@geekmidas/cli 10.0.0-alpha.121 → 10.0.0-alpha.123

package/dist/{discover-CSW_BMWa.d.cts → discover-C08meHhu.d.mts}

@@ -1,4 +1,4 @@
-import { n as Sandbox } from "./sandbox-CdKgQ3XU.cjs";
+import { n as Sandbox } from "./sandbox-Co1y2CmF.mjs";
 import { ConstructManifest, Declaration } from "@geekmidas/manifest";
 //#region src/reconcile/discover.d.ts
 /** The construct face discovery needs: an id, and the ability to declare. */
@@ -122,4 +122,4 @@ interface ConstructSource {
 declare function discover(options: DiscoverOptions): Promise<ConstructManifest>;
 //#endregion
 export { isDeclarable as a, discover as i, ConstructsNotSerializable as n, DiscoverOptions as r, ConstructDiscoveryFailed as t };
-//# sourceMappingURL=discover-CSW_BMWa.d.cts.map
+//# sourceMappingURL=discover-C08meHhu.d.mts.map

package/dist/{discover-CSW_BMWa.d.cts.map → discover-C08meHhu.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"discover-CSW_BMWa.d.cts","names":[],"sources":["../src/reconcile/discover.ts"],"mappings":";;;;UAsCU;EACT;EACA,WAAW;;;;;;;;;iBAUI,aAAa,iBAAiB,SAAS;UAYtC;;EAEhB;EACA;;;;;;;EAOA;;;;;;;;;;;;EAYA,UAAU,eAAe;;;;;;;;;;;;EAYzB,YAAY;;;;;;;;;EASZ,aAAa;;;;;;;;;;EAUb,cAAc,eAAe;;;;;;;EAO7B,UAAU;;;UAIM;;EAEhB;;EAEA;;;cA8GY,iCAAiC;WAEnC;WACA;EAFV,YACU,mBACA;;;;;;cAWE,kCAAkC;WACzB;EAArB,YAAqB;;;UAYL;;EAEhB;;EAEA;;;;;;;EAOA;;;;;;;;;;iBAWqB,SACrB,SAAS,kBACP,QAAQ"}
+{"version":3,"file":"discover-C08meHhu.d.mts","names":[],"sources":["../src/reconcile/discover.ts"],"mappings":";;;;UAsCU;EACT;EACA,WAAW;;;;;;;;;iBAUI,aAAa,iBAAiB,SAAS;UAYtC;;EAEhB;EACA;;;;;;;EAOA;;;;;;;;;;;;EAYA,UAAU,eAAe;;;;;;;;;;;;EAYzB,YAAY;;;;;;;;;EASZ,aAAa;;;;;;;;;;EAUb,cAAc,eAAe;;;;;;;EAO7B,UAAU;;;UAIM;;EAEhB;;EAEA;;;cA8GY,iCAAiC;WAEnC;WACA;EAFV,YACU,mBACA;;;;;;cAWE,kCAAkC;WACzB;EAArB,YAAqB;;;UAYL;;EAEhB;;EAEA;;;;;;;EAOA;;;;;;;;;;iBAWqB,SACrB,SAAS,kBACP,QAAQ"}

package/dist/{discover-xtT7fgWg.d.mts → discover-DipvfWpK.d.cts}

@@ -1,4 +1,4 @@
-import { n as Sandbox } from "./sandbox-C4g1eG31.mjs";
+import { n as Sandbox } from "./sandbox-DvNqr6od.cjs";
 import { ConstructManifest, Declaration } from "@geekmidas/manifest";
 //#region src/reconcile/discover.d.ts
 /** The construct face discovery needs: an id, and the ability to declare. */
@@ -122,4 +122,4 @@ interface ConstructSource {
 declare function discover(options: DiscoverOptions): Promise<ConstructManifest>;
 //#endregion
 export { isDeclarable as a, discover as i, ConstructsNotSerializable as n, DiscoverOptions as r, ConstructDiscoveryFailed as t };
-//# sourceMappingURL=discover-xtT7fgWg.d.mts.map
+//# sourceMappingURL=discover-DipvfWpK.d.cts.map

package/dist/{discover-xtT7fgWg.d.mts.map → discover-DipvfWpK.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"discover-xtT7fgWg.d.mts","names":[],"sources":["../src/reconcile/discover.ts"],"mappings":";;;;UAsCU;EACT;EACA,WAAW;;;;;;;;;iBAUI,aAAa,iBAAiB,SAAS;UAYtC;;EAEhB;EACA;;;;;;;EAOA;;;;;;;;;;;;EAYA,UAAU,eAAe;;;;;;;;;;;;EAYzB,YAAY;;;;;;;;;EASZ,aAAa;;;;;;;;;;EAUb,cAAc,eAAe;;;;;;;EAO7B,UAAU;;;UAIM;;EAEhB;;EAEA;;;cA8GY,iCAAiC;WAEnC;WACA;EAFV,YACU,mBACA;;;;;;cAWE,kCAAkC;WACzB;EAArB,YAAqB;;;UAYL;;EAEhB;;EAEA;;;;;;;EAOA;;;;;;;;;;iBAWqB,SACrB,SAAS,kBACP,QAAQ"}
