedConfig.workspace.apps)) {\n\t\tconst dir = real(join(loadedConfig.workspace.root, app.path));\n\t\tconst inside = here === dir || here.startsWith(`${dir}${sep}`);\n\t\tif (inside && (!found || dir.length > found.dir.length)) {\n\t\t\tfound = { key, app, dir };\n\t\t}\n\t}\n\n\treturn found && { key: found.key, app: found.app };\n}\n\n/** A path with its symlinks resolved, where it exists — `/tmp` is `/private/tmp`. */\nfunction real(path: string): string {\n\tconst absolute = resolve(path);\n\treturn existsSync(absolute) ? realpathSync(absolute) : absolute;\n}\n\n/** A directory that no app in the workspace lives in. */\nexport class NotInAnApp extends GkmError {\n\tconstructor(\n\t\treadonly cwd: string,\n\t\treadonly apps: Readonly<Record<string, string>>,\n\t) {\n\t\tsuper(\n\t\t\t`${cwd} is not inside any app's path. Apps: ` +\n\t\t\t\tObject.entries(apps)\n\t\t\t\t\t.map(([key, path]) => `${key} (${path})`)\n\t\t\t\t\t.join(', ') +\n\t\t\t\t'.',\n\t\t);\n\t\tthis.name = 'NotInAnApp';\n\t}\n}\n\n/** Every app's path, by key — what `NotInAnApp` lists. */\nfunction appPaths(loadedConfig: LoadedConfig): Record<string, string> {\n\treturn Object.fromEntries(\n\t\tObject.entries(loadedConfig.workspace.apps).map(([key, app]) => [\n\t\t\tkey,\n\t\t\tapp.path,\n\t\t]),\n\t);\n}\n\n/**\n * The backend app a directory is part of, with its gkm config — found by the\n * `path` its construct declares.\n *\n * @example\n * ```ts\n * // From apps/api, where a construct declares `path: 'apps/api'`\n * const { app, workspace, workspaceRoot } = await loadAppConfig();\n * ```\n *\n * @throws {NotInAnApp} when no app's path contains the directory.\n * @throws {NotABackendApp} when the app it is in has no gkm config to run.\n */\nexport async function loadAppConfig(\n\tcwd: string = process.cwd(),\n): Promise<AppConfigResult> {\n\tconst { appName, app, workspace, workspaceRoot } =\n\t\tawait loadWorkspaceAppInfo(cwd);\n\n\tconst gkmConfig = getAppGkmConfig(workspace, appName);\n\tif (!gkmConfig) throw new NotABackendApp(appName);\n\n\treturn {\n\t\tappName,\n\t\tapp,\n\t\tgkmConfig,\n\t\tworkspace,\n\t\tworkspaceRoot,\n\t\tappRoot: join(workspaceRoot, app.path),\n\t};\n}\n\n/** The app a directory is in has no gkm config — a site, or an entry app. */\nexport class NotABackendApp extends GkmError {\n\tconstructor(readonly appName: string) {\n\t\tsuper(\n\t\t\t`App \"${appName}\" is not a backend app and cannot be run with gkm dev.`,\n\t\t);\n\t\tthis.name = 'NotABackendApp';\n\t}\n}\n\nexport interface WorkspaceAppInfo {\n\t/** The app's key in the workspace. */\n\tappName: string;\n\tapp: NormalizedAppConfig;\n\tworkspace: NormalizedWorkspace;\n\tworkspaceRoot: string;\n}\n\n/**\n * The app a directory is part of, frontend or backend — found by the `path`\n * its construct declares. Unlike `loadAppConfig`, the app need not have a\n * gkm config, which is what `gkm exec` and `gkm test` from a site need.