@geekmidas/cli 10.0.0-alpha.60 → 10.0.0-alpha.62

package/dist/{deploy-0fBVeWO-.cjs → deploy-DSaCYvcO.cjs}

@@ -1,110 +1,19 @@
-const require_sniffer = require("./sniffer-DIv12ncU.cjs");
-const require_home = require("./home-DOzBaWaL.cjs");
+const require_sniffer = require("./sniffer-BsfPa-GA.cjs");
 const require_discover = require("./discover-Bc-4eA_p.cjs");
-const require_config = require("./config-DXnkCEq0.cjs");
-const require_workspace = require("./workspace-B64Xk1Mb.cjs");
+const require_config = require("./config-BYh9S0cZ.cjs");
+const require_workspace = require("./workspace-B6zQO6RY.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-KvNQwYaB.cjs");
+const require_terminal = require("./terminal-6oL0vANs.cjs");
 let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_crypto = require("node:crypto");
-let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let pg = require("pg");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
 let node_dns_promises = require("node:dns/promises");
-//#region src/deploy/credentials.ts
-/**
-* How a deploy gets the credentials it acts with.
-*
-* `deploy()` never prompts and never reads a terminal: it asks a
-* `CredentialProvider` and, when the provider has nothing, stops with
-* `MissingCredential` naming what it needed and how to supply it. Whether to
-* ask a person, read a vault or fail is the caller's decision — `gkm deploy`
-* prompts at a terminal and stores what was typed; a CI job sets the
-* environment; a host passes its own provider.
-*/
-/** How to supply each kind, for the error that says it is missing. */
-const HOW_TO_PROVIDE = {
-	dokploy: "Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.",
-	registry: "Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them."
-};
-/** A deploy needed a credential, and its provider had none. */
-var MissingCredential = class extends Error {
-	kind;
-	target;
-	howToProvide;
-	constructor(kind, target, howToProvide = HOW_TO_PROVIDE[kind]) {
-		const what = kind === "dokploy" ? `No Dokploy credentials${target ? ` for ${target}` : ""}.` : `Dokploy has no registry for ${target ?? "the configured registry"}, and there are no credentials to create one with.`;
-		super(`${what} ${howToProvide}`);
-		this.kind = kind;
-		this.target = target;
-		this.howToProvide = howToProvide;
-		this.name = "MissingCredential";
-	}
-};
-/** Whatever was asked for, from the first provider that has it. */
-function chainCredentials(...providers) {
-	return { async get(request, options) {
-		for (const provider of providers) {
-			const found = await provider.get(request, options);
-			if (found) return found;
-		}
-	} };
-}
-/**
-* Credentials from the environment, then from what `gkm login` stored. What
-* `deploy()` uses when it is handed no provider.
-*
-* - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
-*   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
-*   Each half is read on its own: a token is a secret and belongs in the
-*   environment, an endpoint is configuration and belongs in the config.
-* - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
-*/
-function storedCredentials(options = {}) {
-	const env = options.env ?? process.env;
-	return { async get(asked) {
-		const request = asked;
-		switch (request.kind) {
-			case "dokploy": {
-				const stored = (await require_sniffer.readCredentials(options.home ? { home: options.home } : void 0)).dokploy;
-				const token = env.DOKPLOY_API_TOKEN ?? stored?.token;
-				const endpoint = env.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;
-				if (!token || !endpoint) return void 0;
-				return {
-					endpoint: endpoint.replace(/\/$/, ""),
-					token
-				};
-			}
-			case "registry": {
-				const username = env.DOCKER_REGISTRY_USERNAME;
-				const password = env.DOCKER_REGISTRY_PASSWORD;
-				if (!username || !password) return void 0;
-				return {
-					username,
-					password
-				};
-			}
-		}
-	} };
-}
-//#endregion
-//#region src/deploy/events.ts
-/** An error as an event carries it: its name and message, nothing else. */
-function eventError(error) {
-	if (error instanceof Error) return {
-		name: error.name,
-		message: error.message
-	};
-	return {
-		name: "Error",
-		message: String(error)
-	};
-}
-//#endregion
 //#region src/deploy/fromManifest.ts
 /**
 * The Dokploy target, read off the construct manifest.
@@ -855,108 +764,6 @@ function surfaceAddresses(manifest, appUrls) {
 	return addresses;
 }
 //#endregion
-//#region src/deploy/state.ts
-/**
-* Deploy state management for Dokploy deployments
-*
-* Stores resource IDs (applications, services) per stage to avoid
-* re-creating resources on subsequent deploys.
-*/
-/**
-* Create a new empty state for a stage
-*/
-function createEmptyState(stage, projectId, environmentId) {
-	return {
-		provider: "dokploy",
-		stage,
-		projectId,
-		environmentId,
-		applications: {},
-		services: {},
-		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Set application ID in state (mutates state)
-*/
-function setApplicationId(state, appName, applicationId) {
-	state.applications[appName] = applicationId;
-}
-/**
-* Record the image an app was deployed with (mutates state)
-*/
-function setDeployedImage(state, appName, image) {
-	state.images = {
-		...state.images,
-		[appName]: image
-	};
-}
-/**
-* Get a generated secret for an app
-*/
-function getGeneratedSecret(state, appName, secretName) {
-	return state?.generatedSecrets?.[appName]?.[secretName];
-}
-/**
-* Set a generated secret for an app (mutates state)
-*/
-function setGeneratedSecret(state, appName, secretName, value) {
-	if (!state.generatedSecrets) state.generatedSecrets = {};
-	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
-	state.generatedSecrets[appName][secretName] = value;
-}
-/**
-* Set DNS verification record for a hostname (mutates state)
-*/
-function setDnsVerification(state, hostname, serverIp) {
-	if (!state.dnsVerified) state.dnsVerified = {};
-	state.dnsVerified[hostname] = {
-		serverIp,
-		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Check if a hostname is already verified with the given IP
-*/
-function isDnsVerified(state, hostname, serverIp) {
-	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
-}
-/**
-* Get the key for a DNS record in state
-*/
-function getDnsRecordKey(name, type) {
-	return `${name}:${type}`;
-}
-/**
-* Set a created DNS record in state (mutates state)
-*/
-function setDnsRecord(state, record) {
-	if (!state.dnsRecords) state.dnsRecords = {};
-	const key = getDnsRecordKey(record.name, record.type);
-	state.dnsRecords[key] = {
-		...record,
-		createdAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Get backup state from state
-*/
-function getBackupState(state) {
-	return state?.backups;
-}
-/**
-* Set backup state (mutates state)
-*/
-function setBackupState(state, backupState) {
-	state.backups = backupState;
-}
-/**
-* Set postgres backup ID in state (mutates state)
-*/
-function setPostgresBackupId(state, backupId) {
-	if (state.backups) state.backups.postgresBackupId = backupId;
-}
-//#endregion
 //#region src/deploy/dns/DnsProvider.ts
 /**
 * Check if value is a DnsProvider implementation.
