@infracraft/pulumi 1.16.5 → 1.16.7

package/dist/commands/deploy.cjs

@@ -24,10 +24,11 @@ function createDeployCommand(args, opts) {
 	const sandbox = deps.some(require_sandbox.isDeploySandbox);
 	const gitGuard = deps.some(require_git_guard.isGitGuard);
 	if (gitGuard && !sandbox) throw new Error(`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`);
+	let mode = "NONE";
+	if (sandbox) mode = gitGuard ? "STUB" : "ORIGINAL";
 	const env = _pulumi_pulumi.getStack();
 	const create = _pulumi_pulumi.output(args.cli).apply((cli) => require_sandbox.buildSandboxScript({
-		sandbox,
-		gitGuard,
+		mode,
 		appName: args.name,
 		env,
 		excludePaths: args.excludePaths,
@@ -47,4 +48,5 @@ function createDeployCommand(args, opts) {
 
 //#endregion
 exports.createDeployCommand = createDeployCommand;
+exports.dependsOnList = dependsOnList;
 //# sourceMappingURL=deploy.cjs.map

package/dist/commands/deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.cjs","names":["isDeploySandbox","isGitGuard","pulumi","buildSandboxScript","command"],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["// src/commands/deploy.ts\nimport * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { isGitGuard } from \"../git-guard\";\nimport { buildSandboxScript, isDeploySandbox } from \"../sandbox\";\n\nexport interface CreateDeployCommandArgs {\n\t/** Resource name; the child command is `<name>` and the sandbox dir uses it. */\n\tname: string;\n\t/** Fully-formed platform deploy command (may be an Output, e.g. Railway). */\n\tcli: pulumi.Input<string>;\n\t/** Redeploy triggers (source/env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Upload-scoping excludes (applied only in stub mode). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Env passed to the command (secrets that survive preview; not the inlined ones). */\n\tenvironment?: Record<string, pulumi.Input<string>>;\n}\n\nexport interface CreateDeployCommandResult {\n\tcommand: command.local.Command;\n\t/** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */\n\tdeploymentUrl: pulumi.Output<string>;\n}\n\n/** Reads a `dependsOn` opt into a flat array of resource instances. */\nfunction dependsOnList(opts: pulumi.ComponentResourceOptions): unknown[] {\n\tconst dep = opts.dependsOn;\n\n\tif (Array.isArray(dep)) {\n\t\treturn dep;\n\t}\n\n\treturn dep ? [dep] : [];\n}\n\n/**\n * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:\n * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.\n * The platform deploy resources call ONLY this; they never touch the sandbox.\n */\nexport function createDeployCommand(\n\targs: CreateDeployCommandArgs,\n\topts: pulumi.ComponentResourceOptions,\n): CreateDeployCommandResult {\n\tconst deps = dependsOnList(opts);\n\tconst sandbox = deps.some(isDeploySandbox);\n\tconst gitGuard = deps.some(isGitGuard);\n\n\tif (gitGuard && !sandbox) {\n\t\tthrow new Error(\n\t\t\t`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`,\n\t\t);\n\t}\n\n\tconst env = pulumi.getStack();\n\n\tconst create = pulumi.output(args.cli).apply((cli) =>\n\t\tbuildSandboxScript({\n\t\t\tsandbox,\n\t\t\tgitGuard,\n\t\t\tappName: args.name,\n\t\t\tenv,\n\t\t\texcludePaths: args.excludePaths,\n\t\t\tsetup: args.setup,\n\t\t\tcli,\n\t\t}),\n\t);\n\n\tconst cmd = new command.local.Command(\n\t\targs.name,\n\t\t{ create, triggers: args.triggers, environment: args.environment },\n\t\topts,\n\t);\n\n\tconst deploymentUrl = cmd.stdout.apply(\n\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t);\n\n\treturn { command: cmd, deploymentUrl };\n}\n"],"mappings":";;;;;;;;;;;AA6BA,SAAS,cAAc,MAAkD;CACxE,MAAM,MAAM,KAAK;CAEjB,IAAI,MAAM,QAAQ,GAAG,GACpB,OAAO;CAGR,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACvB;;;;;;AAOA,SAAgB,oBACf,MACA,MAC4B;CAC5B,MAAM,OAAO,cAAc,IAAI;CAC/B,MAAM,UAAU,KAAK,KAAKA,+BAAe;CACzC,MAAM,WAAW,KAAK,KAAKC,4BAAU;CAErC,IAAI,YAAY,CAAC,SAChB,MAAM,IAAI,MACT,gBAAgB,KAAK,KAAK,8DAC3B;CAGD,MAAM,MAAMC,eAAO,SAAS;CAE5B,MAAM,SAASA,eAAO,OAAO,KAAK,GAAG,EAAE,OAAO,QAC7CC,mCAAmB;EAClB;EACA;EACA,SAAS,KAAK;EACd;EACA,cAAc,KAAK;EACnB,OAAO,KAAK;EACZ;CACD,CAAC,CACF;CAEA,MAAM,MAAM,IAAIC,gBAAQ,MAAM,QAC7B,KAAK,MACL;EAAE;EAAQ,UAAU,KAAK;EAAU,aAAa,KAAK;CAAY,GACjE,IACD;CAMA,OAAO;EAAE,SAAS;EAAK,eAJD,IAAI,OAAO,OAC/B,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAGP;CAAE;AACtC"}
+{"version":3,"file":"deploy.cjs","names":["isDeploySandbox","isGitGuard","pulumi","buildSandboxScript","command"],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["// src/commands/deploy.ts\nimport * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { isGitGuard } from \"../git-guard\";\nimport { buildSandboxScript, isDeploySandbox, SandboxMode } from \"../sandbox\";\n\nexport interface CreateDeployCommandArgs {\n\t/** Resource name; the child command is `<name>` and the sandbox dir uses it. */\n\tname: string;\n\t/** Fully-formed platform deploy command (may be an Output, e.g. Railway). */\n\tcli: pulumi.Input<string>;\n\t/** Redeploy triggers (source/env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Upload-scoping excludes (applied only in stub mode). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Env passed to the command (secrets that survive preview; not the inlined ones). */\n\tenvironment?: Record<string, pulumi.Input<string>>;\n}\n\nexport interface CreateDeployCommandResult {\n\tcommand: command.local.Command;\n\t/** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */\n\tdeploymentUrl: pulumi.Output<string>;\n}\n\n/** Reads a `dependsOn` opt into a flat array of resource instances. */\nexport function dependsOnList(\n\topts: pulumi.ComponentResourceOptions,\n): unknown[] {\n\tconst dep = opts.dependsOn;\n\n\tif (Array.isArray(dep)) {\n\t\treturn dep;\n\t}\n\n\treturn dep ? [dep] : [];\n}\n\n/**\n * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:\n * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.\n * The platform deploy resources call ONLY this; they never touch the sandbox.\n */\nexport function createDeployCommand(\n\targs: CreateDeployCommandArgs,\n\topts: pulumi.ComponentResourceOptions,\n): CreateDeployCommandResult {\n\tconst deps = dependsOnList(opts);\n\tconst sandbox = deps.some(isDeploySandbox);\n\tconst gitGuard = deps.some(isGitGuard);\n\n\tif (gitGuard && !sandbox) {\n\t\tthrow new Error(\n\t\t\t`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`,\n\t\t);\n\t}\n\n\tlet mode = SandboxMode.NONE;\n\n\tif (sandbox) {\n\t\tmode = gitGuard ? SandboxMode.STUB : SandboxMode.ORIGINAL;\n\t}\n\n\tconst env = pulumi.getStack();\n\n\tconst create = pulumi.output(args.cli).apply((cli) =>\n\t\tbuildSandboxScript({\n\t\t\tmode,\n\t\t\tappName: args.name,\n\t\t\tenv,\n\t\t\texcludePaths: args.excludePaths,\n\t\t\tsetup: args.setup,\n\t\t\tcli,\n\t\t}),\n\t);\n\n\tconst cmd = new command.local.Command(\n\t\targs.name,\n\t\t{ create, triggers: args.triggers, environment: args.environment },\n\t\topts,\n\t);\n\n\tconst deploymentUrl = cmd.stdout.apply(\n\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t);\n\n\treturn { command: cmd, deploymentUrl };\n}\n"],"mappings":";;;;;;;;;;;AA6BA,SAAgB,cACf,MACY;CACZ,MAAM,MAAM,KAAK;CAEjB,IAAI,MAAM,QAAQ,GAAG,GACpB,OAAO;CAGR,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACvB;;;;;;AAOA,SAAgB,oBACf,MACA,MAC4B;CAC5B,MAAM,OAAO,cAAc,IAAI;CAC/B,MAAM,UAAU,KAAK,KAAKA,+BAAe;CACzC,MAAM,WAAW,KAAK,KAAKC,4BAAU;CAErC,IAAI,YAAY,CAAC,SAChB,MAAM,IAAI,MACT,gBAAgB,KAAK,KAAK,8DAC3B;CAGD,IAAI;CAEJ,IAAI,SACH,OAAO;CAGR,MAAM,MAAMC,eAAO,SAAS;CAE5B,MAAM,SAASA,eAAO,OAAO,KAAK,GAAG,EAAE,OAAO,QAC7CC,mCAAmB;EAClB;EACA,SAAS,KAAK;EACd;EACA,cAAc,KAAK;EACnB,OAAO,KAAK;EACZ;CACD,CAAC,CACF;CAEA,MAAM,MAAM,IAAIC,gBAAQ,MAAM,QAC7B,KAAK,MACL;EAAE;EAAQ,UAAU,KAAK;EAAU,aAAa,KAAK;CAAY,GACjE,IACD;CAMA,OAAO;EAAE,SAAS;EAAK,eAJD,IAAI,OAAO,OAC/B,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAGP;CAAE;AACtC"}

package/dist/commands/deploy.d.cts

@@ -22,6 +22,8 @@ interface CreateDeployCommandResult {
   /** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */
   deploymentUrl: pulumi.Output<string>;
 }
+/** Reads a `dependsOn` opt into a flat array of resource instances. */
+declare function dependsOnList(opts: pulumi.ComponentResourceOptions): unknown[];
 /**
  * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:
  * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.
@@ -29,5 +31,5 @@ interface CreateDeployCommandResult {
  */
 declare function createDeployCommand(args: CreateDeployCommandArgs, opts: pulumi.ComponentResourceOptions): CreateDeployCommandResult;
 //#endregion
-export { CreateDeployCommandArgs, CreateDeployCommandResult, createDeployCommand };
+export { CreateDeployCommandArgs, CreateDeployCommandResult, createDeployCommand, dependsOnList };
 //# sourceMappingURL=deploy.d.cts.map

package/dist/commands/deploy.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/commands/deploy.ts"],"mappings":";;;;;UAOiB,uBAAA;;EAEhB,IAAA;EAFgB;EAIhB,GAAA,EAAK,MAAA,CAAO,KAAA;;EAEZ,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAAP;EAEvB,YAAA;EAI6B;EAF7B,KAAA;EAEoB;EAApB,WAAA,GAAc,MAAA,SAAe,MAAA,CAAO,KAAA;AAAA;AAAA,UAGpB,yBAAA;EAChB,OAAA,EAAS,OAAA,CAAQ,KAAA,CAAM,OAAA;EAZX;EAcZ,aAAA,EAAe,MAAA,CAAO,MAAM;AAAA;;;;;;iBAmBb,mBAAA,CACf,IAAA,EAAM,uBAAA,EACN,IAAA,EAAM,MAAA,CAAO,wBAAA,GACX,yBAAA"}
+{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/commands/deploy.ts"],"mappings":";;;;;UAOiB,uBAAA;;EAEhB,IAAA;EAFgB;EAIhB,GAAA,EAAK,MAAA,CAAO,KAAA;;EAEZ,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAAP;EAEvB,YAAA;EAI6B;EAF7B,KAAA;EAEoB;EAApB,WAAA,GAAc,MAAA,SAAe,MAAA,CAAO,KAAA;AAAA;AAAA,UAGpB,yBAAA;EAChB,OAAA,EAAS,OAAA,CAAQ,KAAA,CAAM,OAAA;EAZX;EAcZ,aAAA,EAAe,MAAA,CAAO,MAAM;AAAA;;iBAIb,aAAA,CACf,IAAA,EAAM,MAAA,CAAO,wBAAwB;;;;;;iBAgBtB,mBAAA,CACf,IAAA,EAAM,uBAAA,EACN,IAAA,EAAM,MAAA,CAAO,wBAAA,GACX,yBAAA"}

