@geekmidas/cli 10.0.0-alpha.60 → 10.0.0-alpha.62

package/dist/{deploy-D6Q09OkA.mjs → deploy-B7jvUORo.mjs}

@@ -1,110 +1,19 @@
-import { B as providerOf, C as run, D as constructGlobs, L as resourceName, N as applyPostgres, R as cacheBackendFor, S as keyFingerprint, V as storageBackendFor, a as dockerCommand, b as encryptSecrets, c as resolveHost, ct as storeDokployCredentials, f as StateStoreBusy, g as createStateStore, i as DockerPushFailed, lt as canPrompt, m as StateVersionConflict, o as validateImageRef, r as DockerBuildFailed, s as isMainFrontendApp, st as readCredentials, t as sniffAllApps, tt as validateDokployToken, ut as prompt, v as DokployApi, w as runOutput, y as DokployApiError, z as eventsBackendFor } from "./sniffer-BM8fpCas.mjs";
-import { n as gkmHome } from "./home-GI7pJl1M.mjs";
-import { a as output, o as withOutput, t as discover } from "./discover-FrYvzkeC.mjs";
-import { f as appKey, l as loadWorkspaceConfig, p as derivedApps } from "./config-C5-EEdmr.mjs";
-import { D as assertDeployedStage, a as getAppBuildOrder, b as getDeployTargetError, m as stripPublicPrefix, p as getPublicEnvPrefix, x as isDeployTargetSupported } from "./workspace-Bp1xVaOz.mjs";
+import { A as StateStoreBusy, B as run, C as setDnsRecord, E as setPostgresBackupId, I as withGeneratedSecrets, L as encryptSecrets, M as StateVersionConflict, S as setDeployedImage, T as setGeneratedSecret, V as runOutput, W as constructGlobs, X as applyPostgres, _ as getBackupState, a as DockerBuildFailed, b as setApplicationId, c as dockerCommand, dt as providerOf, ft as storageBackendFor, g as createEmptyState, h as resolveHost, i as DokployApiError, lt as cacheBackendFor, m as isMainFrontendApp, o as DockerPushFailed, p as validateImageRef, r as DokployApi, st as resourceName, t as sniffAllApps, ut as eventsBackendFor, v as getGeneratedSecret, w as setDnsVerification, x as setBackupState, y as isDnsVerified, z as keyFingerprint } from "./sniffer-DHE2Nafd.mjs";
+import { a as output, t as discover } from "./discover-FrYvzkeC.mjs";
+import { f as appKey } from "./config-Bf4-bROQ.mjs";
+import { a as getAppBuildOrder, m as stripPublicPrefix, p as getPublicEnvPrefix } from "./workspace-BFe57es7.mjs";
 import { i as toEmbeddableSecrets, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
-import { d as imageName, f as imageRef, g as projectName, h as ownershipMarker, l as applicationName, m as markerOf, n as secretsStoreFor, p as isOwnedBy, u as deployIdentity } from "./store-BS8A7NcA.mjs";
+import { d as imageName, f as imageRef, g as projectName, h as ownershipMarker, l as applicationName, m as markerOf, p as isOwnedBy } from "./store-BS8A7NcA.mjs";
+import { c as MissingCredential, o as eventError } from "./terminal-ByZNjuig.mjs";
 import { join, resolve } from "node:path";
 import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
 import { createHash, randomBytes } from "node:crypto";
-import { generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import { lookup } from "node:dns/promises";
-//#region src/deploy/credentials.ts
-/**
-* How a deploy gets the credentials it acts with.
-*
-* `deploy()` never prompts and never reads a terminal: it asks a
-* `CredentialProvider` and, when the provider has nothing, stops with
-* `MissingCredential` naming what it needed and how to supply it. Whether to
-* ask a person, read a vault or fail is the caller's decision — `gkm deploy`
-* prompts at a terminal and stores what was typed; a CI job sets the
-* environment; a host passes its own provider.
-*/
-/** How to supply each kind, for the error that says it is missing. */
-const HOW_TO_PROVIDE = {
-	dokploy: "Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.",
-	registry: "Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them."
-};
-/** A deploy needed a credential, and its provider had none. */
-var MissingCredential = class extends Error {
-	kind;
-	target;
-	howToProvide;
-	constructor(kind, target, howToProvide = HOW_TO_PROVIDE[kind]) {
-		const what = kind === "dokploy" ? `No Dokploy credentials${target ? ` for ${target}` : ""}.` : `Dokploy has no registry for ${target ?? "the configured registry"}, and there are no credentials to create one with.`;
-		super(`${what} ${howToProvide}`);
-		this.kind = kind;
-		this.target = target;
-		this.howToProvide = howToProvide;
-		this.name = "MissingCredential";
-	}
-};
-/** Whatever was asked for, from the first provider that has it. */
-function chainCredentials(...providers) {
-	return { async get(request, options) {
-		for (const provider of providers) {
-			const found = await provider.get(request, options);
-			if (found) return found;
-		}
-	} };
-}
-/**
-* Credentials from the environment, then from what `gkm login` stored. What
-* `deploy()` uses when it is handed no provider.
-*
-* - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
-*   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
-*   Each half is read on its own: a token is a secret and belongs in the
-*   environment, an endpoint is configuration and belongs in the config.
-* - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
-*/
-function storedCredentials(options = {}) {
-	const env = options.env ?? process.env;
-	return { async get(asked) {
-		const request = asked;
-		switch (request.kind) {
-			case "dokploy": {
-				const stored = (await readCredentials(options.home ? { home: options.home } : void 0)).dokploy;
-				const token = env.DOKPLOY_API_TOKEN ?? stored?.token;
-				const endpoint = env.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;
-				if (!token || !endpoint) return void 0;
-				return {
-					endpoint: endpoint.replace(/\/$/, ""),
-					token
-				};
-			}
-			case "registry": {
-				const username = env.DOCKER_REGISTRY_USERNAME;
-				const password = env.DOCKER_REGISTRY_PASSWORD;
-				if (!username || !password) return void 0;
-				return {
-					username,
-					password
-				};
-			}
-		}
-	} };
-}
-//#endregion
-//#region src/deploy/events.ts
-/** An error as an event carries it: its name and message, nothing else. */
-function eventError(error) {
-	if (error instanceof Error) return {
-		name: error.name,
-		message: error.message
-	};
-	return {
-		name: "Error",
-		message: String(error)
-	};
-}
-//#endregion
 //#region src/deploy/fromManifest.ts
 /**
 * The Dokploy target, read off the construct manifest.
@@ -855,102 +764,6 @@ function surfaceAddresses(manifest, appUrls) {
 	return addresses;
 }
 //#endregion
-//#region src/deploy/state.ts
-/**
-* Create a new empty state for a stage
-*/
-function createEmptyState(stage, projectId, environmentId) {
-	return {
-		provider: "dokploy",
-		stage,
-		projectId,
-		environmentId,
-		applications: {},
-		services: {},
-		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Set application ID in state (mutates state)
-*/
-function setApplicationId(state, appName, applicationId) {
-	state.applications[appName] = applicationId;
-}
-/**
-* Record the image an app was deployed with (mutates state)
-*/
-function setDeployedImage(state, appName, image) {
-	state.images = {
-		...state.images,
-		[appName]: image
-	};
-}
-/**
-* Get a generated secret for an app
-*/
-function getGeneratedSecret(state, appName, secretName) {
-	return state?.generatedSecrets?.[appName]?.[secretName];
-}
-/**
-* Set a generated secret for an app (mutates state)
-*/
-function setGeneratedSecret(state, appName, secretName, value) {
-	if (!state.generatedSecrets) state.generatedSecrets = {};
-	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
-	state.generatedSecrets[appName][secretName] = value;
-}
-/**
-* Set DNS verification record for a hostname (mutates state)
-*/
-function setDnsVerification(state, hostname, serverIp) {
-	if (!state.dnsVerified) state.dnsVerified = {};
-	state.dnsVerified[hostname] = {
-		serverIp,
-		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Check if a hostname is already verified with the given IP
-*/
-function isDnsVerified(state, hostname, serverIp) {
-	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
-}
-/**
-* Get the key for a DNS record in state
-*/
-function getDnsRecordKey(name, type) {
-	return `${name}:${type}`;
-}
-/**
-* Set a created DNS record in state (mutates state)
-*/
-function setDnsRecord(state, record) {
-	if (!state.dnsRecords) state.dnsRecords = {};
-	const key = getDnsRecordKey(record.name, record.type);
-	state.dnsRecords[key] = {
-		...record,
-		createdAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Get backup state from state
-*/
-function getBackupState(state) {
-	return state?.backups;
-}
-/**
-* Set backup state (mutates state)
-*/
-function setBackupState(state, backupState) {
-	state.backups = backupState;
-}
-/**
-* Set postgres backup ID in state (mutates state)
-*/
-function setPostgresBackupId(state, backupId) {
-	if (state.backups) state.backups.postgresBackupId = backupId;
-}
-//#endregion
 //#region src/deploy/dns/DnsProvider.ts
 /**
 * Check if value is a DnsProvider implementation.
@@ -972,7 +785,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-DgzKa_Tj.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-B92qH4dC.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -994,7 +807,7 @@ async function createDnsProvider(options) {
 *
 * Handles automatic DNS record creation for deployed applications.