+{"version":3,"file":"discover-DipvfWpK.d.cts","names":[],"sources":["../src/reconcile/discover.ts"],"mappings":";;;;UAsCU;EACT;EACA,WAAW;;;;;;;;;iBAUI,aAAa,iBAAiB,SAAS;UAYtC;;EAEhB;EACA;;;;;;;EAOA;;;;;;;;;;;;EAYA,UAAU,eAAe;;;;;;;;;;;;EAYzB,YAAY;;;;;;;;;EASZ,aAAa;;;;;;;;;;EAUb,cAAc,eAAe;;;;;;;EAO7B,UAAU;;;UAIM;;EAEhB;;EAEA;;;cA8GY,iCAAiC;WAEnC;WACA;EAFV,YACU,mBACA;;;;;;cAWE,kCAAkC;WACzB;EAArB,YAAqB;;;UAYL;;EAEhB;;EAEA;;;;;;;EAOA;;;;;;;;;;iBAWqB,SACrB,SAAS,kBACP,QAAQ"}

package/dist/{dns-BIYf20p7.cjs → dns-Bmnuttja.cjs}

@@ -1,6 +1,8 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_workspace = require("./workspace-BwqQnool.cjs");
-const require_seeds = require("./seeds-C2w4UqVP.cjs");
+const require_workspace = require("./workspace-C82GLPnf.cjs");
+const require_seeds = require("./seeds-BWC-qjSI.cjs");
+const require_derive = require("./derive-DAbo49sm.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_net = require("node:net");
@@ -8,6 +10,8 @@ let node_crypto = require("node:crypto");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_module = require("node:module");
 let node_url = require("node:url");
+let bcryptjs = require("bcryptjs");
+bcryptjs = require_rolldown_runtime.__toESM(bcryptjs, 1);
 let node_dns_promises = require("node:dns/promises");
 //#region src/providers/dns.ts
 /** Whether the workspace deploys through the compose target. */
@@ -319,6 +323,153 @@ function backupsRoleStatements(backups) {
 	];
 }
 //#endregion
+//#region src/compose/sitePassword.ts
+/**
+* A deployed stage's sites behind a password — `deploy.sitePassword` — so a
+* staging build is not public while it is being tried.
+*
+* The edge asks for it with HTTP basic auth, before a request reaches the
+* site: the browser prompts, and nothing of the site loads until the stage's
+* login is given. The user is the stage's name; the password is generated
+* once per site and kept in the stage's secrets, where one set by hand wins.
+* Only its bcrypt hash reaches the edge's config.
+*
+* Pure.
+*/
+/** `deploy.sitePassword` names something that is not one of the stage's sites. */
+var UnknownPasswordSite = class extends require_errors.GkmError {
+	stage;
+	site;
+	sites;
+	constructor(stage, site, sites) {
+		super(`deploy.sitePassword.${stage} names '${site}', which is not a site of this workspace. ${sites.length > 0 ? `Its sites: ${sites.map((s) => `'${s}'`).join(", ")}.` : "It declares no site."} Name one of them, or set ${stage}: true for every site.`);
+		this.stage = stage;
+		this.site = site;
+		this.sites = sites;
+		this.name = "UnknownPasswordSite";
+	}
+};
+/** A site the stage puts behind a password, with none in the stage's secrets. */
+var SitePasswordMissing = class extends require_errors.GkmError {
+	stage;
+	key;
+	constructor(stage, key) {
+		super(`deploy.sitePassword puts a site of '${stage}' behind a password, and the stage has no ${key} in its secrets. Run gkm compose --stage ${stage} once to generate it, or set one: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.key = key;
+		this.name = "SitePasswordMissing";
+	}
+};
+/**
+* `deploy.sitePassword` names a stage that deploys through a target that
+* cannot ask for a login. Refused rather than ignored: ignored, the stage
+* would be public while its config says it is not.