package/dist/commands/deploy.d.mts

@@ -22,6 +22,8 @@ interface CreateDeployCommandResult {
   /** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */
   deploymentUrl: pulumi.Output<string>;
 }
+/** Reads a `dependsOn` opt into a flat array of resource instances. */
+declare function dependsOnList(opts: pulumi.ComponentResourceOptions): unknown[];
 /**
  * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:
  * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.
@@ -29,5 +31,5 @@ interface CreateDeployCommandResult {
  */
 declare function createDeployCommand(args: CreateDeployCommandArgs, opts: pulumi.ComponentResourceOptions): CreateDeployCommandResult;
 //#endregion
-export { CreateDeployCommandArgs, CreateDeployCommandResult, createDeployCommand };
+export { CreateDeployCommandArgs, CreateDeployCommandResult, createDeployCommand, dependsOnList };
 //# sourceMappingURL=deploy.d.mts.map

package/dist/commands/deploy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/commands/deploy.ts"],"mappings":";;;;;UAOiB,uBAAA;;EAEhB,IAAA;EAFgB;EAIhB,GAAA,EAAK,MAAA,CAAO,KAAA;;EAEZ,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAAP;EAEvB,YAAA;EAI6B;EAF7B,KAAA;EAEoB;EAApB,WAAA,GAAc,MAAA,SAAe,MAAA,CAAO,KAAA;AAAA;AAAA,UAGpB,yBAAA;EAChB,OAAA,EAAS,OAAA,CAAQ,KAAA,CAAM,OAAA;EAZX;EAcZ,aAAA,EAAe,MAAA,CAAO,MAAM;AAAA;;;;;;iBAmBb,mBAAA,CACf,IAAA,EAAM,uBAAA,EACN,IAAA,EAAM,MAAA,CAAO,wBAAA,GACX,yBAAA"}
+{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/commands/deploy.ts"],"mappings":";;;;;UAOiB,uBAAA;;EAEhB,IAAA;EAFgB;EAIhB,GAAA,EAAK,MAAA,CAAO,KAAA;;EAEZ,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAAP;EAEvB,YAAA;EAI6B;EAF7B,KAAA;EAEoB;EAApB,WAAA,GAAc,MAAA,SAAe,MAAA,CAAO,KAAA;AAAA;AAAA,UAGpB,yBAAA;EAChB,OAAA,EAAS,OAAA,CAAQ,KAAA,CAAM,OAAA;EAZX;EAcZ,aAAA,EAAe,MAAA,CAAO,MAAM;AAAA;;iBAIb,aAAA,CACf,IAAA,EAAM,MAAA,CAAO,wBAAwB;;;;;;iBAgBtB,mBAAA,CACf,IAAA,EAAM,uBAAA,EACN,IAAA,EAAM,MAAA,CAAO,wBAAA,GACX,yBAAA"}

package/dist/commands/deploy.mjs

@@ -1,6 +1,6 @@
 import { t as __name } from "../chunk-OPjESj5l.mjs";
 import { isGitGuard } from "../git-guard.mjs";
-import { buildSandboxScript, isDeploySandbox } from "../sandbox.mjs";
+import { SandboxMode, buildSandboxScript, isDeploySandbox } from "../sandbox.mjs";
 import * as pulumi from "@pulumi/pulumi";
 import * as command from "@pulumi/command";
 
@@ -21,10 +21,11 @@ function createDeployCommand(args, opts) {
 	const sandbox = deps.some(isDeploySandbox);
 	const gitGuard = deps.some(isGitGuard);
 	if (gitGuard && !sandbox) throw new Error(`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`);
+	let mode = "NONE";
+	if (sandbox) mode = gitGuard ? "STUB" : "ORIGINAL";
 	const env = pulumi.getStack();
 	const create = pulumi.output(args.cli).apply((cli) => buildSandboxScript({
-		sandbox,
-		gitGuard,
+		mode,
 		appName: args.name,
 		env,
 		excludePaths: args.excludePaths,
@@ -43,5 +44,5 @@ function createDeployCommand(args, opts) {
 }
 
 //#endregion
-export { createDeployCommand };
+export { createDeployCommand, dependsOnList };
 //# sourceMappingURL=deploy.mjs.map

package/dist/commands/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["// src/commands/deploy.ts\nimport * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { isGitGuard } from \"../git-guard\";\nimport { buildSandboxScript, isDeploySandbox } from \"../sandbox\";\n\nexport interface CreateDeployCommandArgs {\n\t/** Resource name; the child command is `<name>` and the sandbox dir uses it. */\n\tname: string;\n\t/** Fully-formed platform deploy command (may be an Output, e.g. Railway). */\n\tcli: pulumi.Input<string>;\n\t/** Redeploy triggers (source/env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Upload-scoping excludes (applied only in stub mode). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Env passed to the command (secrets that survive preview; not the inlined ones). */\n\tenvironment?: Record<string, pulumi.Input<string>>;\n}\n\nexport interface CreateDeployCommandResult {\n\tcommand: command.local.Command;\n\t/** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */\n\tdeploymentUrl: pulumi.Output<string>;\n}\n\n/** Reads a `dependsOn` opt into a flat array of resource instances. */\nfunction dependsOnList(opts: pulumi.ComponentResourceOptions): unknown[] {\n\tconst dep = opts.dependsOn;\n\n\tif (Array.isArray(dep)) {\n\t\treturn dep;\n\t}\n\n\treturn dep ? [dep] : [];\n}\n\n/**\n * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:\n * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.\n * The platform deploy resources call ONLY this; they never touch the sandbox.\n */\nexport function createDeployCommand(\n\targs: CreateDeployCommandArgs,\n\topts: pulumi.ComponentResourceOptions,\n): CreateDeployCommandResult {\n\tconst deps = dependsOnList(opts);\n\tconst sandbox = deps.some(isDeploySandbox);\n\tconst gitGuard = deps.some(isGitGuard);\n\n\tif (gitGuard && !sandbox) {\n\t\tthrow new Error(\n\t\t\t`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`,\n\t\t);\n\t}\n\n\tconst env = pulumi.getStack();\n\n\tconst create = pulumi.output(args.cli).apply((cli) =>\n\t\tbuildSandboxScript({\n\t\t\tsandbox,\n\t\t\tgitGuard,\n\t\t\tappName: args.name,\n\t\t\tenv,\n\t\t\texcludePaths: args.excludePaths,\n\t\t\tsetup: args.setup,\n\t\t\tcli,\n\t\t}),\n\t);\n\n\tconst cmd = new command.local.Command(\n\t\targs.name,\n\t\t{ create, triggers: args.triggers, environment: args.environment },\n\t\topts,\n\t);\n\n\tconst deploymentUrl = cmd.stdout.apply(\n\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t);\n\n\treturn { command: cmd, deploymentUrl };\n}\n"],"mappings":";;;;;;;;AA6BA,SAAS,cAAc,MAAkD;CACxE,MAAM,MAAM,KAAK;CAEjB,IAAI,MAAM,QAAQ,GAAG,GACpB,OAAO;CAGR,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACvB;;;;;;AAOA,SAAgB,oBACf,MACA,MAC4B;CAC5B,MAAM,OAAO,cAAc,IAAI;CAC/B,MAAM,UAAU,KAAK,KAAK,eAAe;CACzC,MAAM,WAAW,KAAK,KAAK,UAAU;CAErC,IAAI,YAAY,CAAC,SAChB,MAAM,IAAI,MACT,gBAAgB,KAAK,KAAK,8DAC3B;CAGD,MAAM,MAAM,OAAO,SAAS;CAE5B,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG,EAAE,OAAO,QAC7C,mBAAmB;EAClB;EACA;EACA,SAAS,KAAK;EACd;EACA,cAAc,KAAK;EACnB,OAAO,KAAK;EACZ;CACD,CAAC,CACF;CAEA,MAAM,MAAM,IAAI,QAAQ,MAAM,QAC7B,KAAK,MACL;EAAE;EAAQ,UAAU,KAAK;EAAU,aAAa,KAAK;CAAY,GACjE,IACD;CAMA,OAAO;EAAE,SAAS;EAAK,eAJD,IAAI,OAAO,OAC/B,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAGP;CAAE;AACtC"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["// src/commands/deploy.ts\nimport * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { isGitGuard } from \"../git-guard\";\nimport { buildSandboxScript, isDeploySandbox, SandboxMode } from \"../sandbox\";\n\nexport interface CreateDeployCommandArgs {\n\t/** Resource name; the child command is `<name>` and the sandbox dir uses it. */\n\tname: string;\n\t/** Fully-formed platform deploy command (may be an Output, e.g. Railway). */\n\tcli: pulumi.Input<string>;\n\t/** Redeploy triggers (source/env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Upload-scoping excludes (applied only in stub mode). */\n\texcludePaths?: string[];\n\t/** Shell run in the working dir before `cli` (e.g. write railpack.json). */\n\tsetup?: string;\n\t/** Env passed to the command (secrets that survive preview; not the inlined ones). */\n\tenvironment?: Record<string, pulumi.Input<string>>;\n}\n\nexport interface CreateDeployCommandResult {\n\tcommand: command.local.Command;\n\t/** The deploy CLI's final stdout line (the production URL for Vercel/Fly). */\n\tdeploymentUrl: pulumi.Output<string>;\n}\n\n/** Reads a `dependsOn` opt into a flat array of resource instances. */\nexport function dependsOnList(\n\topts: pulumi.ComponentResourceOptions,\n): unknown[] {\n\tconst dep = opts.dependsOn;\n\n\tif (Array.isArray(dep)) {\n\t\treturn dep;\n\t}\n\n\treturn dep ? [dep] : [];\n}\n\n/**\n * Builds a sandboxed deploy command. Inspects `opts.dependsOn` by brand:\n * a DeploySandbox → isolate; a GitGuard → stub `.git`; GitGuard alone → throw.\n * The platform deploy resources call ONLY this; they never touch the sandbox.\n */\nexport function createDeployCommand(\n\targs: CreateDeployCommandArgs,\n\topts: pulumi.ComponentResourceOptions,\n): CreateDeployCommandResult {\n\tconst deps = dependsOnList(opts);\n\tconst sandbox = deps.some(isDeploySandbox);\n\tconst gitGuard = deps.some(isGitGuard);\n\n\tif (gitGuard && !sandbox) {\n\t\tthrow new Error(\n\t\t\t`[infracraft] ${args.name}: GitGuard has no effect without a DeploySandbox in dependsOn`,\n\t\t);\n\t}\n\n\tlet mode = SandboxMode.NONE;\n\n\tif (sandbox) {\n\t\tmode = gitGuard ? SandboxMode.STUB : SandboxMode.ORIGINAL;\n\t}\n\n\tconst env = pulumi.getStack();\n\n\tconst create = pulumi.output(args.cli).apply((cli) =>\n\t\tbuildSandboxScript({\n\t\t\tmode,\n\t\t\tappName: args.name,\n\t\t\tenv,\n\t\t\texcludePaths: args.excludePaths,\n\t\t\tsetup: args.setup,\n\t\t\tcli,\n\t\t}),\n\t);\n\n\tconst cmd = new command.local.Command(\n\t\targs.name,\n\t\t{ create, triggers: args.triggers, environment: args.environment },\n\t\topts,\n\t);\n\n\tconst deploymentUrl = cmd.stdout.apply(\n\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t);\n\n\treturn { command: cmd, deploymentUrl };\n}\n"],"mappings":";;;;;;;;AA6BA,SAAgB,cACf,MACY;CACZ,MAAM,MAAM,KAAK;CAEjB,IAAI,MAAM,QAAQ,GAAG,GACpB,OAAO;CAGR,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACvB;;;;;;AAOA,SAAgB,oBACf,MACA,MAC4B;CAC5B,MAAM,OAAO,cAAc,IAAI;CAC/B,MAAM,UAAU,KAAK,KAAK,eAAe;CACzC,MAAM,WAAW,KAAK,KAAK,UAAU;CAErC,IAAI,YAAY,CAAC,SAChB,MAAM,IAAI,MACT,gBAAgB,KAAK,KAAK,8DAC3B;CAGD,IAAI;CAEJ,IAAI,SACH,OAAO;CAGR,MAAM,MAAM,OAAO,SAAS;CAE5B,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG,EAAE,OAAO,QAC7C,mBAAmB;EAClB;EACA,SAAS,KAAK;EACd;EACA,cAAc,KAAK;EACnB,OAAO,KAAK;EACZ;CACD,CAAC,CACF;CAEA,MAAM,MAAM,IAAI,QAAQ,MAAM,QAC7B,KAAK,MACL;EAAE;EAAQ,UAAU,KAAK;EAAU,aAAa,KAAK;CAAY,GACjE,IACD;CAMA,OAAO;EAAE,SAAS;EAAK,eAJD,IAAI,OAAO,OAC/B,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAGP;CAAE;AACtC"}

