@geekmidas/cli 10.0.0-alpha.1 → 10.0.0-alpha.100

package/dist/sniffer-n3TkX6JD.cjs

@@ -0,0 +1,1998 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_workspace = require("./workspace-BwqQnool.cjs");
+const require_seeds = require("./seeds-CHIPcMrY.cjs");
+const require_discover = require("./discover-BfhVW_kT.cjs");
+const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
+const require_local = require("./local-DNhnkugT.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_os = require("node:os");
+let node_crypto = require("node:crypto");
+let node_url = require("node:url");
+let node_zlib = require("node:zlib");
+//#region src/secrets/encryption.ts
+var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	encryptSecrets: () => encryptSecrets,
+	generateDefineOptions: () => generateDefineOptions,
+	keyFingerprint: () => keyFingerprint
+});
+/** AES-256-GCM configuration */
+const ALGORITHM = "aes-256-gcm";
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+/**
+* Encrypt secrets for embedding in a bundle.
+* Uses AES-256-GCM with a randomly generated ephemeral key.
+*
+* @param secrets - Key-value pairs to encrypt
+* @returns Encrypted payload with ephemeral master key
+*/
+function encryptSecrets(secrets) {
+	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
+	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
+	const plaintext = JSON.stringify(secrets);
+	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+	const authTag = cipher.getAuthTag();
+	return {
+		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
+		iv: iv.toString("hex"),
+		masterKey: masterKey.toString("hex")
+	};
+}
+/**
+* Generate the define options for tsdown/esbuild.
+* These will be injected at build time.
+*/
+function generateDefineOptions(payload) {
+	return {
+		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
+		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
+	};
+}
+/**
+* A short, one-way name for a master key: the first 8 hex characters of its
+* SHA-256.
+*
+* Printed where the key itself used to be, so a person can tell which key a
+* build used — and match it against the one they hold — without the output
+* carrying a value that decrypts every secret of the stage.
+*/
+function keyFingerprint(masterKey) {
+	return (0, node_crypto.createHash)("sha256").update(masterKey).digest("hex").slice(0, 8);
+}
+//#endregion
+//#region src/deploy/events.ts
+/** An error as an event carries it: its name and message, nothing else. */
+function eventError(error) {
+	if (error instanceof Error) return {
+		name: error.name,
+		message: error.message
+	};
+	return {
+		name: "Error",
+		message: String(error)
+	};
+}
+//#endregion
+//#region src/deploy/StateProvider.ts
+/**
+* Check if value is a StateProvider implementation.
+*/
+function isStateProvider(value) {
+	return typeof value === "object" && value !== null && typeof value.read === "function" && typeof value.write === "function";
+}
+var StateLocked = class extends require_errors.GkmError {
+	stage;
+	holder;
+	location;
+	constructor(stage, holder, location) {
+		const by = holder ? `${holder.owner}@${holder.host} (pid ${holder.pid}) since ${holder.acquiredAt}${holder.operation ? ` for '${holder.operation}'` : ""}` : "a run that did not record who it was";
+		super(`Deploy state for stage '${stage}' is locked by ${by} (${location}). Wait for that run to finish; if it crashed, release the lock with \`gkm state:unlock --stage ${stage}\`.`);
+		this.stage = stage;
+		this.holder = holder;
+		this.location = location;
+		this.name = "StateLocked";
+	}
+};
+var StateVersionConflict = class extends require_errors.GkmError {
+	stage;
+	expectedVersion;
+	actualVersion;
+	constructor(stage, expectedVersion, actualVersion) {
+		super(`Deploy state for stage '${stage}' changed since it was read (expected ${expectedVersion ? `version ${expectedVersion}` : "no state"}, found ${actualVersion ? `version ${actualVersion}` : "no state"}). Another run wrote it: read the state again and re-apply the change, and hold the stage's lock so runs take turns.`);
+		this.stage = stage;
+		this.expectedVersion = expectedVersion;
+		this.actualVersion = actualVersion;
+		this.name = "StateVersionConflict";
+	}
+};
+var StageStateMissing = class extends require_errors.GkmError {
+	stage;
+	constructor(stage) {
+		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
+		this.stage = stage;
+		this.name = "StageStateMissing";
+	}
+};
+var StateUnreadable = class extends require_errors.GkmError {
+	stage;
+	location;
+	constructor(stage, location, cause) {
+		super(`Deploy state for stage '${stage}' at ${location} is not valid JSON. Restore it from a backup (or the provider's history) rather than deploying without it — a deploy without state recreates every resource.`, { cause });
+		this.stage = stage;
+		this.location = location;
+		this.name = "StateUnreadable";
+	}
+};
+var StateSchemaTooNew = class extends require_errors.GkmError {
+	stage;
+	schemaVersion;
+	constructor(stage, schemaVersion) {
+		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (3). Upgrade @geekmidas/cli to the version that wrote it.`);
+		this.stage = stage;
+		this.schemaVersion = schemaVersion;
+		this.name = "StateSchemaTooNew";
+	}
+};
+/**
+* Not thrown: emitted (once per store) when a custom `StateProvider` stands
+* in for a store, so a deploy that cannot be protected from a concurrent one
+* says so.
+*/
+var StateStoreWithoutLocking = class extends require_errors.GkmError {
+	provider;
+	constructor(provider) {
+		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
+		this.provider = provider;
+		this.name = "StateStoreWithoutLocking";
+	}
+};
+var StateStoreNeedsWorkspaceName = class extends require_errors.GkmError {
+	provider;
+	constructor(provider) {
+		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
+		this.provider = provider;
+		this.name = "StateStoreNeedsWorkspaceName";
+	}
+};
+var UnknownStateProvider = class extends require_errors.GkmError {
+	config;
+	constructor(config) {
+		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
+		this.config = config;
+		this.name = "UnknownStateProvider";
+	}
+};
+/**
+* A deploy, setup or rollback of a stage in CI, with the stage's state kept on
+* the runner — which is discarded when the job ends.
+*/
+var LocalStateInCi = class extends require_errors.GkmError {
+	stage;
+	operation;
+	region;
+	constructor(stage, operation, region) {
+		super(`\`gkm ${operation}\` would keep stage '${stage}'s deploy state in .gkm/ on this CI runner, and the runner is discarded when the job ends: the next run would start without it — no releases to roll back to, no record of what was created. Keep the state in S3, in a bucket gkm creates for the project — in gkm.config.ts:\n\n  state: { provider: 's3', region: '${region}' },\n\nthen move the state you already have, from the machine that holds it:\n\n  gkm state:push --stage ${stage}\n`);
+		this.stage = stage;
+		this.operation = operation;
+		this.region = region;
+		this.name = "LocalStateInCi";
+	}
+};
+/**
+* What a run adds to a document, at most, as the store writes it: a release
+* per app and a history entry — the release and run history are capped, so
+* a stage's document stops growing once they are full.
+*/
+const STATE_HEADROOM_BYTES = 1024;
+/** The switch to S3, as the messages below spell it out. */
+function moveToS3(stage, region) {
+	return `Keep the state in S3 instead — in gkm.config.ts:\n\n  state: { provider: 's3', region: '${region}' },\n\nwhich keeps it in a bucket gkm creates for the project. Move the state there: \`gkm state:pull --stage ${stage}\` with the ssm config, then switch the config and \`gkm state:push --stage ${stage}\`.`;
+}
+/**
+* Before a deploy changes anything: the stage's state, with room for what
+* this run adds, would not fit in its SSM parameter.
