@infracraft/pulumi 1.14.0 → 1.15.1

package/dist/git-guard.cjs

@@ -3,6 +3,8 @@ const require_chunk = require('./chunk-BVYJZCqc.cjs');
 let node_child_process = require("node:child_process");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs, 1);
+let node_os = require("node:os");
+node_os = require_chunk.__toESM(node_os, 1);
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path, 1);
 let _pulumi_command = require("@pulumi/command");
@@ -93,6 +95,7 @@ function recoverStaleGuard(monorepoRoot) {
 	for (const dirName of [GUARD_DIR, ...LEGACY_GUARD_DIRS]) {
 		const guardPath = node_path.join(monorepoRoot, dirName);
 		if (!node_fs.existsSync(guardPath)) continue;
+		setGuardImmutable(guardPath, false);
 		if (node_fs.existsSync(gitPath)) node_fs.rmSync(gitPath, {
 			recursive: true,
 			force: true
@@ -108,6 +111,12 @@ function recoverStaleGuard(monorepoRoot) {
 * repository, so `git ls-files` still reports the tracked files (deploy tools
 * enumerate them) while none of the history is exposed.
 *
+* On success it also writes an agent-facing `README.md` and an
+* `infracraft.lock` into the stub (so a coding agent that stumbles onto
+* the unusual state leaves it alone instead of "fixing" it), and best-effort
+* marks the moved-aside real history immutable via {@link setGuardImmutable} so
+* it cannot be accidentally restored while the deploy is in progress.
+*
 * Idempotent and safe to call on every `up`: it no-ops when there is no `.git`
 * to hide, and refuses to overwrite an existing guard dir (which would destroy
 * the real history captured by an earlier run).
@@ -132,6 +141,8 @@ function hideGit(monorepoRoot) {
 		node_fs.renameSync(guardPath, gitPath);
 		throw new Error(`[git-guard] Failed to create stub .git in ${monorepoRoot}: ${String(error)}`);
 	}
+	writeStubMetadata(gitPath, GUARD_DIR);
+	setGuardImmutable(guardPath, true);
 }
 /**
 * Moves the real `.git` back from the guard dir, discarding the stub. No-ops when
@@ -143,6 +154,7 @@ function restoreGit(monorepoRoot) {
 	if (!node_fs.existsSync(guardPath)) return;
 	const gitPath = node_path.join(monorepoRoot, ".git");
 	try {
+		setGuardImmutable(guardPath, false);
 		if (node_fs.existsSync(gitPath)) node_fs.rmSync(gitPath, {
 			recursive: true,
 			force: true
@@ -158,13 +170,121 @@ function ensureGitignore(gitignorePath) {
 	const newline = content.length > 0 && !content.endsWith("\n") ? "\n" : "";
 	node_fs.appendFileSync(gitignorePath, `${newline}${GUARD_DIR}\n`);
 }
+/**
+* Basename of the human/agent-facing explainer written into the stub `.git`.
+*/
+const STUB_README_NAME = "README.md";
+/**
+* Basename of the lock file written into the stub `.git`. Its presence — with a
+* live `pid` — marks an in-progress deploy that owns the guard.
+*/
+const LOCK_FILE_NAME = "infracraft.lock";
+/**
+* Builds the agent-facing explainer placed at `.git/README.md` inside the stub.
+*
+* An automated coding agent that trips over the unusual git state (an unborn
+* `main`; `git ls-files` works but `git log` fails with `unable to read <sha>`)
+* should read this and leave the repository alone instead of "fixing" it
+* mid-deploy.
+*
+* @param guardDir - Basename of the sibling dir holding the real, locked history
+*/
+function buildStubReadme(guardDir) {
+	return `# Managed STUB \`.git\` — do not modify or restore it
+
+This is **not** the real repository. It is a lightweight stub created
+automatically by [\`@infracraft/pulumi\`](https://github.com/andredezzy/infracraft)
+(the \`git-guard\`) while a deploy (\`pulumi up\` / \`vercel deploy\`) is in progress.
+
+## Why it exists
+Deploy tools would otherwise ingest the full git history. The guard moves the real
+\`.git\` aside to \`../${guardDir}\` and leaves this stub, copying only the index so
+\`git ls-files\` still lists tracked files for the deploy tool.
+
+## It restores itself — automatically
+When the deploy finishes (success or failure) the guard discards this stub and
+moves the real \`.git\` back. **You do not need to do anything.**
+
+## DO NOT try to "fix" this
+While the deploy runs, the real history in \`../${guardDir}\` is **locked**
+(filesystem-immutable, best-effort). Do not run \`git init\` / \`reset\` / \`checkout\`
+here, do not \`rm -rf .git\`, and do not \`mv ../${guardDir} .git\` — the move is
+intentionally blocked and will fail.
+
+Symptoms you can safely ignore: an unborn \`main\` branch; \`git ls-files\` works but
+\`git log\` / \`git diff\` fail with \`unable to read <sha>\` (the objects live in the
+locked guard dir).
+
+## If a deploy crashed and this looks stuck
+The guard self-heals on the next deploy. Only if you are certain no deploy is
+running, recover manually from the repo root:
+
+\`\`\`sh
+chflags -R nouchg "../${guardDir}" 2>/dev/null || chattr -R -i "../${guardDir}" 2>/dev/null || true
+rm -rf .git && mv "../${guardDir}" .git
+\`\`\`
+
+See \`./${LOCK_FILE_NAME}\` for the owning process id and start time.
+`;
+}
+/**
+* Writes the stub explainer and the deploy lock into the freshly created stub
+* `.git`. Best-effort: the stub already satisfies deploy tools without these
+* files, so a write failure here must never abort an otherwise-successful hide.
+*/
+function writeStubMetadata(gitPath, guardDir) {
+	try {
+		node_fs.writeFileSync(node_path.join(gitPath, STUB_README_NAME), buildStubReadme(guardDir));
+		const lock = {
+			tool: "@infracraft/pulumi git-guard",
+			pid: process.pid,
+			startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			host: node_os.hostname(),
+			guardDir,
+			note: "Deploy in progress. The real .git is moved aside and locked. Do not restore it manually; it restores automatically when the deploy finishes."
+		};
+		node_fs.writeFileSync(node_path.join(gitPath, LOCK_FILE_NAME), `${JSON.stringify(lock, null, 2)}\n`);
+	} catch (error) {
+		console.error(`[git-guard] Failed to write stub metadata: ${String(error)}`);
+	}
+}
+/**
+* Best-effort filesystem lock on the moved-aside real history so it cannot be
+* accidentally restored mid-deploy (e.g. a manual `mv` fails on an immutable
+* dir). Uses `chflags uchg` on macOS and `chattr +i` on Linux, and silently
+* no-ops where the flag is unsupported or not permitted (e.g. unprivileged CI) —
+* the lock is a guard rail, never a deploy blocker. The legitimate restore and
+* recover paths call this with `immutable = false` before moving the dir back.
+*
+* @param guardPath - Absolute path to the guard dir holding the real history
+* @param immutable - `true` to lock, `false` to unlock
+*/
+function setGuardImmutable(guardPath, immutable) {
+	if (!node_fs.existsSync(guardPath)) return;
+	try {
+		if (process.platform === "darwin") (0, node_child_process.execFileSync)("chflags", [
+			"-R",
+			immutable ? "uchg" : "nouchg",
+			guardPath
+		], { stdio: "ignore" });
+		else if (process.platform === "linux") (0, node_child_process.execFileSync)("chattr", [
+			"-R",
+			immutable ? "+i" : "-i",
+			guardPath
+		], { stdio: "ignore" });
+	} catch {}
+}
 
 //#endregion
 exports.GUARD_DIR = GUARD_DIR;
 exports.LEGACY_GUARD_DIRS = LEGACY_GUARD_DIRS;
+exports.LOCK_FILE_NAME = LOCK_FILE_NAME;
+exports.STUB_README_NAME = STUB_README_NAME;
+exports.buildStubReadme = buildStubReadme;
 exports.ensureGitignore = ensureGitignore;
 exports.gitGuard = gitGuard;
 exports.hideGit = hideGit;
 exports.recoverStaleGuard = recoverStaleGuard;
 exports.restoreGit = restoreGit;
+exports.setGuardImmutable = setGuardImmutable;
 //# sourceMappingURL=git-guard.cjs.map

package/dist/git-guard.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"git-guard.cjs","names":["path","runtime","command","fs"],"sources":["../src/git-guard.ts"],"sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as command from \"@pulumi/command\";\nimport { runtime } from \"@pulumi/pulumi\";\n\n/**\n * Name of the directory the real `.git` is moved to while deploys run.\n *\n * This value changed from `.git-infrakit-pulumi-guard` to\n * `.git-infracraft-pulumi-guard`. A guard dir left under the old name by a crash\n * under a previous release is still recovered automatically (see\n * {@link LEGACY_GUARD_DIRS} and {@link recoverStaleGuard}), so the rename needs no\n * manual migration. Consumers that imported this constant to locate the guard dir\n * themselves should also account for {@link LEGACY_GUARD_DIRS}.\n */\nexport const GUARD_DIR = \".git-infracraft-pulumi-guard\";\n\n/**\n * Guard-dir names written by older releases. They are recovered on startup so a\n * repository left in a hidden state by a crash under a previous version of this\n * package self-heals on the next run.\n */\nexport const LEGACY_GUARD_DIRS = [\".git-infrakit-pulumi-guard\"];\n\ninterface GitGuardResult {\n\thide: command.local.Command;\n}\n\n/** Absolute monorepo roots already hidden in this process — keeps `gitGuard` idempotent. */\nconst guardedRoots = new Set<string>();\n\n/**\n * Hides the real `.git` so deploy tools (e.g. `vercel deploy`) do not ingest the\n * full git history during a `pulumi up`, then restores it once every dependent\n * deploy has finished.\n *\n * Hiding is performed **synchronously, in-process, on every invocation** — not\n * through a state-tracked `command.local.Command`. A command's `create` only\n * runs on first creation or when its `triggers` change, so a stack that had\n * already recorded the hide command would skip it on every subsequent `up`,\n * leaving the real `.git` exposed during deploys. Hiding is a host-side,\n * run-scoped side effect, not desired-state infrastructure, so it belongs in the\n * program lifecycle rather than the resource graph.\n *\n * Guarantees:\n * - `.git` is hidden before any resource is registered (and therefore before any\n *   dependent deploy command runs), on every `up`.\n * - `.git` is restored on success and on failure. On success the language host\n *   stays alive until every resource operation completes, so the `exit` handler\n *   fires after the deploys; on failure it may fire as soon as the event loop\n *   drains, but a failed deploy has already invalidated the update and restore\n *   only renames a local directory, so restoring early is harmless.