@geekmidas/cli 10.0.0-alpha.91 → 10.0.0-alpha.93

package/dist/{rollback-UIjS25F1.cjs → rollback--ympG9ss.cjs}

@@ -1,11 +1,12 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_credentials = require("./credentials-BKfIugu2.cjs");
-const require_sandbox = require("./sandbox-CL--ZDui.cjs");
-const require_workspace = require("./workspace-CwW3Gkru.cjs");
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_credentials = require("./credentials-QBu7VgaQ.cjs");
+const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
+const require_workspace = require("./workspace-CHOB2Xg3.cjs");
 const require_config = require("./config.cjs");
-const require_seeds = require("./seeds-CkIPFGNO.cjs");
-const require_local = require("./local-BjxDfPvy.cjs");
-const require_engine = require("./engine-BhJ7ZP9K.cjs");
+const require_seeds = require("./seeds-c-ByX9je.cjs");
+const require_local = require("./local-B61kUh0w.cjs");
+const require_engine = require("./engine-Cfx8fEZU.cjs");
 let node_path = require("node:path");
 //#region src/target/dokploy/rollback.ts
 /**
@@ -30,7 +31,7 @@ var rollback_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	rollbackStage: () => rollbackStage
 });
 /** Neither an app nor every app was asked for. */
-var RollbackNeedsApp = class extends Error {
+var RollbackNeedsApp = class extends require_errors.GkmError {
 	stage;
 	apps;
 	constructor(stage, apps) {
@@ -41,7 +42,7 @@ var RollbackNeedsApp = class extends Error {
 	}
 };
 /** An app has no release before the one it runs. */
-var NothingToRollBack = class extends Error {
+var NothingToRollBack = class extends require_errors.GkmError {
 	stage;
 	app;
 	constructor(stage, app) {
@@ -52,7 +53,7 @@ var NothingToRollBack = class extends Error {
 	}
 };
 /** The stage was never deployed through Dokploy from this state. */
-var StageNeverDeployed = class extends Error {
+var StageNeverDeployed = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`"${stage}" has no deploy state, so there is nothing to roll back. Check the stage name, and that \`state\` in gkm.config.ts points at the store the deploys write to.`);
@@ -72,6 +73,7 @@ async function rollbackStage(input) {
 	return require_sandbox.withSandbox(sandbox, async () => {
 		const { workspace } = await require_config.loadWorkspaceConfig((0, node_path.resolve)(input.cwd), { sandbox });
 		require_workspace.assertDeployedStage(workspace.stages, input.stage);
+		require_seeds.assertStateOutlivesRun(workspace, input.stage, "deploy:rollback");
 		const store = await require_seeds.createStateStore({
 			config: workspace.state,
 			workspaceRoot: workspace.root,
@@ -80,7 +82,7 @@ async function rollbackStage(input) {
 		if (!await store.read(input.stage)) throw new StageNeverDeployed(input.stage);
 		const lock = await store.lock(input.stage, { operation: "rollback" });
 		try {
-			const journal = await require_seeds.DeployJournal.open(store, input.stage, () => require_seeds.createEmptyState(input.stage, "", ""));
+			const journal = await require_seeds.DeployJournal.open(store, input.stage, () => require_seeds.createEmptyState(input.stage, "", ""), require_seeds.asDokployState);
 			const { state } = journal;
 			const releases = state.releases ?? {};
 			const restorable = Object.keys(releases).filter((app) => releases[app].previous);
@@ -158,4 +160,4 @@ Object.defineProperty(exports, "rollback_exports", {
 	}
 });
 
-//# sourceMappingURL=rollback-UIjS25F1.cjs.map
+//# sourceMappingURL=rollback--ympG9ss.cjs.map