 */
-const logger$3 = output;
+const logger$2 = output;
 /**
 * Check if DNS config is legacy format (single domain with `domain` property)
 */
@@ -1031,7 +844,7 @@ function groupHostnamesByDomain(appHostnames, dnsConfig) {
 	for (const [appName, hostname] of appHostnames) {
 		const rootDomain = findRootDomain(hostname, dnsConfig);
 		if (!rootDomain) {
-			logger$3.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			logger$2.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
 			continue;
 		}
 		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
@@ -1081,10 +894,10 @@ function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
 * Print DNS records table
 */
 function printDnsRecordsTable(records, rootDomain) {
-	logger$3.log(`\n   📋 DNS Records for ${rootDomain}:`);
-	logger$3.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
-	logger$3.log("   │ Subdomain                           │ Type │ Value           │ Status │");
-	logger$3.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	logger$2.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$2.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$2.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$2.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
 	for (const record of records) {
 		const subdomain = record.subdomain.padEnd(35);
 		const type = record.type.padEnd(4);
@@ -1094,18 +907,18 @@ function printDnsRecordsTable(records, rootDomain) {
 		else if (record.created) status = "✓ new";
 		else if (record.existed) status = "✓";
 		else status = "?";
-		logger$3.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
+		logger$2.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
 	}
-	logger$3.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+	logger$2.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
 }
 /**
 * Print DNS records in a simple format for manual setup
 */
 function printDnsRecordsSimple(records, rootDomain) {
-	logger$3.log("\n   📋 Required DNS Records:");
-	logger$3.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
-	for (const record of records) logger$3.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
-	logger$3.log("");
+	logger$2.log("\n   📋 Required DNS Records:");
+	logger$2.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$2.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$2.log("");
 }
 /**
 * Create DNS records for a single domain using its configured provider
@@ -1117,7 +930,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		provider = await createDnsProvider({ config: providerConfig });
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$3.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		logger$2.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			...r,
 			error: message
@@ -1171,7 +984,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		}
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$3.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		logger$2.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			hostname: r.hostname,
 			subdomain: r.subdomain,
@@ -1198,20 +1011,20 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	if (!dnsConfig) return null;
 	const normalizedConfig = normalizeDnsConfig(dnsConfig);
-	logger$3.log("\n🌐 Setting up DNS records...");
+	logger$2.log("\n🌐 Setting up DNS records...");
 	let serverIp;
 	try {
 		const endpointUrl = new URL(dokployEndpoint);
 		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
-		logger$3.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+		logger$2.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$3.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		logger$2.log(`   ⚠ Failed to resolve server IP: ${message}`);
 		return null;
 	}
 	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
 	if (groupedHostnames.size === 0) {
-		logger$3.log("   No DNS records needed (no hostnames match configured domains)");
+		logger$2.log("   No DNS records needed (no hostnames match configured domains)");
 		return {
 			records: [],
 			success: true,
@@ -1223,22 +1036,22 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	for (const [rootDomain, domainHostnames] of groupedHostnames) {
 		const providerConfig = normalizedConfig[rootDomain];
 		if (!providerConfig) {
-			logger$3.log(`   ⚠ No provider config for ${rootDomain}`);
+			logger$2.log(`   ⚠ No provider config for ${rootDomain}`);
 			continue;
 		}
 		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
 		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
 		if (requiredRecords.length === 0) continue;
-		logger$3.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		logger$2.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
 		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
 		allRecords.push(...domainRecords);
 		const created = domainRecords.filter((r) => r.created).length;
 		const existed = domainRecords.filter((r) => r.existed).length;
 		const failed = domainRecords.filter((r) => r.error).length;
-		if (created > 0) logger$3.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
-		if (existed > 0) logger$3.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (created > 0) logger$2.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$2.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
 		if (failed > 0) {
-			logger$3.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			logger$2.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
 			hasFailures = true;
 		}
 		if (state) {
@@ -1275,10 +1088,10 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 */
 async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const results = [];
-	logger$3.log("\n🔍 Verifying DNS records...");
+	logger$2.log("\n🔍 Verifying DNS records...");
 	for (const [appName, hostname] of appHostnames) {
 		if (isDnsVerified(state, hostname, serverIp)) {
-			logger$3.log(`   ✓ ${hostname} (previously verified)`);
+			logger$2.log(`   ✓ ${hostname} (previously verified)`);
 			results.push({
 				hostname,
 				appName,
@@ -1292,7 +1105,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			const resolvedIp = await resolveHostnameToIp(hostname);
 			if (resolvedIp === serverIp) {
 				setDnsVerification(state, hostname, serverIp);
-				logger$3.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				logger$2.log(`   ✓ ${hostname} → ${resolvedIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -1301,7 +1114,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 					expectedIp: serverIp
 				});
 			} else {
-				logger$3.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				logger$2.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -1312,7 +1125,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			}
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$3.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			logger$2.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
 			results.push({
 				hostname,
 				appName,
@@ -1326,14 +1139,14 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const skipped = results.filter((r) => r.skipped).length;
 	const pending = results.filter((r) => !r.verified).length;
 	if (pending > 0) {
-		logger$3.log(`\n   ${verified} verified, ${pending} pending propagation`);
-		logger$3.log("   DNS changes may take 5-30 minutes to propagate");
-	} else if (skipped > 0) logger$3.log(`   ${verified} verified (${skipped} from cache)`);
+		logger$2.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$2.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$2.log(`   ${verified} verified (${skipped} from cache)`);
 	return results;
 }
 //#endregion
 //#region src/deploy/docker.ts
-const logger$2 = output;
+const logger$1 = output;
 /**
 * The id the Dockerfile templates mount the encrypted credentials under:
 * `RUN --mount=type=secret,id=gkm_credentials`.
