@geekmidas/cli 10.0.0-alpha.63 → 10.0.0-alpha.65

package/dist/terminal-D0f1u0LG.cjs

@@ -1,576 +0,0 @@
-const require_sniffer = require("./sniffer-D_SYc_pO.cjs");
-const require_discover = require("./discover-C_6COHEv.cjs");
-const require_config = require("./config-BEJYKd4s.cjs");
-const require_define = require("./define-Cv_QvDrg.cjs");
-const require_workspace = require("./workspace-Kl4NG9IH.cjs");
-const require_store = require("./store-KvNQwYaB.cjs");
-const require_resolve = require("./resolve-xytBTtG4.cjs");
-//#region src/deploy/credentials.ts
-/**
-* How a deploy gets the credentials it acts with.
-*
-* `deploy()` never prompts and never reads a terminal: it asks a
-* `CredentialProvider` and, when the provider has nothing, stops with
-* `MissingCredential` naming what it needed and how to supply it. Whether to
-* ask a person, read a vault or fail is the caller's decision — `gkm deploy`
-* prompts at a terminal and stores what was typed; a CI job sets the
-* environment; a host passes its own provider.
-*/
-/**
-* How to supply each kind the CLI knows, for the error that says it is
-* missing. A target's own kinds are its to explain.
-*/
-const HOW_TO_PROVIDE = {
-	dokploy: "Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.",
-	registry: "Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them."
-};
-/** A deploy needed a credential, and its provider had none. */
-var MissingCredential = class extends Error {
-	kind;
-	target;
-	howToProvide;
-	constructor(kind, target, howToProvide = HOW_TO_PROVIDE[kind] ?? "Pass it through the deploy's CredentialProvider.") {
-		const what = kind === "dokploy" ? `No Dokploy credentials${target ? ` for ${target}` : ""}.` : kind === "registry" ? `Dokploy has no registry for ${target ?? "the configured registry"}, and there are no credentials to create one with.` : `No "${String(kind)}" credentials${target ? ` for ${target}` : ""}.`;
-		super(`${what} ${howToProvide}`);
-		this.kind = kind;
-		this.target = target;
-		this.howToProvide = howToProvide;
-		this.name = "MissingCredential";
-	}
-};
-/** Whatever was asked for, from the first provider that has it. */
-function chainCredentials(...providers) {
-	return { async get(request, options) {
-		for (const provider of providers) {
-			const found = await provider.get(request, options);
-			if (found) return found;
-		}
-	} };
-}
-/**
-* Credentials from the environment, then from what `gkm login` stored. What
-* `deploy()` uses when it is handed no provider.
-*
-* - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to
-*   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.
-*   Each half is read on its own: a token is a secret and belongs in the
-*   environment, an endpoint is configuration and belongs in the config.
-* - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.
-*/
-function storedCredentials(options = {}) {
-	const env = options.env ?? process.env;
-	return { async get(asked) {
-		const request = asked;
-		switch (request.kind) {
-			case "dokploy": {
-				const stored = (await require_sniffer.readCredentials(options.home ? { home: options.home } : void 0)).dokploy;
-				const token = env.DOKPLOY_API_TOKEN ?? stored?.token;
-				const endpoint = env.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;
-				if (!token || !endpoint) return void 0;
-				return {
-					endpoint: endpoint.replace(/\/$/, ""),
-					token
-				};
-			}
-			case "registry": {
-				const username = env.DOCKER_REGISTRY_USERNAME;
-				const password = env.DOCKER_REGISTRY_PASSWORD;
-				if (!username || !password) return void 0;
-				return {
-					username,
-					password
-				};
-			}
-		}
-	} };
-}
-//#endregion
-//#region src/target/secrets.ts
-/**
-* A stage's secrets as a target sees them: read and written through the
-* stage's own store, and masked in everything the run prints once read.
-*/
-/**
-* Shorter values are left alone: what a progress line legitimately prints —
-* a port, a stage, an app name — would otherwise come out as `***` wherever
-* a secret happened to share it.
-*/
-const SHORTEST_MASKED = 6;
-/** The values a run must never print, and the rewrite that keeps it so. */
-var Redactor = class {
-	values = /* @__PURE__ */ new Set();
-	add(value) {
-		if (value && value.length >= SHORTEST_MASKED) this.values.add(value);
-	}
-	/** `text` with every masked value replaced by `***`, longest first. */
-	redact(text) {
-		if (this.values.size === 0) return text;
-		let out = text;
-		const longestFirst = [...this.values].sort((a, b) => b.length - a.length);
-		for (const value of longestFirst) out = out.replaceAll(value, "***");
-		return out;
-	}
-};
-/** Every value in `secrets` that is a secret rather than a label. */
-function secretValues(secrets) {
-	return [
-		secrets.seed,
-		...Object.values(secrets.custom ?? {}),
-		...Object.values(secrets.urls ?? {}),
-		...Object.values(secrets.services ?? {}).map((service) => service?.password)
-	].filter((value) => typeof value === "string");
-}
-/**
-* The stage's secrets through the store `secrets.store` names for it. Opening
-* one builds a client and makes no request, so a target that never reads them
-* costs nothing.
-*/
-async function deploySecrets(workspace, stage, redactor, options = {}) {
-	const store = await require_store.secretsStoreFor(workspace, stage, options);
-	const mask = (secrets) => {
-		for (const value of secretValues(secrets)) redactor.add(value);
-	};
-	return {
-		store: store.name,
-		async read() {
-			const secrets = await store.read(stage);
-			if (secrets) mask(secrets);
-			return secrets;
-		},
-		async write(secrets) {
-			mask(secrets);
-			await store.write(stage, secrets);
-		},
-		mask: (value) => redactor.add(value)
-	};
-}
-//#endregion
-//#region src/deploy/events.ts
-/** An error as an event carries it: its name and message, nothing else. */
-function eventError(error) {
-	if (error instanceof Error) return {
-		name: error.name,
-		message: error.message
-	};
-	return {
-		name: "Error",
-		message: String(error)
-	};
-}
-//#endregion
-//#region src/deploy/orchestrate.ts
-/**
-* The run around a target: what every deploy does whatever it deploys
-* through.
-*
-* It loads the workspace, resolves the target, works out the apps and the
-* identity, takes the stage's lock, and calls the target's phases in order,
-* reporting each as it starts, finishes or fails. Everything that is about
-* *where* the stage goes is the target's.
-*/
-/** Apps were asked for by name that the workspace does not have. */
-var UnknownDeployApps = class extends Error {
-	apps;
-	available;
-	constructor(apps, available) {
-		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
-		this.apps = apps;
-		this.available = available;
-		this.name = "UnknownDeployApps";
-	}
-};
-/** Every app asked for deploys through some other target. */
-var NoDeployableApps = class extends Error {
-	stage;
-	target;
-	constructor(stage, target) {
-		super(`No apps to deploy through "${target}": every selected app deploys somewhere else. Pick the target with --target, or set each app's deploy in gkm.config.ts.`);
-		this.stage = stage;
-		this.target = target;
-		this.name = "NoDeployableApps";
-	}
-};
-/** A failed rollback, after the failure that called for it. */
-var RollbackFailed = class extends Error {
-	target;
-	failure;
-	constructor(target, failure, cause) {
-		super(`Deploying through "${target}" failed, and so did rolling it back: ${cause instanceof Error ? cause.message : String(cause)}. The stage may be part-released; deploy again, or roll it back by hand. The first failure: ${failure instanceof Error ? failure.message : String(failure)}`, { cause });
-		this.target = target;
-		this.failure = failure;
-		this.name = "RollbackFailed";
-	}
-};
-/**
-* Generate image tag from stage and timestamp
-*/
-function generateTag(stage) {
-	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
-}
-/** Why an app that deploys through another target is left out. */
-function elsewhere(target, stage) {
-	const instead = require_define.builtinTarget(target)?.instead?.(stage);
-	if (target === "sst" && instead) return `it deploys with SST — ${instead}`;
-	return `it deploys through "${target}" — run \`gkm deploy --target ${target} --stage ${stage}\``;
-}
-/**
-* Deploy a workspace's stage through its target.
