@geekmidas/cli 10.0.0-alpha.61 → 10.0.0-alpha.63

package/dist/target/public.cjs

@@ -0,0 +1,15 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_define = require("../define-Cv_QvDrg.cjs");
+const require_runtime = require("../runtime-CMwtq0AL.cjs");
+const require_resolve = require("../resolve-xytBTtG4.cjs");
+exports.DeployTargetNotYetSupported = require_define.DeployTargetNotYetSupported;
+exports.InvalidTargetOptions = require_resolve.InvalidTargetOptions;
+exports.ProviderRemoved = require_resolve.ProviderRemoved;
+exports.TargetEntryInvalid = require_resolve.TargetEntryInvalid;
+exports.TargetPackageInvalid = require_resolve.TargetPackageInvalid;
+exports.TargetPackageNotFound = require_runtime.TargetPackageNotFound;
+exports.TargetRuntimeMismatch = require_resolve.TargetRuntimeMismatch;
+exports.TargetRuntimeUndeclared = require_runtime.TargetRuntimeUndeclared;
+exports.UnknownDeployTarget = require_define.UnknownDeployTarget;
+exports.defineTarget = require_define.defineTarget;
+exports.isDeployTarget = require_define.isDeployTarget;

package/dist/target/public.d.cts

@@ -0,0 +1,28 @@
+import { $ as DeployEventError, B as DeployFailure, G as DeployTargetCapabilities, H as DeployRuntime, J as TargetEvent, K as DeployTargetEntry, Q as DeployEvent, U as DeploySecrets, V as DeployPhaseContext, W as DeployTarget, X as TargetOptionsIssue, Y as TargetOptions, Z as TargetOptionsSchema, at as DeployResult, ct as CredentialKinds, et as DeployEventType, gt as StateStore, it as AppDeployResult, lt as CredentialProvider, nt as ResourceChange, ot as Credential, q as DeployTargetLogger, rt as ResourceVia, st as CredentialKind, tt as DeployPhase, ut as CredentialRequest, vt as StageSecrets, yt as DeployIdentity, z as AnyDeployTarget } from "../types-DIA7Li-J.cjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-Dn_n-29S.cjs";
+//#region src/target/define.d.ts
+/**
+ * A deploy target, typed from what it is written with: the options from its
+ * `options` schema, the run state from what `validate` returns. Nothing
+ * happens at runtime — it returns the target as given.
+ *
+ * ```ts
+ * export default defineTarget({
+ *   name: 'fly',
+ *   runtime: 'server',
+ *   capabilities: { rollback: true, migrations: 'target', images: true },
+ *   options: z.object({ org: z.string() }),
+ *   async validate(ctx) {
+ *     return { org: ctx.options.org }; // ctx.options: { org: string }
+ *   },
+ *   async release(ctx, run) { … },       // run: { org: string }
+ *   …
+ * });
+ * ```
+ */
+export declare function defineTarget<Options = undefined, Run = void>(target: DeployTarget<Options, Run>): DeployTarget<Options, Run>;
+/** Whether `value` has the shape of a target. */
+export declare function isDeployTarget(value: unknown): value is AnyDeployTarget;
+//#endregion
+export { type AnyDeployTarget, type AppDeployResult, type Credential, type CredentialKind, type CredentialKinds, type CredentialProvider, type CredentialRequest, type DeployEvent, type DeployEventError, type DeployEventType, type DeployFailure, type DeployIdentity, type DeployPhase, type DeployPhaseContext, type DeployResult, type DeployRuntime, type DeploySecrets, type DeployTarget, type DeployTargetCapabilities, type DeployTargetEntry, type DeployTargetLogger, DeployTargetNotYetSupported, InvalidTargetOptions, ProviderRemoved, type ResourceChange, type ResourceVia, type StageSecrets, type StateStore, TargetEntryInvalid, type TargetEvent, type TargetOptions, type TargetOptionsIssue, type TargetOptionsSchema, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget };
+//# sourceMappingURL=public.d.cts.map

package/dist/target/public.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/target/define.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;wBAqBgB,aAAa,qBAAqB,YACjD,QAAQ,aAAa,SAAS,OAC5B,aAAa,SAAS;;wBAKT,eAAe,iBAAiB,SAAS"}

package/dist/target/public.d.mts

@@ -0,0 +1,28 @@