\n * - A guard dir left behind by a hard-killed run (`kill -9`, OOM) is recovered on\n *   the next invocation, with no loss of real history.\n * - `pulumi preview` (dry run) moves nothing: it executes no deploy commands.\n *\n * @param monorepoRoot - Absolute path to the repository root containing `.git`\n * @returns `{ hide }` — a backward-compatible dependency anchor for `dependsOn`\n */\nexport function gitGuard(monorepoRoot: string): GitGuardResult {\n\tensureGitignore(path.join(monorepoRoot, \".gitignore\"));\n\n\tconst root = path.resolve(monorepoRoot);\n\n\t// Guard each root at most once per process. `pulumi preview` (dry run) runs the\n\t// program but executes no deploy commands, so it skips the move entirely —\n\t// preview never touches `.git`.\n\tif (!guardedRoots.has(root) && !runtime.isDryRun()) {\n\t\t// Self-heal first: a guard dir present at startup is the fingerprint of a\n\t\t// previous run that was killed before it could restore. Doing this only on\n\t\t// `up` (not preview) keeps preview side-effect free; skipping it on a repeat\n\t\t// call avoids treating the guard this process just created as a stale one.\n\t\trecoverStaleGuard(monorepoRoot);\n\n\t\thideGit(monorepoRoot);\n\t\tguardedRoots.add(root);\n\n\t\tconst restore = (): void => restoreGit(monorepoRoot);\n\n\t\tprocess.on(\"exit\", restore);\n\n\t\tprocess.on(\"SIGINT\", () => {\n\t\t\trestore();\n\t\t\tprocess.exit(0);\n\t\t});\n\n\t\tprocess.on(\"SIGTERM\", () => {\n\t\t\trestore();\n\t\t\tprocess.exit(0);\n\t\t});\n\t}\n\n\t// Backward-compatible dependency anchor. The real hide already ran\n\t// synchronously above — before any resource was registered — so consumers'\n\t// existing `dependsOn: [hide]` keeps compiling and still orders deploys after\n\t// the guard, without depending on a command whose static trigger skipped\n\t// re-runs.\n\t//\n\t// Upgrade note: the previous release built this resource with\n\t// `triggers: [stableDir(...)]`. Dropping `triggers` makes the first `pulumi up`\n\t// after upgrading REPLACE `git-guard-hide` once. The replace is harmless — there\n\t// is no delete step and the new create is a bare echo.\n\tconst hide = new command.local.Command(\"git-guard-hide\", {\n\t\tcreate: 'echo \"[git-guard] .git hidden in-process by @infracraft/pulumi\"',\n\t});\n\n\treturn { hide };\n}\n\n/**\n * Restores a guard dir left behind by a previously killed run.\n *\n * A guard dir only exists if a prior run moved the real `.git` aside and never\n * restored it. The current `.git` — if present — is the throwaway stub that\n * `git init` created and is safe to discard; the real history lives in the guard\n * dir and is moved back into place. Legacy guard names are recovered too, which\n * migrates a crashed older stack onto the current layout.\n *\n * @returns `true` if a stale guard dir was recovered, otherwise `false`\n */\nexport function recoverStaleGuard(monorepoRoot: string): boolean {\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\n\tfor (const dirName of [GUARD_DIR, ...LEGACY_GUARD_DIRS]) {\n\t\tconst guardPath = path.join(monorepoRoot, dirName);\n\n\t\tif (!fs.existsSync(guardPath)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (fs.existsSync(gitPath)) {\n\t\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\t}\n\n\t\tfs.renameSync(guardPath, gitPath);\n\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * Moves the real `.git` to the guard dir and leaves a lightweight stub in its\n * place. The stub is a fresh `git init` whose index is copied from the real\n * repository, so `git ls-files` still reports the tracked files (deploy tools\n * enumerate them) while none of the history is exposed.\n *\n * Idempotent and safe to call on every `up`: it no-ops when there is no `.git`\n * to hide, and refuses to overwrite an existing guard dir (which would destroy\n * the real history captured by an earlier run).\n */\nexport function hideGit(monorepoRoot: string): void {\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\tconst guardPath = path.join(monorepoRoot, GUARD_DIR);\n\n\tif (!fs.existsSync(gitPath) || fs.existsSync(guardPath)) {\n\t\treturn;\n\t}\n\n\tfs.renameSync(gitPath, guardPath);\n\n\ttry {\n\t\texecFileSync(\"git\", [\"init\", \"--quiet\"], {\n\t\t\tcwd: monorepoRoot,\n\t\t\tstdio: \"ignore\",\n\t\t});\n\n\t\tconst realIndex = path.join(guardPath, \"index\");\n\n\t\tif (fs.existsSync(realIndex)) {\n\t\t\tfs.copyFileSync(realIndex, path.join(gitPath, \"index\"));\n\t\t}\n\t} catch (error) {\n\t\t// Re-expose the real `.git` so a failed stub creation never leaves the\n\t\t// repository without git metadata.\n\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\tfs.renameSync(guardPath, gitPath);\n\n\t\tthrow new Error(\n\t\t\t`[git-guard] Failed to create stub .git in ${monorepoRoot}: ${String(error)}`,\n\t\t);\n\t}\n}\n\n/**\n * Moves the real `.git` back from the guard dir, discarding the stub. No-ops when\n * there is nothing hidden. Failures are reported, not thrown, so a restore on\n * process exit can never crash the host — the manual recovery command is logged.\n */\nexport function restoreGit(monorepoRoot: string): void {\n\tconst guardPath = path.join(monorepoRoot, GUARD_DIR);\n\n\tif (!fs.existsSync(guardPath)) {\n\t\treturn;\n\t}\n\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\n\ttry {\n\t\tif (fs.existsSync(gitPath)) {\n\t\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\t}\n\n\t\tfs.renameSync(guardPath, gitPath);\n\t} catch {\n\t\tconsole.error(\n\t\t\t`[git-guard] Failed to restore .git. Run manually: rm -rf ${gitPath} && mv ${guardPath} ${gitPath}`,\n\t\t);\n\t}\n}\n\nexport function ensureGitignore(gitignorePath: string): void {\n\tconst content = fs.existsSync(gitignorePath)\n\t\t? fs.readFileSync(gitignorePath, \"utf-8\")\n\t\t: \"\";\n\n\tif (content.includes(GUARD_DIR)) {\n\t\treturn;\n\t}\n\n\tconst newline = content.length > 0 && !content.endsWith(\"\\n\") ? \"\\n\" : \"\";\n\n\tfs.appendFileSync(gitignorePath, `${newline}${GUARD_DIR}\\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;;;;;;AAOzB,MAAa,oBAAoB,CAAC,4BAA4B;;AAO9D,MAAM,+BAAe,IAAI,IAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BrC,SAAgB,SAAS,cAAsC;CAC9D,gBAAgBA,UAAK,KAAK,cAAc,YAAY,CAAC;CAErD,MAAM,OAAOA,UAAK,QAAQ,YAAY;CAKtC,IAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAACC,uBAAQ,SAAS,GAAG;EAKnD,kBAAkB,YAAY;EAE9B,QAAQ,YAAY;EACpB,aAAa,IAAI,IAAI;EAErB,MAAM,gBAAsB,WAAW,YAAY;EAEnD,QAAQ,GAAG,QAAQ,OAAO;EAE1B,QAAQ,GAAG,gBAAgB;GAC1B,QAAQ;GACR,QAAQ,KAAK,CAAC;EACf,CAAC;EAED,QAAQ,GAAG,iBAAiB;GAC3B,QAAQ;GACR,QAAQ,KAAK,CAAC;EACf,CAAC;CACF;CAgBA,OAAO,EAAE,UAJQC,gBAAQ,MAAM,QAAQ,kBAAkB,EACxD,QAAQ,oEACT,CAEY,EAAE;AACf;;;;;;;;;;;;AAaA,SAAgB,kBAAkB,cAA+B;CAChE,MAAM,UAAUF,UAAK,KAAK,cAAc,MAAM;CAE9C,KAAK,MAAM,WAAW,CAAC,WAAW,GAAG,iBAAiB,GAAG;EACxD,MAAM,YAAYA,UAAK,KAAK,cAAc,OAAO;EAEjD,IAAI,CAACG,QAAG,WAAW,SAAS,GAC3B;EAGD,IAAIA,QAAG,WAAW,OAAO,GACxB,QAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAGpD,QAAG,WAAW,WAAW,OAAO;EAEhC,OAAO;CACR;CAEA,OAAO;AACR;;;;;;;;;;;AAYA,SAAgB,QAAQ,cAA4B;CACnD,MAAM,UAAUH,UAAK,KAAK,cAAc,MAAM;CAC9C,MAAM,YAAYA,UAAK,KAAK,cAAc,SAAS;CAEnD,IAAI,CAACG,QAAG,WAAW,OAAO,KAAKA,QAAG,WAAW,SAAS,GACrD;CAGD,QAAG,WAAW,SAAS,SAAS;CAEhC,IAAI;EACH,qCAAa,OAAO,CAAC,QAAQ,SAAS,GAAG;GACxC,KAAK;GACL,OAAO;EACR,CAAC;EAED,MAAM,YAAYH,UAAK,KAAK,WAAW,OAAO;EAE9C,IAAIG,QAAG,WAAW,SAAS,GAC1B,QAAG,aAAa,WAAWH,UAAK,KAAK,SAAS,OAAO,CAAC;CAExD,SAAS,OAAO;EAGf,QAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACnD,QAAG,WAAW,WAAW,OAAO;EAEhC,MAAM,IAAI,MACT,6CAA6C,aAAa,IAAI,OAAO,KAAK,GAC3E;CACD;AACD;;;;;;AAOA,SAAgB,WAAW,cAA4B;CACtD,MAAM,YAAYA,UAAK,KAAK,cAAc,SAAS;CAEnD,IAAI,CAACG,QAAG,WAAW,SAAS,GAC3B;CAGD,MAAM,UAAUH,UAAK,KAAK,cAAc,MAAM;CAE9C,IAAI;EACH,IAAIG,QAAG,WAAW,OAAO,GACxB,QAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAGpD,QAAG,WAAW,WAAW,OAAO;CACjC,QAAQ;EACP,QAAQ,MACP,4DAA4D,QAAQ,SAAS,UAAU,GAAG,SAC3F;CACD;AACD;AAEA,SAAgB,gBAAgB,eAA6B;CAC5D,MAAM,UAAUA,QAAG,WAAW,aAAa,IACxCA,QAAG,aAAa,eAAe,OAAO,IACtC;CAEH,IAAI,QAAQ,uCAAkB,GAC7B;CAGD,MAAM,UAAU,QAAQ,SAAS,KAAK,CAAC,QAAQ,SAAS,IAAI,IAAI,OAAO;CAEvE,QAAG,eAAe,eAAe,GAAG,UAAU,UAAU,GAAG;AAC5D"}
+{"version":3,"file":"git-guard.cjs","names":["path","runtime","command","fs","os"],"sources":["../src/git-guard.ts"],"sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport * as command from \"@pulumi/command\";\nimport { runtime } from \"@pulumi/pulumi\";\n\n/**\n * Name of the directory the real `.git` is moved to while deploys run.\n *\n * This value changed from `.git-infrakit-pulumi-guard` to\n * `.git-infracraft-pulumi-guard`. A guard dir left under the old name by a crash\n * under a previous release is still recovered automatically (see\n * {@link LEGACY_GUARD_DIRS} and {@link recoverStaleGuard}), so the rename needs no\n * manual migration. Consumers that imported this constant to locate the guard dir\n * themselves should also account for {@link LEGACY_GUARD_DIRS}.\n */\nexport const GUARD_DIR = \".git-infracraft-pulumi-guard\";\n\n/**\n * Guard-dir names written by older releases. They are recovered on startup so a\n * repository left in a hidden state by a crash under a previous version of this\n * package self-heals on the next run.\n */\nexport const LEGACY_GUARD_DIRS = [\".git-infrakit-pulumi-guard\"];\n\ninterface GitGuardResult {\n\thide: command.local.Command;\n}\n\n/** Absolute monorepo roots already hidden in this process — keeps `gitGuard` idempotent. */\nconst guardedRoots = new Set<string>();\n\n/**\n * Hides the real `.git` so deploy tools (e.g. `vercel deploy`) do not ingest the\n * full git history during a `pulumi up`, then restores it once every dependent\n * deploy has finished.\n *\n * Hiding is performed **synchronously, in-process, on every invocation** — not\n * through a state-tracked `command.local.Command`. A command's `create` only\n * runs on first creation or when its `triggers` change, so a stack that had\n * already recorded the hide command would skip it on every subsequent `up`,\n * leaving the real `.git` exposed during deploys. Hiding is a host-side,\n * run-scoped side effect, not desired-state infrastructure, so it belongs in the\n * program lifecycle rather than the resource graph.