@@ -978,7 +785,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-BTZd2u0f.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-DyD1Hin8.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -1000,7 +807,7 @@ async function createDnsProvider(options) {
 *
 * Handles automatic DNS record creation for deployed applications.
 */
-const logger$3 = require_discover.output;
+const logger$2 = require_discover.output;
 /**
 * Check if DNS config is legacy format (single domain with `domain` property)
 */
@@ -1037,7 +844,7 @@ function groupHostnamesByDomain(appHostnames, dnsConfig) {
 	for (const [appName, hostname] of appHostnames) {
 		const rootDomain = findRootDomain(hostname, dnsConfig);
 		if (!rootDomain) {
-			logger$3.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			logger$2.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
 			continue;
 		}
 		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
@@ -1087,10 +894,10 @@ function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
 * Print DNS records table
 */
 function printDnsRecordsTable(records, rootDomain) {
-	logger$3.log(`\n   📋 DNS Records for ${rootDomain}:`);
-	logger$3.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
-	logger$3.log("   │ Subdomain                           │ Type │ Value           │ Status │");
-	logger$3.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	logger$2.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$2.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$2.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$2.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
 	for (const record of records) {
 		const subdomain = record.subdomain.padEnd(35);
 		const type = record.type.padEnd(4);
@@ -1100,18 +907,18 @@ function printDnsRecordsTable(records, rootDomain) {
 		else if (record.created) status = "✓ new";
 		else if (record.existed) status = "✓";
 		else status = "?";
-		logger$3.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
+		logger$2.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
 	}
-	logger$3.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+	logger$2.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
 }
 /**
 * Print DNS records in a simple format for manual setup
 */
 function printDnsRecordsSimple(records, rootDomain) {
-	logger$3.log("\n   📋 Required DNS Records:");
-	logger$3.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
-	for (const record of records) logger$3.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
-	logger$3.log("");
+	logger$2.log("\n   📋 Required DNS Records:");
+	logger$2.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$2.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$2.log("");
 }
 /**
 * Create DNS records for a single domain using its configured provider
@@ -1123,7 +930,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		provider = await createDnsProvider({ config: providerConfig });
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$3.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		logger$2.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			...r,
 			error: message
@@ -1177,7 +984,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		}
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$3.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		logger$2.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			hostname: r.hostname,
 			subdomain: r.subdomain,
@@ -1204,20 +1011,20 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	if (!dnsConfig) return null;
 	const normalizedConfig = normalizeDnsConfig(dnsConfig);
-	logger$3.log("\n🌐 Setting up DNS records...");
+	logger$2.log("\n🌐 Setting up DNS records...");
 	let serverIp;
 	try {
 		const endpointUrl = new URL(dokployEndpoint);
 		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
-		logger$3.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+		logger$2.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$3.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		logger$2.log(`   ⚠ Failed to resolve server IP: ${message}`);
 		return null;
 	}
 	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
 	if (groupedHostnames.size === 0) {
-		logger$3.log("   No DNS records needed (no hostnames match configured domains)");
+		logger$2.log("   No DNS records needed (no hostnames match configured domains)");
 		return {
 			records: [],
 			success: true,
@@ -1229,26 +1036,26 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	for (const [rootDomain, domainHostnames] of groupedHostnames) {
 		const providerConfig = normalizedConfig[rootDomain];
 		if (!providerConfig) {
-			logger$3.log(`   ⚠ No provider config for ${rootDomain}`);
+			logger$2.log(`   ⚠ No provider config for ${rootDomain}`);
 			continue;
 		}
 		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
 		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
 		if (requiredRecords.length === 0) continue;
-		logger$3.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		logger$2.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
 		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
 		allRecords.push(...domainRecords);
 		const created = domainRecords.filter((r) => r.created).length;
 		const existed = domainRecords.filter((r) => r.existed).length;
 		const failed = domainRecords.filter((r) => r.error).length;
-		if (created > 0) logger$3.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
-		if (existed > 0) logger$3.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (created > 0) logger$2.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$2.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
 		if (failed > 0) {
-			logger$3.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			logger$2.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
 			hasFailures = true;
 		}
 		if (state) {
-			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
+			for (const record of domainRecords) if (record.created || record.existed) require_sniffer.setDnsRecord(state, {
 				domain: rootDomain,
 				name: record.subdomain,
 				type: record.type,
@@ -1281,10 +1088,10 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 */
 async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const results = [];
-	logger$3.log("\n🔍 Verifying DNS records...");
+	logger$2.log("\n🔍 Verifying DNS records...");
 	for (const [appName, hostname] of appHostnames) {
-		if (isDnsVerified(state, hostname, serverIp)) {
-			logger$3.log(`   ✓ ${hostname} (previously verified)`);
+		if (require_sniffer.isDnsVerified(state, hostname, serverIp)) {
+			logger$2.log(`   ✓ ${hostname} (previously verified)`);
 			results.push({
 				hostname,
 				appName,
@@ -1297,8 +1104,8 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 		try {
 			const resolvedIp = await resolveHostnameToIp(hostname);
 			if (resolvedIp === serverIp) {
-				setDnsVerification(state, hostname, serverIp);
-				logger$3.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				require_sniffer.setDnsVerification(state, hostname, serverIp);
+				logger$2.log(`   ✓ ${hostname} → ${resolvedIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -1307,7 +1114,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 					expectedIp: serverIp
 				});
 			} else {
-				logger$3.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				logger$2.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -1318,7 +1125,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			}
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$3.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			logger$2.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
 			results.push({
 				hostname,
 				appName,
@@ -1332,14 +1139,14 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const skipped = results.filter((r) => r.skipped).length;
 	const pending = results.filter((r) => !r.verified).length;
 	if (pending > 0) {
-		logger$3.log(`\n   ${verified} verified, ${pending} pending propagation`);
-		logger$3.log("   DNS changes may take 5-30 minutes to propagate");
-	} else if (skipped > 0) logger$3.log(`   ${verified} verified (${skipped} from cache)`);
+		logger$2.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$2.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$2.log(`   ${verified} verified (${skipped} from cache)`);
 	return results;
 }
 //#endregion
 //#region src/deploy/docker.ts
-const logger$2 = require_discover.output;
+const logger$1 = require_discover.output;
 /**
 * The id the Dockerfile templates mount the encrypted credentials under:
 * `RUN --mount=type=secret,id=gkm_credentials`.
