@geekmidas/cli 10.0.0-alpha.61 → 10.0.0-alpha.63

package/dist/{deploy-BbJdgQ2b.cjs → deploy-ABBI0lf1.cjs}

@@ -1,10 +1,10 @@
-const require_sniffer = require("./sniffer-CQmJnNJM.cjs");
-const require_home = require("./home-DOzBaWaL.cjs");
-const require_discover = require("./discover-Bc-4eA_p.cjs");
-const require_config = require("./config-DXnkCEq0.cjs");
-const require_workspace = require("./workspace-B64Xk1Mb.cjs");
+const require_sniffer = require("./sniffer-D_SYc_pO.cjs");
+const require_discover = require("./discover-C_6COHEv.cjs");
+const require_config = require("./config-BEJYKd4s.cjs");
+const require_workspace = require("./workspace-Kl4NG9IH.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-KvNQwYaB.cjs");
+const require_terminal = require("./terminal-D0f1u0LG.cjs");
 let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
@@ -14,96 +14,6 @@ let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let pg = require("pg");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
 let node_dns_promises = require("node:dns/promises");
-//#region src/deploy/credentials.ts
-/**
-* How a deploy gets the credentials it acts with.
-*
-* `deploy()` never prompts and never reads a terminal: it asks a
-* `CredentialProvider` and, when the provider has nothing, stops with
-* `MissingCredential` naming what it needed and how to supply it. Whether to
-* ask a person, read a vault or fail is the caller's decision — `gkm deploy`
-* prompts at a terminal and stores what was typed; a CI job sets the
-* environment; a host passes its own provider.
-*/
-/** How to supply each kind, for the error that says it is missing. */
-const HOW_TO_PROVIDE = {
-	dokploy: "Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.",
-	registry: "Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them."
-};
-/** A deploy needed a credential, and its provider had none. */
-var MissingCredential = class extends Error {
-	kind;
-	target;
-	howToProvide;
-	constructor(kind, target, howToProvide = HOW_TO_PROVIDE[kind]) {
-		const what = kind === "dokploy" ? `No Dokploy credentials${target ? ` for ${target}` : ""}.` : `Dokploy has no registry for ${target ?? "the configured registry"}, and there are no credentials to create one with.`;
-		super(`${what} ${howToProvide}`);
-		this.kind = kind;
-		this.target = target;
-		this.howToProvide = howToProvide;
-		this.name = "MissingCredential";
-	}
-};
-/** Whatever was asked for, from the first provider that has it. */
-function chainCredentials(...providers) {
-	return { async get(request, options) {
-		for (const provider of providers) {
-			const found = await provider.get(request, options);
-			if (found) return found;
-		}
-	} };
-}
-/**
-* Credentials from the environment, then from what `gkm login` stored. What
-* `deploy()` uses when it is handed no provider.
-*
-* - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
-*   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
-*   Each half is read on its own: a token is a secret and belongs in the
-*   environment, an endpoint is configuration and belongs in the config.
-* - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
-*/
-function storedCredentials(options = {}) {
-	const env = options.env ?? process.env;
-	return { async get(asked) {
-		const request = asked;
-		switch (request.kind) {
-			case "dokploy": {
-				const stored = (await require_sniffer.readCredentials(options.home ? { home: options.home } : void 0)).dokploy;
-				const token = env.DOKPLOY_API_TOKEN ?? stored?.token;
-				const endpoint = env.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;
-				if (!token || !endpoint) return void 0;
-				return {
-					endpoint: endpoint.replace(/\/$/, ""),
-					token
-				};
-			}
-			case "registry": {
-				const username = env.DOCKER_REGISTRY_USERNAME;
-				const password = env.DOCKER_REGISTRY_PASSWORD;
-				if (!username || !password) return void 0;
-				return {
-					username,
-					password
-				};
-			}
-		}
-	} };
-}
-//#endregion
-//#region src/deploy/events.ts
-/** An error as an event carries it: its name and message, nothing else. */
-function eventError(error) {
-	if (error instanceof Error) return {
-		name: error.name,
-		message: error.message
-	};
-	return {
-		name: "Error",
-		message: String(error)
-	};
-}
-//#endregion
 //#region src/deploy/fromManifest.ts
 /**
 * The Dokploy target, read off the construct manifest.
@@ -875,7 +785,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-CgDaD8VR.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-mJ7YruxH.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -897,7 +807,7 @@ async function createDnsProvider(options) {
 *
 * Handles automatic DNS record creation for deployed applications.