-*
-* The engine under `deploy()` and `gkm deploy`. It never prompts and never
-* exits: credentials come from `ctx.credentials`, progress goes to
-* `ctx.emit` and to `output`, and every failure is thrown.
-*
-* @internal
-*/
-async function runDeploy(source, request, ctx) {
-	const { stage } = request;
-	const redactor = ctx.redactor ?? new Redactor();
-	const emit = (event) => ctx.emit(event.type === "log" ? {
-		...event,
-		message: redactor.redact(event.message)
-	} : event);
-	/** Run one phase between its events. */
-	const phase = async (name, body) => {
-		ctx.signal?.throwIfAborted();
-		emit({
-			type: "phase.started",
-			phase: name
-		});
-		try {
-			const value = await body();
-			emit({
-				type: "phase.finished",
-				phase: name
-			});
-			return value;
-		} catch (error) {
-			emit({
-				type: "phase.failed",
-				phase: name,
-				error: eventError(error)
-			});
-			throw error;
-		}
-	};
-	ctx.signal?.throwIfAborted();
-	emit({
-		type: "phase.started",
-		phase: "validate"
-	});
-	let prepared;
-	try {
-		prepared = await prepare(source, request, ctx, emit, redactor);
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-	const { resolved, phaseCtx, store } = prepared;
-	const { target } = resolved;
-	if (ctx.dryRun) {
-		const run = await validate(target, phaseCtx, emit);
-		await phase("plan", () => target.plan(phaseCtx, run));
-		return target.result(phaseCtx, run);
-	}
-	let lock;
-	try {
-		lock = await store.lock(stage, { operation: "deploy" });
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-	try {
-		const run = await validate(target, phaseCtx, emit);
-		if (target.provision) await phase("provision", () => target.provision(phaseCtx, run));
-		if (target.build) await phase("build", () => target.build(phaseCtx, run));
-		let releasing = "release";
-		try {
-			await phase("release", () => target.release(phaseCtx, run));
-			releasing = "verify";
-			if (target.verify) await phase("verify", () => target.verify(phaseCtx, run));
-		} catch (error) {
-			if (ctx.signal?.aborted || !target.capabilities.rollback) throw error;
-			if (!target.rollback) throw error;
-			try {
-				await phase("rollback", () => target.rollback(phaseCtx, run, {
-					phase: releasing,
-					error
-				}));
-			} catch (rollbackError) {
-				throw new RollbackFailed(resolved.name, error, rollbackError);
-			}
-			throw error;
-		}
-		return await target.result(phaseCtx, run);
-	} finally {
-		await lock.release();
-	}
-}
-/** `validate`, then the run's `deploy.started`, inside the validate phase. */
-async function validate(target, phaseCtx, emit) {
-	try {
-		const run = await target.validate(phaseCtx);
-		const skipped = new Set(phaseCtx.skipped.map((s) => s.app));
-		emit({
-			type: "deploy.started",
-			stage: phaseCtx.stage,
-			target: phaseCtx.target,
-			identity: phaseCtx.identity.key,
-			tag: phaseCtx.tag,
-			apps: phaseCtx.apps.filter((app) => !skipped.has(app)),
-			dryRun: phaseCtx.dryRun
-		});
-		emit({
-			type: "phase.finished",
-			phase: "validate"
-		});
-		return run;
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-}
-/** Everything the phases are handed, worked out before the first of them. */
-async function prepare(source, request, ctx, emit, redactor) {
-	const { stage } = request;
-	const configured = typeof source === "function" ? await source() : source;
-	const targetName = request.target ?? configured.deploy?.default ?? "dokploy";
-	const resolved = await require_resolve.resolveTarget(targetName, {
-		workspace: configured,
-		stage,
-		...ctx.targets ? { host: ctx.targets } : {}
-	});
-	const options = await require_resolve.parseTargetOptions(resolved);
-	const manifest = await require_discover.discover({
-		patterns: require_sniffer.constructGlobs(configured),
-		cwd: configured.root
-	});
-	const units = require_config.derivedApps(manifest, configured);
-	const workspace = Object.keys(units).length > 0 ? {
-		...configured,
-		apps: units
-	} : configured;
-	const identity = require_store.deployIdentity(workspace, stage);
-	const tag = request.tag ?? generateTag(stage);
-	const buildOrder = require_workspace.getAppBuildOrder(workspace);
-	let selected = buildOrder;
-	if (request.apps && request.apps.length > 0) {
-		const unknown = request.apps.filter((name) => !workspace.apps[name]);
-		if (unknown.length > 0) throw new UnknownDeployApps(unknown, Object.keys(workspace.apps));
-		selected = buildOrder.filter((name) => request.apps.includes(name));
-	}
-	const skipped = [];
-	const skip = (app, reason) => {
-		skipped.push({
-			app,
-			reason
-		});
-		emit({
-			type: "app.skipped",
-			app,
-			reason
-		});
-	};
-	const byDefault = configured.deploy?.default ?? "dokploy";
-	const apps = selected.filter((name) => {
-		const own = workspace.apps[name].resolvedDeployTarget;
-		const deploysThrough = own === byDefault ? targetName : own;
-		if (deploysThrough === targetName) return true;
-		skip(name, elsewhere(deploysThrough, stage));
-		return false;
-	});
-	if (apps.length === 0) throw new NoDeployableApps(stage, targetName);
-	const store = await require_sniffer.createStateStore({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	const secrets = await deploySecrets(workspace, stage, redactor, { ...ctx.home ? { home: ctx.home } : {} });
-	const line = (level) => (message) => emit({
-		type: "log",
-		level,
-		message
-	});
-	const logger = {
-		info: line("info"),
-		warn: line("warn"),
-		error: line("error")
-	};
-	return {
-		resolved,
-		phaseCtx: {
-			target: targetName,
-			cwd: workspace.root,
-			stage,
-			tag,
-			apps,
-			skipped,
-			identity,
-			workspace,
-			manifest,
-			options,
-			dryRun: ctx.dryRun,
-			credentials: ctx.credentials,
-			state: store,
-			secrets,
-			logger,
-			signal: ctx.signal ?? new AbortController().signal,
-			childOutput: ctx.childOutput ?? "inherit",
-			emit,
-			skip,
-			name: (resource) => require_store.applicationName(identity, resource)
-		},
-		store
-	};
-}
-//#endregion
-//#region src/deploy/terminal.ts
-/**
-* The credentials `gkm deploy` can ask a person for. CLI layer only.
-*
-* `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`
-* when the answer is nothing. At a terminal, `gkm deploy` would rather ask:
-* this provider reads the environment and the stored login first, and only
-* when both are empty prompts — and stores a Dokploy login it validated, so
-* the next deploy does not ask again. With no terminal it answers nothing, and
-* the deploy says what was missing instead of waiting on a prompt nobody sees.