@@ -1402,8 +1209,8 @@ async function writeCredentialsFile(credentials) {
 * @param credentials - Encrypted credentials, passed as a build secret
 */
 async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio }) {
-	logger$2.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger$2.log("   Generating Dockerfile for the pre-built bundle...");
+	logger$1.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$1.log("   Generating Dockerfile for the pre-built bundle...");
 	await require_sniffer.dockerCommand({
 		slim: true,
 		cwd
@@ -1425,7 +1232,7 @@ async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio
 			...signal ? { signal } : {},
 			...stdio ? { stdio } : {}
 		});
-		logger$2.log(`✅ Image built: ${imageRef}`);
+		logger$1.log(`✅ Image built: ${imageRef}`);
 	} catch (error) {
 		throw new require_sniffer.DockerBuildFailed(imageRef, error);
 	} finally {
@@ -1436,14 +1243,14 @@ async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio
 * Push Docker image to registry
 */
 async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger$2.log(`\n☁️  Pushing image: ${imageRef}`);
+	logger$1.log(`\n☁️  Pushing image: ${imageRef}`);
 	try {
 		await require_sniffer.run("docker", ["push", imageRef], {
 			cwd,
 			...signal ? { signal } : {},
 			...stdio ? { stdio } : {}
 		});
-		logger$2.log(`✅ Image pushed: ${imageRef}`);
+		logger$1.log(`✅ Image pushed: ${imageRef}`);
 	} catch (error) {
 		throw new require_sniffer.DockerPushFailed(imageRef, error);
 	}
@@ -1493,17 +1300,17 @@ async function deployDocker(options) {
 	await buildImage(imageRef, buildArgs, credentials, docker);
 	let digest;
 	if (!skipPush) {
-		if (!config.registry) logger$2.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		if (!config.registry) logger$1.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
 		else {
 			await pushImage(imageRef, docker);
 			digest = await pushedDigest(imageRef, docker);
 		}
 	}
-	logger$2.log("\n✅ Docker deployment ready!");
-	logger$2.log(`\n📋 Deployment details:`);
-	logger$2.log(`   Image: ${imageRef}`);
-	logger$2.log(`   Stage: ${stage}`);
-	if (masterKey) logger$2.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${require_sniffer.keyFingerprint(masterKey)}.`);
+	logger$1.log("\n✅ Docker deployment ready!");
+	logger$1.log(`\n📋 Deployment details:`);
+	logger$1.log(`   Image: ${imageRef}`);
+	logger$1.log(`   Stage: ${stage}`);
+	if (masterKey) logger$1.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${require_sniffer.keyFingerprint(masterKey)}.`);
 	return {
 		imageRef,
 		...digest ? { digest } : {},
@@ -1531,10 +1338,10 @@ function generateSecret() {
 * Otherwise generates a new one and stores it.
 */
 function getOrGenerateSecret(state, appName, secretName) {
-	const existing = getGeneratedSecret(state, appName, secretName);
+	const existing = require_sniffer.getGeneratedSecret(state, appName, secretName);
 	if (existing) return existing;
 	const generated = generateSecret();
-	setGeneratedSecret(state, appName, secretName, generated);
+	require_sniffer.setGeneratedSecret(state, appName, secretName, generated);
 	return generated;
 }
 /**
@@ -1597,57 +1404,6 @@ function validateEnvVars(requiredVars, context) {
 	};
 }
 //#endregion
-//#region src/deploy/generated.ts
-/**
-* The values a deployed stage generates once and keeps: what nothing can
-* provision and nobody else issues.
-*
-* - **A seed**, which salts every password a deploy derives — a database's
-*   master and roles, a bucket's root user. Derived from repo facts alone
-*   (project, stage, construct id), those passwords were computable by anyone
-*   who could read the repo.
-* - **Each `secret` construct's value** — an auth server's signing secret —
-*   random, rather than derived.
-* - **Each `encryption` construct's keyring** — one random key and an index
-*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
-*
-* Both are generated on the first deploy that needs them and written to the
-* stage's store, so every later deploy reads the same values: sessions survive
-* a redeploy, and a role's password does not move. A value set by hand with
-* `gkm secrets:set` is kept, never replaced.