 */
-const logger$3 = require_discover.output;
+const logger$2 = require_discover.output;
 /**
 * Check if DNS config is legacy format (single domain with `domain` property)
 */
@@ -934,7 +844,7 @@ function groupHostnamesByDomain(appHostnames, dnsConfig) {
 	for (const [appName, hostname] of appHostnames) {
 		const rootDomain = findRootDomain(hostname, dnsConfig);
 		if (!rootDomain) {
-			logger$3.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
+			logger$2.log(`   ⚠ No DNS config found for hostname: ${hostname}`);
 			continue;
 		}
 		if (!grouped.has(rootDomain)) grouped.set(rootDomain, /* @__PURE__ */ new Map());
@@ -984,10 +894,10 @@ function generateRequiredRecords(appHostnames, rootDomain, serverIp) {
 * Print DNS records table
 */
 function printDnsRecordsTable(records, rootDomain) {
-	logger$3.log(`\n   📋 DNS Records for ${rootDomain}:`);
-	logger$3.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
-	logger$3.log("   │ Subdomain                           │ Type │ Value           │ Status │");
-	logger$3.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
+	logger$2.log(`\n   📋 DNS Records for ${rootDomain}:`);
+	logger$2.log("   ┌─────────────────────────────────────┬──────┬─────────────────┬────────┐");
+	logger$2.log("   │ Subdomain                           │ Type │ Value           │ Status │");
+	logger$2.log("   ├─────────────────────────────────────┼──────┼─────────────────┼────────┤");
 	for (const record of records) {
 		const subdomain = record.subdomain.padEnd(35);
 		const type = record.type.padEnd(4);
@@ -997,18 +907,18 @@ function printDnsRecordsTable(records, rootDomain) {
 		else if (record.created) status = "✓ new";
 		else if (record.existed) status = "✓";
 		else status = "?";
-		logger$3.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
+		logger$2.log(`   │ ${subdomain} │ ${type} │ ${value} │ ${status.padEnd(6)} │`);
 	}
-	logger$3.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
+	logger$2.log("   └─────────────────────────────────────┴──────┴─────────────────┴────────┘");
 }
 /**
 * Print DNS records in a simple format for manual setup
 */
 function printDnsRecordsSimple(records, rootDomain) {
-	logger$3.log("\n   📋 Required DNS Records:");
-	logger$3.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
-	for (const record of records) logger$3.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
-	logger$3.log("");
+	logger$2.log("\n   📋 Required DNS Records:");
+	logger$2.log(`   Add these A records to your DNS provider (${rootDomain}):\n`);
+	for (const record of records) logger$2.log(`   ${record.subdomain}  →  ${record.value}  (A record)`);
+	logger$2.log("");
 }
 /**
 * Create DNS records for a single domain using its configured provider
@@ -1020,7 +930,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		provider = await createDnsProvider({ config: providerConfig });
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$3.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
+		logger$2.log(`   ⚠ Failed to create DNS provider for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			...r,
 			error: message
@@ -1074,7 +984,7 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 		}
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$3.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
+		logger$2.log(`   ⚠ Failed to create DNS records for ${rootDomain}: ${message}`);
 		return records.map((r) => ({
 			hostname: r.hostname,
 			subdomain: r.subdomain,
@@ -1101,20 +1011,20 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	if (!dnsConfig) return null;
 	const normalizedConfig = normalizeDnsConfig(dnsConfig);
-	logger$3.log("\n🌐 Setting up DNS records...");
+	logger$2.log("\n🌐 Setting up DNS records...");
 	let serverIp;
 	try {
 		const endpointUrl = new URL(dokployEndpoint);
 		serverIp = await resolveHostnameToIp(endpointUrl.hostname);
-		logger$3.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
+		logger$2.log(`   Server IP: ${serverIp} (from ${endpointUrl.hostname})`);
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
-		logger$3.log(`   ⚠ Failed to resolve server IP: ${message}`);
+		logger$2.log(`   ⚠ Failed to resolve server IP: ${message}`);
 		return null;
 	}
 	const groupedHostnames = groupHostnamesByDomain(appHostnames, normalizedConfig);
 	if (groupedHostnames.size === 0) {
-		logger$3.log("   No DNS records needed (no hostnames match configured domains)");
+		logger$2.log("   No DNS records needed (no hostnames match configured domains)");
 		return {
 			records: [],
 			success: true,
@@ -1126,22 +1036,22 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	for (const [rootDomain, domainHostnames] of groupedHostnames) {
 		const providerConfig = normalizedConfig[rootDomain];
 		if (!providerConfig) {
-			logger$3.log(`   ⚠ No provider config for ${rootDomain}`);
+			logger$2.log(`   ⚠ No provider config for ${rootDomain}`);
 			continue;
 		}
 		const providerName = typeof providerConfig.provider === "string" ? providerConfig.provider : "custom";
 		const requiredRecords = generateRequiredRecords(domainHostnames, rootDomain, serverIp);
 		if (requiredRecords.length === 0) continue;
-		logger$3.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
+		logger$2.log(`   Creating DNS records for ${rootDomain} (${providerName})...`);
 		const domainRecords = await createDnsRecordsForDomain(requiredRecords, rootDomain, providerConfig);
 		allRecords.push(...domainRecords);
 		const created = domainRecords.filter((r) => r.created).length;
 		const existed = domainRecords.filter((r) => r.existed).length;
 		const failed = domainRecords.filter((r) => r.error).length;
-		if (created > 0) logger$3.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
-		if (existed > 0) logger$3.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
