@geekmidas/cli 10.0.0-alpha.63 → 10.0.0-alpha.65

package/dist/{deploy-BiMrP9i7.cjs → deploy-B80idPUZ.cjs}

@@ -1,9 +1,9 @@
-const require_sniffer = require("./sniffer-D_SYc_pO.cjs");
-const require_home = require("./home-DOzBaWaL.cjs");
-const require_discover = require("./discover-C_6COHEv.cjs");
-const require_config = require("./config-BEJYKd4s.cjs");
-const require_workspace = require("./workspace-Kl4NG9IH.cjs");
-const require_terminal = require("./terminal-D0f1u0LG.cjs");
+const require_sniffer = require("./sniffer-BSwaL-dX.cjs");
+const require_local = require("./local-BdH4XN0E.cjs");
+const require_credentials = require("./credentials-Bzbg23n8.cjs");
+const require_discover = require("./discover-DHdECueV.cjs");
+const require_sandbox = require("./sandbox-CL--ZDui.cjs");
+const require_config = require("./config.cjs");
 let node_path = require("node:path");
 //#region src/deploy/deploy.ts
 /**
@@ -69,7 +69,7 @@ function forward(logger, level, message) {
 */
 function deploy(input) {
 	const log = new EventLog();
-	const redactor = new require_terminal.Redactor();
+	const redactor = new require_sniffer.Redactor();
 	const emit = (event) => {
 		const masked = event.type === "log" ? {
 			...event,
@@ -80,9 +80,9 @@ function deploy(input) {
 	};
 	const ctx = {
 		emit,
-		credentials: input.credentials ?? require_terminal.storedCredentials({ home: input.home ?? require_home.gkmHome() }),
+		credentials: input.credentials ?? require_credentials.storedCredentials({ home: input.home ?? require_local.gkmHome() }),
 		dryRun: input.dryRun ?? false,
-		home: input.home ?? require_home.gkmHome(),
+		home: input.home ?? require_local.gkmHome(),
 		redactor,
 		...input.signal ? { signal: input.signal } : {},
 		...input.childOutput ? { childOutput: input.childOutput } : {},
@@ -95,8 +95,8 @@ function deploy(input) {
 	}), async () => {
 		try {
 			input.signal?.throwIfAborted();
-			const sandbox = input.sandbox ?? new require_sniffer.LocalSandbox({ root: require_config.findWorkspaceRoot((0, node_path.resolve)(input.cwd)) });
-			const deployed = await require_discover.withSandbox(sandbox, () => require_terminal.runDeploy(() => load(input, sandbox), {
+			const sandbox = input.sandbox ?? new require_local.LocalSandbox({ root: require_config.findWorkspaceRoot((0, node_path.resolve)(input.cwd)) });
+			const deployed = await require_sandbox.withSandbox(sandbox, () => require_sniffer.runDeploy(() => load(input, sandbox), {
 				stage: input.stage,
 				...input.target ? { target: input.target } : {},
 				...input.tag ? { tag: input.tag } : {},
@@ -110,7 +110,7 @@ function deploy(input) {
 		} catch (error) {
 			emit({
 				type: "deploy.failed",
-				error: require_terminal.eventError(error)
+				error: require_sniffer.eventError(error)
 			});
 			throw error;
 		} finally {
@@ -123,10 +123,12 @@ function deploy(input) {
 		[Symbol.asyncIterator]: () => log.iterate()
 	};
 }
-/** The workspace at `input.cwd`, refusing a stage it does not deploy. */
+/**
+* The workspace at `input.cwd`. The stage is checked by the run, once it
+* knows the target: one that runs on this machine may take the local stage.