+import { $ as DeployEventError, B as DeployFailure, G as DeployTargetCapabilities, H as DeployRuntime, J as TargetEvent, K as DeployTargetEntry, Q as DeployEvent, U as DeploySecrets, V as DeployPhaseContext, W as DeployTarget, X as TargetOptionsIssue, Y as TargetOptions, Z as TargetOptionsSchema, at as DeployResult, ct as CredentialKinds, et as DeployEventType, gt as StateStore, it as AppDeployResult, lt as CredentialProvider, nt as ResourceChange, ot as Credential, q as DeployTargetLogger, rt as ResourceVia, st as CredentialKind, tt as DeployPhase, ut as CredentialRequest, vt as StageSecrets, yt as DeployIdentity, z as AnyDeployTarget } from "../types-CfLKGfC_.mjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-CXPlkZzs.mjs";
+//#region src/target/define.d.ts
+/**
+ * A deploy target, typed from what it is written with: the options from its
+ * `options` schema, the run state from what `validate` returns. Nothing
+ * happens at runtime — it returns the target as given.
+ *
+ * ```ts
+ * export default defineTarget({
+ *   name: 'fly',
+ *   runtime: 'server',
+ *   capabilities: { rollback: true, migrations: 'target', images: true },
+ *   options: z.object({ org: z.string() }),
+ *   async validate(ctx) {
+ *     return { org: ctx.options.org }; // ctx.options: { org: string }
+ *   },
+ *   async release(ctx, run) { … },       // run: { org: string }
+ *   …
+ * });
+ * ```
+ */
+export declare function defineTarget<Options = undefined, Run = void>(target: DeployTarget<Options, Run>): DeployTarget<Options, Run>;
+/** Whether `value` has the shape of a target. */
+export declare function isDeployTarget(value: unknown): value is AnyDeployTarget;
+//#endregion
+export { type AnyDeployTarget, type AppDeployResult, type Credential, type CredentialKind, type CredentialKinds, type CredentialProvider, type CredentialRequest, type DeployEvent, type DeployEventError, type DeployEventType, type DeployFailure, type DeployIdentity, type DeployPhase, type DeployPhaseContext, type DeployResult, type DeployRuntime, type DeploySecrets, type DeployTarget, type DeployTargetCapabilities, type DeployTargetEntry, type DeployTargetLogger, DeployTargetNotYetSupported, InvalidTargetOptions, ProviderRemoved, type ResourceChange, type ResourceVia, type StageSecrets, type StateStore, TargetEntryInvalid, type TargetEvent, type TargetOptions, type TargetOptionsIssue, type TargetOptionsSchema, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget };
+//# sourceMappingURL=public.d.mts.map

package/dist/target/public.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.d.mts","names":[],"sources":["../../src/target/define.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;wBAqBgB,aAAa,qBAAqB,YACjD,QAAQ,aAAa,SAAS,OAC5B,aAAa,SAAS;;wBAKT,eAAe,iBAAiB,SAAS"}

package/dist/target/public.mjs

@@ -0,0 +1,4 @@
+import { a as UnknownDeployTarget, i as DeployTargetNotYetSupported, n as isDeployTarget, t as defineTarget } from "../define-CHBIEc5j.mjs";
+import { i as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-DbakJS8u.mjs";
+import { i as TargetRuntimeMismatch, n as TargetEntryInvalid, r as TargetPackageInvalid, s as ProviderRemoved, t as InvalidTargetOptions } from "../resolve-B1T0hUaR.mjs";
+export { DeployTargetNotYetSupported, InvalidTargetOptions, ProviderRemoved, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, defineTarget, isDeployTarget };

package/dist/terminal-D0f1u0LG.cjs

@@ -0,0 +1,576 @@
+const require_sniffer = require("./sniffer-D_SYc_pO.cjs");
+const require_discover = require("./discover-C_6COHEv.cjs");
+const require_config = require("./config-BEJYKd4s.cjs");
+const require_define = require("./define-Cv_QvDrg.cjs");
+const require_workspace = require("./workspace-Kl4NG9IH.cjs");
+const require_store = require("./store-KvNQwYaB.cjs");
+const require_resolve = require("./resolve-xytBTtG4.cjs");
+//#region src/deploy/credentials.ts
+/**
+* How a deploy gets the credentials it acts with.