\n *\n * Guarantees:\n * - `.git` is hidden before any resource is registered (and therefore before any\n *   dependent deploy command runs), on every `up`.\n * - `.git` is restored on success and on failure. On success the language host\n *   stays alive until every resource operation completes, so the `exit` handler\n *   fires after the deploys; on failure it may fire as soon as the event loop\n *   drains, but a failed deploy has already invalidated the update and restore\n *   only renames a local directory, so restoring early is harmless.\n * - A guard dir left behind by a hard-killed run (`kill -9`, OOM) is recovered on\n *   the next invocation, with no loss of real history.\n * - `pulumi preview` (dry run) moves nothing: it executes no deploy commands.\n *\n * @param monorepoRoot - Absolute path to the repository root containing `.git`\n * @returns `{ hide }` — a backward-compatible dependency anchor for `dependsOn`\n */\nexport function gitGuard(monorepoRoot: string): GitGuardResult {\n\tensureGitignore(path.join(monorepoRoot, \".gitignore\"));\n\n\tconst root = path.resolve(monorepoRoot);\n\n\t// Guard each root at most once per process. `pulumi preview` (dry run) runs the\n\t// program but executes no deploy commands, so it skips the move entirely —\n\t// preview never touches `.git`.\n\tif (!guardedRoots.has(root) && !runtime.isDryRun()) {\n\t\t// Self-heal first: a guard dir present at startup is the fingerprint of a\n\t\t// previous run that was killed before it could restore. Doing this only on\n\t\t// `up` (not preview) keeps preview side-effect free; skipping it on a repeat\n\t\t// call avoids treating the guard this process just created as a stale one.\n\t\trecoverStaleGuard(monorepoRoot);\n\n\t\thideGit(monorepoRoot);\n\t\tguardedRoots.add(root);\n\n\t\tconst restore = (): void => restoreGit(monorepoRoot);\n\n\t\tprocess.on(\"exit\", restore);\n\n\t\tprocess.on(\"SIGINT\", () => {\n\t\t\trestore();\n\t\t\tprocess.exit(0);\n\t\t});\n\n\t\tprocess.on(\"SIGTERM\", () => {\n\t\t\trestore();\n\t\t\tprocess.exit(0);\n\t\t});\n\t}\n\n\t// Backward-compatible dependency anchor. The real hide already ran\n\t// synchronously above — before any resource was registered — so consumers'\n\t// existing `dependsOn: [hide]` keeps compiling and still orders deploys after\n\t// the guard, without depending on a command whose static trigger skipped\n\t// re-runs.\n\t//\n\t// Upgrade note: the previous release built this resource with\n\t// `triggers: [stableDir(...)]`. Dropping `triggers` makes the first `pulumi up`\n\t// after upgrading REPLACE `git-guard-hide` once. The replace is harmless — there\n\t// is no delete step and the new create is a bare echo.\n\tconst hide = new command.local.Command(\"git-guard-hide\", {\n\t\tcreate: 'echo \"[git-guard] .git hidden in-process by @infracraft/pulumi\"',\n\t});\n\n\treturn { hide };\n}\n\n/**\n * Restores a guard dir left behind by a previously killed run.\n *\n * A guard dir only exists if a prior run moved the real `.git` aside and never\n * restored it. The current `.git` — if present — is the throwaway stub that\n * `git init` created and is safe to discard; the real history lives in the guard\n * dir and is moved back into place. Legacy guard names are recovered too, which\n * migrates a crashed older stack onto the current layout.\n *\n * @returns `true` if a stale guard dir was recovered, otherwise `false`\n */\nexport function recoverStaleGuard(monorepoRoot: string): boolean {\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\n\tfor (const dirName of [GUARD_DIR, ...LEGACY_GUARD_DIRS]) {\n\t\tconst guardPath = path.join(monorepoRoot, dirName);\n\n\t\tif (!fs.existsSync(guardPath)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// A crashed run may have left the guard dir immutable; lift the lock so the\n\t\t// recovery rename can proceed.\n\t\tsetGuardImmutable(guardPath, false);\n\n\t\tif (fs.existsSync(gitPath)) {\n\t\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\t}\n\n\t\tfs.renameSync(guardPath, gitPath);\n\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * Moves the real `.git` to the guard dir and leaves a lightweight stub in its\n * place. The stub is a fresh `git init` whose index is copied from the real\n * repository, so `git ls-files` still reports the tracked files (deploy tools\n * enumerate them) while none of the history is exposed.\n *\n * On success it also writes an agent-facing `README.md` and an\n * `infracraft.lock` into the stub (so a coding agent that stumbles onto\n * the unusual state leaves it alone instead of \"fixing\" it), and best-effort\n * marks the moved-aside real history immutable via {@link setGuardImmutable} so\n * it cannot be accidentally restored while the deploy is in progress.\n *\n * Idempotent and safe to call on every `up`: it no-ops when there is no `.git`\n * to hide, and refuses to overwrite an existing guard dir (which would destroy\n * the real history captured by an earlier run).\n */\nexport function hideGit(monorepoRoot: string): void {\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\tconst guardPath = path.join(monorepoRoot, GUARD_DIR);\n\n\tif (!fs.existsSync(gitPath) || fs.existsSync(guardPath)) {\n\t\treturn;\n\t}\n\n\tfs.renameSync(gitPath, guardPath);\n\n\ttry {\n\t\texecFileSync(\"git\", [\"init\", \"--quiet\"], {\n\t\t\tcwd: monorepoRoot,\n\t\t\tstdio: \"ignore\",\n\t\t});\n\n\t\tconst realIndex = path.join(guardPath, \"index\");\n\n\t\tif (fs.existsSync(realIndex)) {\n\t\t\tfs.copyFileSync(realIndex, path.join(gitPath, \"index\"));\n\t\t}\n\t} catch (error) {\n\t\t// Re-expose the real `.git` so a failed stub creation never leaves the\n\t\t// repository without git metadata.\n\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\tfs.renameSync(guardPath, gitPath);\n\n\t\tthrow new Error(\n\t\t\t`[git-guard] Failed to create stub .git in ${monorepoRoot}: ${String(error)}`,\n\t\t);\n\t}\n\n\twriteStubMetadata(gitPath, GUARD_DIR);\n\n\tsetGuardImmutable(guardPath, true);\n}\n\n/**\n * Moves the real `.git` back from the guard dir, discarding the stub. No-ops when\n * there is nothing hidden. Failures are reported, not thrown, so a restore on\n * process exit can never crash the host — the manual recovery command is logged.\n */\nexport function restoreGit(monorepoRoot: string): void {\n\tconst guardPath = path.join(monorepoRoot, GUARD_DIR);\n\n\tif (!fs.existsSync(guardPath)) {\n\t\treturn;\n\t}\n\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\n\ttry {\n\t\t// Lift the immutability lock before moving the real history back, otherwise\n\t\t// the rename fails on a guard dir that hideGit marked immutable.\n\t\tsetGuardImmutable(guardPath, false);\n\n\t\tif (fs.existsSync(gitPath)) {\n\t\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\t}\n\n\t\tfs.renameSync(guardPath, gitPath);\n\t} catch {\n\t\tconsole.error(\n\t\t\t`[git-guard] Failed to restore .git. Run manually: rm -rf ${gitPath} && mv ${guardPath} ${gitPath}`,\n\t\t);\n\t}\n}\n\nexport function ensureGitignore(gitignorePath: string): void {\n\tconst content = fs.existsSync(gitignorePath)\n\t\t? fs.readFileSync(gitignorePath, \"utf-8\")\n\t\t: \"\";\n\n\tif (content.includes(GUARD_DIR)) {\n\t\treturn;\n\t}\n\n\tconst newline = content.length > 0 && !content.endsWith(\"\\n\") ? \"\\n\" : \"\";\n\n\tfs.appendFileSync(gitignorePath, `${newline}${GUARD_DIR}\\n`);\n}\n\n/**\n * Basename of the human/agent-facing explainer written into the stub `.git`.\n */\nexport const STUB_README_NAME = \"README.md\";\n\n/**\n * Basename of the lock file written into the stub `.git`. Its presence — with a\n * live `pid` — marks an in-progress deploy that owns the guard.\n */\nexport const LOCK_FILE_NAME = \"infracraft.lock\";\n\n/**\n * Builds the agent-facing explainer placed at `.git/README.md` inside the stub.\n *\n * An automated coding agent that trips over the unusual git state (an unborn\n * `main`; `git ls-files` works but `git log` fails with `unable to read <sha>`)\n * should read this and leave the repository alone instead of \"fixing\" it\n * mid-deploy.\n *\n * @param guardDir - Basename of the sibling dir holding the real, locked history\n */\nexport function buildStubReadme(guardDir: string): string {\n\treturn `# Managed STUB \\`.git\\` — do not modify or restore it\n\nThis is **not** the real repository. It is a lightweight stub created\nautomatically by [\\`@infracraft/pulumi\\`](https://github.com/andredezzy/infracraft)\n(the \\`git-guard\\`) while a deploy (\\`pulumi up\\` / \\`vercel deploy\\`) is in progress.\n\n## Why it exists\nDeploy tools would otherwise ingest the full git history. The guard moves the real\n\\`.git\\` aside to \\`../${guardDir}\\` and leaves this stub, copying only the index so\n\\`git ls-files\\` still lists tracked files for the deploy tool.\n\n## It restores itself — automatically\nWhen the deploy finishes (success or failure) the guard discards this stub and\nmoves the real \\`.git\\` back. **You do not need to do anything.**\n\n## DO NOT try to \"fix\" this\nWhile the deploy runs, the real history in \\`../${guardDir}\\` is **locked**\n(filesystem-immutable, best-effort). Do not run \\`git init\\` / \\`reset\\` / \\`checkout\\`\nhere, do not \\`rm -rf .git\\`, and do not \\`mv ../${guardDir} .git\\` — the move is\nintentionally blocked and will fail.\n\nSymptoms you can safely ignore: an unborn \\`main\\` branch; \\`git ls-files\\` works but\n\\`git log\\` / \\`git diff\\` fail with \\`unable to read <sha>\\` (the objects live in the\nlocked guard dir).\n\n## If a deploy crashed and this looks stuck\nThe guard self-heals on the next deploy. Only if you are certain no deploy is\nrunning, recover manually from the repo root:\n\n\\`\\`\\`sh\nchflags -R nouchg \"../${guardDir}\" 2>/dev/null || chattr -R -i \"../${guardDir}\" 2>/dev/null || true\nrm -rf .git && mv \"../${guardDir}\" .git\n\\`\\`\\`\n\nSee \\`./${LOCK_FILE_NAME}\\` for the owning process id and start time.