+*/
 async function load(input, sandbox) {
 	const { workspace } = await require_config.loadWorkspaceConfig((0, node_path.resolve)(input.cwd), { sandbox });
-	require_workspace.assertDeployedStage(workspace.stages, input.stage);
 	return workspace;
 }
 //#endregion
@@ -137,4 +139,4 @@ Object.defineProperty(exports, "deploy", {
 	}
 });
 
-//# sourceMappingURL=deploy-BiMrP9i7.cjs.map
+//# sourceMappingURL=deploy-B80idPUZ.cjs.map

package/dist/deploy-B80idPUZ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-B80idPUZ.cjs","names":["Redactor","storedCredentials","gkmHome","withOutput","LocalSandbox","findWorkspaceRoot","resolve","withSandbox","runDeploy","eventError","loadWorkspaceConfig"],"sources":["../src/deploy/deploy.ts"],"sourcesContent":["/**\n * `deploy()`: a deploy as a library call.\n *\n * `gkm deploy` could only be driven from an interactive terminal: it prompted\n * for what it lacked and exited the process on failure, worked out of\n * `process.cwd()`, and reported progress by printing. Here the caller says\n * where the project is, hands over the credentials and a signal, and gets back\n * a run — events to iterate while it goes, and a structured result at the end.\n * Nothing below this asks a person anything or ends the process; `gkm deploy`\n * is a thin wrapper that does both.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../config';\nimport { gkmHome } from '../home';\nimport { type OutputLevel, withOutput } from '../output';\nimport { LocalSandbox } from '../sandbox/local';\nimport { type Sandbox, withSandbox } from '../sandbox/sandbox';\nimport { Redactor } from '../target/secrets';\nimport type { AnyDeployTarget } from '../target/types';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { type CredentialProvider, storedCredentials } from './credentials';\nimport { type DeployEvent, eventError } from './events';\nimport { type DeployContext, runDeploy } from './orchestrate';\nimport type { DeployResult } from './types';\n\n/**\n * Where a run's progress lines go, besides its events. `@geekmidas/logger`'s\n * `Logger` is one.\n */\nexport interface DeployLogger {\n\tinfo(message: string): void;\n\twarn(message: string): void;\n\terror?(message: string): void;\n}\n\nexport interface DeployInput {\n\t/**\n\t * The project to deploy: the directory holding `gkm.config.ts`, or any\n\t * directory inside it. Never assumed to be `process.cwd()`.\n\t */\n\tcwd: string;\n\t/**\n\t * The stage to deploy — one of the config's deployed stages, or its local\n\t * stage through a target that runs one (`compose`).\n\t */\n\tstage: string;\n\t/**\n\t * The target to deploy through, by name. Defaults to `deploy.default`,\n\t * else `dokploy`.\n\t */\n\ttarget?: string;\n\t/**\n\t * The host's own targets, by name. Consulted before the built-ins and the\n\t * config's `deploy.targets`, so a host can deploy through an\n\t * implementation of its own — `{ dokploy: myDokploy }` included.\n\t */\n\ttargets?: Record<string, AnyDeployTarget>;\n\t/** The image tag. Defaults to `<stage>-<timestamp>`. */\n\ttag?: string;\n\t/** Deploy only these apps (in dependency order). Defaults to all. */\n\tapps?: string[];\n\t/**\n\t * Look everything up and report what would happen — as `resource.planned`\n\t * events — without taking the lock, writing state, generating secrets,\n\t * changing Dokploy or building and pushing images.