@infracraft/pulumi 1.16.0 → 1.16.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/deploy-command.cjs +2 -0
- package/dist/deploy-command.cjs.map +1 -1
- package/dist/deploy-command.mjs +2 -0
- package/dist/deploy-command.mjs.map +1 -1
- package/dist/sandbox.cjs +2 -2
- package/dist/sandbox.cjs.map +1 -1
- package/dist/sandbox.d.cts +4 -1
- package/dist/sandbox.d.cts.map +1 -1
- package/dist/sandbox.d.mts +4 -1
- package/dist/sandbox.d.mts.map +1 -1
- package/dist/sandbox.mjs +2 -2
- package/dist/sandbox.mjs.map +1 -1
- package/package.json +1 -1
package/dist/deploy-command.cjs
CHANGED
|
@@ -24,10 +24,12 @@ function createDeployCommand(args, opts) {
|
|
|
24
24
|
const sandbox = deps.some(require_sandbox.isDeploySandbox);
|
|
25
25
|
const gitGuard = deps.some(require_git_guard.isGitGuard);
|
|
26
26
|
if (gitGuard && !sandbox) throw new Error(`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`);
|
|
27
|
+
const env = _pulumi_pulumi.getStack();
|
|
27
28
|
const create = _pulumi_pulumi.output(args.cli).apply((cli) => require_sandbox.buildSandboxScript({
|
|
28
29
|
sandbox,
|
|
29
30
|
gitGuard,
|
|
30
31
|
appName: args.name.replace(/-deploy$/, ""),
|
|
32
|
+
env,
|
|
31
33
|
excludePaths: args.excludePaths,
|
|
32
34
|
setup: args.setup,
|
|
33
35
|
cli
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy-command.cjs","names":["isDeploySandbox","isGitGuard","pulumi","buildSandboxScript","command"],"sources":["../src/deploy-command.ts"],"sourcesContent":["// src/deploy-command.ts\nimport * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { isGitGuard } from \"./git-guard\";\nimport { buildSandboxScript, isDeploySandbox } from \"./sandbox\";\n\nexport interface CreateDeployCommandArgs {\n\t/** Resource name; the child command is `<name>` and the sandbox dir uses it. */\n\tname: string;\n\t/** Fully-formed platform deploy command (may be an Output, e.g. Railway). */\n\tcli: pulumi.Input<string>;\n\t/** Redeploy triggers (source/env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Upload-scoping excludes (applied only in stub mode). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Env passed to the command (secrets that survive preview; not the inlined ones). */\n\tenvironment?: Record<string, pulumi.Input<string>>;\n}\n\nexport interface CreateDeployCommandResult {\n\tcommand: command.local.Command;\n\t/** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */\n\tdeploymentUrl: pulumi.Output<string>;\n}\n\n/** Reads a `dependsOn` opt into a flat array of resource instances. */\nfunction dependsOnList(opts: pulumi.ComponentResourceOptions): unknown[] {\n\tconst dep = opts.dependsOn;\n\n\tif (Array.isArray(dep)) {\n\t\treturn dep;\n\t}\n\n\treturn dep ? [dep] : [];\n}\n\n/**\n * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:\n * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.\n * The platform deploy resources call ONLY this; they never touch the sandbox.\n */\nexport function createDeployCommand(\n\targs: CreateDeployCommandArgs,\n\topts: pulumi.ComponentResourceOptions,\n): CreateDeployCommandResult {\n\tconst deps = dependsOnList(opts);\n\tconst sandbox = deps.some(isDeploySandbox);\n\tconst gitGuard = deps.some(isGitGuard);\n\n\tif (gitGuard && !sandbox) {\n\t\tthrow new Error(\n\t\t\t`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`,\n\t\t);\n\t}\n\n\tconst create = pulumi.output(args.cli).apply((cli) =>\n\t\tbuildSandboxScript({\n\t\t\tsandbox,\n\t\t\tgitGuard,\n\t\t\tappName: args.name.replace(/-deploy$/, \"\"),\n\t\t\texcludePaths: args.excludePaths,\n\t\t\tsetup: args.setup,\n\t\t\tcli,\n\t\t}),\n\t);\n\n\tconst cmd = new command.local.Command(\n\t\targs.name,\n\t\t{ create, triggers: args.triggers, environment: args.environment },\n\t\topts,\n\t);\n\n\tconst deploymentUrl = cmd.stdout.apply(\n\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t);\n\n\treturn { command: cmd, deploymentUrl };\n}\n"],"mappings":";;;;;;;;;;;AA6BA,SAAS,cAAc,MAAkD;CACxE,MAAM,MAAM,KAAK;CAEjB,IAAI,MAAM,QAAQ,GAAG,GACpB,OAAO;CAGR,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACvB;;;;;;AAOA,SAAgB,oBACf,MACA,MAC4B;CAC5B,MAAM,OAAO,cAAc,IAAI;CAC/B,MAAM,UAAU,KAAK,KAAKA,+BAAe;CACzC,MAAM,WAAW,KAAK,KAAKC,4BAAU;CAErC,IAAI,YAAY,CAAC,SAChB,MAAM,IAAI,MACT,gBAAgB,KAAK,KAAK,8DAC3B;CAGD,MAAM,
|
|
1
|
+
{"version":3,"file":"deploy-command.cjs","names":["isDeploySandbox","isGitGuard","pulumi","buildSandboxScript","command"],"sources":["../src/deploy-command.ts"],"sourcesContent":["// src/deploy-command.ts\nimport * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { isGitGuard } from \"./git-guard\";\nimport { buildSandboxScript, isDeploySandbox } from \"./sandbox\";\n\nexport interface CreateDeployCommandArgs {\n\t/** Resource name; the child command is `<name>` and the sandbox dir uses it. */\n\tname: string;\n\t/** Fully-formed platform deploy command (may be an Output, e.g. Railway). */\n\tcli: pulumi.Input<string>;\n\t/** Redeploy triggers (source/env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Upload-scoping excludes (applied only in stub mode). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Env passed to the command (secrets that survive preview; not the inlined ones). */\n\tenvironment?: Record<string, pulumi.Input<string>>;\n}\n\nexport interface CreateDeployCommandResult {\n\tcommand: command.local.Command;\n\t/** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */\n\tdeploymentUrl: pulumi.Output<string>;\n}\n\n/** Reads a `dependsOn` opt into a flat array of resource instances. */\nfunction dependsOnList(opts: pulumi.ComponentResourceOptions): unknown[] {\n\tconst dep = opts.dependsOn;\n\n\tif (Array.isArray(dep)) {\n\t\treturn dep;\n\t}\n\n\treturn dep ? [dep] : [];\n}\n\n/**\n * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:\n * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.\n * The platform deploy resources call ONLY this; they never touch the sandbox.\n */\nexport function createDeployCommand(\n\targs: CreateDeployCommandArgs,\n\topts: pulumi.ComponentResourceOptions,\n): CreateDeployCommandResult {\n\tconst deps = dependsOnList(opts);\n\tconst sandbox = deps.some(isDeploySandbox);\n\tconst gitGuard = deps.some(isGitGuard);\n\n\tif (gitGuard && !sandbox) {\n\t\tthrow new Error(\n\t\t\t`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`,\n\t\t);\n\t}\n\n\tconst env = pulumi.getStack();\n\n\tconst create = pulumi.output(args.cli).apply((cli) =>\n\t\tbuildSandboxScript({\n\t\t\tsandbox,\n\t\t\tgitGuard,\n\t\t\tappName: args.name.replace(/-deploy$/, \"\"),\n\t\t\tenv,\n\t\t\texcludePaths: args.excludePaths,\n\t\t\tsetup: args.setup,\n\t\t\tcli,\n\t\t}),\n\t);\n\n\tconst cmd = new command.local.Command(\n\t\targs.name,\n\t\t{ create, triggers: args.triggers, environment: args.environment },\n\t\topts,\n\t);\n\n\tconst deploymentUrl = cmd.stdout.apply(\n\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t);\n\n\treturn { command: cmd, deploymentUrl };\n}\n"],"mappings":";;;;;;;;;;;AA6BA,SAAS,cAAc,MAAkD;CACxE,MAAM,MAAM,KAAK;CAEjB,IAAI,MAAM,QAAQ,GAAG,GACpB,OAAO;CAGR,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACvB;;;;;;AAOA,SAAgB,oBACf,MACA,MAC4B;CAC5B,MAAM,OAAO,cAAc,IAAI;CAC/B,MAAM,UAAU,KAAK,KAAKA,+BAAe;CACzC,MAAM,WAAW,KAAK,KAAKC,4BAAU;CAErC,IAAI,YAAY,CAAC,SAChB,MAAM,IAAI,MACT,gBAAgB,KAAK,KAAK,8DAC3B;CAGD,MAAM,MAAMC,eAAO,SAAS;CAE5B,MAAM,SAASA,eAAO,OAAO,KAAK,GAAG,EAAE,OAAO,QAC7CC,mCAAmB;EAClB;EACA;EACA,SAAS,KAAK,KAAK,QAAQ,YAAY,EAAE;EACzC;EACA,cAAc,KAAK;EACnB,OAAO,KAAK;EACZ;CACD,CAAC,CACF;CAEA,MAAM,MAAM,IAAIC,gBAAQ,MAAM,QAC7B,KAAK,MACL;EAAE;EAAQ,UAAU,KAAK;EAAU,aAAa,KAAK;CAAY,GACjE,IACD;CAMA,OAAO;EAAE,SAAS;EAAK,eAJD,IAAI,OAAO,OAC/B,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAGP;CAAE;AACtC"}
|
package/dist/deploy-command.mjs
CHANGED
|
@@ -21,10 +21,12 @@ function createDeployCommand(args, opts) {
|
|
|
21
21
|
const sandbox = deps.some(isDeploySandbox);
|
|
22
22
|
const gitGuard = deps.some(isGitGuard);
|
|
23
23
|
if (gitGuard && !sandbox) throw new Error(`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`);
|
|
24
|
+
const env = pulumi.getStack();
|
|
24
25
|
const create = pulumi.output(args.cli).apply((cli) => buildSandboxScript({
|
|
25
26
|
sandbox,
|
|
26
27
|
gitGuard,
|
|
27
28
|
appName: args.name.replace(/-deploy$/, ""),
|
|
29
|
+
env,
|
|
28
30
|
excludePaths: args.excludePaths,
|
|
29
31
|
setup: args.setup,
|
|
30
32
|
cli
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy-command.mjs","names":[],"sources":["../src/deploy-command.ts"],"sourcesContent":["// src/deploy-command.ts\nimport * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { isGitGuard } from \"./git-guard\";\nimport { buildSandboxScript, isDeploySandbox } from \"./sandbox\";\n\nexport interface CreateDeployCommandArgs {\n\t/** Resource name; the child command is `<name>` and the sandbox dir uses it. */\n\tname: string;\n\t/** Fully-formed platform deploy command (may be an Output, e.g. Railway). */\n\tcli: pulumi.Input<string>;\n\t/** Redeploy triggers (source/env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Upload-scoping excludes (applied only in stub mode). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Env passed to the command (secrets that survive preview; not the inlined ones). */\n\tenvironment?: Record<string, pulumi.Input<string>>;\n}\n\nexport interface CreateDeployCommandResult {\n\tcommand: command.local.Command;\n\t/** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */\n\tdeploymentUrl: pulumi.Output<string>;\n}\n\n/** Reads a `dependsOn` opt into a flat array of resource instances. */\nfunction dependsOnList(opts: pulumi.ComponentResourceOptions): unknown[] {\n\tconst dep = opts.dependsOn;\n\n\tif (Array.isArray(dep)) {\n\t\treturn dep;\n\t}\n\n\treturn dep ? [dep] : [];\n}\n\n/**\n * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:\n * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.\n * The platform deploy resources call ONLY this; they never touch the sandbox.