+		if (created > 0) logger$2.log(`   ✓ Created ${created} DNS record(s) for ${rootDomain}`);
+		if (existed > 0) logger$2.log(`   ✓ ${existed} record(s) already exist for ${rootDomain}`);
 		if (failed > 0) {
-			logger$3.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
+			logger$2.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
 			hasFailures = true;
 		}
 		if (state) {
@@ -1178,10 +1088,10 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 */
 async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const results = [];
-	logger$3.log("\n🔍 Verifying DNS records...");
+	logger$2.log("\n🔍 Verifying DNS records...");
 	for (const [appName, hostname] of appHostnames) {
 		if (require_sniffer.isDnsVerified(state, hostname, serverIp)) {
-			logger$3.log(`   ✓ ${hostname} (previously verified)`);
+			logger$2.log(`   ✓ ${hostname} (previously verified)`);
 			results.push({
 				hostname,
 				appName,
@@ -1195,7 +1105,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			const resolvedIp = await resolveHostnameToIp(hostname);
 			if (resolvedIp === serverIp) {
 				require_sniffer.setDnsVerification(state, hostname, serverIp);
-				logger$3.log(`   ✓ ${hostname} → ${resolvedIp}`);
+				logger$2.log(`   ✓ ${hostname} → ${resolvedIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -1204,7 +1114,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 					expectedIp: serverIp
 				});
 			} else {
-				logger$3.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
+				logger$2.log(`   ⚠ ${hostname} resolves to ${resolvedIp}, expected ${serverIp}`);
 				results.push({
 					hostname,
 					appName,
@@ -1215,7 +1125,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 			}
 		} catch (error) {
 			const message = error instanceof Error ? error.message : "Unknown error";
-			logger$3.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
+			logger$2.log(`   ⚠ ${hostname} DNS not propagated (${message})`);
 			results.push({
 				hostname,
 				appName,
@@ -1229,14 +1139,14 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const skipped = results.filter((r) => r.skipped).length;
 	const pending = results.filter((r) => !r.verified).length;
 	if (pending > 0) {
-		logger$3.log(`\n   ${verified} verified, ${pending} pending propagation`);
-		logger$3.log("   DNS changes may take 5-30 minutes to propagate");
-	} else if (skipped > 0) logger$3.log(`   ${verified} verified (${skipped} from cache)`);
+		logger$2.log(`\n   ${verified} verified, ${pending} pending propagation`);
+		logger$2.log("   DNS changes may take 5-30 minutes to propagate");
+	} else if (skipped > 0) logger$2.log(`   ${verified} verified (${skipped} from cache)`);
 	return results;
 }
 //#endregion
 //#region src/deploy/docker.ts
-const logger$2 = require_discover.output;
+const logger$1 = require_discover.output;
 /**
 * The id the Dockerfile templates mount the encrypted credentials under:
 * `RUN --mount=type=secret,id=gkm_credentials`.
@@ -1299,8 +1209,8 @@ async function writeCredentialsFile(credentials) {
 * @param credentials - Encrypted credentials, passed as a build secret
 */
 async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio }) {
-	logger$2.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger$2.log("   Generating Dockerfile for the pre-built bundle...");
+	logger$1.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$1.log("   Generating Dockerfile for the pre-built bundle...");
 	await require_sniffer.dockerCommand({
 		slim: true,
 		cwd
@@ -1322,7 +1232,7 @@ async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio
 			...signal ? { signal } : {},
 			...stdio ? { stdio } : {}
 		});
-		logger$2.log(`✅ Image built: ${imageRef}`);
+		logger$1.log(`✅ Image built: ${imageRef}`);
 	} catch (error) {
 		throw new require_sniffer.DockerBuildFailed(imageRef, error);
 	} finally {
@@ -1333,14 +1243,14 @@ async function buildImage(imageRef, buildArgs, credentials, { cwd, signal, stdio
 * Push Docker image to registry
 */
 async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger$2.log(`\n☁️  Pushing image: ${imageRef}`);
+	logger$1.log(`\n☁️  Pushing image: ${imageRef}`);
 	try {
 		await require_sniffer.run("docker", ["push", imageRef], {
 			cwd,
 			...signal ? { signal } : {},
 			...stdio ? { stdio } : {}
 		});
-		logger$2.log(`✅ Image pushed: ${imageRef}`);
+		logger$1.log(`✅ Image pushed: ${imageRef}`);
 	} catch (error) {
 		throw new require_sniffer.DockerPushFailed(imageRef, error);
 	}
@@ -1390,17 +1300,17 @@ async function deployDocker(options) {
 	await buildImage(imageRef, buildArgs, credentials, docker);
 	let digest;
 	if (!skipPush) {
-		if (!config.registry) logger$2.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		if (!config.registry) logger$1.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
 		else {
 			await pushImage(imageRef, docker);
 			digest = await pushedDigest(imageRef, docker);
 		}
 	}
-	logger$2.log("\n✅ Docker deployment ready!");
-	logger$2.log(`\n📋 Deployment details:`);
-	logger$2.log(`   Image: ${imageRef}`);
-	logger$2.log(`   Stage: ${stage}`);
-	if (masterKey) logger$2.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${require_sniffer.keyFingerprint(masterKey)}.`);
+	logger$1.log("\n✅ Docker deployment ready!");
+	logger$1.log(`\n📋 Deployment details:`);
+	logger$1.log(`   Image: ${imageRef}`);
+	logger$1.log(`   Stage: ${stage}`);
+	if (masterKey) logger$1.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${require_sniffer.keyFingerprint(masterKey)}.`);
 	return {
 		imageRef,
 		...digest ? { digest } : {},
@@ -1911,83 +1821,6 @@ function generateSecretsReport(encryptedApps, sniffedApps) {
 	};
 }
 //#endregion
-//#region src/deploy/terminal.ts
-/**
-* The credentials `gkm deploy` can ask a person for. CLI layer only.