-*/
-const logger = require_discover.output;
-/** What answers a deploy prompt without a terminal. */
-const INSTEAD = "Please configure manually.";
-/** The Dokploy URL typed at the prompt is not a URL. */
-var DokployEndpointInvalid = class extends Error {
-	endpoint;
-	constructor(endpoint) {
-		super("Invalid URL format");
-		this.endpoint = endpoint;
-		this.name = "DokployEndpointInvalid";
-	}
-};
-/** Dokploy refused the token typed at the prompt; nothing was stored. */
-var DokployTokenRejected = class extends Error {
-	endpoint;
-	constructor(endpoint) {
-		super("Invalid credentials. Please check your token.");
-		this.endpoint = endpoint;
-		this.name = "DokployTokenRejected";
-	}
-};
-/** Asks the person at the terminal for what nothing else supplied. */
-function asking() {
-	return { async get(asked) {
-		if (!require_sniffer.canPrompt()) return void 0;
-		const request = asked;
-		if (request.kind === "dokploy") {
-			logger.log("\n📋 Dokploy credentials not found. Let's set them up.");
-			const endpoint = (await require_sniffer.prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: INSTEAD })).replace(/\/$/, "");
-			try {
-				new URL(endpoint);
-			} catch {
-				throw new DokployEndpointInvalid(endpoint);
-			}
-			logger.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
-			const token = await require_sniffer.prompt("API Token: ", {
-				hidden: true,
-				instead: INSTEAD
-			});
-			logger.log("\nValidating credentials...");
-			if (!await require_sniffer.validateDokployToken(endpoint, token)) throw new DokployTokenRejected(endpoint);
-			await require_sniffer.storeDokployCredentials(token, endpoint);
-			logger.log("✓ Credentials saved");
-			return {
-				endpoint,
-				token
-			};
-		}
-		logger.log(`   Dokploy has no registry for ${request.url}. Let's create one.`);
-		return {
-			username: await require_sniffer.prompt("Registry username: ", { instead: INSTEAD }),
-			password: await require_sniffer.prompt("Registry password/token: ", {
-				hidden: true,
-				instead: INSTEAD
-			})
-		};
-	} };
-}
-/**
-* The environment, then the stored login, then — at a terminal — the person
-* running the command.
-*/
-function terminalCredentials(base = storedCredentials()) {
-	return chainCredentials(base, asking());
-}
-//#endregion
-Object.defineProperty(exports, "MissingCredential", {
-	enumerable: true,
-	get: function() {
-		return MissingCredential;
-	}
-});
-Object.defineProperty(exports, "NoDeployableApps", {
-	enumerable: true,
-	get: function() {
-		return NoDeployableApps;
-	}
-});
-Object.defineProperty(exports, "Redactor", {
-	enumerable: true,
-	get: function() {
-		return Redactor;
-	}
-});
-Object.defineProperty(exports, "RollbackFailed", {
-	enumerable: true,
-	get: function() {
-		return RollbackFailed;
-	}
-});
-Object.defineProperty(exports, "UnknownDeployApps", {
-	enumerable: true,
-	get: function() {
-		return UnknownDeployApps;
-	}
-});
-Object.defineProperty(exports, "chainCredentials", {
-	enumerable: true,
-	get: function() {
-		return chainCredentials;
-	}
-});
-Object.defineProperty(exports, "eventError", {
-	enumerable: true,
-	get: function() {
-		return eventError;
-	}
-});
-Object.defineProperty(exports, "runDeploy", {
-	enumerable: true,
-	get: function() {
-		return runDeploy;
-	}
-});
-Object.defineProperty(exports, "storedCredentials", {
-	enumerable: true,
-	get: function() {
-		return storedCredentials;
-	}
-});
-Object.defineProperty(exports, "terminalCredentials", {
-	enumerable: true,
-	get: function() {
-		return terminalCredentials;
-	}
-});
-
-//# sourceMappingURL=terminal-D0f1u0LG.cjs.map

package/dist/terminal-D0f1u0LG.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"terminal-D0f1u0LG.cjs","names":["readCredentials","secretsStoreFor","builtinTarget","resolveTarget","parseTargetOptions","discover","constructGlobs","derivedApps","deployIdentity","getAppBuildOrder","createStateStore","applicationName","output","canPrompt","prompt","validateDokployToken","storeDokployCredentials"],"sources":["../src/deploy/credentials.ts","../src/target/secrets.ts","../src/deploy/events.ts","../src/deploy/orchestrate.ts","../src/deploy/terminal.ts"],"sourcesContent":["/**\n * How a deploy gets the credentials it acts with.\n *\n * `deploy()` never prompts and never reads a terminal: it asks a\n * `CredentialProvider` and, when the provider has nothing, stops with\n * `MissingCredential` naming what it needed and how to supply it. Whether to\n * ask a person, read a vault or fail is the caller's decision — `gkm deploy`\n * prompts at a terminal and stores what was typed; a CI job sets the\n * environment; a host passes its own provider.\n */\n\nimport { readCredentials } from '../auth/credentials';\n\n/**\n * What each kind of credential is asked for with, and what it is.\n *\n * A target that needs a kind the CLI does not know declares it by augmenting\n * this interface, and lists it in its `credentials`:\n *\n * ```ts\n * declare module '@geekmidas/cli/target' {\n *   interface CredentialKinds {\n *     fly: { request: { org: string }; value: { token: string } };\n *   }\n * }\n * ```\n */\nexport interface CredentialKinds {\n\t/** The Dokploy API a stage deploys through. */\n\tdokploy: {\n\t\t/** `deploy.dokploy.endpoint`, when the config names one. */\n\t\trequest: { endpoint?: string };\n\t\tvalue: { endpoint: string; token: string };\n\t};\n\t/**\n\t * A container registry login, for Dokploy to pull with. Asked for only when\n\t * Dokploy has no registry for `deploy.dokploy.registry` and one has to be\n\t * created.\n\t */\n\tregistry: {\n\t\t/** `deploy.dokploy.registry`. */\n\t\trequest: { url: string };\n\t\tvalue: { username: string; password: string };\n\t};\n}\n\nexport type CredentialKind = keyof CredentialKinds;\n\n/** What a deploy asks a provider for. */\nexport type CredentialRequest<K extends CredentialKind = CredentialKind> = {\n\t[P in K]: { kind: P } & CredentialKinds[P]['request'];\n}[K];\n\n/** What a provider answers with. */\nexport type Credential<K extends CredentialKind> = CredentialKinds[K]['value'];\n\nexport interface CredentialProvider {\n\t/**\n\t * The credential `request` asks for, or `undefined` when this provider has\n\t * none — the deploy then raises {@link MissingCredential}.\n\t */\n\tget<K extends CredentialKind>(\n\t\trequest: CredentialRequest<K>,\n\t\toptions?: { signal?: AbortSignal },\n\t): Promise<Credential<K> | undefined>;\n}\n\n/**\n * How to supply each kind the CLI knows, for the error that says it is\n * missing. A target's own kinds are its to explain.