\n\t */\n\tdryRun?: boolean;\n\t/**\n\t * Where credentials come from. Defaults to the environment, then the\n\t * logins `gkm login` stored. A credential no provider has stops the run\n\t * with `MissingCredential`; nothing prompts.\n\t */\n\tcredentials?: CredentialProvider;\n\t/** Receives each progress line as it is written. Defaults to none. */\n\tlogger?: DeployLogger;\n\t/**\n\t * Stops the run: in-flight Dokploy requests and docker children are\n\t * cancelled, the stage's lock is released, and `result` rejects with the\n\t * signal's reason.\n\t */\n\tsignal?: AbortSignal;\n\t/**\n\t * The CLI's home: stage keys and stored logins. Defaults to `GKM_HOME`,\n\t * else `~/.gkm`.\n\t */\n\thome?: string;\n\t/**\n\t * Where docker's own output goes: the host's terminal (`inherit`, the\n\t * default), its stderr, or nowhere.\n\t */\n\tchildOutput?: 'inherit' | 'stderr' | 'ignore';\n\t/**\n\t * Where the project's own code runs: loading `gkm.config.ts`, discovering\n\t * its constructs, sniffing each app's environment. Defaults to a\n\t * `LocalSandbox` on the project — a child process here with an\n\t * allowlisted environment, for a project the host trusts.\n\t *\n\t * A host deploying repositories it does not trust passes one that\n\t * isolates — a container per build — and the config then reaches the\n\t * deploy only as data. Credentials never enter a sandbox: they go from\n\t * `credentials` to the steps that provision, push and release.\n\t */\n\tsandbox?: Sandbox;\n}\n\n/** A deploy in progress. */\nexport interface DeployRun extends AsyncIterable<DeployEvent> {\n\t/**\n\t * What the deploy did, once it is done. Rejects with the error that\n\t * stopped it — `MissingCredential`, `StateLocked`, `ProjectNotOwned`, … —\n\t * after a `deploy.failed` event carrying the same.\n\t */\n\treadonly result: Promise<DeployResult>;\n}\n\n/**\n * Every event a run emits, kept so that each iteration — however late it\n * starts — sees the run from its first event to its last.\n */\nclass EventLog {\n\tprivate readonly events: DeployEvent[] = [];\n\tprivate closed = false;\n\tprivate waiting: (() => void)[] = [];\n\n\tpush(event: DeployEvent): void {\n\t\tthis.events.push(event);\n\t\tthis.wake();\n\t}\n\n\tclose(): void {\n\t\tthis.closed = true;\n\t\tthis.wake();\n\t}\n\n\tprivate wake(): void {\n\t\tconst waiting = this.waiting;\n\t\tthis.waiting = [];\n\t\tfor (const resume of waiting) resume();\n\t}\n\n\tasync *iterate(): AsyncGenerator<DeployEvent> {\n\t\tlet next = 0;\n\t\twhile (true) {\n\t\t\tif (next < this.events.length) {\n\t\t\t\tyield this.events[next++]!;\n\t\t\t} else if (this.closed) {\n\t\t\t\treturn;\n\t\t\t} else {\n\t\t\t\tawait new Promise<void>((resume) => this.waiting.push(resume));\n\t\t\t}\n\t\t}\n\t}\n}\n\nfunction forward(\n\tlogger: DeployLogger | undefined,\n\tlevel: OutputLevel,\n\tmessage: string,\n): void {\n\tif (!logger) return;\n\tif (level === 'info') logger.info(message);\n\telse if (level === 'error' && logger.error) logger.error(message);\n\telse logger.warn(message);\n}\n\n/**\n * Deploy a project's stage.\n *\n * ```ts\n * import { deploy } from '@geekmidas/cli/deploy';\n *\n * const run = deploy({ cwd: '/srv/checkouts/shop', stage: 'production' });\n * for await (const event of run) {\n *   if (event.type === 'app.deployed') console.log(event.app, event.url);\n * }\n * const result = await run.result;\n * ```\n *\n * The run starts at once; iterating it is optional, and an iteration started\n * late still sees every event from the first.