package/dist/rollback--ympG9ss.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback--ympG9ss.cjs","names":["GkmError","storedCredentials","LocalSandbox","findWorkspaceRoot","resolve","withSandbox","loadWorkspaceConfig","createStateStore","DeployJournal","createEmptyState","asDokployState","dokployApi","verifySettings","restoreImage"],"sources":["../src/target/dokploy/rollback.ts"],"sourcesContent":["/**\n * `gkm deploy:rollback`: a stage's apps put back on the release before the\n * one they run, by hand — for a release that passed its checks and turned out\n * wrong anyway.\n *\n * One app by default, because an app is what usually broke: rolling the API\n * back over a site fix that shipped beside it undoes the fix too. `atomic`\n * rolls back every app that has a release to go back to, for apps that only\n * work together — an API and the site built against its newer contract.\n *\n * It restores images and nothing else. The environment an app runs with is\n * the stage's, resolved on every deploy, and migrations are forward-only: a\n * migration that the older code cannot run against is undone by a new\n * migration, never by a rollback.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../../config';\nimport {\n\ttype CredentialProvider,\n\tstoredCredentials,\n} from '../../deploy/credentials';\nimport { DeployJournal } from '../../deploy/journal';\nimport {\n\tassertStateOutlivesRun,\n\tcreateStateStore,\n} from '../../deploy/StateStore';\nimport {\n\tasDokployState,\n\tcreateEmptyState,\n\ttype ReleasedImage,\n\trecordRollback,\n} from '../../deploy/state';\nimport { GkmError } from '../../errors';\nimport { LocalSandbox } from '../../sandbox/local';\nimport { type Sandbox, withSandbox } from '../../sandbox/sandbox';\nimport { assertDeployedStage } from '../../workspace/stages';\nimport { dokployApi, restoreImage, verifySettings } from './engine';\n\nexport interface RollbackInput {\n\t/** The project: the directory holding `gkm.config.ts`, or one inside it. */\n\tcwd: string;\n\tstage: string;\n\t/** The app to roll back. */\n\tapp?: string;\n\t/** Every app with an earlier release, instead of one. */\n\tatomic?: boolean;\n\t/** Defaults to the environment, then the logins `gkm login` stored. */\n\tcredentials?: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Each progress line. Defaults to none. */\n\tlog?: (line: string) => void;\n\t/** Where the config is loaded. Defaults to a `LocalSandbox` on the project. */\n\tsandbox?: Sandbox;\n}\n\n/** One app rolled back. */\nexport interface RolledBack {\n\tapp: string;\n\tfrom: ReleasedImage;\n\tto: ReleasedImage;\n}\n\n/** Neither an app nor every app was asked for. */\nexport class RollbackNeedsApp extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** The apps that have a release to go back to. */\n\t\treadonly apps: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Say what to roll back: --app <name> for one app (${apps.join(', ') || 'none has an earlier release'}), ` +\n\t\t\t\t`or --atomic for every app of \"${stage}\" together.`,\n\t\t);\n\t\tthis.name = 'RollbackNeedsApp';\n\t}\n}\n\n/** An app has no release before the one it runs. */\nexport class NothingToRollBack extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly app: string,\n\t) {\n\t\tsuper(\n\t\t\t`\"${app}\" has no earlier release on \"${stage}\" to roll back to: it has been released once, ` +\n\t\t\t\t'or every earlier release was itself rolled back. Deploy the version you want instead.',\n\t\t);\n\t\tthis.name = 'NothingToRollBack';\n\t}\n}\n\n/** The stage was never deployed through Dokploy from this state. */\nexport class StageNeverDeployed extends GkmError {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`\"${stage}\" has no deploy state, so there is nothing to roll back. ` +\n\t\t\t\t'Check the stage name, and that `state` in gkm.config.ts points at the store the deploys write to.',\n\t\t);\n\t\tthis.name = 'StageNeverDeployed';\n\t}\n}\n\n/**\n * Roll a stage's app — or, `atomic`, all of them — back to its previous\n * release, holding the stage's lock as a deploy does.\n */\nexport async function rollbackStage(\n\tinput: RollbackInput,\n): Promise<RolledBack[]> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst log = input.log ?? (() => {});\n\tconst credentials = input.credentials ?? storedCredentials();\n\tconst sandbox =\n\t\tinput.sandbox ??\n\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\n\treturn withSandbox(sandbox, async () => {\n\t\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\t\tsandbox,\n\t\t});\n\t\tassertDeployedStage(workspace.stages, input.stage);\n\t\tassertStateOutlivesRun(workspace, input.stage, 'deploy:rollback');\n\n\t\tconst store = await createStateStore({\n\t\t\tconfig: workspace.state,\n\t\t\tworkspaceRoot: workspace.root,\n\t\t\tworkspaceName: workspace.name,\n\t\t});\n\t\tif (!(await store.read(input.stage))) {\n\t\t\tthrow new StageNeverDeployed(input.stage);\n\t\t}\n\n\t\tconst lock = await store.lock(input.stage, { operation: 'rollback' });\n\t\ttry {\n\t\t\tconst journal = await DeployJournal.open(\n\t\t\t\tstore,\n\t\t\t\tinput.stage,\n\t\t\t\t() => createEmptyState(input.stage, '', ''),\n\t\t\t\tasDokployState,\n\t\t\t);\n\t\t\tconst { state } = journal;\n\t\t\tconst releases = state.releases ?? {};\n\t\t\tconst restorable = Object.keys(releases).filter(\n\t\t\t\t(app) => releases[app]!.previous,\n\t\t\t);\n\n\t\t\tlet apps: string[];\n\t\t\tif (input.atomic) {\n\t\t\t\tapps = restorable;\n\t\t\t\tif (apps.length === 0) {\n\t\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t\t}\n\t\t\t} else if (input.app) {\n\t\t\t\tif (!releases[input.app]?.previous) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, input.app);\n\t\t\t\t}\n\t\t\t\tapps = [input.app];\n\t\t\t} else {\n\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t}\n\n\t\t\tconst { api } = await dokployApi(workspace, { credentials, signal });\n\t\t\tconst verify = verifySettings(workspace.deploy.dokploy?.verify);\n\t\t\tconst rolled: RolledBack[] = [];\n\n\t\t\tfor (const app of apps) {\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t\tconst { current, previous } = releases[app]!;\n\t\t\t\tconst applicationId = state.applications[app];\n\t\t\t\tif (!previous || !applicationId) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, app);\n\t\t\t\t}\n\n\t\t\t\tlog(`⏪ ${app}: ${current.ref} → ${previous.ref}`);\n\t\t\t\tawait restoreImage(api, {\n\t\t\t\t\tapplicationId,\n\t\t\t\t\timage: previous,\n\t\t\t\t\tregistryId: state.registryId,\n\t\t\t\t\tverify,\n\t\t\t\t\tsignal,\n\t\t\t\t});\n\t\t\t\trecordRollback(state, app, previous);\n\t\t\t\tawait journal.save();\n\t\t\t\tlog(`   ✓ ${app} is running ${previous.ref}`);\n\t\t\t\trolled.push({ app, from: current, to: previous });\n\t\t\t}\n\n\t\t\treturn rolled;\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgEA,IAAa,mBAAb,cAAsCA,eAAAA,SAAS;CAEpC;CAEA;CAHV,YACC,OAEA,MACC;EACD,MACC,oDAAoD,KAAK,KAAK,IAAI,KAAK,8BAA8B,mCACnE,MAAM,YACzC;EAPS,KAAA,QAAA;EAEA,KAAA,OAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuCA,eAAAA,SAAS;CAErC;CACA;CAFV,YACC,OACA,KACC;EACD,MACC,IAAI,IAAI,+BAA+B,MAAM,oIAE9C;EANS,KAAA,QAAA;EACA,KAAA,MAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwCA,eAAAA,SAAS;CAC3B;CAArB,YAAY,OAAwB;EACnC,MACC,IAAI,MAAM,6JAEX;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,eAAsB,cACrB,OACwB;CACxB,MAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CACrD,MAAM,MAAM,MAAM,cAAc,CAAC;CACjC,MAAM,cAAc,MAAM,eAAeC,oBAAAA,kBAAkB;CAC3D,MAAM,UACL,MAAM,WACN,IAAIC,cAAAA,aAAa,EAAE,MAAMC,eAAAA,mBAAAA,GAAkBC,UAAAA,QAAAA,CAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;CAEjE,OAAOC,gBAAAA,YAAY,SAAS,YAAY;EACvC,MAAM,EAAE,cAAc,MAAMC,eAAAA,qBAAAA,GAAoBF,UAAAA,QAAAA,CAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;EACD,kBAAA,oBAAoB,UAAU,QAAQ,MAAM,KAAK;EACjD,cAAA,uBAAuB,WAAW,MAAM,OAAO,iBAAiB;EAEhE,MAAM,QAAQ,MAAMG,cAAAA,iBAAiB;GACpC,QAAQ,UAAU;GAClB,eAAe,UAAU;GACzB,eAAe,UAAU;EAC1B,CAAC;EACD,IAAI,CAAE,MAAM,MAAM,KAAK,MAAM,KAAK,GACjC,MAAM,IAAI,mBAAmB,MAAM,KAAK;EAGzC,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,EAAE,WAAW,WAAW,CAAC;EACpE,IAAI;GACH,MAAM,UAAU,MAAMC,cAAAA,cAAc,KACnC,OACA,MAAM,aACAC,cAAAA,iBAAiB,MAAM,OAAO,IAAI,EAAE,GAC1CC,cAAAA,cACD;GACA,MAAM,EAAE,UAAU;GAClB,MAAM,WAAW,MAAM,YAAY,CAAC;GACpC,MAAM,aAAa,OAAO,KAAK,QAAQ,CAAC,CAAC,QACvC,QAAQ,SAAS,IAAI,CAAE,QACzB;GAEA,IAAI;GACJ,IAAI,MAAM,QAAQ;IACjB,OAAO;IACP,IAAI,KAAK,WAAW,GACnB,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAEpD,OAAO,IAAI,MAAM,KAAK;IACrB,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,UACzB,MAAM,IAAI,kBAAkB,MAAM,OAAO,MAAM,GAAG;IAEnD,OAAO,CAAC,MAAM,GAAG;GAClB,OACC,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAGnD,MAAM,EAAE,QAAQ,MAAMC,eAAAA,WAAW,WAAW;IAAE;IAAa;GAAO,CAAC;GACnE,MAAM,SAASC,eAAAA,eAAe,UAAU,OAAO,SAAS,MAAM;GAC9D,MAAM,SAAuB,CAAC;GAE9B,KAAK,MAAM,OAAO,MAAM;IACvB,OAAO,eAAe;IACtB,MAAM,EAAE,SAAS,aAAa,SAAS;IACvC,MAAM,gBAAgB,MAAM,aAAa;IACzC,IAAI,CAAC,YAAY,CAAC,eACjB,MAAM,IAAI,kBAAkB,MAAM,OAAO,GAAG;IAG7C,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,SAAS,KAAK;IAChD,MAAMC,eAAAA,aAAa,KAAK;KACvB;KACA,OAAO;KACP,YAAY,MAAM;KAClB;KACA;IACD,CAAC;IACD,cAAA,eAAe,OAAO,KAAK,QAAQ;IACnC,MAAM,QAAQ,KAAK;IACnB,IAAI,QAAQ,IAAI,cAAc,SAAS,KAAK;IAC5C,OAAO,KAAK;KAAE;KAAK,MAAM;KAAS,IAAI;IAAS,CAAC;GACjD;GAEA,OAAO;EACR,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD,CAAC;AACF"}

package/dist/{rollback-CFrNLmxs.mjs → rollback-Drbg0OeR.mjs}

@@ -1,11 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { r as storedCredentials } from "./credentials-CnVqoXMb.mjs";
-import { c as withSandbox } from "./sandbox-Dm247NGx.mjs";
-import { N as assertDeployedStage } from "./workspace-CJ0lKFq-.mjs";
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { r as storedCredentials } from "./credentials-C4KII3PD.mjs";
+import { c as withSandbox } from "./sandbox-CbVB7uOD.mjs";
+import { N as assertDeployedStage } from "./workspace-Bzw7Zs82.mjs";
 import { findWorkspaceRoot, loadWorkspaceConfig } from "./config.mjs";
-import { T as createEmptyState, U as createStateStore, k as recordRollback, s as DeployJournal } from "./seeds-odfgSCmu.mjs";
-import { t as LocalSandbox } from "./local-IuoIF3CT.mjs";
-import { i as dokployApi, l as restoreImage, p as verifySettings } from "./engine-2h4k5ICq.mjs";
+import { M as asDokployState, P as createEmptyState, Q as assertStateOutlivesRun, R as recordRollback, et as createStateStore, u as DeployJournal } from "./seeds-BSL55F6q.mjs";
+import { t as LocalSandbox } from "./local-Otp74ak0.mjs";
+import { i as dokployApi, l as restoreImage, p as verifySettings } from "./engine-DjEcovm-.mjs";
 import { resolve } from "node:path";
 //#region src/target/dokploy/rollback.ts
 /**
@@ -30,7 +31,7 @@ var rollback_exports = /* @__PURE__ */ __exportAll({
 	rollbackStage: () => rollbackStage
 });
 /** Neither an app nor every app was asked for. */
-var RollbackNeedsApp = class extends Error {
+var RollbackNeedsApp = class extends GkmError {
 	stage;
 	apps;
 	constructor(stage, apps) {
@@ -41,7 +42,7 @@ var RollbackNeedsApp = class extends Error {
 	}
 };
 /** An app has no release before the one it runs. */
-var NothingToRollBack = class extends Error {
+var NothingToRollBack = class extends GkmError {
 	stage;
 	app;
 	constructor(stage, app) {
@@ -52,7 +53,7 @@ var NothingToRollBack = class extends Error {
 	}
 };
 /** The stage was never deployed through Dokploy from this state. */
-var StageNeverDeployed = class extends Error {
+var StageNeverDeployed = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`"${stage}" has no deploy state, so there is nothing to roll back. Check the stage name, and that \`state\` in gkm.config.ts points at the store the deploys write to.`);
@@ -72,6 +73,7 @@ async function rollbackStage(input) {
 	return withSandbox(sandbox, async () => {
 		const { workspace } = await loadWorkspaceConfig(resolve(input.cwd), { sandbox });
 		assertDeployedStage(workspace.stages, input.stage);
+		assertStateOutlivesRun(workspace, input.stage, "deploy:rollback");
 		const store = await createStateStore({
 			config: workspace.state,
 			workspaceRoot: workspace.root,
@@ -80,7 +82,7 @@ async function rollbackStage(input) {
 		if (!await store.read(input.stage)) throw new StageNeverDeployed(input.stage);
 		const lock = await store.lock(input.stage, { operation: "rollback" });
 		try {
-			const journal = await DeployJournal.open(store, input.stage, () => createEmptyState(input.stage, "", ""));
+			const journal = await DeployJournal.open(store, input.stage, () => createEmptyState(input.stage, "", ""), asDokployState);
 			const { state } = journal;
 			const releases = state.releases ?? {};
 			const restorable = Object.keys(releases).filter((app) => releases[app].previous);
@@ -129,4 +131,4 @@ async function rollbackStage(input) {
 //#endregion
 export { rollback_exports as a, rollbackStage as i, RollbackNeedsApp as n, StageNeverDeployed as r, NothingToRollBack as t };
 