@@ -1396,8 +1209,8 @@ async function writeCredentialsFile(credentials) {
 * @param credentials - Encrypted credentials, passed as a build secret
 */
 async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio }) {
-	logger$2.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger$2.log("   Generating Dockerfile for the pre-built bundle...");
+	logger$1.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$1.log("   Generating Dockerfile for the pre-built bundle...");
 	await dockerCommand({
 		slim: true,
 		cwd
@@ -1419,7 +1232,7 @@ async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio
 			...signal ? { signal } : {},
 			...stdio ? { stdio } : {}
 		});
-		logger$2.log(`✅ Image built: ${imageRef}`);
+		logger$1.log(`✅ Image built: ${imageRef}`);
 	} catch (error) {
 		throw new DockerBuildFailed(imageRef, error);
 	} finally {
@@ -1430,14 +1243,14 @@ async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio
 * Push Docker image to registry
 */
 async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger$2.log(`\n☁️  Pushing image: ${imageRef}`);
+	logger$1.log(`\n☁️  Pushing image: ${imageRef}`);
 	try {
 		await run("docker", ["push", imageRef], {
 			cwd,
 			...signal ? { signal } : {},
 			...stdio ? { stdio } : {}
 		});
-		logger$2.log(`✅ Image pushed: ${imageRef}`);
+		logger$1.log(`✅ Image pushed: ${imageRef}`);
 	} catch (error) {
 		throw new DockerPushFailed(imageRef, error);
 	}
@@ -1487,17 +1300,17 @@ async function deployDocker(options) {
 	await buildImage(imageRef, buildArgs, credentials, docker);
 	let digest;
 	if (!skipPush) {
-		if (!config.registry) logger$2.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		if (!config.registry) logger$1.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
 		else {
 			await pushImage(imageRef, docker);
 			digest = await pushedDigest(imageRef, docker);
 		}
 	}
-	logger$2.log("\n✅ Docker deployment ready!");
-	logger$2.log(`\n📋 Deployment details:`);
-	logger$2.log(`   Image: ${imageRef}`);
-	logger$2.log(`   Stage: ${stage}`);
-	if (masterKey) logger$2.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
+	logger$1.log("\n✅ Docker deployment ready!");
+	logger$1.log(`\n📋 Deployment details:`);
+	logger$1.log(`   Image: ${imageRef}`);
+	logger$1.log(`   Stage: ${stage}`);
+	if (masterKey) logger$1.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
 	return {
 		imageRef,
 		...digest ? { digest } : {},
@@ -1591,57 +1404,6 @@ function validateEnvVars(requiredVars, context) {
 	};
 }
 //#endregion
-//#region src/deploy/generated.ts
-/**
-* The values a deployed stage generates once and keeps: what nothing can
-* provision and nobody else issues.
-*
-* - **A seed**, which salts every password a deploy derives — a database's
-*   master and roles, a bucket's root user. Derived from repo facts alone
-*   (project, stage, construct id), those passwords were computable by anyone
-*   who could read the repo.
-* - **Each `secret` construct's value** — an auth server's signing secret —
-*   random, rather than derived.
-* - **Each `encryption` construct's keyring** — one random key and an index
-*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
-*
-* Both are generated on the first deploy that needs them and written to the
-* stage's store, so every later deploy reads the same values: sessions survive
-* a redeploy, and a role's password does not move. A value set by hand with
-* `gkm secrets:set` is kept, never replaced.
-*/
-/**
-* The stage's secrets with its seed and every declared `secret`'s value
-* present, generating what is missing. Pure: the caller writes the result
-* back to the stage's store when `generated` is not empty.
-*/
-function withGeneratedSecrets(secrets, manifest) {
-	const generated = [];
-	const custom = { ...secrets.custom };
-	for (const declaration of Object.values(manifest)) {
-		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
-		const key = declaration.provides?.[0];
-		if (!key || custom[key]) continue;
-		custom[key] = declaration.kind === "encryption" ? generateKeyring() : random();
-		generated.push(key);
-	}
-	const seed = secrets.seed ?? random();
-	if (!secrets.seed) generated.push("seed");
-	return {
-		secrets: generated.length ? {
-			...secrets,
-			seed,
-			custom,
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		} : secrets,
-		generated
-	};
-}
-/** 256 bits, URL-safe. */
-function random() {
-	return randomBytes(32).toString("base64url");
-}
-//#endregion
 //#region src/deploy/journal.ts
 var DeployJournal = class DeployJournal {
 	store;
@@ -2059,83 +1821,6 @@ function generateSecretsReport(encryptedApps, sniffedApps) {
 	};
 }
 //#endregion
-//#region src/deploy/terminal.ts
-/**
-* The credentials `gkm deploy` can ask a person for. CLI layer only.
-*
-* `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`
-* when the answer is nothing. At a terminal, `gkm deploy` would rather ask:
-* this provider reads the environment and the stored login first, and only
-* when both are empty prompts — and stores a Dokploy login it validated, so
-* the next deploy does not ask again. With no terminal it answers nothing, and
-* the deploy says what was missing instead of waiting on a prompt nobody sees.
-*/
-const logger$1 = output;
-/** What answers a deploy prompt without a terminal. */
-const INSTEAD = "Please configure manually.";
-/** The Dokploy URL typed at the prompt is not a URL. */
-var DokployEndpointInvalid = class extends Error {
-	endpoint;
-	constructor(endpoint) {
-		super("Invalid URL format");
-		this.endpoint = endpoint;
-		this.name = "DokployEndpointInvalid";
-	}
-};
-/** Dokploy refused the token typed at the prompt; nothing was stored. */
-var DokployTokenRejected = class extends Error {
-	endpoint;
-	constructor(endpoint) {
-		super("Invalid credentials. Please check your token.");
-		this.endpoint = endpoint;
-		this.name = "DokployTokenRejected";
-	}
-};
-/** Asks the person at the terminal for what nothing else supplied. */
-function asking() {
-	return { async get(asked) {
-		if (!canPrompt()) return void 0;
-		const request = asked;
-		if (request.kind === "dokploy") {
-			logger$1.log("\n📋 Dokploy credentials not found. Let's set them up.");
-			const endpoint = (await prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: INSTEAD })).replace(/\/$/, "");
-			try {
-				new URL(endpoint);
-			} catch {
-				throw new DokployEndpointInvalid(endpoint);
-			}
-			logger$1.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
-			const token = await prompt("API Token: ", {
-				hidden: true,
-				instead: INSTEAD
-			});
-			logger$1.log("\nValidating credentials...");
-			if (!await validateDokployToken(endpoint, token)) throw new DokployTokenRejected(endpoint);
-			await storeDokployCredentials(token, endpoint);
-			logger$1.log("✓ Credentials saved");
-			return {
-				endpoint,
-				token
-			};
-		}
-		logger$1.log(`   Dokploy has no registry for ${request.url}. Let's create one.`);
-		return {
-			username: await prompt("Registry username: ", { instead: INSTEAD }),
-			password: await prompt("Registry password/token: ", {
-				hidden: true,
-				instead: INSTEAD
-			})
-		};
-	} };
-}
-/**
-* The environment, then the stored login, then — at a terminal — the person
-* running the command.