package/dist/fly/deploy.cjs

@@ -22,11 +22,8 @@ var FlyDeploy = class extends _pulumi_pulumi.ComponentResource {
 		const setup = `mkdir -p .fly && printf '%s' "$FLY_TOML_CONTENT" > ${configPath}`;
 		const cli = `fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`;
 		const triggers = _pulumi_pulumi.output(args.triggers).apply((values) => [...values, tomlContent]);
-		let consumerDeps;
-		if (Array.isArray(pulumiOpts.dependsOn)) consumerDeps = pulumiOpts.dependsOn;
-		else if (pulumiOpts.dependsOn) consumerDeps = [pulumiOpts.dependsOn];
-		else consumerDeps = [];
-		require_commands_deploy.createDeployCommand({
+		const consumerDeps = require_commands_deploy.dependsOnList(pulumiOpts);
+		const { deploymentUrl } = require_commands_deploy.createDeployCommand({
 			name,
 			cli,
 			triggers,
@@ -40,7 +37,8 @@ var FlyDeploy = class extends _pulumi_pulumi.ComponentResource {
 			parent: this,
 			dependsOn: [app, ...consumerDeps]
 		});
-		this.registerOutputs({});
+		this.deploymentUrl = deploymentUrl;
+		this.registerOutputs({ deploymentUrl: this.deploymentUrl });
 	}
 };
 

package/dist/fly/deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.cjs","names":["pulumi","generateFlyToml"],"sources":["../../src/fly/deploy.ts"],"sourcesContent":["// src/fly/deploy.ts  (replace entire file)\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport type { FlyApp } from \"./app\";\nimport type { FlyProvider } from \"./provider\";\nimport { type FlyTomlConfig, generateFlyToml } from \"./toml\";\n\ntype FlyDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\tprovider: FlyProvider;\n\tapp: FlyApp;\n};\n\nexport interface FlyDeployArgs {\n\t/** fly.toml configuration. `config.app` must equal the FlyApp name. */\n\tconfig: FlyTomlConfig;\n\t/** Redeploy triggers; the generated toml content is appended automatically. */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** `fly deploy --wait-timeout` seconds (default 300). */\n\twaitTimeout?: number;\n\t/** `fly deploy --release-command-timeout` seconds (default 600). */\n\treleaseCommandTimeout?: number;\n\t/** `fly deploy --ha` (default false). */\n\thighAvailability?: boolean;\n}\n\n/**\n * Deploys a Fly app via `fly deploy --remote-only` from a generated fly.toml.\n * Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).\n */\nexport class FlyDeploy extends pulumi.ComponentResource {\n\tconstructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions) {\n\t\tconst { provider, app, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:fly:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst tomlContent = generateFlyToml(args.config);\n\t\tconst configPath = `.fly/${args.config.app}.toml`;\n\n\t\tconst waitTimeout = args.waitTimeout ?? 300;\n\t\tconst releaseCommandTimeout = args.releaseCommandTimeout ?? 600;\n\t\tconst highAvailability = args.highAvailability ?? false;\n\n\t\t// The toml content arrives via FLY_TOML_CONTENT (avoids shell escaping).\n\t\tconst setup = `mkdir -p .fly && printf '%s' \"$FLY_TOML_CONTENT\" > ${configPath}`;\n\t\tconst cli = `fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`;\n\n\t\tconst triggers = pulumi\n\t\t\t.output(args.triggers)\n\t\t\t.apply((values) => [...values, tomlContent]);\n\n\t\tlet consumerDeps: pulumi.Resource[];\n\n\t\tif (Array.isArray(pulumiOpts.dependsOn)) {\n\t\t\tconsumerDeps = pulumiOpts.dependsOn as pulumi.Resource[];\n\t\t} else if (pulumiOpts.dependsOn) {\n\t\t\tconsumerDeps = [pulumiOpts.dependsOn as pulumi.Resource];\n\t\t} else {\n\t\t\tconsumerDeps = [];\n\t\t}\n\n\t\tcreateDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers,\n\t\t\t\tsetup,\n\t\t\t\tenvironment: {\n\t\t\t\t\tFLY_API_TOKEN: provider.token,\n\t\t\t\t\tFLY_TOML_CONTENT: tomlContent,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ ...pulumiOpts, parent: this, dependsOn: [app, ...consumerDeps] },\n\t\t);\n\n\t\tthis.registerOutputs({});\n\t}\n}\n"],"mappings":";;;;;;;;;;;;AA8BA,IAAa,YAAb,cAA+BA,eAAO,kBAAkB;CACvD,YAAY,MAAc,MAAqB,MAAwB;EACtE,MAAM,EAAE,UAAU,KAAK,GAAG,eAAe;EAEzC,MAAM,yBAAyB,MAAM,CAAC,GAAG,UAAU;EAEnD,MAAM,cAAcC,iCAAgB,KAAK,MAAM;EAC/C,MAAM,aAAa,QAAQ,KAAK,OAAO,IAAI;EAE3C,MAAM,cAAc,KAAK,eAAe;EACxC,MAAM,wBAAwB,KAAK,yBAAyB;EAC5D,MAAM,mBAAmB,KAAK,oBAAoB;EAGlD,MAAM,QAAQ,sDAAsD;EACpE,MAAM,MAAM,uBAAuB,WAAW,sBAAsB,iBAAiB,kBAAkB,YAAY,6BAA6B;EAEhJ,MAAM,WAAWD,eACf,OAAO,KAAK,QAAQ,EACpB,OAAO,WAAW,CAAC,GAAG,QAAQ,WAAW,CAAC;EAE5C,IAAI;EAEJ,IAAI,MAAM,QAAQ,WAAW,SAAS,GACrC,eAAe,WAAW;OACpB,IAAI,WAAW,WACrB,eAAe,CAAC,WAAW,SAA4B;OAEvD,eAAe,CAAC;EAGjB,4CACC;GACC;GACA;GACA;GACA;GACA,aAAa;IACZ,eAAe,SAAS;IACxB,kBAAkB;GACnB;EACD,GACA;GAAE,GAAG;GAAY,QAAQ;GAAM,WAAW,CAAC,KAAK,GAAG,YAAY;EAAE,CAClE;EAEA,KAAK,gBAAgB,CAAC,CAAC;CACxB;AACD"}
+{"version":3,"file":"deploy.cjs","names":["pulumi","generateFlyToml","dependsOnList","createDeployCommand"],"sources":["../../src/fly/deploy.ts"],"sourcesContent":["// src/fly/deploy.ts  (replace entire file)\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand, dependsOnList } from \"../commands/deploy\";\nimport type { FlyApp } from \"./app\";\nimport type { FlyProvider } from \"./provider\";\nimport { type FlyTomlConfig, generateFlyToml } from \"./toml\";\n\ntype FlyDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\tprovider: FlyProvider;\n\tapp: FlyApp;\n};\n\nexport interface FlyDeployArgs {\n\t/** fly.toml configuration. `config.app` must equal the FlyApp name. */\n\tconfig: FlyTomlConfig;\n\t/** Redeploy triggers; the generated toml content is appended automatically. */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** `fly deploy --wait-timeout` seconds (default 300). */\n\twaitTimeout?: number;\n\t/** `fly deploy --release-command-timeout` seconds (default 600). */\n\treleaseCommandTimeout?: number;\n\t/** `fly deploy --ha` (default false). */\n\thighAvailability?: boolean;\n}\n\n/**\n * Deploys a Fly app via `fly deploy --remote-only` from a generated fly.toml.\n * Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).\n */\nexport class FlyDeploy extends pulumi.ComponentResource {\n\t/** The deploy CLI's final stdout line (the Fly app URL when emitted). */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions) {\n\t\tconst { provider, app, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:fly:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst tomlContent = generateFlyToml(args.config);\n\t\tconst configPath = `.fly/${args.config.app}.toml`;\n\n\t\tconst waitTimeout = args.waitTimeout ?? 300;\n\t\tconst releaseCommandTimeout = args.releaseCommandTimeout ?? 600;\n\t\tconst highAvailability = args.highAvailability ?? false;\n\n\t\t// The toml content arrives via FLY_TOML_CONTENT (avoids shell escaping).\n\t\tconst setup = `mkdir -p .fly && printf '%s' \"$FLY_TOML_CONTENT\" > ${configPath}`;\n\t\tconst cli = `fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`;\n\n\t\tconst triggers = pulumi\n\t\t\t.output(args.triggers)\n\t\t\t.apply((values) => [...values, tomlContent]);\n\n\t\t// Keep the `app` ordering anchor first; append the consumer's deps\n\t\t// (DeploySandbox / GitGuard) using the seam's shared normaliser.\n\t\tconst consumerDeps = dependsOnList(pulumiOpts) as pulumi.Resource[];\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers,\n\t\t\t\tsetup,\n\t\t\t\tenvironment: {\n\t\t\t\t\tFLY_API_TOKEN: provider.token,\n\t\t\t\t\tFLY_TOML_CONTENT: tomlContent,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ ...pulumiOpts, parent: this, dependsOn: [app, ...consumerDeps] },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;AA8BA,IAAa,YAAb,cAA+BA,eAAO,kBAAkB;CAIvD,YAAY,MAAc,MAAqB,MAAwB;EACtE,MAAM,EAAE,UAAU,KAAK,GAAG,eAAe;EAEzC,MAAM,yBAAyB,MAAM,CAAC,GAAG,UAAU;EAEnD,MAAM,cAAcC,iCAAgB,KAAK,MAAM;EAC/C,MAAM,aAAa,QAAQ,KAAK,OAAO,IAAI;EAE3C,MAAM,cAAc,KAAK,eAAe;EACxC,MAAM,wBAAwB,KAAK,yBAAyB;EAC5D,MAAM,mBAAmB,KAAK,oBAAoB;EAGlD,MAAM,QAAQ,sDAAsD;EACpE,MAAM,MAAM,uBAAuB,WAAW,sBAAsB,iBAAiB,kBAAkB,YAAY,6BAA6B;EAEhJ,MAAM,WAAWD,eACf,OAAO,KAAK,QAAQ,EACpB,OAAO,WAAW,CAAC,GAAG,QAAQ,WAAW,CAAC;EAI5C,MAAM,eAAeE,sCAAc,UAAU;EAE7C,MAAM,EAAE,kBAAkBC,4CACzB;GACC;GACA;GACA;GACA;GACA,aAAa;IACZ,eAAe,SAAS;IACxB,kBAAkB;GACnB;EACD,GACA;GAAE,GAAG;GAAY,QAAQ;GAAM,WAAW,CAAC,KAAK,GAAG,YAAY;EAAE,CAClE;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}

package/dist/fly/deploy.d.cts

@@ -26,6 +26,8 @@ interface FlyDeployArgs {
  * Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).
  */
 declare class FlyDeploy extends pulumi.ComponentResource {
+  /** The deploy CLI's final stdout line (the Fly app URL when emitted). */
+  readonly deploymentUrl: pulumi.Output<string>;
   constructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions);
 }
 //#endregion