\n */\nconst HOW_TO_PROVIDE: Partial<Record<CredentialKind, string>> = {\n\tdokploy:\n\t\t\"Set DOKPLOY_API_TOKEN (and DOKPLOY_ENDPOINT, or deploy.dokploy.endpoint in gkm.config.ts), run `gkm login --provider dokploy`, or pass them through the deploy's CredentialProvider.\",\n\tregistry:\n\t\t'Add the registry in Dokploy (Settings → Docker Registry) and set deploy.dokploy.registryId, set DOCKER_REGISTRY_USERNAME and DOCKER_REGISTRY_PASSWORD, or run `gkm deploy` at a terminal to be asked for them.',\n};\n\n/** A deploy needed a credential, and its provider had none. */\nexport class MissingCredential extends Error {\n\tconstructor(\n\t\treadonly kind: CredentialKind,\n\t\t/** What it was for: the Dokploy endpoint or the registry URL. */\n\t\treadonly target: string | undefined,\n\t\t/** How to supply it. */\n\t\treadonly howToProvide: string = HOW_TO_PROVIDE[kind] ??\n\t\t\t\"Pass it through the deploy's CredentialProvider.\",\n\t) {\n\t\tconst what =\n\t\t\tkind === 'dokploy'\n\t\t\t\t? `No Dokploy credentials${target ? ` for ${target}` : ''}.`\n\t\t\t\t: kind === 'registry'\n\t\t\t\t\t? `Dokploy has no registry for ${target ?? 'the configured registry'}, and there are no credentials to create one with.`\n\t\t\t\t\t: `No \"${String(kind)}\" credentials${target ? ` for ${target}` : ''}.`;\n\t\tsuper(`${what} ${howToProvide}`);\n\t\tthis.name = 'MissingCredential';\n\t}\n}\n\n/** Whatever was asked for, from the first provider that has it. */\nexport function chainCredentials(\n\t...providers: CredentialProvider[]\n): CredentialProvider {\n\treturn {\n\t\tasync get(request, options) {\n\t\t\tfor (const provider of providers) {\n\t\t\t\tconst found = await provider.get(request, options);\n\t\t\t\tif (found) return found;\n\t\t\t}\n\t\t\treturn undefined;\n\t\t},\n\t};\n}\n\nexport interface StoredCredentialsOptions {\n\t/** Where to read the variables from. Defaults to `process.env`. */\n\tenv?: NodeJS.ProcessEnv;\n\t/**\n\t * The CLI's home, whose `credentials.json` holds stored logins. Defaults\n\t * to `GKM_HOME`, else `~/.gkm`.\n\t */\n\thome?: string;\n}\n\n/**\n * Credentials from the environment, then from what `gkm login` stored. What\n * `deploy()` uses when it is handed no provider.\n *\n * - Dokploy: `DOKPLOY_API_TOKEN` / `DOKPLOY_ENDPOINT`, each falling back to\n *   the stored login, and the endpoint finally to `deploy.dokploy.endpoint`.\n *   Each half is read on its own: a token is a secret and belongs in the\n *   environment, an endpoint is configuration and belongs in the config.\n * - Registry: `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_PASSWORD`.\n */\nexport function storedCredentials(\n\toptions: StoredCredentialsOptions = {},\n): CredentialProvider {\n\tconst env = options.env ?? process.env;\n\n\treturn {\n\t\tasync get(asked) {\n\t\t\t// The union, so a switch on `kind` narrows it: `K` itself never is.\n\t\t\tconst request = asked as CredentialRequest;\n\t\t\tswitch (request.kind) {\n\t\t\t\tcase 'dokploy': {\n\t\t\t\t\tconst stored = (\n\t\t\t\t\t\tawait readCredentials(\n\t\t\t\t\t\t\toptions.home ? { home: options.home } : undefined,\n\t\t\t\t\t\t)\n\t\t\t\t\t).dokploy;\n\t\t\t\t\tconst token = env.DOKPLOY_API_TOKEN ?? stored?.token;\n\t\t\t\t\tconst endpoint =\n\t\t\t\t\t\tenv.DOKPLOY_ENDPOINT ?? stored?.endpoint ?? request.endpoint;\n\t\t\t\t\tif (!token || !endpoint) return undefined;\n\t\t\t\t\treturn { endpoint: endpoint.replace(/\\/$/, ''), token } as never;\n\t\t\t\t}\n\t\t\t\tcase 'registry': {\n\t\t\t\t\tconst username = env.DOCKER_REGISTRY_USERNAME;\n\t\t\t\t\tconst password = env.DOCKER_REGISTRY_PASSWORD;\n\t\t\t\t\tif (!username || !password) return undefined;\n\t\t\t\t\treturn { username, password } as never;\n\t\t\t\t}\n\t\t\t}\n\t\t\t// A kind a target declared: nothing stored here can answer it.\n\t\t\treturn undefined;\n\t\t},\n\t};\n}\n","/**\n * A stage's secrets as a target sees them: read and written through the\n * stage's own store, and masked in everything the run prints once read.\n */\n\nimport { secretsStoreFor } from '../secrets/store';\nimport type { StageSecrets } from '../secrets/types';\nimport type { NormalizedWorkspace } from '../workspace/types';\nimport type { DeploySecrets } from './types';\n\n/**\n * Shorter values are left alone: what a progress line legitimately prints —\n * a port, a stage, an app name — would otherwise come out as `***` wherever\n * a secret happened to share it.\n */\nconst SHORTEST_MASKED = 6;\n\n/** The values a run must never print, and the rewrite that keeps it so. */\nexport class Redactor {\n\tprivate readonly values = new Set<string>();\n\n\tadd(value: string | undefined): void {\n\t\tif (value && value.length >= SHORTEST_MASKED) this.values.add(value);\n\t}\n\n\t/** `text` with every masked value replaced by `***`, longest first. */\n\tredact(text: string): string {\n\t\tif (this.values.size === 0) return text;\n\t\tlet out = text;\n\t\tconst longestFirst = [...this.values].sort((a, b) => b.length - a.length);\n\t\tfor (const value of longestFirst) out = out.replaceAll(value, '***');\n\t\treturn out;\n\t}\n}\n\n/** Every value in `secrets` that is a secret rather than a label. */\nfunction secretValues(secrets: StageSecrets): string[] {\n\treturn [\n\t\tsecrets.seed,\n\t\t...Object.values(secrets.custom ?? {}),\n\t\t...Object.values(secrets.urls ?? {}),\n\t\t...Object.values(secrets.services ?? {}).map(\n\t\t\t(service) => service?.password,\n\t\t),\n\t].filter((value): value is string => typeof value === 'string');\n}\n\n/**\n * The stage's secrets through the store `secrets.store` names for it. Opening\n * one builds a client and makes no request, so a target that never reads them\n * costs nothing.\n */\nexport async function deploySecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\tredactor: Redactor,\n\toptions: { home?: string } = {},\n): Promise<DeploySecrets> {\n\tconst store = await secretsStoreFor(workspace, stage, options);\n\tconst mask = (secrets: StageSecrets) => {\n\t\tfor (const value of secretValues(secrets)) redactor.add(value);\n\t};\n\n\treturn {\n\t\tstore: store.name,\n\t\tasync read() {\n\t\t\tconst secrets = await store.read(stage);\n\t\t\tif (secrets) mask(secrets);\n\t\t\treturn secrets;\n\t\t},\n\t\tasync write(secrets) {\n\t\t\tmask(secrets);\n\t\t\tawait store.write(stage, secrets);\n\t\t},\n\t\tmask: (value) => redactor.add(value),\n\t};\n}\n","/**\n * What a deploy reports while it runs.