\n`;\n}\n\n/**\n * Writes the stub explainer and the deploy lock into the freshly created stub\n * `.git`. Best-effort: the stub already satisfies deploy tools without these\n * files, so a write failure here must never abort an otherwise-successful hide.\n */\nfunction writeStubMetadata(gitPath: string, guardDir: string): void {\n\ttry {\n\t\tfs.writeFileSync(\n\t\t\tpath.join(gitPath, STUB_README_NAME),\n\t\t\tbuildStubReadme(guardDir),\n\t\t);\n\n\t\tconst lock = {\n\t\t\ttool: \"@infracraft/pulumi git-guard\",\n\t\t\tpid: process.pid,\n\t\t\tstartedAt: new Date().toISOString(),\n\t\t\thost: os.hostname(),\n\t\t\tguardDir,\n\t\t\tnote: \"Deploy in progress. The real .git is moved aside and locked. Do not restore it manually; it restores automatically when the deploy finishes.\",\n\t\t};\n\n\t\tfs.writeFileSync(\n\t\t\tpath.join(gitPath, LOCK_FILE_NAME),\n\t\t\t`${JSON.stringify(lock, null, 2)}\\n`,\n\t\t);\n\t} catch (error) {\n\t\tconsole.error(\n\t\t\t`[git-guard] Failed to write stub metadata: ${String(error)}`,\n\t\t);\n\t}\n}\n\n/**\n * Best-effort filesystem lock on the moved-aside real history so it cannot be\n * accidentally restored mid-deploy (e.g. a manual `mv` fails on an immutable\n * dir). Uses `chflags uchg` on macOS and `chattr +i` on Linux, and silently\n * no-ops where the flag is unsupported or not permitted (e.g. unprivileged CI) —\n * the lock is a guard rail, never a deploy blocker. The legitimate restore and\n * recover paths call this with `immutable = false` before moving the dir back.\n *\n * @param guardPath - Absolute path to the guard dir holding the real history\n * @param immutable - `true` to lock, `false` to unlock\n */\nexport function setGuardImmutable(guardPath: string, immutable: boolean): void {\n\tif (!fs.existsSync(guardPath)) {\n\t\treturn;\n\t}\n\n\ttry {\n\t\tif (process.platform === \"darwin\") {\n\t\t\texecFileSync(\n\t\t\t\t\"chflags\",\n\t\t\t\t[\"-R\", immutable ? \"uchg\" : \"nouchg\", guardPath],\n\t\t\t\t{ stdio: \"ignore\" },\n\t\t\t);\n\t\t} else if (process.platform === \"linux\") {\n\t\t\texecFileSync(\"chattr\", [\"-R\", immutable ? \"+i\" : \"-i\", guardPath], {\n\t\t\t\tstdio: \"ignore\",\n\t\t\t});\n\t\t}\n\t} catch {\n\t\t// Lacking the privilege to set the flag (common in CI) must never break the\n\t\t// guard — the lock is best-effort hardening, not a hard dependency.\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;;;;;;AAOzB,MAAa,oBAAoB,CAAC,4BAA4B;;AAO9D,MAAM,+BAAe,IAAI,IAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BrC,SAAgB,SAAS,cAAsC;CAC9D,gBAAgBA,UAAK,KAAK,cAAc,YAAY,CAAC;CAErD,MAAM,OAAOA,UAAK,QAAQ,YAAY;CAKtC,IAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAACC,uBAAQ,SAAS,GAAG;EAKnD,kBAAkB,YAAY;EAE9B,QAAQ,YAAY;EACpB,aAAa,IAAI,IAAI;EAErB,MAAM,gBAAsB,WAAW,YAAY;EAEnD,QAAQ,GAAG,QAAQ,OAAO;EAE1B,QAAQ,GAAG,gBAAgB;GAC1B,QAAQ;GACR,QAAQ,KAAK,CAAC;EACf,CAAC;EAED,QAAQ,GAAG,iBAAiB;GAC3B,QAAQ;GACR,QAAQ,KAAK,CAAC;EACf,CAAC;CACF;CAgBA,OAAO,EAAE,UAJQC,gBAAQ,MAAM,QAAQ,kBAAkB,EACxD,QAAQ,oEACT,CAEY,EAAE;AACf;;;;;;;;;;;;AAaA,SAAgB,kBAAkB,cAA+B;CAChE,MAAM,UAAUF,UAAK,KAAK,cAAc,MAAM;CAE9C,KAAK,MAAM,WAAW,CAAC,WAAW,GAAG,iBAAiB,GAAG;EACxD,MAAM,YAAYA,UAAK,KAAK,cAAc,OAAO;EAEjD,IAAI,CAACG,QAAG,WAAW,SAAS,GAC3B;EAKD,kBAAkB,WAAW,KAAK;EAElC,IAAIA,QAAG,WAAW,OAAO,GACxB,QAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAGpD,QAAG,WAAW,WAAW,OAAO;EAEhC,OAAO;CACR;CAEA,OAAO;AACR;;;;;;;;;;;;;;;;;AAkBA,SAAgB,QAAQ,cAA4B;CACnD,MAAM,UAAUH,UAAK,KAAK,cAAc,MAAM;CAC9C,MAAM,YAAYA,UAAK,KAAK,cAAc,SAAS;CAEnD,IAAI,CAACG,QAAG,WAAW,OAAO,KAAKA,QAAG,WAAW,SAAS,GACrD;CAGD,QAAG,WAAW,SAAS,SAAS;CAEhC,IAAI;EACH,qCAAa,OAAO,CAAC,QAAQ,SAAS,GAAG;GACxC,KAAK;GACL,OAAO;EACR,CAAC;EAED,MAAM,YAAYH,UAAK,KAAK,WAAW,OAAO;EAE9C,IAAIG,QAAG,WAAW,SAAS,GAC1B,QAAG,aAAa,WAAWH,UAAK,KAAK,SAAS,OAAO,CAAC;CAExD,SAAS,OAAO;EAGf,QAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACnD,QAAG,WAAW,WAAW,OAAO;EAEhC,MAAM,IAAI,MACT,6CAA6C,aAAa,IAAI,OAAO,KAAK,GAC3E;CACD;CAEA,kBAAkB,SAAS,SAAS;CAEpC,kBAAkB,WAAW,IAAI;AAClC;;;;;;AAOA,SAAgB,WAAW,cAA4B;CACtD,MAAM,YAAYA,UAAK,KAAK,cAAc,SAAS;CAEnD,IAAI,CAACG,QAAG,WAAW,SAAS,GAC3B;CAGD,MAAM,UAAUH,UAAK,KAAK,cAAc,MAAM;CAE9C,IAAI;EAGH,kBAAkB,WAAW,KAAK;EAElC,IAAIG,QAAG,WAAW,OAAO,GACxB,QAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAGpD,QAAG,WAAW,WAAW,OAAO;CACjC,QAAQ;EACP,QAAQ,MACP,4DAA4D,QAAQ,SAAS,UAAU,GAAG,SAC3F;CACD;AACD;AAEA,SAAgB,gBAAgB,eAA6B;CAC5D,MAAM,UAAUA,QAAG,WAAW,aAAa,IACxCA,QAAG,aAAa,eAAe,OAAO,IACtC;CAEH,IAAI,QAAQ,uCAAkB,GAC7B;CAGD,MAAM,UAAU,QAAQ,SAAS,KAAK,CAAC,QAAQ,SAAS,IAAI,IAAI,OAAO;CAEvE,QAAG,eAAe,eAAe,GAAG,UAAU,UAAU,GAAG;AAC5D;;;;AAKA,MAAa,mBAAmB;;;;;AAMhC,MAAa,iBAAiB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,UAA0B;CACzD,OAAO;;;;;;;;yBAQiB,SAAS;;;;;;;;kDAQgB,SAAS;;mDAER,SAAS;;;;;;;;;;;;wBAYpC,SAAS,oCAAoC,SAAS;wBACtD,SAAS;;;UAGvB,eAAe;;AAEzB;;;;;;AAOA,SAAS,kBAAkB,SAAiB,UAAwB;CACnE,IAAI;EACH,QAAG,cACFH,UAAK,KAAK,SAAS,gBAAgB,GACnC,gBAAgB,QAAQ,CACzB;EAEA,MAAM,OAAO;GACZ,MAAM;GACN,KAAK,QAAQ;GACb,4BAAW,IAAI,KAAK,GAAE,YAAY;GAClC,MAAMI,QAAG,SAAS;GAClB;GACA,MAAM;EACP;EAEA,QAAG,cACFJ,UAAK,KAAK,SAAS,cAAc,GACjC,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,EAAE,GAClC;CACD,SAAS,OAAO;EACf,QAAQ,MACP,8CAA8C,OAAO,KAAK,GAC3D;CACD;AACD;;;;;;;;;;;;AAaA,SAAgB,kBAAkB,WAAmB,WAA0B;CAC9E,IAAI,CAACG,QAAG,WAAW,SAAS,GAC3B;CAGD,IAAI;EACH,IAAI,QAAQ,aAAa,UACxB,qCACC,WACA;GAAC;GAAM,YAAY,SAAS;GAAU;EAAS,GAC/C,EAAE,OAAO,SAAS,CACnB;OACM,IAAI,QAAQ,aAAa,SAC/B,qCAAa,UAAU;GAAC;GAAM,YAAY,OAAO;GAAM;EAAS,GAAG,EAClE,OAAO,SACR,CAAC;CAEH,QAAQ,CAGR;AACD"}

package/dist/git-guard.d.cts

@@ -69,6 +69,12 @@ declare function recoverStaleGuard(monorepoRoot: string): boolean;
  * repository, so `git ls-files` still reports the tracked files (deploy tools
  * enumerate them) while none of the history is exposed.
  *
+ * On success it also writes an agent-facing `README.md` and an
+ * `infracraft.lock` into the stub (so a coding agent that stumbles onto
+ * the unusual state leaves it alone instead of "fixing" it), and best-effort
+ * marks the moved-aside real history immutable via {@link setGuardImmutable} so
+ * it cannot be accidentally restored while the deploy is in progress.
+ *
  * Idempotent and safe to call on every `up`: it no-ops when there is no `.git`
  * to hide, and refuses to overwrite an existing guard dir (which would destroy
  * the real history captured by an earlier run).
@@ -81,6 +87,38 @@ declare function hideGit(monorepoRoot: string): void;
  */
 declare function restoreGit(monorepoRoot: string): void;
 declare function ensureGitignore(gitignorePath: string): void;
+/**
+ * Basename of the human/agent-facing explainer written into the stub `.git`.
+ */
+declare const STUB_README_NAME = "README.md";
+/**
+ * Basename of the lock file written into the stub `.git`. Its presence — with a
+ * live `pid` — marks an in-progress deploy that owns the guard.
+ */
+declare const LOCK_FILE_NAME = "infracraft.lock";
+/**
+ * Builds the agent-facing explainer placed at `.git/README.md` inside the stub.
+ *
+ * An automated coding agent that trips over the unusual git state (an unborn
+ * `main`; `git ls-files` works but `git log` fails with `unable to read <sha>`)
+ * should read this and leave the repository alone instead of "fixing" it
+ * mid-deploy.
+ *
+ * @param guardDir - Basename of the sibling dir holding the real, locked history
+ */
+declare function buildStubReadme(guardDir: string): string;
+/**
+ * Best-effort filesystem lock on the moved-aside real history so it cannot be
+ * accidentally restored mid-deploy (e.g. a manual `mv` fails on an immutable
+ * dir). Uses `chflags uchg` on macOS and `chattr +i` on Linux, and silently
+ * no-ops where the flag is unsupported or not permitted (e.g. unprivileged CI) —
+ * the lock is a guard rail, never a deploy blocker. The legitimate restore and
+ * recover paths call this with `immutable = false` before moving the dir back.
+ *
+ * @param guardPath - Absolute path to the guard dir holding the real history
+ * @param immutable - `true` to lock, `false` to unlock
+ */
+declare function setGuardImmutable(guardPath: string, immutable: boolean): void;
 //#endregion
-export { GUARD_DIR, LEGACY_GUARD_DIRS, ensureGitignore, gitGuard, hideGit, recoverStaleGuard, restoreGit };
+export { GUARD_DIR, LEGACY_GUARD_DIRS, LOCK_FILE_NAME, STUB_README_NAME, buildStubReadme, ensureGitignore, gitGuard, hideGit, recoverStaleGuard, restoreGit, setGuardImmutable };
 //# sourceMappingURL=git-guard.d.cts.map

package/dist/git-guard.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"git-guard.d.cts","names":[],"sources":["../src/git-guard.ts"],"mappings":";;;;;;;AAgBA;;;;AAAsB;AAOtB;;cAPa,SAAA;;AAOkD;AAAC;;;cAAnD,iBAAA;AAAA,UAEH,cAAA;EACT,IAAA,EAAM,OAAA,CAAQ,KAAA,CAAM,OAAO;AAAA;;;AAAA;AAkC5B;;;;AAA8D;AA6D9D;;;;AAAsD;AAgCtD;;;;AAA4C;AAsC5C;;;;AAA+C;AAsB/C;;;;AAAqD;iBAzJrC,QAAA,CAAS,YAAA,WAAuB,cAAc;;;;;;;;;;;;iBA6D9C,iBAAA,CAAkB,YAAoB;;;;;;;;;;;iBAgCtC,OAAA,CAAQ,YAAoB;;;;;;iBAsC5B,UAAA,CAAW,YAAoB;AAAA,iBAsB/B,eAAA,CAAgB,aAAqB"}
+{"version":3,"file":"git-guard.d.cts","names":[],"sources":["../src/git-guard.ts"],"mappings":";;;;;;;AAiBA;;;;AAAsB;AAOtB;;cAPa,SAAA;;AAOkD;AAAC;;;cAAnD,iBAAA;AAAA,UAEH,cAAA;EACT,IAAA,EAAM,OAAA,CAAQ,KAAA,CAAM,OAAO;AAAA;;;AAAA;AAkC5B;;;;AAA8D;AA6D9D;;;;AAAsD;AA0CtD;;;;AAA4C;AA0C5C;;;;AAA+C;AA0B/C;;;;AAAqD;iBA3KrC,QAAA,CAAS,YAAA,WAAuB,cAAc;;;;AA4LjC;AAM7B;;;;AAA2B;AAY3B;;iBAjJgB,iBAAA,CAAkB,YAAoB;;AAiJN;AAkFhD;;;;AAAuE;;;;;;;;;;iBAzLvD,OAAA,CAAQ,YAAoB;;;;;;iBA0C5B,UAAA,CAAW,YAAoB;AAAA,iBA0B/B,eAAA,CAAgB,aAAqB;;;;cAiBxC,gBAAA;;;;;cAMA,cAAA;;;;;;;;;;;iBAYG,eAAA,CAAgB,QAAgB;;;;;;;;;;;;iBAkFhC,iBAAA,CAAkB,SAAA,UAAmB,SAAkB"}

package/dist/git-guard.d.mts

@@ -69,6 +69,12 @@ declare function recoverStaleGuard(monorepoRoot: string): boolean;
  * repository, so `git ls-files` still reports the tracked files (deploy tools
  * enumerate them) while none of the history is exposed.
