@infracraft/pulumi 1.15.1 → 1.16.1

package/dist/deploy-command.cjs

@@ -0,0 +1,50 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('./chunk-BVYJZCqc.cjs');
+const require_git_guard = require('./git-guard.cjs');
+const require_sandbox = require('./sandbox.cjs');
+let _pulumi_command = require("@pulumi/command");
+_pulumi_command = require_chunk.__toESM(_pulumi_command, 1);
+let _pulumi_pulumi = require("@pulumi/pulumi");
+_pulumi_pulumi = require_chunk.__toESM(_pulumi_pulumi, 1);
+
+//#region src/deploy-command.ts
+/** Reads a `dependsOn` opt into a flat array of resource instances. */
+function dependsOnList(opts) {
+	const dep = opts.dependsOn;
+	if (Array.isArray(dep)) return dep;
+	return dep ? [dep] : [];
+}
+/**
+* Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:
+* a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.
+* The platform deploy resources call ONLY this; they never touch the sandbox.
+*/
+function createDeployCommand(args, opts) {
+	const deps = dependsOnList(opts);
+	const sandbox = deps.some(require_sandbox.isDeploySandbox);
+	const gitGuard = deps.some(require_git_guard.isGitGuard);
+	if (gitGuard && !sandbox) throw new Error(`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`);
+	const env = _pulumi_pulumi.getStack();
+	const create = _pulumi_pulumi.output(args.cli).apply((cli) => require_sandbox.buildSandboxScript({
+		sandbox,
+		gitGuard,
+		appName: args.name.replace(/-deploy$/, ""),
+		env,
+		excludePaths: args.excludePaths,
+		setup: args.setup,
+		cli
+	}));
+	const cmd = new _pulumi_command.local.Command(args.name, {
+		create,
+		triggers: args.triggers,
+		environment: args.environment
+	}, opts);
+	return {
+		command: cmd,
+		deploymentUrl: cmd.stdout.apply((out) => out.trim().split("\n").pop() ?? "")
+	};
+}
+
+//#endregion
+exports.createDeployCommand = createDeployCommand;
+//# sourceMappingURL=deploy-command.cjs.map

package/dist/deploy-command.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-command.cjs","names":["isDeploySandbox","isGitGuard","pulumi","buildSandboxScript","command"],"sources":["../src/deploy-command.ts"],"sourcesContent":["// src/deploy-command.ts\nimport * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { isGitGuard } from \"./git-guard\";\nimport { buildSandboxScript, isDeploySandbox } from \"./sandbox\";\n\nexport interface CreateDeployCommandArgs {\n\t/** Resource name; the child command is `<name>` and the sandbox dir uses it. */\n\tname: string;\n\t/** Fully-formed platform deploy command (may be an Output, e.g. Railway). */\n\tcli: pulumi.Input<string>;\n\t/** Redeploy triggers (source/env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Upload-scoping excludes (applied only in stub mode). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Env passed to the command (secrets that survive preview; not the inlined ones). */\n\tenvironment?: Record<string, pulumi.Input<string>>;\n}\n\nexport interface CreateDeployCommandResult {\n\tcommand: command.local.Command;\n\t/** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */\n\tdeploymentUrl: pulumi.Output<string>;\n}\n\n/** Reads a `dependsOn` opt into a flat array of resource instances. */\nfunction dependsOnList(opts: pulumi.ComponentResourceOptions): unknown[] {\n\tconst dep = opts.dependsOn;\n\n\tif (Array.isArray(dep)) {\n\t\treturn dep;\n\t}\n\n\treturn dep ? [dep] : [];\n}\n\n/**\n * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:\n * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.\n * The platform deploy resources call ONLY this; they never touch the sandbox.\n */\nexport function createDeployCommand(\n\targs: CreateDeployCommandArgs,\n\topts: pulumi.ComponentResourceOptions,\n): CreateDeployCommandResult {\n\tconst deps = dependsOnList(opts);\n\tconst sandbox = deps.some(isDeploySandbox);\n\tconst gitGuard = deps.some(isGitGuard);\n\n\tif (gitGuard && !sandbox) {\n\t\tthrow new Error(\n\t\t\t`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`,\n\t\t);\n\t}\n\n\tconst env = pulumi.getStack();\n\n\tconst create = pulumi.output(args.cli).apply((cli) =>\n\t\tbuildSandboxScript({\n\t\t\tsandbox,\n\t\t\tgitGuard,\n\t\t\tappName: args.name.replace(/-deploy$/, \"\"),\n\t\t\tenv,\n\t\t\texcludePaths: args.excludePaths,\n\t\t\tsetup: args.setup,\n\t\t\tcli,\n\t\t}),\n\t);\n\n\tconst cmd = new command.local.Command(\n\t\targs.name,\n\t\t{ create, triggers: args.triggers, environment: args.environment },\n\t\topts,\n\t);\n\n\tconst deploymentUrl = cmd.stdout.apply(\n\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t);\n\n\treturn { command: cmd, deploymentUrl };\n}\n"],"mappings":";;;;;;;;;;;AA6BA,SAAS,cAAc,MAAkD;CACxE,MAAM,MAAM,KAAK;CAEjB,IAAI,MAAM,QAAQ,GAAG,GACpB,OAAO;CAGR,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACvB;;;;;;AAOA,SAAgB,oBACf,MACA,MAC4B;CAC5B,MAAM,OAAO,cAAc,IAAI;CAC/B,MAAM,UAAU,KAAK,KAAKA,+BAAe;CACzC,MAAM,WAAW,KAAK,KAAKC,4BAAU;CAErC,IAAI,YAAY,CAAC,SAChB,MAAM,IAAI,MACT,gBAAgB,KAAK,KAAK,8DAC3B;CAGD,MAAM,MAAMC,eAAO,SAAS;CAE5B,MAAM,SAASA,eAAO,OAAO,KAAK,GAAG,EAAE,OAAO,QAC7CC,mCAAmB;EAClB;EACA;EACA,SAAS,KAAK,KAAK,QAAQ,YAAY,EAAE;EACzC;EACA,cAAc,KAAK;EACnB,OAAO,KAAK;EACZ;CACD,CAAC,CACF;CAEA,MAAM,MAAM,IAAIC,gBAAQ,MAAM,QAC7B,KAAK,MACL;EAAE;EAAQ,UAAU,KAAK;EAAU,aAAa,KAAK;CAAY,GACjE,IACD;CAMA,OAAO;EAAE,SAAS;EAAK,eAJD,IAAI,OAAO,OAC/B,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAGP;CAAE;AACtC"}