\n *\n * Plain JSON objects, discriminated by `type`: `gkm deploy --json` writes them\n * one per line, and a host can forward them to a UI or a log pipeline without\n * a serialiser of its own. Nothing in an event is a class instance, a function\n * or a secret — an error travels as its name and message, a credential never\n * travels at all.\n *\n * Every target reports through this one union, so a UI renders a Dokploy\n * deploy and a plugin's the same way.\n *\n * The union only grows: a new event is a new `type`, a new field is optional,\n * and nothing that exists changes meaning. A consumer ignores types it does\n * not know. That is why the events carry no version number — the CLI that\n * writes a stream and the program that reads it agree by that rule rather\n * than by negotiating one.\n */\n\nimport type { DeployResult } from './types';\n\n/**\n * The stretch of a deploy an event belongs to.\n *\n * - `validate`: the config, the target, the stage, the apps, the lock, the\n *   stage's secrets and what each app reads from its environment\n * - `plan`: a dry run's lookups — what would be created and what reused\n * - `provision`: what the apps run on — for Dokploy the project, environment\n *   and registry — and the declared constructs\n * - `build`: each app's artifact, built without changing anything live\n * - `release`: the artifacts put live. Dokploy builds and pushes each image\n *   here, beside its application, because a site's build args are resolved\n *   per app\n * - `verify`: what was released answers — for Dokploy, DNS records and its\n *   domain validation\n * - `rollback`: the previous release restored, after `release` or `verify`\n *   failed, on a target that can\n */\nexport type DeployPhase =\n\t| 'validate'\n\t| 'plan'\n\t| 'provision'\n\t| 'build'\n\t| 'release'\n\t| 'verify'\n\t| 'rollback';\n\n/** An error, as an event carries it. */\nexport interface DeployEventError {\n\t/** The error's class name — `MissingCredential`, `StateLocked`. */\n\tname: string;\n\tmessage: string;\n}\n\n/**\n * How a resource came to be used:\n * - `recorded`: the id the stage's state holds still resolves\n * - `resumed`: a run that died after creating it is picked up\n * - `found`: it existed and was looked up\n * - `created`: this run created it\n */\nexport type ResourceVia = 'recorded' | 'resumed' | 'found' | 'created';\n\n/** One resource a deploy touches, planned or applied. */\nexport interface ResourceChange {\n\t/** `<type>:<name>`, unique within the stage — `application:api`. */\n\tkey: string;\n\t/** `project`, `environment`, `registry`, `application`, `domain`, `image`, or a construct's kind. */\n\tresourceType: string;\n\t/**\n\t * For a plan: whether the run would create it, reuse what exists, or\n\t * ensure it (look it up, and create it if missing). For an applied change:\n\t * what was done.\n\t */\n\taction: 'create' | 'reuse' | 'ensure' | 'build';\n\t/** The target's id, once there is one. */\n\tid?: string;\n}\n\nexport type DeployEvent =\n\t| {\n\t\t\ttype: 'deploy.started';\n\t\t\tstage: string;\n\t\t\t/** The target the run deploys through, by the name it was given. */\n\t\t\ttarget: string;\n\t\t\t/** `<namespace>/<project>`. */\n\t\t\tidentity: string;\n\t\t\ttag: string;\n\t\t\t/** The apps this run deploys, in order. */\n\t\t\tapps: string[];\n\t\t\tdryRun: boolean;\n\t  }\n\t| { type: 'phase.started'; phase: DeployPhase }\n\t| { type: 'phase.finished'; phase: DeployPhase }\n\t/** A phase threw; `deploy.failed` follows (after a rollback, if any). */\n\t| { type: 'phase.failed'; phase: DeployPhase; error: DeployEventError }\n\t/**\n\t * A progress line, exactly as `gkm deploy` prints it — leading newline and\n\t * indentation included, so a terminal renderer prints `message` as is.\n\t */\n\t| { type: 'log'; level: 'info' | 'warn' | 'error'; message: string }\n\t| { type: 'app.skipped'; app: string; reason: string }\n\t| ({ type: 'resource.planned' } & ResourceChange)\n\t| ({ type: 'resource.applied'; via: ResourceVia } & ResourceChange & {\n\t\t\t\tid: string;\n\t\t\t})\n\t| {\n\t\t\ttype: 'artifact.built';\n\t\t\tapp: string;\n\t\t\timageRef: string;\n\t\t\t/** The registry's digest, `sha256:…`, once pushed. */\n\t\t\tdigest?: string;\n\t  }\n\t| {\n\t\t\ttype: 'app.deployed';\n\t\t\tapp: string;\n\t\t\tapplicationId: string;\n\t\t\timageRef: string;\n\t\t\turl: string;\n\t  }\n\t| { type: 'app.failed'; app: string; error: DeployEventError }\n\t/** One check of whether a released app answers. */\n\t| {\n\t\t\ttype: 'health.checked';\n\t\t\tapp: string;\n\t\t\t/** What was asked: a URL, or the target's own status check. */\n\t\t\turl: string;\n\t\t\thealthy: boolean;\n\t\t\t/** The HTTP status, when the check was a request. */\n\t\t\tstatus?: number;\n\t\t\t/** 1 for the first check of the app in this run. */\n\t\t\tattempt: number;\n\t  }\n\t| { type: 'deploy.finished'; result: DeployResult }\n\t| { type: 'deploy.failed'; error: DeployEventError };\n\n/** Every `type` a deploy event can have. */\nexport type DeployEventType = DeployEvent['type'];\n\n/** An error as an event carries it: its name and message, nothing else. */\nexport function eventError(error: unknown): DeployEventError {\n\tif (error instanceof Error) {\n\t\treturn { name: error.name, message: error.message };\n\t}\n\treturn { name: 'Error', message: String(error) };\n}\n","/**\n * The run around a target: what every deploy does whatever it deploys\n * through.\n *\n * It loads the workspace, resolves the target, works out the apps and the\n * identity, takes the stage's lock, and calls the target's phases in order,\n * reporting each as it starts, finishes or fails. Everything that is about\n * *where* the stage goes is the target's.\n */\n\nimport { discover } from '../reconcile/discover.js';\nimport { constructGlobs } from '../reconcile/workspace.js';\nimport { builtinTarget } from '../target/builtins';\nimport {\n\tparseTargetOptions,\n\ttype ResolvedTarget,\n\tresolveTarget,\n} from '../target/resolve';\nimport { deploySecrets, Redactor } from '../target/secrets';\nimport type {\n\tAnyDeployTarget,\n\tDeployPhaseContext,\n\tDeployTargetLogger,\n} from '../target/types';\nimport { derivedApps } from '../workspace/derive.js';\nimport { getAppBuildOrder } from '../workspace/index.