\n *\n * @throws {NotInAnApp} when no app's path contains the directory.\n */\nexport async function loadWorkspaceAppInfo(\n\tcwd: string = process.cwd(),\n): Promise<WorkspaceAppInfo> {\n\tconst { config, workspaceRoot } = await loadRawConfig(cwd);\n\tconst loadedConfig = await withDerivedApps(\n\t\tprocessConfig(config, workspaceRoot),\n\t);\n\n\tconst resolved = resolveWorkspaceApp(loadedConfig, cwd);\n\tif (!resolved) throw new NotInAnApp(cwd, appPaths(loadedConfig));\n\n\treturn {\n\t\tappName: resolved.key,\n\t\tapp: resolved.app,\n\t\tworkspace: loadedConfig.workspace,\n\t\tworkspaceRoot,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAoDA,SAAgB,aAAa,QAA8B;CAC1D,OAAO;AACR;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,kBACf,cACA,cACqB;CACrB,MAAM,QAAQ,aAAa,MAAM,GAAG;CACpC,MAAM,OAAO,MAAM,MAAM;CACzB,MAAM,aAAa,MAAM;CAOzB,OAAO;EAAE;EAAM,eANO,CAAC,aACpB,eACA,eAAe,eACd,KAAK,aAAa,MAClB,KAAK,WAAW,MAAM,aAAa;CAEV;AAC9B;;;;;;;;AAcA,SAAS,eAAe,KAAoC;CAC3D,MAAM,QAAQ;EAAC;EAAmB;EAAiB;CAAe;CAGlE,MAAM,gBAAgB,QAAQ,IAAI;CAClC,IAAI,iBAAiB,WAAW,aAAa,GAC5C,OAAO;EACN,YAAY;EACZ,eAAe,QAAQ,aAAa;CACrC;CAID,IAAI,aAAa;CACjB,MAAM,EAAE,SAAS,MAAM,UAAU;CAEjC,OAAO,eAAe,MAAM;EAC3B,KAAK,MAAM,QAAQ,OAAO;GACzB,MAAM,aAAa,KAAK,YAAY,IAAI;GACxC,IAAI,WAAW,UAAU,GACxB,OAAO;IACN;IACA,eAAe;GAChB;EAEF;EACA,aAAa,QAAQ,UAAU;CAChC;CAEA,MAAM,IAAI,eAAe,GAAG;AAC7B;;;;;;;AAQA,SAAgB,kBAAkB,KAAqB;CACtD,OAAO,eAAe,GAAG,CAAC,CAAC;AAC5B;;AAGA,IAAa,iBAAb,cAAoC,SAAS;CACvB;CAArB,YAAY,KAAsB;EACjC,MACC,mHACD;EAHoB,KAAA,MAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;AA4BA,MAAa,yBAAyB;;AAGtC,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CACA;CAFV,YACC,YACA,QACC;EACD,MAAM,0BAA0B,QAAQ;EAH/B,KAAA,aAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACb;AACD;;;;;;AAOA,IAAa,8BAAb,cAAiD,MAAM;CAE5C;CACA;CAFV,YACC,YACA,OACC;EACD,MACC,GAAG,WAAW,4CACV,MAAM,KAAK,IAAI,EAAE,mTAKtB;EAVS,KAAA,aAAA;EACA,KAAA,QAAA;EAUT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,eAAeA,mBAAqB,UAAU;CACnDC,OAAS;EACR,QAAQC,QAAU,QAAQ;EAC1B,QAAQC,OAASC,OAAS,GAAGC,QAAU,CAAC;CACzC,CAAC;CACDJ,OAAS;EAAE,QAAQC,QAAU,MAAM;EAAG,OAAOI,MAAQF,OAAS,CAAC;CAAE,CAAC;CAClEH,OAAS;EACR,QAAQC,QAAU,QAAQ;EAC1B,OAAOD,OAAS;GAAE,MAAMG,OAAS;GAAG,SAASA,OAAS;EAAE,CAAC;CAC1D,CAAC;AACF,CAAC;;AAGD,eAAe,aACd,YACuC;CACvC,IAAI;EAEH,QAAO,MADc,OAAO,YAAA,CACd;CACf,SAAS,OAAO;EACf,MAAM,IAAI,iBAAiB,YAAa,MAAgB,OAAO;CAChE;AACD;;;;;;;;;AAUA,eAAe,oBACd,SACA,YACA,eACA,YAAY,wBAC2B;CACvC,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,eAAe;EACzD,MAAM;EACN,MAAM,CAAC,UAAU;EACjB,KAAK;EACL;EACA,QAAQ;CACT,CAAC;CAED,QAAQ,MAAM,QAAd;EACC,KAAK,UAGJ,OAAO,MAAM;EACd,KAAK,UACJ,MAAM,IAAI,iBAAiB,YAAY,MAAM,MAAM,OAAO;EAC3D,KAAK;GACJ,IAAI,QAAQ,WACX,MAAM,IAAI,4BAA4B,YAAY,MAAM,KAAK;GAE9D,OAAO,aAAa,UAAU;CAChC;AACD;;;;AAKA,eAAe,cACd,KACA,UAA6B,CAAC,GACH;CAC3B,MAAM,EAAE,YAAY,kBAAkB,eAAe,GAAG;CAIxD,MAAM,UAAU,QAAQ,WAAW,cAAc;CAUjD,OAAO;EAAE,QATM,UACZ,MAAM,oBACN,SACA