+*
+* `deploy()` never prompts and never reads a terminal: it asks a
+* `CredentialProvider` and, when the provider has nothing, stops with
+* `MissingCredential` naming what it needed and how to supply it. Whether to
+* ask a person, read a vault or fail is the caller's decision — `gkm deploy`
+* prompts at a terminal and stores what was typed; a CI job sets the
+* environment; a host passes its own provider.
+*/
+/**
+* How to supply each kind the CLI knows, for the error that says it is
+* missing. A target's own kinds are its to explain.
+*/
+const HOW_TO_PROVIDE = {
+	dokploy: "Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.",
+	registry: "Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them."
+};
+/** A deploy needed a credential, and its provider had none. */
+var MissingCredential = class extends Error {
+	kind;
+	target;
+	howToProvide;
+	constructor(kind, target, howToProvide = HOW_TO_PROVIDE[kind] ?? "Pass it through the deploy's CredentialProvider.") {
+		const what = kind === "dokploy" ? `No Dokploy credentials${target ? ` for ${target}` : ""}.` : kind === "registry" ? `Dokploy has no registry for ${target ?? "the configured registry"}, and there are no credentials to create one with.` : `No "${String(kind)}" credentials${target ? ` for ${target}` : ""}.`;
+		super(`${what} ${howToProvide}`);
+		this.kind = kind;
+		this.target = target;
+		this.howToProvide = howToProvide;
+		this.name = "MissingCredential";
+	}
+};
+/** Whatever was asked for, from the first provider that has it. */
+function chainCredentials(...providers) {
+	return { async get(request, options) {
+		for (const provider of providers) {
+			const found = await provider.get(request, options);
+			if (found) return found;
+		}
+	} };
+}
+/**
+* Credentials from the environment, then from what `gkm login` stored. What
+* `deploy()` uses when it is handed no provider.
+*
+* - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
+*   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
+*   Each half is read on its own: a token is a secret and belongs in the
+*   environment, an endpoint is configuration and belongs in the config.
+* - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
+*/
+function storedCredentials(options = {}) {
+	const env = options.env ?? process.env;
+	return { async get(asked) {
+		const request = asked;
+		switch (request.kind) {
+			case "dokploy": {
+				const stored = (await require_sniffer.readCredentials(options.home ? { home: options.home } : void 0)).dokploy;
+				const token = env.DOKPLOY_API_TOKEN ?? stored?.token;
+				const endpoint = env.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;
+				if (!token || !endpoint) return void 0;
+				return {
+					endpoint: endpoint.replace(/\/$/, ""),
+					token
+				};
+			}
+			case "registry": {
+				const username = env.DOCKER_REGISTRY_USERNAME;
+				const password = env.DOCKER_REGISTRY_PASSWORD;
+				if (!username || !password) return void 0;
+				return {
+					username,
+					password
+				};
+			}
+		}
+	} };
+}
+//#endregion
+//#region src/target/secrets.ts
+/**
+* A stage's secrets as a target sees them: read and written through the
+* stage's own store, and masked in everything the run prints once read.