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { CredentialProvider } from './credentials';\nimport { type DeployEvent, type DeployPhase, eventError } from './events';\nimport { applicationName, deployIdentity } from './identity.js';\nimport { createStateStore } from './StateStore.js';\nimport type { DeployResult } from './types';\n\n/** What a run deploys, once the workspace is loaded. */\nexport interface DeployRequest {\n\t/** Deployment stage (e.g., 'production', 'staging') */\n\tstage: string;\n\t/** Image tag (default: stage-timestamp) */\n\ttag?: string;\n\t/** Specific apps to deploy (default: all) */\n\tapps?: string[];\n\t/** The target to deploy through. Defaults to `deploy.default`. */\n\ttarget?: string;\n}\n\n/**\n * What a run is handed by whoever started it: where its events go, where it\n * gets credentials, and whether it may change anything. Nothing in a run\n * reads a terminal or exits the process — that is its caller's business.\n */\nexport interface DeployContext {\n\temit: (event: DeployEvent) => void;\n\tcredentials: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Look everything up, create, build and push nothing. */\n\tdryRun: boolean;\n\t/** The CLI's home, for the stage's keys. Defaults to `GKM_HOME`. */\n\thome?: string;\n\t/** Where spawned processes' output goes. Defaults to the terminal. */\n\tchildOutput?: 'inherit' | 'stderr' | 'ignore';\n\t/** The host's own targets, which win over every other by the same name. */\n\ttargets?: Record<string, AnyDeployTarget>;\n\t/**\n\t * What the run masks in what it prints. `deploy()` passes the one its\n\t * progress lines go through; a run without one masks only its events.\n\t */\n\tredactor?: Redactor;\n}\n\n/** Apps were asked for by name that the workspace does not have. */\nexport class UnknownDeployApps extends Error {\n\tconstructor(\n\t\treadonly apps: readonly string[],\n\t\treadonly available: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Unknown apps: ${apps.join(', ')}\\n` +\n\t\t\t\t`Available apps: ${available.join(', ')}`,\n\t\t);\n\t\tthis.name = 'UnknownDeployApps';\n\t}\n}\n\n/** Every app asked for deploys through some other target. */\nexport class NoDeployableApps extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly target: string,\n\t) {\n\t\tsuper(\n\t\t\t`No apps to deploy through \"${target}\": every selected app deploys somewhere else. Pick the target with --target, or set each app's deploy in gkm.config.ts.`,\n\t\t);\n\t\tthis.name = 'NoDeployableApps';\n\t}\n}\n\n/** A failed rollback, after the failure that called for it. */\nexport class RollbackFailed extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\t/** What failed first, and was being rolled back. */\n\t\treadonly failure: unknown,\n\t\tcause: unknown,\n\t) {\n\t\tsuper(\n\t\t\t`Deploying through \"${target}\" failed, and so did rolling it back: ${cause instanceof Error ? cause.message : String(cause)}. The stage may be part-released; deploy again, or roll it back by hand. The first failure: ${failure instanceof Error ? failure.message : String(failure)}`,\n\t\t\t{ cause },\n\t\t);\n\t\tthis.name = 'RollbackFailed';\n\t}\n}\n\n/**\n * Generate image tag from stage and timestamp\n */\nexport function generateTag(stage: string): string {\n\tconst timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);\n\treturn `${stage}-${timestamp}`;\n}\n\n/** Why an app that deploys through another target is left out. */\nfunction elsewhere(target: string, stage: string): string {\n\tconst instead = builtinTarget(target)?.instead?.(stage);\n\tif (target === 'sst' && instead) return `it deploys with SST — ${instead}`;\n\treturn `it deploys through \"${target}\" — run \\`gkm deploy --target ${target} --stage ${stage}\\``;\n}\n\n/**\n * Deploy a workspace's stage through its target.\n *\n * The engine under `deploy()` and `gkm deploy`. It never prompts and never\n * exits: credentials come from `ctx.credentials`, progress goes to\n * `ctx.emit` and to `output`, and every failure is thrown.\n *\n * @internal\n */\nexport async function runDeploy(\n\tsource: NormalizedWorkspace | (() => Promise<NormalizedWorkspace>),\n\trequest: DeployRequest,\n\tctx: DeployContext,\n): Promise<DeployResult> {\n\tconst { stage } = request;\n\tconst redactor = ctx.redactor ?? new Redactor();\n\tconst emit = (event: DeployEvent) =>\n\t\tctx.emit(\n\t\t\tevent.type === 'log'\n\t\t\t\t? { ...event, message: redactor.redact(event.message) }\n\t\t\t\t: event,\n\t\t);\n\n\t/** Run one phase between its events. */\n\tconst phase = async <T>(name: DeployPhase, body: () => Promise<T>) => {\n\t\tctx.signal?.throwIfAborted();\n\t\temit({ type: 'phase.started', phase: name });\n\t\ttry {\n\t\t\tconst value = await body();\n\t\t\temit({ type: 'phase.finished', phase: name });\n\t\t\treturn value;\n\t\t} catch (error) {\n\t\t\temit({ type: 'phase.failed', phase: name, error: eventError(error) });\n\t\t\tthrow error;\n\t\t}\n\t};\n\n\tctx.signal?.throwIfAborted();\n\temit({ type: 'phase.started', phase: 'validate' });\n\n\tlet prepared: Prepared;\n\ttry {\n\t\tprepared = await prepare(source, request, ctx, emit, redactor);\n\t} catch (error) {\n\t\temit({ type: 'phase.failed', phase: 'validate', error: eventError(error) });\n\t\tthrow error;\n\t}\n\tconst { resolved, phaseCtx, store } = prepared;\n\tconst { target } = resolved;\n\n\t// A dry run takes no lock: it writes nothing a lock would protect, and it\n\t// should not stop a real deploy that starts while it is looking.\n\tif (ctx.dryRun) {\n\t\tconst run = await validate(target, phaseCtx, emit);\n\t\tawait phase('plan', () => target.plan(phaseCtx, run));\n\t\treturn target.result(phaseCtx, run);\n\t}\n\n\t// One deploy of a stage at a time. Taken before the target generates,\n\t// provisions or records anything, and held until the run ends however it\n\t// ends. A second run of the stage — another CI job, a laptop — gets\n\t// `StateLocked` naming this one instead of racing it; a run killed with\n\t// the lock held is released with `gkm state:unlock`.\n\tlet lock: Awaited<ReturnType<typeof store.lock>>;\n\ttry {\n\t\tlock = await store.lock(stage, { operation: 'deploy' });\n\t} catch (error) {\n\t\temit({ type: 'phase.failed', phase: 'validate', error: eventError(error) });\n\t\tthrow error;\n\t}\n\n\ttry {\n\t\tconst run = await validate(target, phaseCtx, emit);\n\t\tif (target.provision) {\n\t\t\tawait phase('provision', () => target.provision!(phaseCtx, run));\n\t\t}\n\t\tif (target.build) {\n\t\t\tawait phase('build', () => target.build!