-*/
-function terminalCredentials(base = storedCredentials()) {
-	return chainCredentials(base, asking());
-}
-//#endregion
 //#region src/deploy/index.ts
 /**
 * Deploy Module
@@ -2336,22 +2021,6 @@ function getServerHostname(endpoint) {
 	return new URL(endpoint).hostname;
 }
 /**
-* Generate image tag from stage and timestamp
-*/
-function generateTag(stage) {
-	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
-}
-/**
-* The things this deploy creates a container for.
-*
-* A deploy unit is a *declaration*, not a config entry — and since that is now
-* true of every app, not just the ones being deployed, this is the workspace's
-* own derivation under the name the deploy phases call it by.
-*/
-function deployUnits(manifest, workspace) {
-	return derivedApps(manifest, workspace);
-}
-/**
 * The variables an app cannot start without.
 *
 * The sniffer reports every key it saw in `requiredEnvVars` and says which of
@@ -2369,26 +2038,6 @@ function requiredOf(requirements) {
 	const optional = new Set(requirements.optionalEnvVars);
 	return requirements.requiredEnvVars.map((name) => name.endsWith("?") ? name.slice(0, -1) : name).filter((name) => !optional.has(name));
 }
-/** Apps were asked for by name that the workspace does not have. */
-var UnknownDeployApps = class extends Error {
-	apps;
-	available;
-	constructor(apps, available) {
-		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
-		this.apps = apps;
-		this.available = available;
-		this.name = "UnknownDeployApps";
-	}
-};
-/** Every app asked for deploys somewhere other than Dokploy. */
-var NoDeployableApps = class extends Error {
-	stage;
-	constructor(stage) {
-		super("No apps to deploy. All selected apps have unsupported deploy targets.");
-		this.stage = stage;
-		this.name = "NoDeployableApps";
-	}
-};
 /** A backend failed, so the run stopped before deploying anything after it. */
 var BackendDeployFailed = class extends Error {
 	app;
@@ -2411,23 +2060,24 @@ var MissingEnvVars = class extends Error {
 		this.name = "MissingEnvVars";
 	}
 };
-/** Workspace deploys go to Dokploy; another provider was asked for. */
-var DeployProviderUnsupported = class extends Error {
-	provider;
-	constructor(provider) {
-		super(`Workspace deployment only supports Dokploy. Got: ${provider}`);
-		this.provider = provider;
-		this.name = "DeployProviderUnsupported";
-	}
-};
 /** How `resolveProject` found a project, in the journal's words. */
 const PROJECT_VIA = {
 	state: "recorded",
 	marker: "found",
 	created: "created"
 };
+/** `childOutput` as `spawn` reads it, where it is not the default. */
+const CHILD_STDIO = {
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
 /**
-* Deploy every app in a workspace to Dokploy.
+* Deploy every app in a workspace to Dokploy: the engine under the built-in
+* `dokploy` target.
 *
 * Two-phase orchestration:
 * - PHASE 1: Deploy backend apps (with encrypted secrets)
@@ -2438,119 +2088,60 @@ const PROJECT_VIA = {
 * - Only GKM_MASTER_KEY is injected as Dokploy env var
 * - Frontend apps get public URLs baked in at build time (no secrets)
 *
-* The engine under `deploy()` and `gkm deploy`. It never prompts and never
-* exits: credentials come from `ctx.credentials`, progress goes to
-* `ctx.emit` and to `output`, and every failure is thrown.
+* The run around it — the target, the apps, the lock, the phase events — is
+* `runDeploy`'s. This says what it is doing and checks what Dokploy needs.