-*/
-/**
-* The stage's secrets with its seed and every declared `secret`'s value
-* present, generating what is missing. Pure: the caller writes the result
-* back to the stage's store when `generated` is not empty.
-*/
-function withGeneratedSecrets(secrets, manifest) {
-	const generated = [];
-	const custom = { ...secrets.custom };
-	for (const declaration of Object.values(manifest)) {
-		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
-		const key = declaration.provides?.[0];
-		if (!key || custom[key]) continue;
-		custom[key] = declaration.kind === "encryption" ? (0, _geekmidas_constructs_encryption.generateKeyring)() : random();
-		generated.push(key);
-	}
-	const seed = secrets.seed ?? random();
-	if (!secrets.seed) generated.push("seed");
-	return {
-		secrets: generated.length ? {
-			...secrets,
-			seed,
-			custom,
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		} : secrets,
-		generated
-	};
-}
-/** 256 bits, URL-safe. */
-function random() {
-	return (0, node_crypto.randomBytes)(32).toString("base64url");
-}
-//#endregion
 //#region src/deploy/journal.ts
 var DeployJournal = class DeployJournal {
 	store;
@@ -2065,83 +1821,6 @@ function generateSecretsReport(encryptedApps, sniffedApps) {
 	};
 }
 //#endregion
-//#region src/deploy/terminal.ts
-/**
-* The credentials `gkm deploy` can ask a person for. CLI layer only.
-*
-* `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`
-* when the answer is nothing. At a terminal, `gkm deploy` would rather ask:
-* this provider reads the environment and the stored login first, and only
-* when both are empty prompts — and stores a Dokploy login it validated, so
-* the next deploy does not ask again. With no terminal it answers nothing, and
-* the deploy says what was missing instead of waiting on a prompt nobody sees.
-*/
-const logger$1 = require_discover.output;
-/** What answers a deploy prompt without a terminal. */
-const INSTEAD = "Please configure manually.";
-/** The Dokploy URL typed at the prompt is not a URL. */
-var DokployEndpointInvalid = class extends Error {
-	endpoint;
-	constructor(endpoint) {
-		super("Invalid URL format");
-		this.endpoint = endpoint;
-		this.name = "DokployEndpointInvalid";
-	}
-};
-/** Dokploy refused the token typed at the prompt; nothing was stored. */
-var DokployTokenRejected = class extends Error {
-	endpoint;
-	constructor(endpoint) {
-		super("Invalid credentials. Please check your token.");
-		this.endpoint = endpoint;
-		this.name = "DokployTokenRejected";
-	}
-};
-/** Asks the person at the terminal for what nothing else supplied. */
-function asking() {
-	return { async get(asked) {
-		if (!require_sniffer.canPrompt()) return void 0;
-		const request = asked;
-		if (request.kind === "dokploy") {
-			logger$1.log("\n📋 Dokploy credentials not found. Let's set them up.");
-			const endpoint = (await require_sniffer.prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: INSTEAD })).replace(/\/$/, "");
-			try {
-				new URL(endpoint);
-			} catch {
-				throw new DokployEndpointInvalid(endpoint);
-			}
-			logger$1.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
-			const token = await require_sniffer.prompt("API Token: ", {
-				hidden: true,
-				instead: INSTEAD
-			});
-			logger$1.log("\nValidating credentials...");
-			if (!await require_sniffer.validateDokployToken(endpoint, token)) throw new DokployTokenRejected(endpoint);
-			await require_sniffer.storeDokployCredentials(token, endpoint);
-			logger$1.log("✓ Credentials saved");
-			return {
-				endpoint,
-				token
-			};
-		}
-		logger$1.log(`   Dokploy has no registry for ${request.url}. Let's create one.`);
-		return {
-			username: await require_sniffer.prompt("Registry username: ", { instead: INSTEAD }),
-			password: await require_sniffer.prompt("Registry password/token: ", {
-				hidden: true,
-				instead: INSTEAD
-			})
-		};
-	} };
-}
-/**
-* The environment, then the stored login, then — at a terminal — the person
-* running the command.
-*/
-function terminalCredentials(base = storedCredentials()) {
-	return chainCredentials(base, asking());
-}
-//#endregion
 //#region src/deploy/index.ts
 /**
 * Deploy Module
@@ -2342,22 +2021,6 @@ function getServerHostname(endpoint) {
 	return new URL(endpoint).hostname;
 }
 /**
-* Generate image tag from stage and timestamp
-*/
-function generateTag(stage) {
-	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
-}
-/**
-* The things this deploy creates a container for.
-*
-* A deploy unit is a *declaration*, not a config entry — and since that is now
-* true of every app, not just the ones being deployed, this is the workspace's
-* own derivation under the name the deploy phases call it by.
-*/
-function deployUnits(manifest, workspace) {
-	return require_config.derivedApps(manifest, workspace);
-}
-/**
 * The variables an app cannot start without.
 *
 * The sniffer reports every key it saw in `requiredEnvVars` and says which of
@@ -2375,26 +2038,6 @@ function requiredOf(requirements) {
 	const optional = new Set(requirements.optionalEnvVars);
 	return requirements.requiredEnvVars.map((name) => name.endsWith("?") ? name.slice(0, -1) : name).filter((name) => !optional.has(name));
 }
-/** Apps were asked for by name that the workspace does not have. */
-var UnknownDeployApps = class extends Error {
-	apps;
-	available;
-	constructor(apps, available) {
-		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
-		this.apps = apps;
-		this.available = available;
-		this.name = "UnknownDeployApps";
-	}
-};
-/** Every app asked for deploys somewhere other than Dokploy. */
-var NoDeployableApps = class extends Error {
-	stage;
-	constructor(stage) {
-		super("No apps to deploy. All selected apps have unsupported deploy targets.");
-		this.stage = stage;
-		this.name = "NoDeployableApps";
-	}
-};
 /** A backend failed, so the run stopped before deploying anything after it. */
 var BackendDeployFailed = class extends Error {
 	app;
@@ -2417,23 +2060,24 @@ var MissingEnvVars = class extends Error {
 		this.name = "MissingEnvVars";
 	}
 };
-/** Workspace deploys go to Dokploy; another provider was asked for. */
-var DeployProviderUnsupported = class extends Error {
-	provider;
-	constructor(provider) {
-		super(`Workspace deployment only supports Dokploy. Got: ${provider}`);
-		this.provider = provider;
-		this.name = "DeployProviderUnsupported";
-	}
-};
 /** How `resolveProject` found a project, in the journal's words. */
 const PROJECT_VIA = {
 	state: "recorded",
 	marker: "found",
 	created: "created"
 };
+/** `childOutput` as `spawn` reads it, where it is not the default. */
+const CHILD_STDIO = {
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
 /**
-* Deploy every app in a workspace to Dokploy.