+*/
+var StateTooLargeForSsm = class extends require_errors.GkmError {
+	stage;
+	bytes;
+	limit;
+	location;
+	region;
+	constructor(stage, bytes, limit, location, region) {
+		super(`Deploy state for stage '${stage}' is ${bytes} bytes compressed (${location}), and with room for this deploy (${STATE_HEADROOM_BYTES} bytes) it would pass SSM's limit of ${limit}. Nothing was deployed. ` + moveToS3(stage, region));
+		this.stage = stage;
+		this.bytes = bytes;
+		this.limit = limit;
+		this.location = location;
+		this.region = region;
+		this.name = "StateTooLargeForSsm";
+	}
+};
+/** SSM refused a write of the stage's state — past its size limit, usually. */
+var StateRejectedBySsm = class extends require_errors.GkmError {
+	stage;
+	bytes;
+	location;
+	region;
+	constructor(stage, bytes, location, region, cause) {
+		super(`SSM refused to save the deploy state for stage '${stage}' (${bytes} bytes, ${location}): ${cause instanceof Error ? cause.message : String(cause)} If a deploy was running, what it released is running now — only the record of it is missing, and the state holds what the last saved write left. ${moveToS3(stage, region)} Then deploy again to record the release, or push a good copy with \`gkm state:push\`.`, { cause });
+		this.stage = stage;
+		this.bytes = bytes;
+		this.location = location;
+		this.region = region;
+		this.name = "StateRejectedBySsm";
+	}
+};
+/** A lock or write that could not get at the state backend in time. */
+var StateStoreBusy = class extends require_errors.GkmError {
+	stage;
+	location;
+	constructor(stage, location) {
+		super(`Timed out waiting to write deploy state for stage '${stage}' (${location}). If no other gkm process is running, remove ${location}.`);
+		this.stage = stage;
+		this.location = location;
+		this.name = "StateStoreBusy";
+	}
+};
+/** `body` as `gz:` and its gzip in base64. */
+function compressBody(body) {
+	return "gz:" + (0, node_zlib.gzipSync)(body).toString("base64");
+}
+/** A stored body as the JSON it holds: compressed or not. */
+function decompressBody(body) {
+	if (!body.startsWith("gz:")) return body;
+	return (0, node_zlib.gunzipSync)(Buffer.from(body.slice(3), "base64")).toString("utf-8");
+}
+function decodeDocument(stage, body, location) {
+	let parsed;
+	try {
+		parsed = JSON.parse(decompressBody(body));
+	} catch (error) {
+		throw new StateUnreadable(stage, location, error);
+	}
+	if (typeof parsed !== "object" || parsed === null) throw new StateUnreadable(stage, location, parsed);
+	const schemaVersion = parsed.schemaVersion;
+	if (schemaVersion === void 0) return {
+		schemaVersion: 1,
+		state: parsed
+	};
+	if (schemaVersion === 2) return {
+		schemaVersion: 2,
+		document: parsed
+	};
+	if (schemaVersion === 3) return {
+		schemaVersion: 3,
+		document: parsed
+	};
+	throw new StateSchemaTooNew(stage, schemaVersion);
+}
+function encodeDocument(document) {
+	return JSON.stringify(document, null, 2);
+}
+/**
+* v1 state as a v2 document. The ids v1 kept are seeded as `ready` records,
+* so the first journaled deploy after an upgrade adopts them rather than
+* treating them as unknown.
+*/
+function migrateV1(stage, state) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const resources = {};
+	const seed = (type, name, id) => {
+		if (!id) return;
+		const key = name ? `${type}:${name}` : type;
+		resources[key] = {
+			key,
+			type,
+			id,
+			status: "ready",
+			updatedAt: now
+		};
+	};
+	seed("project", null, state.projectId);
+	seed("environment", null, state.environmentId);
+	for (const [app, id] of Object.entries(state.applications ?? {})) seed("application", app, id);
+	seed("postgres", null, state.services?.postgresId);
+	seed("redis", null, state.services?.redisId);
+	seed("backup-destination", null, state.backups?.destinationId);
+	return {
+		schemaVersion: 2,
+		stage,
+		serial: 1,
+		state,
+		resources,
+		updatedAt: now
+	};
+}
+const isEmpty = (value) => !value || Object.keys(value).length === 0;
+/**
+* Whether a v2 state in the Dokploy shape was written by the compose target.
+*
+* Before v3 every target wrote the Dokploy shape, and compose filled none of
+* its Dokploy fields. So the rule is the shape's content, not the target the
+* workspace names now: a state whose every Dokploy-only field is empty — no
+* project or environment id, no application or service ids, no credentials,
+* generated secrets, backups or registry — holds nothing only Dokploy could
+* use, and reading it as compose loses nothing. One with any of them was
+* written by Dokploy and is kept exactly as it is.
+*
+* The configured target is not used: a document decodes the same wherever it
+* is read (`state:show`, `state:push`) without a workspace, a stage can be
+* moved between targets, and `--target` can override a run.
+*/
+function writtenByCompose(state) {
+	return !state.projectId && !state.environmentId && isEmpty(state.applications) && !state.services?.postgresId && !state.services?.redisId && isEmpty(state.appCredentials) && isEmpty(state.generatedSecrets) && !state.backups && !state.registryId;
+}
+/**
+* A v2 state and its records as v3 keeps them. A compose-written state
+* becomes the compose shape: its `dnsRecords` become `dns-record` resources,
+* and `dnsVerified` and the empty Dokploy fields go — the DNS check is made
+* on every deploy. A Dokploy state is returned as it is.
+*/
+function upgradeV2State(state, resources) {
+	if (!writtenByCompose(state)) return {
+		state,
+		resources
+	};
+	const compose = {
+		provider: "compose",
+		stage: state.stage,
+		lastDeployedAt: state.lastDeployedAt,
+		...state.identity ? { identity: state.identity } : {},
+		...state.releases ? { releases: state.releases } : {}
+	};
+	const upgraded = { ...resources };
+	for (const record of Object.values(state.dnsRecords ?? {})) {
+		const resource = migratedDnsResource(record);
+		upgraded[resource.key] = resource;
+	}
+	return {
+		state: compose,
+		resources: upgraded
+	};
+}
+/** A v2 `dnsRecords` entry as the `dns-record` resource v3 keeps. */
+function migratedDnsResource(record) {
+	return {
+		...require_seeds.dnsRecordResource({
+			domain: record.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		}),
+		updatedAt: record.createdAt
+	};
+}
+/** A v2 document as v3 — not written until the next write. */
+function migrateV2(document) {
+	const { state, resources } = upgradeV2State(document.state, document.resources);
+	return {
+		schemaVersion: 3,
+		stage: document.stage,
+		serial: document.serial,
+		state,
+		resources,
+		updatedAt: document.updatedAt,
+		history: []
+	};
+}
+function newLockHolder(options) {
+	let owner = "unknown";
+	try {
+		owner = (0, node_os.userInfo)().username;
+	} catch {}
+	return {
+		id: (0, node_crypto.randomUUID)(),
+		owner,
+		host: (0, node_os.hostname)(),
+		pid: process.pid,
+		acquiredAt: (/* @__PURE__ */ new Date()).toISOString(),
+		operation: options?.operation
+	};
+}
+function contentVersion(body) {
+	return (0, node_crypto.createHash)("sha256").update(body).digest("hex").slice(0, 16);
+}
+/**
+* `history` with this write at its head. A run makes many writes — one per
+* resource it journals — so a run is one entry: a write by the run that
+* wrote the newest entry (the same lock) replaces it, and any other is
+* added. Without a lock, each write is its own entry.
+*/
+function appendHistory(history, entry, sameRun) {
+	return [entry, ...sameRun ? history.slice(1) : history].slice(0, 20);
+}
+/**
+* A store over a backend that can read and conditionally write one blob per
+* stage, and create a lock object only if it does not exist. Migration,
+* resource records and history are the same for every such backend, so they
+* live here.