package/dist/deploy-command.d.cts

@@ -0,0 +1,33 @@
+import { t as __name } from "./chunk-OPjESj5l.cjs";
+import * as command from "@pulumi/command";
+import * as pulumi from "@pulumi/pulumi";
+
+//#region src/deploy-command.d.ts
+interface CreateDeployCommandArgs {
+  /** Resource name; the child command is `<name>` and the sandbox dir uses it. */
+  name: string;
+  /** Fully-formed platform deploy command (may be an Output, e.g. Railway). */
+  cli: pulumi.Input<string>;
+  /** Redeploy triggers (source/env hashes). */
+  triggers: pulumi.Input<pulumi.Input<string>[]>;
+  /** Upload-scoping excludes (applied only in stub mode). */
+  excludePaths?: string[];
+  /** Shell run in the working dir before `cli` (e.g. write railpack.json). */
+  setup?: string;
+  /** Env passed to the command (secrets that survive preview; not the inlined ones). */
+  environment?: Record<string, pulumi.Input<string>>;
+}
+interface CreateDeployCommandResult {
+  command: command.local.Command;
+  /** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */
+  deploymentUrl: pulumi.Output<string>;
+}
+/**
+ * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:
+ * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.
+ * The platform deploy resources call ONLY this; they never touch the sandbox.
+ */
+declare function createDeployCommand(args: CreateDeployCommandArgs, opts: pulumi.ComponentResourceOptions): CreateDeployCommandResult;
+//#endregion
+export { CreateDeployCommandArgs, CreateDeployCommandResult, createDeployCommand };
+//# sourceMappingURL=deploy-command.d.cts.map

package/dist/deploy-command.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-command.d.cts","names":[],"sources":["../src/deploy-command.ts"],"mappings":";;;;;UAOiB,uBAAA;;EAEhB,IAAA;EAFgB;EAIhB,GAAA,EAAK,MAAA,CAAO,KAAA;;EAEZ,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAAP;EAEvB,YAAA;EAI6B;EAF7B,KAAA;EAEoB;EAApB,WAAA,GAAc,MAAA,SAAe,MAAA,CAAO,KAAA;AAAA;AAAA,UAGpB,yBAAA;EAChB,OAAA,EAAS,OAAA,CAAQ,KAAA,CAAM,OAAA;EAZX;EAcZ,aAAA,EAAe,MAAA,CAAO,MAAM;AAAA;;;;;;iBAmBb,mBAAA,CACf,IAAA,EAAM,uBAAA,EACN,IAAA,EAAM,MAAA,CAAO,wBAAA,GACX,yBAAA"}

package/dist/deploy-command.d.mts

@@ -0,0 +1,33 @@
+import { t as __name } from "./chunk-OPjESj5l.mjs";
+import * as command from "@pulumi/command";
+import * as pulumi from "@pulumi/pulumi";
+
+//#region src/deploy-command.d.ts
+interface CreateDeployCommandArgs {
+  /** Resource name; the child command is `<name>` and the sandbox dir uses it. */
+  name: string;
+  /** Fully-formed platform deploy command (may be an Output, e.g. Railway). */
+  cli: pulumi.Input<string>;
+  /** Redeploy triggers (source/env hashes). */
+  triggers: pulumi.Input<pulumi.Input<string>[]>;
+  /** Upload-scoping excludes (applied only in stub mode). */
+  excludePaths?: string[];
+  /** Shell run in the working dir before `cli` (e.g. write railpack.json). */
+  setup?: string;
+  /** Env passed to the command (secrets that survive preview; not the inlined ones). */
+  environment?: Record<string, pulumi.Input<string>>;
+}
+interface CreateDeployCommandResult {
+  command: command.local.Command;
+  /** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */
+  deploymentUrl: pulumi.Output<string>;
+}
+/**
+ * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:
+ * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.
+ * The platform deploy resources call ONLY this; they never touch the sandbox.
+ */
+declare function createDeployCommand(args: CreateDeployCommandArgs, opts: pulumi.ComponentResourceOptions): CreateDeployCommandResult;
+//#endregion
+export { CreateDeployCommandArgs, CreateDeployCommandResult, createDeployCommand };
+//# sourceMappingURL=deploy-command.d.mts.map

package/dist/deploy-command.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-command.d.mts","names":[],"sources":["../src/deploy-command.ts"],"mappings":";;;;;UAOiB,uBAAA;;EAEhB,IAAA;EAFgB;EAIhB,GAAA,EAAK,MAAA,CAAO,KAAA;;EAEZ,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAAP;EAEvB,YAAA;EAI6B;EAF7B,KAAA;EAEoB;EAApB,WAAA,GAAc,MAAA,SAAe,MAAA,CAAO,KAAA;AAAA;AAAA,UAGpB,yBAAA;EAChB,OAAA,EAAS,OAAA,CAAQ,KAAA,CAAM,OAAA;EAZX;EAcZ,aAAA,EAAe,MAAA,CAAO,MAAM;AAAA;;;;;;iBAmBb,mBAAA,CACf,IAAA,EAAM,uBAAA,EACN,IAAA,EAAM,MAAA,CAAO,wBAAA,GACX,yBAAA"}

package/dist/deploy-command.mjs

@@ -0,0 +1,47 @@
+import { t as __name } from "./chunk-OPjESj5l.mjs";
+import { isGitGuard } from "./git-guard.mjs";
+import { buildSandboxScript, isDeploySandbox } from "./sandbox.mjs";
+import * as command from "@pulumi/command";
+import * as pulumi from "@pulumi/pulumi";
+
+//#region src/deploy-command.ts
+/** Reads a `dependsOn` opt into a flat array of resource instances. */
+function dependsOnList(opts) {
+	const dep = opts.dependsOn;
+	if (Array.isArray(dep)) return dep;
+	return dep ? [dep] : [];
+}
+/**
+* Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:
+* a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.
+* The platform deploy resources call ONLY this; they never touch the sandbox.
+*/
+function createDeployCommand(args, opts) {
+	const deps = dependsOnList(opts);
+	const sandbox = deps.some(isDeploySandbox);
+	const gitGuard = deps.some(isGitGuard);
+	if (gitGuard && !sandbox) throw new Error(`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`);
+	const env = pulumi.getStack();
+	const create = pulumi.output(args.cli).apply((cli) => buildSandboxScript({
+		sandbox,
+		gitGuard,
+		appName: args.name.replace(/-deploy$/, ""),
+		env,
+		excludePaths: args.excludePaths,
+		setup: args.setup,
+		cli
+	}));
+	const cmd = new command.local.Command(args.name, {
+		create,
+		triggers: args.triggers,
+		environment: args.environment
+	}, opts);
+	return {
+		command: cmd,
+		deploymentUrl: cmd.stdout.apply((out) => out.trim().split("\n").pop() ?? "")
+	};
+}
+
+//#endregion
+export { createDeployCommand };
+//# sourceMappingURL=deploy-command.mjs.map