-//# sourceMappingURL=rollback-CFrNLmxs.mjs.map
+//# sourceMappingURL=rollback-Drbg0OeR.mjs.map

package/dist/rollback-Drbg0OeR.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback-Drbg0OeR.mjs","names":[],"sources":["../src/target/dokploy/rollback.ts"],"sourcesContent":["/**\n * `gkm deploy:rollback`: a stage's apps put back on the release before the\n * one they run, by hand — for a release that passed its checks and turned out\n * wrong anyway.\n *\n * One app by default, because an app is what usually broke: rolling the API\n * back over a site fix that shipped beside it undoes the fix too. `atomic`\n * rolls back every app that has a release to go back to, for apps that only\n * work together — an API and the site built against its newer contract.\n *\n * It restores images and nothing else. The environment an app runs with is\n * the stage's, resolved on every deploy, and migrations are forward-only: a\n * migration that the older code cannot run against is undone by a new\n * migration, never by a rollback.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../../config';\nimport {\n\ttype CredentialProvider,\n\tstoredCredentials,\n} from '../../deploy/credentials';\nimport { DeployJournal } from '../../deploy/journal';\nimport {\n\tassertStateOutlivesRun,\n\tcreateStateStore,\n} from '../../deploy/StateStore';\nimport {\n\tasDokployState,\n\tcreateEmptyState,\n\ttype ReleasedImage,\n\trecordRollback,\n} from '../../deploy/state';\nimport { GkmError } from '../../errors';\nimport { LocalSandbox } from '../../sandbox/local';\nimport { type Sandbox, withSandbox } from '../../sandbox/sandbox';\nimport { assertDeployedStage } from '../../workspace/stages';\nimport { dokployApi, restoreImage, verifySettings } from './engine';\n\nexport interface RollbackInput {\n\t/** The project: the directory holding `gkm.config.ts`, or one inside it. */\n\tcwd: string;\n\tstage: string;\n\t/** The app to roll back. */\n\tapp?: string;\n\t/** Every app with an earlier release, instead of one. */\n\tatomic?: boolean;\n\t/** Defaults to the environment, then the logins `gkm login` stored. */\n\tcredentials?: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Each progress line. Defaults to none. */\n\tlog?: (line: string) => void;\n\t/** Where the config is loaded. Defaults to a `LocalSandbox` on the project. */\n\tsandbox?: Sandbox;\n}\n\n/** One app rolled back. */\nexport interface RolledBack {\n\tapp: string;\n\tfrom: ReleasedImage;\n\tto: ReleasedImage;\n}\n\n/** Neither an app nor every app was asked for. */\nexport class RollbackNeedsApp extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** The apps that have a release to go back to. */\n\t\treadonly apps: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Say what to roll back: --app <name> for one app (${apps.join(', ') || 'none has an earlier release'}), ` +\n\t\t\t\t`or --atomic for every app of \"${stage}\" together.`,\n\t\t);\n\t\tthis.name = 'RollbackNeedsApp';\n\t}\n}\n\n/** An app has no release before the one it runs. */\nexport class NothingToRollBack extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly app: string,\n\t) {\n\t\tsuper(\n\t\t\t`\"${app}\" has no earlier release on \"${stage}\" to roll back to: it has been released once, ` +\n\t\t\t\t'or every earlier release was itself rolled back. Deploy the version you want instead.',\n\t\t);\n\t\tthis.name = 'NothingToRollBack';\n\t}\n}\n\n/** The stage was never deployed through Dokploy from this state. */\nexport class StageNeverDeployed extends GkmError {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`\"${stage}\" has no deploy state, so there is nothing to roll back. ` +\n\t\t\t\t'Check the stage name, and that `state` in gkm.config.ts points at the store the deploys write to.',\n\t\t);\n\t\tthis.name = 'StageNeverDeployed';\n\t}\n}\n\n/**\n * Roll a stage's app — or, `atomic`, all of them — back to its previous\n * release, holding the stage's lock as a deploy does.\n */\nexport async function rollbackStage(\n\tinput: RollbackInput,\n): Promise<RolledBack[]> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst log = input.log ?? (() => {});\n\tconst credentials = input.credentials ?? storedCredentials();\n\tconst sandbox =\n\t\tinput.sandbox ??\n\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\n\treturn withSandbox(sandbox, async () => {\n\t\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\t\tsandbox,\n\t\t});\n\t\tassertDeployedStage(workspace.stages, input.stage);\n\t\tassertStateOutlivesRun(workspace, input.stage, 'deploy:rollback');\n\n\t\tconst store = await createStateStore({\n\t\t\tconfig: workspace.state,\n\t\t\tworkspaceRoot: workspace.root,\n\t\t\tworkspaceName: workspace.name,\n\t\t});\n\t\tif (!(await store.read(input.stage))) {\n\t\t\tthrow new StageNeverDeployed(input.stage);\n\t\t}\n\n\t\tconst lock = await store.lock(input.stage, { operation: 'rollback' });\n\t\ttry {\n\t\t\tconst journal = await DeployJournal.open(\n\t\t\t\tstore,\n\t\t\t\tinput.stage,\n\t\t\t\t() => createEmptyState(input.stage, '', ''),\n\t\t\t\tasDokployState,\n\t\t\t);\n\t\t\tconst { state } = journal;\n\t\t\tconst releases = state.releases ?? {};\n\t\t\tconst restorable = Object.keys(releases).filter(\n\t\t\t\t(app) => releases[app]!.previous,\n\t\t\t);\n\n\t\t\tlet apps: string[];\n\t\t\tif (input.atomic) {\n\t\t\t\tapps = restorable;\n\t\t\t\tif (apps.length === 0) {\n\t\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t\t}\n\t\t\t} else if (input.app) {\n\t\t\t\tif (!releases[input.app]?.previous) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, input.app);\n\t\t\t\t}\n\t\t\t\tapps = [input.app];\n\t\t\t} else {\n\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t}\n\n\t\t\tconst { api } = await dokployApi(workspace, { credentials, signal });\n\t\t\tconst verify = verifySettings(workspace.deploy.dokploy?.verify);\n\t\t\tconst rolled: RolledBack[] = [];\n\n\t\t\tfor (const app of apps) {\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t\tconst { current, previous } = releases[app]!;\n\t\t\t\tconst applicationId = state.applications[app];\n\t\t\t\tif (!previous || !applicationId) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, app);\n\t\t\t\t}\n\n\t\t\t\tlog(`⏪ ${app}: ${current.ref} → ${previous.ref}`);\n\t\t\t\tawait restoreImage(api, {\n\t\t\t\t\tapplicationId,\n\t\t\t\t\timage: previous,\n\t\t\t\t\tregistryId: state.registryId,\n\t\t\t\t\tverify,\n\t\t\t\t\tsignal,\n\t\t\t\t});\n\t\t\t\trecordRollback(state, app, previous);\n\t\t\t\tawait journal.save();\n\t\t\t\tlog(`   ✓ ${app} is running ${previous.ref}`);\n\t\t\t\trolled.push({ app, from: current, to: previous });\n\t\t\t}\n\n\t\t\treturn rolled;\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgEA,IAAa,mBAAb,cAAsC,SAAS;CAEpC;CAEA;CAHV,YACC,OAEA,MACC;EACD,MACC,oDAAoD,KAAK,KAAK,IAAI,KAAK,8BAA8B,mCACnE,MAAM,YACzC;EAPS,KAAA,QAAA;EAEA,KAAA,OAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,SAAS;CAErC;CACA;CAFV,YACC,OACA,KACC;EACD,MACC,IAAI,IAAI,+BAA+B,MAAM,oIAE9C;EANS,KAAA,QAAA;EACA,KAAA,MAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,SAAS;CAC3B;CAArB,YAAY,OAAwB;EACnC,MACC,IAAI,MAAM,6JAEX;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,eAAsB,cACrB,OACwB;CACxB,MAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CACrD,MAAM,MAAM,MAAM,cAAc,CAAC;CACjC,MAAM,cAAc,MAAM,eAAe,kBAAkB;CAC3D,MAAM,UACL,MAAM,WACN,IAAI,aAAa,EAAE,MAAM,kBAAkB,QAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;CAEjE,OAAO,YAAY,SAAS,YAAY;EACvC,MAAM,EAAE,cAAc,MAAM,oBAAoB,QAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;EACD,oBAAoB,UAAU,QAAQ,MAAM,KAAK;EACjD,uBAAuB,WAAW,MAAM,OAAO,iBAAiB;EAEhE,MAAM,QAAQ,MAAM,iBAAiB;GACpC,QAAQ,UAAU;GAClB,eAAe,UAAU;GACzB,eAAe,UAAU;EAC1B,CAAC;EACD,IAAI,CAAE,MAAM,MAAM,KAAK,MAAM,KAAK,GACjC,MAAM,IAAI,mBAAmB,MAAM,KAAK;EAGzC,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,EAAE,WAAW,WAAW,CAAC;EACpE,IAAI;GACH,MAAM,UAAU,MAAM,cAAc,KACnC,OACA,MAAM,aACA,iBAAiB,MAAM,OAAO,IAAI,EAAE,GAC1C,cACD;GACA,MAAM,EAAE,UAAU;GAClB,MAAM,WAAW,MAAM,YAAY,CAAC;GACpC,MAAM,aAAa,OAAO,KAAK,QAAQ,CAAC,CAAC,QACvC,QAAQ,SAAS,IAAI,CAAE,QACzB;GAEA,IAAI;GACJ,IAAI,MAAM,QAAQ;IACjB,OAAO;IACP,IAAI,KAAK,WAAW,GACnB,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAEpD,OAAO,IAAI,MAAM,KAAK;IACrB,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,UACzB,MAAM,IAAI,kBAAkB,MAAM,OAAO,MAAM,GAAG;IAEnD,OAAO,CAAC,MAAM,GAAG;GAClB,OACC,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAGnD,MAAM,EAAE,QAAQ,MAAM,WAAW,WAAW;IAAE;IAAa;GAAO,CAAC;GACnE,MAAM,SAAS,eAAe,UAAU,OAAO,SAAS,MAAM;GAC9D,MAAM,SAAuB,CAAC;GAE9B,KAAK,MAAM,OAAO,MAAM;IACvB,OAAO,eAAe;IACtB,MAAM,EAAE,SAAS,aAAa,SAAS;IACvC,MAAM,gBAAgB,MAAM,aAAa;IACzC,IAAI,CAAC,YAAY,CAAC,eACjB,MAAM,IAAI,kBAAkB,MAAM,OAAO,GAAG;IAG7C,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,SAAS,KAAK;IAChD,MAAM,aAAa,KAAK;KACvB;KACA,OAAO;KACP,YAAY,MAAM;KAClB;KACA;IACD,CAAC;IACD,eAAe,OAAO,KAAK,QAAQ;IACnC,MAAM,QAAQ,KAAK;IACnB,IAAI,QAAQ,IAAI,cAAc,SAAS,KAAK;IAC5C,OAAO,KAAK;KAAE;KAAK,MAAM;KAAS,IAAI;IAAS,CAAC;GACjD;GAEA,OAAO;EACR,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD,CAAC;AACF"}