 *
 * @internal
 */
-async function runDeploy(source, request, ctx) {
-	const { stage, tag, apps: selectedApps } = request;
-	ctx.emit({
-		type: "phase.started",
-		phase: "validate"
-	});
-	const configured = typeof source === "function" ? await source() : source;
-	const manifest = await discover({
-		patterns: constructGlobs(configured),
-		cwd: configured.root
-	});
-	const units = deployUnits(manifest, configured);
-	const workspace = Object.keys(units).length > 0 ? {
-		...configured,
-		apps: units
-	} : configured;
-	const identity = deployIdentity(workspace, stage);
+async function validateDokploy(phase) {
+	const { workspace, stage, identity, tag: imageTag } = phase;
+	const ctx = {
+		emit: phase.emit,
+		credentials: phase.credentials,
+		signal: phase.signal,
+		dryRun: phase.dryRun,
+		...phase.childOutput !== "inherit" ? { stdio: CHILD_STDIO[phase.childOutput] } : {}
+	};
 	logger.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
 	logger.log(`   Stage: ${stage}`);
-	const imageTag = tag ?? generateTag(stage);
 	logger.log(`   Tag: ${imageTag}`);
-	const buildOrder = getAppBuildOrder(workspace);
-	let appsToDeployNames = buildOrder;
-	if (selectedApps && selectedApps.length > 0) {
-		const invalidApps = selectedApps.filter((name) => !workspace.apps[name]);
-		if (invalidApps.length > 0) throw new UnknownDeployApps(invalidApps, Object.keys(workspace.apps));
-		appsToDeployNames = buildOrder.filter((name) => selectedApps.includes(name));
-		logger.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
-	} else logger.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
-	const skipped = [];
-	const skip = (app, reason) => {
-		skipped.push({
-			app,
-			reason
-		});
-		ctx.emit({
-			type: "app.skipped",
-			app,
-			reason
-		});
-	};
-	const dokployApps = appsToDeployNames.filter((name) => {
-		const target = workspace.apps[name].resolvedDeployTarget;
-		if (target === "sst") {
-			const reason = `it deploys with SST — run \`gkm build && sst deploy --stage ${stage}\``;
-			logger.log(`   ⚠️  Skipping ${name}: ${reason}`);
-			skip(name, reason);
-			return false;
-		}
-		if (!isDeployTargetSupported(target)) {
-			const reason = getDeployTargetError(target, name);
-			logger.log(`   ⚠️  Skipping ${name}: ${reason}`);
-			skip(name, reason);
-			return false;
-		}
-		return true;
-	});
-	if (dokployApps.length === 0) throw new NoDeployableApps(stage);
-	appsToDeployNames = dokployApps;
-	for (const name of appsToDeployNames) if (workspace.apps[name].type === "mobile") skip(name, MOBILE_SKIP_REASON);
-	ctx.emit({
-		type: "deploy.started",
-		stage,
-		identity: identity.key,
-		tag: imageTag,
-		apps: appsToDeployNames.filter((name) => workspace.apps[name].type !== "mobile"),
-		dryRun: ctx.dryRun
-	});
-	const store = await createStateStore({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
+	const askedFor = /* @__PURE__ */ new Set([...phase.apps, ...phase.skipped.map((skipped) => skipped.app)]);
+	const asked = getAppBuildOrder(workspace).filter((name) => askedFor.has(name));
+	logger.log(asked.length === Object.keys(workspace.apps).length ? `   Deploying all apps: ${asked.join(", ")}` : `   Deploying apps: ${asked.join(", ")}`);
+	for (const { app, reason } of phase.skipped) logger.log(`   ⚠️  Skipping ${app}: ${reason}`);
+	const appsToDeployNames = [...phase.apps];
+	for (const name of appsToDeployNames) if (workspace.apps[name].type === "mobile") phase.skip(name, MOBILE_SKIP_REASON);
 	const run = {
 		workspace,
-		manifest,
+		manifest: phase.manifest,
 		stage,
 		imageTag,
 		appsToDeployNames,
 		identity,
-		store,
-		skipped,
+		store: phase.state,
+		skipped: phase.skipped,
+		secrets: phase.secrets,
 		ctx
 	};
-	if (ctx.dryRun) return planDeploy(run);
-	const lock = await store.lock(stage, { operation: "deploy" });
-	try {
-		return await deployLocked(run);
-	} finally {
-		await lock.release();
-	}
+	return {
+		...run,
+		preflight: await preflight(run)
+	};
 }
 /**
 * The stage's secrets and every app's environment requirements. A dry run
 * reads the secrets and generates nothing into the store.
 */
-async function preflight({ workspace, manifest, stage, ctx }) {
+async function preflight({ workspace, manifest, stage, secrets: secretsStore, ctx }) {
 	logger.log("\n🔐 Loading secrets and analyzing environment requirements...");
-	const secretsStore = await secretsStoreFor(workspace, stage, { ...ctx.home ? { home: ctx.home } : {} });
-	const stored = await secretsStore.read(stage);
+	const stored = await secretsStore.read();
 	if (!stored) logger.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
 	const { secrets: stageSecrets, generated } = withGeneratedSecrets(stored ?? initStageSecrets(stage), manifest);
 	if (generated.length > 0) {
-		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
+		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.store}): ${generated.join(", ")}`);
 		else {
-			await secretsStore.write(stage, stageSecrets);
-			logger.log(`   🔑 Generated for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
+			await secretsStore.write(stageSecrets);
+			logger.log(`   🔑 Generated for "${stage}" (${secretsStore.store}): ${generated.join(", ")}`);
 		}
 	}
 	const sniffedApps = await sniffAllApps(workspace.apps, workspace.root);
@@ -2566,14 +2157,14 @@ async function preflight({ workspace, manifest, stage, ctx }) {
 		encryptedSecrets
 	};
 }
-/** Everything a deploy does while it holds the stage's lock. */
-async function deployLocked(run) {
-	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity, store, ctx } = run;
-	const { stageSecrets, sniffedApps, encryptedSecrets } = await preflight(run);
-	ctx.emit({
-		type: "phase.finished",
-		phase: "validate"
-	});
+/**
+* The project, environment and registry, then what the manifest declares.
+* Each is looked up — by the id the stage's state recorded, else by name —
+* before it is created, so a run stopped part way is finished by the next.