package/dist/fly/deploy.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/fly/deploy.ts"],"mappings":";;;;;;;KAQK,gBAAA,GAAmB,IAAA,CAAK,MAAA,CAAO,wBAAA;EACnC,QAAA,EAAU,WAAA;EACV,GAAA,EAAK,MAAA;AAAA;AAAA,UAGW,aAAA;;EAEhB,MAAA,EAAQ,aAAA;EAPe;EASvB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPzB;EASL,WAAA;EATW;EAWX,qBAAA;EAb4B;EAe5B,gBAAA;AAAA;;;;;cAOY,SAAA,SAAkB,MAAA,CAAO,iBAAA;cACzB,IAAA,UAAc,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,gBAAA;AAAA"}
+{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/fly/deploy.ts"],"mappings":";;;;;;;KAQK,gBAAA,GAAmB,IAAA,CAAK,MAAA,CAAO,wBAAA;EACnC,QAAA,EAAU,WAAA;EACV,GAAA,EAAK,MAAA;AAAA;AAAA,UAGW,aAAA;;EAEhB,MAAA,EAAQ,aAAA;EAPe;EASvB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPzB;EASL,WAAA;EATW;EAWX,qBAAA;EAb4B;EAe5B,gBAAA;AAAA;;;;;cAOY,SAAA,SAAkB,MAAA,CAAO,iBAAA;EAjBrB;EAAA,SAmBA,aAAA,EAAe,MAAA,CAAO,MAAA;cAE1B,IAAA,UAAc,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,gBAAA;AAAA"}

package/dist/fly/deploy.d.mts

@@ -26,6 +26,8 @@ interface FlyDeployArgs {
  * Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).
  */
 declare class FlyDeploy extends pulumi.ComponentResource {
+  /** The deploy CLI's final stdout line (the Fly app URL when emitted). */
+  readonly deploymentUrl: pulumi.Output<string>;
   constructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions);
 }
 //#endregion

package/dist/fly/deploy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/fly/deploy.ts"],"mappings":";;;;;;;KAQK,gBAAA,GAAmB,IAAA,CAAK,MAAA,CAAO,wBAAA;EACnC,QAAA,EAAU,WAAA;EACV,GAAA,EAAK,MAAA;AAAA;AAAA,UAGW,aAAA;;EAEhB,MAAA,EAAQ,aAAA;EAPe;EASvB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPzB;EASL,WAAA;EATW;EAWX,qBAAA;EAb4B;EAe5B,gBAAA;AAAA;;;;;cAOY,SAAA,SAAkB,MAAA,CAAO,iBAAA;cACzB,IAAA,UAAc,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,gBAAA;AAAA"}
+{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/fly/deploy.ts"],"mappings":";;;;;;;KAQK,gBAAA,GAAmB,IAAA,CAAK,MAAA,CAAO,wBAAA;EACnC,QAAA,EAAU,WAAA;EACV,GAAA,EAAK,MAAA;AAAA;AAAA,UAGW,aAAA;;EAEhB,MAAA,EAAQ,aAAA;EAPe;EASvB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPzB;EASL,WAAA;EATW;EAWX,qBAAA;EAb4B;EAe5B,gBAAA;AAAA;;;;;cAOY,SAAA,SAAkB,MAAA,CAAO,iBAAA;EAjBrB;EAAA,SAmBA,aAAA,EAAe,MAAA,CAAO,MAAA;cAE1B,IAAA,UAAc,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,gBAAA;AAAA"}

package/dist/fly/deploy.mjs

@@ -1,5 +1,5 @@
 import { t as __name } from "../chunk-OPjESj5l.mjs";
-import { createDeployCommand } from "../commands/deploy.mjs";
+import { createDeployCommand, dependsOnList } from "../commands/deploy.mjs";
 import { generateFlyToml } from "./toml.mjs";
 import * as pulumi from "@pulumi/pulumi";
 
@@ -20,11 +20,8 @@ var FlyDeploy = class extends pulumi.ComponentResource {
 		const setup = `mkdir -p .fly && printf '%s' "$FLY_TOML_CONTENT" > ${configPath}`;
 		const cli = `fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`;
 		const triggers = pulumi.output(args.triggers).apply((values) => [...values, tomlContent]);
-		let consumerDeps;
-		if (Array.isArray(pulumiOpts.dependsOn)) consumerDeps = pulumiOpts.dependsOn;
-		else if (pulumiOpts.dependsOn) consumerDeps = [pulumiOpts.dependsOn];
-		else consumerDeps = [];
-		createDeployCommand({
+		const consumerDeps = dependsOnList(pulumiOpts);
+		const { deploymentUrl } = createDeployCommand({
 			name,
 			cli,
 			triggers,
@@ -38,7 +35,8 @@ var FlyDeploy = class extends pulumi.ComponentResource {
 			parent: this,
 			dependsOn: [app, ...consumerDeps]
 		});
-		this.registerOutputs({});
+		this.deploymentUrl = deploymentUrl;
+		this.registerOutputs({ deploymentUrl: this.deploymentUrl });
 	}
 };
 

package/dist/fly/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/fly/deploy.ts"],"sourcesContent":["// src/fly/deploy.ts  (replace entire file)\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport type { FlyApp } from \"./app\";\nimport type { FlyProvider } from \"./provider\";\nimport { type FlyTomlConfig, generateFlyToml } from \"./toml\";\n\ntype FlyDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\tprovider: FlyProvider;\n\tapp: FlyApp;\n};\n\nexport interface FlyDeployArgs {\n\t/** fly.toml configuration. `config.app` must equal the FlyApp name. */\n\tconfig: FlyTomlConfig;\n\t/** Redeploy triggers; the generated toml content is appended automatically. */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** `fly deploy --wait-timeout` seconds (default 300). */\n\twaitTimeout?: number;\n\t/** `fly deploy --release-command-timeout` seconds (default 600). */\n\treleaseCommandTimeout?: number;\n\t/** `fly deploy --ha` (default false). */\n\thighAvailability?: boolean;\n}\n\n/**\n * Deploys a Fly app via `fly deploy --remote-only` from a generated fly.toml.\n * Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).\n */\nexport class FlyDeploy extends pulumi.ComponentResource {\n\tconstructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions) {\n\t\tconst { provider, app, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:fly:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst tomlContent = generateFlyToml(args.config);\n\t\tconst configPath = `.fly/${args.config.app}.toml`;\n\n\t\tconst waitTimeout = args.waitTimeout ?? 300;\n\t\tconst releaseCommandTimeout = args.releaseCommandTimeout ?? 600;\n\t\tconst highAvailability = args.highAvailability ?? false;\n\n\t\t// The toml content arrives via FLY_TOML_CONTENT (avoids shell escaping).\n\t\tconst setup = `mkdir -p .fly && printf '%s' \"$FLY_TOML_CONTENT\" > ${configPath}`;\n\t\tconst cli = `fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`;\n\n\t\tconst triggers = pulumi\n\t\t\t.output(args.triggers)\n\t\t\t.apply((values) => [...values, tomlContent]);\n\n\t\tlet consumerDeps: pulumi.Resource[];\n\n\t\tif (Array.isArray(pulumiOpts.dependsOn)) {\n\t\t\tconsumerDeps = pulumiOpts.dependsOn as pulumi.Resource[];\n\t\t} else if (pulumiOpts.dependsOn) {\n\t\t\tconsumerDeps = [pulumiOpts.dependsOn as pulumi.Resource];\n\t\t} else {\n\t\t\tconsumerDeps = [];\n\t\t}\n\n\t\tcreateDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers,\n\t\t\t\tsetup,\n\t\t\t\tenvironment: {\n\t\t\t\t\tFLY_API_TOKEN: provider.token,\n\t\t\t\t\tFLY_TOML_CONTENT: tomlContent,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ ...pulumiOpts, parent: this, dependsOn: [app, ...consumerDeps] },\n\t\t);\n\n\t\tthis.registerOutputs({});\n\t}\n}\n"],"mappings":";;;;;;;;;;AA8BA,IAAa,YAAb,cAA+B,OAAO,kBAAkB;CACvD,YAAY,MAAc,MAAqB,MAAwB;EACtE,MAAM,EAAE,UAAU,KAAK,GAAG,eAAe;EAEzC,MAAM,yBAAyB,MAAM,CAAC,GAAG,UAAU;EAEnD,MAAM,cAAc,gBAAgB,KAAK,MAAM;EAC/C,MAAM,aAAa,QAAQ,KAAK,OAAO,IAAI;EAE3C,MAAM,cAAc,KAAK,eAAe;EACxC,MAAM,wBAAwB,KAAK,yBAAyB;EAC5D,MAAM,mBAAmB,KAAK,oBAAoB;EAGlD,MAAM,QAAQ,sDAAsD;EACpE,MAAM,MAAM,uBAAuB,WAAW,sBAAsB,iBAAiB,kBAAkB,YAAY,6BAA6B;EAEhJ,MAAM,WAAW,OACf,OAAO,KAAK,QAAQ,EACpB,OAAO,WAAW,CAAC,GAAG,QAAQ,WAAW,CAAC;EAE5C,IAAI;EAEJ,IAAI,MAAM,QAAQ,WAAW,SAAS,GACrC,eAAe,WAAW;OACpB,IAAI,WAAW,WACrB,eAAe,CAAC,WAAW,SAA4B;OAEvD,eAAe,CAAC;EAGjB,oBACC;GACC;GACA;GACA;GACA;GACA,aAAa;IACZ,eAAe,SAAS;IACxB,kBAAkB;GACnB;EACD,GACA;GAAE,GAAG;GAAY,QAAQ;GAAM,WAAW,CAAC,KAAK,GAAG,YAAY;EAAE,CAClE;EAEA,KAAK,gBAAgB,CAAC,CAAC;CACxB;AACD"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/fly/deploy.ts"],"sourcesContent":["// src/fly/deploy.ts  (replace entire file)\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand, dependsOnList } from \"../commands/deploy\";\nimport type { FlyApp } from \"./app\";\nimport type { FlyProvider } from \"./provider\";\nimport { type FlyTomlConfig, generateFlyToml } from \"./toml\";\n\ntype FlyDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\tprovider: FlyProvider;\n\tapp: FlyApp;\n};\n\nexport interface FlyDeployArgs {\n\t/** fly.toml configuration. `config.app` must equal the FlyApp name. */\n\tconfig: FlyTomlConfig;\n\t/** Redeploy triggers; the generated toml content is appended automatically. */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** `fly deploy --wait-timeout` seconds (default 300). */\n\twaitTimeout?: number;\n\t/** `fly deploy --release-command-timeout` seconds (default 600). */\n\treleaseCommandTimeout?: number;\n\t/** `fly deploy --ha` (default false). */\n\thighAvailability?: boolean;\n}\n\n/**\n * Deploys a Fly app via `fly deploy --remote-only` from a generated fly.toml.\n * Isolation/git are the seam's job (list a `DeploySandbox`, optionally a `GitGuard`).\n */\nexport class FlyDeploy extends pulumi.ComponentResource {\n\t/** The deploy CLI's final stdout line (the Fly app URL when emitted). */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(name: string, args: FlyDeployArgs, opts: FlyDeployOptions) {\n\t\tconst { provider, app, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:fly:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst tomlContent = generateFlyToml(args.config);\n\t\tconst configPath = `.fly/${args.config.app}.toml`;\n\n\t\tconst waitTimeout = args.waitTimeout ?? 300;\n\t\tconst releaseCommandTimeout = args.releaseCommandTimeout ?? 600;\n\t\tconst highAvailability = args.highAvailability ?? false;\n\n\t\t// The toml content arrives via FLY_TOML_CONTENT (avoids shell escaping).\n\t\tconst setup = `mkdir -p .fly && printf '%s' \"$FLY_TOML_CONTENT\" > ${configPath}`;\n\t\tconst cli = `fly deploy --config ${configPath} --remote-only --ha=${highAvailability} --wait-timeout ${waitTimeout} --release-command-timeout ${releaseCommandTimeout}`;\n\n\t\tconst triggers = pulumi\n\t\t\t.output(args.triggers)\n\t\t\t.apply((values) => [...values, tomlContent]);\n\n\t\t// Keep the `app` ordering anchor first; append the consumer's deps\n\t\t// (DeploySandbox / GitGuard) using the seam's shared normaliser.\n\t\tconst consumerDeps = dependsOnList(pulumiOpts) as pulumi.Resource[];\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers,\n\t\t\t\tsetup,\n\t\t\t\tenvironment: {\n\t\t\t\t\tFLY_API_TOKEN: provider.token,\n\t\t\t\t\tFLY_TOML_CONTENT: tomlContent,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ ...pulumiOpts, parent: this, dependsOn: [app, ...consumerDeps] },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;AA8BA,IAAa,YAAb,cAA+B,OAAO,kBAAkB;CAIvD,YAAY,MAAc,MAAqB,MAAwB;EACtE,MAAM,EAAE,UAAU,KAAK,GAAG,eAAe;EAEzC,MAAM,yBAAyB,MAAM,CAAC,GAAG,UAAU;EAEnD,MAAM,cAAc,gBAAgB,KAAK,MAAM;EAC/C,MAAM,aAAa,QAAQ,KAAK,OAAO,IAAI;EAE3C,MAAM,cAAc,KAAK,eAAe;EACxC,MAAM,wBAAwB,KAAK,yBAAyB;EAC5D,MAAM,mBAAmB,KAAK,oBAAoB;EAGlD,MAAM,QAAQ,sDAAsD;EACpE,MAAM,MAAM,uBAAuB,WAAW,sBAAsB,iBAAiB,kBAAkB,YAAY,6BAA6B;EAEhJ,MAAM,WAAW,OACf,OAAO,KAAK,QAAQ,EACpB,OAAO,WAAW,CAAC,GAAG,QAAQ,WAAW,CAAC;EAI5C,MAAM,eAAe,cAAc,UAAU;EAE7C,MAAM,EAAE,kBAAkB,oBACzB;GACC;GACA;GACA;GACA;GACA,aAAa;IACZ,eAAe,SAAS;IACxB,kBAAkB;GACnB;EACD,GACA;GAAE,GAAG;GAAY,QAAQ;GAAM,WAAW,CAAC,KAAK,GAAG,YAAY;EAAE,CAClE;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}