+*/
+var DocumentStateStore = class {
+	/** The lock this store holds for each stage — what its writes are for. */
+	held = /* @__PURE__ */ new Map();
+	/** Per stage, the lock whose run wrote the newest history entry. */
+	logged = /* @__PURE__ */ new Map();
+	/** Who this store writes as. */
+	actor() {
+		return require_seeds.currentActor();
+	}
+	async lock(stage, options) {
+		const holder = newLockHolder(options);
+		await this.createLock(stage, holder);
+		this.held.set(stage, holder);
+		let released = false;
+		return {
+			stage,
+			holder,
+			release: async () => {
+				if (released) return;
+				released = true;
+				if (this.held.get(stage)?.id === holder.id) this.held.delete(stage);
+				await this.removeLock(stage, holder);
+			}
+		};
+	}
+	async forceUnlock(stage) {
+		const holder = await this.readLock(stage);
+		await this.removeLock(stage, null);
+		return holder;
+	}
+	async read(stage) {
+		const current = await this.readDocument(stage);
+		if (!current) return null;
+		return {
+			state: current.document.state,
+			resources: current.document.resources,
+			history: current.document.history,
+			version: current.version
+		};
+	}
+	async write(stage, state, options) {
+		if (options.expectedVersion === null) {
+			const document = this.stamp(stage, {
+				schemaVersion: 3,
+				stage,
+				serial: 1,
+				state,
+				resources: {},
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				history: []
+			});
+			return this.writeRaw(stage, encodeDocument(document), null);
+		}
+		return this.mutate(stage, options.expectedVersion, (document) => ({
+			...document,
+			state
+		}));
+	}
+	async putResource(stage, record, options) {
+		return this.mutate(stage, options?.expectedVersion, (document) => ({
+			...document,
+			resources: {
+				...document.resources,
+				[record.key]: {
+					...record,
+					updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+					updatedBy: this.actor()
+				}
+			}
+		}));
+	}
+	async deleteResource(stage, key, options) {
+		return this.mutate(stage, options?.expectedVersion, (document) => {
+			const { [key]: _removed, ...resources } = document.resources;
+			return {
+				...document,
+				resources
+			};
+		});
+	}
+	/** `document` as this write leaves it: who wrote it, in its history. */
+	stamp(stage, document) {
+		const by = this.actor();
+		const holder = this.held.get(stage);
+		const operation = holder?.operation ?? "write";
+		const history = document.history ?? [];
+		const sameRun = holder !== void 0 && this.logged.get(stage) === holder.id && history[0]?.operation === operation;
+		if (holder) this.logged.set(stage, holder.id);
+		return {
+			...document,
+			updatedBy: by,
+			history: appendHistory(history, {
+				serial: document.serial,
+				at: document.updatedAt,
+				by,
+				operation
+			}, sameRun)
+		};
+	}
+	async mutate(stage, expectedVersion, change) {
+		const current = await this.readDocument(stage);
+		if (!current) {
+			if (expectedVersion !== void 0) throw new StateVersionConflict(stage, expectedVersion, null);
+			throw new StageStateMissing(stage);
+		}
+		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
+		const next = change(current.document);
+		next.schemaVersion = 3;
+		next.serial = current.document.serial + 1;
+		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		return this.writeRaw(stage, encodeDocument(this.stamp(stage, next)), current.version);
+	}
+	/**
+	* Reads the stage's document as v3. A v1 document is migrated in place on
+	* the way — itself a conditional write: if another run migrated (or wrote)
+	* first, its result is read instead. A v2 document is upgraded in memory
+	* and written as v3 by the next write.
+	*/
+	async readDocument(stage, attempt = 0) {
+		const raw = await this.readRaw(stage);
+		if (!raw) return null;
+		const decoded = decodeDocument(stage, raw.body, this.location(stage));
+		if (decoded.schemaVersion === 3) return {
+			document: decoded.document,
+			version: raw.version
+		};
+		if (decoded.schemaVersion === 2) return {
+			document: migrateV2(decoded.document),
+			version: raw.version
+		};
+		await this.writeV1Backup(stage, raw.body);
+		const document = this.stamp(stage, migrateV2(migrateV1(stage, decoded.state)));
+		try {
+			return {
+				document,
+				version: await this.writeRaw(stage, encodeDocument(document), raw.version)
+			};
+		} catch (error) {
+			if (error instanceof StateVersionConflict && attempt < 2) return this.readDocument(stage, attempt + 1);
+			throw error;
+		}
+	}
+};
+/**
+* Refuses, with `StateTooLargeForSsm`, a run whose state would not fit its
+* store once this run has added to it — before the run changes anything, not
+* at the last write, after the stack has started.
+*/
+async function assertStateRoom(store, stage) {
+	const capacity = await store.capacity?.(stage);
+	if (!capacity) return;
+	if (capacity.bytes + 1024 > capacity.limit) throw new StateTooLargeForSsm(stage, capacity.bytes, capacity.limit, capacity.location, capacity.region ?? "<region>");
+}
+/** Whether `config` keeps state on this machine — `local`, or none given. */
+function isLocalState(config) {
+	return !config || config.provider === "local";
+}
+/**
+* Refuses, with `LocalStateInCi`, a run that would write a deployed stage's
+* state to a CI runner's disk — the local stage, which runs on the runner
+* itself, is exempt. Local use is untouched. The region the message
+* suggests is the secrets store's, when the workspace keeps them in AWS.
+*/
+function assertStateOutlivesRun(workspace, stage, operation, env = process.env) {
+	if (stage === workspace.stages?.local) return;
+	if (!require_seeds.isCi(env) || !isLocalState(workspace.state)) return;
+	const store = workspace.secrets?.store;
+	throw new LocalStateInCi(stage, operation, typeof store === "object" && store && typeof store.region === "string" ? store.region : "<region>");
+}
+function isStateStore(value) {
+	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
+}
+/**
+* The store for a workspace's `state` config:
+*
+* - none / `'local'`: `LocalStateStore` under `.gkm/`
+* - `'ssm'`: `SSMStateStore`, with no local cache — SSM is read directly, so
+*   a stale local copy can never win over it
+* - `'s3'`: `S3StateStore`
+* - a `StateStore` object: used as is
+* - a `StateProvider` object: wrapped by `LegacyStateStore`
+*/
+async function createStateStore(options) {
+	const { config, workspaceRoot, workspaceName } = options;
+	if (!config || config.provider === "local") {
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-BGDzf2f8.cjs")).then((n) => n.LocalStateStore_exports);
+		return new LocalStateStore(workspaceRoot);
+	}
+	if (isStateStore(config.provider)) return config.provider;
+	if (isStateProvider(config.provider)) {
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-CoHPQMLO.cjs"));
+		return new LegacyStateStore(config.provider, { warn: options.warn });
+	}
+	if (config.provider === "ssm") {
+		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-CLX4Dm5d.cjs"));
+		const ssm = config;
+		return SSMStateStore.create({
+			workspaceName,
+			region: ssm.region,
+			profile: ssm.profile
+		});
+	}
+	if (config.provider === "s3") {
+		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-Re4LfDTl.cjs"));
+		const s3 = config;
+		return S3StateStore.create({
+			workspaceName,
+			...s3.bucket ? { bucket: s3.bucket } : {},
+			...options.namespace ? { namespace: options.namespace } : {},
+			prefix: s3.prefix,
+			region: s3.region,
+			profile: s3.profile
+		});
+	}
+	throw new UnknownStateProvider(config);
+}
+//#endregion
+//#region src/target/dokploy/dokploy-api.ts
+/**
+* Centralized Dokploy API client
+*
+* Handles authentication, error handling, and provides typed methods for all Dokploy API endpoints.
+*/
+var dokploy_api_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	DEFAULT_DEPLOYMENT_TIMEOUT_MS: () => DEFAULT_DEPLOYMENT_TIMEOUT_MS,
+	DEFAULT_DOKPLOY_TIMEOUT_MS: () => DEFAULT_DOKPLOY_TIMEOUT_MS,
+	DeploymentFailed: () => DeploymentFailed,
+	DeploymentTimedOut: () => DeploymentTimedOut,
+	DokployApi: () => DokployApi,
+	DokployApiError: () => DokployApiError,
+	DokployRequestTimedOut: () => DokployRequestTimedOut
+});
+/** Per request, so a stalled server fails the deploy, not the CI job. */
+const DEFAULT_DOKPLOY_TIMEOUT_MS = 3e4;
+/**
+* Dokploy accepted the connection but did not answer in time.
+*
+* Not retried: a request that arrived and stalled may still be acted on, and
+* sending it again could repeat a deploy or a create the server is already
+* doing.
+*/
+var DokployRequestTimedOut = class extends require_errors.GkmError {
+	baseUrl;
+	endpoint;
+	timeoutMs;
+	constructor(baseUrl, endpoint, timeoutMs) {
+		super(`Dokploy at ${baseUrl} did not answer ${endpoint} within ${timeoutMs}ms. Check that the Dokploy server is healthy, or raise \`timeoutMs\` if this call is known to be slow.`);
+		this.baseUrl = baseUrl;
+		this.endpoint = endpoint;
+		this.timeoutMs = timeoutMs;
+		this.name = "DokployRequestTimedOut";
+	}
+};
+/**
+* Waits `ms` between retries, or rejects with the signal's reason the moment
+* it aborts — a caller who gave up should not sit through the backoff.