+* Deploy every app in a workspace to Dokploy: the engine under the built-in
+* `dokploy` target.
 *
 * Two-phase orchestration:
 * - PHASE 1: Deploy backend apps (with encrypted secrets)
@@ -2444,119 +2088,60 @@ const PROJECT_VIA = {
 * - Only GKM_MASTER_KEY is injected as Dokploy env var
 * - Frontend apps get public URLs baked in at build time (no secrets)
 *
-* The engine under `deploy()` and `gkm deploy`. It never prompts and never
-* exits: credentials come from `ctx.credentials`, progress goes to
-* `ctx.emit` and to `output`, and every failure is thrown.
+* The run around it — the target, the apps, the lock, the phase events — is
+* `runDeploy`'s. This says what it is doing and checks what Dokploy needs.
 *
 * @internal
 */
-async function runDeploy(source, request, ctx) {
-	const { stage, tag, apps: selectedApps } = request;
-	ctx.emit({
-		type: "phase.started",
-		phase: "validate"
-	});
-	const configured = typeof source === "function" ? await source() : source;
-	const manifest = await require_discover.discover({
-		patterns: require_sniffer.constructGlobs(configured),
-		cwd: configured.root
-	});
-	const units = deployUnits(manifest, configured);
-	const workspace = Object.keys(units).length > 0 ? {
-		...configured,
-		apps: units
-	} : configured;
-	const identity = require_store.deployIdentity(workspace, stage);
+async function validateDokploy(phase) {
+	const { workspace, stage, identity, tag: imageTag } = phase;
+	const ctx = {
+		emit: phase.emit,
+		credentials: phase.credentials,
+		signal: phase.signal,
+		dryRun: phase.dryRun,
+		...phase.childOutput !== "inherit" ? { stdio: CHILD_STDIO[phase.childOutput] } : {}
+	};
 	logger.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
 	logger.log(`   Stage: ${stage}`);
-	const imageTag = tag ?? generateTag(stage);
 	logger.log(`   Tag: ${imageTag}`);
-	const buildOrder = require_workspace.getAppBuildOrder(workspace);
-	let appsToDeployNames = buildOrder;
-	if (selectedApps && selectedApps.length > 0) {
-		const invalidApps = selectedApps.filter((name) => !workspace.apps[name]);
-		if (invalidApps.length > 0) throw new UnknownDeployApps(invalidApps, Object.keys(workspace.apps));
-		appsToDeployNames = buildOrder.filter((name) => selectedApps.includes(name));
-		logger.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
-	} else logger.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
-	const skipped = [];
-	const skip = (app, reason) => {
-		skipped.push({
-			app,
-			reason
-		});
-		ctx.emit({
-			type: "app.skipped",
-			app,
-			reason
-		});
-	};
-	const dokployApps = appsToDeployNames.filter((name) => {
-		const target = workspace.apps[name].resolvedDeployTarget;
-		if (target === "sst") {
-			const reason = `it deploys with SST — run \`gkm build && sst deploy --stage ${stage}\``;
-			logger.log(`   ⚠️  Skipping ${name}: ${reason}`);
-			skip(name, reason);
-			return false;
-		}
-		if (!require_workspace.isDeployTargetSupported(target)) {
-			const reason = require_workspace.getDeployTargetError(target, name);
-			logger.log(`   ⚠️  Skipping ${name}: ${reason}`);
-			skip(name, reason);
-			return false;
-		}
-		return true;
-	});
-	if (dokployApps.length === 0) throw new NoDeployableApps(stage);
-	appsToDeployNames = dokployApps;
-	for (const name of appsToDeployNames) if (workspace.apps[name].type === "mobile") skip(name, MOBILE_SKIP_REASON);
-	ctx.emit({
-		type: "deploy.started",
-		stage,
-		identity: identity.key,
-		tag: imageTag,
-		apps: appsToDeployNames.filter((name) => workspace.apps[name].type !== "mobile"),
-		dryRun: ctx.dryRun
-	});
-	const store = await require_sniffer.createStateStore({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
+	const askedFor = /* @__PURE__ */ new Set([...phase.apps, ...phase.skipped.map((skipped) => skipped.app)]);
+	const asked = require_workspace.getAppBuildOrder(workspace).filter((name) => askedFor.has(name));
+	logger.log(asked.length === Object.keys(workspace.apps).length ? `   Deploying all apps: ${asked.join(", ")}` : `   Deploying apps: ${asked.join(", ")}`);
+	for (const { app, reason } of phase.skipped) logger.log(`   ⚠️  Skipping ${app}: ${reason}`);
+	const appsToDeployNames = [...phase.apps];
+	for (const name of appsToDeployNames) if (workspace.apps[name].type === "mobile") phase.skip(name, MOBILE_SKIP_REASON);
 	const run = {
 		workspace,
-		manifest,
+		manifest: phase.manifest,
 		stage,
 		imageTag,
 		appsToDeployNames,
 		identity,
-		store,
-		skipped,
+		store: phase.state,
+		skipped: phase.skipped,
+		secrets: phase.secrets,
 		ctx
 	};
-	if (ctx.dryRun) return planDeploy(run);
-	const lock = await store.lock(stage, { operation: "deploy" });
-	try {
-		return await deployLocked(run);
-	} finally {
-		await lock.release();
-	}
+	return {
+		...run,
+		preflight: await preflight(run)
+	};
 }
 /**
 * The stage's secrets and every app's environment requirements. A dry run
 * reads the secrets and generates nothing into the store.