package/dist/hash.cjs

@@ -29,22 +29,95 @@ function hash(input, options) {
 	}
 	const ignore = options?.ignore ?? DEFAULT_IGNORE;
 	const digest = node_crypto.createHash("sha256");
-	function walk(currentPath) {
-		const entries = node_fs.readdirSync(currentPath, { withFileTypes: true });
-		for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-			if (ignore.has(entry.name)) continue;
-			const fullPath = node_path.join(currentPath, entry.name);
-			if (entry.isDirectory()) walk(fullPath);
-			else if (entry.isFile()) {
-				digest.update(entry.name);
-				digest.update(node_fs.readFileSync(fullPath));
-			}
+	hashDirInto(digest, input, ignore);
+	return digest.digest("hex");
+}
+/** Recursively folds a directory's file names + contents into `digest`. */
+function hashDirInto(digest, currentPath, ignore) {
+	const entries = node_fs.readdirSync(currentPath, { withFileTypes: true });
+	for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+		if (ignore.has(entry.name)) continue;
+		const fullPath = node_path.join(currentPath, entry.name);
+		if (entry.isDirectory()) hashDirInto(digest, fullPath, ignore);
+		else if (entry.isFile()) {
+			digest.update(entry.name);
+			digest.update(node_fs.readFileSync(fullPath));
+		}
+	}
+}
+function readWorkspacePackage(directory) {
+	try {
+		return JSON.parse(node_fs.readFileSync(node_path.join(directory, "package.json"), "utf8"));
+	} catch {
+		return;
+	}
+}
+/**
+* Indexes every workspace package by its `package.json` `name` -> directory, by
+* scanning `apps/*` and `packages/*`. Robust to a package whose directory name
+* differs from its published name.
+*/
+function buildWorkspaceIndex(monorepoRoot) {
+	const index = /* @__PURE__ */ new Map();
+	for (const group of ["apps", "packages"]) {
+		const base = node_path.join(monorepoRoot, group);
+		let entries;
+		try {
+			entries = node_fs.readdirSync(base, { withFileTypes: true });
+		} catch {
+			continue;
 		}
+		for (const entry of entries) {
+			if (!entry.isDirectory()) continue;
+			const directory = node_path.join(base, entry.name);
+			const pkg = readWorkspacePackage(directory);
+			if (pkg?.name) index.set(pkg.name, directory);
+		}
+	}
+	return index;
+}
+/**
+* Hashes an app's source AND every workspace package it depends on
+* (transitively), for use as a redeploy trigger. Resolving the dependency
+* closure from each `package.json` means a change to a shared `packages/*` an
+* app depends on correctly retriggers that app's deploy — and adding a new app
+* needs no hand-maintained list of which packages to hash.
+*
+* @param monorepoRoot Absolute repo root (holds `apps/` and `packages/`).
+* @param appDirectory The app to hash, relative to the root (e.g. `apps/mesh`).
+* @example
+* triggers: [hashApp(monorepoRoot, "apps/mesh"), hash(env)]
+*/
+function hashApp(monorepoRoot, appDirectory, options) {
+	const ignore = options?.ignore ?? DEFAULT_IGNORE;
+	const index = buildWorkspaceIndex(monorepoRoot);
+	const start = node_path.join(monorepoRoot, appDirectory);
+	const visited = /* @__PURE__ */ new Set();
+	const queue = [start];
+	while (queue.length > 0) {
+		const directory = queue.pop();
+		if (!directory || visited.has(directory)) continue;
+		visited.add(directory);
+		const pkg = readWorkspacePackage(directory);
+		if (!pkg) continue;
+		const deps = {
+			...pkg.dependencies,
+			...pkg.devDependencies
+		};
+		for (const depName of Object.keys(deps)) {
+			const depDirectory = index.get(depName);
+			if (depDirectory && !visited.has(depDirectory)) queue.push(depDirectory);
+		}
+	}
+	const digest = node_crypto.createHash("sha256");
+	for (const directory of [...visited].sort()) {
+		digest.update(`\0${node_path.relative(monorepoRoot, directory)}\0`);
+		hashDirInto(digest, directory, ignore);
 	}
-	walk(input);
 	return digest.digest("hex");
 }
 
 //#endregion
 exports.hash = hash;
+exports.hashApp = hashApp;
 //# sourceMappingURL=hash.cjs.map