+*/
+function pause(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** How long a deployment may take to finish before a deploy gives up on it. */
+const DEFAULT_DEPLOYMENT_TIMEOUT_MS = 6e5;
+/** A deployment Dokploy ran and reported as failed. */
+var DeploymentFailed = class extends require_errors.GkmError {
+	applicationId;
+	deployment;
+	constructor(applicationId, deployment) {
+		super(`Dokploy's deployment ${deployment.deploymentId} of application ${applicationId} ended in "${deployment.status}"${deployment.errorMessage ? `: ${deployment.errorMessage}` : ""}. Its log in Dokploy says why — usually an image the server could not pull, or a container that exited on start.`);
+		this.applicationId = applicationId;
+		this.deployment = deployment;
+		this.name = "DeploymentFailed";
+	}
+};
+/** A deployment that had not finished when the deploy stopped waiting. */
+var DeploymentTimedOut = class extends require_errors.GkmError {
+	applicationId;
+	timeoutMs;
+	lastStatus;
+	constructor(applicationId, timeoutMs, lastStatus) {
+		super(`Application ${applicationId} did not finish deploying within ${Math.round(timeoutMs / 1e3)}s (${lastStatus ? `last status "${lastStatus}"` : "no deployment started"}). Check its deployment log in Dokploy, or raise deploy.dokploy.verify.deploymentTimeoutMs for an image that is slow to pull.`);
+		this.applicationId = applicationId;
+		this.timeoutMs = timeoutMs;
+		this.lastStatus = lastStatus;
+		this.name = "DeploymentTimedOut";
+	}
+};
+var DokployApiError = class extends Error {
+	status;
+	statusText;
+	issues;
+	constructor(message, status, statusText, issues) {
+		super(message);
+		this.status = status;
+		this.statusText = statusText;
+		this.issues = issues;
+		this.name = "DokployApiError";
+	}
+};
+/**
+* Dokploy API client
+*/
+var DokployApi = class {
+	baseUrl;
+	token;
+	timeoutMs;
+	signal;
+	constructor(options) {
+		this.baseUrl = options.baseUrl.replace(/\/$/, "");
+		this.token = options.token;
+		this.timeoutMs = options.timeoutMs ?? 3e4;
+		this.signal = options.signal;
+	}
+	/**
+	* Make a GET request to the Dokploy API
+	*/
+	async get(endpoint) {
+		return this.request("GET", endpoint);
+	}
+	/**
+	* Make a POST request to the Dokploy API
+	*/
+	async post(endpoint, body) {
+		return this.request("POST", endpoint, body);
+	}
+	/**
+	* Make a request to the Dokploy API
+	*/
+	async request(method, endpoint, body) {
+		const url = `${this.baseUrl}/api/${endpoint}`;
+		let response;
+		let timeout;
+		let lastError;
+		for (let attempt = 1; attempt <= 3; attempt++) {
+			this.signal?.throwIfAborted();
+			timeout = AbortSignal.timeout(this.timeoutMs);
+			try {
+				response = await fetch(url, {
+					method,
+					headers: {
+						"Content-Type": "application/json",
+						"x-api-key": this.token
+					},
+					body: body ? JSON.stringify(body) : void 0,
+					signal: this.signal ? AbortSignal.any([this.signal, timeout]) : timeout
+				});
+				break;
+			} catch (error) {
+				const stopped = this.stopped(timeout, endpoint);
+				if (stopped) throw stopped;
+				lastError = error;
+				if (attempt === 3) break;
+				await pause(attempt * 750, this.signal);
+			}
+		}
+		if (!response || !timeout) {
+			const detail = lastError instanceof Error ? lastError.message : String(lastError);
+			throw new DokployApiError(`Could not reach Dokploy at ${this.baseUrl} (${endpoint}): ${detail}`, 0, "Network error");
+		}
+		try {
+			return await this.read(response);
+		} catch (error) {
+			throw this.stopped(timeout, endpoint) ?? error;
+		}
+	}
+	/**
+	* What a request cut short should reject with: the caller's own reason
+	* when they aborted, `DokployRequestTimedOut` when the deadline passed,
+	* nothing when it was neither.
+	*/
+	stopped(timeout, endpoint) {
+		if (this.signal?.aborted) return this.signal.reason;
+		if (timeout.aborted) return new DokployRequestTimedOut(this.baseUrl, endpoint, this.timeoutMs);
+	}
+	/** Turns a response into its JSON body, or a `DokployApiError`. */
+	async read(response) {
+		if (!response.ok) {
+			let errorMessage = `Dokploy API error: ${response.status} ${response.statusText}`;
+			let issues;
+			try {
+				const errorBody = await response.json();
+				if (errorBody.message) errorMessage = `Dokploy API error: ${errorBody.message}`;
+				if (errorBody.issues?.length) {
+					issues = errorBody.issues;
+					errorMessage += `\n  Issues: ${errorBody.issues.map((i) => i.message).join(", ")}`;
+				}
+			} catch {}
+			throw new DokployApiError(errorMessage, response.status, response.statusText, issues);
+		}
+		const text = await response.text();
+		if (!text || text.trim() === "") return;
+		return JSON.parse(text);
+	}
+	/**
+	* Every external port published on this server, across every project.
+	*
+	* Dokploy knows what it has bound; guessing does not. A port that looks free
+	* from here can be held by a service in a project this deploy has never
+	* heard of — which surfaces as `Port 5432 is already in use by container
+	* "…"`, naming something the caller cannot see.
+	*
+	* `project.all` is a summary, so each project is fetched: the per-service
+	* `externalPort` only appears on `project.one`.
+	*/
+	async publishedPorts() {
+		const ports = /* @__PURE__ */ new Set();
+		const projects = await this.listProjects();
+		for (const project of projects) {
+			const details = await this.getProject(project.projectId);
+			for (const environment of details.environments ?? []) {
+				const resources = [
+					...environment.postgres ?? [],
+					...environment.redis ?? [],
+					...environment.applications ?? []
+				];
+				for (const resource of resources) if (typeof resource.externalPort === "number") ports.add(resource.externalPort);
+			}
+		}
+		return ports;
+	}
+	/**
+	* Validate the API token by making a test request
+	*/
+	async validateToken() {
+		try {
+			await this.get("project.all");
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* List all projects
+	*/
+	async listProjects() {
+		return this.get("project.all");
+	}
+	/**
+	* Get a single project by ID
+	*/
+	async getProject(projectId) {
+		return this.get(`project.one?projectId=${projectId}`);
+	}
+	/**
+	* Create a new project
+	*/
+	async createProject(name, description) {
+		return this.post("project.create", {
+			name,
+			description: description ?? `Created by gkm CLI`
+		});
+	}
+	/**
+	* Change a project's name or description.
+	*
+	* The name is sent with the description because `project.update` validates
+	* the whole project on some Dokploy versions, and a missing name fails it.
+	*/
+	async updateProject(projectId, updates) {
+		await this.post("project.update", {
+			projectId,
+			...updates
+		});
+	}
+	/**
+	* Delete a project and all its resources
+	*/
+	async deleteProject(projectId) {
+		await this.post("project.remove", { projectId });
+	}
+	/**
+	* Create an environment in a project
+	*/
+	async createEnvironment(projectId, name, description) {
+		return this.post("environment.create", {
+			projectId,
+			name,
+			description: description ?? `${name} environment`
+		});
+	}
+	/**
+	* List all applications in a project
+	*/
+	async listApplications(projectId) {
+		return this.listInProject(projectId, (env) => env.applications);
+	}
+	/**
+	* Everything of one kind in a project, across its environments.
+	*
+	* From `project.one`, because the per-kind `*.all?projectId=` endpoints
+	* return **404** on current Dokploy: resources live under environments now.
+	* Those calls used to be wrapped in `catch { return [] }`, which turned "I
+	* could not ask" into "there are none" — and for a find-or-create that is
+	* the worst available answer. Every deploy created a second application, a
+	* second Postgres and a second Redis, silently, for as long as the project
+	* existed.
+	*
+	* A failure here is not swallowed: creating a duplicate is worse than
+	* stopping.