+*/
+/**
+* Shorter values are left alone: what a progress line legitimately prints —
+* a port, a stage, an app name — would otherwise come out as `***` wherever
+* a secret happened to share it.
+*/
+const SHORTEST_MASKED = 6;
+/** The values a run must never print, and the rewrite that keeps it so. */
+var Redactor = class {
+	values = /* @__PURE__ */ new Set();
+	add(value) {
+		if (value && value.length >= SHORTEST_MASKED) this.values.add(value);
+	}
+	/** `text` with every masked value replaced by `***`, longest first. */
+	redact(text) {
+		if (this.values.size === 0) return text;
+		let out = text;
+		const longestFirst = [...this.values].sort((a, b) => b.length - a.length);
+		for (const value of longestFirst) out = out.replaceAll(value, "***");
+		return out;
+	}
+};
+/** Every value in `secrets` that is a secret rather than a label. */
+function secretValues(secrets) {
+	return [
+		secrets.seed,
+		...Object.values(secrets.custom ?? {}),
+		...Object.values(secrets.urls ?? {}),
+		...Object.values(secrets.services ?? {}).map((service) => service?.password)
+	].filter((value) => typeof value === "string");
+}
+/**
+* The stage's secrets through the store `secrets.store` names for it. Opening
+* one builds a client and makes no request, so a target that never reads them
+* costs nothing.
+*/
+async function deploySecrets(workspace, stage, redactor, options = {}) {
+	const store = await require_store.secretsStoreFor(workspace, stage, options);
+	const mask = (secrets) => {
+		for (const value of secretValues(secrets)) redactor.add(value);
+	};
+	return {
+		store: store.name,
+		async read() {
+			const secrets = await store.read(stage);
+			if (secrets) mask(secrets);
+			return secrets;
+		},
+		async write(secrets) {
+			mask(secrets);
+			await store.write(stage, secrets);
+		},
+		mask: (value) => redactor.add(value)
+	};
+}
+//#endregion
+//#region src/deploy/events.ts
+/** An error as an event carries it: its name and message, nothing else. */
+function eventError(error) {
+	if (error instanceof Error) return {
+		name: error.name,
+		message: error.message
+	};
+	return {
+		name: "Error",
+		message: String(error)
+	};
+}
+//#endregion
+//#region src/deploy/orchestrate.ts
+/**
+* The run around a target: what every deploy does whatever it deploys
+* through.
+*
+* It loads the workspace, resolves the target, works out the apps and the
+* identity, takes the stage's lock, and calls the target's phases in order,
+* reporting each as it starts, finishes or fails. Everything that is about
+* *where* the stage goes is the target's.
+*/
+/** Apps were asked for by name that the workspace does not have. */
+var UnknownDeployApps = class extends Error {
+	apps;
+	available;
+	constructor(apps, available) {
+		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
+		this.apps = apps;
+		this.available = available;
+		this.name = "UnknownDeployApps";
+	}
+};
+/** Every app asked for deploys through some other target. */
+var NoDeployableApps = class extends Error {
+	stage;
+	target;
+	constructor(stage, target) {
+		super(`No apps to deploy through "${target}": every selected app deploys somewhere else. Pick the target with --target, or set each app's deploy in gkm.config.ts.`);
+		this.stage = stage;
+		this.target = target;
+		this.name = "NoDeployableApps";
+	}
+};
+/** A failed rollback, after the failure that called for it. */
+var RollbackFailed = class extends Error {
+	target;
+	failure;
+	constructor(target, failure, cause) {
+		super(`Deploying through "${target}" failed, and so did rolling it back: ${cause instanceof Error ? cause.message : String(cause)}. The stage may be part-released; deploy again, or roll it back by hand. The first failure: ${failure instanceof Error ? failure.message : String(failure)}`, { cause });
+		this.target = target;
+		this.failure = failure;
+		this.name = "RollbackFailed";
+	}
+};
+/**
+* Generate image tag from stage and timestamp
+*/
+function generateTag(stage) {
+	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
+}
+/** Why an app that deploys through another target is left out. */
+function elsewhere(target, stage) {
+	const instead = require_define.builtinTarget(target)?.instead?.(stage);
+	if (target === "sst" && instead) return `it deploys with SST — ${instead}`;
+	return `it deploys through "${target}" — run \`gkm deploy --target ${target} --stage ${stage}\``;
+}
+/**
+* Deploy a workspace's stage through its target.