+*/
+async function provisionDokploy(run) {
+	const { workspace, manifest, stage, appsToDeployNames, identity, store, ctx } = run;
+	const { stageSecrets } = run.preflight;
 	const changes = [];
 	const applied = (change, via) => {
 		changes.push(change);
@@ -2583,11 +2174,6 @@ async function deployLocked(run) {
 			via
 		});
 	};
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "provision"
-	});
 	const { api, endpoint } = await dokployApi(workspace, ctx);
 	logger.log("\n📋 Loading deploy state...");
 	const journal = await DeployJournal.open(store, stage, () => createEmptyState(stage, "", ""));
@@ -2730,7 +2316,7 @@ async function deployLocked(run) {
 			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
 			const backupRetention = workspace.deploy.backups.retention ?? 30;
 			logger.log("   Creating postgres backup schedule...");
-			setPostgresBackupId(state, (await api.createPostgresBackup({
+			const backup = await api.createPostgresBackup({
 				schedule: backupSchedule,
 				prefix: `${stage}/postgres`,
 				destinationId: backupState.destinationId,
@@ -2738,14 +2324,39 @@ async function deployLocked(run) {
 				postgresId: backupCluster.postgresId,
 				enabled: true,
 				keepLatestCount: backupRetention
-			})).backupId);
+			});
+			setPostgresBackupId(state, backup.backupId);
 			logger.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
 		} else logger.log("   ✓ Using existing postgres backup schedule");
 	}
-	ctx.emit({
-		type: "phase.finished",
-		phase: "provision"
-	});
+	run.provisioned = {
+		api,
+		endpoint,
+		journal,
+		state,
+		projectId: project.projectId,
+		environmentId,
+		registry,
+		registryId,
+		declaredEnv,
+		changes,
+		applied
+	};
+}
+/**
+* Each app's image built and pushed, its application configured and
+* deployed, and its domain attached: backends first, each failure stopping
+* the run; then sites, whose build args are the backends' public URLs.
+*
+* Building is here rather than in a `build` phase of its own because an
+* image is built beside its application — a site's build args are resolved
+* per app, against the backends released before it.
+*/
+async function releaseDokploy(run) {
+	const { workspace, stage, imageTag, appsToDeployNames, identity, ctx } = run;
+	const { stageSecrets, sniffedApps, encryptedSecrets } = run.preflight;
+	const { api, journal, state, environmentId, registry, registryId, declaredEnv, changes, applied } = run.provisioned;
+	const project = { projectId: run.provisioned.projectId };
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
 	const publicUrls = {};
@@ -2806,11 +2417,6 @@ async function deployLocked(run) {
 	};
 	const frontendUrls = [];
 	for (const appName of frontendApps) frontendUrls.push(`https://${hostOf(workspace, appName, stage)}`);
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "release"
-	});
 	if (backendApps.length > 0) {
 		logger.log("\n📦 PHASE 1: Deploying backend applications...");
 		for (const appName of backendApps) {
@@ -2976,15 +2582,17 @@ async function deployLocked(run) {
 	logger.log("\n📋 Saving deploy state...");
 	await journal.save();
 	logger.log("   ✓ State saved");
-	ctx.emit({
-		type: "phase.finished",
-		phase: "release"
-	});
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "verify"
-	});
+	run.released = {
+		results,
+		publicUrls,
+		appHostnames
+	};
+}
+/** DNS records for each released app, and Dokploy's validation of each domain. */
+async function verifyDokploy(run) {
+	const { workspace } = run;
+	const { api, endpoint, journal, state } = run.provisioned;
+	const { appHostnames } = run.released;
 	const dnsConfig = workspace.deploy.dns;
 	if (dnsConfig && appHostnames.size > 0) {
 		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
@@ -3004,10 +2612,14 @@ async function deployLocked(run) {
 			}
 		}
 	}
-	ctx.emit({
-		type: "phase.finished",
-		phase: "verify"
-	});
+}
+/** What the run did, printed as the summary it always ended with. */
+function dokployResult(run) {
+	if (run.result) return run.result;
+	const { stage, identity, imageTag } = run;
+	const { projectId, environmentId, changes } = run.provisioned;
+	const { results, publicUrls } = run.released;
+	const project = { projectId };
 	const successCount = results.filter((r) => r.success).length;
 	const failedCount = results.filter((r) => !r.success).length;
 	logger.log(`\n${"─".repeat(50)}`);
@@ -3029,7 +2641,7 @@ async function deployLocked(run) {
 		identity: identity.key,
 		tag: imageTag,
 		dryRun: false,
-		skipped: run.skipped,
+		skipped: [...run.skipped],
 		urls: publicUrls,
 		changes
 	};
@@ -3150,19 +2762,9 @@ function hostOf(workspace, appName, stage) {
 * else: no lock, no state written, no secret generated, no Dokploy resource
 * created or changed, no image built or pushed.