package/dist/{runtime-CN_kmqxo.d.cts → runtime-D_J3ExJn.d.cts}

@@ -1,7 +1,7 @@
-import { K as DeployRuntime, et as TargetOptionsIssue } from "./types-NqX1Hz4P.cjs";
+import { K as DeployRuntime, et as TargetOptionsIssue, jt as GkmError } from "./types-BibpiHKB.cjs";
 //#region src/target/builtins.d.ts
 /** A target name that is neither built in nor in `deploy.targets`. */
-declare class UnknownDeployTarget extends Error {
+declare class UnknownDeployTarget extends GkmError {
   readonly target: string;
   /** The names that would have resolved. */
   readonly known: readonly string[];
@@ -10,7 +10,7 @@ declare class UnknownDeployTarget extends Error {
   known: readonly string[]);
 }
 /** A built-in target `gkm deploy` cannot deploy through yet. */
-declare class DeployTargetNotYetSupported extends Error {
+declare class DeployTargetNotYetSupported extends GkmError {
   readonly target: string;
   /** What to do instead, when there is something. */
   readonly instead?: string | undefined;
@@ -21,7 +21,7 @@ declare class DeployTargetNotYetSupported extends Error {
 //#endregion
 //#region src/target/package.d.ts
 /** A target package the project does not have installed. */
-declare class TargetPackageNotFound extends Error {
+declare class TargetPackageNotFound extends GkmError {
   readonly target: string;
   readonly packageName: string;
   readonly from: string;
@@ -29,16 +29,8 @@ declare class TargetPackageNotFound extends Error {
 }
 //#endregion
 //#region src/target/provider.d.ts
-/**
- * `gkm deploy --provider`, from before there were targets.
- *
- * It named three things, and only one of them ever deployed a workspace:
- * `dokploy` is now the target of that name; `docker` and `aws-lambda` were
- * accepted and always failed, so they are gone with a pointer to what does
- * the job.
- */
 /** A `--provider` that no longer exists. */
-declare class ProviderRemoved extends Error {
+declare class ProviderRemoved extends GkmError {
   readonly provider: string;
   /** What to use instead. */
   readonly instead: string;
@@ -49,18 +41,18 @@ declare class ProviderRemoved extends Error {
 //#endregion
 //#region src/target/resolve.d.ts
 /** A target package whose default export is not a target. */
-declare class TargetPackageInvalid extends Error {
+declare class TargetPackageInvalid extends GkmError {
   readonly target: string;
   readonly packageName: string;
   constructor(target: string, packageName: string);
 }
 /** A `deploy.targets` entry that is not a target, a package name or a pair. */
-declare class TargetEntryInvalid extends Error {
+declare class TargetEntryInvalid extends GkmError {
   readonly target: string;
   constructor(target: string);
 }
 /** A target whose `runtime` is not the one its package declares. */
-declare class TargetRuntimeMismatch extends Error {
+declare class TargetRuntimeMismatch extends GkmError {
   readonly target: string;
   readonly packageName: string;
   readonly declared: DeployRuntime;
@@ -68,7 +60,7 @@ declare class TargetRuntimeMismatch extends Error {
   constructor(target: string, packageName: string, declared: DeployRuntime, actual: DeployRuntime);
 }
 /** Options a target's schema rejected. */
-declare class InvalidTargetOptions extends Error {
+declare class InvalidTargetOptions extends GkmError {
   readonly target: string;
   readonly issues: readonly TargetOptionsIssue[];
   constructor(target: string, issues: readonly TargetOptionsIssue[]);
@@ -76,7 +68,7 @@ declare class InvalidTargetOptions extends Error {
 //#endregion
 //#region src/target/runtime.d.ts
 /** A target package whose `package.json` does not say where it runs. */
-declare class TargetRuntimeUndeclared extends Error {
+declare class TargetRuntimeUndeclared extends GkmError {
   readonly target: string;
   readonly packageName: string;
   /** What `gkm.runtime` held instead, when it held anything. */
@@ -87,4 +79,4 @@ declare class TargetRuntimeUndeclared extends Error {
 }
 //#endregion
 export { TargetRuntimeMismatch as a, DeployTargetNotYetSupported as c, TargetPackageInvalid as i, UnknownDeployTarget as l, InvalidTargetOptions as n, ProviderRemoved as o, TargetEntryInvalid as r, TargetPackageNotFound as s, TargetRuntimeUndeclared as t };
-//# sourceMappingURL=runtime-CN_kmqxo.d.cts.map
+//# sourceMappingURL=runtime-D_J3ExJn.d.cts.map

package/dist/runtime-D_J3ExJn.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-D_J3ExJn.d.cts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cAgEa,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}