\n */\nexport function createDeployCommand(\n\targs: CreateDeployCommandArgs,\n\topts: pulumi.ComponentResourceOptions,\n): CreateDeployCommandResult {\n\tconst deps = dependsOnList(opts);\n\tconst sandbox = deps.some(isDeploySandbox);\n\tconst gitGuard = deps.some(isGitGuard);\n\n\tif (gitGuard && !sandbox) {\n\t\tthrow new Error(\n\t\t\t`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`,\n\t\t);\n\t}\n\n\tconst create = pulumi.output(args.cli).apply((cli) =>\n\t\tbuildSandboxScript({\n\t\t\tsandbox,\n\t\t\tgitGuard,\n\t\t\tappName: args.name.replace(/-deploy$/, \"\"),\n\t\t\texcludePaths: args.excludePaths,\n\t\t\tsetup: args.setup,\n\t\t\tcli,\n\t\t}),\n\t);\n\n\tconst cmd = new command.local.Command(\n\t\targs.name,\n\t\t{ create, triggers: args.triggers, environment: args.environment },\n\t\topts,\n\t);\n\n\tconst deploymentUrl = cmd.stdout.apply(\n\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t);\n\n\treturn { command: cmd, deploymentUrl };\n}\n"],"mappings":";;;;;;;;AA6BA,SAAS,cAAc,MAAkD;CACxE,MAAM,MAAM,KAAK;CAEjB,IAAI,MAAM,QAAQ,GAAG,GACpB,OAAO;CAGR,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACvB;;;;;;AAOA,SAAgB,oBACf,MACA,MAC4B;CAC5B,MAAM,OAAO,cAAc,IAAI;CAC/B,MAAM,UAAU,KAAK,KAAK,eAAe;CACzC,MAAM,WAAW,KAAK,KAAK,UAAU;CAErC,IAAI,YAAY,CAAC,SAChB,MAAM,IAAI,MACT,gBAAgB,KAAK,KAAK,8DAC3B;CAGD,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG,EAAE,OAAO,QAC7C,mBAAmB;EAClB;EACA;EACA,SAAS,KAAK,KAAK,QAAQ,YAAY,EAAE;EACzC,cAAc,KAAK;EACnB,OAAO,KAAK;EACZ;CACD,CAAC,CACF;CAEA,MAAM,MAAM,IAAI,QAAQ,MAAM,QAC7B,KAAK,MACL;EAAE;EAAQ,UAAU,KAAK;EAAU,aAAa,KAAK;CAAY,GACjE,IACD;CAMA,OAAO;EAAE,SAAS;EAAK,eAJD,IAAI,OAAO,OAC/B,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAGP;CAAE;AACtC"}
|
|
1
|
+
{"version":3,"file":"deploy-command.mjs","names":[],"sources":["../src/deploy-command.ts"],"sourcesContent":["// src/deploy-command.ts\nimport * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { isGitGuard } from \"./git-guard\";\nimport { buildSandboxScript, isDeploySandbox } from \"./sandbox\";\n\nexport interface CreateDeployCommandArgs {\n\t/** Resource name; the child command is `<name>` and the sandbox dir uses it. */\n\tname: string;\n\t/** Fully-formed platform deploy command (may be an Output, e.g. Railway). */\n\tcli: pulumi.Input<string>;\n\t/** Redeploy triggers (source/env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Upload-scoping excludes (applied only in stub mode). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Env passed to the command (secrets that survive preview; not the inlined ones). */\n\tenvironment?: Record<string, pulumi.Input<string>>;\n}\n\nexport interface CreateDeployCommandResult {\n\tcommand: command.local.Command;\n\t/** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */\n\tdeploymentUrl: pulumi.Output<string>;\n}\n\n/** Reads a `dependsOn` opt into a flat array of resource instances. */\nfunction dependsOnList(opts: pulumi.ComponentResourceOptions): unknown[] {\n\tconst dep = opts.dependsOn;\n\n\tif (Array.isArray(dep)) {\n\t\treturn dep;\n\t}\n\n\treturn dep ? [dep] : [];\n}\n\n/**\n * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:\n * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.\n * The platform deploy resources call ONLY this; they never touch the sandbox.\n */\nexport function createDeployCommand(\n\targs: CreateDeployCommandArgs,\n\topts: pulumi.ComponentResourceOptions,\n): CreateDeployCommandResult {\n\tconst deps = dependsOnList(opts);\n\tconst sandbox = deps.some(isDeploySandbox);\n\tconst gitGuard = deps.some(isGitGuard);\n\n\tif (gitGuard && !sandbox) {\n\t\tthrow new Error(\n\t\t\t`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`,\n\t\t);\n\t}\n\n\tconst env = pulumi.getStack();\n\n\tconst create = pulumi.output(args.cli).apply((cli) =>\n\t\tbuildSandboxScript({\n\t\t\tsandbox,\n\t\t\tgitGuard,\n\t\t\tappName: args.name.replace(/-deploy$/, \"\"),\n\t\t\tenv,\n\t\t\texcludePaths: args.excludePaths,\n\t\t\tsetup: args.setup,\n\t\t\tcli,\n\t\t}),\n\t);\n\n\tconst cmd = new command.local.Command(\n\t\targs.name,\n\t\t{ create, triggers: args.triggers, environment: args.environment },\n\t\topts,\n\t);\n\n\tconst deploymentUrl = cmd.stdout.apply(\n\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t);\n\n\treturn { command: cmd, deploymentUrl };\n}\n"],"mappings":";;;;;;;;AA6BA,SAAS,cAAc,MAAkD;CACxE,MAAM,MAAM,KAAK;CAEjB,IAAI,MAAM,QAAQ,GAAG,GACpB,OAAO;CAGR,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACvB;;;;;;AAOA,SAAgB,oBACf,MACA,MAC4B;CAC5B,MAAM,OAAO,cAAc,IAAI;CAC/B,MAAM,UAAU,KAAK,KAAK,eAAe;CACzC,MAAM,WAAW,KAAK,KAAK,UAAU;CAErC,IAAI,YAAY,CAAC,SAChB,MAAM,IAAI,MACT,gBAAgB,KAAK,KAAK,8DAC3B;CAGD,MAAM,MAAM,OAAO,SAAS;CAE5B,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG,EAAE,OAAO,QAC7C,mBAAmB;EAClB;EACA;EACA,SAAS,KAAK,KAAK,QAAQ,YAAY,EAAE;EACzC;EACA,cAAc,KAAK;EACnB,OAAO,KAAK;EACZ;CACD,CAAC,CACF;CAEA,MAAM,MAAM,IAAI,QAAQ,MAAM,QAC7B,KAAK,MACL;EAAE;EAAQ,UAAU,KAAK;EAAU,aAAa,KAAK;CAAY,GACjE,IACD;CAMA,OAAO;EAAE,SAAS;EAAK,eAJD,IAAI,OAAO,OAC/B,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAGP;CAAE;AACtC"}
|
package/dist/sandbox.cjs
CHANGED
|
@@ -34,11 +34,11 @@ const SANDBOX_ROOT = "/tmp/infracraft";
|
|
|
34
34
|
* docs/superpowers/specs/2026-06-05-deploy-sandbox-design.md for the modes.