-*
-* `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`
-* when the answer is nothing. At a terminal, `gkm deploy` would rather ask:
-* this provider reads the environment and the stored login first, and only
-* when both are empty prompts — and stores a Dokploy login it validated, so
-* the next deploy does not ask again. With no terminal it answers nothing, and
-* the deploy says what was missing instead of waiting on a prompt nobody sees.
-*/
-const logger$1 = require_discover.output;
-/** What answers a deploy prompt without a terminal. */
-const INSTEAD = "Please configure manually.";
-/** The Dokploy URL typed at the prompt is not a URL. */
-var DokployEndpointInvalid = class extends Error {
-	endpoint;
-	constructor(endpoint) {
-		super("Invalid URL format");
-		this.endpoint = endpoint;
-		this.name = "DokployEndpointInvalid";
-	}
-};
-/** Dokploy refused the token typed at the prompt; nothing was stored. */
-var DokployTokenRejected = class extends Error {
-	endpoint;
-	constructor(endpoint) {
-		super("Invalid credentials. Please check your token.");
-		this.endpoint = endpoint;
-		this.name = "DokployTokenRejected";
-	}
-};
-/** Asks the person at the terminal for what nothing else supplied. */
-function asking() {
-	return { async get(asked) {
-		if (!require_sniffer.canPrompt()) return void 0;
-		const request = asked;
-		if (request.kind === "dokploy") {
-			logger$1.log("\n📋 Dokploy credentials not found. Let's set them up.");
-			const endpoint = (await require_sniffer.prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: INSTEAD })).replace(/\/$/, "");
-			try {
-				new URL(endpoint);
-			} catch {
-				throw new DokployEndpointInvalid(endpoint);
-			}
-			logger$1.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
-			const token = await require_sniffer.prompt("API Token: ", {
-				hidden: true,
-				instead: INSTEAD
-			});
-			logger$1.log("\nValidating credentials...");
-			if (!await require_sniffer.validateDokployToken(endpoint, token)) throw new DokployTokenRejected(endpoint);
-			await require_sniffer.storeDokployCredentials(token, endpoint);
-			logger$1.log("✓ Credentials saved");
-			return {
-				endpoint,
-				token
-			};
-		}
-		logger$1.log(`   Dokploy has no registry for ${request.url}. Let's create one.`);
-		return {
-			username: await require_sniffer.prompt("Registry username: ", { instead: INSTEAD }),
-			password: await require_sniffer.prompt("Registry password/token: ", {
-				hidden: true,
-				instead: INSTEAD
-			})
-		};
-	} };
-}
-/**
-* The environment, then the stored login, then — at a terminal — the person
-* running the command.
-*/
-function terminalCredentials(base = storedCredentials()) {
-	return chainCredentials(base, asking());
-}
-//#endregion
 //#region src/deploy/index.ts
 /**
 * Deploy Module
@@ -2188,22 +2021,6 @@ function getServerHostname(endpoint) {
 	return new URL(endpoint).hostname;
 }
 /**
-* Generate image tag from stage and timestamp
-*/
-function generateTag(stage) {
-	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
-}
-/**
-* The things this deploy creates a container for.
-*
-* A deploy unit is a *declaration*, not a config entry — and since that is now
-* true of every app, not just the ones being deployed, this is the workspace's
-* own derivation under the name the deploy phases call it by.
-*/
-function deployUnits(manifest, workspace) {
-	return require_config.derivedApps(manifest, workspace);
-}
-/**
 * The variables an app cannot start without.
 *
 * The sniffer reports every key it saw in `requiredEnvVars` and says which of
@@ -2221,26 +2038,6 @@ function requiredOf(requirements) {
 	const optional = new Set(requirements.optionalEnvVars);
 	return requirements.requiredEnvVars.map((name) => name.endsWith("?") ? name.slice(0, -1) : name).filter((name) => !optional.has(name));
 }
-/** Apps were asked for by name that the workspace does not have. */
-var UnknownDeployApps = class extends Error {
-	apps;
-	available;
-	constructor(apps, available) {
-		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
-		this.apps = apps;
-		this.available = available;
-		this.name = "UnknownDeployApps";
-	}
-};
-/** Every app asked for deploys somewhere other than Dokploy. */
-var NoDeployableApps = class extends Error {
-	stage;
-	constructor(stage) {
-		super("No apps to deploy. All selected apps have unsupported deploy targets.");
-		this.stage = stage;
-		this.name = "NoDeployableApps";
-	}
-};
 /** A backend failed, so the run stopped before deploying anything after it. */
 var BackendDeployFailed = class extends Error {
 	app;
@@ -2263,23 +2060,24 @@ var MissingEnvVars = class extends Error {
 		this.name = "MissingEnvVars";
 	}
 };
-/** Workspace deploys go to Dokploy; another provider was asked for. */
-var DeployProviderUnsupported = class extends Error {
-	provider;
-	constructor(provider) {
-		super(`Workspace deployment only supports Dokploy. Got: ${provider}`);
-		this.provider = provider;
-		this.name = "DeployProviderUnsupported";
-	}
-};
 /** How `resolveProject` found a project, in the journal's words. */
 const PROJECT_VIA = {
 	state: "recorded",
 	marker: "found",
 	created: "created"
 };
+/** `childOutput` as `spawn` reads it, where it is not the default. */
+const CHILD_STDIO = {
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
 /**
-* Deploy every app in a workspace to Dokploy.