  *
+ * On success it also writes an agent-facing `README.md` and an
+ * `infracraft.lock` into the stub (so a coding agent that stumbles onto
+ * the unusual state leaves it alone instead of "fixing" it), and best-effort
+ * marks the moved-aside real history immutable via {@link setGuardImmutable} so
+ * it cannot be accidentally restored while the deploy is in progress.
+ *
  * Idempotent and safe to call on every `up`: it no-ops when there is no `.git`
  * to hide, and refuses to overwrite an existing guard dir (which would destroy
  * the real history captured by an earlier run).
@@ -81,6 +87,38 @@ declare function hideGit(monorepoRoot: string): void;
  */
 declare function restoreGit(monorepoRoot: string): void;
 declare function ensureGitignore(gitignorePath: string): void;
+/**
+ * Basename of the human/agent-facing explainer written into the stub `.git`.
+ */
+declare const STUB_README_NAME = "README.md";
+/**
+ * Basename of the lock file written into the stub `.git`. Its presence — with a
+ * live `pid` — marks an in-progress deploy that owns the guard.
+ */
+declare const LOCK_FILE_NAME = "infracraft.lock";
+/**
+ * Builds the agent-facing explainer placed at `.git/README.md` inside the stub.
+ *
+ * An automated coding agent that trips over the unusual git state (an unborn
+ * `main`; `git ls-files` works but `git log` fails with `unable to read <sha>`)
+ * should read this and leave the repository alone instead of "fixing" it
+ * mid-deploy.
+ *
+ * @param guardDir - Basename of the sibling dir holding the real, locked history
+ */
+declare function buildStubReadme(guardDir: string): string;
+/**
+ * Best-effort filesystem lock on the moved-aside real history so it cannot be
+ * accidentally restored mid-deploy (e.g. a manual `mv` fails on an immutable
+ * dir). Uses `chflags uchg` on macOS and `chattr +i` on Linux, and silently
+ * no-ops where the flag is unsupported or not permitted (e.g. unprivileged CI) —
+ * the lock is a guard rail, never a deploy blocker. The legitimate restore and
+ * recover paths call this with `immutable = false` before moving the dir back.
+ *
+ * @param guardPath - Absolute path to the guard dir holding the real history
+ * @param immutable - `true` to lock, `false` to unlock
+ */
+declare function setGuardImmutable(guardPath: string, immutable: boolean): void;
 //#endregion
-export { GUARD_DIR, LEGACY_GUARD_DIRS, ensureGitignore, gitGuard, hideGit, recoverStaleGuard, restoreGit };
+export { GUARD_DIR, LEGACY_GUARD_DIRS, LOCK_FILE_NAME, STUB_README_NAME, buildStubReadme, ensureGitignore, gitGuard, hideGit, recoverStaleGuard, restoreGit, setGuardImmutable };
 //# sourceMappingURL=git-guard.d.mts.map

package/dist/git-guard.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"git-guard.d.mts","names":[],"sources":["../src/git-guard.ts"],"mappings":";;;;;;;AAgBA;;;;AAAsB;AAOtB;;cAPa,SAAA;;AAOkD;AAAC;;;cAAnD,iBAAA;AAAA,UAEH,cAAA;EACT,IAAA,EAAM,OAAA,CAAQ,KAAA,CAAM,OAAO;AAAA;;;AAAA;AAkC5B;;;;AAA8D;AA6D9D;;;;AAAsD;AAgCtD;;;;AAA4C;AAsC5C;;;;AAA+C;AAsB/C;;;;AAAqD;iBAzJrC,QAAA,CAAS,YAAA,WAAuB,cAAc;;;;;;;;;;;;iBA6D9C,iBAAA,CAAkB,YAAoB;;;;;;;;;;;iBAgCtC,OAAA,CAAQ,YAAoB;;;;;;iBAsC5B,UAAA,CAAW,YAAoB;AAAA,iBAsB/B,eAAA,CAAgB,aAAqB"}
+{"version":3,"file":"git-guard.d.mts","names":[],"sources":["../src/git-guard.ts"],"mappings":";;;;;;;AAiBA;;;;AAAsB;AAOtB;;cAPa,SAAA;;AAOkD;AAAC;;;cAAnD,iBAAA;AAAA,UAEH,cAAA;EACT,IAAA,EAAM,OAAA,CAAQ,KAAA,CAAM,OAAO;AAAA;;;AAAA;AAkC5B;;;;AAA8D;AA6D9D;;;;AAAsD;AA0CtD;;;;AAA4C;AA0C5C;;;;AAA+C;AA0B/C;;;;AAAqD;iBA3KrC,QAAA,CAAS,YAAA,WAAuB,cAAc;;;;AA4LjC;AAM7B;;;;AAA2B;AAY3B;;iBAjJgB,iBAAA,CAAkB,YAAoB;;AAiJN;AAkFhD;;;;AAAuE;;;;;;;;;;iBAzLvD,OAAA,CAAQ,YAAoB;;;;;;iBA0C5B,UAAA,CAAW,YAAoB;AAAA,iBA0B/B,eAAA,CAAgB,aAAqB;;;;cAiBxC,gBAAA;;;;;cAMA,cAAA;;;;;;;;;;;iBAYG,eAAA,CAAgB,QAAgB;;;;;;;;;;;;iBAkFhC,iBAAA,CAAkB,SAAA,UAAmB,SAAkB"}

package/dist/git-guard.mjs

@@ -1,6 +1,7 @@
 import { t as __name } from "./chunk-OPjESj5l.mjs";
 import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 import * as command from "@pulumi/command";
 import { runtime } from "@pulumi/pulumi";
@@ -89,6 +90,7 @@ function recoverStaleGuard(monorepoRoot) {
 	for (const dirName of [GUARD_DIR, ...LEGACY_GUARD_DIRS]) {
 		const guardPath = path.join(monorepoRoot, dirName);
 		if (!fs.existsSync(guardPath)) continue;
+		setGuardImmutable(guardPath, false);
 		if (fs.existsSync(gitPath)) fs.rmSync(gitPath, {
 			recursive: true,
 			force: true
@@ -104,6 +106,12 @@ function recoverStaleGuard(monorepoRoot) {
 * repository, so `git ls-files` still reports the tracked files (deploy tools
 * enumerate them) while none of the history is exposed.
 *
+* On success it also writes an agent-facing `README.md` and an
+* `infracraft.lock` into the stub (so a coding agent that stumbles onto
+* the unusual state leaves it alone instead of "fixing" it), and best-effort
+* marks the moved-aside real history immutable via {@link setGuardImmutable} so
+* it cannot be accidentally restored while the deploy is in progress.
+*
 * Idempotent and safe to call on every `up`: it no-ops when there is no `.git`
 * to hide, and refuses to overwrite an existing guard dir (which would destroy
 * the real history captured by an earlier run).
@@ -128,6 +136,8 @@ function hideGit(monorepoRoot) {
 		fs.renameSync(guardPath, gitPath);
 		throw new Error(`[git-guard] Failed to create stub .git in ${monorepoRoot}: ${String(error)}`);
 	}
+	writeStubMetadata(gitPath, GUARD_DIR);
+	setGuardImmutable(guardPath, true);
 }
 /**
 * Moves the real `.git` back from the guard dir, discarding the stub. No-ops when
@@ -139,6 +149,7 @@ function restoreGit(monorepoRoot) {
 	if (!fs.existsSync(guardPath)) return;
 	const gitPath = path.join(monorepoRoot, ".git");
 	try {
+		setGuardImmutable(guardPath, false);
 		if (fs.existsSync(gitPath)) fs.rmSync(gitPath, {
 			recursive: true,
 			force: true
@@ -154,7 +165,111 @@ function ensureGitignore(gitignorePath) {
 	const newline = content.length > 0 && !content.endsWith("\n") ? "\n" : "";
 	fs.appendFileSync(gitignorePath, `${newline}${GUARD_DIR}\n`);
 }
+/**
+* Basename of the human/agent-facing explainer written into the stub `.git`.
+*/
+const STUB_README_NAME = "README.md";
+/**
+* Basename of the lock file written into the stub `.git`. Its presence — with a
+* live `pid` — marks an in-progress deploy that owns the guard.
+*/
+const LOCK_FILE_NAME = "infracraft.lock";
+/**
+* Builds the agent-facing explainer placed at `.git/README.md` inside the stub.
+*
+* An automated coding agent that trips over the unusual git state (an unborn
+* `main`; `git ls-files` works but `git log` fails with `unable to read <sha>`)
+* should read this and leave the repository alone instead of "fixing" it
+* mid-deploy.
+*
+* @param guardDir - Basename of the sibling dir holding the real, locked history
+*/
+function buildStubReadme(guardDir) {
+	return `# Managed STUB \`.git\` — do not modify or restore it
+
+This is **not** the real repository. It is a lightweight stub created
+automatically by [\`@infracraft/pulumi\`](https://github.com/andredezzy/infracraft)
+(the \`git-guard\`) while a deploy (\`pulumi up\` / \`vercel deploy\`) is in progress.
+
+## Why it exists
+Deploy tools would otherwise ingest the full git history. The guard moves the real
+\`.git\` aside to \`../${guardDir}\` and leaves this stub, copying only the index so
+\`git ls-files\` still lists tracked files for the deploy tool.
+
+## It restores itself — automatically
+When the deploy finishes (success or failure) the guard discards this stub and
+moves the real \`.git\` back. **You do not need to do anything.**
+
+## DO NOT try to "fix" this
+While the deploy runs, the real history in \`../${guardDir}\` is **locked**
+(filesystem-immutable, best-effort). Do not run \`git init\` / \`reset\` / \`checkout\`
+here, do not \`rm -rf .git\`, and do not \`mv ../${guardDir} .git\` — the move is
+intentionally blocked and will fail.
+
+Symptoms you can safely ignore: an unborn \`main\` branch; \`git ls-files\` works but
+\`git log\` / \`git diff\` fail with \`unable to read <sha>\` (the objects live in the
+locked guard dir).
+
+## If a deploy crashed and this looks stuck
+The guard self-heals on the next deploy. Only if you are certain no deploy is
+running, recover manually from the repo root:
+
+\`\`\`sh
+chflags -R nouchg "../${guardDir}" 2>/dev/null || chattr -R -i "../${guardDir}" 2>/dev/null || true
+rm -rf .git && mv "../${guardDir}" .git
+\`\`\`
+
+See \`./${LOCK_FILE_NAME}\` for the owning process id and start time.
+`;
+}
+/**
+* Writes the stub explainer and the deploy lock into the freshly created stub
+* `.git`. Best-effort: the stub already satisfies deploy tools without these
+* files, so a write failure here must never abort an otherwise-successful hide.
+*/
+function writeStubMetadata(gitPath, guardDir) {
+	try {
+		fs.writeFileSync(path.join(gitPath, STUB_README_NAME), buildStubReadme(guardDir));
+		const lock = {
+			tool: "@infracraft/pulumi git-guard",
+			pid: process.pid,
+			startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			host: os.hostname(),
+			guardDir,
+			note: "Deploy in progress. The real .git is moved aside and locked. Do not restore it manually; it restores automatically when the deploy finishes."
+		};
+		fs.writeFileSync(path.join(gitPath, LOCK_FILE_NAME), `${JSON.stringify(lock, null, 2)}\n`);
+	} catch (error) {
+		console.error(`[git-guard] Failed to write stub metadata: ${String(error)}`);
+	}
+}
+/**
+* Best-effort filesystem lock on the moved-aside real history so it cannot be
+* accidentally restored mid-deploy (e.g. a manual `mv` fails on an immutable
+* dir). Uses `chflags uchg` on macOS and `chattr +i` on Linux, and silently
+* no-ops where the flag is unsupported or not permitted (e.g. unprivileged CI) —
+* the lock is a guard rail, never a deploy blocker. The legitimate restore and
+* recover paths call this with `immutable = false` before moving the dir back.