,YACA,eACA,QAAQ,SACT,IACC,MAAM,aAAa,UAAU;EAEf;CAAc;AAChC;;;;;;;AAQA,eAAsB,WACrB,MAAc,QAAQ,IAAI,GACL;CACrB,MAAM,EAAE,WAAW,MAAM,cAAc,GAAG;CAG1C,IAAI,kBAAkB,MAAM,GAC3B,MAAM,IAAI,MACT,sEACD;CAGD,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,sBACrB,MAAc,QAAQ,IAAI,GAC1B,UAA6B,CAAC,GACO;CACrC,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,KAAK,OAAO;CAClE,OAAO,cAAc,QAAQ,aAAa,CAAC,CAAC;AAC7C;AAEA,eAAsB,oBACrB,MAAc,QAAQ,IAAI,GAC1B,UAA6B,CAAC,GACN;CACxB,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,KAAK,OAAO;CAClE,OAAO,gBAAgB,cAAc,QAAQ,aAAa,GAAG,QAAQ,OAAO;AAC7E;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,gBACd,QACA,SACwB;CACxB,MAAM,QAAQ,kBAAkB,OAAO,SAAS;CAChD,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,8BAA8B,OAAO,UAAU,IAAI;CAG9D,IAAI;EACH,MAAM,aAAuC,CAAC;EAC9C,MAAM,WAAW,MAAM,SAAS;GAC/B,UAAU;GACV,KAAK,OAAO,UAAU;GACtB;GACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC9B,CAAC;EAED,OAAO;GACN,GAAG;GACH;GACA;GACA,WAAW;IACV,GAAG,OAAO;IACV,MAAM,YAAY,UAAU,OAAO,SAAS;GAC7C;EACD;CACD,SAAS,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,OAAO,KACN,kEAAkE,SACnE;EACA,OAAO;CACR;AACD;;;;;;;;AASA,IAAa,gCAAb,cAAmD,SAAS;CACtC;CAArB,YAAY,MAAuB;EAClC,MACC,oBAAoB,KAAK,8NAI1B;EANoB,KAAA,OAAA;EAOpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;AAoBA,SAAS,oBACR,cACA,KACwD;CACxD,MAAM,OAAO,KAAK,GAAG;CACrB,IAAI;CAEJ,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,aAAa,UAAU,IAAI,GAAG;EACrE,MAAM,MAAM,KAAK,KAAK,aAAa,UAAU,MAAM,IAAI,IAAI,CAAC;EAE5D,KADe,SAAS,OAAO,KAAK,WAAW,GAAG,MAAM,KAAK,OAC9C,CAAC,SAAS,IAAI,SAAS,MAAM,IAAI,SAC/C,QAAQ;GAAE;GAAK;GAAK;EAAI;CAE1B;CAEA,OAAO,SAAS;EAAE,KAAK,MAAM;EAAK,KAAK,MAAM;CAAI;AAClD;;AAGA,SAAS,KAAK,MAAsB;CACnC,MAAM,WAAW,QAAQ,IAAI;CAC7B,OAAO,WAAW,QAAQ,IAAI,aAAa,QAAQ,IAAI;AACxD;;AAGA,IAAa,aAAb,cAAgC,SAAS;CAE9B;CACA;CAFV,YACC,KACA,MACC;EACD,MACC,GAAG,IAAI,yCACN,OAAO,QAAQ,IAAI,CAAC,CAClB,KAAK,CAAC,KAAK,UAAU,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CACxC,KAAK,IAAI,IACX,GACF;EATS,KAAA,MAAA;EACA,KAAA,OAAA;EAST,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,SAAS,cAAoD;CACrE,OAAO,OAAO,YACb,OAAO,QAAQ,aAAa,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,CAC/D,KACA,IAAI,IACL,CAAC,CACF;AACD;;;;;;;;;;;;;;AAeA,eAAsB,cACrB,MAAc,QAAQ,IAAI,GACC;CAC3B,MAAM,EAAE,SAAS,KAAK,WAAW,kBAChC,MAAM,qBAAqB,GAAG;CAE/B,MAAM,YAAY,gBAAgB,WAAW,OAAO;CACpD,IAAI,CAAC,WAAW,MAAM,IAAI,eAAe,OAAO;CAEhD,OAAO;EACN;EACA;EACA;EACA;EACA;EACA,SAAS,KAAK,eAAe,IAAI,IAAI;CACtC;AACD;;AAGA,IAAa,iBAAb,cAAoC,SAAS;CACvB;CAArB,YAAY,SAA0B;EACrC,MACC,QAAQ,QAAQ,uDACjB;EAHoB,KAAA,UAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;AAiBA,eAAsB,qBACrB,MAAc,QAAQ,IAAI,GACE;CAC5B,MAAM,EAAE,QAAQ,kBAAkB,MAAM,cAAc,GAAG;CACzD,MAAM,eAAe,MAAM,gBAC1B,cAAc,QAAQ,aAAa,CACpC;CAEA,MAAM,WAAW,oBAAoB,cAAc,GAAG;CACtD,IAAI,CAAC,UAAU,MAAM,IAAI,WAAW,KAAK,SAAS,YAAY,CAAC;CAE/D,OAAO;EACN,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,WAAW,aAAa;EACxB;CACD;AACD"}