package/dist/deploy-command.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-command.mjs","names":[],"sources":["../src/deploy-command.ts"],"sourcesContent":["// src/deploy-command.ts\nimport * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { isGitGuard } from \"./git-guard\";\nimport { buildSandboxScript, isDeploySandbox } from \"./sandbox\";\n\nexport interface CreateDeployCommandArgs {\n\t/** Resource name; the child command is `<name>` and the sandbox dir uses it. */\n\tname: string;\n\t/** Fully-formed platform deploy command (may be an Output, e.g. Railway). */\n\tcli: pulumi.Input<string>;\n\t/** Redeploy triggers (source/env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Upload-scoping excludes (applied only in stub mode). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Env passed to the command (secrets that survive preview; not the inlined ones). */\n\tenvironment?: Record<string, pulumi.Input<string>>;\n}\n\nexport interface CreateDeployCommandResult {\n\tcommand: command.local.Command;\n\t/** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */\n\tdeploymentUrl: pulumi.Output<string>;\n}\n\n/** Reads a `dependsOn` opt into a flat array of resource instances. */\nfunction dependsOnList(opts: pulumi.ComponentResourceOptions): unknown[] {\n\tconst dep = opts.dependsOn;\n\n\tif (Array.isArray(dep)) {\n\t\treturn dep;\n\t}\n\n\treturn dep ? [dep] : [];\n}\n\n/**\n * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:\n * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.\n * The platform deploy resources call ONLY this; they never touch the sandbox.\n */\nexport function createDeployCommand(\n\targs: CreateDeployCommandArgs,\n\topts: pulumi.ComponentResourceOptions,\n): CreateDeployCommandResult {\n\tconst deps = dependsOnList(opts);\n\tconst sandbox = deps.some(isDeploySandbox);\n\tconst gitGuard = deps.some(isGitGuard);\n\n\tif (gitGuard && !sandbox) {\n\t\tthrow new Error(\n\t\t\t`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`,\n\t\t);\n\t}\n\n\tconst env = pulumi.getStack();\n\n\tconst create = pulumi.output(args.cli).apply((cli) =>\n\t\tbuildSandboxScript({\n\t\t\tsandbox,\n\t\t\tgitGuard,\n\t\t\tappName: args.name.replace(/-deploy$/, \"\"),\n\t\t\tenv,\n\t\t\texcludePaths: args.excludePaths,\n\t\t\tsetup: args.setup,\n\t\t\tcli,\n\t\t}),\n\t);\n\n\tconst cmd = new command.local.Command(\n\t\targs.name,\n\t\t{ create, triggers: args.triggers, environment: args.environment },\n\t\topts,\n\t);\n\n\tconst deploymentUrl = cmd.stdout.apply(\n\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t);\n\n\treturn { command: cmd, deploymentUrl };\n}\n"],"mappings":";;;;;;;;AA6BA,SAAS,cAAc,MAAkD;CACxE,MAAM,MAAM,KAAK;CAEjB,IAAI,MAAM,QAAQ,GAAG,GACpB,OAAO;CAGR,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACvB;;;;;;AAOA,SAAgB,oBACf,MACA,MAC4B;CAC5B,MAAM,OAAO,cAAc,IAAI;CAC/B,MAAM,UAAU,KAAK,KAAK,eAAe;CACzC,MAAM,WAAW,KAAK,KAAK,UAAU;CAErC,IAAI,YAAY,CAAC,SAChB,MAAM,IAAI,MACT,gBAAgB,KAAK,KAAK,8DAC3B;CAGD,MAAM,MAAM,OAAO,SAAS;CAE5B,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG,EAAE,OAAO,QAC7C,mBAAmB;EAClB;EACA;EACA,SAAS,KAAK,KAAK,QAAQ,YAAY,EAAE;EACzC;EACA,cAAc,KAAK;EACnB,OAAO,KAAK;EACZ;CACD,CAAC,CACF;CAEA,MAAM,MAAM,IAAI,QAAQ,MAAM,QAC7B,KAAK,MACL;EAAE;EAAQ,UAAU,KAAK;EAAU,aAAa,KAAK;CAAY,GACjE,IACD;CAMA,OAAO;EAAE,SAAS;EAAK,eAJD,IAAI,OAAO,OAC/B,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAGP;CAAE;AACtC"}

package/dist/fly/deploy.cjs

@@ -1,27 +1,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_chunk = require('../chunk-BVYJZCqc.cjs');
-const require_stable_dir = require('../stable-dir.cjs');
+const require_deploy_command = require('../deploy-command.cjs');
 const require_fly_toml = require('./toml.cjs');
-let _pulumi_command = require("@pulumi/command");
-_pulumi_command = require_chunk.__toESM(_pulumi_command, 1);
 let _pulumi_pulumi = require("@pulumi/pulumi");
 _pulumi_pulumi = require_chunk.__toESM(_pulumi_pulumi, 1);
 
 //#region src/fly/deploy.ts
 /**
-* Deploys a Fly app via `fly deploy --remote-only`, driven by a generated
-* fly.toml. The toml is written by the deploy command itself (at execution
-* time, not during `pulumi preview`) to `<monorepoRoot>/.fly/<app>.toml`, and
-* its content is added to the redeploy triggers (so config changes redeploy).
-*
-* @example
-* ```typescript
-* new FlyDeploy("api-deploy", {
-*   monorepoRoot,
-*   config: { app: "rby-api", primaryRegion: "iad", build: { dockerfile: "apps/api/Dockerfile" } },
-*   triggers: [hashDirectory("apps/api"), secrets.version],
-* }, { provider, app, dependsOn: [secrets] });
-* ```
+* Deploys a Fly app via `fly deploy --remote-only` from a generated fly.toml.
+* Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).
 */
 var FlyDeploy = class extends _pulumi_pulumi.ComponentResource {
 	constructor(name, args, opts) {
@@ -32,23 +19,26 @@ var FlyDeploy = class extends _pulumi_pulumi.ComponentResource {
 		const waitTimeout = args.waitTimeout ?? 300;
 		const releaseCommandTimeout = args.releaseCommandTimeout ?? 600;
 		const highAvailability = args.highAvailability ?? false;
-		const deployCommand = [
-			"mkdir -p .fly",
-			`printf '%s' "$FLY_TOML_CONTENT" > ${configPath}`,
-			`fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`
-		].join(" && ");
+		const setup = `mkdir -p .fly && printf '%s' "$FLY_TOML_CONTENT" > ${configPath}`;
+		const cli = `fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`;
 		const triggers = _pulumi_pulumi.output(args.triggers).apply((values) => [...values, tomlContent]);
-		new _pulumi_command.local.Command(`${name}-deploy`, {
-			create: deployCommand,
+		let consumerDeps;
+		if (Array.isArray(pulumiOpts.dependsOn)) consumerDeps = pulumiOpts.dependsOn;
+		else if (pulumiOpts.dependsOn) consumerDeps = [pulumiOpts.dependsOn];
+		else consumerDeps = [];
+		require_deploy_command.createDeployCommand({
+			name: `${name}-deploy`,
+			cli,
 			triggers,
-			dir: require_stable_dir.stableDir(args.monorepoRoot),
+			setup,
 			environment: {
 				FLY_API_TOKEN: provider.token,
 				FLY_TOML_CONTENT: tomlContent
 			}
 		}, {
+			...pulumiOpts,
 			parent: this,
-			dependsOn: [app]
+			dependsOn: [app, ...consumerDeps]
 		});
 		this.registerOutputs({});
 	}