+*
+* The engine under `deploy()` and `gkm deploy`. It never prompts and never
+* exits: credentials come from `ctx.credentials`, progress goes to
+* `ctx.emit` and to `output`, and every failure is thrown.
+*
+* @internal
+*/
+async function runDeploy(source, request, ctx) {
+	const { stage } = request;
+	const redactor = ctx.redactor ?? new Redactor();
+	const emit = (event) => ctx.emit(event.type === "log" ? {
+		...event,
+		message: redactor.redact(event.message)
+	} : event);
+	/** Run one phase between its events. */
+	const phase = async (name, body) => {
+		ctx.signal?.throwIfAborted();
+		emit({
+			type: "phase.started",
+			phase: name
+		});
+		try {
+			const value = await body();
+			emit({
+				type: "phase.finished",
+				phase: name
+			});
+			return value;
+		} catch (error) {
+			emit({
+				type: "phase.failed",
+				phase: name,
+				error: eventError(error)
+			});
+			throw error;
+		}
+	};
+	ctx.signal?.throwIfAborted();
+	emit({
+		type: "phase.started",
+		phase: "validate"
+	});
+	let prepared;
+	try {
+		prepared = await prepare(source, request, ctx, emit, redactor);
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: eventError(error)
+		});
+		throw error;
+	}
+	const { resolved, phaseCtx, store } = prepared;
+	const { target } = resolved;
+	if (ctx.dryRun) {
+		const run = await validate(target, phaseCtx, emit);
+		await phase("plan", () => target.plan(phaseCtx, run));
+		return target.result(phaseCtx, run);
+	}
+	let lock;
+	try {
+		lock = await store.lock(stage, { operation: "deploy" });
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: eventError(error)
+		});
+		throw error;
+	}
+	try {
+		const run = await validate(target, phaseCtx, emit);
+		if (target.provision) await phase("provision", () => target.provision(phaseCtx, run));
+		if (target.build) await phase("build", () => target.build(phaseCtx, run));
+		let releasing = "release";
+		try {
+			await phase("release", () => target.release(phaseCtx, run));
+			releasing = "verify";
+			if (target.verify) await phase("verify", () => target.verify(phaseCtx, run));
+		} catch (error) {
+			if (ctx.signal?.aborted || !target.capabilities.rollback) throw error;
+			if (!target.rollback) throw error;
+			try {
+				await phase("rollback", () => target.rollback(phaseCtx, run, {
+					phase: releasing,
+					error
+				}));
+			} catch (rollbackError) {
+				throw new RollbackFailed(resolved.name, error, rollbackError);
+			}
+			throw error;
+		}
+		return await target.result(phaseCtx, run);
+	} finally {
+		await lock.release();
+	}
+}
+/** `validate`, then the run's `deploy.started`, inside the validate phase. */
+async function validate(target, phaseCtx, emit) {
+	try {
+		const run = await target.validate(phaseCtx);
+		const skipped = new Set(phaseCtx.skipped.map((s) => s.app));
+		emit({
+			type: "deploy.started",
+			stage: phaseCtx.stage,
+			target: phaseCtx.target,
+			identity: phaseCtx.identity.key,
+			tag: phaseCtx.tag,
+			apps: phaseCtx.apps.filter((app) => !skipped.has(app)),
+			dryRun: phaseCtx.dryRun
+		});
+		emit({
+			type: "phase.finished",
+			phase: "validate"
+		});
+		return run;
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: eventError(error)
+		});
+		throw error;
+	}
+}
+/** Everything the phases are handed, worked out before the first of them. */