 */
-async function preflight({ workspace, manifest, stage, ctx }) {
+async function preflight({ workspace, manifest, stage, secrets: secretsStore, ctx }) {
 	logger.log("\n🔐 Loading secrets and analyzing environment requirements...");
-	const secretsStore = await require_store.secretsStoreFor(workspace, stage, { ...ctx.home ? { home: ctx.home } : {} });
-	const stored = await secretsStore.read(stage);
+	const stored = await secretsStore.read();
 	if (!stored) logger.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
-	const { secrets: stageSecrets, generated } = withGeneratedSecrets(stored ?? require_storage.initStageSecrets(stage), manifest);
+	const { secrets: stageSecrets, generated } = require_sniffer.withGeneratedSecrets(stored ?? require_storage.initStageSecrets(stage), manifest);
 	if (generated.length > 0) {
-		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
+		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.store}): ${generated.join(", ")}`);
 		else {
-			await secretsStore.write(stage, stageSecrets);
-			logger.log(`   🔑 Generated for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
+			await secretsStore.write(stageSecrets);
+			logger.log(`   🔑 Generated for "${stage}" (${secretsStore.store}): ${generated.join(", ")}`);
 		}
 	}
 	const sniffedApps = await require_sniffer.sniffAllApps(workspace.apps, workspace.root);
@@ -2572,14 +2157,14 @@ async function preflight({ workspace, manifest, stage, ctx }) {
 		encryptedSecrets
 	};
 }
-/** Everything a deploy does while it holds the stage's lock. */
-async function deployLocked(run) {
-	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity, store, ctx } = run;
-	const { stageSecrets, sniffedApps, encryptedSecrets } = await preflight(run);
-	ctx.emit({
-		type: "phase.finished",
-		phase: "validate"
-	});
+/**
+* The project, environment and registry, then what the manifest declares.
+* Each is looked up — by the id the stage's state recorded, else by name —
+* before it is created, so a run stopped part way is finished by the next.
+*/
+async function provisionDokploy(run) {
+	const { workspace, manifest, stage, appsToDeployNames, identity, store, ctx } = run;
+	const { stageSecrets } = run.preflight;
 	const changes = [];
 	const applied = (change, via) => {
 		changes.push(change);
@@ -2589,14 +2174,9 @@ async function deployLocked(run) {
 			via
 		});
 	};
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "provision"
-	});
 	const { api, endpoint } = await dokployApi(workspace, ctx);
 	logger.log("\n📋 Loading deploy state...");
-	const journal = await DeployJournal.open(store, stage, () => createEmptyState(stage, "", ""));
+	const journal = await DeployJournal.open(store, stage, () => require_sniffer.createEmptyState(stage, "", ""));
 	const state = journal.state;
 	if (journal.existed) logger.log(`   Found existing state for stage "${stage}"`);
 	else logger.log(`   Creating new state for stage "${stage}"`);
@@ -2665,7 +2245,7 @@ async function deployLocked(run) {
 				kind: "registry",
 				url
 			}, { signal: ctx.signal });
-			if (!login) throw new MissingCredential("registry", url);
+			if (!login) throw new require_terminal.MissingCredential("registry", url);
 			const created = await api.createRegistry("Default Registry", url, login.username, login.password);
 			registryCreated = true;
 			logger.log(`   ✓ Registry created: ${created.registryId}`);
@@ -2728,15 +2308,15 @@ async function deployLocked(run) {
 			projectName: identity.scope,
 			stage,
 			config: workspace.deploy.backups,
-			existingState: getBackupState(state),
+			existingState: require_sniffer.getBackupState(state),
 			logger
 		});
-		setBackupState(state, backupState);
+		require_sniffer.setBackupState(state, backupState);
 		if (!backupState.postgresBackupId) {
 			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
 			const backupRetention = workspace.deploy.backups.retention ?? 30;
 			logger.log("   Creating postgres backup schedule...");
-			setPostgresBackupId(state, (await api.createPostgresBackup({
+			const backup = await api.createPostgresBackup({
 				schedule: backupSchedule,
 				prefix: `${stage}/postgres`,
 				destinationId: backupState.destinationId,
@@ -2744,14 +2324,39 @@ async function deployLocked(run) {
 				postgresId: backupCluster.postgresId,
 				enabled: true,
 				keepLatestCount: backupRetention
-			})).backupId);
+			});
+			require_sniffer.setPostgresBackupId(state, backup.backupId);
 			logger.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
 		} else logger.log("   ✓ Using existing postgres backup schedule");
 	}
-	ctx.emit({
-		type: "phase.finished",
-		phase: "provision"
-	});
+	run.provisioned = {
+		api,
+		endpoint,
+		journal,
+		state,
+		projectId: project.projectId,
+		environmentId,
+		registry,
+		registryId,
+		declaredEnv,
+		changes,
+		applied
+	};
+}
+/**
+* Each app's image built and pushed, its application configured and
+* deployed, and its domain attached: backends first, each failure stopping
+* the run; then sites, whose build args are the backends' public URLs.
+*
+* Building is here rather than in a `build` phase of its own because an
+* image is built beside its application — a site's build args are resolved
+* per app, against the backends released before it.