package/dist/fly/deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.cjs","names":["pulumi","generateFlyToml","command","stableDir"],"sources":["../../src/fly/deploy.ts"],"sourcesContent":["import * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { stableDir } from \"../stable-dir\";\nimport type { FlyApp } from \"./app\";\nimport type { FlyProvider } from \"./provider\";\nimport { type FlyTomlConfig, generateFlyToml } from \"./toml\";\n\n/** Options type for FlyDeploy. */\ntype FlyDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\t/** Fly authentication context. */\n\tprovider: FlyProvider;\n\n\t/** App to deploy into. */\n\tapp: FlyApp;\n};\n\n/** Args for FlyDeploy. */\nexport interface FlyDeployArgs {\n\t/**\n\t * Absolute path to the repo root (working directory for `fly deploy`).\n\t * Stored relative to the Pulumi program directory so the command stays stable\n\t * across machines and CI (see {@link stableDir}).\n\t */\n\tmonorepoRoot: string;\n\n\t/**\n\t * fly.toml configuration. `config.app` must equal the FlyApp name. All values\n\t * are plain (not `pulumi.Input`) — resolve Outputs before constructing this.\n\t */\n\tconfig: FlyTomlConfig;\n\n\t/**\n\t * Values that force a redeploy when changed (e.g. a source hash from\n\t * `hashDirectory()` and `FlySecret.version`). The generated toml content is\n\t * appended automatically.\n\t */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\n\t/** `fly deploy --wait-timeout` in seconds (default 300). */\n\twaitTimeout?: number;\n\n\t/** `fly deploy --release-command-timeout` in seconds (default 600). */\n\treleaseCommandTimeout?: number;\n\n\t/** `fly deploy --ha` (default false). */\n\thighAvailability?: boolean;\n}\n\n/**\n * Deploys a Fly app via `fly deploy --remote-only`, driven by a generated\n * fly.toml. The toml is written by the deploy command itself (at execution\n * time, not during `pulumi preview`) to `<monorepoRoot>/.fly/<app>.toml`, and\n * its content is added to the redeploy triggers (so config changes redeploy).\n *\n * @example\n * ```typescript\n * new FlyDeploy(\"api-deploy\", {\n *   monorepoRoot,\n *   config: { app: \"rby-api\", primaryRegion: \"iad\", build: { dockerfile: \"apps/api/Dockerfile\" } },\n *   triggers: [hashDirectory(\"apps/api\"), secrets.version],\n * }, { provider, app, dependsOn: [secrets] });\n * ```\n */\nexport class FlyDeploy extends pulumi.ComponentResource {\n\tconstructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions) {\n\t\tconst { provider, app, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:fly:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst tomlContent = generateFlyToml(args.config);\n\t\tconst configPath = `.fly/${args.config.app}.toml`;\n\n\t\tconst waitTimeout = args.waitTimeout ?? 300;\n\t\tconst releaseCommandTimeout = args.releaseCommandTimeout ?? 600;\n\t\tconst highAvailability = args.highAvailability ?? false;\n\n\t\t// The toml is written by the command at execution time. The content\n\t\t// arrives via the FLY_TOML_CONTENT env var (avoiding shell escaping) so\n\t\t// no file is touched during `pulumi preview`.\n\t\tconst deployCommand = [\n\t\t\t\"mkdir -p .fly\",\n\t\t\t`printf '%s' \"$FLY_TOML_CONTENT\" > ${configPath}`,\n\t\t\t`fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`,\n\t\t].join(\" && \");\n\n\t\tconst triggers = pulumi\n\t\t\t.output(args.triggers)\n\t\t\t.apply((values) => [...values, tomlContent]);\n\n\t\tnew command.local.Command(\n\t\t\t`${name}-deploy`,\n\t\t\t{\n\t\t\t\tcreate: deployCommand,\n\t\t\t\ttriggers,\n\t\t\t\tdir: stableDir(args.monorepoRoot),\n\t\t\t\tenvironment: {\n\t\t\t\t\tFLY_API_TOKEN: provider.token,\n\t\t\t\t\tFLY_TOML_CONTENT: tomlContent,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ parent: this, dependsOn: [app] },\n\t\t);\n\n\t\tthis.registerOutputs({});\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAgEA,IAAa,YAAb,cAA+BA,eAAO,kBAAkB;CACvD,YAAY,MAAc,MAAqB,MAAwB;EACtE,MAAM,EAAE,UAAU,KAAK,GAAG,eAAe;EAEzC,MAAM,yBAAyB,MAAM,CAAC,GAAG,UAAU;EAEnD,MAAM,cAAcC,iCAAgB,KAAK,MAAM;EAC/C,MAAM,aAAa,QAAQ,KAAK,OAAO,IAAI;EAE3C,MAAM,cAAc,KAAK,eAAe;EACxC,MAAM,wBAAwB,KAAK,yBAAyB;EAC5D,MAAM,mBAAmB,KAAK,oBAAoB;EAKlD,MAAM,gBAAgB;GACrB;GACA,qCAAqC;GACrC,uBAAuB,WAAW,sBAAsB,iBAAiB,kBAAkB,YAAY,6BAA6B;EACrI,EAAE,KAAK,MAAM;EAEb,MAAM,WAAWD,eACf,OAAO,KAAK,QAAQ,EACpB,OAAO,WAAW,CAAC,GAAG,QAAQ,WAAW,CAAC;EAE5C,IAAIE,gBAAQ,MAAM,QACjB,GAAG,KAAK,UACR;GACC,QAAQ;GACR;GACA,KAAKC,6BAAU,KAAK,YAAY;GAChC,aAAa;IACZ,eAAe,SAAS;IACxB,kBAAkB;GACnB;EACD,GACA;GAAE,QAAQ;GAAM,WAAW,CAAC,GAAG;EAAE,CAClC;EAEA,KAAK,gBAAgB,CAAC,CAAC;CACxB;AACD"}
+{"version":3,"file":"deploy.cjs","names":["pulumi","generateFlyToml"],"sources":["../../src/fly/deploy.ts"],"sourcesContent":["// src/fly/deploy.ts  (replace entire file)\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../deploy-command\";\nimport type { FlyApp } from \"./app\";\nimport type { FlyProvider } from \"./provider\";\nimport { type FlyTomlConfig, generateFlyToml } from \"./toml\";\n\ntype FlyDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\tprovider: FlyProvider;\n\tapp: FlyApp;\n};\n\nexport interface FlyDeployArgs {\n\t/** fly.toml configuration. `config.app` must equal the FlyApp name. */\n\tconfig: FlyTomlConfig;\n\t/** Redeploy triggers; the generated toml content is appended automatically. */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** `fly deploy --wait-timeout` seconds (default 300). */\n\twaitTimeout?: number;\n\t/** `fly deploy --release-command-timeout` seconds (default 600). */\n\treleaseCommandTimeout?: number;\n\t/** `fly deploy --ha` (default false). */\n\thighAvailability?: boolean;\n}\n\n/**\n * Deploys a Fly app via `fly deploy --remote-only` from a generated fly.toml.\n * Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).\n */\nexport class FlyDeploy extends pulumi.ComponentResource {\n\tconstructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions) {\n\t\tconst { provider, app, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:fly:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst tomlContent = generateFlyToml(args.config);\n\t\tconst configPath = `.fly/${args.config.app}.toml`;\n\n\t\tconst waitTimeout = args.waitTimeout ?? 300;\n\t\tconst releaseCommandTimeout = args.releaseCommandTimeout ?? 600;\n\t\tconst highAvailability = args.highAvailability ?? false;\n\n\t\t// The toml content arrives via FLY_TOML_CONTENT (avoids shell escaping).\n\t\tconst setup = `mkdir -p .fly && printf '%s' \"$FLY_TOML_CONTENT\" > ${configPath}`;\n\t\tconst cli = `fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`;\n\n\t\tconst triggers = pulumi\n\t\t\t.output(args.triggers)\n\t\t\t.apply((values) => [...values, tomlContent]);\n\n\t\tlet consumerDeps: pulumi.Resource[];\n\n\t\tif (Array.isArray(pulumiOpts.dependsOn)) {\n\t\t\tconsumerDeps = pulumiOpts.dependsOn as pulumi.Resource[];\n\t\t} else if (pulumiOpts.dependsOn) {\n\t\t\tconsumerDeps = [pulumiOpts.dependsOn as pulumi.Resource];\n\t\t} else {\n\t\t\tconsumerDeps = [];\n\t\t}\n\n\t\tcreateDeployCommand(\n\t\t\t{\n\t\t\t\tname: `${name}-deploy`,\n\t\t\t\tcli,\n\t\t\t\ttriggers,\n\t\t\t\tsetup,\n\t\t\t\tenvironment: {\n\t\t\t\t\tFLY_API_TOKEN: provider.token,\n\t\t\t\t\tFLY_TOML_CONTENT: tomlContent,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ ...pulumiOpts, parent: this, dependsOn: [app, ...consumerDeps] },\n\t\t);\n\n\t\tthis.registerOutputs({});\n\t}\n}\n"],"mappings":";;;;;;;;;;;;AA8BA,IAAa,YAAb,cAA+BA,eAAO,kBAAkB;CACvD,YAAY,MAAc,MAAqB,MAAwB;EACtE,MAAM,EAAE,UAAU,KAAK,GAAG,eAAe;EAEzC,MAAM,yBAAyB,MAAM,CAAC,GAAG,UAAU;EAEnD,MAAM,cAAcC,iCAAgB,KAAK,MAAM;EAC/C,MAAM,aAAa,QAAQ,KAAK,OAAO,IAAI;EAE3C,MAAM,cAAc,KAAK,eAAe;EACxC,MAAM,wBAAwB,KAAK,yBAAyB;EAC5D,MAAM,mBAAmB,KAAK,oBAAoB;EAGlD,MAAM,QAAQ,sDAAsD;EACpE,MAAM,MAAM,uBAAuB,WAAW,sBAAsB,iBAAiB,kBAAkB,YAAY,6BAA6B;EAEhJ,MAAM,WAAWD,eACf,OAAO,KAAK,QAAQ,EACpB,OAAO,WAAW,CAAC,GAAG,QAAQ,WAAW,CAAC;EAE5C,IAAI;EAEJ,IAAI,MAAM,QAAQ,WAAW,SAAS,GACrC,eAAe,WAAW;OACpB,IAAI,WAAW,WACrB,eAAe,CAAC,WAAW,SAA4B;OAEvD,eAAe,CAAC;EAGjB,2CACC;GACC,MAAM,GAAG,KAAK;GACd;GACA;GACA;GACA,aAAa;IACZ,eAAe,SAAS;IACxB,kBAAkB;GACnB;EACD,GACA;GAAE,GAAG;GAAY,QAAQ;GAAM,WAAW,CAAC,KAAK,GAAG,YAAY;EAAE,CAClE;EAEA,KAAK,gBAAgB,CAAC,CAAC;CACxB;AACD"}