package/dist/{runtime-Cjvon3oj.d.mts → runtime-_wEVtshH.d.mts}

@@ -1,7 +1,7 @@
-import { K as DeployRuntime, et as TargetOptionsIssue } from "./types-ZHuZ89hv.mjs";
+import { K as DeployRuntime, et as TargetOptionsIssue, jt as GkmError } from "./types-B6lmD3en.mjs";
 //#region src/target/builtins.d.ts
 /** A target name that is neither built in nor in `deploy.targets`. */
-declare class UnknownDeployTarget extends Error {
+declare class UnknownDeployTarget extends GkmError {
   readonly target: string;
   /** The names that would have resolved. */
   readonly known: readonly string[];
@@ -10,7 +10,7 @@ declare class UnknownDeployTarget extends Error {
   known: readonly string[]);
 }
 /** A built-in target `gkm deploy` cannot deploy through yet. */
-declare class DeployTargetNotYetSupported extends Error {
+declare class DeployTargetNotYetSupported extends GkmError {
   readonly target: string;
   /** What to do instead, when there is something. */
   readonly instead?: string | undefined;
@@ -21,7 +21,7 @@ declare class DeployTargetNotYetSupported extends Error {
 //#endregion
 //#region src/target/package.d.ts
 /** A target package the project does not have installed. */
-declare class TargetPackageNotFound extends Error {
+declare class TargetPackageNotFound extends GkmError {
   readonly target: string;
   readonly packageName: string;
   readonly from: string;
@@ -29,16 +29,8 @@ declare class TargetPackageNotFound extends Error {
 }
 //#endregion
 //#region src/target/provider.d.ts
-/**
- * `gkm deploy --provider`, from before there were targets.
- *
- * It named three things, and only one of them ever deployed a workspace:
- * `dokploy` is now the target of that name; `docker` and `aws-lambda` were
- * accepted and always failed, so they are gone with a pointer to what does
- * the job.
- */
 /** A `--provider` that no longer exists. */
-declare class ProviderRemoved extends Error {
+declare class ProviderRemoved extends GkmError {
   readonly provider: string;
   /** What to use instead. */
   readonly instead: string;
@@ -49,18 +41,18 @@ declare class ProviderRemoved extends Error {
 //#endregion
 //#region src/target/resolve.d.ts
 /** A target package whose default export is not a target. */
-declare class TargetPackageInvalid extends Error {
+declare class TargetPackageInvalid extends GkmError {
   readonly target: string;
   readonly packageName: string;
   constructor(target: string, packageName: string);
 }
 /** A `deploy.targets` entry that is not a target, a package name or a pair. */
-declare class TargetEntryInvalid extends Error {
+declare class TargetEntryInvalid extends GkmError {
   readonly target: string;
   constructor(target: string);
 }
 /** A target whose `runtime` is not the one its package declares. */
-declare class TargetRuntimeMismatch extends Error {
+declare class TargetRuntimeMismatch extends GkmError {
   readonly target: string;
   readonly packageName: string;
   readonly declared: DeployRuntime;
@@ -68,7 +60,7 @@ declare class TargetRuntimeMismatch extends Error {
   constructor(target: string, packageName: string, declared: DeployRuntime, actual: DeployRuntime);
 }
 /** Options a target's schema rejected. */
-declare class InvalidTargetOptions extends Error {
+declare class InvalidTargetOptions extends GkmError {
   readonly target: string;
   readonly issues: readonly TargetOptionsIssue[];
   constructor(target: string, issues: readonly TargetOptionsIssue[]);
@@ -76,7 +68,7 @@ declare class InvalidTargetOptions extends Error {
 //#endregion
 //#region src/target/runtime.d.ts
 /** A target package whose `package.json` does not say where it runs. */
-declare class TargetRuntimeUndeclared extends Error {
+declare class TargetRuntimeUndeclared extends GkmError {
   readonly target: string;
   readonly packageName: string;
   /** What `gkm.runtime` held instead, when it held anything. */
@@ -87,4 +79,4 @@ declare class TargetRuntimeUndeclared extends Error {
 }
 //#endregion
 export { TargetRuntimeMismatch as a, DeployTargetNotYetSupported as c, TargetPackageInvalid as i, UnknownDeployTarget as l, InvalidTargetOptions as n, ProviderRemoved as o, TargetEntryInvalid as r, TargetPackageNotFound as s, TargetRuntimeUndeclared as t };
-//# sourceMappingURL=runtime-Cjvon3oj.d.mts.map
+//# sourceMappingURL=runtime-_wEVtshH.d.mts.map

package/dist/runtime-_wEVtshH.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-_wEVtshH.d.mts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cAgEa,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}

package/dist/sandbox/credentials-worker.cjs

@@ -1,7 +1,7 @@
-const require_discover = require("../discover-D1It5r_h.cjs");
-const require_sandbox = require("../sandbox-CL--ZDui.cjs");
+const require_discover = require("../discover-DPgu-ScS.cjs");
+const require_sandbox = require("../sandbox-CHv3OYXg.cjs");
 const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
-const require_credentialSchemas = require("../credentialSchemas-DCR4Wd1W.cjs");
+const require_credentialSchemas = require("../credentialSchemas-CAPKFkrG.cjs");
 let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
 //#region src/sandbox/credentials-worker.ts

package/dist/sandbox/credentials-worker.mjs

@@ -1,7 +1,7 @@
-import { r as discover } from "../discover-BPelzeGW.mjs";
-import { t as SECRETS_DIR_ENV } from "../sandbox-Dm247NGx.mjs";
+import { r as discover } from "../discover-qjFapetL.mjs";
+import { t as SECRETS_DIR_ENV } from "../sandbox-CbVB7uOD.mjs";
 import { a as registerAdjacentTsconfig, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
-import { a as liveCredentials, r as inspectLive } from "../credentialSchemas-BJqRJNK4.mjs";
+import { a as liveCredentials, r as inspectLive } from "../credentialSchemas-BJFvfkaz.mjs";
 import { join } from "node:path";
 import { readFile, readdir } from "node:fs/promises";
 //#region src/sandbox/credentials-worker.ts

package/dist/sandbox/discover-worker.cjs

@@ -1,4 +1,4 @@
-const require_discover = require("../discover-D1It5r_h.cjs");
+const require_discover = require("../discover-DPgu-ScS.cjs");
 const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
 //#region src/sandbox/discover-worker.ts
 /**

package/dist/sandbox/discover-worker.mjs

@@ -1,4 +1,4 @@
-import { r as discover } from "../discover-BPelzeGW.mjs";
+import { r as discover } from "../discover-qjFapetL.mjs";
 import { a as registerAdjacentTsconfig, i as liveValuePaths, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
 //#region src/sandbox/discover-worker.ts
 /**

package/dist/sandbox/migrate-worker.cjs

@@ -1,7 +1,7 @@
-const require_discover = require("../discover-D1It5r_h.cjs");
-const require_sandbox = require("../sandbox-CL--ZDui.cjs");
+const require_discover = require("../discover-DPgu-ScS.cjs");
+const require_sandbox = require("../sandbox-CHv3OYXg.cjs");
 const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
-const require_databases = require("../databases-BY-pEImp.cjs");
+const require_databases = require("../databases-DGALFDG3.cjs");
 let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
 //#region src/sandbox/migrate-worker.ts

package/dist/sandbox/migrate-worker.mjs

@@ -1,7 +1,7 @@
-import { r as discover } from "../discover-BPelzeGW.mjs";
-import { t as SECRETS_DIR_ENV } from "../sandbox-Dm247NGx.mjs";
+import { r as discover } from "../discover-qjFapetL.mjs";
+import { t as SECRETS_DIR_ENV } from "../sandbox-CbVB7uOD.mjs";
 import { a as registerAdjacentTsconfig, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
-import { o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "../databases-CzszQV0N.mjs";
+import { o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "../databases-BeGP5eDh.mjs";
 import { join } from "node:path";
 import { readFile, readdir } from "node:fs/promises";
 //#region src/sandbox/migrate-worker.ts

package/dist/{sandbox-CL--ZDui.cjs → sandbox-CHv3OYXg.cjs}

@@ -1,3 +1,4 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_async_hooks = require("node:async_hooks");
@@ -28,7 +29,7 @@ let node_async_hooks = require("node:async_hooks");
 /** The variable naming the directory a command's secrets are mounted in. */
 const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
 /** A command was asked to run outside the project. */
-var SandboxCwdEscape = class extends Error {
+var SandboxCwdEscape = class extends require_errors.GkmError {
 	cwd;
 	root;
 	constructor(cwd, root) {
@@ -57,7 +58,7 @@ function confineCwd(root, cwd) {
 	return absolute;
 }
 /** A secret's file name: one path segment, so it cannot be written elsewhere. */
-var SecretNameInvalid = class extends Error {
+var SecretNameInvalid = class extends require_errors.GkmError {
 	secretName;
 	constructor(secretName) {
 		super(`'${secretName}' cannot be a secret's name: it becomes a file name in the secrets directory, so it must be one segment of letters, digits, '.', '-' or '_' and not start with '.'.`);
@@ -161,4 +162,4 @@ Object.defineProperty(exports, "withSandbox", {
 	}
 });
 