+async function prepare(source, request, ctx, emit, redactor) {
+	const { stage } = request;
+	const configured = typeof source === "function" ? await source() : source;
+	const targetName = request.target ?? configured.deploy?.default ?? "dokploy";
+	const resolved = await require_resolve.resolveTarget(targetName, {
+		workspace: configured,
+		stage,
+		...ctx.targets ? { host: ctx.targets } : {}
+	});
+	const options = await require_resolve.parseTargetOptions(resolved);
+	const manifest = await require_discover.discover({
+		patterns: require_sniffer.constructGlobs(configured),
+		cwd: configured.root
+	});
+	const units = require_config.derivedApps(manifest, configured);
+	const workspace = Object.keys(units).length > 0 ? {
+		...configured,
+		apps: units
+	} : configured;
+	const identity = require_store.deployIdentity(workspace, stage);
+	const tag = request.tag ?? generateTag(stage);
+	const buildOrder = require_workspace.getAppBuildOrder(workspace);
+	let selected = buildOrder;
+	if (request.apps && request.apps.length > 0) {
+		const unknown = request.apps.filter((name) => !workspace.apps[name]);
+		if (unknown.length > 0) throw new UnknownDeployApps(unknown, Object.keys(workspace.apps));
+		selected = buildOrder.filter((name) => request.apps.includes(name));
+	}
+	const skipped = [];
+	const skip = (app, reason) => {
+		skipped.push({
+			app,
+			reason
+		});
+		emit({
+			type: "app.skipped",
+			app,
+			reason
+		});
+	};
+	const byDefault = configured.deploy?.default ?? "dokploy";
+	const apps = selected.filter((name) => {
+		const own = workspace.apps[name].resolvedDeployTarget;
+		const deploysThrough = own === byDefault ? targetName : own;
+		if (deploysThrough === targetName) return true;
+		skip(name, elsewhere(deploysThrough, stage));
+		return false;
+	});
+	if (apps.length === 0) throw new NoDeployableApps(stage, targetName);
+	const store = await require_sniffer.createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	});
+	const secrets = await deploySecrets(workspace, stage, redactor, { ...ctx.home ? { home: ctx.home } : {} });
+	const line = (level) => (message) => emit({
+		type: "log",
+		level,
+		message
+	});
+	const logger = {
+		info: line("info"),
+		warn: line("warn"),
+		error: line("error")
+	};
+	return {
+		resolved,
+		phaseCtx: {
+			target: targetName,
+			cwd: workspace.root,
+			stage,
+			tag,
+			apps,
+			skipped,
+			identity,
+			workspace,
+			manifest,
+			options,
+			dryRun: ctx.dryRun,
+			credentials: ctx.credentials,
+			state: store,
+			secrets,
+			logger,
+			signal: ctx.signal ?? new AbortController().signal,
+			childOutput: ctx.childOutput ?? "inherit",
+			emit,
+			skip,
+			name: (resource) => require_store.applicationName(identity, resource)
+		},
+		store
+	};
+}
+//#endregion
+//#region src/deploy/terminal.ts
+/**
+* The credentials `gkm deploy` can ask a person for. CLI layer only.
+*
+* `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`
+* when the answer is nothing. At a terminal, `gkm deploy` would rather ask:
+* this provider reads the environment and the stored login first, and only
+* when both are empty prompts — and stores a Dokploy login it validated, so
+* the next deploy does not ask again. With no terminal it answers nothing, and
+* the deploy says what was missing instead of waiting on a prompt nobody sees.