+* Deploy every app in a workspace to Dokploy: the engine under the built-in
+* `dokploy` target.
 *
 * Two-phase orchestration:
 * - PHASE 1: Deploy backend apps (with encrypted secrets)
@@ -2290,119 +2088,60 @@ const PROJECT_VIA = {
 * - Only GKM_MASTER_KEY is injected as Dokploy env var
 * - Frontend apps get public URLs baked in at build time (no secrets)
 *
-* The engine under `deploy()` and `gkm deploy`. It never prompts and never
-* exits: credentials come from `ctx.credentials`, progress goes to
-* `ctx.emit` and to `output`, and every failure is thrown.
+* The run around it — the target, the apps, the lock, the phase events — is
+* `runDeploy`'s. This says what it is doing and checks what Dokploy needs.
 *
 * @internal
 */
-async function runDeploy(source, request, ctx) {
-	const { stage, tag, apps: selectedApps } = request;
-	ctx.emit({
-		type: "phase.started",
-		phase: "validate"
-	});
-	const configured = typeof source === "function" ? await source() : source;
-	const manifest = await require_discover.discover({
-		patterns: require_sniffer.constructGlobs(configured),
-		cwd: configured.root
-	});
-	const units = deployUnits(manifest, configured);
-	const workspace = Object.keys(units).length > 0 ? {
-		...configured,
-		apps: units
-	} : configured;
-	const identity = require_store.deployIdentity(workspace, stage);
+async function validateDokploy(phase) {
+	const { workspace, stage, identity, tag: imageTag } = phase;
+	const ctx = {
+		emit: phase.emit,
+		credentials: phase.credentials,
+		signal: phase.signal,
+		dryRun: phase.dryRun,
+		...phase.childOutput !== "inherit" ? { stdio: CHILD_STDIO[phase.childOutput] } : {}
+	};
 	logger.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
 	logger.log(`   Stage: ${stage}`);
-	const imageTag = tag ?? generateTag(stage);
 	logger.log(`   Tag: ${imageTag}`);
-	const buildOrder = require_workspace.getAppBuildOrder(workspace);
-	let appsToDeployNames = buildOrder;
-	if (selectedApps && selectedApps.length > 0) {
-		const invalidApps = selectedApps.filter((name) => !workspace.apps[name]);
-		if (invalidApps.length > 0) throw new UnknownDeployApps(invalidApps, Object.keys(workspace.apps));
-		appsToDeployNames = buildOrder.filter((name) => selectedApps.includes(name));
-		logger.log(`   Deploying apps: ${appsToDeployNames.join(", ")}`);
-	} else logger.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
-	const skipped = [];
-	const skip = (app, reason) => {
-		skipped.push({
-			app,
-			reason
-		});
-		ctx.emit({
-			type: "app.skipped",
-			app,
-			reason
-		});
-	};
-	const dokployApps = appsToDeployNames.filter((name) => {
-		const target = workspace.apps[name].resolvedDeployTarget;
-		if (target === "sst") {
-			const reason = `it deploys with SST — run \`gkm build && sst deploy --stage ${stage}\``;
-			logger.log(`   ⚠️  Skipping ${name}: ${reason}`);
-			skip(name, reason);
-			return false;
-		}
-		if (!require_workspace.isDeployTargetSupported(target)) {
-			const reason = require_workspace.getDeployTargetError(target, name);
-			logger.log(`   ⚠️  Skipping ${name}: ${reason}`);
-			skip(name, reason);
-			return false;
-		}
-		return true;
-	});
-	if (dokployApps.length === 0) throw new NoDeployableApps(stage);
-	appsToDeployNames = dokployApps;
-	for (const name of appsToDeployNames) if (workspace.apps[name].type === "mobile") skip(name, MOBILE_SKIP_REASON);
-	ctx.emit({
-		type: "deploy.started",
-		stage,
-		identity: identity.key,
-		tag: imageTag,
-		apps: appsToDeployNames.filter((name) => workspace.apps[name].type !== "mobile"),
-		dryRun: ctx.dryRun
-	});
-	const store = await require_sniffer.createStateStore({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
+	const askedFor = /* @__PURE__ */ new Set([...phase.apps, ...phase.skipped.map((skipped) => skipped.app)]);
+	const asked = require_workspace.getAppBuildOrder(workspace).filter((name) => askedFor.has(name));
+	logger.log(asked.length === Object.keys(workspace.apps).length ? `   Deploying all apps: ${asked.join(", ")}` : `   Deploying apps: ${asked.join(", ")}`);
+	for (const { app, reason } of phase.skipped) logger.log(`   ⚠️  Skipping ${app}: ${reason}`);
+	const appsToDeployNames = [...phase.apps];
+	for (const name of appsToDeployNames) if (workspace.apps[name].type === "mobile") phase.skip(name, MOBILE_SKIP_REASON);
 	const run = {
 		workspace,
-		manifest,
+		manifest: phase.manifest,
 		stage,
 		imageTag,
 		appsToDeployNames,
 		identity,
-		store,
-		skipped,
+		store: phase.state,
+		skipped: phase.skipped,
+		secrets: phase.secrets,
 		ctx
 	};
-	if (ctx.dryRun) return planDeploy(run);
-	const lock = await store.lock(stage, { operation: "deploy" });
-	try {
-		return await deployLocked(run);
-	} finally {
-		await lock.release();
-	}
+	return {
+		...run,
+		preflight: await preflight(run)
+	};
 }
 /**
 * The stage's secrets and every app's environment requirements. A dry run
 * reads the secrets and generates nothing into the store.