 */
-async function planDeploy(run) {
+async function planDokploy(run) {
 	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity } = run;
 	const { ctx } = run;
-	await preflight(run);
-	ctx.emit({
-		type: "phase.finished",
-		phase: "validate"
-	});
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "plan"
-	});
 	logger.log("\n🔎 Dry run: nothing will be created, changed, built or pushed.");
 	const changes = [];
 	const plan = (change, detail) => {
@@ -3277,11 +2879,7 @@ async function planDeploy(run) {
 	}
 	const creates = changes.filter((c) => c.action !== "reuse").length;
 	logger.log(`\n✅ Dry run complete: ${creates} to create or build, ${changes.length - creates} to reuse.`);
-	ctx.emit({
-		type: "phase.finished",
-		phase: "plan"
-	});
-	return {
+	run.result = {
 		apps,
 		projectId: project?.projectId ?? "",
 		environmentId: environment?.environmentId ?? "",
@@ -3291,7 +2889,7 @@ async function planDeploy(run) {
 		identity: identity.key,
 		tag: imageTag,
 		dryRun: true,
-		skipped: run.skipped,
+		skipped: [...run.skipped],
 		urls,
 		changes
 	};
@@ -3299,131 +2897,6 @@ async function planDeploy(run) {
 /** Why a mobile app is left out of a Dokploy deploy. */
 const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
-//#region src/deploy/deploy.ts
-/**
-* `deploy()`: a deploy as a library call.
-*
-* `gkm deploy` could only be driven from an interactive terminal: it prompted
-* for what it lacked and exited the process on failure, worked out of
-* `process.cwd()`, and reported progress by printing. Here the caller says
-* where the project is, hands over the credentials and a signal, and gets back
-* a run — events to iterate while it goes, and a structured result at the end.
-* Nothing below this asks a person anything or ends the process; `gkm deploy`
-* is a thin wrapper that does both.
-*/
-/**
-* Every event a run emits, kept so that each iteration — however late it
-* starts — sees the run from its first event to its last.
-*/
-var EventLog = class {
-	events = [];
-	closed = false;
-	waiting = [];
-	push(event) {
-		this.events.push(event);
-		this.wake();
-	}
-	close() {
-		this.closed = true;
-		this.wake();
-	}
-	wake() {
-		const waiting = this.waiting;
-		this.waiting = [];
-		for (const resume of waiting) resume();
-	}
-	async *iterate() {
-		let next = 0;
-		while (true) if (next < this.events.length) yield this.events[next++];
-		else if (this.closed) return;
-		else await new Promise((resume) => this.waiting.push(resume));
-	}
-};
-/** `childOutput` as `spawn` reads it, where it is not the default. */
-const CHILD_STDIO = {
-	stderr: [
-		"ignore",
-		2,
-		2
-	],
-	ignore: "ignore"
-};
-function forward(logger, level, message) {
-	if (!logger) return;
-	if (level === "info") logger.info(message);
-	else if (level === "error" && logger.error) logger.error(message);
-	else logger.warn(message);
-}
-/**
-* Deploy a project's stage.
-*
-* ```ts
-* import { deploy } from '@geekmidas/cli/deploy';
-*
-* const run = deploy({ cwd: '/srv/checkouts/shop', stage: 'production' });
-* for await (const event of run) {
-*   if (event.type === 'app.deployed') console.log(event.app, event.url);
-* }
-* const result = await run.result;
-* ```
-*
-* The run starts at once; iterating it is optional, and an iteration started
-* late still sees every event from the first.
-*/
-function deploy(input) {
-	const log = new EventLog();
-	const emit = (event) => {
-		log.push(event);
-		if (event.type === "log") forward(input.logger, event.level, event.message);
-	};
-	const ctx = {
-		emit,
-		credentials: input.credentials ?? storedCredentials({ home: input.home ?? gkmHome() }),
-		dryRun: input.dryRun ?? false,
-		home: input.home ?? gkmHome(),
-		...input.signal ? { signal: input.signal } : {},
-		...input.childOutput && input.childOutput !== "inherit" ? { stdio: CHILD_STDIO[input.childOutput] } : {}
-	};
-	const result = withOutput((level, message) => emit({
-		type: "log",
-		level,
-		message
-	}), async () => {
-		try {
-			input.signal?.throwIfAborted();
-			const deployed = await runDeploy(() => load(input), {
-				stage: input.stage,
-				...input.tag ? { tag: input.tag } : {},
-				...input.apps ? { apps: input.apps } : {}
-			}, ctx);
-			emit({
-				type: "deploy.finished",
-				result: deployed
-			});
-			return deployed;
-		} catch (error) {
-			emit({
-				type: "deploy.failed",
-				error: eventError(error)
-			});
-			throw error;
-		} finally {
-			log.close();
-		}
-	});
-	result.catch(() => {});
-	return {
-		result,
-		[Symbol.asyncIterator]: () => log.iterate()
-	};
-}
-/** The workspace at `input.cwd`, refusing a stage it does not deploy. */
-async function load(input) {
-	const { workspace } = await loadWorkspaceConfig(resolve(input.cwd));
-	assertDeployedStage(workspace.stages, input.stage);
-	return workspace;
-}
-//#endregion
-export { NoDeployableApps as a, RegistryAmbiguous as c, ProjectNotOwned as d, MissingCredential as f, MissingEnvVars as i, RegistryNotConfigured as l, storedCredentials as m, BackendDeployFailed as n, UnknownDeployApps as o, chainCredentials as p, DeployProviderUnsupported as r, terminalCredentials as s, deploy as t, RegistryNotFound as u };
+export { provisionDokploy as a, verifyDokploy as c, RegistryNotFound as d, ProjectNotOwned as f, planDokploy as i, RegistryAmbiguous as l, MissingEnvVars as n, releaseDokploy as o, dokployResult as r, validateDokploy as s, BackendDeployFailed as t, RegistryNotConfigured as u };
 
-//# sourceMappingURL=deploy-D6Q09OkA.mjs.map
+//# sourceMappingURL=deploy-B7jvUORo.mjs.map