+*/
+async function releaseDokploy(run) {
+	const { workspace, stage, imageTag, appsToDeployNames, identity, ctx } = run;
+	const { stageSecrets, sniffedApps, encryptedSecrets } = run.preflight;
+	const { api, journal, state, environmentId, registry, registryId, declaredEnv, changes, applied } = run.provisioned;
+	const project = { projectId: run.provisioned.projectId };
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
 	const publicUrls = {};
@@ -2787,12 +2392,12 @@ async function deployLocked(run) {
 		ctx.emit({
 			type: "app.failed",
 			app: appName,
-			error: eventError(error)
+			error: require_terminal.eventError(error)
 		});
 	};
 	/** An image is pushed: worth keeping even if what follows fails. */
 	const built = async (appName, image, ref) => {
-		setDeployedImage(state, appName, {
+		require_sniffer.setDeployedImage(state, appName, {
 			ref: image.imageRef ?? ref,
 			...image.digest ? { digest: image.digest } : {}
 		});
@@ -2812,11 +2417,6 @@ async function deployLocked(run) {
 	};
 	const frontendUrls = [];
 	for (const appName of frontendApps) frontendUrls.push(`https://${hostOf(workspace, appName, stage)}`);
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "release"
-	});
 	if (backendApps.length > 0) {
 		logger.log("\n📦 PHASE 1: Deploying backend applications...");
 		for (const appName of backendApps) {
@@ -2982,15 +2582,17 @@ async function deployLocked(run) {
 	logger.log("\n📋 Saving deploy state...");
 	await journal.save();
 	logger.log("   ✓ State saved");
-	ctx.emit({
-		type: "phase.finished",
-		phase: "release"
-	});
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "verify"
-	});
+	run.released = {
+		results,
+		publicUrls,
+		appHostnames
+	};
+}
+/** DNS records for each released app, and Dokploy's validation of each domain. */
+async function verifyDokploy(run) {
+	const { workspace } = run;
+	const { api, endpoint, journal, state } = run.provisioned;
+	const { appHostnames } = run.released;
 	const dnsConfig = workspace.deploy.dns;
 	if (dnsConfig && appHostnames.size > 0) {
 		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
@@ -3010,10 +2612,14 @@ async function deployLocked(run) {
 			}
 		}
 	}
-	ctx.emit({
-		type: "phase.finished",
-		phase: "verify"
-	});
+}
+/** What the run did, printed as the summary it always ended with. */
+function dokployResult(run) {
+	if (run.result) return run.result;
+	const { stage, identity, imageTag } = run;
+	const { projectId, environmentId, changes } = run.provisioned;
+	const { results, publicUrls } = run.released;
+	const project = { projectId };
 	const successCount = results.filter((r) => r.success).length;
 	const failedCount = results.filter((r) => !r.success).length;
 	logger.log(`\n${"─".repeat(50)}`);
@@ -3035,7 +2641,7 @@ async function deployLocked(run) {
 		identity: identity.key,
 		tag: imageTag,
 		dryRun: false,
-		skipped: run.skipped,
+		skipped: [...run.skipped],
 		urls: publicUrls,
 		changes
 	};
@@ -3071,7 +2677,7 @@ async function ensureApplication(api, journal, appName, dokployAppName, projectI
 		action: via === "created" ? "create" : "reuse",
 		id: resource.applicationId
 	}, via);
-	setApplicationId(journal.state, appName, resource.applicationId);
+	require_sniffer.setApplicationId(journal.state, appName, resource.applicationId);
 	return resource;
 }
 /**
@@ -3136,7 +2742,7 @@ async function dokployApi(workspace, ctx) {
 		kind: "dokploy",
 		...configured ? { endpoint: configured } : {}
 	}, { signal: ctx.signal });
-	if (!creds) throw new MissingCredential("dokploy", configured);
+	if (!creds) throw new require_terminal.MissingCredential("dokploy", configured);
 	return {
 		api: new require_sniffer.DokployApi({
 			baseUrl: creds.endpoint,
@@ -3156,19 +2762,9 @@ function hostOf(workspace, appName, stage) {
 * else: no lock, no state written, no secret generated, no Dokploy resource
 * created or changed, no image built or pushed.
 */
-async function planDeploy(run) {
+async function planDokploy(run) {
 	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity } = run;
 	const { ctx } = run;
-	await preflight(run);
-	ctx.emit({
-		type: "phase.finished",
-		phase: "validate"
-	});
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "plan"
-	});
 	logger.log("\n🔎 Dry run: nothing will be created, changed, built or pushed.");
 	const changes = [];
 	const plan = (change, detail) => {
@@ -3283,11 +2879,7 @@ async function planDeploy(run) {
 	}
 	const creates = changes.filter((c) => c.action !== "reuse").length;
 	logger.log(`\n✅ Dry run complete: ${creates} to create or build, ${changes.length - creates} to reuse.`);
-	ctx.emit({
-		type: "phase.finished",
-		phase: "plan"
-	});
-	return {
+	run.result = {
 		apps,
 		projectId: project?.projectId ?? "",
 		environmentId: environment?.environmentId ?? "",
@@ -3297,7 +2889,7 @@ async function planDeploy(run) {
 		identity: identity.key,
 		tag: imageTag,
 		dryRun: true,
-		skipped: run.skipped,
+		skipped: [...run.skipped],
 		urls,
 		changes
 	};
@@ -3305,161 +2897,18 @@ async function planDeploy(run) {
 /** Why a mobile app is left out of a Dokploy deploy. */
 const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
-//#region src/deploy/deploy.ts
-/**
-* `deploy()`: a deploy as a library call.
-*
-* `gkm deploy` could only be driven from an interactive terminal: it prompted
-* for what it lacked and exited the process on failure, worked out of
-* `process.cwd()`, and reported progress by printing. Here the caller says
-* where the project is, hands over the credentials and a signal, and gets back
-* a run — events to iterate while it goes, and a structured result at the end.
-* Nothing below this asks a person anything or ends the process; `gkm deploy`
-* is a thin wrapper that does both.
-*/
-/**
-* Every event a run emits, kept so that each iteration — however late it
-* starts — sees the run from its first event to its last.