|
|
35
35
|
*/
|
|
36
36
|
function buildSandboxScript(options) {
|
|
37
|
-
const { sandbox, gitGuard, appName, excludePaths, setup, cli } = options;
|
|
37
|
+
const { sandbox, gitGuard, appName, env, excludePaths, setup, cli } = options;
|
|
38
38
|
const head = `REPO=$(git rev-parse --show-toplevel)`;
|
|
39
39
|
const runSetupAndCli = [setup, cli].filter(Boolean).join("; ");
|
|
40
40
|
if (!sandbox) return `${head}; cd "$REPO"; ${runSetupAndCli}`;
|
|
41
|
-
const makeSandbox = [`SANDBOX=$(mktemp -d ${SANDBOX_ROOT}/${appName}.XXXXXX)`, `trap 'rm -rf "$SANDBOX"' EXIT`].join("; ");
|
|
41
|
+
const makeSandbox = [`SANDBOX=$(mktemp -d ${SANDBOX_ROOT}/${env ? `${env}-${appName}` : appName}.XXXXXX)`, `trap 'rm -rf "$SANDBOX"' EXIT`].join("; ");
|
|
42
42
|
if (gitGuard) return `${head}; ${makeSandbox}; ${`git -C "$REPO" ls-files | ${buildSandboxFileFilter(excludePaths)} | rsync -a --files-from=- "$REPO"/ "$SANDBOX"/`}; cd "\$SANDBOX" && git init -q && git add -A; ${runSetupAndCli}`;
|
|
43
43
|
return `${head}; ${makeSandbox}; git -C "\$REPO" ls-files | rsync -a --files-from=- "\$REPO"/ "\$SANDBOX"/; cp -c -R "\$REPO/.git" "\$SANDBOX/.git" 2>/dev/null || cp -R "\$REPO/.git" "\$SANDBOX/.git"; cd "$SANDBOX"; ${runSetupAndCli}`;
|
|
44
44
|
}
|
package/dist/sandbox.cjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox.cjs","names":["pulumi","fs","path"],"sources":["../src/sandbox.ts"],"sourcesContent":["import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\n/** Escapes a path literal for embedding inside an awk ERE. */\nfunction escapeAwkRegex(path: string): string {\n\treturn path.replace(/[.[\\]{}()*+?^$|\\\\/]/g, \"\\\\$&\");\n}\n\n/**\n * Builds the shell filter applied to newline-delimited `git ls-files` output\n * before `rsync --files-from`. For `apps/<x>` it drops the app's files but keeps\n * `apps/<x>/package.json` (the monorepo workspace graph needs it during build);\n * any other entry drops the path and its subtree. Returns `cat` (passthrough)\n * when nothing is excluded. Uses awk so it is portable across macOS and Linux.\n */\nexport function buildSandboxFileFilter(excludePaths: string[] = []): string {\n\tif (excludePaths.length === 0) {\n\t\treturn \"cat\";\n\t}\n\n\tconst clauses = excludePaths.map((entry) => {\n\t\tconst escaped = escapeAwkRegex(entry);\n\n\t\tif (entry.startsWith(\"apps/\")) {\n\t\t\treturn `!(/^${escaped}\\\\// && !/^${escaped}\\\\/package\\\\.json$/)`;\n\t\t}\n\n\t\treturn `!/^${escaped}(\\\\/|$)/`;\n\t});\n\n\treturn `awk '${clauses.join(\" && \")}'`;\n}\n\n/** Root of the per-deploy sandbox tree. The DeploySandbox resource GCs this. */\nconst SANDBOX_ROOT = \"/tmp/infracraft\";\n\ninterface SandboxScriptOptions {\n\t/** Whether to isolate into a /tmp copy (false → run in the live tree). */\n\tsandbox: boolean;\n\t/** Whether the sandbox `.git` is a metadata-free stub (true) or the real one. */\n\tgitGuard: boolean;\n\t/** Resource-derived name, used
|
|
1
|
+
{"version":3,"file":"sandbox.cjs","names":["pulumi","fs","path"],"sources":["../src/sandbox.ts"],"sourcesContent":["import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\n/** Escapes a path literal for embedding inside an awk ERE. */\nfunction escapeAwkRegex(path: string): string {\n\treturn path.replace(/[.[\\]{}()*+?^$|\\\\/]/g, \"\\\\$&\");\n}\n\n/**\n * Builds the shell filter applied to newline-delimited `git ls-files` output\n * before `rsync --files-from`. For `apps/<x>` it drops the app's files but keeps\n * `apps/<x>/package.json` (the monorepo workspace graph needs it during build);\n * any other entry drops the path and its subtree. Returns `cat` (passthrough)\n * when nothing is excluded. Uses awk so it is portable across macOS and Linux.\n */\nexport function buildSandboxFileFilter(excludePaths: string[] = []): string {\n\tif (excludePaths.length === 0) {\n\t\treturn \"cat\";\n\t}\n\n\tconst clauses = excludePaths.map((entry) => {\n\t\tconst escaped = escapeAwkRegex(entry);\n\n\t\tif (entry.startsWith(\"apps/\")) {\n\t\t\treturn `!(/^${escaped}\\\\// && !/^${escaped}\\\\/package\\\\.json$/)`;\n\t\t}\n\n\t\treturn `!