+	*/
+	async listInProject(projectId, pick) {
+		return ((await this.getProject(projectId)).environments ?? []).flatMap((environment) => (pick(environment) ?? []).map((resource) => ({
+			...resource,
+			environmentId: environment.environmentId
+		})));
+	}
+	/**
+	* Find an application by name in a project
+	*/
+	async findApplicationByName(projectId, name, environmentId) {
+		const applications = await this.listApplications(projectId);
+		const normalizedName = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+		return applications.find((app) => (!environmentId || app.environmentId === environmentId) && (app.name === name || app.appName === normalizedName));
+	}
+	/**
+	* Create a new application
+	*/
+	async createApplication(name, projectId, environmentId) {
+		return this.post("application.create", {
+			name,
+			projectId,
+			environmentId,
+			appName: name.toLowerCase().replace(/[^a-z0-9-]/g, "-")
+		});
+	}
+	/**
+	* Find or create an application by name
+	*/
+	async findOrCreateApplication(name, projectId, environmentId) {
+		const existing = await this.findApplicationByName(projectId, name, environmentId);
+		if (existing) return {
+			application: existing,
+			created: false
+		};
+		return {
+			application: await this.createApplication(name, projectId, environmentId),
+			created: true
+		};
+	}
+	/**
+	* Get an application by ID
+	*/
+	async getApplication(applicationId) {
+		try {
+			return await this.get(`application.one?applicationId=${applicationId}`);
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Update an application
+	*/
+	async updateApplication(applicationId, updates) {
+		await this.post("application.update", {
+			applicationId,
+			...updates
+		});
+	}
+	/**
+	* Save environment variables for an application
+	*/
+	async saveApplicationEnv(applicationId, env, options) {
+		await this.post("application.saveEnvironment", {
+			applicationId,
+			env,
+			buildArgs: options?.buildArgs ?? null,
+			buildSecrets: options?.buildSecrets ?? null,
+			createEnvFile: false
+		});
+	}
+	/**
+	* Configure application to use Docker provider (pull from registry)
+	*
+	* For private registries, either:
+	* - Use `registryId` if the registry is configured in Dokploy
+	* - Or provide `username`, `password`, and `registryUrl` directly
+	*/
+	async saveDockerProvider(applicationId, dockerImage, options) {
+		await this.post("application.saveDockerProvider", {
+			applicationId,
+			dockerImage,
+			...options,
+			username: options?.username ?? null,
+			password: options?.password ?? null,
+			registryUrl: options?.registryUrl ?? null
+		});
+	}
+	/**
+	* Deploy an application
+	*/
+	async deployApplication(applicationId) {
+		await this.post("application.deploy", { applicationId });
+	}
+	/**
+	* An application's deployments, newest first.
+	*
+	* Sorted here rather than trusted to arrive sorted: which deployment is
+	* the latest is the whole question `waitForDeployment` asks.
+	*/
+	async listDeployments(applicationId) {
+		return [...await this.get(`deployment.all?applicationId=${encodeURIComponent(applicationId)}`)].sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+	}
+	/**
+	* When the application's latest deployment was created, by Dokploy's own
+	* clock — what `waitForDeployment`'s `since` is measured against. Epoch
+	* when it has none.
+	*/
+	async latestDeploymentAt(applicationId) {
+		const [latest] = await this.listDeployments(applicationId);
+		return new Date(latest ? Date.parse(latest.createdAt) : 0);
+	}
+	/**
+	* Wait for the deployment `application.deploy` queued to finish.
+	*
+	* `application.deploy` only queues one: it answers before the image is
+	* pulled, let alone running, so a deploy that stopped there reported
+	* success for containers that had not started. This polls the latest
+	* deployment created after `since` — Dokploy's clock, from
+	* `latestDeploymentAt` before deploying, so a laptop's skew cannot pick an
+	* older one — and the application's own status, backing off from
+	* `intervalMs` to `maxIntervalMs`.
+	*
+	* @throws {DeploymentFailed} when the deployment ends in `error` or is
+	*   cancelled, or the application reports `error` once it has finished.
+	* @throws {DeploymentTimedOut} when it has not finished within `timeoutMs`.
+	*/
+	async waitForDeployment(applicationId, options) {
+		const { since, timeoutMs = DEFAULT_DEPLOYMENT_TIMEOUT_MS, signal, intervalMs = 2e3, maxIntervalMs = 15e3 } = options;
+		const after = since.getTime();
+		const deadline = Date.now() + timeoutMs;
+		let interval = intervalMs;
+		let last;
+		while (true) {
+			signal?.throwIfAborted();
+			const deployment = (await this.listDeployments(applicationId)).find((d) => Date.parse(d.createdAt) > after);
+			last = deployment ?? last;
+			if (deployment) {
+				if (deployment.status === "error" || deployment.status === "cancelled") throw new DeploymentFailed(applicationId, deployment);
+				if (deployment.status === "done") {
+					const { applicationStatus } = await this.get(`application.one?applicationId=${encodeURIComponent(applicationId)}`);
+					if (applicationStatus === "error") throw new DeploymentFailed(applicationId, deployment);
+					if (applicationStatus !== "running") return deployment;
+				}
+			}
+			const left = deadline - Date.now();
+			if (left <= 0) throw new DeploymentTimedOut(applicationId, timeoutMs, last?.status);
+			await pause(Math.min(interval, left), signal);
+			interval = Math.min(interval * 2, maxIntervalMs);
+		}
+	}
+	/**
+	* Delete an application
+	*/
+	async deleteApplication(applicationId) {
+		await this.post("application.remove", { applicationId });
+	}
+	/**
+	* List all registries
+	*/
+	async listRegistries() {
+		return this.get("registry.all");
+	}
+	/**
+	* Create a new registry
+	*/
+	async createRegistry(registryName, registryUrl, username, password, options) {
+		return this.post("registry.create", {
+			registryName,
+			registryUrl,
+			username,
+			password,
+			imagePrefix: options?.imagePrefix
+		});
+	}
+	/**
+	* Get a registry by ID
+	*/
+	async getRegistry(registryId) {
+		return this.get(`registry.one?registryId=${registryId}`);
+	}
+	/**
+	* Update a registry
+	*/
+	async updateRegistry(registryId, updates) {
+		await this.post("registry.update", {
+			registryId,
+			...updates
+		});
+	}
+	/**
+	* Delete a registry
+	*/
+	async deleteRegistry(registryId) {
+		await this.post("registry.remove", { registryId });
+	}
+	/**
+	* List all Postgres databases in a project
+	*/
+	async listPostgres(projectId) {
+		return this.listInProject(projectId, (env) => env.postgres);
+	}
+	/**
+	* Find a Postgres database by name in a project
+	*/
+	async findPostgresByName(projectId, name) {
+		const databases = await this.listPostgres(projectId);
+		const normalizedName = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+		const match = databases.find((db) => db.name === name || db.appName === normalizedName);
+		if (!match) return void 0;
+		return this.getPostgres(match.postgresId);
+	}
+	/**
+	* Create a new Postgres database
+	*/
+	async createPostgres(name, projectId, environmentId, options) {
+		return this.post("postgres.create", {
+			name,
+			projectId,
+			environmentId,
+			appName: options?.appName ?? name.toLowerCase().replace(/[^a-z0-9-]/g, "-"),
+			databaseName: options?.databaseName,
+			databaseUser: options?.databaseUser ?? "postgres",
+			databasePassword: options?.databasePassword,
+			dockerImage: options?.dockerImage ?? "postgres:18",
+			description: options?.description ?? `Postgres database for ${name}`
+		});
+	}
+	/**
+	* Find or create a Postgres database by name
+	*/
+	async findOrCreatePostgres(name, projectId, environmentId, options) {
+		const existing = await this.findPostgresByName(projectId, name);
+		if (existing) return {
+			postgres: existing,
+			created: false
+		};
+		return {
+			postgres: await this.createPostgres(name, projectId, environmentId, options),
+			created: true
+		};
+	}
+	/**
+	* Get a Postgres database by ID
+	*/
+	async getPostgres(postgresId) {
+		return this.get(`postgres.one?postgresId=${postgresId}`);
+	}
+	/**
+	* Deploy a Postgres database
+	*/
+	async deployPostgres(postgresId) {
+		await this.post("postgres.deploy", { postgresId });
+	}
+	/**
+	* Save environment variables for Postgres
+	*/
+	async savePostgresEnv(postgresId, env) {
+		await this.post("postgres.saveEnvironment", {
+			postgresId,
+			env
+		});
+	}
+	/**
+	* Set external port for Postgres (for external access)
+	*/
+	async savePostgresExternalPort(postgresId, externalPort) {
+		await this.post("postgres.saveExternalPort", {
+			postgresId,
+			externalPort
+		});
+	}
+	/**
+	* Update Postgres configuration
+	*/
+	async updatePostgres(postgresId, updates) {
+		await this.post("postgres.update", {
+			postgresId,
+			...updates
+		});
+	}
+	/**
+	* Delete a Postgres database
+	*/
+	async deletePostgres(postgresId) {
+		await this.post("postgres.remove", { postgresId });
+	}
+	/**
+	* The compose stacks in a project.