+*/
+var SitePasswordNeedsCompose = class extends require_errors.GkmError {
+	stage;
+	target;
+	constructor(stage, target) {
+		super(`deploy.sitePassword puts '${stage}' behind a password, and it deploys through '${target}', which cannot ask for one yet — only compose does. Remove ${stage} from deploy.sitePassword, or deploy it with compose.`);
+		this.stage = stage;
+		this.target = target;
+		this.name = "SitePasswordNeedsCompose";
+	}
+};
+/**
+* @throws {SitePasswordNeedsCompose} where `stage` asks for a site password
+* and `target` is not compose
+*/
+function assertSitePasswordTarget(workspace, stage, target) {
+	if (workspace.deploy?.sitePassword?.[stage] && target !== "compose") throw new SitePasswordNeedsCompose(stage, target);
+}
+/** The stage secret a site's password is kept in: `WEB_SITE_PASSWORD`. */
+function sitePasswordKey(site) {
+	return `${(0, _geekmidas_manifest.environmentCase)(site)}_SITE_PASSWORD`;
+}
+/** Every site the manifest declares, by app name. */
+function siteNames(manifest) {
+	return Object.values(manifest).filter((declaration) => declaration.kind === "site").map((declaration) => require_derive.appKey(declaration.id));
+}
+/**
+* The sites `deploy.sitePassword` puts behind a password on `stage`, by app
+* name: every one for `true`, the ones it names otherwise.
+*
+* @throws {UnknownPasswordSite} for a name that is not one of `sites`
+*/
+function passwordSites(workspace, stage, sites) {
+	const choice = workspace.deploy?.sitePassword?.[stage];
+	if (!choice) return [];
+	if (choice === true) return [...sites];
+	const chosen = /* @__PURE__ */ new Set();
+	for (const name of choice) {
+		const site = require_derive.appKey(name);
+		if (!sites.includes(site)) throw new UnknownPasswordSite(stage, name, sites);
+		chosen.add(site);
+	}
+	return [...chosen];
+}
+/** A password: 192 random bits, URL-safe, so it is typed or pasted as is. */
+function generateSitePassword() {
+	return (0, node_crypto.randomBytes)(24).toString("base64url");
+}
+/**
+* The stage's secrets with a generated password for each site, where it has
+* none. Pure, like `withGeneratedSecrets`: the caller keeps the result once
+* the run goes ahead.
+*/
+function withSitePasswords(secrets, sites) {
+	const missing = sites.map(sitePasswordKey).filter((key) => !secrets.custom?.[key]);
+	if (missing.length === 0) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				...Object.fromEntries(missing.map((key) => [key, generateSitePassword()]))
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: missing
+	};
+}
+/**
+* The login a site is served behind on `stage`.
+*
+* The hash's salt is derived from the password, so the same password always
+* renders the same edge config: a deploy that changed nothing rewrites
+* nothing, and the proxy is not reloaded for it. A per-hash random salt
+* guards against a precomputed table of common passwords; a generated one is
+* 192 random bits, which no table holds.
+*
+* @throws {SitePasswordMissing} where the stage's secrets hold none
+*/
+function siteAuth(stage, site, custom) {
+	const key = sitePasswordKey(site);
+	const password = custom[key];
+	if (!password) throw new SitePasswordMissing(stage, key);
+	return {
+		user: stage,
+		password,
+		hash: bcryptjs.default.hashSync(password, saltFor(password)),
+		key
+	};
+}
+/** bcrypt's own base-64 alphabet, in which a salt is written. */
+const BCRYPT_ALPHABET = "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+/**
+* A bcrypt salt — `$2a$`, which Caddy and Traefik both read, at cost 10 —
+* derived from the password.