/^${escaped}(\\\\/|$)/`;\n\t});\n\n\treturn `awk '${clauses.join(\" && \")}'`;\n}\n\n/** Root of the per-deploy sandbox tree. The DeploySandbox resource GCs this. */\nconst SANDBOX_ROOT = \"/tmp/infracraft\";\n\ninterface SandboxScriptOptions {\n\t/** Whether to isolate into a /tmp copy (false → run in the live tree). */\n\tsandbox: boolean;\n\t/** Whether the sandbox `.git` is a metadata-free stub (true) or the real one. */\n\tgitGuard: boolean;\n\t/** Resource-derived name, used in the sandbox dir prefix. */\n\tappName: string;\n\t/** Stack/environment name, prefixed to the sandbox dir so leftovers and\n\t * concurrent deploys are identifiable (e.g. `staging-vercel-deploy-nexus.XXXX`). */\n\tenv?: string;\n\t/** Upload-scoping excludes; applied only in stub mode (see design spec). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Fully-formed platform deploy command (its exit code becomes the script's). */\n\tcli: string;\n}\n\n/**\n * Builds the shell for a deploy's `command.local.Command.create`. See\n * docs/superpowers/specs/2026-06-05-deploy-sandbox-design.md for the modes.\n */\nexport function buildSandboxScript(options: SandboxScriptOptions): string {\n\tconst { sandbox, gitGuard, appName, env, excludePaths, setup, cli } = options;\n\n\tconst head = `REPO=$(git rev-parse --show-toplevel)`;\n\tconst runSetupAndCli = [setup, cli].filter(Boolean).join(\"; \");\n\n\tif (!sandbox) {\n\t\treturn `${head}; cd \"$REPO\"; ${runSetupAndCli}`;\n\t}\n\n\t// Prefix the dir with the env so leftovers/concurrent deploys are identifiable.\n\tconst dirPrefix = env ? `${env}-${appName}` : appName;\n\n\tconst makeSandbox = [\n\t\t`SANDBOX=$(mktemp -d ${SANDBOX_ROOT}/${dirPrefix}.XXXXXX)`,\n\t\t`trap 'rm -rf \"$SANDBOX\"' EXIT`,\n\t].join(\"; \");\n\n\tif (gitGuard) {\n\t\tconst filter = buildSandboxFileFilter(excludePaths);\n\n\t\tconst copy =\n\t\t\t`git -C \"$REPO\" ls-files | ${filter} | ` +\n\t\t\t`rsync -a --files-from=- \"$REPO\"/ \"$SANDBOX\"/`;\n\n\t\tconst stubGit = `cd \"$SANDBOX\" && git init -q && git add -A`;\n\n\t\treturn `${head}; ${makeSandbox}; ${copy}; ${stubGit}; ${runSetupAndCli}`;\n\t}\n\n\t// Original `.git`, full clean tree (no filter, no reconciliation needed).\n\tconst copy = `git -C \"$REPO\" ls-files | rsync -a --files-from=- \"$REPO\"/ \"$SANDBOX\"/`;\n\n\tconst copyGit =\n\t\t`cp -c -R \"$REPO/.git\" \"$SANDBOX/.git\" 2>/dev/null || ` +\n\t\t`cp -R \"$REPO/.git\" \"$SANDBOX/.git\"`;\n\n\treturn `${head}; ${makeSandbox}; ${copy}; ${copyGit}; cd \"$SANDBOX\"; ${runSetupAndCli}`;\n}\n\n/** Cross-bundle brand: `instanceof` is unreliable when the seam and the resource\n * come from different built entries, so the seam detects sandboxes by this. */\nconst DEPLOY_SANDBOX_BRAND = Symbol.for(\"@infracraft/pulumi/DeploySandbox\");\n\n/** Sweep sandboxes orphaned by a hard-killed run (older than this). */\nconst STALE_SANDBOX_MS = 24 * 60 * 60 * 1000;\n\n/**\n * Isolation marker + workspace lifecycle. Listing it in a deploy's `dependsOn`\n * makes that deploy run in an isolated `/tmp/infracraft` copy. Carries no config;\n * the repo root is derived at runtime by the deploy command.\n */\nexport class DeploySandbox extends pulumi.ComponentResource {\n\tconstructor(name: string, opts?: pulumi.ComponentResourceOptions) {\n\t\tsuper(\"infracraft:sandbox:DeploySandbox\", name, {}, opts);\n\n\t\t(this as Record<symbol, unknown>)[DEPLOY_SANDBOX_BRAND] = true;\n\n\t\tif (!pulumi.runtime.isDryRun()) {\n\t\t\tthis.prepareWorkspace();\n\t\t}\n\n\t\tthis.registerOutputs({});\n\t}\n\n\t/** mkdir the workspace root and GC stale sandboxes (best-effort). */\n\tprivate prepareWorkspace(): void {\n\t\tfs.mkdirSync(SANDBOX_ROOT, { recursive: true });\n\n\t\tlet entries: string[] = [];\n\n\t\ttry {\n\t\t\tentries = fs.readdirSync(SANDBOX_ROOT) as string[];\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\n\t\tconst now = Date.now();\n\n\t\tfor (const entry of entries) {\n\t\t\tconst full = path.join(SANDBOX_ROOT, entry);\n\n\t\t\ttry {\n\t\t\t\tif (now - fs.statSync(full).mtimeMs > STALE_SANDBOX_MS) {\n\t\t\t\t\tfs.rmSync(full, { recursive: true, force: true });\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// Racing with an in-flight deploy's cleanup — ignore.\n\t\t\t}\n\t\t}\n\t}\n}\n\n/** Bundle-safe check for a `DeploySandbox` in a `dependsOn` array. */\nexport function isDeploySandbox(value: unknown): value is DeploySandbox {\n\treturn (\n\t\ttypeof value === \"object\" &&\n\t\tvalue !