-*/
-var EventLog = class {
-	events = [];
-	closed = false;
-	waiting = [];
-	push(event) {
-		this.events.push(event);
-		this.wake();
-	}
-	close() {
-		this.closed = true;
-		this.wake();
-	}
-	wake() {
-		const waiting = this.waiting;
-		this.waiting = [];
-		for (const resume of waiting) resume();
-	}
-	async *iterate() {
-		let next = 0;
-		while (true) if (next < this.events.length) yield this.events[next++];
-		else if (this.closed) return;
-		else await new Promise((resume) => this.waiting.push(resume));
-	}
-};
-/** `childOutput` as `spawn` reads it, where it is not the default. */
-const CHILD_STDIO = {
-	stderr: [
-		"ignore",
-		2,
-		2
-	],
-	ignore: "ignore"
-};
-function forward(logger, level, message) {
-	if (!logger) return;
-	if (level === "info") logger.info(message);
-	else if (level === "error" && logger.error) logger.error(message);
-	else logger.warn(message);
-}
-/**
-* Deploy a project's stage.
-*
-* ```ts
-* import { deploy } from '@geekmidas/cli/deploy';
-*
-* const run = deploy({ cwd: '/srv/checkouts/shop', stage: 'production' });
-* for await (const event of run) {
-*   if (event.type === 'app.deployed') console.log(event.app, event.url);
-* }
-* const result = await run.result;
-* ```
-*
-* The run starts at once; iterating it is optional, and an iteration started
-* late still sees every event from the first.
-*/
-function deploy(input) {
-	const log = new EventLog();
-	const emit = (event) => {
-		log.push(event);
-		if (event.type === "log") forward(input.logger, event.level, event.message);
-	};
-	const ctx = {
-		emit,
-		credentials: input.credentials ?? storedCredentials({ home: input.home ?? require_home.gkmHome() }),
-		dryRun: input.dryRun ?? false,
-		home: input.home ?? require_home.gkmHome(),
-		...input.signal ? { signal: input.signal } : {},
-		...input.childOutput && input.childOutput !== "inherit" ? { stdio: CHILD_STDIO[input.childOutput] } : {}
-	};
-	const result = require_discover.withOutput((level, message) => emit({
-		type: "log",
-		level,
-		message
-	}), async () => {
-		try {
-			input.signal?.throwIfAborted();
-			const deployed = await runDeploy(() => load(input), {
-				stage: input.stage,
-				...input.tag ? { tag: input.tag } : {},
-				...input.apps ? { apps: input.apps } : {}
-			}, ctx);
-			emit({
-				type: "deploy.finished",
-				result: deployed
-			});
-			return deployed;
-		} catch (error) {
-			emit({
-				type: "deploy.failed",
-				error: eventError(error)
-			});
-			throw error;
-		} finally {
-			log.close();
-		}
-	});
-	result.catch(() => {});
-	return {
-		result,
-		[Symbol.asyncIterator]: () => log.iterate()
-	};
-}
-/** The workspace at `input.cwd`, refusing a stage it does not deploy. */
-async function load(input) {
-	const { workspace } = await require_config.loadWorkspaceConfig((0, node_path.resolve)(input.cwd));
-	require_workspace.assertDeployedStage(workspace.stages, input.stage);
-	return workspace;
-}
-//#endregion
 Object.defineProperty(exports, "BackendDeployFailed", {
 	enumerable: true,
 	get: function() {
 		return BackendDeployFailed;
 	}
 });
-Object.defineProperty(exports, "DeployProviderUnsupported", {
-	enumerable: true,
-	get: function() {
-		return DeployProviderUnsupported;
-	}
-});
-Object.defineProperty(exports, "MissingCredential", {
-	enumerable: true,
-	get: function() {
-		return MissingCredential;
-	}
-});
 Object.defineProperty(exports, "MissingEnvVars", {
 	enumerable: true,
 	get: function() {
 		return MissingEnvVars;
 	}
 });
-Object.defineProperty(exports, "NoDeployableApps", {
-	enumerable: true,
-	get: function() {
-		return NoDeployableApps;
-	}
-});
 Object.defineProperty(exports, "ProjectNotOwned", {
 	enumerable: true,
 	get: function() {
@@ -3484,35 +2933,41 @@ Object.defineProperty(exports, "RegistryNotFound", {
 		return RegistryNotFound;
 	}
 });
-Object.defineProperty(exports, "UnknownDeployApps", {
+Object.defineProperty(exports, "dokployResult", {
+	enumerable: true,
+	get: function() {
+		return dokployResult;
+	}
+});
+Object.defineProperty(exports, "planDokploy", {
 	enumerable: true,
 	get: function() {
-		return UnknownDeployApps;
+		return planDokploy;
 	}
 });
-Object.defineProperty(exports, "chainCredentials", {
+Object.defineProperty(exports, "provisionDokploy", {
 	enumerable: true,
 	get: function() {
-		return chainCredentials;
+		return provisionDokploy;
 	}
 });
-Object.defineProperty(exports, "deploy", {
+Object.defineProperty(exports, "releaseDokploy", {
 	enumerable: true,
 	get: function() {
-		return deploy;
+		return releaseDokploy;
 	}
 });
-Object.defineProperty(exports, "storedCredentials", {
+Object.defineProperty(exports, "validateDokploy", {
 	enumerable: true,
 	get: function() {
-		return storedCredentials;
+		return validateDokploy;
 	}
 });
-Object.defineProperty(exports, "terminalCredentials", {
+Object.defineProperty(exports, "verifyDokploy", {
 	enumerable: true,
 	get: function() {
-		return terminalCredentials;
+		return verifyDokploy;
 	}
 });
 
-//# sourceMappingURL=deploy-0fBVeWO-.cjs.map
+//# sourceMappingURL=deploy-DSaCYvcO.cjs.map