+*/
+function saltFor(password) {
+	const digest = (0, node_crypto.createHash)("sha256").update(password).digest();
+	let salt = "";
+	for (let i = 0; i < 22; i++) salt += BCRYPT_ALPHABET[digest[i] % 64];
+	return `$2a$10$${salt}`;
+}
+//#endregion
 //#region src/compose/dns.ts
 /**
 * A compose stage's DNS: the records its public hosts need, and the check that
@@ -341,10 +492,17 @@ function backupsRoleStatements(backups) {
 *   resolver. One that is not the server stops the deploy with
 *   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
 *   for a certificate it cannot get — and use up the rate limit trying.
-* - **The step** (`stageDns`): all three, as every deploy runs them — the plan applied through each provider,
-*   what was written read back from the provider, and only the hosts no
-*   provider wrote resolved publicly. A brand-new name is never looked up
-*   before its record exists, so no resolver caches it as missing.
+* - **What gkm wrote before** (`diffRecordedDns`, pure): the plan against the
+*   records the stage's state says gkm wrote — added, kept, and stale: a
+*   host the stage no longer serves, after a domain or an app changed.
+* - **The prune** (`pruneStackDns`): each stale record deleted through its
+*   domain's provider, if it still holds the value gkm wrote. One someone
+*   pointed elsewhere is left alone; one no provider can delete is printed.
+* - **The step** (`stageDns`): all of it, as every deploy runs it — the plan applied through each provider,
+*   what was written read back from the provider, the stale records pruned,
+*   and only the hosts no provider wrote resolved publicly. A brand-new name
+*   is never looked up before its record exists, so no resolver caches it as
+*   missing.
 */
 /** The line that says how to set the server's address. */
 function serverAddressHint(stage) {
@@ -536,12 +694,23 @@ function printManual(plan, log, why) {
 /** The existing records of every planned name, for the types gkm manages. */
 async function existingRecords(provider, plan) {
 	const names = [...new Set(plan.records.map((r) => r.name))];
-	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
+	return readRecords(provider, plan.domain, names.flatMap((name) => MANAGED.map((type) => ({
 		name,
 		type
-	})));
-	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
-	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
+	}))));
+}
+/** Exactly these names and types, as the provider holds them. */
+async function readRecords(provider, domain, wanted) {
+	if (provider.readRecords) return provider.readRecords(domain, wanted);
+	return (await provider.getRecords(domain)).filter((r) => wanted.some((w) => w.name === r.name && w.type === r.type));
+}
+/** The provider for a domain's config: `providerFor`, or the real one. */
+function providerResolver(options) {
+	return options.providerFor ?? ((config) => require_seeds.createDnsProvider({
+		config,
+		...options.credentials ? { godaddy: options.credentials } : {},
+		...options.hostinger ? { hostinger: options.hostinger } : {}
+	}));
 }
 const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
 /**
@@ -631,11 +800,7 @@ function printChange(change, dryRun, log) {
 async function settleStackDns(plan, options = {}) {
 	const dryRun = options.dryRun === true;
 	const log = options.log ?? ((line) => console.log(line));
-	const providerFor = options.providerFor ?? ((config) => require_seeds.createDnsProvider({
-		config,
-		...options.credentials ? { godaddy: options.credentials } : {},
-		...options.hostinger ? { hostinger: options.hostinger } : {}
-	}));
+	const providerFor = providerResolver(options);
 	const changes = [];
 	const confirmed = /* @__PURE__ */ new Set();
 	const unconfirmed = /* @__PURE__ */ new Set();
@@ -725,6 +890,110 @@ async function settleStackDns(plan, options = {}) {
 		unconfirmed: [...unconfirmed].filter((h) => !confirmed.has(h)).sort()
 	};
 }
+/** `api.example.com A` — a record's identity, whatever its value. */
+const recordKey = (fqdn, type) => `${fqdn.trim().replace(/\.$/, "").toLowerCase()} ${type.toUpperCase()}`;
+/**
+* The plan against the records gkm wrote for the stage — pure. A record is
+* its full name and its type: one the plan has at another value is kept (the
+* apply updates it), and one whose name or type the plan no longer has is
+* stale — a host the stage stopped serving when its domain or an app changed,
+* or an AAAA once its server has no IPv6 address.