-//# sourceMappingURL=sandbox-CL--ZDui.cjs.map
+//# sourceMappingURL=sandbox-CHv3OYXg.cjs.map

package/dist/sandbox-CHv3OYXg.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-CHv3OYXg.cjs","names":["GkmError","existsSync","realpathSync","resolve","relative","sep","isAbsolute","AsyncLocalStorage"],"sources":["../src/sandbox/sandbox.ts"],"sourcesContent":["/**\n * Where a deploy runs the project's own code.\n *\n * A deploy holds credentials — Dokploy's token, a registry login, an AWS key —\n * and loading `gkm.config.ts`, sniffing an app's environment and building it\n * all execute code from the repository being deployed. On a developer's own\n * laptop that is the developer's code. On a CI job for a fork, or a shared\n * build runner, it is not, and that code should not be able to read the\n * credentials used to deploy it, hang the deploy, or reach outside the\n * checkout.\n *\n * So every step that runs project code goes through a `Sandbox`: one call,\n * with an argument array rather than a shell line, the complete environment\n * the step needs rather than the host's, a timeout it cannot outlive, secrets\n * as files rather than variables, and a working directory inside the project.\n * The steps that need credentials — provisioning, pushing, releasing — are\n * the deploy's own code and never run in one.\n *\n * `LocalSandbox` is the default: a child process on this machine with an\n * allowlisted environment. A host that builds repositories it does not trust\n * passes its own — a container per build, a VM — through `deploy()`'s\n * `sandbox`.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { existsSync, realpathSync } from 'node:fs';\nimport { isAbsolute, relative, resolve, sep } from 'node:path';\nimport { GkmError } from '../errors';\n\n/** Where a command's output goes. */\nexport type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';\n\nexport interface SandboxExecOptions {\n\t/**\n\t * Where the command runs: the project root or a directory below it, as an\n\t * absolute path or relative to the root. Anywhere else is refused with\n\t * {@link SandboxCwdEscape}.\n\t */\n\tcwd: string;\n\t/**\n\t * The command's whole environment. Nothing of the host's is added to it:\n\t * start from {@link Sandbox.env} and add what the step needs.\n\t */\n\tenv: Readonly<Record<string, string>>;\n\t/**\n\t * How long the command may run before it is killed. Required: a step that\n\t * waits forever — a sniffed entry that opens a server, a build stuck on a\n\t * prompt — would otherwise hold the deploy, and its lock, forever.\n\t */\n\ttimeoutMs: number;\n\t/**\n\t * Files the command can read, by name. Mounted in a directory of their own\n\t * — named by `GKM_SECRETS_DIR` in the command's environment — and removed\n\t * when it exits. Never set as variables, which every child inherits, a\n\t * crash report prints and `/proc/<pid>/environ` shows.\n\t */\n\tsecrets?: Readonly<Record<string, string>>;\n\t/**\n\t * `capture` (the default) returns stdout and stderr in the result;\n\t * `inherit` gives the command the host's terminal; `stderr` sends both\n\t * streams to the host's stderr; `ignore` discards them.\n\t */\n\toutput?: SandboxOutput;\n\t/** Kills the command when aborted; `exec` rejects with the signal's reason. */\n\tsignal?: AbortSignal;\n}\n\n/** How a command ended. A non-zero exit is a result, not an error. */\nexport interface SandboxResult {\n\texitCode: number | null;\n\tsignal: string | null;\n\t/** What it wrote to stdout, when its output was captured. */\n\tstdout: string;\n\t/** What it wrote to stderr, when its output was captured. */\n\tstderr: string;\n}\n\n/**\n * Runs a command against the project, and nothing else of the host's.\n *\n * `exec` resolves with the result however the command exited. It rejects\n * with {@link CommandTimedOut} once the timeout passes — after the command is\n * gone — with {@link SandboxCwdEscape} for a directory outside the project,\n * with the signal's reason when aborted, and with the spawn error when the\n * program cannot be started.\n */\nexport interface Sandbox {\n\t/** The project: the directory every command runs at or below. */\n\treadonly root: string;\n\t/**\n\t * Whether the code it runs is kept from the host: its files, its\n\t * processes, its memory.\n\t *\n\t * An isolating sandbox shares nothing but what crosses `exec`, so a config\n\t * reaches the deploy as data — a live object in it (a custom state store,\n\t * an inline target) cannot cross, and is refused with\n\t * `ConfigObjectNotSerializable`. A non-isolating one, like\n\t * {@link LocalSandbox}, runs on the host as the host's user; a project\n\t * whose config holds live objects is then loaded in-process as before,\n\t * because a project trusted to run there is trusted to do that.\n\t */\n\treadonly isolating: boolean;\n\t/**\n\t * The environment a command starts from: what any program needs to run\n\t * here — `PATH`, `HOME`, the locale — and no credential.\n\t */\n\treadonly env: Readonly<Record<string, string>>;\n\texec(\n\t\tcommand: string,\n\t\targs: readonly string[],\n\t\toptions: SandboxExecOptions,\n\t): Promise<SandboxResult>;\n}\n\n/** The variable naming the directory a command's secrets are mounted in. */\nexport const SECRETS_DIR_ENV = 'GKM_SECRETS_DIR';\n\n/** A command was asked to run outside the project. */\nexport class SandboxCwdEscape extends GkmError {\n\tconstructor(\n\t\treadonly cwd: string,\n\t\treadonly root: string,\n\t) {\n\t\tsuper(\n\t\t\t`Refusing to run in '${cwd}': it is outside the project at '${root}'. ` +\n\t\t\t\t'A sandboxed step only runs inside the project it was given — check ' +\n\t\t\t\t'the app paths in gkm.config.ts for `..` or an absolute path.',\n\t\t);\n\t\tthis.name = 'SandboxCwdEscape';\n\t}\n}\n\n/** A path with its symlinks resolved where it exists — `/tmp` is `/private/tmp`. */\nfunction real(path: string): string {\n\treturn existsSync(path) ? realpathSync(path) : path;\n}\n\n/**\n * `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.\n *\n * Symlinks are resolved on both sides first, so a link inside the project\n * that points out of it is an escape, and a project reached through a link\n * (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call\n * before it runs anything.\n */\nexport function confineCwd(root: string, cwd: string): string {\n\tconst absolute = resolve(root, cwd);\n\tconst from = relative(real(resolve(root)), real(absolute));\n\tif (from === '..' || from.startsWith(`..${sep}`) || isAbsolute(from)) {\n\t\tthrow new SandboxCwdEscape(cwd, root);\n\t}\n\treturn absolute;\n}\n\n/** A secret's file name: one path segment, so it cannot be written elsewhere. */\nexport class SecretNameInvalid extends GkmError {\n\tconstructor(readonly secretName: string) {\n\t\tsuper(\n\t\t\t`'${secretName}' cannot be a secret's name: it becomes a file name in ` +\n\t\t\t\t'the secrets directory, so it must be one segment of letters, digits, ' +\n\t\t\t\t\"'.', '-' or '_' and not start with '.'.\",\n\t\t);\n\t\tthis.name = 'SecretNameInvalid';\n\t}\n}\n\nconst SECRET_NAME = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;\n\n/** Every secret name, checked before anything is written. */\nexport function assertSecretNames(\n\tsecrets: Readonly<Record<string, string>> | undefined,\n): void {\n\tfor (const name of Object.keys(secrets ?? {})) {\n\t\tif (!SECRET_NAME.test(name)) throw new SecretNameInvalid(name);\n\t}\n}\n\n/** A run's sandbox, and what its workers already answered. */\ninterface SandboxRun {\n\tsandbox: Sandbox;\n\tanswers: Map<string, Promise<unknown>>;\n}\n\nconst active = new AsyncLocalStorage<SandboxRun>();\n\n/**\n * Run `fn` with `sandbox` as the one its steps use.\n *\n * Per run rather than global, as `withOutput` routes a run's lines: two\n * deploys in one host process each build in their own sandbox. A step deep in\n * the engine — discovering constructs, sniffing an app — asks\n * {@link activeSandbox} rather than every function between `deploy()` and it\n * taking one more parameter.\n */\nexport function withSandbox<T>(sandbox: Sandbox, fn: () => T): T {\n\treturn active.run({ sandbox, answers: new Map() }, fn);\n}\n\n/** The sandbox of the run this is part of, if it was started with one. */\nexport function activeSandbox(): Sandbox | undefined {\n\treturn active.getStore()?.sandbox;\n}\n\n/**\n * `ask()`'s answer, asked once per run.\n *\n * A deploy loads its config and discovers its constructs from several places\n * — the first load, the engine, the Dockerfile generator — and in a sandbox\n * each was a child process of its own, for the same answer: the checkout does\n * not change while it deploys. Within a run in `sandbox`, the first answer\n * for `key` is the one every later ask gets. Outside one, or for another\n * sandbox, `ask()` runs each time.\n */\nexport function oncePerRun<T>(\n\tsandbox: Sandbox,\n\tkey: string,\n\task: () => Promise<T>,\n): Promise<T> {\n\tconst run = active.getStore();\n\tif (!run || run.sandbox !== sandbox) return ask();\n\n\tlet answer = run.answers.get(key) as Promise<T> | undefined;\n\tif (!answer) {\n\t\tanswer = ask();\n\t\trun.answers.set(key, answer);\n\t\t// A failure is not remembered: the next ask tries again.\n\t\tanswer.catch(() => run.answers.delete(key));\n\t}\n\treturn answer;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmHA,MAAa,kBAAkB;;AAG/B,IAAa,mBAAb,cAAsCA,eAAAA,SAAS;CAEpC;CACA;CAFV,YACC,KACA,MACC;EACD,MACC,uBAAuB,IAAI,mCAAmC,KAAK,qIAGpE;EAPS,KAAA,MAAA;EACA,KAAA,OAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,KAAK,MAAsB;CACnC,QAAA,GAAOC,QAAAA,WAAAA,CAAW,IAAI,KAAA,GAAIC,QAAAA,aAAAA,CAAa,IAAI,IAAI;AAChD;;;;;;;;;AAUA,SAAgB,WAAW,MAAc,KAAqB;CAC7D,MAAM,YAAA,GAAWC,UAAAA,QAAAA,CAAQ,MAAM,GAAG;CAClC,MAAM,QAAA,GAAOC,UAAAA,SAAAA,CAAS,MAAA,GAAKD,UAAAA,QAAAA,CAAQ,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC;CACzD,IAAI,SAAS,QAAQ,KAAK,WAAW,KAAKE,UAAAA,KAAK,MAAA,GAAKC,UAAAA,WAAAA,CAAW,IAAI,GAClE,MAAM,IAAI,iBAAiB,KAAK,IAAI;CAErC,OAAO;AACR;;AAGA,IAAa,oBAAb,cAAuCN,eAAAA,SAAS;CAC1B;CAArB,YAAY,YAA6B;EACxC,MACC,IAAI,WAAW,oKAGhB;EALoB,KAAA,aAAA;EAMpB,KAAK,OAAO;CACb;AACD;AAEA,MAAM,cAAc;;AAGpB,SAAgB,kBACf,SACO;CACP,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,CAAC,CAAC,GAC3C,IAAI,CAAC,YAAY,KAAK,IAAI,GAAG,MAAM,IAAI,kBAAkB,IAAI;AAE/D;AAQA,MAAM,SAAS,IAAIO,iBAAAA,kBAA8B;;;;;;;;;;AAWjD,SAAgB,YAAe,SAAkB,IAAgB;CAChE,OAAO,OAAO,IAAI;EAAE;EAAS,yBAAS,IAAI,IAAI;CAAE,GAAG,EAAE;AACtD;;AAGA,SAAgB,gBAAqC;CACpD,OAAO,OAAO,SAAS,CAAC,EAAE;AAC3B;;;;;;;;;;;AAYA,SAAgB,WACf,SACA,KACA,KACa;CACb,MAAM,MAAM,OAAO,SAAS;CAC5B,IAAI,CAAC,OAAO,IAAI,YAAY,SAAS,OAAO,IAAI;CAEhD,IAAI,SAAS,IAAI,QAAQ,IAAI,GAAG;CAChC,IAAI,CAAC,QAAQ;EACZ,SAAS,IAAI;EACb,IAAI,QAAQ,IAAI,KAAK,MAAM;EAE3B,OAAO,YAAY,IAAI,QAAQ,OAAO,GAAG,CAAC;CAC3C;CACA,OAAO;AACR"}