package/dist/{credentialSchemas-BJqRJNK4.mjs → credentialSchemas-BJFvfkaz.mjs}

@@ -1,6 +1,7 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { _ as toJSONSchema, a as discriminatedUnion, d as record, f as string, h as unknown, n as array, r as boolean, s as literal, t as _enum, u as object } from "./schemas-D-xeKJDD.mjs";
-import { c as runWorker, r as discover, t as ConstructDiscoveryFailed } from "./discover-BPelzeGW.mjs";
-import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
+import { c as runWorker, r as discover, t as ConstructDiscoveryFailed } from "./discover-qjFapetL.mjs";
+import { i as activeSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { provideKey } from "@geekmidas/manifest";
 import { decodeCredentials } from "@geekmidas/constructs/credential";
 //#region src/secrets/credentialSchemas.ts
@@ -195,7 +196,7 @@ function issueLine(key, issue) {
 * stage's secrets, or already there when a deploy reads them. The values are
 * never in the message: only where each is wrong, and why.
 */
-var CredentialsInvalid = class extends Error {
+var CredentialsInvalid = class extends GkmError {
 	stage;
 	invalid;
 	during;
@@ -233,4 +234,4 @@ async function assertStageCredentials(options) {
 //#endregion
 export { liveCredentials as a, issueLine as i, assertStageCredentials as n, loadCredentialSchemas as o, inspectLive as r, CredentialsInvalid as t };
 
-//# sourceMappingURL=credentialSchemas-BJqRJNK4.mjs.map
+//# sourceMappingURL=credentialSchemas-BJFvfkaz.mjs.map

package/dist/credentialSchemas-BJFvfkaz.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialSchemas-BJFvfkaz.mjs","names":["z.toJSONSchema","z.object","z.string","z.discriminatedUnion","z.literal","z.array","z.enum","z.record","z.unknown","z.boolean"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,KAAK,WAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAOA,aAAe,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,SAAS,kBAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAQC,OAAS;CAAE,MAAMC,OAAS;CAAG,SAASA,OAAS;AAAE,CAAC;;AAGhE,MAAM,oBAAoBC,mBAAqB,UAAU,CACxDF,OAAS;CACR,QAAQG,QAAU,WAAW;CAC7B,SAASC,MACRJ,OAAS;EACR,KAAKC,OAAS;EACd,IAAIA,OAAS;EACb,MAAMI,MAAO,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAYC,OAASL,OAAS,GAAGM,QAAU,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAQD,OACPL,OAAS,GACTD,OAAS;EAAE,IAAIQ,QAAU;EAAG,QAAQJ,MAAQ,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GACDJ,OAAS;CACR,QAAQG,QAAU,QAAQ;CAC1B,OAAOH,OAAS;EAAE,MAAMC,OAAS;EAAG,SAASA,OAAS;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAU,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAI,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALN,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAO,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwC,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}

package/dist/{credentialSchemas-DCR4Wd1W.cjs → credentialSchemas-CAPKFkrG.cjs}

@@ -1,6 +1,7 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_schemas = require("./schemas-BObwxB_t.cjs");
-const require_discover = require("./discover-D1It5r_h.cjs");
-const require_sandbox = require("./sandbox-CL--ZDui.cjs");
+const require_discover = require("./discover-DPgu-ScS.cjs");
+const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let _geekmidas_constructs_credential = require("@geekmidas/constructs/credential");
 //#region src/secrets/credentialSchemas.ts
@@ -195,7 +196,7 @@ function issueLine(key, issue) {
 * stage's secrets, or already there when a deploy reads them. The values are
 * never in the message: only where each is wrong, and why.
 */
-var CredentialsInvalid = class extends Error {
+var CredentialsInvalid = class extends require_errors.GkmError {
 	stage;
 	invalid;
 	during;
@@ -268,4 +269,4 @@ Object.defineProperty(exports, "loadCredentialSchemas", {
 	}
 });
 
-//# sourceMappingURL=credentialSchemas-DCR4Wd1W.cjs.map
+//# sourceMappingURL=credentialSchemas-CAPKFkrG.cjs.map