\n */\nexport function deploy(input: DeployInput): DeployRun {\n\tconst log = new EventLog();\n\t// Every secret the run reads is masked in every line it reports — in the\n\t// events and in what the logger is handed.\n\tconst redactor = new Redactor();\n\tconst emit = (event: DeployEvent) => {\n\t\tconst masked =\n\t\t\tevent.type === 'log'\n\t\t\t\t? { ...event, message: redactor.redact(event.message) }\n\t\t\t\t: event;\n\t\tlog.push(masked);\n\t\tif (masked.type === 'log') {\n\t\t\tforward(input.logger, masked.level, masked.message);\n\t\t}\n\t};\n\n\tconst ctx: DeployContext = {\n\t\temit,\n\t\tcredentials:\n\t\t\tinput.credentials ?? storedCredentials({ home: input.home ?? gkmHome() }),\n\t\tdryRun: input.dryRun ?? false,\n\t\thome: input.home ?? gkmHome(),\n\t\tredactor,\n\t\t...(input.signal ? { signal: input.signal } : {}),\n\t\t...(input.childOutput ? { childOutput: input.childOutput } : {}),\n\t\t...(input.targets ? { targets: input.targets } : {}),\n\t};\n\n\t// Every line anything in the run writes through `output` — the deploy's\n\t// own, the Dockerfile generator's, discovery's warnings — becomes an event\n\t// of this run, and of no other.\n\tconst result = withOutput(\n\t\t(level, message) => emit({ type: 'log', level, message }),\n\t\tasync () => {\n\t\t\ttry {\n\t\t\t\tinput.signal?.throwIfAborted();\n\t\t\t\tconst sandbox =\n\t\t\t\t\tinput.sandbox ??\n\t\t\t\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\t\t\t\t// Every step of the run that executes the project's code — the\n\t\t\t\t// engine's own discoveries and sniffs included — runs in it.\n\t\t\t\tconst deployed = await withSandbox(sandbox, () =>\n\t\t\t\t\trunDeploy(\n\t\t\t\t\t\t() => load(input, sandbox),\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tstage: input.stage,\n\t\t\t\t\t\t\t...(input.target ? { target: input.target } : {}),\n\t\t\t\t\t\t\t...(input.tag ? { tag: input.tag } : {}),\n\t\t\t\t\t\t\t...(input.apps ? { apps: input.apps } : {}),\n\t\t\t\t\t\t},\n\t\t\t\t\t\tctx,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\temit({ type: 'deploy.finished', result: deployed });\n\t\t\t\treturn deployed;\n\t\t\t} catch (error) {\n\t\t\t\temit({ type: 'deploy.failed', error: eventError(error) });\n\t\t\t\tthrow error;\n\t\t\t} finally {\n\t\t\t\tlog.close();\n\t\t\t}\n\t\t},\n\t);\n\n\t// A caller that only iterates still learns of the failure from the\n\t// `deploy.failed` event; the rejection must not also crash its process as\n\t// unhandled. Awaiting `result` still rejects.\n\tresult.catch(() => {});\n\n\treturn {\n\t\tresult,\n\t\t[Symbol.asyncIterator]: () => log.iterate(),\n\t};\n}\n\n/**\n * The workspace at `input.cwd`. The stage is checked by the run, once it\n * knows the target: one that runs on this machine may take the local stage.\n */\nasync function load(\n\tinput: DeployInput,\n\tsandbox: Sandbox,\n): Promise<NormalizedWorkspace> {\n\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\tsandbox,\n\t});\n\treturn