package/dist/hash.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"hash.cjs","names":["pulumi","crypto","fs","path"],"sources":["../src/hash.ts"],"sourcesContent":["import * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nconst DEFAULT_IGNORE = new Set([\n\t\"node_modules\",\n\t\"dist\",\n\t\".turbo\",\n\t\".next\",\n\t\".git\",\n\t\".vercel\",\n]);\n\ninterface HashOptions {\n\tignore?: Set<string>;\n}\n\n/**\n * Produces a stable SHA-256 hex digest for use as a resource/deploy trigger,\n * from either a source directory or an environment map.\n *\n * - **Directory** (`string`): recursively hashes file names + contents (build\n *   and VCS directories skipped). Synchronous — returns a plain `string`.\n * - **Env map** (`Record<string, Input<string>>`): resolves the values, sorts\n *   by key, and hashes them into a single non-secret `Output<string>`. Passing\n *   secret `Output`s straight into a dynamic resource's inputs intermittently\n *   races Pulumi's gRPC secret serialization (`Unexpected struct type`, issue\n *   #16041) — the reason such deploys otherwise need `--parallel 1`. Collapsing\n *   the env to one `unsecret` digest keeps the trigger moving on any change\n *   while carrying no secret, so deploys are safe to (re)create at full\n *   parallelism. Exposing the digest is safe: it is a one-way hash of\n *   high-entropy secrets.\n *\n * @param input A source directory path, or a map of env var name to value.\n * @param options Directory mode only: `ignore` overrides the default skip set.\n * @returns `string` for a directory, `Output<string>` for an env map.\n * @example\n * triggers: [hash(appDir), hash(env)]\n */\nexport function hash(directory: string, options?: HashOptions): string;\nexport function hash(\n\tenv: Record<string, pulumi.Input<string>>,\n): pulumi.Output<string>;\nexport function hash(\n\tinput: string | Record<string, pulumi.Input<string>>,\n\toptions?: HashOptions,\n): string | pulumi.Output<string> {\n\tif (typeof input !== \"string\") {\n\t\tconst keys = Object.keys(input).sort();\n\n\t\treturn pulumi.unsecret(\n\t\t\tpulumi.all(keys.map((key) => input[key])).apply((values) => {\n\t\t\t\tconst digest = crypto.createHash(\"sha256\");\n\n\t\t\t\tfor (const [index, key] of keys.entries()) {\n\t\t\t\t\tdigest.update(`${key}=${values[index]}\\0`);\n\t\t\t\t}\n\n\t\t\t\treturn digest.digest(\"hex\");\n\t\t\t}),\n\t\t);\n\t}\n\n\tconst ignore = options?.ignore ?? DEFAULT_IGNORE;\n\tconst digest = crypto.createHash(\"sha256\");\n\n\tfunction walk(currentPath: string) {\n\t\tconst entries = fs.readdirSync(currentPath, { withFileTypes: true });\n\n\t\tfor (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {\n\t\t\tif (ignore.has(entry.name)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst fullPath = path.join(currentPath, entry.name);\n\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\twalk(fullPath);\n\t\t\t} else if (entry.isFile()) {\n\t\t\t\tdigest.update(entry.name);\n\t\t\t\tdigest.update(fs.readFileSync(fullPath));\n\t\t\t}\n\t\t}\n\t}\n\n\twalk(input);\n\n\treturn digest.digest(\"hex\");\n}\n"],"mappings":";;;;;;;;;;;;AAKA,MAAM,iBAAiB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AAgCD,SAAgB,KACf,OACA,SACiC;CACjC,IAAI,OAAO,UAAU,UAAU;EAC9B,MAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK;EAErC,OAAOA,eAAO,SACbA,eAAO,IAAI,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC,EAAE,OAAO,WAAW;GAC3D,MAAM,SAASC,YAAO,WAAW,QAAQ;GAEzC,KAAK,MAAM,CAAC,OAAO,QAAQ,KAAK,QAAQ,GACvC,OAAO,OAAO,GAAG,IAAI,GAAG,OAAO,OAAO,GAAG;GAG1C,OAAO,OAAO,OAAO,KAAK;EAC3B,CAAC,CACF;CACD;CAEA,MAAM,SAAS,SAAS,UAAU;CAClC,MAAM,SAASA,YAAO,WAAW,QAAQ;CAEzC,SAAS,KAAK,aAAqB;EAClC,MAAM,UAAUC,QAAG,YAAY,aAAa,EAAE,eAAe,KAAK,CAAC;EAEnE,KAAK,MAAM,SAAS,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC,GAAG;GACzE,IAAI,OAAO,IAAI,MAAM,IAAI,GACxB;GAGD,MAAM,WAAWC,UAAK,KAAK,aAAa,MAAM,IAAI;GAElD,IAAI,MAAM,YAAY,GACrB,KAAK,QAAQ;QACP,IAAI,MAAM,OAAO,GAAG;IAC1B,OAAO,OAAO,MAAM,IAAI;IACxB,OAAO,OAAOD,QAAG,aAAa,QAAQ,CAAC;GACxC;EACD;CACD;CAEA,KAAK,KAAK;CAEV,OAAO,OAAO,OAAO,KAAK;AAC3B"}
+{"version":3,"file":"hash.cjs","names":["pulumi","crypto","fs","path"],"sources":["../src/hash.ts"],"sourcesContent":["import * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nconst DEFAULT_IGNORE = new Set([\n\t\"node_modules\",\n\t\"dist\",\n\t\".turbo\",\n\t\".next\",\n\t\".git\",\n\t\".vercel\",\n]);\n\ninterface HashOptions {\n\tignore?: Set<string>;\n}\n\n/**\n * Produces a stable SHA-256 hex digest for use as a resource/deploy trigger,\n * from either a source directory or an environment map.\n *\n * - **Directory** (`string`): recursively hashes file names + contents (build\n *   and VCS directories skipped). Synchronous — returns a plain `string`.\n * - **Env map** (`Record<string, Input<string>>`): resolves the values, sorts\n *   by key, and hashes them into a single non-secret `Output<string>`. Passing\n *   secret `Output`s straight into a dynamic resource's inputs intermittently\n *   races Pulumi's gRPC secret serialization (`Unexpected struct type`, issue\n *   #16041) — the reason such deploys otherwise need `--parallel 1`. Collapsing\n *   the env to one `unsecret` digest keeps the trigger moving on any change\n *   while carrying no secret, so deploys are safe to (re)create at full\n *   parallelism. Exposing the digest is safe: it is a one-way hash of\n *   high-entropy secrets.\n *\n * @param input A source directory path, or a map of env var name to value.\n * @param options Directory mode only: `ignore` overrides the default skip set.\n * @returns `string` for a directory, `Output<string>` for an env map.\n * @example\n * triggers: [hash(appDir), hash(env)]\n */\nexport function hash(directory: string, options?: HashOptions): string;\nexport function hash(\n\tenv: Record<string, pulumi.Input<string>>,\n): pulumi.Output<string>;\nexport function hash(\n\tinput: string | Record<string, pulumi.Input<string>>,\n\toptions?: HashOptions,\n): string | pulumi.Output<string> {\n\tif (typeof input !== \"string\") {\n\t\tconst keys = Object.keys(input).sort();\n\n\t\treturn pulumi.unsecret(\n\t\t\tpulumi.all(keys.map((key) => input[key])).apply((values) => {\n\t\t\t\tconst digest = crypto.createHash(\"sha256\");\n\n\t\t\t\tfor (const [index, key] of keys.entries()) {\n\t\t\t\t\tdigest.update(`${key}=${values[index]}\\0`);\n\t\t\t\t}\n\n\t\t\t\treturn digest.digest(\"hex\");\n\t\t\t}),\n\t\t);\n\t}\n\n\tconst ignore = options?.ignore ?? DEFAULT_IGNORE;\n\tconst digest = crypto.createHash(\"sha256\");\n\n\thashDirInto(digest, input, ignore);\n\n\treturn digest.digest(\"hex\");\n}\n\n/** Recursively folds a directory's file names + contents into `digest`. */\nfunction hashDirInto(\n\tdigest: crypto.Hash,\n\tcurrentPath: string,\n\tignore: Set<string>,\n): void {\n\tconst entries = fs.readdirSync(currentPath, { withFileTypes: true });\n\n\tfor (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {\n\t\tif (ignore.has(entry.name)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst fullPath = path.join(currentPath, entry.name);\n\n\t\tif (entry.isDirectory()) {\n\t\t\thashDirInto(digest, fullPath, ignore);\n\t\t} else if (entry.isFile()) {\n\t\t\tdigest.update(entry.name);\n\t\t\tdigest.update(fs.readFileSync(fullPath));\n\t\t}\n\t}\n}\n\ninterface WorkspacePackage {\n\tname?: string;\n\tdependencies?: Record<string, string>;\n\tdevDependencies?: Record<string, string>;\n}\n\nfunction readWorkspacePackage(directory: string): WorkspacePackage | undefined {\n\ttry {\n\t\treturn JSON.parse(\n\t\t\tfs.readFileSync(path.join(directory, \"package.json\"), \"utf8\"),\n\t\t) as WorkspacePackage;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Indexes every workspace package by its `package.json` `name` -> directory, by\n * scanning `apps/*` and `packages/*`. Robust to a package whose directory name\n * differs from its published name.\n */\nfunction buildWorkspaceIndex(monorepoRoot: string): Map<string, string> {\n\tconst index = new Map<string, string>();\n\n\tfor (const group of [\"apps\", \"packages\"]) {\n\t\tconst base = path.join(monorepoRoot, group);\n\n\t\tlet entries: fs.Dirent[];\n\n\t\ttry {\n\t\t\tentries = fs.readdirSync(base, { withFileTypes: true });\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\n\t\tfor (const entry of entries) {\n\t\t\tif (!entry.isDirectory()) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst directory = path.join(base, entry.name);\n\t\t\tconst pkg = readWorkspacePackage(directory);\n\n\t\t\tif (pkg?.name) {\n\t\t\t\tindex.set(pkg.name, directory);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn index;\n}\n\n/**\n * Hashes an app's source AND every workspace package it depends on\n * (transitively), for use as a redeploy trigger. Resolving the dependency\n * closure from each `package.json` means a change to a shared `packages/*` an\n * app depends on correctly retriggers that app's deploy — and adding a new app\n * needs no hand-maintained list of which packages to hash.\n *\n * @param monorepoRoot Absolute repo root (holds `apps/` and `packages/`).\n * @param appDirectory The app to hash, relative to the root (e.g. `apps/mesh`).\n * @example\n * triggers: [hashApp(monorepoRoot, \"apps/mesh\"), hash(env)]\n */\nexport function hashApp(\n\tmonorepoRoot: string,\n\tappDirectory: string,\n\toptions?: HashOptions,\n): string {\n\tconst ignore = options?.ignore ?? DEFAULT_IGNORE;\n\tconst index = buildWorkspaceIndex(monorepoRoot);\n\n\tconst start = path.join(monorepoRoot, appDirectory);\n\tconst visited = new Set<string>();\n\tconst queue = [start];\n\n\twhile (queue.length > 0) {\n\t\tconst directory = queue.pop();\n\n\t\tif (!directory || visited.has(directory)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tvisited.add(directory);\n\n\t\tconst pkg = readWorkspacePackage(directory);\n\n\t\tif (!pkg) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst deps = { ...pkg.dependencies, ...pkg.devDependencies };\n\n\t\tfor (const depName of Object.keys(deps)) {\n\t\t\tconst depDirectory = index.get(depName);\n\n\t\t\t// Only workspace packages are in the index — external deps are ignored.\n\t\t\tif (depDirectory && !visited.has(depDirectory)) {\n\t\t\t\tqueue.push(depDirectory);\n\t\t\t}\n\t\t}\n\t}\n\n\tconst digest = crypto.createHash(\"sha256\");\n\n\t// Sort by directory so the digest is independent of traversal order; include\n\t// the relative path so moving content between packages changes the hash.\n\tfor (const directory of [...visited].sort()) {\n\t\tdigest.update(`\\0${path.relative(monorepoRoot, directory)}\\0`);\n\t\thashDirInto(digest, directory, ignore);\n\t}\n\n\treturn digest.digest(\"hex\");\n}\n"],"mappings":";;;;;;;;;;;;AAKA,MAAM,iBAAiB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AAgCD,SAAgB,KACf,OACA,SACiC;CACjC,IAAI,OAAO,UAAU,UAAU;EAC9B,MAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK;EAErC,OAAOA,eAAO,SACbA,eAAO,IAAI,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC,EAAE,OAAO,WAAW;GAC3D,MAAM,SAASC,YAAO,WAAW,QAAQ;GAEzC,KAAK,MAAM,CAAC,OAAO,QAAQ,KAAK,QAAQ,GACvC,OAAO,OAAO,GAAG,IAAI,GAAG,OAAO,OAAO,GAAG;GAG1C,OAAO,OAAO,OAAO,KAAK;EAC3B,CAAC,CACF;CACD;CAEA,MAAM,SAAS,SAAS,UAAU;CAClC,MAAM,SAASA,YAAO,WAAW,QAAQ;CAEzC,YAAY,QAAQ,OAAO,MAAM;CAEjC,OAAO,OAAO,OAAO,KAAK;AAC3B;;AAGA,SAAS,YACR,QACA,aACA,QACO;CACP,MAAM,UAAUC,QAAG,YAAY,aAAa,EAAE,eAAe,KAAK,CAAC;CAEnE,KAAK,MAAM,SAAS,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC,GAAG;EACzE,IAAI,OAAO,IAAI,MAAM,IAAI,GACxB;EAGD,MAAM,WAAWC,UAAK,KAAK,aAAa,MAAM,IAAI;EAElD,IAAI,MAAM,YAAY,GACrB,YAAY,QAAQ,UAAU,MAAM;OAC9B,IAAI,MAAM,OAAO,GAAG;GAC1B,OAAO,OAAO,MAAM,IAAI;GACxB,OAAO,OAAOD,QAAG,aAAa,QAAQ,CAAC;EACxC;CACD;AACD;AAQA,SAAS,qBAAqB,WAAiD;CAC9E,IAAI;EACH,OAAO,KAAK,MACXA,QAAG,aAAaC,UAAK,KAAK,WAAW,cAAc,GAAG,MAAM,CAC7D;CACD,QAAQ;EACP;CACD;AACD;;;;;;AAOA,SAAS,oBAAoB,cAA2C;CACvE,MAAM,wBAAQ,IAAI,IAAoB;CAEtC,KAAK,MAAM,SAAS,CAAC,QAAQ,UAAU,GAAG;EACzC,MAAM,OAAOA,UAAK,KAAK,cAAc,KAAK;EAE1C,IAAI;EAEJ,IAAI;GACH,UAAUD,QAAG,YAAY,MAAM,EAAE,eAAe,KAAK,CAAC;EACvD,QAAQ;GACP;EACD;EAEA,KAAK,MAAM,SAAS,SAAS;GAC5B,IAAI,CAAC,MAAM,YAAY,GACtB;GAGD,MAAM,YAAYC,UAAK,KAAK,MAAM,MAAM,IAAI;GAC5C,MAAM,MAAM,qBAAqB,SAAS;GAE1C,IAAI,KAAK,MACR,MAAM,IAAI,IAAI,MAAM,SAAS;EAE/B;CACD;CAEA,OAAO;AACR;;;;;;;;;;;;;AAcA,SAAgB,QACf,cACA,cACA,SACS;CACT,MAAM,SAAS,SAAS,UAAU;CAClC,MAAM,QAAQ,oBAAoB,YAAY;CAE9C,MAAM,QAAQA,UAAK,KAAK,cAAc,YAAY;CAClD,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,QAAQ,CAAC,KAAK;CAEpB,OAAO,MAAM,SAAS,GAAG;EACxB,MAAM,YAAY,MAAM,IAAI;EAE5B,IAAI,CAAC,aAAa,QAAQ,IAAI,SAAS,GACtC;EAGD,QAAQ,IAAI,SAAS;EAErB,MAAM,MAAM,qBAAqB,SAAS;EAE1C,IAAI,CAAC,KACJ;EAGD,MAAM,OAAO;GAAE,GAAG,IAAI;GAAc,GAAG,IAAI;EAAgB;EAE3D,KAAK,MAAM,WAAW,OAAO,KAAK,IAAI,GAAG;GACxC,MAAM,eAAe,MAAM,IAAI,OAAO;GAGtC,IAAI,gBAAgB,CAAC,QAAQ,IAAI,YAAY,GAC5C,MAAM,KAAK,YAAY;EAEzB;CACD;CAEA,MAAM,SAASF,YAAO,WAAW,QAAQ;CAIzC,KAAK,MAAM,aAAa,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG;EAC5C,OAAO,OAAO,KAAKE,UAAK,SAAS,cAAc,SAAS,EAAE,GAAG;EAC7D,YAAY,QAAQ,WAAW,MAAM;CACtC;CAEA,OAAO,OAAO,OAAO,KAAK;AAC3B"}

package/dist/hash.d.cts

@@ -29,6 +29,19 @@ interface HashOptions {
  */
 declare function hash(directory: string, options?: HashOptions): string;
 declare function hash(env: Record<string, pulumi.Input<string>>): pulumi.Output<string>;
+/**
+ * Hashes an app's source AND every workspace package it depends on
+ * (transitively), for use as a redeploy trigger. Resolving the dependency
+ * closure from each `package.json` means a change to a shared `packages/*` an
+ * app depends on correctly retriggers that app's deploy — and adding a new app
+ * needs no hand-maintained list of which packages to hash.
+ *
+ * @param monorepoRoot Absolute repo root (holds `apps/` and `packages/`).
+ * @param appDirectory The app to hash, relative to the root (e.g. `apps/mesh`).
+ * @example
+ * triggers: [hashApp(monorepoRoot, "apps/mesh"), hash(env)]
+ */
+declare function hashApp(monorepoRoot: string, appDirectory: string, options?: HashOptions): string;
 //#endregion
-export { hash };
+export { hash, hashApp };
 //# sourceMappingURL=hash.d.cts.map