package/dist/fly/deploy.d.cts

@@ -5,51 +5,25 @@ import { FlyTomlConfig } from "./toml.cjs";
 import * as pulumi from "@pulumi/pulumi";
 
 //#region src/fly/deploy.d.ts
-/** Options type for FlyDeploy. */
 type FlyDeployOptions = Omit<pulumi.ComponentResourceOptions, "provider"> & {
-  /** Fly authentication context. */provider: FlyProvider; /** App to deploy into. */
+  provider: FlyProvider;
   app: FlyApp;
 };
-/** Args for FlyDeploy. */
 interface FlyDeployArgs {
-  /**
-   * Absolute path to the repo root (working directory for `fly deploy`).
-   * Stored relative to the Pulumi program directory so the command stays stable
-   * across machines and CI (see {@link stableDir}).
-   */
-  monorepoRoot: string;
-  /**
-   * fly.toml configuration. `config.app` must equal the FlyApp name. All values
-   * are plain (not `pulumi.Input`) — resolve Outputs before constructing this.
-   */
+  /** fly.toml configuration. `config.app` must equal the FlyApp name. */
   config: FlyTomlConfig;
-  /**
-   * Values that force a redeploy when changed (e.g. a source hash from
-   * `hashDirectory()` and `FlySecret.version`). The generated toml content is
-   * appended automatically.
-   */
+  /** Redeploy triggers; the generated toml content is appended automatically. */
   triggers: pulumi.Input<pulumi.Input<string>[]>;
-  /** `fly deploy --wait-timeout` in seconds (default 300). */
+  /** `fly deploy --wait-timeout` seconds (default 300). */
   waitTimeout?: number;
-  /** `fly deploy --release-command-timeout` in seconds (default 600). */
+  /** `fly deploy --release-command-timeout` seconds (default 600). */
   releaseCommandTimeout?: number;
   /** `fly deploy --ha` (default false). */
   highAvailability?: boolean;
 }
 /**
- * Deploys a Fly app via `fly deploy --remote-only`, driven by a generated
- * fly.toml. The toml is written by the deploy command itself (at execution
- * time, not during `pulumi preview`) to `<monorepoRoot>/.fly/<app>.toml`, and
- * its content is added to the redeploy triggers (so config changes redeploy).
- *
- * @example
- * ```typescript
- * new FlyDeploy("api-deploy", {
- *   monorepoRoot,
- *   config: { app: "rby-api", primaryRegion: "iad", build: { dockerfile: "apps/api/Dockerfile" } },
- *   triggers: [hashDirectory("apps/api"), secrets.version],
- * }, { provider, app, dependsOn: [secrets] });
- * ```
+ * Deploys a Fly app via `fly deploy --remote-only` from a generated fly.toml.
+ * Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).
  */
 declare class FlyDeploy extends pulumi.ComponentResource {
   constructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions);