+*/
+const logger = require_discover.output;
+/** What answers a deploy prompt without a terminal. */
+const INSTEAD = "Please configure manually.";
+/** The Dokploy URL typed at the prompt is not a URL. */
+var DokployEndpointInvalid = class extends Error {
+	endpoint;
+	constructor(endpoint) {
+		super("Invalid URL format");
+		this.endpoint = endpoint;
+		this.name = "DokployEndpointInvalid";
+	}
+};
+/** Dokploy refused the token typed at the prompt; nothing was stored. */
+var DokployTokenRejected = class extends Error {
+	endpoint;
+	constructor(endpoint) {
+		super("Invalid credentials. Please check your token.");
+		this.endpoint = endpoint;
+		this.name = "DokployTokenRejected";
+	}
+};
+/** Asks the person at the terminal for what nothing else supplied. */
+function asking() {
+	return { async get(asked) {
+		if (!require_sniffer.canPrompt()) return void 0;
+		const request = asked;
+		if (request.kind === "dokploy") {
+			logger.log("\n📋 Dokploy credentials not found. Let's set them up.");
+			const endpoint = (await require_sniffer.prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: INSTEAD })).replace(/\/$/, "");
+			try {
+				new URL(endpoint);
+			} catch {
+				throw new DokployEndpointInvalid(endpoint);
+			}
+			logger.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			const token = await require_sniffer.prompt("API Token: ", {
+				hidden: true,
+				instead: INSTEAD
+			});
+			logger.log("\nValidating credentials...");
+			if (!await require_sniffer.validateDokployToken(endpoint, token)) throw new DokployTokenRejected(endpoint);
+			await require_sniffer.storeDokployCredentials(token, endpoint);
+			logger.log("✓ Credentials saved");
+			return {
+				endpoint,
+				token
+			};
+		}
+		logger.log(`   Dokploy has no registry for ${request.url}. Let's create one.`);
+		return {
+			username: await require_sniffer.prompt("Registry username: ", { instead: INSTEAD }),
+			password: await require_sniffer.prompt("Registry password/token: ", {
+				hidden: true,
+				instead: INSTEAD
+			})
+		};
+	} };
+}
+/**
+* The environment, then the stored login, then — at a terminal — the person
+* running the command.
+*/
+function terminalCredentials(base = storedCredentials()) {
+	return chainCredentials(base, asking());
+}
+//#endregion
+Object.defineProperty(exports, "MissingCredential", {
+	enumerable: true,
+	get: function() {
+		return MissingCredential;
+	}
+});
+Object.defineProperty(exports, "NoDeployableApps", {
+	enumerable: true,
+	get: function() {
+		return NoDeployableApps;
+	}
+});
+Object.defineProperty(exports, "Redactor", {
+	enumerable: true,
+	get: function() {
+		return Redactor;
+	}
+});
+Object.defineProperty(exports, "RollbackFailed", {
+	enumerable: true,
+	get: function() {
+		return RollbackFailed;
+	}
+});
+Object.defineProperty(exports, "UnknownDeployApps", {
+	enumerable: true,
+	get: function() {
+		return UnknownDeployApps;
+	}
+});
+Object.defineProperty(exports, "chainCredentials", {
+	enumerable: true,
+	get: function() {
+		return chainCredentials;
+	}
+});
+Object.defineProperty(exports, "eventError", {
+	enumerable: true,
+	get: function() {
+		return eventError;
+	}
+});
+Object.defineProperty(exports, "runDeploy", {
+	enumerable: true,
+	get: function() {
+		return runDeploy;
+	}
+});
+Object.defineProperty(exports, "storedCredentials", {
+	enumerable: true,
+	get: function() {
+		return storedCredentials;
+	}
+});
+Object.defineProperty(exports, "terminalCredentials", {
+	enumerable: true,
+	get: function() {
+		return terminalCredentials;
+	}
+});
+
+//# sourceMappingURL=terminal-D0f1u0LG.cjs.map