 */
-async function preflight({ workspace, manifest, stage, ctx }) {
+async function preflight({ workspace, manifest, stage, secrets: secretsStore, ctx }) {
 	logger.log("\n🔐 Loading secrets and analyzing environment requirements...");
-	const secretsStore = await require_store.secretsStoreFor(workspace, stage, { ...ctx.home ? { home: ctx.home } : {} });
-	const stored = await secretsStore.read(stage);
+	const stored = await secretsStore.read();
 	if (!stored) logger.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
 	const { secrets: stageSecrets, generated } = require_sniffer.withGeneratedSecrets(stored ?? require_storage.initStageSecrets(stage), manifest);
 	if (generated.length > 0) {
-		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
+		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.store}): ${generated.join(", ")}`);
 		else {
-			await secretsStore.write(stage, stageSecrets);
-			logger.log(`   🔑 Generated for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
+			await secretsStore.write(stageSecrets);
+			logger.log(`   🔑 Generated for "${stage}" (${secretsStore.store}): ${generated.join(", ")}`);
 		}
 	}
 	const sniffedApps = await require_sniffer.sniffAllApps(workspace.apps, workspace.root);
@@ -2418,14 +2157,14 @@ async function preflight({ workspace, manifest, stage, ctx }) {
 		encryptedSecrets
 	};
 }
-/** Everything a deploy does while it holds the stage's lock. */
-async function deployLocked(run) {
-	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity, store, ctx } = run;
-	const { stageSecrets, sniffedApps, encryptedSecrets } = await preflight(run);
-	ctx.emit({
-		type: "phase.finished",
-		phase: "validate"
-	});
+/**
+* The project, environment and registry, then what the manifest declares.
+* Each is looked up — by the id the stage's state recorded, else by name —
+* before it is created, so a run stopped part way is finished by the next.
+*/
+async function provisionDokploy(run) {
+	const { workspace, manifest, stage, appsToDeployNames, identity, store, ctx } = run;
+	const { stageSecrets } = run.preflight;
 	const changes = [];
 	const applied = (change, via) => {
 		changes.push(change);
@@ -2435,11 +2174,6 @@ async function deployLocked(run) {
 			via
 		});
 	};
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "provision"
-	});
 	const { api, endpoint } = await dokployApi(workspace, ctx);
 	logger.log("\n📋 Loading deploy state...");
 	const journal = await DeployJournal.open(store, stage, () => require_sniffer.createEmptyState(stage, "", ""));
@@ -2511,7 +2245,7 @@ async function deployLocked(run) {
 				kind: "registry",
 				url
 			}, { signal: ctx.signal });
-			if (!login) throw new MissingCredential("registry", url);
+			if (!login) throw new require_terminal.MissingCredential("registry", url);
 			const created = await api.createRegistry("Default Registry", url, login.username, login.password);
 			registryCreated = true;
 			logger.log(`   ✓ Registry created: ${created.registryId}`);
@@ -2595,10 +2329,34 @@ async function deployLocked(run) {
 			logger.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
 		} else logger.log("   ✓ Using existing postgres backup schedule");
 	}
-	ctx.emit({
-		type: "phase.finished",
-		phase: "provision"
-	});
+	run.provisioned = {
+		api,
+		endpoint,
+		journal,
+		state,
+		projectId: project.projectId,
+		environmentId,
+		registry,
+		registryId,
+		declaredEnv,
+		changes,
+		applied
+	};
+}
+/**
+* Each app's image built and pushed, its application configured and
+* deployed, and its domain attached: backends first, each failure stopping
+* the run; then sites, whose build args are the backends' public URLs.
+*
+* Building is here rather than in a `build` phase of its own because an
+* image is built beside its application — a site's build args are resolved
+* per app, against the backends released before it.