== null &&\n\t\t(value as Record<symbol, unknown>)[DEPLOY_SANDBOX_BRAND] === true\n\t);\n}\n"],"mappings":";;;;;;;;;;;AAKA,SAAS,eAAe,MAAsB;CAC7C,OAAO,KAAK,QAAQ,wBAAwB,MAAM;AACnD;;;;;;;;AASA,SAAgB,uBAAuB,eAAyB,CAAC,GAAW;CAC3E,IAAI,aAAa,WAAW,GAC3B,OAAO;CAaR,OAAO,QAVS,aAAa,KAAK,UAAU;EAC3C,MAAM,UAAU,eAAe,KAAK;EAEpC,IAAI,MAAM,WAAW,OAAO,GAC3B,OAAO,OAAO,QAAQ,aAAa,QAAQ;EAG5C,OAAO,MAAM,QAAQ;CACtB,CAEqB,EAAE,KAAK,MAAM,EAAE;AACrC;;AAGA,MAAM,eAAe;;;;;AAwBrB,SAAgB,mBAAmB,SAAuC;CACzE,MAAM,EAAE,SAAS,UAAU,SAAS,KAAK,cAAc,OAAO,QAAQ;CAEtE,MAAM,OAAO;CACb,MAAM,iBAAiB,CAAC,OAAO,GAAG,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;CAE7D,IAAI,CAAC,SACJ,OAAO,GAAG,KAAK,gBAAgB;CAMhC,MAAM,cAAc,CACnB,uBAAuB,aAAa,GAHnB,MAAM,GAAG,IAAI,GAAG,YAAY,QAGI,WACjD,+BACD,EAAE,KAAK,IAAI;CAEX,IAAI,UASH,OAAO,GAAG,KAAK,IAAI,YAAY,IAAI,6BARpB,uBAAuB,YAGH,EAAE,iDAKG,iDAAgB;CAUzD,OAAO,GAAG,KAAK,IAAI,YAAY,2LAAwC;AACxE;;;AAIA,MAAM,uBAAuB,OAAO,IAAI,kCAAkC;;AAG1E,MAAM,mBAAmB,OAAU,KAAK;;;;;;AAOxC,IAAa,gBAAb,cAAmCA,eAAO,kBAAkB;CAC3D,YAAY,MAAc,MAAwC;EACjE,MAAM,oCAAoC,MAAM,CAAC,GAAG,IAAI;EAExD,AAAC,KAAiC,wBAAwB;EAE1D,IAAI,CAACA,eAAO,QAAQ,SAAS,GAC5B,KAAK,iBAAiB;EAGvB,KAAK,gBAAgB,CAAC,CAAC;CACxB;;CAGA,AAAQ,mBAAyB;EAChC,QAAG,UAAU,cAAc,EAAE,WAAW,KAAK,CAAC;EAE9C,IAAI,UAAoB,CAAC;EAEzB,IAAI;GACH,UAAUC,QAAG,YAAY,YAAY;EACtC,QAAQ;GACP;EACD;EAEA,MAAM,MAAM,KAAK,IAAI;EAErB,KAAK,MAAM,SAAS,SAAS;GAC5B,MAAM,OAAOC,UAAK,KAAK,cAAc,KAAK;GAE1C,IAAI;IACH,IAAI,MAAMD,QAAG,SAAS,IAAI,EAAE,UAAU,kBACrC,QAAG,OAAO,MAAM;KAAE,WAAW;KAAM,OAAO;IAAK,CAAC;GAElD,QAAQ,CAER;EACD;CACD;AACD;;AAGA,SAAgB,gBAAgB,OAAwC;CACvE,OACC,OAAO,UAAU,YACjB,UAAU,QACT,MAAkC,0BAA0B;AAE/D"}
|
package/dist/sandbox.d.cts
CHANGED
|
@@ -15,8 +15,11 @@ interface SandboxScriptOptions {
|
|
|
15
15
|
sandbox: boolean;
|
|
16
16
|
/** Whether the sandbox `.git` is a metadata-free stub (true) or the real one. */
|
|
17
17
|
gitGuard: boolean;
|
|
18
|
-
/** Resource-derived name, used
|
|
18
|
+
/** Resource-derived name, used in the sandbox dir prefix. */
|
|
19
19
|
appName: string;
|
|
20
|
+
/** Stack/environment name, prefixed to the sandbox dir so leftovers and
|
|
21
|
+
* concurrent deploys are identifiable (e.g. `staging-vercel-deploy-nexus.XXXX`). */
|
|
22
|
+
env?: string;
|
|
20
23
|
/** Upload-scoping excludes; applied only in stub mode (see design spec). */
|
|
21
24
|
excludePaths?: string[];
|
|
22
25
|
/** Shell run in the working dir before `cli` (e.g. write railpack.json). */
|
package/dist/sandbox.d.cts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox.d.cts","names":[],"sources":["../src/sandbox.ts"],"mappings":";;;;;;;AAgBA;;;;iBAAgB,sBAAA,CAAuB,YAA2B;AAAA,UAqBxD,oBAAA;EAAoB;EAE7B,OAAA;EAF6B;EAI7B,QAAA;EAAA;EAEA,OAAA;
|
|
1
|
+
{"version":3,"file":"sandbox.d.cts","names":[],"sources":["../src/sandbox.ts"],"mappings":";;;;;;;AAgBA;;;;iBAAgB,sBAAA,CAAuB,YAA2B;AAAA,UAqBxD,oBAAA;EAAoB;EAE7B,OAAA;EAF6B;EAI7B,QAAA;EAAA;EAEA,OAAA;EAGA;;EAAA,GAAA;EAMA;EAJA,YAAA;EAIG;EAFH,KAAA;EASiC;EAPjC,GAAA;AAAA;AAO+D;AAoDhE;;;AApDgE,iBAAhD,kBAAA,CAAmB,OAA6B,EAApB,oBAAoB;;;;;;cAoDnD,aAAA,SAAsB,MAAA,CAAO,iBAAiB;cAC9C,IAAA,UAAc,IAAA,GAAO,MAAA,CAAO,wBAAA;EAahC;EAAA,QAAA,gBAAA;AAAA;AA4BT;AAAA,iBAAgB,eAAA,CAAgB,KAAA,YAAiB,KAAA,IAAS,aAAa"}
|
package/dist/sandbox.d.mts
CHANGED
|
@@ -15,8 +15,11 @@ interface SandboxScriptOptions {
|
|
|
15
15
|
sandbox: boolean;
|
|
16
16
|
/** Whether the sandbox `.git` is a metadata-free stub (true) or the real one. */
|
|
17
17
|
gitGuard: boolean;
|
|
18
|
-
/** Resource-derived name, used
|
|
18
|
+
/** Resource-derived name, used in the sandbox dir prefix. */
|
|
19
19
|
appName: string;
|
|
20
|
+
/** Stack/environment name, prefixed to the sandbox dir so leftovers and
|
|
21
|
+
* concurrent deploys are identifiable (e.g. `staging-vercel-deploy-nexus.XXXX`). */
|
|
22
|
+
env?: string;
|
|
20
23
|
/** Upload-scoping excludes; applied only in stub mode (see design spec). */
|
|
21
24
|
excludePaths?: string[];
|
|
22
25
|
/** Shell run in the working dir before `cli` (e.g. write railpack.json). */
|
package/dist/sandbox.d.mts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox.d.mts","names":[],"sources":["../src/sandbox.ts"],"mappings":";;;;;;;AAgBA;;;;iBAAgB,sBAAA,CAAuB,YAA2B;AAAA,UAqBxD,oBAAA;EAAoB;EAE7B,OAAA;EAF6B;EAI7B,QAAA;EAAA;EAEA,OAAA;
|
|
1
|
+
{"version":3,"file":"sandbox.d.mts","names":[],"sources":["../src/sandbox.ts"],"mappings":";;;;;;;AAgBA;;;;iBAAgB,sBAAA,CAAuB,YAA2B;AAAA,UAqBxD,oBAAA;EAAoB;EAE7B,OAAA;EAF6B;EAI7B,QAAA;EAAA;EAEA,OAAA;EAGA;;EAAA,GAAA;EAMA;EAJA,YAAA;EAIG;EAFH,KAAA;EASiC;EAPjC,GAAA;AAAA;AAO+D;AAoDhE;;;AApDgE,iBAAhD,kBAAA,CAAmB,OAA6B,EAApB,oBAAoB;;;;;;cAoDnD,aAAA,SAAsB,MAAA,CAAO,iBAAiB;cAC9C,IAAA,UAAc,IAAA,GAAO,MAAA,CAAO,wBAAA;EAahC;EAAA,QAAA,gBAAA;AAAA;AA4BT;AAAA,iBAAgB,eAAA,CAAgB,KAAA,YAAiB,KAAA,IAAS,aAAa"}
|
package/dist/sandbox.mjs
CHANGED
|
@@ -30,11 +30,11 @@ const SANDBOX_ROOT = "/tmp/infracraft";
|
|
|
30
30
|
* docs/superpowers/specs/2026-06-05-deploy-sandbox-design.md for the modes.