+	*
+	* Dokploy has first-class primitives for Postgres and Redis and none for
+	* MinIO, so an object store is a compose stack — the one kind whose contents
+	* this target writes rather than configures.
+	*/
+	async listCompose(projectId) {
+		return this.listInProject(projectId, (env) => env.compose);
+	}
+	/** A compose stack by name, hydrated — `project.one` returns summaries. */
+	async findComposeByName(projectId, name) {
+		const summary = (await this.listCompose(projectId)).find((compose) => compose.name === name);
+		return summary ? this.getCompose(summary.composeId) : void 0;
+	}
+	async getCompose(composeId) {
+		return this.get(`compose.one?composeId=${composeId}`);
+	}
+	/**
+	* A compose stack carrying the file this target wrote.
+	*
+	* Created empty and then updated, because `compose.create` takes no file:
+	* it defaults to `sourceType: 'github'` and expects a repository. `raw` is
+	* what makes the file ours.
+	*/
+	async findOrCreateCompose(name, projectId, environmentId, composeFile) {
+		const existing = await this.findComposeByName(projectId, name);
+		const compose = existing ?? await this.post("compose.create", {
+			name,
+			environmentId,
+			composeType: "docker-compose"
+		});
+		await this.post("compose.update", {
+			composeId: compose.composeId,
+			sourceType: "raw",
+			composeFile
+		});
+		return {
+			compose,
+			created: !existing
+		};
+	}
+	async deployCompose(composeId) {
+		await this.post("compose.deploy", { composeId });
+	}
+	async deleteCompose(composeId) {
+		await this.post("compose.delete", {
+			composeId,
+			deleteVolumes: false
+		});
+	}
+	/**
+	* List all Redis instances in a project
+	*/
+	async listRedis(projectId) {
+		return this.listInProject(projectId, (env) => env.redis);
+	}
+	/**
+	* Find a Redis instance by name in a project
+	*/
+	async findRedisByName(projectId, name) {
+		const instances = await this.listRedis(projectId);
+		const normalizedName = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+		const match = instances.find((redis) => redis.name === name || redis.appName === normalizedName);
+		return match ? this.getRedis(match.redisId) : void 0;
+	}
+	/**
+	* Create a new Redis instance
+	*/
+	async createRedis(name, projectId, environmentId, options) {
+		return this.post("redis.create", {
+			name,
+			projectId,
+			environmentId,
+			appName: options?.appName ?? name.toLowerCase().replace(/[^a-z0-9-]/g, "-"),
+			databasePassword: options?.databasePassword,
+			dockerImage: options?.dockerImage ?? "redis:8",
+			description: options?.description ?? `Redis instance for ${name}`
+		});
+	}
+	/**
+	* Find or create a Redis instance by name
+	*/
+	async findOrCreateRedis(name, projectId, environmentId, options) {
+		const existing = await this.findRedisByName(projectId, name);
+		if (existing) return {
+			redis: existing,
+			created: false
+		};
+		return {
+			redis: await this.createRedis(name, projectId, environmentId, options),
+			created: true
+		};
+	}
+	/**
+	* Get a Redis instance by ID
+	*/
+	async getRedis(redisId) {
+		return this.get(`redis.one?redisId=${redisId}`);
+	}
+	/**
+	* Deploy a Redis instance
+	*/
+	async deployRedis(redisId) {
+		await this.post("redis.deploy", { redisId });
+	}
+	/**
+	* Save environment variables for Redis
+	*/
+	async saveRedisEnv(redisId, env) {
+		await this.post("redis.saveEnvironment", {
+			redisId,
+			env
+		});
+	}
+	/**
+	* Set external port for Redis (for external access)
+	*/
+	async saveRedisExternalPort(redisId, externalPort) {
+		await this.post("redis.saveExternalPort", {
+			redisId,
+			externalPort
+		});
+	}
+	/**
+	* Update Redis configuration
+	*/
+	async updateRedis(redisId, updates) {
+		await this.post("redis.update", {
+			redisId,
+			...updates
+		});
+	}
+	/**
+	* Delete a Redis instance
+	*/
+	async deleteRedis(redisId) {
+		await this.post("redis.remove", { redisId });
+	}
+	/**
+	* Create a new domain for an application
+	*/
+	async createDomain(options) {
+		return this.post("domain.create", options);
+	}
+	/**
+	* Update an existing domain
+	*/
+	async updateDomain(domainId, updates) {
+		await this.post("domain.update", {
+			domainId,
+			...updates
+		});
+	}
+	/**
+	* Delete a domain
+	*/
+	async deleteDomain(domainId) {
+		await this.post("domain.delete", { domainId });
+	}
+	/**
+	* Get a domain by ID
+	*/
+	async getDomain(domainId) {
+		return this.get(`domain.one?domainId=${domainId}`);
+	}
+	/**
+	* Get all domains for an application
+	*/
+	async getDomainsByApplicationId(applicationId) {
+		return this.get(`domain.byApplicationId?applicationId=${applicationId}`);
+	}
+	/**
+	* Validate a domain and trigger SSL certificate generation
+	*
+	* This should be called after DNS records are created and propagated.
+	* It triggers Let's Encrypt certificate generation for HTTPS domains.
+	*
+	* @param domain - The domain hostname to validate (e.g., 'api.example.com')
+	*/
+	async validateDomain(domain) {
+		return this.post("domain.validateDomain", { domain });
+	}
+	/**
+	* Auto-generate a domain name for an application
+	*/
+	async generateDomain(appName, serverId) {
+		return this.post("domain.generateDomain", {
+			appName,
+			serverId
+		});
+	}
+	/**
+	* List all backup destinations
+	*/
+	async listDestinations() {
+		return this.get("destination.all");
+	}
+	/**
+	* Get a destination by ID
+	*/
+	async getDestination(destinationId) {
+		return this.get(`destination.one?destinationId=${destinationId}`);
+	}
+	/**
+	* Create a new S3 backup destination
+	*/
+	async createDestination(options) {
+		return this.post("destination.create", { ...options });
+	}
+	/**
+	* Find a destination by name
+	*/
+	async findDestinationByName(name) {
+		return (await this.listDestinations()).find((d) => d.name === name);
+	}
+	/**
+	* Find or create a destination by name
+	*/
+	async findOrCreateDestination(name, options) {
+		const existing = await this.findDestinationByName(name);
+		if (existing) return {
+			destination: existing,
+			created: false
+		};
+		return {
+			destination: await this.createDestination({
+				name,
+				...options
+			}),
+			created: true
+		};
+	}
+	/**
+	* Update a destination
+	*/
+	async updateDestination(destinationId, updates) {
+		await this.post("destination.update", {
+			destinationId,
+			...updates
+		});
+	}
+	/**
+	* Delete a destination
+	*/
+	async deleteDestination(destinationId) {
+		await this.post("destination.remove", { destinationId });
+	}
+	/**
+	* Test connection to a destination
+	*/
+	async testDestinationConnection(destinationId) {
+		return this.post("destination.testConnection", { destinationId });
+	}
+	/**
+	* Create a backup schedule for postgres
+	*/
+	async createPostgresBackup(options) {
+		return this.post("backup.create", {
+			...options,
+			databaseType: "postgres"
+		});
+	}
+	/**
+	* List backups for a postgres database
+	*/
+	async listPostgresBackups(postgresId) {
+		return this.get(`backup.all?postgresId=${postgresId}&databaseType=postgres`);
+	}
+	/**
+	* Get a backup by ID
+	*/
+	async getBackup(backupId) {
+		return this.get(`backup.one?backupId=${backupId}`);
+	}
+	/**
+	* Update a backup schedule
+	*/
+	async updateBackup(backupId, updates) {
+		await this.post("backup.update", {
+			backupId,
+			...updates
+		});
+	}
+	/**
+	* Delete a backup schedule
+	*/
+	async deleteBackup(backupId) {
+		await this.post("backup.remove", { backupId });
+	}
+	/**
+	* Trigger a manual backup run
+	*/
+	async runBackupManually(backupId) {
+		await this.post("backup.manualBackup", { backupId });
+	}
+};
+//#endregion
+//#region src/workspace/client-generator.ts
+/**
+* Normalize routes to an array of patterns.