package/dist/fly/deploy.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/fly/deploy.ts"],"mappings":";;;;;;;;KASK,gBAAA,GAAmB,IAAA,CAAK,MAAA,CAAO,wBAAA;oCAEnC,QAAA,EAAU,WAAA,EAFU;EAKpB,GAAA,EAAK,MAAA;AAAA;;UAIW,aAAA;EAJX;;;;;EAUL,YAAA;EAbA;;;;EAmBA,MAAA,EAAQ,aAAA;EAhBG;AAIZ;;;;EAmBC,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAApB;EAGV,WAAA;EAHsB;EAMtB,qBAAA;EAbA;EAgBA,gBAAA;AAAA;;;;;;;;;AAAgB;AAkBjB;;;;;;cAAa,SAAA,SAAkB,MAAA,CAAO,iBAAA;cACzB,IAAA,UAAc,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,gBAAA;AAAA"}
+{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/fly/deploy.ts"],"mappings":";;;;;;;KAQK,gBAAA,GAAmB,IAAA,CAAK,MAAA,CAAO,wBAAA;EACnC,QAAA,EAAU,WAAA;EACV,GAAA,EAAK,MAAA;AAAA;AAAA,UAGW,aAAA;;EAEhB,MAAA,EAAQ,aAAA;EAPe;EASvB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPzB;EASL,WAAA;EATW;EAWX,qBAAA;EAb4B;EAe5B,gBAAA;AAAA;;;;;cAOY,SAAA,SAAkB,MAAA,CAAO,iBAAA;cACzB,IAAA,UAAc,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,gBAAA;AAAA"}

package/dist/fly/deploy.d.mts

@@ -5,51 +5,25 @@ import { FlyTomlConfig } from "./toml.mjs";
 import * as pulumi from "@pulumi/pulumi";
 
 //#region src/fly/deploy.d.ts
-/** Options type for FlyDeploy. */
 type FlyDeployOptions = Omit<pulumi.ComponentResourceOptions, "provider"> & {
-  /** Fly authentication context. */provider: FlyProvider; /** App to deploy into. */
+  provider: FlyProvider;
   app: FlyApp;
 };
-/** Args for FlyDeploy. */
 interface FlyDeployArgs {
-  /**
-   * Absolute path to the repo root (working directory for `fly deploy`).
-   * Stored relative to the Pulumi program directory so the command stays stable
-   * across machines and CI (see {@link stableDir}).
-   */
-  monorepoRoot: string;
-  /**
-   * fly.toml configuration. `config.app` must equal the FlyApp name. All values
-   * are plain (not `pulumi.Input`) — resolve Outputs before constructing this.
-   */
+  /** fly.toml configuration. `config.app` must equal the FlyApp name. */
   config: FlyTomlConfig;
-  /**
-   * Values that force a redeploy when changed (e.g. a source hash from
-   * `hashDirectory()` and `FlySecret.version`). The generated toml content is
-   * appended automatically.
-   */
+  /** Redeploy triggers; the generated toml content is appended automatically. */
   triggers: pulumi.Input<pulumi.Input<string>[]>;
-  /** `fly deploy --wait-timeout` in seconds (default 300). */
+  /** `fly deploy --wait-timeout` seconds (default 300). */
   waitTimeout?: number;
-  /** `fly deploy --release-command-timeout` in seconds (default 600). */
+  /** `fly deploy --release-command-timeout` seconds (default 600). */
   releaseCommandTimeout?: number;
   /** `fly deploy --ha` (default false). */
   highAvailability?: boolean;
 }
 /**
- * Deploys a Fly app via `fly deploy --remote-only`, driven by a generated
- * fly.toml. The toml is written by the deploy command itself (at execution
- * time, not during `pulumi preview`) to `<monorepoRoot>/.fly/<app>.toml`, and
- * its content is added to the redeploy triggers (so config changes redeploy).
- *
- * @example
- * ```typescript
- * new FlyDeploy("api-deploy", {
- *   monorepoRoot,
- *   config: { app: "rby-api", primaryRegion: "iad", build: { dockerfile: "apps/api/Dockerfile" } },
- *   triggers: [hashDirectory("apps/api"), secrets.version],
- * }, { provider, app, dependsOn: [secrets] });
- * ```
+ * Deploys a Fly app via `fly deploy --remote-only` from a generated fly.toml.
+ * Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).
  */
 declare class FlyDeploy extends pulumi.ComponentResource {
   constructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions);

package/dist/fly/deploy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/fly/deploy.ts"],"mappings":";;;;;;;;KASK,gBAAA,GAAmB,IAAA,CAAK,MAAA,CAAO,wBAAA;oCAEnC,QAAA,EAAU,WAAA,EAFU;EAKpB,GAAA,EAAK,MAAA;AAAA;;UAIW,aAAA;EAJX;;;;;EAUL,YAAA;EAbA;;;;EAmBA,MAAA,EAAQ,aAAA;EAhBG;AAIZ;;;;EAmBC,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAApB;EAGV,WAAA;EAHsB;EAMtB,qBAAA;EAbA;EAgBA,gBAAA;AAAA;;;;;;;;;AAAgB;AAkBjB;;;;;;cAAa,SAAA,SAAkB,MAAA,CAAO,iBAAA;cACzB,IAAA,UAAc,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,gBAAA;AAAA"}
+{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/fly/deploy.ts"],"mappings":";;;;;;;KAQK,gBAAA,GAAmB,IAAA,CAAK,MAAA,CAAO,wBAAA;EACnC,QAAA,EAAU,WAAA;EACV,GAAA,EAAK,MAAA;AAAA;AAAA,UAGW,aAAA;;EAEhB,MAAA,EAAQ,aAAA;EAPe;EASvB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPzB;EASL,WAAA;EATW;EAWX,qBAAA;EAb4B;EAe5B,gBAAA;AAAA;;;;;cAOY,SAAA,SAAkB,MAAA,CAAO,iBAAA;cACzB,IAAA,UAAc,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,gBAAA;AAAA"}

package/dist/fly/deploy.mjs

@@ -1,24 +1,12 @@
 import { t as __name } from "../chunk-OPjESj5l.mjs";
-import { stableDir } from "../stable-dir.mjs";
+import { createDeployCommand } from "../deploy-command.mjs";
 import { generateFlyToml } from "./toml.mjs";
-import * as command from "@pulumi/command";
 import * as pulumi from "@pulumi/pulumi";
 