+*/
+function diffRecordedDns(plan, recorded) {
+	const planned = plan.domains.flatMap((domain) => domain.records);
+	const wanted = new Set(planned.map((r) => recordKey(r.host, r.type)));
+	const written = new Set(recorded.map((r) => recordKey(r.fqdn, r.type)));
+	return {
+		added: planned.filter((r) => !written.has(recordKey(r.host, r.type))),
+		kept: planned.filter((r) => written.has(recordKey(r.host, r.type))),
+		stale: recorded.filter((r) => !wanted.has(recordKey(r.fqdn, r.type)))
+	};
+}
+/**
+* Each stale record deleted through its domain's provider — only where the
+* provider still holds exactly the value gkm wrote, so a name someone has
+* since pointed elsewhere is never taken from them. Where no provider can
+* read and delete it — a `manual` domain, one gone from `dns`, a key that
+* can only write — it is printed for a person to remove. A dry run reads
+* and prints, and deletes nothing.
+*/
+async function pruneStackDns(stale, options) {
+	if (stale.length === 0) return [];
+	const dryRun = options.dryRun === true;
+	const log = options.log ?? ((line) => console.log(line));
+	const providerFor = providerResolver(options);
+	const dns = options.dns ? require_seeds.normalizeDnsConfig(options.dns) : {};
+	const byDomain = /* @__PURE__ */ new Map();
+	for (const record of stale) byDomain.set(record.domain, [...byDomain.get(record.domain) ?? [], record]);
+	log(`   No longer served by '${options.stage}':`);
+	const pruned = [];
+	const byHand = (domain, records, why) => {
+		log(`   ${domain}: ${why} — remove these records at its DNS host:`);
+		for (const record of records) {
+			log(`     ${record.fqdn.padEnd(32)} ${record.type.padEnd(5)} ${record.value}`);
+			pruned.push({
+				record,
+				action: "manual"
+			});
+		}
+	};
+	for (const [domain, records] of byDomain) {
+		const config = dns[domain];
+		if (!config) {
+			byHand(domain, records, "no longer in dns");
+			continue;
+		}
+		const provider = providerName(config) === "manual" ? null : await providerFor(config);
+		if (!provider) {
+			byHand(domain, records, "manual");
+			continue;
+		}
+		let existing;
+		try {
+			existing = await readRecords(provider, domain, records.map((r) => ({
+				name: r.name,
+				type: r.type
+			})));
+		} catch (error) {
+			if (!(error instanceof require_seeds.DnsRecordsUnreadable)) throw error;
+			byHand(domain, records, `the ${provider.name} key cannot read its records, so none is deleted unchecked`);
+			continue;
+		}
+		const would = dryRun ? "would " : "";
+		const deletes = [];
+		for (const record of records) {
+			const host = record.fqdn.padEnd(32);
+			const type = record.type.padEnd(5);
+			const found = existing.find((r) => r.name === record.name && r.type === record.type)?.values ?? [];
+			if (found.length === 0) {
+				log(`   · ${host} ${type} already gone`);
+				pruned.push({
+					record,
+					action: "gone"
+				});
+			} else if (found.length === 1 && same(found[0], record.value)) {
+				log(`   - ${host} ${type} ${record.value} — ${would}delete`);
+				deletes.push({
+					record,
+					action: "delete"
+				});
+			} else {
+				log(`   ⚠ ${host} ${type} ${found.join(", ")} — pointed elsewhere since gkm wrote ${record.value}; left as it is`);
+				pruned.push({
+					record,
+					action: "changed",
+					found
+				});
+			}
+		}
+		if (!dryRun && deletes.length > 0) await provider.deleteRecords(domain, deletes.map(({ record }) => ({
+			name: record.name,
+			type: record.type
+		})));
+		pruned.push(...deletes);
+	}
+	return pruned;
+}
 /** The system resolver: what the server's own clients would be told. */
 const systemLookup = async (host) => {
 	return (await (0, node_dns_promises.lookup)(host, { all: true })).map((a) => a.address);
@@ -867,8 +1136,9 @@ async function dnsCredentials(stage, domains, credentials) {
 /**
 * A stage's DNS, as every deploy runs it: the
 * stage's own hosts planned, written through each domain's provider where
-* they differ, and read back from it. Only A, AAAA and CNAME records of
-* those names are touched; nothing is a wildcard, and no other name is read,
+* they differ, and read back from it — and each record gkm wrote for a host
+* the stage no longer serves found, for `prune` to delete. Only A, AAAA and CNAME records of those
+* names are touched; nothing is a wildcard, and no other name is read,
 * written or deleted. What no provider confirms — a `manual` domain, a host
 * under no domain in `dns`, a key that cannot read — is resolved publicly.