+* Handles a glob or a list of them.
+* @internal Exported for use in dev command
+*/
+function normalizeRoutes(routes) {
+	if (!routes) return [];
+	return Array.isArray(routes) ? routes : [routes];
+}
+//#endregion
+//#region src/deploy/sniffer.ts
+const __filename$1 = (0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href);
+const __dirname$1 = (0, node_path.dirname)(__filename$1);
+/**
+* Resolve the path to a sniffer helper file.
+* Handles both dev (.ts with tsx) and production (.mjs from dist).
+*
+* In production: sniffer.ts is bundled into dist/index.mjs, but sniffer helper
+* files are output to dist/deploy/ as standalone modules for subprocess loading.
+*
+* In development: All files are in src/deploy/ and loaded via tsx.
+*/
+function resolveSnifferFile(baseName) {
+	const deployMjsPath = (0, node_path.resolve)(__dirname$1, "deploy", `${baseName}.mjs`);
+	if ((0, node_fs.existsSync)(deployMjsPath)) return deployMjsPath;
+	const mjsPath = (0, node_path.resolve)(__dirname$1, `${baseName}.mjs`);
+	if ((0, node_fs.existsSync)(mjsPath)) return mjsPath;
+	const tsPath = (0, node_path.resolve)(__dirname$1, `${baseName}.ts`);
+	if ((0, node_fs.existsSync)(tsPath)) return tsPath;
+	return tsPath;
+}
+/**
+* Run a sniffer worker in the sandbox, with the sandbox's environment and
+* nothing of the deploy's: the deploy's Dokploy token, registry login and AWS
+* keys stay where they are. A worker that outlives the timeout is killed, and
+* comes back as the error the caller reports.
+*/
+async function runSniffer(run, workspacePath, cwd, nodeArgs) {
+	const sandbox = run.sandbox ?? require_sandbox.activeSandbox() ?? new require_local.LocalSandbox({ root: (0, node_path.resolve)(workspacePath) });
+	try {
+		const result = await sandbox.exec("node", nodeArgs, {
+			cwd,
+			env: { ...sandbox.env },
+			timeoutMs: run.timeoutMs ?? 3e4,
+			output: "capture"
+		});
+		return {
+			stdout: result.stdout,
+			stderr: result.stderr,
+			code: result.exitCode
+		};
+	} catch (error) {
+		return { error: error instanceof Error ? error : new Error(String(error)) };
+	}
+}
+/** The worker's JSON answer: the last object on stdout naming `envVars`. */
+function snifferAnswer(stdout) {
+	try {
+		const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+		return jsonMatch ? JSON.parse(jsonMatch[0]) : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Get required environment variables for an app.
+*
+* Detection strategy (in order):
+* 1. Frontend apps: Returns empty (no server secrets)
+* 2. Apps with `requiredEnv`: Uses explicit list from config
+* 3. Entry apps: Imports entry file in subprocess to capture config.parse() calls
+* 4. Route-based apps: Loads route files and calls getEnvironment() on each construct
+* 5. Apps with `envParser` (no routes): Runs SnifferEnvironmentParser to detect usage
+* 6. Apps with neither: Returns empty
+*
+* This function handles "fire and forget" async operations gracefully,
+* capturing errors and unhandled rejections without failing the build.
+*
+* @param app - The normalized app configuration
+* @param appName - The name of the app
+* @param workspacePath - Absolute path to the workspace root
+* @param options - Optional configuration for sniffing behavior
+* @returns The sniffed environment with required variables
+*/
+async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
+	const { logWarnings = true, markOptional = false } = options;
+	const run = {
+		...options.sandbox ? { sandbox: options.sandbox } : {},
+		...options.timeoutMs ? { timeoutMs: options.timeoutMs } : {}
+	};
+	if (app.type === "web" || app.type === "mobile") {
+		const publicPrefix = require_workspace.getPublicEnvPrefix(app.framework);
+		const depVars = publicPrefix ? (app.dependencies ?? []).map((dep) => `${publicPrefix}${dep.toUpperCase()}_URL`) : [];
+		if (app.config) {
+			const sniffedVars = [];
+			const sniffedOptional = [];
+			const configPaths = [];
+			if (app.config.client) configPaths.push(app.config.client);
+			if (app.config.server) configPaths.push(app.config.server);
+			for (const configPath of configPaths) {
+				const result = await sniffEntryFile(configPath, app.path, workspacePath, run);
+				if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
+				sniffedVars.push(...result.envVars);
+				sniffedOptional.push(...result.optionalEnvVars);
+			}
+			const optionalEnvVars = [...new Set(sniffedOptional)];
+			return {
+				appName,
+				requiredEnvVars: applyMarkOptional([.../* @__PURE__ */ new Set([...depVars, ...sniffedVars])], optionalEnvVars, markOptional),
+				optionalEnvVars
+			};
+		}
+		return {
+			appName,
+			requiredEnvVars: depVars,
+			optionalEnvVars: []
+		};
+	}
+	if (app.entry) {
+		const result = await sniffEntryFile(app.entry, app.path, workspacePath, run);
+		if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	if (app.routes) {
+		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath, run);
+		if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	if (app.envParser) {
+		const result = await sniffEnvParser(app.envParser, app.path, workspacePath, run);
+		if (logWarnings) {
+			if (result.error) require_discover.output.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
+			if (result.unhandledRejections.length > 0) require_discover.output.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
+		}
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	return {
+		appName,
+		requiredEnvVars: [],
+		optionalEnvVars: []
+	};
+}
+/**
+* Apply the `?` suffix to optional variables in an env var list.
+* Only modifies the list when `markOptional` is true and there are optional vars.
+*/
+function applyMarkOptional(envVars, optionalEnvVars, markOptional) {
+	if (!markOptional || optionalEnvVars.length === 0) return envVars;
+	const optionalSet = new Set(optionalEnvVars);
+	return envVars.map((v) => optionalSet.has(v) ? `${v}?` : v);
+}
+/**
+* Sniff an entry file by importing it in a subprocess.
+*
+* Entry apps call `config.parse()` at module load time. To capture which
+* env vars are accessed, we:
+* 1. Spawn a subprocess with a module loader hook
+* 2. The loader intercepts `@geekmidas/envkit` and replaces EnvironmentParser
+*    with SnifferEnvironmentParser
+* 3. Import the entry file (triggers config.parse())
+* 4. Capture and return the accessed env var names
+*
+* This approach provides process isolation - each app is sniffed in its own
+* subprocess, preventing module cache pollution.
+*
+* @param entryPath - Relative path to the entry file (e.g., './src/index.ts')
+* @param appPath - The app's path relative to workspace (e.g., 'apps/auth')
+* @param workspacePath - Absolute path to workspace root
+* @returns EntrySniffResult with env vars and optional error
+*/
+async function sniffEntryFile(entryPath, appPath, workspacePath, run = {}) {
+	const fullEntryPath = (0, node_path.resolve)(workspacePath, appPath, entryPath);
+	const loaderPath = resolveSnifferFile("sniffer-loader");
+	const workerPath = resolveSnifferFile("sniffer-worker");
+	const ran = await runSniffer(run, workspacePath, (0, node_path.resolve)(workspacePath, appPath), require_discover.nodeWithTsx(workerPath, [fullEntryPath], [loaderPath]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: ran.error
+	};
+	const answer = snifferAnswer(ran.stdout);
+	if (answer) return {
+		envVars: answer.envVars || [],
+		optionalEnvVars: answer.optionalEnvVars || [],
+		error: answer.error ? new Error(answer.error) : void 0
+	};
+	return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff entry file (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
+}
+/**
+* Sniff route files by loading constructs and calling getEnvironment().