workspace;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAwHA,IAAM,WAAN,MAAe;CACd,SAAyC,CAAC;CAC1C,SAAiB;CACjB,UAAkC,CAAC;CAEnC,KAAK,OAA0B;EAC9B,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,KAAK;CACX;CAEA,QAAc;EACb,KAAK,SAAS;EACd,KAAK,KAAK;CACX;CAEA,OAAqB;EACpB,MAAM,UAAU,KAAK;EACrB,KAAK,UAAU,CAAC;EAChB,KAAK,MAAM,UAAU,SAAS,OAAO;CACtC;CAEA,OAAO,UAAuC;EAC7C,IAAI,OAAO;EACX,OAAO,MACN,IAAI,OAAO,KAAK,OAAO,QACtB,MAAM,KAAK,OAAO;OACZ,IAAI,KAAK,QACf;OAEA,MAAM,IAAI,SAAe,WAAW,KAAK,QAAQ,KAAK,MAAM,CAAC;CAGhE;AACD;AAEA,SAAS,QACR,QACA,OACA,SACO;CACP,IAAI,CAAC,QAAQ;CACb,IAAI,UAAU,QAAQ,OAAO,KAAK,OAAO;MACpC,IAAI,UAAU,WAAW,OAAO,OAAO,OAAO,MAAM,OAAO;MAC3D,OAAO,KAAK,OAAO;AACzB;;;;;;;;;;;;;;;;;AAkBA,SAAgB,OAAO,OAA+B;CACrD,MAAM,MAAM,IAAI,SAAS;CAGzB,MAAM,WAAW,IAAIA,gBAAAA,SAAS;CAC9B,MAAM,QAAQ,UAAuB;EACpC,MAAM,SACL,MAAM,SAAS,QACZ;GAAE,GAAG;GAAO,SAAS,SAAS,OAAO,MAAM,OAAO;EAAE,IACpD;EACJ,IAAI,KAAK,MAAM;EACf,IAAI,OAAO,SAAS,OACnB,QAAQ,MAAM,QAAQ,OAAO,OAAO,OAAO,OAAO;CAEpD;CAEA,MAAM,MAAqB;EAC1B;EACA,aACC,MAAM,eAAeC,oBAAAA,kBAAkB,EAAE,MAAM,MAAM,QAAQC,cAAAA,QAAQ,EAAE,CAAC;EACzE,QAAQ,MAAM,UAAU;EACxB,MAAM,MAAM,QAAQA,cAAAA,QAAQ;EAC5B;EACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C,GAAI,MAAM,cAAc,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;EAC9D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;CACnD;CAKA,MAAM,SAASC,iBAAAA,YACb,OAAO,YAAY,KAAK;EAAE,MAAM;EAAO;EAAO;CAAQ,CAAC,GACxD,YAAY;EACX,IAAI;GACH,MAAM,QAAQ,eAAe;GAC7B,MAAM,UACL,MAAM,WACN,IAAIC,cAAAA,aAAa,EAAE,MAAMC,eAAAA,mBAAAA,GAAkBC,UAAAA,QAAAA,CAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;GAGjE,MAAM,WAAW,MAAMC,gBAAAA,YAAY,eAClCC,gBAAAA,gBACO,KAAK,OAAO,OAAO,GACzB;IACC,OAAO,MAAM;IACb,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/C,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;IACtC,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;GAC1C,GACA,GACD,CACD;GACA,KAAK;IAAE,MAAM;IAAmB,QAAQ;GAAS,CAAC;GAClD,OAAO;EACR,SAAS,OAAO;GACf,KAAK;IAAE,MAAM;IAAiB,OAAOC,gBAAAA,WAAW,KAAK;GAAE,CAAC;GACxD,MAAM;EACP,UAAU;GACT,IAAI,MAAM;EACX;CACD,CACD;CAKA,OAAO,YAAY,CAAC,CAAC;CAErB,OAAO;EACN;GACC,OAAO,sBAAsB,IAAI,QAAQ;CAC3C;AACD;;;;;AAMA,eAAe,KACd,OACA,SAC+B;CAC/B,MAAM,EAAE,cAAc,MAAMC,eAAAA,qBAAAA,GAAoBJ,UAAAA,QAAAA,CAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;CACD,OAAO;AACR"}

package/dist/{deploy-CG8bfFij.mjs → deploy-CZ5nlpsu.mjs}

@@ -1,10 +1,14 @@
-import { A as StateStoreBusy, C as setDnsRecord, E as setPostgresBackupId, I as withGeneratedSecrets, K as run, L as encryptSecrets, M as StateVersionConflict, S as setDeployedImage, T as setGeneratedSecret, X as constructGlobs, _ as getBackupState, _t as providerOf, a as DockerBuildFailed, b as setApplicationId, c as dockerCommand, g as createEmptyState, gt as eventsBackendFor, h as resolveHost, ht as cacheBackendFor, i as DokployApiError, m as isMainFrontendApp, nt as applyPostgres, o as DockerPushFailed, p as validateImageRef, pt as resourceName, q as runOutput, r as DokployApi, t as sniffAllApps, v as getGeneratedSecret, vt as storageBackendFor, w as setDnsVerification, x as setBackupState, y as isDnsVerified, z as keyFingerprint } from "./sniffer-aO_-s5vq.mjs";
-import { r as discover, v as output } from "./discover-BaT6bpnA.mjs";
-import { g as appKey } from "./config-LKKCVCnC.mjs";
-import { a as getAppBuildOrder, m as stripPublicPrefix, p as getPublicEnvPrefix } from "./workspace-Dh7rr7l4.mjs";
+import { S as keyFingerprint, b as encryptSecrets, f as StateStoreBusy, i as DokployApiError, m as StateVersionConflict, r as DokployApi, t as sniffAllApps, v as eventError } from "./sniffer-BZ-OJO4Y.mjs";
+import { c as runOutput, s as run } from "./local-CWR4Y_kW.mjs";
+import { t as MissingCredential } from "./credentials-Dq1MnWQf.mjs";
+import { d as output, r as discover } from "./discover-LMrqsWSU.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-C06_pW4g.mjs";