+*/
+async function releaseDokploy(run) {
+	const { workspace, stage, imageTag, appsToDeployNames, identity, ctx } = run;
+	const { stageSecrets, sniffedApps, encryptedSecrets } = run.preflight;
+	const { api, journal, state, environmentId, registry, registryId, declaredEnv, changes, applied } = run.provisioned;
+	const project = { projectId: run.provisioned.projectId };
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
 	const publicUrls = {};
@@ -2634,7 +2392,7 @@ async function deployLocked(run) {
 		ctx.emit({
 			type: "app.failed",
 			app: appName,
-			error: eventError(error)
+			error: require_terminal.eventError(error)
 		});
 	};
 	/** An image is pushed: worth keeping even if what follows fails. */
@@ -2659,11 +2417,6 @@ async function deployLocked(run) {
 	};
 	const frontendUrls = [];
 	for (const appName of frontendApps) frontendUrls.push(`https://${hostOf(workspace, appName, stage)}`);
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "release"
-	});
 	if (backendApps.length > 0) {
 		logger.log("\n📦 PHASE 1: Deploying backend applications...");
 		for (const appName of backendApps) {
@@ -2829,15 +2582,17 @@ async function deployLocked(run) {
 	logger.log("\n📋 Saving deploy state...");
 	await journal.save();
 	logger.log("   ✓ State saved");
-	ctx.emit({
-		type: "phase.finished",
-		phase: "release"
-	});
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "verify"
-	});
+	run.released = {
+		results,
+		publicUrls,
+		appHostnames
+	};
+}
+/** DNS records for each released app, and Dokploy's validation of each domain. */
+async function verifyDokploy(run) {
+	const { workspace } = run;
+	const { api, endpoint, journal, state } = run.provisioned;
+	const { appHostnames } = run.released;
 	const dnsConfig = workspace.deploy.dns;
 	if (dnsConfig && appHostnames.size > 0) {
 		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, endpoint);
@@ -2857,10 +2612,14 @@ async function deployLocked(run) {
 			}
 		}
 	}
-	ctx.emit({
-		type: "phase.finished",
-		phase: "verify"
-	});
+}
+/** What the run did, printed as the summary it always ended with. */
+function dokployResult(run) {
+	if (run.result) return run.result;
+	const { stage, identity, imageTag } = run;
+	const { projectId, environmentId, changes } = run.provisioned;
+	const { results, publicUrls } = run.released;
+	const project = { projectId };
 	const successCount = results.filter((r) => r.success).length;
 	const failedCount = results.filter((r) => !r.success).length;
 	logger.log(`\n${"─".repeat(50)}`);
@@ -2882,7 +2641,7 @@ async function deployLocked(run) {
 		identity: identity.key,
 		tag: imageTag,
 		dryRun: false,
-		skipped: run.skipped,
+		skipped: [...run.skipped],
 		urls: publicUrls,
 		changes
 	};
@@ -2983,7 +2742,7 @@ async function dokployApi(workspace, ctx) {
 		kind: "dokploy",
 		...configured ? { endpoint: configured } : {}
 	}, { signal: ctx.signal });
-	if (!creds) throw new MissingCredential("dokploy", configured);
+	if (!creds) throw new require_terminal.MissingCredential("dokploy", configured);
 	return {
 		api: new require_sniffer.DokployApi({
 			baseUrl: creds.endpoint,
@@ -3003,19 +2762,9 @@ function hostOf(workspace, appName, stage) {
 * else: no lock, no state written, no secret generated, no Dokploy resource
 * created or changed, no image built or pushed.
 */
-async function planDeploy(run) {
+async function planDokploy(run) {
 	const { workspace, manifest, stage, imageTag, appsToDeployNames, identity } = run;
 	const { ctx } = run;
-	await preflight(run);
-	ctx.emit({
-		type: "phase.finished",
-		phase: "validate"
-	});
-	ctx.signal?.throwIfAborted();
-	ctx.emit({
-		type: "phase.started",
-		phase: "plan"
-	});
 	logger.log("\n🔎 Dry run: nothing will be created, changed, built or pushed.");
 	const changes = [];
 	const plan = (change, detail) => {
@@ -3130,11 +2879,7 @@ async function planDeploy(run) {
 	}
 	const creates = changes.filter((c) => c.action !== "reuse").length;
 	logger.log(`\n✅ Dry run complete: ${creates} to create or build, ${changes.length - creates} to reuse.`);
-	ctx.emit({
-		type: "phase.finished",
-		phase: "plan"
-	});
-	return {
+	run.result = {
 		apps,
 		projectId: project?.projectId ?? "",
 		environmentId: environment?.environmentId ?? "",
@@ -3144,7 +2889,7 @@ async function planDeploy(run) {
 		identity: identity.key,
 		tag: imageTag,
 		dryRun: true,
-		skipped: run.skipped,
+		skipped: [...run.skipped],
 		urls,
 		changes
 	};
@@ -3152,161 +2897,18 @@ async function planDeploy(run) {
 /** Why a mobile app is left out of a Dokploy deploy. */
 const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
-//#region src/deploy/deploy.ts
-/**
-* `deploy()`: a deploy as a library call.
-*
-* `gkm deploy` could only be driven from an interactive terminal: it prompted
-* for what it lacked and exited the process on failure, worked out of
-* `process.cwd()`, and reported progress by printing. Here the caller says
-* where the project is, hands over the credentials and a signal, and gets back
-* a run — events to iterate while it goes, and a structured result at the end.
-* Nothing below this asks a person anything or ends the process; `gkm deploy`
-* is a thin wrapper that does both.
-*/
-/**
-* Every event a run emits, kept so that each iteration — however late it
-* starts — sees the run from its first event to its last.
-*/
-var EventLog = class {
-	events = [];
-	closed = false;
-	waiting = [];
-	push(event) {
-		this.events.push(event);
-		this.wake();
-	}
-	close() {
-		this.closed = true;
-		this.wake();
-	}
-	wake() {
-		const waiting = this.waiting;
-		this.waiting = [];
-		for (const resume of waiting) resume();
-	}
-	async *iterate() {
-		let next = 0;
-		while (true) if (next < this.events.length) yield this.events[next++];
-		else if (this.closed) return;
-		else await new Promise((resume) => this.waiting.push(resume));
-	}
-};
-/** `childOutput` as `spawn` reads it, where it is not the default. */
-const CHILD_STDIO = {
-	stderr: [
-		"ignore",
-		2,
-		2
-	],
-	ignore: "ignore"
-};
-function forward(logger, level, message) {
-	if (!logger) return;
-	if (level === "info") logger.info(message);
-	else if (level === "error" && logger.error) logger.error(message);
-	else logger.warn(message);
-}
-/**
-* Deploy a project's stage.