+*
+* Route-based apps have endpoints, functions, crons, and subscribers that
+* use services. Each service's register() method accesses environment variables.
+*
+* This runs in a subprocess with tsx loader to properly handle TypeScript
+* compilation and path alias resolution (e.g., `src/...` imports).
+*
+* @param routes - Glob pattern(s) for route files
+* @param appPath - The app's path relative to workspace (e.g., 'apps/api')
+* @param workspacePath - Absolute path to workspace root
+* @returns EntrySniffResult with env vars and optional error
+*/
+async function sniffRouteFiles(routes, appPath, workspacePath, run = {}) {
+	const fullAppPath = (0, node_path.resolve)(workspacePath, appPath);
+	const workerPath = resolveSnifferFile("sniffer-routes-worker");
+	const pattern = (Array.isArray(routes) ? routes : [routes])[0];
+	if (!pattern) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error("No route patterns provided")
+	};
+	const ran = await runSniffer(run, workspacePath, fullAppPath, require_discover.nodeWithTsx(workerPath, [fullAppPath, pattern]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: ran.error
+	};
+	if (ran.stderr) ran.stderr.split("\n").filter((line) => line.trim()).forEach((line) => require_discover.output.warn(line));
+	const answer = snifferAnswer(ran.stdout);
+	if (answer) return {
+		envVars: answer.envVars || [],
+		optionalEnvVars: answer.optionalEnvVars || [],
+		error: answer.error ? new Error(answer.error) : void 0
+	};
+	return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff route files (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
+}
+/**
+* Run the SnifferEnvironmentParser on an envParser module to detect
+* which environment variables it accesses.
+*
+* In a subprocess, like the entry and route sniffers: the module is the
+* project's code, and it was imported into the deploy itself before — with
+* every credential the deploy held in reach. Fire-and-forget rejections are
+* collected there with the shared `sniffWithFireAndForget`.
+*
+* @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
+* @param appPath - The app's path relative to workspace
+* @param workspacePath - Absolute path to workspace root
+* @returns SniffResult with env vars and any errors encountered
+*/
+async function sniffEnvParser(envParserPath, appPath, workspacePath, run = {}) {
+	const [modulePath, exportName = "default"] = envParserPath.split("#");
+	if (!modulePath) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: []
+	};
+	const appRoot = (0, node_path.resolve)(workspacePath, appPath);
+	const fullPath = (0, node_path.resolve)(appRoot, modulePath);
+	const workerPath = resolveSnifferFile("sniffer-envparser-worker");
+	const ran = await runSniffer(run, workspacePath, appRoot, require_discover.nodeWithTsx(workerPath, [fullPath, exportName]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: [],
+		error: ran.error
+	};
+	const answer = snifferAnswer(ran.stdout);
+	if (!answer) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff envParser (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
+	for (const warning of answer.warnings ?? []) require_discover.output.warn(warning);
+	return {
+		envVars: answer.envVars ?? [],
+		optionalEnvVars: answer.optionalEnvVars ?? [],
+		unhandledRejections: (answer.unhandledRejections ?? []).map((message) => new Error(message)),
+		...answer.error ? { error: new Error(answer.error) } : {}
+	};
+}
+/**
+* Sniff environment requirements for multiple apps.
+*
+* @param apps - Map of app name to app config
+* @param workspacePath - Absolute path to workspace root
+* @param options - Optional configuration for sniffing behavior
+* @returns Map of app name to sniffed environment
+*/
+async function sniffAllApps(apps, workspacePath, options = {}) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, app] of Object.entries(apps)) {
+		const sniffed = await sniffAppEnvironment(app, appName, workspacePath, options);
+		results.set(appName, sniffed);
+	}
+	return results;
+}
+//#endregion
+Object.defineProperty(exports, "DEFAULT_DEPLOYMENT_TIMEOUT_MS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_DEPLOYMENT_TIMEOUT_MS;
+	}
+});
+Object.defineProperty(exports, "DeploymentFailed", {
+	enumerable: true,
+	get: function() {
+		return DeploymentFailed;
+	}
+});
+Object.defineProperty(exports, "DeploymentTimedOut", {
+	enumerable: true,
+	get: function() {
+		return DeploymentTimedOut;
+	}
+});
+Object.defineProperty(exports, "DocumentStateStore", {
+	enumerable: true,
+	get: function() {
+		return DocumentStateStore;
+	}
+});
+Object.defineProperty(exports, "DokployApi", {
+	enumerable: true,
+	get: function() {
+		return DokployApi;
+	}
+});
+Object.defineProperty(exports, "DokployApiError", {
+	enumerable: true,
+	get: function() {
+		return DokployApiError;
+	}
+});
+Object.defineProperty(exports, "LocalStateInCi", {
+	enumerable: true,
+	get: function() {
+		return LocalStateInCi;
+	}
+});
+Object.defineProperty(exports, "StageStateMissing", {
+	enumerable: true,
+	get: function() {
+		return StageStateMissing;
+	}
+});
+Object.defineProperty(exports, "StateLocked", {
+	enumerable: true,
+	get: function() {
+		return StateLocked;
+	}
+});
+Object.defineProperty(exports, "StateRejectedBySsm", {
+	enumerable: true,
+	get: function() {
+		return StateRejectedBySsm;
+	}
+});
+Object.defineProperty(exports, "StateStoreBusy", {
+	enumerable: true,
+	get: function() {
+		return StateStoreBusy;
+	}
+});
+Object.defineProperty(exports, "StateStoreWithoutLocking", {
+	enumerable: true,
+	get: function() {
+		return StateStoreWithoutLocking;
+	}
+});
+Object.defineProperty(exports, "StateVersionConflict", {
+	enumerable: true,
+	get: function() {
+		return StateVersionConflict;
+	}
+});
+Object.defineProperty(exports, "appendHistory", {
+	enumerable: true,
+	get: function() {
+		return appendHistory;
+	}
+});
+Object.defineProperty(exports, "assertStateOutlivesRun", {
+	enumerable: true,
+	get: function() {
+		return assertStateOutlivesRun;
+	}
+});
+Object.defineProperty(exports, "assertStateRoom", {
+	enumerable: true,
+	get: function() {
+		return assertStateRoom;
+	}
+});
+Object.defineProperty(exports, "compressBody", {
+	enumerable: true,
+	get: function() {
+		return compressBody;
+	}
+});
+Object.defineProperty(exports, "contentVersion", {
+	enumerable: true,
+	get: function() {
+		return contentVersion;
+	}
+});
+Object.defineProperty(exports, "createStateStore", {
+	enumerable: true,
+	get: function() {
+		return createStateStore;
+	}
+});
+Object.defineProperty(exports, "decompressBody", {
+	enumerable: true,
+	get: function() {
+		return decompressBody;
+	}
+});
+Object.defineProperty(exports, "dokploy_api_exports", {
+	enumerable: true,
+	get: function() {
+		return dokploy_api_exports;
+	}
+});
+Object.defineProperty(exports, "encryptSecrets", {
+	enumerable: true,
+	get: function() {
+		return encryptSecrets;
+	}
+});
+Object.defineProperty(exports, "encryption_exports", {
+	enumerable: true,
+	get: function() {
+		return encryption_exports;
+	}
+});
+Object.defineProperty(exports, "eventError", {
+	enumerable: true,
+	get: function() {
+		return eventError;
+	}
+});
+Object.defineProperty(exports, "keyFingerprint", {
+	enumerable: true,
+	get: function() {
+		return keyFingerprint;
+	}
+});
+Object.defineProperty(exports, "newLockHolder", {
+	enumerable: true,
+	get: function() {
+		return newLockHolder;
+	}
+});
+Object.defineProperty(exports, "sniffAllApps", {
+	enumerable: true,
+	get: function() {
+		return sniffAllApps;
+	}
+});
+Object.defineProperty(exports, "sniffAppEnvironment", {
+	enumerable: true,
+	get: function() {
+		return sniffAppEnvironment;
+	}
+});
+Object.defineProperty(exports, "upgradeV2State", {
+	enumerable: true,
+	get: function() {
+		return upgradeV2State;
+	}
+});
+
+//# sourceMappingURL=sniffer-n3TkX6JD.cjs.map