+import "./config.mjs";
 import { i as toEmbeddableSecrets, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
-import { d as imageName, f as imageRef, g as projectName, h as ownershipMarker, l as applicationName, m as markerOf, p as isOwnedBy } from "./store-BS8A7NcA.mjs";
-import { c as MissingCredential, o as eventError } from "./terminal-gMxAo9Dj.mjs";
+import { d as imageName, f as imageRef, g as projectName, h as ownershipMarker, l as applicationName, m as markerOf, p as isOwnedBy } from "./store-CLiHnqOY.mjs";
+import { C as isMainFrontendApp, D as constructGlobs, J as providerOf, K as cacheBackendFor, N as applyPostgres, S as validateImageRef, W as resourceName, Y as storageBackendFor, _ as dockerCommand, a as setApplicationId, c as setDnsRecord, d as setPostgresBackupId, f as DeployJournal, h as DockerPushFailed, i as isDnsVerified, l as setDnsVerification, m as DockerBuildFailed, n as getBackupState, o as setBackupState, p as withGeneratedSecrets, q as eventsBackendFor, r as getGeneratedSecret, s as setDeployedImage, t as createEmptyState, u as setGeneratedSecret, w as resolveHost } from "./state-B8YwmUZU.mjs";
+import "./terminal-CfbiYUbZ.mjs";
 import { join, resolve } from "node:path";
 import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -785,7 +789,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-DBBwpDjn.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-x9gQTAGZ.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -1404,113 +1408,6 @@ function validateEnvVars(requiredVars, context) {
 	};
 }
 //#endregion
-//#region src/deploy/journal.ts
-var DeployJournal = class DeployJournal {
-	store;
-	stage;
-	state;
-	resources;
-	version;
-	existed;
-	constructor(store, stage, state, resources, version, existed) {
-		this.store = store;
-		this.stage = stage;
-		this.state = state;
-		this.resources = resources;
-		this.version = version;
-		this.existed = existed;
-	}
-	/**
-	* The stage's journal — its stored state, or `initial` written as the
-	* stage's first state, so there is somewhere to record the very first
-	* resource before it is created.
-	*/
-	static async open(store, stage, initial) {
-		const stored = await store.read(stage);
-		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
-		const state = initial();
-		const version = await store.write(stage, state, { expectedVersion: null });
-		return new DeployJournal(store, stage, state, {}, version, false);
-	}
-	record(key) {
-		return this.resources[key];
-	}
-	/** The keys a previous run marked `pending` and never saw created. */
-	unfinished() {
-		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
-	}
-	/** Records that `entry` is about to be created. */
-	async pending(entry) {
-		await this.put({
-			...entry,
-			status: "pending"
-		});
-	}
-	/** Records `entry` as existing with `id`; a no-op if it already is. */
-	async ready(entry, id) {
-		const current = this.resources[entry.key];
-		if (current?.status === "ready" && current.id === id) return;
-		await this.put({
-			...entry,
-			status: "ready",
-			id
-		});
-	}
-	/**
-	* The resource `entry` names: by its recorded id, else by looking it up,
-	* else created — with `pending` written before the create and `ready`
-	* after, so a run that dies in between leaves a record the next run
-	* resolves by looking the resource up rather than creating another.