|
|
31
31
|
*/
|
|
32
32
|
function buildSandboxScript(options) {
|
|
33
|
-
const { sandbox, gitGuard, appName, excludePaths, setup, cli } = options;
|
|
33
|
+
const { sandbox, gitGuard, appName, env, excludePaths, setup, cli } = options;
|
|
34
34
|
const head = `REPO=$(git rev-parse --show-toplevel)`;
|
|
35
35
|
const runSetupAndCli = [setup, cli].filter(Boolean).join("; ");
|
|
36
36
|
if (!sandbox) return `${head}; cd "$REPO"; ${runSetupAndCli}`;
|
|
37
|
-
const makeSandbox = [`SANDBOX=$(mktemp -d ${SANDBOX_ROOT}/${appName}.XXXXXX)`, `trap 'rm -rf "$SANDBOX"' EXIT`].join("; ");
|
|
37
|
+
const makeSandbox = [`SANDBOX=$(mktemp -d ${SANDBOX_ROOT}/${env ? `${env}-${appName}` : appName}.XXXXXX)`, `trap 'rm -rf "$SANDBOX"' EXIT`].join("; ");
|
|
38
38
|
if (gitGuard) return `${head}; ${makeSandbox}; ${`git -C "$REPO" ls-files | ${buildSandboxFileFilter(excludePaths)} | rsync -a --files-from=- "$REPO"/ "$SANDBOX"/`}; cd "\$SANDBOX" && git init -q && git add -A; ${runSetupAndCli}`;
|
|
39
39
|
return `${head}; ${makeSandbox}; git -C "\$REPO" ls-files | rsync -a --files-from=- "\$REPO"/ "\$SANDBOX"/; cp -c -R "\$REPO/.git" "\$SANDBOX/.git" 2>/dev/null || cp -R "\$REPO/.git" "\$SANDBOX/.git"; cd "$SANDBOX"; ${runSetupAndCli}`;
|
|
40
40
|
}
|
package/dist/sandbox.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox.mjs","names":[],"sources":["../src/sandbox.ts"],"sourcesContent":["import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\n/** Escapes a path literal for embedding inside an awk ERE. */\nfunction escapeAwkRegex(path: string): string {\n\treturn path.replace(/[.[\\]{}()*+?^$|\\\\/]/g, \"\\\\$&\");\n}\n\n/**\n * Builds the shell filter applied to newline-delimited `git ls-files` output\n * before `rsync --files-from`. For `apps/<x>` it drops the app's files but keeps\n * `apps/<x>/package.json` (the monorepo workspace graph needs it during build);\n * any other entry drops the path and its subtree. Returns `cat` (passthrough)\n * when nothing is excluded. Uses awk so it is portable across macOS and Linux.\n */\nexport function buildSandboxFileFilter(excludePaths: string[] = []): string {\n\tif (excludePaths.length === 0) {\n\t\treturn \"cat\";\n\t}\n\n\tconst clauses = excludePaths.map((entry) => {\n\t\tconst escaped = escapeAwkRegex(entry);\n\n\t\tif (entry.startsWith(\"apps/\")) {\n\t\t\treturn `!(/^${escaped}\\\\// && !/^${escaped}\\\\/package\\\\.json$/)`;\n\t\t}\n\n\t\treturn `!/^${escaped}(\\\\/|$)/`;\n\t});\n\n\treturn `awk '${clauses.join(\" && \")}'`;\n}\n\n/** Root of the per-deploy sandbox tree. The DeploySandbox resource GCs this. */\nconst SANDBOX_ROOT = \"/tmp/infracraft\";\n\ninterface SandboxScriptOptions {\n\t/** Whether to isolate into a /tmp copy (false → run in the live tree). */\n\tsandbox: boolean;\n\t/** Whether the sandbox `.git` is a metadata-free stub (true) or the real one. */\n\tgitGuard: boolean;\n\t/** Resource-derived name, used
|
|
1
|
+
{"version":3,"file":"sandbox.mjs","names":[],"sources":["../src/sandbox.ts"],"sourcesContent":["import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\n/** Escapes a path literal for embedding inside an awk ERE. */\nfunction escapeAwkRegex(path: string): string {\n\treturn path.replace(/[.[\\]{}()*+?^$|\\\\/]/g, \"\\\\$&\");\n}\n\n/**\n * Builds the shell filter applied to newline-delimited `git ls-files` output\n * before `rsync --files-from`. For `apps/<x>` it drops the app's files but keeps\n * `apps/<x>/package.json` (the monorepo workspace graph needs it during build);\n * any other entry drops the path and its subtree. Returns `cat` (passthrough)\n * when nothing is excluded. Uses awk so it is portable across macOS and Linux.\n */\nexport function buildSandboxFileFilter(excludePaths: string[] = []): string {\n\tif (excludePaths.length === 0) {\n\t\treturn \"cat\";\n\t}\n\n\tconst clauses = excludePaths.map((entry) => {\n\t\tconst escaped = escapeAwkRegex(entry);\n\n\t\tif (entry.startsWith(\"apps/\")) {\n\t\t\treturn `!(/^${escaped}\\\\// && !/^${escaped}\\\\/package\\\\.json$/)`;\n\t\t}\n\n\t\treturn `!/^${escaped}(\\\\/|$)/`;\n\t});\n\n\treturn `awk '${clauses.join(\" && \")}'`;\n}\n\n/** Root of the per-deploy sandbox tree. The DeploySandbox resource GCs this. */\nconst SANDBOX_ROOT = \"/tmp/infracraft\";\n\ninterface SandboxScriptOptions {\n\t/** Whether to isolate into a /tmp copy (false → run in the live tree). */\n\tsandbox: boolean;\n\t/** Whether the sandbox `.git` is a metadata-free stub (true) or the real one. */\n\tgitGuard: boolean;\n\t/** Resource-derived name, used in the sandbox dir prefix. */\n\tappName: string;\n\t/** Stack/environment name, prefixed to the sandbox dir so leftovers and\n\t * concurrent deploys are identifiable (e.g. `staging-vercel-deploy-nexus.XXXX`). */\n\tenv?: string;\n\t/** Upload-scoping excludes; applied only in stub mode (see design spec). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Fully-formed platform deploy command (its exit code becomes the script's). */\n\tcli: string;\n}\n\n/**\n * Builds the shell for a deploy's `command.local.Command.create`. See\n * docs/superpowers/specs/2026-06-05-deploy-sandbox-design.md for the modes.