 //#region src/fly/deploy.ts
 /**
-* Deploys a Fly app via `fly deploy --remote-only`, driven by a generated
-* fly.toml. The toml is written by the deploy command itself (at execution
-* time, not during `pulumi preview`) to `<monorepoRoot>/.fly/<app>.toml`, and
-* its content is added to the redeploy triggers (so config changes redeploy).
-*
-* @example
-* ```typescript
-* new FlyDeploy("api-deploy", {
-*   monorepoRoot,
-*   config: { app: "rby-api", primaryRegion: "iad", build: { dockerfile: "apps/api/Dockerfile" } },
-*   triggers: [hashDirectory("apps/api"), secrets.version],
-* }, { provider, app, dependsOn: [secrets] });
-* ```
+* Deploys a Fly app via `fly deploy --remote-only` from a generated fly.toml.
+* Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).
 */
 var FlyDeploy = class extends pulumi.ComponentResource {
 	constructor(name, args, opts) {
@@ -29,23 +17,26 @@ var FlyDeploy = class extends pulumi.ComponentResource {
 		const waitTimeout = args.waitTimeout ?? 300;
 		const releaseCommandTimeout = args.releaseCommandTimeout ?? 600;
 		const highAvailability = args.highAvailability ?? false;
-		const deployCommand = [
-			"mkdir -p .fly",
-			`printf '%s' "$FLY_TOML_CONTENT" > ${configPath}`,
-			`fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`
-		].join(" && ");
+		const setup = `mkdir -p .fly && printf '%s' "$FLY_TOML_CONTENT" > ${configPath}`;
+		const cli = `fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`;
 		const triggers = pulumi.output(args.triggers).apply((values) => [...values, tomlContent]);
-		new command.local.Command(`${name}-deploy`, {
-			create: deployCommand,
+		let consumerDeps;
+		if (Array.isArray(pulumiOpts.dependsOn)) consumerDeps = pulumiOpts.dependsOn;
+		else if (pulumiOpts.dependsOn) consumerDeps = [pulumiOpts.dependsOn];
+		else consumerDeps = [];
+		createDeployCommand({
+			name: `${name}-deploy`,
+			cli,
 			triggers,
-			dir: stableDir(args.monorepoRoot),
+			setup,
 			environment: {
 				FLY_API_TOKEN: provider.token,
 				FLY_TOML_CONTENT: tomlContent
 			}
 		}, {
+			...pulumiOpts,
 			parent: this,
-			dependsOn: [app]
+			dependsOn: [app, ...consumerDeps]
 		});
 		this.registerOutputs({});
 	}