+*
+* @param guardPath - Absolute path to the guard dir holding the real history
+* @param immutable - `true` to lock, `false` to unlock
+*/
+function setGuardImmutable(guardPath, immutable) {
+	if (!fs.existsSync(guardPath)) return;
+	try {
+		if (process.platform === "darwin") execFileSync("chflags", [
+			"-R",
+			immutable ? "uchg" : "nouchg",
+			guardPath
+		], { stdio: "ignore" });
+		else if (process.platform === "linux") execFileSync("chattr", [
+			"-R",
+			immutable ? "+i" : "-i",
+			guardPath
+		], { stdio: "ignore" });
+	} catch {}
+}
 
 //#endregion
-export { GUARD_DIR, LEGACY_GUARD_DIRS, ensureGitignore, gitGuard, hideGit, recoverStaleGuard, restoreGit };
+export { GUARD_DIR, LEGACY_GUARD_DIRS, LOCK_FILE_NAME, STUB_README_NAME, buildStubReadme, ensureGitignore, gitGuard, hideGit, recoverStaleGuard, restoreGit, setGuardImmutable };
 //# sourceMappingURL=git-guard.mjs.map

package/dist/git-guard.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"git-guard.mjs","names":[],"sources":["../src/git-guard.ts"],"sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as command from \"@pulumi/command\";\nimport { runtime } from \"@pulumi/pulumi\";\n\n/**\n * Name of the directory the real `.git` is moved to while deploys run.\n *\n * This value changed from `.git-infrakit-pulumi-guard` to\n * `.git-infracraft-pulumi-guard`. A guard dir left under the old name by a crash\n * under a previous release is still recovered automatically (see\n * {@link LEGACY_GUARD_DIRS} and {@link recoverStaleGuard}), so the rename needs no\n * manual migration. Consumers that imported this constant to locate the guard dir\n * themselves should also account for {@link LEGACY_GUARD_DIRS}.\n */\nexport const GUARD_DIR = \".git-infracraft-pulumi-guard\";\n\n/**\n * Guard-dir names written by older releases. They are recovered on startup so a\n * repository left in a hidden state by a crash under a previous version of this\n * package self-heals on the next run.\n */\nexport const LEGACY_GUARD_DIRS = [\".git-infrakit-pulumi-guard\"];\n\ninterface GitGuardResult {\n\thide: command.local.Command;\n}\n\n/** Absolute monorepo roots already hidden in this process — keeps `gitGuard` idempotent. */\nconst guardedRoots = new Set<string>();\n\n/**\n * Hides the real `.git` so deploy tools (e.g. `vercel deploy`) do not ingest the\n * full git history during a `pulumi up`, then restores it once every dependent\n * deploy has finished.\n *\n * Hiding is performed **synchronously, in-process, on every invocation** — not\n * through a state-tracked `command.local.Command`. A command's `create` only\n * runs on first creation or when its `triggers` change, so a stack that had\n * already recorded the hide command would skip it on every subsequent `up`,\n * leaving the real `.git` exposed during deploys. Hiding is a host-side,\n * run-scoped side effect, not desired-state infrastructure, so it belongs in the\n * program lifecycle rather than the resource graph.\n *\n * Guarantees:\n * - `.git` is hidden before any resource is registered (and therefore before any\n *   dependent deploy command runs), on every `up`.\n * - `.git` is restored on success and on failure. On success the language host\n *   stays alive until every resource operation completes, so the `exit` handler\n *   fires after the deploys; on failure it may fire as soon as the event loop\n *   drains, but a failed deploy has already invalidated the update and restore\n *   only renames a local directory, so restoring early is harmless.\n * - A guard dir left behind by a hard-killed run (`kill -9`, OOM) is recovered on\n *   the next invocation, with no loss of real history.\n * - `pulumi preview` (dry run) moves nothing: it executes no deploy commands.\n *\n * @param monorepoRoot - Absolute path to the repository root containing `.git`\n * @returns `{ hide }` — a backward-compatible dependency anchor for `dependsOn`\n */\nexport function gitGuard(monorepoRoot: string): GitGuardResult {\n\tensureGitignore(path.join(monorepoRoot, \".gitignore\"));\n\n\tconst root = path.resolve(monorepoRoot);\n\n\t// Guard each root at most once per process. `pulumi preview` (dry run) runs the\n\t// program but executes no deploy commands, so it skips the move entirely —\n\t// preview never touches `.git`.\n\tif (!guardedRoots.has(root) && !runtime.isDryRun()) {\n\t\t// Self-heal first: a guard dir present at startup is the fingerprint of a\n\t\t// previous run that was killed before it could restore. Doing this only on\n\t\t// `up` (not preview) keeps preview side-effect free; skipping it on a repeat\n\t\t// call avoids treating the guard this process just created as a stale one.\n\t\trecoverStaleGuard(monorepoRoot);\n\n\t\thideGit(monorepoRoot);\n\t\tguardedRoots.add(root);\n\n\t\tconst restore = (): void => restoreGit(monorepoRoot);\n\n\t\tprocess.on(\"exit\", restore);\n\n\t\tprocess.on(\"SIGINT\", () => {\n\t\t\trestore();\n\t\t\tprocess.exit(0);\n\t\t});\n\n\t\tprocess.on(\"SIGTERM\", () => {\n\t\t\trestore();\n\t\t\tprocess.exit(0);\n\t\t});\n\t}\n\n\t// Backward-compatible dependency anchor. The real hide already ran\n\t// synchronously above — before any resource was registered — so consumers'\n\t// existing `dependsOn: [hide]` keeps compiling and still orders deploys after\n\t// the guard, without depending on a command whose static trigger skipped\n\t// re-runs.\n\t//\n\t// Upgrade note: the previous release built this resource with\n\t// `triggers: [stableDir(...)]`. Dropping `triggers` makes the first `pulumi up`\n\t// after upgrading REPLACE `git-guard-hide` once. The replace is harmless — there\n\t// is no delete step and the new create is a bare echo.\n\tconst hide = new command.local.Command(\"git-guard-hide\", {\n\t\tcreate: 'echo \"[git-guard] .git hidden in-process by @infracraft/pulumi\"',\n\t});\n\n\treturn { hide };\n}\n\n/**\n * Restores a guard dir left behind by a previously killed run.\n *\n * A guard dir only exists if a prior run moved the real `.git` aside and never\n * restored it. The current `.git` — if present — is the throwaway stub that\n * `git init` created and is safe to discard; the real history lives in the guard\n * dir and is moved back into place. Legacy guard names are recovered too, which\n * migrates a crashed older stack onto the current layout.\n *\n * @returns `true` if a stale guard dir was recovered, otherwise `false`\n */\nexport function recoverStaleGuard(monorepoRoot: string): boolean {\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\n\tfor (const dirName of [GUARD_DIR, ...LEGACY_GUARD_DIRS]) {\n\t\tconst guardPath = path.join(monorepoRoot, dirName);\n\n\t\tif (!fs.existsSync(guardPath)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (fs.existsSync(gitPath)) {\n\t\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\t}\n\n\t\tfs.renameSync(guardPath, gitPath);\n\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * Moves the real `.git` to the guard dir and leaves a lightweight stub in its\n * place. The stub is a fresh `git init` whose index is copied from the real\n * repository, so `git ls-files` still reports the tracked files (deploy tools\n * enumerate them) while none of the history is exposed.\n *\n * Idempotent and safe to call on every `up`: it no-ops when there is no `.git`\n * to hide, and refuses to overwrite an existing guard dir (which would destroy\n * the real history captured by an earlier run).\n */\nexport function hideGit(monorepoRoot: string): void {\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\tconst guardPath = path.join(monorepoRoot, GUARD_DIR);\n\n\tif (!fs.existsSync(gitPath) || fs.existsSync(guardPath)) {\n\t\treturn;\n\t}\n\n\tfs.renameSync(gitPath, guardPath);\n\n\ttry {\n\t\texecFileSync(\"git\", [\"init\", \"--quiet\"], {\n\t\t\tcwd: monorepoRoot,\n\t\t\tstdio: \"ignore\",\n\t\t});\n\n\t\tconst realIndex = path.join(guardPath, \"index\");\n\n\t\tif (fs.existsSync(realIndex)) {\n\t\t\tfs.copyFileSync(realIndex, path.join(gitPath, \"index\"));\n\t\t}\n\t} catch (error) {\n\t\t// Re-expose the real `.git` so a failed stub creation never leaves the\n\t\t// repository without git metadata.\n\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\tfs.renameSync(guardPath, gitPath);\n\n\t\tthrow new Error(\n\t\t\t`[git-guard] Failed to create stub .git in ${monorepoRoot}: ${String(error)}`,\n\t\t);\n\t}\n}\n\n/**\n * Moves the real `.git` back from the guard dir, discarding the stub. No-ops when\n * there is nothing hidden. Failures are reported, not thrown, so a restore on\n * process exit can never crash the host — the manual recovery command is logged.