package/dist/{sandbox-M8UnLhXE.d.cts → sandbox-CPJq1Kia.d.mts}

@@ -1,27 +1,5 @@
+import { jt as GkmError } from "./types-B6lmD3en.mjs";
 //#region src/sandbox/sandbox.d.ts
-/**
- * Where a deploy runs the project's own code.
- *
- * A deploy holds credentials — Dokploy's token, a registry login, an AWS key —
- * and loading `gkm.config.ts`, sniffing an app's environment and building it
- * all execute code from the repository being deployed. On a developer's own
- * laptop that is the developer's code. On a CI job for a fork, or a shared
- * build runner, it is not, and that code should not be able to read the
- * credentials used to deploy it, hang the deploy, or reach outside the
- * checkout.
- *
- * So every step that runs project code goes through a `Sandbox`: one call,
- * with an argument array rather than a shell line, the complete environment
- * the step needs rather than the host's, a timeout it cannot outlive, secrets
- * as files rather than variables, and a working directory inside the project.
- * The steps that need credentials — provisioning, pushing, releasing — are
- * the deploy's own code and never run in one.
- *
- * `LocalSandbox` is the default: a child process on this machine with an
- * allowlisted environment. A host that builds repositories it does not trust
- * passes its own — a container per build, a VM — through `deploy()`'s
- * `sandbox`.
- */
 /** Where a command's output goes. */
 type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
 interface SandboxExecOptions {
@@ -102,7 +80,7 @@ interface Sandbox {
 /** The variable naming the directory a command's secrets are mounted in. */
 declare const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
 /** A command was asked to run outside the project. */
-declare class SandboxCwdEscape extends Error {
+declare class SandboxCwdEscape extends GkmError {
   readonly cwd: string;
   readonly root: string;
   constructor(cwd: string, root: string);
@@ -117,10 +95,10 @@ declare class SandboxCwdEscape extends Error {
  */
 declare function confineCwd(root: string, cwd: string): string;
 /** A secret's file name: one path segment, so it cannot be written elsewhere. */
-declare class SecretNameInvalid extends Error {
+declare class SecretNameInvalid extends GkmError {
   readonly secretName: string;
   constructor(secretName: string);
 }
 //#endregion
 export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
-//# sourceMappingURL=sandbox-M8UnLhXE.d.cts.map
+//# sourceMappingURL=sandbox-CPJq1Kia.d.mts.map

package/dist/sandbox-CPJq1Kia.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-CPJq1Kia.d.mts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}

package/dist/{sandbox-Dm247NGx.mjs → sandbox-CbVB7uOD.mjs}

@@ -1,3 +1,4 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { isAbsolute, relative, resolve, sep } from "node:path";
 import { existsSync, realpathSync } from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -28,7 +29,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 /** The variable naming the directory a command's secrets are mounted in. */
 const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
 /** A command was asked to run outside the project. */
-var SandboxCwdEscape = class extends Error {
+var SandboxCwdEscape = class extends GkmError {
 	cwd;
 	root;
 	constructor(cwd, root) {
@@ -57,7 +58,7 @@ function confineCwd(root, cwd) {
 	return absolute;
 }
 /** A secret's file name: one path segment, so it cannot be written elsewhere. */
-var SecretNameInvalid = class extends Error {
+var SecretNameInvalid = class extends GkmError {
 	secretName;
 	constructor(secretName) {
 		super(`'${secretName}' cannot be a secret's name: it becomes a file name in the secrets directory, so it must be one segment of letters, digits, '.', '-' or '_' and not start with '.'.`);
@@ -114,4 +115,4 @@ function oncePerRun(sandbox, key, ask) {
 //#endregion
 export { assertSecretNames as a, withSandbox as c, activeSandbox as i, SandboxCwdEscape as n, confineCwd as o, SecretNameInvalid as r, oncePerRun as s, SECRETS_DIR_ENV as t };
 
-//# sourceMappingURL=sandbox-Dm247NGx.mjs.map
+//# sourceMappingURL=sandbox-CbVB7uOD.mjs.map