package/dist/fly/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/fly/deploy.ts"],"sourcesContent":["import * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { stableDir } from \"../stable-dir\";\nimport type { FlyApp } from \"./app\";\nimport type { FlyProvider } from \"./provider\";\nimport { type FlyTomlConfig, generateFlyToml } from \"./toml\";\n\n/** Options type for FlyDeploy. */\ntype FlyDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\t/** Fly authentication context. */\n\tprovider: FlyProvider;\n\n\t/** App to deploy into. */\n\tapp: FlyApp;\n};\n\n/** Args for FlyDeploy. */\nexport interface FlyDeployArgs {\n\t/**\n\t * Absolute path to the repo root (working directory for `fly deploy`).\n\t * Stored relative to the Pulumi program directory so the command stays stable\n\t * across machines and CI (see {@link stableDir}).\n\t */\n\tmonorepoRoot: string;\n\n\t/**\n\t * fly.toml configuration. `config.app` must equal the FlyApp name. All values\n\t * are plain (not `pulumi.Input`) — resolve Outputs before constructing this.\n\t */\n\tconfig: FlyTomlConfig;\n\n\t/**\n\t * Values that force a redeploy when changed (e.g. a source hash from\n\t * `hashDirectory()` and `FlySecret.version`). The generated toml content is\n\t * appended automatically.\n\t */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\n\t/** `fly deploy --wait-timeout` in seconds (default 300). */\n\twaitTimeout?: number;\n\n\t/** `fly deploy --release-command-timeout` in seconds (default 600). */\n\treleaseCommandTimeout?: number;\n\n\t/** `fly deploy --ha` (default false). */\n\thighAvailability?: boolean;\n}\n\n/**\n * Deploys a Fly app via `fly deploy --remote-only`, driven by a generated\n * fly.toml. The toml is written by the deploy command itself (at execution\n * time, not during `pulumi preview`) to `<monorepoRoot>/.fly/<app>.toml`, and\n * its content is added to the redeploy triggers (so config changes redeploy).\n *\n * @example\n * ```typescript\n * new FlyDeploy(\"api-deploy\", {\n *   monorepoRoot,\n *   config: { app: \"rby-api\", primaryRegion: \"iad\", build: { dockerfile: \"apps/api/Dockerfile\" } },\n *   triggers: [hashDirectory(\"apps/api\"), secrets.version],\n * }, { provider, app, dependsOn: [secrets] });\n * ```\n */\nexport class FlyDeploy extends pulumi.ComponentResource {\n\tconstructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions) {\n\t\tconst { provider, app, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:fly:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst tomlContent = generateFlyToml(args.config);\n\t\tconst configPath = `.fly/${args.config.app}.toml`;\n\n\t\tconst waitTimeout = args.waitTimeout ?? 300;\n\t\tconst releaseCommandTimeout = args.releaseCommandTimeout ?? 600;\n\t\tconst highAvailability = args.highAvailability ?? false;\n\n\t\t// The toml is written by the command at execution time. The content\n\t\t// arrives via the FLY_TOML_CONTENT env var (avoiding shell escaping) so\n\t\t// no file is touched during `pulumi preview`.\n\t\tconst deployCommand = [\n\t\t\t\"mkdir -p .fly\",\n\t\t\t`printf '%s' \"$FLY_TOML_CONTENT\" > ${configPath}`,\n\t\t\t`fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`,\n\t\t].join(\" && \");\n\n\t\tconst triggers = pulumi\n\t\t\t.output(args.triggers)\n\t\t\t.apply((values) => [...values, tomlContent]);\n\n\t\tnew command.local.Command(\n\t\t\t`${name}-deploy`,\n\t\t\t{\n\t\t\t\tcreate: deployCommand,\n\t\t\t\ttriggers,\n\t\t\t\tdir: stableDir(args.monorepoRoot),\n\t\t\t\tenvironment: {\n\t\t\t\t\tFLY_API_TOKEN: provider.token,\n\t\t\t\t\tFLY_TOML_CONTENT: tomlContent,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ parent: this, dependsOn: [app] },\n\t\t);\n\n\t\tthis.registerOutputs({});\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgEA,IAAa,YAAb,cAA+B,OAAO,kBAAkB;CACvD,YAAY,MAAc,MAAqB,MAAwB;EACtE,MAAM,EAAE,UAAU,KAAK,GAAG,eAAe;EAEzC,MAAM,yBAAyB,MAAM,CAAC,GAAG,UAAU;EAEnD,MAAM,cAAc,gBAAgB,KAAK,MAAM;EAC/C,MAAM,aAAa,QAAQ,KAAK,OAAO,IAAI;EAE3C,MAAM,cAAc,KAAK,eAAe;EACxC,MAAM,wBAAwB,KAAK,yBAAyB;EAC5D,MAAM,mBAAmB,KAAK,oBAAoB;EAKlD,MAAM,gBAAgB;GACrB;GACA,qCAAqC;GACrC,uBAAuB,WAAW,sBAAsB,iBAAiB,kBAAkB,YAAY,6BAA6B;EACrI,EAAE,KAAK,MAAM;EAEb,MAAM,WAAW,OACf,OAAO,KAAK,QAAQ,EACpB,OAAO,WAAW,CAAC,GAAG,QAAQ,WAAW,CAAC;EAE5C,IAAI,QAAQ,MAAM,QACjB,GAAG,KAAK,UACR;GACC,QAAQ;GACR;GACA,KAAK,UAAU,KAAK,YAAY;GAChC,aAAa;IACZ,eAAe,SAAS;IACxB,kBAAkB;GACnB;EACD,GACA;GAAE,QAAQ;GAAM,WAAW,CAAC,GAAG;EAAE,CAClC;EAEA,KAAK,gBAAgB,CAAC,CAAC;CACxB;AACD"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/fly/deploy.ts"],"sourcesContent":["// src/fly/deploy.ts  (replace entire file)\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../deploy-command\";\nimport type { FlyApp } from \"./app\";\nimport type { FlyProvider } from \"./provider\";\nimport { type FlyTomlConfig, generateFlyToml } from \"./toml\";\n\ntype FlyDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\tprovider: FlyProvider;\n\tapp: FlyApp;\n};\n\nexport interface FlyDeployArgs {\n\t/** fly.toml configuration. `config.app` must equal the FlyApp name. */\n\tconfig: FlyTomlConfig;\n\t/** Redeploy triggers; the generated toml content is appended automatically. */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** `fly deploy --wait-timeout` seconds (default 300). */\n\twaitTimeout?: number;\n\t/** `fly deploy --release-command-timeout` seconds (default 600). */\n\treleaseCommandTimeout?: number;\n\t/** `fly deploy --ha` (default false). */\n\thighAvailability?: boolean;\n}\n\n/**\n * Deploys a Fly app via `fly deploy --remote-only` from a generated fly.toml.\n * Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).\n */\nexport class FlyDeploy extends pulumi.ComponentResource {\n\tconstructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions) {\n\t\tconst { provider, app, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:fly:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst tomlContent = generateFlyToml(args.config);\n\t\tconst configPath = `.fly/${args.config.app}.toml`;\n\n\t\tconst waitTimeout = args.waitTimeout ?? 300;\n\t\tconst releaseCommandTimeout = args.releaseCommandTimeout ?? 600;\n\t\tconst highAvailability = args.highAvailability ?? false;\n\n\t\t// The toml content arrives via FLY_TOML_CONTENT (avoids shell escaping).\n\t\tconst setup = `mkdir -p .fly && printf '%s' \"$FLY_TOML_CONTENT\" > ${configPath}`;\n\t\tconst cli = `fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`;\n\n\t\tconst triggers = pulumi\n\t\t\t.output(args.triggers)\n\t\t\t.apply((values) => [...values, tomlContent]);\n\n\t\tlet consumerDeps: pulumi.Resource[];\n\n\t\tif (Array.isArray(pulumiOpts.dependsOn)) {\n\t\t\tconsumerDeps = pulumiOpts.dependsOn as pulumi.Resource[];\n\t\t} else if (pulumiOpts.dependsOn) {\n\t\t\tconsumerDeps = [pulumiOpts.dependsOn as pulumi.Resource];\n\t\t} else {\n\t\t\tconsumerDeps = [];\n\t\t}\n\n\t\tcreateDeployCommand(\n\t\t\t{\n\t\t\t\tname: `${name}-deploy`,\n\t\t\t\tcli,\n\t\t\t\ttriggers,\n\t\t\t\tsetup,\n\t\t\t\tenvironment: {\n\t\t\t\t\tFLY_API_TOKEN: provider.token,\n\t\t\t\t\tFLY_TOML_CONTENT: tomlContent,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ ...pulumiOpts, parent: this, dependsOn: [app, ...consumerDeps] },\n\t\t);\n\n\t\tthis.registerOutputs({});\n\t}\n}\n"],"mappings":";;;;;;;;;;AA8BA,IAAa,YAAb,cAA+B,OAAO,kBAAkB;CACvD,YAAY,MAAc,MAAqB,MAAwB;EACtE,MAAM,EAAE,UAAU,KAAK,GAAG,eAAe;EAEzC,MAAM,yBAAyB,MAAM,CAAC,GAAG,UAAU;EAEnD,MAAM,cAAc,gBAAgB,KAAK,MAAM;EAC/C,MAAM,aAAa,QAAQ,KAAK,OAAO,IAAI;EAE3C,MAAM,cAAc,KAAK,eAAe;EACxC,MAAM,wBAAwB,KAAK,yBAAyB;EAC5D,MAAM,mBAAmB,KAAK,oBAAoB;EAGlD,MAAM,QAAQ,sDAAsD;EACpE,MAAM,MAAM,uBAAuB,WAAW,sBAAsB,iBAAiB,kBAAkB,YAAY,6BAA6B;EAEhJ,MAAM,WAAW,OACf,OAAO,KAAK,QAAQ,EACpB,OAAO,WAAW,CAAC,GAAG,QAAQ,WAAW,CAAC;EAE5C,IAAI;EAEJ,IAAI,MAAM,QAAQ,WAAW,SAAS,GACrC,eAAe,WAAW;OACpB,IAAI,WAAW,WACrB,eAAe,CAAC,WAAW,SAA4B;OAEvD,eAAe,CAAC;EAGjB,oBACC;GACC,MAAM,GAAG,KAAK;GACd;GACA;GACA;GACA,aAAa;IACZ,eAAe,SAAS;IACxB,kBAAkB;GACnB;EACD,GACA;GAAE,GAAG;GAAY,QAAQ;GAAM,WAAW,CAAC,KAAK,GAAG,YAAY;EAAE,CAClE;EAEA,KAAK,gBAAgB,CAAC,CAAC;CACxB;AACD"}