package/dist/hash.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"hash.d.cts","names":[],"sources":["../src/hash.ts"],"mappings":";;;;UAcU,WAAA;EACT,MAAA,GAAS,GAAG;AAAA;AAZ4B;;;;AAY5B;AAyBb;;;;;;;;AAA6D;AAC7D;;;;;;;;AAtCyC,iBAqCzB,IAAA,CAAK,SAAA,UAAmB,OAAA,GAAU,WAAW;AAAA,iBAC7C,IAAA,CACf,GAAA,EAAK,MAAA,SAAe,MAAA,CAAO,KAAA,YACzB,MAAA,CAAO,MAAA"}
+{"version":3,"file":"hash.d.cts","names":[],"sources":["../src/hash.ts"],"mappings":";;;;UAcU,WAAA;EACT,MAAA,GAAS,GAAG;AAAA;AAZ4B;;;;AAY5B;AAyBb;;;;;;;;AAA6D;AAC7D;;;;;;;;AAtCyC,iBAqCzB,IAAA,CAAK,SAAA,UAAmB,OAAA,GAAU,WAAW;AAAA,iBAC7C,IAAA,CACf,GAAA,EAAK,MAAA,SAAe,MAAA,CAAO,KAAA,YACzB,MAAA,CAAO,MAAA;;;;;;AAAM;AAqHhB;;;;;;iBAAgB,OAAA,CACf,YAAA,UACA,YAAA,UACA,OAAA,GAAU,WAAW"}

package/dist/hash.d.mts

@@ -29,6 +29,19 @@ interface HashOptions {
  */
 declare function hash(directory: string, options?: HashOptions): string;
 declare function hash(env: Record<string, pulumi.Input<string>>): pulumi.Output<string>;
+/**
+ * Hashes an app's source AND every workspace package it depends on
+ * (transitively), for use as a redeploy trigger. Resolving the dependency
+ * closure from each `package.json` means a change to a shared `packages/*` an
+ * app depends on correctly retriggers that app's deploy — and adding a new app
+ * needs no hand-maintained list of which packages to hash.
+ *
+ * @param monorepoRoot Absolute repo root (holds `apps/` and `packages/`).
+ * @param appDirectory The app to hash, relative to the root (e.g. `apps/mesh`).
+ * @example
+ * triggers: [hashApp(monorepoRoot, "apps/mesh"), hash(env)]
+ */
+declare function hashApp(monorepoRoot: string, appDirectory: string, options?: HashOptions): string;
 //#endregion
-export { hash };
+export { hash, hashApp };
 //# sourceMappingURL=hash.d.mts.map

package/dist/hash.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"hash.d.mts","names":[],"sources":["../src/hash.ts"],"mappings":";;;;UAcU,WAAA;EACT,MAAA,GAAS,GAAG;AAAA;AAZ4B;;;;AAY5B;AAyBb;;;;;;;;AAA6D;AAC7D;;;;;;;;AAtCyC,iBAqCzB,IAAA,CAAK,SAAA,UAAmB,OAAA,GAAU,WAAW;AAAA,iBAC7C,IAAA,CACf,GAAA,EAAK,MAAA,SAAe,MAAA,CAAO,KAAA,YACzB,MAAA,CAAO,MAAA"}
+{"version":3,"file":"hash.d.mts","names":[],"sources":["../src/hash.ts"],"mappings":";;;;UAcU,WAAA;EACT,MAAA,GAAS,GAAG;AAAA;AAZ4B;;;;AAY5B;AAyBb;;;;;;;;AAA6D;AAC7D;;;;;;;;AAtCyC,iBAqCzB,IAAA,CAAK,SAAA,UAAmB,OAAA,GAAU,WAAW;AAAA,iBAC7C,IAAA,CACf,GAAA,EAAK,MAAA,SAAe,MAAA,CAAO,KAAA,YACzB,MAAA,CAAO,MAAA;;;;;;AAAM;AAqHhB;;;;;;iBAAgB,OAAA,CACf,YAAA,UACA,YAAA,UACA,OAAA,GAAU,WAAW"}

package/dist/hash.mjs

@@ -24,22 +24,94 @@ function hash(input, options) {
 	}
 	const ignore = options?.ignore ?? DEFAULT_IGNORE;
 	const digest = crypto.createHash("sha256");
-	function walk(currentPath) {
-		const entries = fs.readdirSync(currentPath, { withFileTypes: true });
-		for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-			if (ignore.has(entry.name)) continue;
-			const fullPath = path.join(currentPath, entry.name);
-			if (entry.isDirectory()) walk(fullPath);
-			else if (entry.isFile()) {
-				digest.update(entry.name);
-				digest.update(fs.readFileSync(fullPath));
-			}
+	hashDirInto(digest, input, ignore);
+	return digest.digest("hex");
+}
+/** Recursively folds a directory's file names + contents into `digest`. */
+function hashDirInto(digest, currentPath, ignore) {
+	const entries = fs.readdirSync(currentPath, { withFileTypes: true });
+	for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+		if (ignore.has(entry.name)) continue;
+		const fullPath = path.join(currentPath, entry.name);
+		if (entry.isDirectory()) hashDirInto(digest, fullPath, ignore);
+		else if (entry.isFile()) {
+			digest.update(entry.name);
+			digest.update(fs.readFileSync(fullPath));
+		}
+	}
+}
+function readWorkspacePackage(directory) {
+	try {
+		return JSON.parse(fs.readFileSync(path.join(directory, "package.json"), "utf8"));
+	} catch {
+		return;
+	}
+}
+/**
+* Indexes every workspace package by its `package.json` `name` -> directory, by
+* scanning `apps/*` and `packages/*`. Robust to a package whose directory name
+* differs from its published name.
+*/
+function buildWorkspaceIndex(monorepoRoot) {
+	const index = /* @__PURE__ */ new Map();
+	for (const group of ["apps", "packages"]) {
+		const base = path.join(monorepoRoot, group);
+		let entries;
+		try {
+			entries = fs.readdirSync(base, { withFileTypes: true });
+		} catch {
+			continue;
 		}
+		for (const entry of entries) {
+			if (!entry.isDirectory()) continue;
+			const directory = path.join(base, entry.name);
+			const pkg = readWorkspacePackage(directory);
+			if (pkg?.name) index.set(pkg.name, directory);
+		}
+	}
+	return index;
+}
+/**
+* Hashes an app's source AND every workspace package it depends on
+* (transitively), for use as a redeploy trigger. Resolving the dependency
+* closure from each `package.json` means a change to a shared `packages/*` an
+* app depends on correctly retriggers that app's deploy — and adding a new app
+* needs no hand-maintained list of which packages to hash.
+*
+* @param monorepoRoot Absolute repo root (holds `apps/` and `packages/`).
+* @param appDirectory The app to hash, relative to the root (e.g. `apps/mesh`).
+* @example
+* triggers: [hashApp(monorepoRoot, "apps/mesh"), hash(env)]
+*/
+function hashApp(monorepoRoot, appDirectory, options) {
+	const ignore = options?.ignore ?? DEFAULT_IGNORE;
+	const index = buildWorkspaceIndex(monorepoRoot);
+	const start = path.join(monorepoRoot, appDirectory);
+	const visited = /* @__PURE__ */ new Set();
+	const queue = [start];
+	while (queue.length > 0) {
+		const directory = queue.pop();
+		if (!directory || visited.has(directory)) continue;
+		visited.add(directory);
+		const pkg = readWorkspacePackage(directory);
+		if (!pkg) continue;
+		const deps = {
+			...pkg.dependencies,
+			...pkg.devDependencies
+		};
+		for (const depName of Object.keys(deps)) {
+			const depDirectory = index.get(depName);
+			if (depDirectory && !visited.has(depDirectory)) queue.push(depDirectory);
+		}
+	}
+	const digest = crypto.createHash("sha256");
+	for (const directory of [...visited].sort()) {
+		digest.update(`\0${path.relative(monorepoRoot, directory)}\0`);
+		hashDirInto(digest, directory, ignore);
 	}
-	walk(input);
 	return digest.digest("hex");
 }
 
 //#endregion
-export { hash };
+export { hash, hashApp };
 //# sourceMappingURL=hash.mjs.map