\n */\nexport function buildSandboxScript(options: SandboxScriptOptions): string {\n\tconst { sandbox, gitGuard, appName, env, excludePaths, setup, cli } = options;\n\n\tconst head = `REPO=$(git rev-parse --show-toplevel)`;\n\tconst runSetupAndCli = [setup, cli].filter(Boolean).join(\"; \");\n\n\tif (!sandbox) {\n\t\treturn `${head}; cd \"$REPO\"; ${runSetupAndCli}`;\n\t}\n\n\t// Prefix the dir with the env so leftovers/concurrent deploys are identifiable.\n\tconst dirPrefix = env ? `${env}-${appName}` : appName;\n\n\tconst makeSandbox = [\n\t\t`SANDBOX=$(mktemp -d ${SANDBOX_ROOT}/${dirPrefix}.XXXXXX)`,\n\t\t`trap 'rm -rf \"$SANDBOX\"' EXIT`,\n\t].join(\"; \");\n\n\tif (gitGuard) {\n\t\tconst filter = buildSandboxFileFilter(excludePaths);\n\n\t\tconst copy =\n\t\t\t`git -C \"$REPO\" ls-files | ${filter} | ` +\n\t\t\t`rsync -a --files-from=- \"$REPO\"/ \"$SANDBOX\"/`;\n\n\t\tconst stubGit = `cd \"$SANDBOX\" && git init -q && git add -A`;\n\n\t\treturn `${head}; ${makeSandbox}; ${copy}; ${stubGit}; ${runSetupAndCli}`;\n\t}\n\n\t// Original `.git`, full clean tree (no filter, no reconciliation needed).\n\tconst copy = `git -C \"$REPO\" ls-files | rsync -a --files-from=- \"$REPO\"/ \"$SANDBOX\"/`;\n\n\tconst copyGit =\n\t\t`cp -c -R \"$REPO/.git\" \"$SANDBOX/.git\" 2>/dev/null || ` +\n\t\t`cp -R \"$REPO/.git\" \"$SANDBOX/.git\"`;\n\n\treturn `${head}; ${makeSandbox}; ${copy}; ${copyGit}; cd \"$SANDBOX\"; ${runSetupAndCli}`;\n}\n\n/** Cross-bundle brand: `instanceof` is unreliable when the seam and the resource\n * come from different built entries, so the seam detects sandboxes by this. */\nconst DEPLOY_SANDBOX_BRAND = Symbol.for(\"@infracraft/pulumi/DeploySandbox\");\n\n/** Sweep sandboxes orphaned by a hard-killed run (older than this). */\nconst STALE_SANDBOX_MS = 24 * 60 * 60 * 1000;\n\n/**\n * Isolation marker + workspace lifecycle. Listing it in a deploy's `dependsOn`\n * makes that deploy run in an isolated `/tmp/infracraft` copy. Carries no config;\n * the repo root is derived at runtime by the deploy command.\n */\nexport class DeploySandbox extends pulumi.ComponentResource {\n\tconstructor(name: string, opts?: pulumi.ComponentResourceOptions) {\n\t\tsuper(\"infracraft:sandbox:DeploySandbox\", name, {}, opts);\n\n\t\t(this as Record<symbol, unknown>)[DEPLOY_SANDBOX_BRAND] = true;\n\n\t\tif (!pulumi.runtime.isDryRun()) {\n\t\t\tthis.prepareWorkspace();\n\t\t}\n\n\t\tthis.registerOutputs({});\n\t}\n\n\t/** mkdir the workspace root and GC stale sandboxes (best-effort). */\n\tprivate prepareWorkspace(): void {\n\t\tfs.mkdirSync(SANDBOX_ROOT, { recursive: true });\n\n\t\tlet entries: string[] = [];\n\n\t\ttry {\n\t\t\tentries = fs.readdirSync(SANDBOX_ROOT) as string[];\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\n\t\tconst now = Date.now();\n\n\t\tfor (const entry of entries) {\n\t\t\tconst full = path.join(SANDBOX_ROOT, entry);\n\n\t\t\ttry {\n\t\t\t\tif (now - fs.statSync(full).mtimeMs > STALE_SANDBOX_MS) {\n\t\t\t\t\tfs.rmSync(full, { recursive: true, force: true });\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// Racing with an in-flight deploy's cleanup — ignore.\n\t\t\t}\n\t\t}\n\t}\n}\n\n/** Bundle-safe check for a `DeploySandbox` in a `dependsOn` array. */\nexport function isDeploySandbox(value: unknown): value is DeploySandbox {\n\treturn (\n\t\ttypeof value === \"object\" &&\n\t\tvalue !== null &&\n\t\t(value as Record<symbol, unknown>)[DEPLOY_SANDBOX_BRAND] === true\n\t);\n}\n"],"mappings":";;;;;;;AAKA,SAAS,eAAe,MAAsB;CAC7C,OAAO,KAAK,QAAQ,wBAAwB,MAAM;AACnD;;;;;;;;AASA,SAAgB,uBAAuB,eAAyB,CAAC,GAAW;CAC3E,IAAI,aAAa,WAAW,GAC3B,OAAO;CAaR,OAAO,QAVS,aAAa,KAAK,UAAU;EAC3C,MAAM,UAAU,eAAe,KAAK;EAEpC,IAAI,MAAM,WAAW,OAAO,GAC3B,OAAO,OAAO,QAAQ,aAAa,QAAQ;EAG5C,OAAO,MAAM,QAAQ;CACtB,CAEqB,EAAE,KAAK,MAAM,EAAE;AACrC;;AAGA,MAAM,eAAe;;;;;AAwBrB,SAAgB,mBAAmB,SAAuC;CACzE,MAAM,EAAE,SAAS,UAAU,SAAS,KAAK,cAAc,OAAO,QAAQ;CAEtE,MAAM,OAAO;CACb,MAAM,iBAAiB,CAAC,OAAO,GAAG,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;CAE7D,IAAI,CAAC,SACJ,OAAO,GAAG,KAAK,gBAAgB;CAMhC,MAAM,cAAc,CACnB,uBAAuB,aAAa,GAHnB,MAAM,GAAG,IAAI,GAAG,YAAY,QAGI,WACjD,+BACD,EAAE,KAAK,IAAI;CAEX,IAAI,UASH,OAAO,GAAG,KAAK,IAAI,YAAY,IAAI,6BARpB,uBAAuB,YAGH,EAAE,iDAKG,iDAAgB;CAUzD,OAAO,GAAG,KAAK,IAAI,YAAY,2LAAwC;AACxE;;;AAIA,MAAM,uBAAuB,OAAO,IAAI,kCAAkC;;AAG1E,MAAM,mBAAmB,OAAU,KAAK;;;;;;AAOxC,IAAa,gBAAb,cAAmC,OAAO,kBAAkB;CAC3D,YAAY,MAAc,MAAwC;EACjE,MAAM,oCAAoC,MAAM,CAAC,GAAG,IAAI;EAExD,AAAC,KAAiC,wBAAwB;EAE1D,IAAI,CAAC,OAAO,QAAQ,SAAS,GAC5B,KAAK,iBAAiB;EAGvB,KAAK,gBAAgB,CAAC,CAAC;CACxB;;CAGA,AAAQ,mBAAyB;EAChC,GAAG,UAAU,cAAc,EAAE,WAAW,KAAK,CAAC;EAE9C,IAAI,UAAoB,CAAC;EAEzB,IAAI;GACH,UAAU,GAAG,YAAY,YAAY;EACtC,QAAQ;GACP;EACD;EAEA,MAAM,MAAM,KAAK,IAAI;EAErB,KAAK,MAAM,SAAS,SAAS;GAC5B,MAAM,OAAO,KAAK,KAAK,cAAc,KAAK;GAE1C,IAAI;IACH,IAAI,MAAM,GAAG,SAAS,IAAI,EAAE,UAAU,kBACrC,GAAG,OAAO,MAAM;KAAE,WAAW;KAAM,OAAO;IAAK,CAAC;GAElD,QAAQ,CAER;EACD;CACD;AACD;;AAGA,SAAgB,gBAAgB,OAAwC;CACvE,OACC,OAAO,UAAU,YACjB,UAAU,QACT,MAAkC,0BAA0B;AAE/D"}
|