(phaseCtx, run));\n\t\t}\n\n\t\tlet releasing: 'release' | 'verify' = 'release';\n\t\ttry {\n\t\t\tawait phase('release', () => target.release(phaseCtx, run));\n\t\t\treleasing = 'verify';\n\t\t\tif (target.verify) {\n\t\t\t\tawait phase('verify', () => target.verify!(phaseCtx, run));\n\t\t\t}\n\t\t} catch (error) {\n\t\t\t// The caller stopping the run is not a release to undo.\n\t\t\tif (ctx.signal?.aborted || !target.capabilities.rollback) throw error;\n\t\t\tif (!target.rollback) throw error;\n\t\t\ttry {\n\t\t\t\tawait phase('rollback', () =>\n\t\t\t\t\ttarget.rollback!(phaseCtx, run, { phase: releasing, error }),\n\t\t\t\t);\n\t\t\t} catch (rollbackError) {\n\t\t\t\tthrow new RollbackFailed(resolved.name, error, rollbackError);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\n\t\treturn await target.result(phaseCtx, run);\n\t} finally {\n\t\tawait lock.release();\n\t}\n}\n\n/** `validate`, then the run's `deploy.started`, inside the validate phase. */\nasync function validate(\n\ttarget: AnyDeployTarget,\n\tphaseCtx: DeployPhaseContext<unknown>,\n\temit: (event: DeployEvent) => void,\n): Promise<unknown> {\n\ttry {\n\t\tconst run = await target.validate(phaseCtx);\n\t\tconst skipped = new Set(phaseCtx.skipped.map((s) => s.app));\n\t\temit({\n\t\t\ttype: 'deploy.started',\n\t\t\tstage: phaseCtx.stage,\n\t\t\ttarget: phaseCtx.target,\n\t\t\tidentity: phaseCtx.identity.key,\n\t\t\ttag: phaseCtx.tag,\n\t\t\tapps: phaseCtx.apps.filter((app) => !skipped.has(app)),\n\t\t\tdryRun: phaseCtx.dryRun,\n\t\t});\n\t\temit({ type: 'phase.finished', phase: 'validate' });\n\t\treturn run;\n\t} catch (error) {\n\t\temit({ type: 'phase.failed', phase: 'validate', error: eventError(error) });\n\t\tthrow error;\n\t}\n}\n\ninterface Prepared {\n\tresolved: ResolvedTarget;\n\tphaseCtx: DeployPhaseContext<unknown>;\n\tstore: Awaited<ReturnType<typeof createStateStore>>;\n}\n\n/** Everything the phases are handed, worked out before the first of them. */\nasync function prepare(\n\tsource: NormalizedWorkspace | (() => Promise<NormalizedWorkspace>),\n\trequest: DeployRequest,\n\tctx: DeployContext,\n\temit: (event: DeployEvent) => void,\n\tredactor: Redactor,\n): Promise<Prepared> {\n\tconst { stage } = request;\n\tconst configured = typeof source === 'function' ? await source() : source;\n\n\t// Before anything is discovered or derived: a target that cannot be found\n\t// — or a package that would not load — fails a deploy that has done\n\t// nothing yet.\n\tconst targetName = request.target ?? configured.deploy?.default ?? 'dokploy';\n\tconst resolved = await resolveTarget(targetName, {\n\t\tworkspace: configured,\n\t\tstage,\n\t\t...(ctx.targets ? { host: ctx.targets } : {}),\n\t});\n\tconst options = await parseTargetOptions(resolved);\n\n\t// What to deploy comes from the manifest.\n\t//\n\t// Discovered here rather than by the target, because the list of things\n\t// to deploy is the *declarations* — one `rest-api` is one server, one\n\t// `site` is one site — and the config only says how to run each. A project\n\t// that declares no surfaces keeps its configured apps, so adopting\n\t// constructs stays something you do a piece at a time.\n\tconst manifest = await discover({\n\t\tpatterns: constructGlobs(configured),\n\t\tcwd: configured.root,\n\t});\n\tconst units = derivedApps(manifest, configured);\n\tconst workspace: NormalizedWorkspace =\n\t\tObject.keys(units).length > 0 ? { ...configured, apps: units } : configured;\n\n\t// What every resource this deploy touches is named and claimed by —\n\t// resolved first, so a namespace that cannot be a name fails before\n\t// anything is built.\n\tconst identity = deployIdentity(workspace, stage);\n\tconst tag = request.tag ?? generateTag(stage);\n\n\t// The apps asked for, in dependency order.\n\tconst buildOrder = getAppBuildOrder(workspace);\n\tlet selected = buildOrder;\n\tif (request.apps && request.apps.length > 0) {\n\t\tconst unknown = request.apps.filter((name) => !workspace.apps[name]);\n\t\tif (unknown.length > 0) {\n\t\t\tthrow new UnknownDeployApps(unknown, Object.keys(workspace.apps));\n\t\t}\n\t\tselected = buildOrder.filter((name) => request.apps!.includes(name));\n\t}\n\n\tconst skipped: { app: string; reason: string }[] = [];\n\tconst skip = (app: string, reason: string) => {\n\t\tskipped.push({ app, reason });\n\t\temit({ type: 'app.skipped', app, reason });\n\t};\n\n\t// An app that names another target deploys there, in a run of its own.\n\t// One on the default follows the run, so `--target` moves the stage\n\t// without every app having to be told.\n\tconst byDefault = configured.deploy?.default ?? 'dokploy';\n\tconst apps = selected.filter((name) => {\n\t\tconst own = workspace.apps[name]!.resolvedDeployTarget;\n\t\tconst deploysThrough = own === byDefault ? targetName : own;\n\t\tif (deploysThrough === targetName) return true;\n\t\tskip(name, elsewhere(deploysThrough, stage));\n\t\treturn false;\n\t});\n\tif (apps.length === 0) throw new NoDeployableApps(stage, targetName);\n\n\tconst store = await createStateStore({\n\t\tconfig: workspace.state,\n\t\tworkspaceRoot: workspace.root,\n\t\tworkspaceName: workspace.name,\n\t});\n\tconst secrets = await deploySecrets(workspace, stage, redactor, {\n\t\t...(ctx.home ? { home: ctx.home } : {}),\n\t});\n\n\tconst line =\n\t\t(level: 'info' | 'warn' | 'error') =>\n\t\t(message: string): void =>\n\t\t\temit({ type: 'log', level, message });\n\tconst logger: DeployTargetLogger = {\n\t\tinfo: line('info'),\n\t\twarn: line('warn'),\n\t\terror: line('error'),\n\t};\n\n\tconst phaseCtx: DeployPhaseContext<unknown> = {\n\t\ttarget: targetName,\n\t\tcwd: workspace.root,\n\t\tstage,\n\t\ttag,\n\t\tapps,\n\t\tskipped,\n\t\tidentity,\n\t\tworkspace,\n\t\tmanifest,\n\t\toptions,\n\t\tdryRun: ctx.dryRun,\n\t\tcredentials: ctx.credentials,\n\t\tstate: store,\n\t\tsecrets,\n\t\tlogger,\n\t\tsignal: ctx.signal ?? new AbortController().signal,\n\t\tchildOutput: ctx.childOutput ?? 'inherit',\n\t\temit,\n\t\tskip,\n\t\tname: (resource) => applicationName(identity, resource),\n\t};\n\n\treturn { resolved, phaseCtx, store };\n}\n","/**\n * The credentials `gkm deploy` can ask a person for. CLI layer only.\n *\n * `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`\n * when the answer is nothing. At a terminal, `gkm deploy` would rather ask:\n * this provider reads the environment and the stored login first, and only\n * when both are empty prompts — and stores a Dokploy login it validated, so\n * the next deploy does not ask again. With no terminal it answers nothing, and\n * the deploy says what was missing instead of waiting on a prompt nobody sees.