\n */\nexport function restoreGit(monorepoRoot: string): void {\n\tconst guardPath = path.join(monorepoRoot, GUARD_DIR);\n\n\tif (!fs.existsSync(guardPath)) {\n\t\treturn;\n\t}\n\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\n\ttry {\n\t\tif (fs.existsSync(gitPath)) {\n\t\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\t}\n\n\t\tfs.renameSync(guardPath, gitPath);\n\t} catch {\n\t\tconsole.error(\n\t\t\t`[git-guard] Failed to restore .git. Run manually: rm -rf ${gitPath} && mv ${guardPath} ${gitPath}`,\n\t\t);\n\t}\n}\n\nexport function ensureGitignore(gitignorePath: string): void {\n\tconst content = fs.existsSync(gitignorePath)\n\t\t? fs.readFileSync(gitignorePath, \"utf-8\")\n\t\t: \"\";\n\n\tif (content.includes(GUARD_DIR)) {\n\t\treturn;\n\t}\n\n\tconst newline = content.length > 0 && !content.endsWith(\"\\n\") ? \"\\n\" : \"\";\n\n\tfs.appendFileSync(gitignorePath, `${newline}${GUARD_DIR}\\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;;;;;;AAOzB,MAAa,oBAAoB,CAAC,4BAA4B;;AAO9D,MAAM,+BAAe,IAAI,IAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BrC,SAAgB,SAAS,cAAsC;CAC9D,gBAAgB,KAAK,KAAK,cAAc,YAAY,CAAC;CAErD,MAAM,OAAO,KAAK,QAAQ,YAAY;CAKtC,IAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAAC,QAAQ,SAAS,GAAG;EAKnD,kBAAkB,YAAY;EAE9B,QAAQ,YAAY;EACpB,aAAa,IAAI,IAAI;EAErB,MAAM,gBAAsB,WAAW,YAAY;EAEnD,QAAQ,GAAG,QAAQ,OAAO;EAE1B,QAAQ,GAAG,gBAAgB;GAC1B,QAAQ;GACR,QAAQ,KAAK,CAAC;EACf,CAAC;EAED,QAAQ,GAAG,iBAAiB;GAC3B,QAAQ;GACR,QAAQ,KAAK,CAAC;EACf,CAAC;CACF;CAgBA,OAAO,EAAE,UAJQ,QAAQ,MAAM,QAAQ,kBAAkB,EACxD,QAAQ,oEACT,CAEY,EAAE;AACf;;;;;;;;;;;;AAaA,SAAgB,kBAAkB,cAA+B;CAChE,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM;CAE9C,KAAK,MAAM,WAAW,CAAC,WAAW,GAAG,iBAAiB,GAAG;EACxD,MAAM,YAAY,KAAK,KAAK,cAAc,OAAO;EAEjD,IAAI,CAAC,GAAG,WAAW,SAAS,GAC3B;EAGD,IAAI,GAAG,WAAW,OAAO,GACxB,GAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAGpD,GAAG,WAAW,WAAW,OAAO;EAEhC,OAAO;CACR;CAEA,OAAO;AACR;;;;;;;;;;;AAYA,SAAgB,QAAQ,cAA4B;CACnD,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM;CAC9C,MAAM,YAAY,KAAK,KAAK,cAAc,SAAS;CAEnD,IAAI,CAAC,GAAG,WAAW,OAAO,KAAK,GAAG,WAAW,SAAS,GACrD;CAGD,GAAG,WAAW,SAAS,SAAS;CAEhC,IAAI;EACH,aAAa,OAAO,CAAC,QAAQ,SAAS,GAAG;GACxC,KAAK;GACL,OAAO;EACR,CAAC;EAED,MAAM,YAAY,KAAK,KAAK,WAAW,OAAO;EAE9C,IAAI,GAAG,WAAW,SAAS,GAC1B,GAAG,aAAa,WAAW,KAAK,KAAK,SAAS,OAAO,CAAC;CAExD,SAAS,OAAO;EAGf,GAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACnD,GAAG,WAAW,WAAW,OAAO;EAEhC,MAAM,IAAI,MACT,6CAA6C,aAAa,IAAI,OAAO,KAAK,GAC3E;CACD;AACD;;;;;;AAOA,SAAgB,WAAW,cAA4B;CACtD,MAAM,YAAY,KAAK,KAAK,cAAc,SAAS;CAEnD,IAAI,CAAC,GAAG,WAAW,SAAS,GAC3B;CAGD,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM;CAE9C,IAAI;EACH,IAAI,GAAG,WAAW,OAAO,GACxB,GAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAGpD,GAAG,WAAW,WAAW,OAAO;CACjC,QAAQ;EACP,QAAQ,MACP,4DAA4D,QAAQ,SAAS,UAAU,GAAG,SAC3F;CACD;AACD;AAEA,SAAgB,gBAAgB,eAA6B;CAC5D,MAAM,UAAU,GAAG,WAAW,aAAa,IACxC,GAAG,aAAa,eAAe,OAAO,IACtC;CAEH,IAAI,QAAQ,uCAAkB,GAC7B;CAGD,MAAM,UAAU,QAAQ,SAAS,KAAK,CAAC,QAAQ,SAAS,IAAI,IAAI,OAAO;CAEvE,GAAG,eAAe,eAAe,GAAG,UAAU,UAAU,GAAG;AAC5D"}
+{"version":3,"file":"git-guard.mjs","names":[],"sources":["../src/git-guard.ts"],"sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport * as command from \"@pulumi/command\";\nimport { runtime } from \"@pulumi/pulumi\";\n\n/**\n * Name of the directory the real `.git` is moved to while deploys run.\n *\n * This value changed from `.git-infrakit-pulumi-guard` to\n * `.git-infracraft-pulumi-guard`. A guard dir left under the old name by a crash\n * under a previous release is still recovered automatically (see\n * {@link LEGACY_GUARD_DIRS} and {@link recoverStaleGuard}), so the rename needs no\n * manual migration. Consumers that imported this constant to locate the guard dir\n * themselves should also account for {@link LEGACY_GUARD_DIRS}.\n */\nexport const GUARD_DIR = \".git-infracraft-pulumi-guard\";\n\n/**\n * Guard-dir names written by older releases. They are recovered on startup so a\n * repository left in a hidden state by a crash under a previous version of this\n * package self-heals on the next run.\n */\nexport const LEGACY_GUARD_DIRS = [\".git-infrakit-pulumi-guard\"];\n\ninterface GitGuardResult {\n\thide: command.local.Command;\n}\n\n/** Absolute monorepo roots already hidden in this process — keeps `gitGuard` idempotent. */\nconst guardedRoots = new Set<string>();\n\n/**\n * Hides the real `.git` so deploy tools (e.g. `vercel deploy`) do not ingest the\n * full git history during a `pulumi up`, then restores it once every dependent\n * deploy has finished.\n *\n * Hiding is performed **synchronously, in-process, on every invocation** — not\n * through a state-tracked `command.local.Command`. A command's `create` only\n * runs on first creation or when its `triggers` change, so a stack that had\n * already recorded the hide command would skip it on every subsequent `up`,\n * leaving the real `.git` exposed during deploys. Hiding is a host-side,\n * run-scoped side effect, not desired-state infrastructure, so it belongs in the\n * program lifecycle rather than the resource graph.\n *\n * Guarantees:\n * - `.git` is hidden before any resource is registered (and therefore before any\n *   dependent deploy command runs), on every `up`.\n * - `.git` is restored on success and on failure. On success the language host\n *   stays alive until every resource operation completes, so the `exit` handler\n *   fires after the deploys; on failure it may fire as soon as the event loop\n *   drains, but a failed deploy has already invalidated the update and restore\n *   only renames a local directory, so restoring early is harmless.\n * - A guard dir left behind by a hard-killed run (`kill -9`, OOM) is recovered on\n *   the next invocation, with no loss of real history.\n * - `pulumi preview` (dry run) moves nothing: it executes no deploy commands.\n *\n * @param monorepoRoot - Absolute path to the repository root containing `.git`\n * @returns `{ hide }` — a backward-compatible dependency anchor for `dependsOn`\n */\nexport function gitGuard(monorepoRoot: string): GitGuardResult {\n\tensureGitignore(path.join(monorepoRoot, \".gitignore\"));\n\n\tconst root = path.resolve(monorepoRoot);\n\n\t// Guard each root at most once per process. `pulumi preview` (dry run) runs the\n\t// program but executes no deploy commands, so it skips the move entirely —\n\t// preview never touches `.git`.\n\tif (!guardedRoots.has(root) && !runtime.isDryRun()) {\n\t\t// Self-heal first: a guard dir present at startup is the fingerprint of a\n\t\t// previous run that was killed before it could restore. Doing this only on\n\t\t// `up` (not preview) keeps preview side-effect free; skipping it on a repeat\n\t\t// call avoids treating the guard this process just created as a stale one.\n\t\trecoverStaleGuard(monorepoRoot);\n\n\t\thideGit(monorepoRoot);\n\t\tguardedRoots.add(root);\n\n\t\tconst restore = (): void => restoreGit(monorepoRoot);\n\n\t\tprocess.on(\"exit\", restore);\n\n\t\tprocess.on(\"SIGINT\", () => {\n\t\t\trestore();\n\t\t\tprocess.exit(0);\n\t\t});\n\n\t\tprocess.on(\"SIGTERM\", () => {\n\t\t\trestore();\n\t\t\tprocess.exit(0);\n\t\t});\n\t}\n\n\t// Backward-compatible dependency anchor. The real hide already ran\n\t// synchronously above — before any resource was registered — so consumers'\n\t// existing `dependsOn: [hide]` keeps compiling and still orders deploys after\n\t// the guard, without depending on a command whose static trigger skipped\n\t// re-runs.\n\t//\n\t// Upgrade note: the previous release built this resource with\n\t// `triggers: [stableDir(...)]`. Dropping `triggers` makes the first `pulumi up`\n\t// after upgrading REPLACE `git-guard-hide` once. The replace is harmless — there\n\t// is no delete step and the new create is a bare echo.\n\tconst hide = new command.local.Command(\"git-guard-hide\", {\n\t\tcreate: 'echo \"[git-guard] .git hidden in-process by @infracraft/pulumi\"',\n\t});\n\n\treturn { hide };\n}\n\n/**\n * Restores a guard dir left behind by a previously killed run.\n *\n * A guard dir only exists if a prior run moved the real `.git` aside and never\n * restored it. The current `.git` — if present — is the throwaway stub that\n * `git init` created and is safe to discard; the real history lives in the guard\n * dir and is moved back into place. Legacy guard names are recovered too, which\n * migrates a crashed older stack onto the current layout.\n *\n * @returns `true` if a stale guard dir was recovered, otherwise `false`\n */\nexport function recoverStaleGuard(monorepoRoot: string): boolean {\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\n\tfor (const dirName of [GUARD_DIR, ...LEGACY_GUARD_DIRS]) {\n\t\tconst guardPath = path.join(monorepoRoot, dirName);\n\n\t\tif (!fs.existsSync(guardPath)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// A crashed run may have left the guard dir immutable; lift the lock so the\n\t\t// recovery rename can proceed.\n\t\tsetGuardImmutable(guardPath, false);\n\n\t\tif (fs.existsSync(gitPath)) {\n\t\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\t}\n\n\t\tfs.renameSync(guardPath, gitPath);\n\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * Moves the real `.git` to the guard dir and leaves a lightweight stub in its\n * place. The stub is a fresh `git init` whose index is copied from the real\n * repository, so `git ls-files` still reports the tracked files (deploy tools\n * enumerate them) while none of the history is exposed.\n *\n * On success it also writes an agent-facing `README.md` and an\n * `infracraft.lock` into the stub (so a coding agent that stumbles onto\n * the unusual state leaves it alone instead of \"fixing\" it), and best-effort\n * marks the moved-aside real history immutable via {@link setGuardImmutable} so\n * it cannot be accidentally restored while the deploy is in progress.\n *\n * Idempotent and safe to call on every `up`: it no-ops when there is no `.git`\n * to hide, and refuses to overwrite an existing guard dir (which would destroy\n * the real history captured by an earlier run).\n */\nexport function hideGit(monorepoRoot: string): void {\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\tconst guardPath = path.join(monorepoRoot, GUARD_DIR);\n\n\tif (!fs.existsSync(gitPath) || fs.existsSync(guardPath)) {\n\t\treturn;\n\t}\n\n\tfs.renameSync(gitPath, guardPath);\n\n\ttry {\n\t\texecFileSync(\"git\", [\"init\", \"--quiet\"], {\n\t\t\tcwd: monorepoRoot,\n\t\t\tstdio: \"ignore\",\n\t\t});\n\n\t\tconst realIndex = path.join(guardPath, \"index\");\n\n\t\tif (fs.existsSync(realIndex)) {\n\t\t\tfs.copyFileSync(realIndex, path.join(gitPath, \"index\"));\n\t\t}\n\t} catch (error) {\n\t\t// Re-expose the real `.git` so a failed stub creation never leaves the\n\t\t// repository without git metadata.