package/dist/sandbox-CbVB7uOD.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-CbVB7uOD.mjs","names":[],"sources":["../src/sandbox/sandbox.ts"],"sourcesContent":["/**\n * Where a deploy runs the project's own code.\n *\n * A deploy holds credentials — Dokploy's token, a registry login, an AWS key —\n * and loading `gkm.config.ts`, sniffing an app's environment and building it\n * all execute code from the repository being deployed. On a developer's own\n * laptop that is the developer's code. On a CI job for a fork, or a shared\n * build runner, it is not, and that code should not be able to read the\n * credentials used to deploy it, hang the deploy, or reach outside the\n * checkout.\n *\n * So every step that runs project code goes through a `Sandbox`: one call,\n * with an argument array rather than a shell line, the complete environment\n * the step needs rather than the host's, a timeout it cannot outlive, secrets\n * as files rather than variables, and a working directory inside the project.\n * The steps that need credentials — provisioning, pushing, releasing — are\n * the deploy's own code and never run in one.\n *\n * `LocalSandbox` is the default: a child process on this machine with an\n * allowlisted environment. A host that builds repositories it does not trust\n * passes its own — a container per build, a VM — through `deploy()`'s\n * `sandbox`.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { existsSync, realpathSync } from 'node:fs';\nimport { isAbsolute, relative, resolve, sep } from 'node:path';\nimport { GkmError } from '../errors';\n\n/** Where a command's output goes. */\nexport type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';\n\nexport interface SandboxExecOptions {\n\t/**\n\t * Where the command runs: the project root or a directory below it, as an\n\t * absolute path or relative to the root. Anywhere else is refused with\n\t * {@link SandboxCwdEscape}.\n\t */\n\tcwd: string;\n\t/**\n\t * The command's whole environment. Nothing of the host's is added to it:\n\t * start from {@link Sandbox.env} and add what the step needs.\n\t */\n\tenv: Readonly<Record<string, string>>;\n\t/**\n\t * How long the command may run before it is killed. Required: a step that\n\t * waits forever — a sniffed entry that opens a server, a build stuck on a\n\t * prompt — would otherwise hold the deploy, and its lock, forever.\n\t */\n\ttimeoutMs: number;\n\t/**\n\t * Files the command can read, by name. Mounted in a directory of their own\n\t * — named by `GKM_SECRETS_DIR` in the command's environment — and removed\n\t * when it exits. Never set as variables, which every child inherits, a\n\t * crash report prints and `/proc/<pid>/environ` shows.\n\t */\n\tsecrets?: Readonly<Record<string, string>>;\n\t/**\n\t * `capture` (the default) returns stdout and stderr in the result;\n\t * `inherit` gives the command the host's terminal; `stderr` sends both\n\t * streams to the host's stderr; `ignore` discards them.\n\t */\n\toutput?: SandboxOutput;\n\t/** Kills the command when aborted; `exec` rejects with the signal's reason. */\n\tsignal?: AbortSignal;\n}\n\n/** How a command ended. A non-zero exit is a result, not an error. */\nexport interface SandboxResult {\n\texitCode: number | null;\n\tsignal: string | null;\n\t/** What it wrote to stdout, when its output was captured. */\n\tstdout: string;\n\t/** What it wrote to stderr, when its output was captured. */\n\tstderr: string;\n}\n\n/**\n * Runs a command against the project, and nothing else of the host's.\n *\n * `exec` resolves with the result however the command exited. It rejects\n * with {@link CommandTimedOut} once the timeout passes — after the command is\n * gone — with {@link SandboxCwdEscape} for a directory outside the project,\n * with the signal's reason when aborted, and with the spawn error when the\n * program cannot be started.\n */\nexport interface Sandbox {\n\t/** The project: the directory every command runs at or below. */\n\treadonly root: string;\n\t/**\n\t * Whether the code it runs is kept from the host: its files, its\n\t * processes, its memory.\n\t *\n\t * An isolating sandbox shares nothing but what crosses `exec`, so a config\n\t * reaches the deploy as data — a live object in it (a custom state store,\n\t * an inline target) cannot cross, and is refused with\n\t * `ConfigObjectNotSerializable`. A non-isolating one, like\n\t * {@link LocalSandbox}, runs on the host as the host's user; a project\n\t * whose config holds live objects is then loaded in-process as before,\n\t * because a project trusted to run there is trusted to do that.\n\t */\n\treadonly isolating: boolean;\n\t/**\n\t * The environment a command starts from: what any program needs to run\n\t * here — `PATH`, `HOME`, the locale — and no credential.\n\t */\n\treadonly env: Readonly<Record<string, string>>;\n\texec(\n\t\tcommand: string,\n\t\targs: readonly string[],\n\t\toptions: SandboxExecOptions,\n\t): Promise<SandboxResult>;\n}\n\n/** The variable naming the directory a command's secrets are mounted in. */\nexport const SECRETS_DIR_ENV = 'GKM_SECRETS_DIR';\n\n/** A command was asked to run outside the project. */\nexport class SandboxCwdEscape extends GkmError {\n\tconstructor(\n\t\treadonly cwd: string,\n\t\treadonly root: string,\n\t) {\n\t\tsuper(\n\t\t\t`Refusing to run in '${cwd}': it is outside the project at '${root}'. ` +\n\t\t\t\t'A sandboxed step only runs inside the project it was given — check ' +\n\t\t\t\t'the app paths in gkm.config.ts for `..` or an absolute path.',\n\t\t);\n\t\tthis.name = 'SandboxCwdEscape';\n\t}\n}\n\n/** A path with its symlinks resolved where it exists — `/tmp` is `/private/tmp`. */\nfunction real(path: string): string {\n\treturn existsSync(path) ? realpathSync(path) : path;\n}\n\n/**\n * `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.\n *\n * Symlinks are resolved on both sides first, so a link inside the project\n * that points out of it is an escape, and a project reached through a link\n * (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call\n * before it runs anything.\n */\nexport function confineCwd(root: string, cwd: string): string {\n\tconst absolute = resolve(root, cwd);\n\tconst from = relative(real(resolve(root)), real(absolute));\n\tif (from === '..' || from.startsWith(`..${sep}`) || isAbsolute(from)) {\n\t\tthrow new SandboxCwdEscape(cwd, root);\n\t}\n\treturn absolute;\n}\n\n/** A secret's file name: one path segment, so it cannot be written elsewhere. */\nexport class SecretNameInvalid extends GkmError {\n\tconstructor(readonly secretName: string) {\n\t\tsuper(\n\t\t\t`'${secretName}' cannot be a secret's name: it becomes a file name in ` +\n\t\t\t\t'the secrets directory, so it must be one segment of letters, digits, ' +\n\t\t\t\t\"'.', '-' or '_' and not start with '.'.\",\n\t\t);\n\t\tthis.name = 'SecretNameInvalid';\n\t}\n}\n\nconst SECRET_NAME = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;\n\n/** Every secret name, checked before anything is written. */\nexport function assertSecretNames(\n\tsecrets: Readonly<Record<string, string>> | undefined,\n): void {\n\tfor (const name of Object.keys(secrets ?? {})) {\n\t\tif (!SECRET_NAME.test(name)) throw new SecretNameInvalid(name);\n\t}\n}\n\n/** A run's sandbox, and what its workers already answered. */\ninterface SandboxRun {\n\tsandbox: Sandbox;\n\tanswers: Map<string, Promise<unknown>>;\n}\n\nconst active = new AsyncLocalStorage<SandboxRun>();\n\n/**\n * Run `fn` with `sandbox` as the one its steps use.\n *\n * Per run rather than global, as `withOutput` routes a run's lines: two\n * deploys in one host process each build in their own sandbox. A step deep in\n * the engine — discovering constructs, sniffing an app — asks\n * {@link activeSandbox} rather than every function between `deploy()` and it\n * taking one more parameter.\n */\nexport function withSandbox<T>(sandbox: Sandbox, fn: () => T): T {\n\treturn active.run({ sandbox, answers: new Map() }, fn);\n}\n\n/** The sandbox of the run this is part of, if it was started with one. */\nexport function activeSandbox(): Sandbox | undefined {\n\treturn active.getStore()?.sandbox;\n}\n\n/**\n * `ask()`'s answer, asked once per run.\n *\n * A deploy loads its config and discovers its constructs from several places\n * — the first load, the engine, the Dockerfile generator — and in a sandbox\n * each was a child process of its own, for the same answer: the checkout does\n * not change while it deploys. Within a run in `sandbox`, the first answer\n * for `key` is the one every later ask gets. Outside one, or for another\n * sandbox, `ask()` runs each time.\n */\nexport function oncePerRun<T>(\n\tsandbox: Sandbox,\n\tkey: string,\n\task: () => Promise<T>,\n): Promise<T> {\n\tconst run = active.getStore();\n\tif (!run || run.sandbox !== sandbox) return ask();\n\n\tlet answer = run.answers.get(key) as Promise<T> | undefined;\n\tif (!answer) {\n\t\tanswer = ask();\n\t\trun.answers.set(key, answer);\n\t\t// A failure is not remembered: the next ask tries again.\n\t\tanswer.catch(() => run.answers.delete(key));\n\t}\n\treturn answer;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmHA,MAAa,kBAAkB;;AAG/B,IAAa,mBAAb,cAAsC,SAAS;CAEpC;CACA;CAFV,YACC,KACA,MACC;EACD,MACC,uBAAuB,IAAI,mCAAmC,KAAK,qIAGpE;EAPS,KAAA,MAAA;EACA,KAAA,OAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,KAAK,MAAsB;CACnC,OAAO,WAAW,IAAI,IAAI,aAAa,IAAI,IAAI;AAChD;;;;;;;;;AAUA,SAAgB,WAAW,MAAc,KAAqB;CAC7D,MAAM,WAAW,QAAQ,MAAM,GAAG;CAClC,MAAM,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC;CACzD,IAAI,SAAS,QAAQ,KAAK,WAAW,KAAK,KAAK,KAAK,WAAW,IAAI,GAClE,MAAM,IAAI,iBAAiB,KAAK,IAAI;CAErC,OAAO;AACR;;AAGA,IAAa,oBAAb,cAAuC,SAAS;CAC1B;CAArB,YAAY,YAA6B;EACxC,MACC,IAAI,WAAW,oKAGhB;EALoB,KAAA,aAAA;EAMpB,KAAK,OAAO;CACb;AACD;AAEA,MAAM,cAAc;;AAGpB,SAAgB,kBACf,SACO;CACP,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,CAAC,CAAC,GAC3C,IAAI,CAAC,YAAY,KAAK,IAAI,GAAG,MAAM,IAAI,kBAAkB,IAAI;AAE/D;AAQA,MAAM,SAAS,IAAI,kBAA8B;;;;;;;;;;AAWjD,SAAgB,YAAe,SAAkB,IAAgB;CAChE,OAAO,OAAO,IAAI;EAAE;EAAS,yBAAS,IAAI,IAAI;CAAE,GAAG,EAAE;AACtD;;AAGA,SAAgB,gBAAqC;CACpD,OAAO,OAAO,SAAS,CAAC,EAAE;AAC3B;;;;;;;;;;;AAYA,SAAgB,WACf,SACA,KACA,KACa;CACb,MAAM,MAAM,OAAO,SAAS;CAC5B,IAAI,CAAC,OAAO,IAAI,YAAY,SAAS,OAAO,IAAI;CAEhD,IAAI,SAAS,IAAI,QAAQ,IAAI,GAAG;CAChC,IAAI,CAAC,QAAQ;EACZ,SAAS,IAAI;EACb,IAAI,QAAQ,IAAI,KAAK,MAAM;EAE3B,OAAO,YAAY,IAAI,QAAQ,OAAO,GAAG,CAAC;CAC3C;CACA,OAAO;AACR"}