-	*/
-	async ensure(entry, steps) {
-		const record = this.resources[entry.key];
-		let staleId;
-		if (record?.status === "ready" && record.id && steps.get) {
-			const known = await steps.get(record.id);
-			if (known) {
-				await this.ready(entry, steps.id(known));
-				return {
-					resource: known,
-					via: "recorded"
-				};
-			}
-			staleId = record.id;
-		}
-		const existing = await steps.find();
-		if (existing) {
-			await this.ready(entry, steps.id(existing));
-			return {
-				resource: existing,
-				via: record?.status === "pending" ? "resumed" : "found",
-				...staleId ? { staleId } : {}
-			};
-		}
-		await this.pending(entry);
-		const created = await steps.create();
-		await this.ready(entry, steps.id(created));
-		return {
-			resource: created,
-			via: "created",
-			...staleId ? { staleId } : {}
-		};
-	}
-	/** Writes the stage's state, keeping its resource records. */
-	async save() {
-		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
-	}
-	async put(record) {
-		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
-		this.resources = {
-			...this.resources,
-			[record.key]: {
-				...record,
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			}
-		};
-	}
-};
-//#endregion
 //#region src/deploy/ownership.ts
 /**
 * Which Dokploy project a deploy is allowed to deploy into.
@@ -1648,7 +1545,7 @@ async function resolveProject(api, identity, stateProjectId, log = () => {}, hoo
 var RegistryNotConfigured = class extends Error {
 	stage;
 	constructor(stage) {
-		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.dokploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
+		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
 		this.stage = stage;
 		this.name = "RegistryNotConfigured";
 	}
@@ -2232,7 +2129,7 @@ async function provisionDokploy(run) {
 	state.environmentId = environmentId;
 	state.identity = identity.key;
 	logger.log("\n🐳 Checking registry...");
-	const registry = workspace.deploy.dokploy?.registry;
+	const registry = workspace.deploy.registry;
 	let registryCreated = false;
 	const dokployRegistry = await resolveRegistry(api, {
 		stage,
@@ -2804,7 +2701,7 @@ async function planDokploy(run) {
 	let registryPlanned;
 	const registry = await resolveRegistry(api, {
 		stage,
-		registry: workspace.deploy.dokploy?.registry,
+		registry: workspace.deploy.registry,
 		configuredId: workspace.deploy.dokploy?.registryId,
 		stateId: state?.registryId,
 		log: (message) => logger.log(message),
@@ -2849,7 +2746,7 @@ async function planDokploy(run) {
 			resourceType: "application",
 			action: "create"
 		}, dokployAppName);
-		const ref = imageRef(identity, appName, workspace.deploy.dokploy?.registry, imageTag);
+		const ref = imageRef(identity, appName, workspace.deploy.registry, imageTag);
 		plan({
 			key: `image:${appName}`,
 			resourceType: "image",
@@ -2899,4 +2796,4 @@ const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
 export { provisionDokploy as a, verifyDokploy as c, RegistryNotFound as d, ProjectNotOwned as f, planDokploy as i, RegistryAmbiguous as l, MissingEnvVars as n, releaseDokploy as o, dokployResult as r, validateDokploy as s, BackendDeployFailed as t, RegistryNotConfigured as u };
 
-//# sourceMappingURL=deploy-CG8bfFij.mjs.map
+//# sourceMappingURL=deploy-CZ5nlpsu.mjs.map