\n\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\tfs.renameSync(guardPath, gitPath);\n\n\t\tthrow new Error(\n\t\t\t`[git-guard] Failed to create stub .git in ${monorepoRoot}: ${String(error)}`,\n\t\t);\n\t}\n\n\twriteStubMetadata(gitPath, GUARD_DIR);\n\n\tsetGuardImmutable(guardPath, true);\n}\n\n/**\n * Moves the real `.git` back from the guard dir, discarding the stub. No-ops when\n * there is nothing hidden. Failures are reported, not thrown, so a restore on\n * process exit can never crash the host — the manual recovery command is logged.\n */\nexport function restoreGit(monorepoRoot: string): void {\n\tconst guardPath = path.join(monorepoRoot, GUARD_DIR);\n\n\tif (!fs.existsSync(guardPath)) {\n\t\treturn;\n\t}\n\n\tconst gitPath = path.join(monorepoRoot, \".git\");\n\n\ttry {\n\t\t// Lift the immutability lock before moving the real history back, otherwise\n\t\t// the rename fails on a guard dir that hideGit marked immutable.\n\t\tsetGuardImmutable(guardPath, false);\n\n\t\tif (fs.existsSync(gitPath)) {\n\t\t\tfs.rmSync(gitPath, { recursive: true, force: true });\n\t\t}\n\n\t\tfs.renameSync(guardPath, gitPath);\n\t} catch {\n\t\tconsole.error(\n\t\t\t`[git-guard] Failed to restore .git. Run manually: rm -rf ${gitPath} && mv ${guardPath} ${gitPath}`,\n\t\t);\n\t}\n}\n\nexport function ensureGitignore(gitignorePath: string): void {\n\tconst content = fs.existsSync(gitignorePath)\n\t\t? fs.readFileSync(gitignorePath, \"utf-8\")\n\t\t: \"\";\n\n\tif (content.includes(GUARD_DIR)) {\n\t\treturn;\n\t}\n\n\tconst newline = content.length > 0 && !content.endsWith(\"\\n\") ? \"\\n\" : \"\";\n\n\tfs.appendFileSync(gitignorePath, `${newline}${GUARD_DIR}\\n`);\n}\n\n/**\n * Basename of the human/agent-facing explainer written into the stub `.git`.\n */\nexport const STUB_README_NAME = \"README.md\";\n\n/**\n * Basename of the lock file written into the stub `.git`. Its presence — with a\n * live `pid` — marks an in-progress deploy that owns the guard.\n */\nexport const LOCK_FILE_NAME = \"infracraft.lock\";\n\n/**\n * Builds the agent-facing explainer placed at `.git/README.md` inside the stub.\n *\n * An automated coding agent that trips over the unusual git state (an unborn\n * `main`; `git ls-files` works but `git log` fails with `unable to read <sha>`)\n * should read this and leave the repository alone instead of \"fixing\" it\n * mid-deploy.\n *\n * @param guardDir - Basename of the sibling dir holding the real, locked history\n */\nexport function buildStubReadme(guardDir: string): string {\n\treturn `# Managed STUB \\`.git\\` — do not modify or restore it\n\nThis is **not** the real repository. It is a lightweight stub created\nautomatically by [\\`@infracraft/pulumi\\`](https://github.com/andredezzy/infracraft)\n(the \\`git-guard\\`) while a deploy (\\`pulumi up\\` / \\`vercel deploy\\`) is in progress.\n\n## Why it exists\nDeploy tools would otherwise ingest the full git history. The guard moves the real\n\\`.git\\` aside to \\`../${guardDir}\\` and leaves this stub, copying only the index so\n\\`git ls-files\\` still lists tracked files for the deploy tool.\n\n## It restores itself — automatically\nWhen the deploy finishes (success or failure) the guard discards this stub and\nmoves the real \\`.git\\` back. **You do not need to do anything.**\n\n## DO NOT try to \"fix\" this\nWhile the deploy runs, the real history in \\`../${guardDir}\\` is **locked**\n(filesystem-immutable, best-effort). Do not run \\`git init\\` / \\`reset\\` / \\`checkout\\`\nhere, do not \\`rm -rf .git\\`, and do not \\`mv ../${guardDir} .git\\` — the move is\nintentionally blocked and will fail.\n\nSymptoms you can safely ignore: an unborn \\`main\\` branch; \\`git ls-files\\` works but\n\\`git log\\` / \\`git diff\\` fail with \\`unable to read <sha>\\` (the objects live in the\nlocked guard dir).\n\n## If a deploy crashed and this looks stuck\nThe guard self-heals on the next deploy. Only if you are certain no deploy is\nrunning, recover manually from the repo root:\n\n\\`\\`\\`sh\nchflags -R nouchg \"../${guardDir}\" 2>/dev/null || chattr -R -i \"../${guardDir}\" 2>/dev/null || true\nrm -rf .git && mv \"../${guardDir}\" .git\n\\`\\`\\`\n\nSee \\`./${LOCK_FILE_NAME}\\` for the owning process id and start time.\n`;\n}\n\n/**\n * Writes the stub explainer and the deploy lock into the freshly created stub\n * `.git`. Best-effort: the stub already satisfies deploy tools without these\n * files, so a write failure here must never abort an otherwise-successful hide.\n */\nfunction writeStubMetadata(gitPath: string, guardDir: string): void {\n\ttry {\n\t\tfs.writeFileSync(\n\t\t\tpath.join(gitPath, STUB_README_NAME),\n\t\t\tbuildStubReadme(guardDir),\n\t\t);\n\n\t\tconst lock = {\n\t\t\ttool: \"@infracraft/pulumi git-guard\",\n\t\t\tpid: process.pid,\n\t\t\tstartedAt: new Date().toISOString(),\n\t\t\thost: os.hostname(),\n\t\t\tguardDir,\n\t\t\tnote: \"Deploy in progress. The real .git is moved aside and locked. Do not restore it manually; it restores automatically when the deploy finishes.\",\n\t\t};\n\n\t\tfs.writeFileSync(\n\t\t\tpath.join(gitPath, LOCK_FILE_NAME),\n\t\t\t`${JSON.stringify(lock, null, 2)}\\n`,\n\t\t);\n\t} catch (error) {\n\t\tconsole.error(\n\t\t\t`[git-guard] Failed to write stub metadata: ${String(error)}`,\n\t\t);\n\t}\n}\n\n/**\n * Best-effort filesystem lock on the moved-aside real history so it cannot be\n * accidentally restored mid-deploy (e.g. a manual `mv` fails on an immutable\n * dir). Uses `chflags uchg` on macOS and `chattr +i` on Linux, and silently\n * no-ops where the flag is unsupported or not permitted (e.g. unprivileged CI) —\n * the lock is a guard rail, never a deploy blocker. The legitimate restore and\n * recover paths call this with `immutable = false` before moving the dir back.\n *\n * @param guardPath - Absolute path to the guard dir holding the real history\n * @param immutable - `true` to lock, `false` to unlock\n */\nexport function setGuardImmutable(guardPath: string, immutable: boolean): void {\n\tif (!fs.existsSync(guardPath)) {\n\t\treturn;\n\t}\n\n\ttry {\n\t\tif (process.platform === \"darwin\") {\n\t\t\texecFileSync(\n\t\t\t\t\"chflags\",\n\t\t\t\t[\"-R\", immutable ? \"uchg\" : \"nouchg\", guardPath],\n\t\t\t\t{ stdio: \"ignore\" },\n\t\t\t);\n\t\t} else if (process.platform === \"linux\") {\n\t\t\texecFileSync(\"chattr\", [\"-R\", immutable ? \"+i\" : \"-i\", guardPath], {\n\t\t\t\tstdio: \"ignore\",\n\t\t\t});\n\t\t}\n\t} catch {\n\t\t// Lacking the privilege to set the flag (common in CI) must never break the\n\t\t// guard — the lock is best-effort hardening, not a hard dependency.\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;;;;;;AAOzB,MAAa,oBAAoB,CAAC,4BAA4B;;AAO9D,MAAM,+BAAe,IAAI,IAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BrC,SAAgB,SAAS,cAAsC;CAC9D,gBAAgB,KAAK,KAAK,cAAc,YAAY,CAAC;CAErD,MAAM,OAAO,KAAK,QAAQ,YAAY;CAKtC,IAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAAC,QAAQ,SAAS,GAAG;EAKnD,kBAAkB,YAAY;EAE9B,QAAQ,YAAY;EACpB,aAAa,IAAI,IAAI;EAErB,MAAM,gBAAsB,WAAW,YAAY;EAEnD,QAAQ,GAAG,QAAQ,OAAO;EAE1B,QAAQ,GAAG,gBAAgB;GAC1B,QAAQ;GACR,QAAQ,KAAK,CAAC;EACf,CAAC;EAED,QAAQ,GAAG,iBAAiB;GAC3B,QAAQ;GACR,QAAQ,KAAK,CAAC;EACf,CAAC;CACF;CAgBA,OAAO,EAAE,UAJQ,QAAQ,MAAM,QAAQ,kBAAkB,EACxD,QAAQ,oEACT,CAEY,EAAE;AACf;;;;;;;;;;;;AAaA,SAAgB,kBAAkB,cAA+B;CAChE,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM;CAE9C,KAAK,MAAM,WAAW,CAAC,WAAW,GAAG,iBAAiB,GAAG;EACxD,MAAM,YAAY,KAAK,KAAK,cAAc,OAAO;EAEjD,IAAI,CAAC,GAAG,WAAW,SAAS,GAC3B;EAKD,kBAAkB,WAAW,KAAK;EAElC,IAAI,GAAG,WAAW,OAAO,GACxB,GAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAGpD,GAAG,WAAW,WAAW,OAAO;EAEhC,OAAO;CACR;CAEA,OAAO;AACR;;;;;;;;;;;;;;;;;AAkBA,SAAgB,QAAQ,cAA4B;CACnD,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM;CAC9C,MAAM,YAAY,KAAK,KAAK,cAAc,SAAS;CAEnD,IAAI,CAAC,GAAG,WAAW,OAAO,KAAK,GAAG,WAAW,SAAS,GACrD;CAGD,GAAG,WAAW,SAAS,SAAS;CAEhC,IAAI;EACH,aAAa,OAAO,CAAC,QAAQ,SAAS,GAAG;GACxC,KAAK;GACL,OAAO;EACR,CAAC;EAED,MAAM,YAAY,KAAK,KAAK,WAAW,OAAO;EAE9C,IAAI,GAAG,WAAW,SAAS,GAC1B,GAAG,aAAa,WAAW,KAAK,KAAK,SAAS,OAAO,CAAC;CAExD,SAAS,OAAO;EAGf,GAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACnD,GAAG,WAAW,WAAW,OAAO;EAEhC,MAAM,IAAI,MACT,6CAA6C,aAAa,IAAI,OAAO,KAAK,GAC3E;CACD;CAEA,kBAAkB,SAAS,SAAS;CAEpC,kBAAkB,WAAW,IAAI;AAClC;;;;;;AAOA,SAAgB,WAAW,cAA4B;CACtD,MAAM,YAAY,KAAK,KAAK,cAAc,SAAS;CAEnD,IAAI,CAAC,GAAG,WAAW,SAAS,GAC3B;CAGD,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM;CAE9C,IAAI;EAGH,kBAAkB,WAAW,KAAK;EAElC,IAAI,GAAG,WAAW,OAAO,GACxB,GAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAGpD,GAAG,WAAW,WAAW,OAAO;CACjC,QAAQ;EACP,QAAQ,MACP,4DAA4D,QAAQ,SAAS,UAAU,GAAG,SAC3F;CACD;AACD;AAEA,SAAgB,gBAAgB,eAA6B;CAC5D,MAAM,UAAU,GAAG,WAAW,aAAa,IACxC,GAAG,aAAa,eAAe,OAAO,IACtC;CAEH,IAAI,QAAQ,uCAAkB,GAC7B;CAGD,MAAM,UAAU,QAAQ,SAAS,KAAK,CAAC,QAAQ,SAAS,IAAI,IAAI,OAAO;CAEvE,GAAG,eAAe,eAAe,GAAG,UAAU,UAAU,GAAG;AAC5D;;;;AAKA,MAAa,mBAAmB;;;;;AAMhC,MAAa,iBAAiB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,UAA0B;CACzD,OAAO;;;;;;;;yBAQiB,SAAS;;;;;;;;kDAQgB,SAAS;;mDAER,SAAS;;;;;;;;;;;;wBAYpC,SAAS,oCAAoC,SAAS;wBACtD,SAAS;;;UAGvB,eAAe;;AAEzB;;;;;;AAOA,SAAS,kBAAkB,SAAiB,UAAwB;CACnE,IAAI;EACH,GAAG,cACF,KAAK,KAAK,SAAS,gBAAgB,GACnC,gBAAgB,QAAQ,CACzB;EAEA,MAAM,OAAO;GACZ,MAAM;GACN,KAAK,QAAQ;GACb,4BAAW,IAAI,KAAK,GAAE,YAAY;GAClC,MAAM,GAAG,SAAS;GAClB;GACA,MAAM;EACP;EAEA,GAAG,cACF,KAAK,KAAK,SAAS,cAAc,GACjC,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,EAAE,GAClC;CACD,SAAS,OAAO;EACf,QAAQ,MACP,8CAA8C,OAAO,KAAK,GAC3D;CACD;AACD;;;;;;;;;;;;AAaA,SAAgB,kBAAkB,WAAmB,WAA0B;CAC9E,IAAI,CAAC,GAAG,WAAW,SAAS,GAC3B;CAGD,IAAI;EACH,IAAI,QAAQ,aAAa,UACxB,aACC,WACA;GAAC;GAAM,YAAY,SAAS;GAAU;EAAS,GAC/C,EAAE,OAAO,SAAS,CACnB;OACM,IAAI,QAAQ,aAAa,SAC/B,aAAa,UAAU;GAAC;GAAM,YAAY,OAAO;GAAM;EAAS,GAAG,EAClE,OAAO,SACR,CAAC;CAEH,QAAQ,CAGR;AACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@infracraft/pulumi",
-	"version": "1.14.0",
+	"version": "1.15.1",
 	"type": "module",
 	"license": "MIT",
 	"repository": {