package/dist/hash.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"hash.mjs","names":[],"sources":["../src/hash.ts"],"sourcesContent":["import * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nconst DEFAULT_IGNORE = new Set([\n\t\"node_modules\",\n\t\"dist\",\n\t\".turbo\",\n\t\".next\",\n\t\".git\",\n\t\".vercel\",\n]);\n\ninterface HashOptions {\n\tignore?: Set<string>;\n}\n\n/**\n * Produces a stable SHA-256 hex digest for use as a resource/deploy trigger,\n * from either a source directory or an environment map.\n *\n * - **Directory** (`string`): recursively hashes file names + contents (build\n *   and VCS directories skipped). Synchronous — returns a plain `string`.\n * - **Env map** (`Record<string, Input<string>>`): resolves the values, sorts\n *   by key, and hashes them into a single non-secret `Output<string>`. Passing\n *   secret `Output`s straight into a dynamic resource's inputs intermittently\n *   races Pulumi's gRPC secret serialization (`Unexpected struct type`, issue\n *   #16041) — the reason such deploys otherwise need `--parallel 1`. Collapsing\n *   the env to one `unsecret` digest keeps the trigger moving on any change\n *   while carrying no secret, so deploys are safe to (re)create at full\n *   parallelism. Exposing the digest is safe: it is a one-way hash of\n *   high-entropy secrets.\n *\n * @param input A source directory path, or a map of env var name to value.\n * @param options Directory mode only: `ignore` overrides the default skip set.\n * @returns `string` for a directory, `Output<string>` for an env map.\n * @example\n * triggers: [hash(appDir), hash(env)]\n */\nexport function hash(directory: string, options?: HashOptions): string;\nexport function hash(\n\tenv: Record<string, pulumi.Input<string>>,\n): pulumi.Output<string>;\nexport function hash(\n\tinput: string | Record<string, pulumi.Input<string>>,\n\toptions?: HashOptions,\n): string | pulumi.Output<string> {\n\tif (typeof input !== \"string\") {\n\t\tconst keys = Object.keys(input).sort();\n\n\t\treturn pulumi.unsecret(\n\t\t\tpulumi.all(keys.map((key) => input[key])).apply((values) => {\n\t\t\t\tconst digest = crypto.createHash(\"sha256\");\n\n\t\t\t\tfor (const [index, key] of keys.entries()) {\n\t\t\t\t\tdigest.update(`${key}=${values[index]}\\0`);\n\t\t\t\t}\n\n\t\t\t\treturn digest.digest(\"hex\");\n\t\t\t}),\n\t\t);\n\t}\n\n\tconst ignore = options?.ignore ?? DEFAULT_IGNORE;\n\tconst digest = crypto.createHash(\"sha256\");\n\n\tfunction walk(currentPath: string) {\n\t\tconst entries = fs.readdirSync(currentPath, { withFileTypes: true });\n\n\t\tfor (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {\n\t\t\tif (ignore.has(entry.name)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst fullPath = path.join(currentPath, entry.name);\n\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\twalk(fullPath);\n\t\t\t} else if (entry.isFile()) {\n\t\t\t\tdigest.update(entry.name);\n\t\t\t\tdigest.update(fs.readFileSync(fullPath));\n\t\t\t}\n\t\t}\n\t}\n\n\twalk(input);\n\n\treturn digest.digest(\"hex\");\n}\n"],"mappings":";;;;;;;AAKA,MAAM,iBAAiB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AAgCD,SAAgB,KACf,OACA,SACiC;CACjC,IAAI,OAAO,UAAU,UAAU;EAC9B,MAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK;EAErC,OAAO,OAAO,SACb,OAAO,IAAI,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC,EAAE,OAAO,WAAW;GAC3D,MAAM,SAAS,OAAO,WAAW,QAAQ;GAEzC,KAAK,MAAM,CAAC,OAAO,QAAQ,KAAK,QAAQ,GACvC,OAAO,OAAO,GAAG,IAAI,GAAG,OAAO,OAAO,GAAG;GAG1C,OAAO,OAAO,OAAO,KAAK;EAC3B,CAAC,CACF;CACD;CAEA,MAAM,SAAS,SAAS,UAAU;CAClC,MAAM,SAAS,OAAO,WAAW,QAAQ;CAEzC,SAAS,KAAK,aAAqB;EAClC,MAAM,UAAU,GAAG,YAAY,aAAa,EAAE,eAAe,KAAK,CAAC;EAEnE,KAAK,MAAM,SAAS,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC,GAAG;GACzE,IAAI,OAAO,IAAI,MAAM,IAAI,GACxB;GAGD,MAAM,WAAW,KAAK,KAAK,aAAa,MAAM,IAAI;GAElD,IAAI,MAAM,YAAY,GACrB,KAAK,QAAQ;QACP,IAAI,MAAM,OAAO,GAAG;IAC1B,OAAO,OAAO,MAAM,IAAI;IACxB,OAAO,OAAO,GAAG,aAAa,QAAQ,CAAC;GACxC;EACD;CACD;CAEA,KAAK,KAAK;CAEV,OAAO,OAAO,OAAO,KAAK;AAC3B"}
+{"version":3,"file":"hash.mjs","names":[],"sources":["../src/hash.ts"],"sourcesContent":["import * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as pulumi from \"@pulumi/pulumi\";\n\nconst DEFAULT_IGNORE = new Set([\n\t\"node_modules\",\n\t\"dist\",\n\t\".turbo\",\n\t\".next\",\n\t\".git\",\n\t\".vercel\",\n]);\n\ninterface HashOptions {\n\tignore?: Set<string>;\n}\n\n/**\n * Produces a stable SHA-256 hex digest for use as a resource/deploy trigger,\n * from either a source directory or an environment map.\n *\n * - **Directory** (`string`): recursively hashes file names + contents (build\n *   and VCS directories skipped). Synchronous — returns a plain `string`.\n * - **Env map** (`Record<string, Input<string>>`): resolves the values, sorts\n *   by key, and hashes them into a single non-secret `Output<string>`. Passing\n *   secret `Output`s straight into a dynamic resource's inputs intermittently\n *   races Pulumi's gRPC secret serialization (`Unexpected struct type`, issue\n *   #16041) — the reason such deploys otherwise need `--parallel 1`. Collapsing\n *   the env to one `unsecret` digest keeps the trigger moving on any change\n *   while carrying no secret, so deploys are safe to (re)create at full\n *   parallelism. Exposing the digest is safe: it is a one-way hash of\n *   high-entropy secrets.\n *\n * @param input A source directory path, or a map of env var name to value.\n * @param options Directory mode only: `ignore` overrides the default skip set.\n * @returns `string` for a directory, `Output<string>` for an env map.\n * @example\n * triggers: [hash(appDir), hash(env)]\n */\nexport function hash(directory: string, options?: HashOptions): string;\nexport function hash(\n\tenv: Record<string, pulumi.Input<string>>,\n): pulumi.Output<string>;\nexport function hash(\n\tinput: string | Record<string, pulumi.Input<string>>,\n\toptions?: HashOptions,\n): string | pulumi.Output<string> {\n\tif (typeof input !== \"string\") {\n\t\tconst keys = Object.keys(input).sort();\n\n\t\treturn pulumi.unsecret(\n\t\t\tpulumi.all(keys.map((key) => input[key])).apply((values) => {\n\t\t\t\tconst digest = crypto.createHash(\"sha256\");\n\n\t\t\t\tfor (const [index, key] of keys.entries()) {\n\t\t\t\t\tdigest.update(`${key}=${values[index]}\\0`);\n\t\t\t\t}\n\n\t\t\t\treturn digest.digest(\"hex\");\n\t\t\t}),\n\t\t);\n\t}\n\n\tconst ignore = options?.ignore ?? DEFAULT_IGNORE;\n\tconst digest = crypto.createHash(\"sha256\");\n\n\thashDirInto(digest, input, ignore);\n\n\treturn digest.digest(\"hex\");\n}\n\n/** Recursively folds a directory's file names + contents into `digest`. */\nfunction hashDirInto(\n\tdigest: crypto.Hash,\n\tcurrentPath: string,\n\tignore: Set<string>,\n): void {\n\tconst entries = fs.readdirSync(currentPath, { withFileTypes: true });\n\n\tfor (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {\n\t\tif (ignore.has(entry.name)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst fullPath = path.join(currentPath, entry.name);\n\n\t\tif (entry.isDirectory()) {\n\t\t\thashDirInto(digest, fullPath, ignore);\n\t\t} else if (entry.isFile()) {\n\t\t\tdigest.update(entry.name);\n\t\t\tdigest.update(fs.readFileSync(fullPath));\n\t\t}\n\t}\n}\n\ninterface WorkspacePackage {\n\tname?: string;\n\tdependencies?: Record<string, string>;\n\tdevDependencies?: Record<string, string>;\n}\n\nfunction readWorkspacePackage(directory: string): WorkspacePackage | undefined {\n\ttry {\n\t\treturn JSON.parse(\n\t\t\tfs.readFileSync(path.join(directory, \"package.json\"), \"utf8\"),\n\t\t) as WorkspacePackage;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Indexes every workspace package by its `package.json` `name` -> directory, by\n * scanning `apps/*` and `packages/*`. Robust to a package whose directory name\n * differs from its published name.\n */\nfunction buildWorkspaceIndex(monorepoRoot: string): Map<string, string> {\n\tconst index = new Map<string, string>();\n\n\tfor (const group of [\"apps\", \"packages\"]) {\n\t\tconst base = path.join(monorepoRoot, group);\n\n\t\tlet entries: fs.Dirent[];\n\n\t\ttry {\n\t\t\tentries = fs.readdirSync(base, { withFileTypes: true });\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\n\t\tfor (const entry of entries) {\n\t\t\tif (!entry.isDirectory()) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst directory = path.join(base, entry.name);\n\t\t\tconst pkg = readWorkspacePackage(directory);\n\n\t\t\tif (pkg?.name) {\n\t\t\t\tindex.set(pkg.name, directory);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn index;\n}\n\n/**\n * Hashes an app's source AND every workspace package it depends on\n * (transitively), for use as a redeploy trigger. Resolving the dependency\n * closure from each `package.json` means a change to a shared `packages/*` an\n * app depends on correctly retriggers that app's deploy — and adding a new app\n * needs no hand-maintained list of which packages to hash.\n *\n * @param monorepoRoot Absolute repo root (holds `apps/` and `packages/`).\n * @param appDirectory The app to hash, relative to the root (e.g. `apps/mesh`).\n * @example\n * triggers: [hashApp(monorepoRoot, \"apps/mesh\"), hash(env)]\n */\nexport function hashApp(\n\tmonorepoRoot: string,\n\tappDirectory: string,\n\toptions?: HashOptions,\n): string {\n\tconst ignore = options?.ignore ?? DEFAULT_IGNORE;\n\tconst index = buildWorkspaceIndex(monorepoRoot);\n\n\tconst start = path.join(monorepoRoot, appDirectory);\n\tconst visited = new Set<string>();\n\tconst queue = [start];\n\n\twhile (queue.length > 0) {\n\t\tconst directory = queue.pop();\n\n\t\tif (!directory || visited.has(directory)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tvisited.add(directory);\n\n\t\tconst pkg = readWorkspacePackage(directory);\n\n\t\tif (!pkg) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst deps = { ...pkg.dependencies, ...pkg.devDependencies };\n\n\t\tfor (const depName of Object.keys(deps)) {\n\t\t\tconst depDirectory = index.get(depName);\n\n\t\t\t// Only workspace packages are in the index — external deps are ignored.\n\t\t\tif (depDirectory && !visited.has(depDirectory)) {\n\t\t\t\tqueue.push(depDirectory);\n\t\t\t}\n\t\t}\n\t}\n\n\tconst digest = crypto.createHash(\"sha256\");\n\n\t// Sort by directory so the digest is independent of traversal order; include\n\t// the relative path so moving content between packages changes the hash.\n\tfor (const directory of [...visited].sort()) {\n\t\tdigest.update(`\\0${path.relative(monorepoRoot, directory)}\\0`);\n\t\thashDirInto(digest, directory, ignore);\n\t}\n\n\treturn digest.digest(\"hex\");\n}\n"],"mappings":";;;;;;;AAKA,MAAM,iBAAiB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AAgCD,SAAgB,KACf,OACA,SACiC;CACjC,IAAI,OAAO,UAAU,UAAU;EAC9B,MAAM,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK;EAErC,OAAO,OAAO,SACb,OAAO,IAAI,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC,EAAE,OAAO,WAAW;GAC3D,MAAM,SAAS,OAAO,WAAW,QAAQ;GAEzC,KAAK,MAAM,CAAC,OAAO,QAAQ,KAAK,QAAQ,GACvC,OAAO,OAAO,GAAG,IAAI,GAAG,OAAO,OAAO,GAAG;GAG1C,OAAO,OAAO,OAAO,KAAK;EAC3B,CAAC,CACF;CACD;CAEA,MAAM,SAAS,SAAS,UAAU;CAClC,MAAM,SAAS,OAAO,WAAW,QAAQ;CAEzC,YAAY,QAAQ,OAAO,MAAM;CAEjC,OAAO,OAAO,OAAO,KAAK;AAC3B;;AAGA,SAAS,YACR,QACA,aACA,QACO;CACP,MAAM,UAAU,GAAG,YAAY,aAAa,EAAE,eAAe,KAAK,CAAC;CAEnE,KAAK,MAAM,SAAS,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC,GAAG;EACzE,IAAI,OAAO,IAAI,MAAM,IAAI,GACxB;EAGD,MAAM,WAAW,KAAK,KAAK,aAAa,MAAM,IAAI;EAElD,IAAI,MAAM,YAAY,GACrB,YAAY,QAAQ,UAAU,MAAM;OAC9B,IAAI,MAAM,OAAO,GAAG;GAC1B,OAAO,OAAO,MAAM,IAAI;GACxB,OAAO,OAAO,GAAG,aAAa,QAAQ,CAAC;EACxC;CACD;AACD;AAQA,SAAS,qBAAqB,WAAiD;CAC9E,IAAI;EACH,OAAO,KAAK,MACX,GAAG,aAAa,KAAK,KAAK,WAAW,cAAc,GAAG,MAAM,CAC7D;CACD,QAAQ;EACP;CACD;AACD;;;;;;AAOA,SAAS,oBAAoB,cAA2C;CACvE,MAAM,wBAAQ,IAAI,IAAoB;CAEtC,KAAK,MAAM,SAAS,CAAC,QAAQ,UAAU,GAAG;EACzC,MAAM,OAAO,KAAK,KAAK,cAAc,KAAK;EAE1C,IAAI;EAEJ,IAAI;GACH,UAAU,GAAG,YAAY,MAAM,EAAE,eAAe,KAAK,CAAC;EACvD,QAAQ;GACP;EACD;EAEA,KAAK,MAAM,SAAS,SAAS;GAC5B,IAAI,CAAC,MAAM,YAAY,GACtB;GAGD,MAAM,YAAY,KAAK,KAAK,MAAM,MAAM,IAAI;GAC5C,MAAM,MAAM,qBAAqB,SAAS;GAE1C,IAAI,KAAK,MACR,MAAM,IAAI,IAAI,MAAM,SAAS;EAE/B;CACD;CAEA,OAAO;AACR;;;;;;;;;;;;;AAcA,SAAgB,QACf,cACA,cACA,SACS;CACT,MAAM,SAAS,SAAS,UAAU;CAClC,MAAM,QAAQ,oBAAoB,YAAY;CAE9C,MAAM,QAAQ,KAAK,KAAK,cAAc,YAAY;CAClD,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,QAAQ,CAAC,KAAK;CAEpB,OAAO,MAAM,SAAS,GAAG;EACxB,MAAM,YAAY,MAAM,IAAI;EAE5B,IAAI,CAAC,aAAa,QAAQ,IAAI,SAAS,GACtC;EAGD,QAAQ,IAAI,SAAS;EAErB,MAAM,MAAM,qBAAqB,SAAS;EAE1C,IAAI,CAAC,KACJ;EAGD,MAAM,OAAO;GAAE,GAAG,IAAI;GAAc,GAAG,IAAI;EAAgB;EAE3D,KAAK,MAAM,WAAW,OAAO,KAAK,IAAI,GAAG;GACxC,MAAM,eAAe,MAAM,IAAI,OAAO;GAGtC,IAAI,gBAAgB,CAAC,QAAQ,IAAI,YAAY,GAC5C,MAAM,KAAK,YAAY;EAEzB;CACD;CAEA,MAAM,SAAS,OAAO,WAAW,QAAQ;CAIzC,KAAK,MAAM,aAAa,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG;EAC5C,OAAO,OAAO,KAAK,KAAK,SAAS,cAAc,SAAS,EAAE,GAAG;EAC7D,YAAY,QAAQ,WAAW,MAAM;CACtC;CAEA,OAAO,OAAO,OAAO,KAAK;AAC3B"}