 * A dry run prints the plan and writes nothing.
@@ -886,16 +1156,17 @@ async function stageDns(input) {
 		server,
 		dns: input.dns
 	});
-	const tokens = await dnsCredentials(stage, plan.domains.map(({ domain, config }) => ({
+	const recorded = diffRecordedDns(plan, input.recorded ?? []);
+	const dns = input.dns ? require_seeds.normalizeDnsConfig(input.dns) : {};
+	const staleDomains = [...new Set(recorded.stale.map((r) => r.domain))].filter((domain) => dns[domain] && !plan.domains.some((d) => d.domain === domain)).map((domain) => ({
+		domain,
+		config: dns[domain]
+	}));
+	const tokens = await dnsCredentials(stage, [...plan.domains.map(({ domain, config }) => ({
 		domain,
 		config
-	})), input.credentials);
-	const applied = !input.dns ? {
-		changes: [],
-		confirmed: [],
-		unconfirmed: [...plan.uncovered]
-	} : await settleStackDns(plan, {
-		...input.dryRun ? { dryRun: true } : { confirm: true },
+	})), ...staleDomains], input.credentials);
+	const providers = {
 		log,
 		credentials: {
 			...input.godaddy ?? {},
@@ -904,6 +1175,22 @@ async function stageDns(input) {
 		},
 		...tokens.hostinger ? { hostinger: tokens.hostinger } : {},
 		...input.providerFor ? { providerFor: input.providerFor } : {}
+	};
+	const applied = !input.dns ? {
+		changes: [],
+		confirmed: [],
+		unconfirmed: [...plan.uncovered]
+	} : await settleStackDns(plan, {
+		...input.dryRun ? { dryRun: true } : { confirm: true },
+		...providers
+	});
+	const deleted = new Set(applied.changes.filter((c) => c.action === "delete").map((c) => recordKey(fullName(c.domain, c.name), c.type)));
+	const stale = recorded.stale.filter((r) => !deleted.has(recordKey(r.fqdn, r.type)));
+	const prune = () => pruneStackDns(stale, {
+		stage,
+		dns: input.dns,
+		...input.dryRun ? { dryRun: true } : {},
+		...providers
 	});
 	let resolved = [];
 	if (applied.unconfirmed.length > 0) resolved = await checkStackDns({
@@ -917,7 +1204,9 @@ async function stageDns(input) {
 		plan,
 		changes: applied.changes,
 		confirmed: applied.confirmed,
-		resolved
+		resolved,
+		recorded,
+		prune
 	};
 }
 //#endregion
@@ -945,6 +1234,12 @@ Object.defineProperty(exports, "RUNNER_PATH", {
 		return RUNNER_PATH;
 	}
 });
+Object.defineProperty(exports, "assertSitePasswordTarget", {
+	enumerable: true,
+	get: function() {
+		return assertSitePasswordTarget;
+	}
+});
 Object.defineProperty(exports, "backupDatabases", {
 	enumerable: true,
 	get: function() {
@@ -999,6 +1294,12 @@ Object.defineProperty(exports, "isLocalHost", {
 		return isLocalHost;
 	}
 });
+Object.defineProperty(exports, "passwordSites", {
+	enumerable: true,
+	get: function() {
+		return passwordSites;
+	}
+});
 Object.defineProperty(exports, "requiredServerAddress", {
 	enumerable: true,
 	get: function() {
@@ -1017,6 +1318,18 @@ Object.defineProperty(exports, "serverAddressHint", {
 		return serverAddressHint;
 	}
 });
+Object.defineProperty(exports, "siteAuth", {
+	enumerable: true,
+	get: function() {
+		return siteAuth;
+	}
+});
+Object.defineProperty(exports, "siteNames", {
+	enumerable: true,
+	get: function() {
+		return siteNames;
+	}
+});
 Object.defineProperty(exports, "stackBackups", {
 	enumerable: true,
 	get: function() {
@@ -1053,5 +1366,11 @@ Object.defineProperty(exports, "systemLookup", {
 		return systemLookup;
 	}
 });
+Object.defineProperty(exports, "withSitePasswords", {
+	enumerable: true,
+	get: function() {
+		return withSitePasswords;
+	}
+});
 
-//# sourceMappingURL=dns-BIYf20p7.cjs.map
+//# sourceMappingURL=dns-Bmnuttja.cjs.map