-*
-* ```ts
-* import { deploy } from '@geekmidas/cli/deploy';
-*
-* const run = deploy({ cwd: '/srv/checkouts/shop', stage: 'production' });
-* for await (const event of run) {
-*   if (event.type === 'app.deployed') console.log(event.app, event.url);
-* }
-* const result = await run.result;
-* ```
-*
-* The run starts at once; iterating it is optional, and an iteration started
-* late still sees every event from the first.
-*/
-function deploy(input) {
-	const log = new EventLog();
-	const emit = (event) => {
-		log.push(event);
-		if (event.type === "log") forward(input.logger, event.level, event.message);
-	};
-	const ctx = {
-		emit,
-		credentials: input.credentials ?? storedCredentials({ home: input.home ?? require_home.gkmHome() }),
-		dryRun: input.dryRun ?? false,
-		home: input.home ?? require_home.gkmHome(),
-		...input.signal ? { signal: input.signal } : {},
-		...input.childOutput && input.childOutput !== "inherit" ? { stdio: CHILD_STDIO[input.childOutput] } : {}
-	};
-	const result = require_discover.withOutput((level, message) => emit({
-		type: "log",
-		level,
-		message
-	}), async () => {
-		try {
-			input.signal?.throwIfAborted();
-			const deployed = await runDeploy(() => load(input), {
-				stage: input.stage,
-				...input.tag ? { tag: input.tag } : {},
-				...input.apps ? { apps: input.apps } : {}
-			}, ctx);
-			emit({
-				type: "deploy.finished",
-				result: deployed
-			});
-			return deployed;
-		} catch (error) {
-			emit({
-				type: "deploy.failed",
-				error: eventError(error)
-			});
-			throw error;
-		} finally {
-			log.close();
-		}
-	});
-	result.catch(() => {});
-	return {
-		result,
-		[Symbol.asyncIterator]: () => log.iterate()
-	};
-}
-/** The workspace at `input.cwd`, refusing a stage it does not deploy. */
-async function load(input) {
-	const { workspace } = await require_config.loadWorkspaceConfig((0, node_path.resolve)(input.cwd));
-	require_workspace.assertDeployedStage(workspace.stages, input.stage);
-	return workspace;
-}
-//#endregion
 Object.defineProperty(exports, "BackendDeployFailed", {
 	enumerable: true,
 	get: function() {
 		return BackendDeployFailed;
 	}
 });
-Object.defineProperty(exports, "DeployProviderUnsupported", {
-	enumerable: true,
-	get: function() {
-		return DeployProviderUnsupported;
-	}
-});
-Object.defineProperty(exports, "MissingCredential", {
-	enumerable: true,
-	get: function() {
-		return MissingCredential;
-	}
-});
 Object.defineProperty(exports, "MissingEnvVars", {
 	enumerable: true,
 	get: function() {
 		return MissingEnvVars;
 	}
 });
-Object.defineProperty(exports, "NoDeployableApps", {
-	enumerable: true,
-	get: function() {
-		return NoDeployableApps;
-	}
-});
 Object.defineProperty(exports, "ProjectNotOwned", {
 	enumerable: true,
 	get: function() {
@@ -3331,35 +2933,41 @@ Object.defineProperty(exports, "RegistryNotFound", {
 		return RegistryNotFound;
 	}
 });
-Object.defineProperty(exports, "UnknownDeployApps", {
+Object.defineProperty(exports, "dokployResult", {
+	enumerable: true,
+	get: function() {
+		return dokployResult;
+	}
+});
+Object.defineProperty(exports, "planDokploy", {
 	enumerable: true,
 	get: function() {
-		return UnknownDeployApps;
+		return planDokploy;
 	}
 });
-Object.defineProperty(exports, "chainCredentials", {
+Object.defineProperty(exports, "provisionDokploy", {
 	enumerable: true,
 	get: function() {
-		return chainCredentials;
+		return provisionDokploy;
 	}
 });
-Object.defineProperty(exports, "deploy", {
+Object.defineProperty(exports, "releaseDokploy", {
 	enumerable: true,
 	get: function() {
-		return deploy;
+		return releaseDokploy;
 	}
 });
-Object.defineProperty(exports, "storedCredentials", {
+Object.defineProperty(exports, "validateDokploy", {
 	enumerable: true,
 	get: function() {
-		return storedCredentials;
+		return validateDokploy;
 	}
 });
-Object.defineProperty(exports, "terminalCredentials", {
+Object.defineProperty(exports, "verifyDokploy", {
 	enumerable: true,
 	get: function() {
-		return terminalCredentials;
+		return verifyDokploy;
 	}
 });
 
-//# sourceMappingURL=deploy-BbJdgQ2b.cjs.map
+//# sourceMappingURL=deploy-ABBI0lf1.cjs.map