\n */\n\nimport { validateDokployToken } from '../auth';\nimport { storeDokployCredentials } from '../auth/credentials';\nimport { output } from '../output';\nimport { canPrompt, prompt } from '../prompt';\nimport {\n\ttype CredentialProvider,\n\ttype CredentialRequest,\n\tchainCredentials,\n\tstoredCredentials,\n} from './credentials';\n\nconst logger = output;\n\n/** What answers a deploy prompt without a terminal. */\nconst INSTEAD = 'Please configure manually.';\n\n/** The Dokploy URL typed at the prompt is not a URL. */\nexport class DokployEndpointInvalid extends Error {\n\tconstructor(readonly endpoint: string) {\n\t\tsuper('Invalid URL format');\n\t\tthis.name = 'DokployEndpointInvalid';\n\t}\n}\n\n/** Dokploy refused the token typed at the prompt; nothing was stored. */\nexport class DokployTokenRejected extends Error {\n\tconstructor(readonly endpoint: string) {\n\t\tsuper('Invalid credentials. Please check your token.');\n\t\tthis.name = 'DokployTokenRejected';\n\t}\n}\n\n/** Asks the person at the terminal for what nothing else supplied. */\nfunction asking(): CredentialProvider {\n\treturn {\n\t\tasync get(asked) {\n\t\t\tif (!canPrompt()) return undefined;\n\t\t\t// The union, so checking `kind` narrows it: `K` itself never is.\n\t\t\tconst request = asked as CredentialRequest;\n\n\t\t\tif (request.kind === 'dokploy') {\n\t\t\t\tlogger.log(\"\\n📋 Dokploy credentials not found. Let's set them up.\");\n\t\t\t\tconst endpoint = (\n\t\t\t\t\tawait prompt('Dokploy URL (e.g., https://dokploy.example.com): ', {\n\t\t\t\t\t\tinstead: INSTEAD,\n\t\t\t\t\t})\n\t\t\t\t).replace(/\\/$/, '');\n\n\t\t\t\ttry {\n\t\t\t\t\tnew URL(endpoint);\n\t\t\t\t} catch {\n\t\t\t\t\tthrow new DokployEndpointInvalid(endpoint);\n\t\t\t\t}\n\n\t\t\t\tlogger.log(`\\nGenerate a token at: ${endpoint}/settings/profile\\n`);\n\t\t\t\tconst token = await prompt('API Token: ', {\n\t\t\t\t\thidden: true,\n\t\t\t\t\tinstead: INSTEAD,\n\t\t\t\t});\n\n\t\t\t\tlogger.log('\\nValidating credentials...');\n\t\t\t\tif (!(await validateDokployToken(endpoint, token))) {\n\t\t\t\t\tthrow new DokployTokenRejected(endpoint);\n\t\t\t\t}\n\n\t\t\t\tawait storeDokployCredentials(token, endpoint);\n\t\t\t\tlogger.log('✓ Credentials saved');\n\t\t\t\treturn { endpoint, token } as never;\n\t\t\t}\n\n\t\t\tlogger.log(\n\t\t\t\t`   Dokploy has no registry for ${request.url}. Let's create one.`,\n\t\t\t);\n\t\t\tconst username = await prompt('Registry username: ', {\n\t\t\t\tinstead: INSTEAD,\n\t\t\t});\n\t\t\tconst password = await prompt('Registry password/token: ', {\n\t\t\t\thidden: true,\n\t\t\t\tinstead: INSTEAD,\n\t\t\t});\n\t\t\treturn { username, password } as never;\n\t\t},\n\t};\n}\n\n/**\n * The environment, then the stored login, then — at a terminal — the person\n * running the command.\n */\nexport function terminalCredentials(\n\tbase: CredentialProvider = storedCredentials(),\n): CredentialProvider {\n\treturn chainCredentials(base, asking());\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuEA,MAAM,iBAA0D;CAC/D,SACC;CACD,UACC;AACF;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CAEA;CAEA;CALV,YACC,MAEA,QAEA,eAAgC,eAAe,SAC9C,oDACA;EACD,MAAM,OACL,SAAS,YACN,yBAAyB,SAAS,QAAQ,WAAW,GAAG,KACxD,SAAS,aACR,+BAA+B,UAAU,0BAA0B,sDACnE,OAAO,OAAO,IAAI,EAAE,eAAe,SAAS,QAAQ,WAAW,GAAG;EACvE,MAAM,GAAG,KAAK,GAAG,cAAc;EAbtB,KAAA,OAAA;EAEA,KAAA,SAAA;EAEA,KAAA,eAAA;EAUT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,iBACf,GAAG,WACkB;CACrB,OAAO,EACN,MAAM,IAAI,SAAS,SAAS;EAC3B,KAAK,MAAM,YAAY,WAAW;GACjC,MAAM,QAAQ,MAAM,SAAS,IAAI,SAAS,OAAO;GACjD,IAAI,OAAO,OAAO;EACnB;CAED,EACD;AACD;;;;;;;;;;;AAsBA,SAAgB,kBACf,UAAoC,CAAC,GAChB;CACrB,MAAM,MAAM,QAAQ,OAAO,QAAQ;CAEnC,OAAO,EACN,MAAM,IAAI,OAAO;EAEhB,MAAM,UAAU;EAChB,QAAQ,QAAQ,MAAhB;GACC,KAAK,WAAW;IACf,MAAM,UACL,MAAMA,gBAAAA,gBACL,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,KAAA,CACzC,EAAA,CACC;IACF,MAAM,QAAQ,IAAI,qBAAqB,QAAQ;IAC/C,MAAM,WACL,IAAI,oBAAoB,QAAQ,YAAY,QAAQ;IACrD,IAAI,CAAC,SAAS,CAAC,UAAU,OAAO,KAAA;IAChC,OAAO;KAAE,UAAU,SAAS,QAAQ,OAAO,EAAE;KAAG;IAAM;GACvD;GACA,KAAK,YAAY;IAChB,MAAM,WAAW,IAAI;IACrB,MAAM,WAAW,IAAI;IACrB,IAAI,CAAC,YAAY,CAAC,UAAU,OAAO,KAAA;IACnC,OAAO;KAAE;KAAU;IAAS;GAC7B;EACD;CAGD,EACD;AACD;;;;;;;;;;;;ACxJA,MAAM,kBAAkB;;AAGxB,IAAa,WAAb,MAAsB;CACrB,yBAA0B,IAAI,IAAY;CAE1C,IAAI,OAAiC;EACpC,IAAI,SAAS,MAAM,UAAU,iBAAiB,KAAK,OAAO,IAAI,KAAK;CACpE;;CAGA,OAAO,MAAsB;EAC5B,IAAI,KAAK,OAAO,SAAS,GAAG,OAAO;EACnC,IAAI,MAAM;EACV,MAAM,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM;EACxE,KAAK,MAAM,SAAS,cAAc,MAAM,IAAI,WAAW,OAAO,KAAK;EACnE,OAAO;CACR;AACD;;AAGA,SAAS,aAAa,SAAiC;CACtD,OAAO;EACN,QAAQ;EACR,GAAG,OAAO,OAAO,QAAQ,UAAU,CAAC,CAAC;EACrC,GAAG,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC;EACnC,GAAG,OAAO,OAAO,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,KACvC,YAAY,SAAS,QACvB;CACD,CAAC,CAAC,QAAQ,UAA2B,OAAO,UAAU,QAAQ;AAC/D;;;;;;AAOA,eAAsB,cACrB,WACA,OACA,UACA,UAA6B,CAAC,GACL;CACzB,MAAM,QAAQ,MAAMC,cAAAA,gBAAgB,WAAW,OAAO,OAAO;CAC7D,MAAM,QAAQ,YAA0B;EACvC,KAAK,MAAM,SAAS,aAAa,OAAO,GAAG,SAAS,IAAI,KAAK;CAC9D;CAEA,OAAO;EACN,OAAO,MAAM;EACb,MAAM,OAAO;GACZ,MAAM,UAAU,MAAM,MAAM,KAAK,KAAK;GACtC,IAAI,SAAS,KAAK,OAAO;GACzB,OAAO;EACR;EACA,MAAM,MAAM,SAAS;GACpB,KAAK,OAAO;GACZ,MAAM,MAAM,MAAM,OAAO,OAAO;EACjC;EACA,OAAO,UAAU,SAAS,IAAI,KAAK;CACpC;AACD;;;;ACgEA,SAAgB,WAAW,OAAkC;CAC5D,IAAI,iBAAiB,OACpB,OAAO;EAAE,MAAM,MAAM;EAAM,SAAS,MAAM;CAAQ;CAEnD,OAAO;EAAE,MAAM;EAAS,SAAS,OAAO,KAAK;CAAE;AAChD;;;;;;;;;;;;;AC3EA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CACA;CAFV,YACC,MACA,WACC;EACD,MACC,iBAAiB,KAAK,KAAK,IAAI,EAAE,oBACb,UAAU,KAAK,IAAI,GACxC;EANS,KAAA,OAAA;EACA,KAAA,YAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CACA;CAFV,YACC,OACA,QACC;EACD,MACC,8BAA8B,OAAO,wHACtC;EALS,KAAA,QAAA;EACA,KAAA,SAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,iBAAb,cAAoC,MAAM;CAE/B;CAEA;CAHV,YACC,QAEA,SACA,OACC;EACD,MACC,sBAAsB,OAAO,wCAAwC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,8FAA8F,mBAAmB,QAAQ,QAAQ,UAAU,OAAO,OAAO,KACrR,EAAE,MAAM,CACT;EARS,KAAA,SAAA;EAEA,KAAA,UAAA;EAOT,KAAK,OAAO;CACb;AACD;;;;AAKA,SAAgB,YAAY,OAAuB;CAElD,OAAO,GAAG,MAAM,oBADE,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,QAAQ,SAAS,GAAG,CAAC,CAAC,MAAM,GAAG,EAC/C;AAC5B;;AAGA,SAAS,UAAU,QAAgB,OAAuB;CACzD,MAAM,UAAUC,eAAAA,cAAc,MAAM,CAAC,EAAE,UAAU,KAAK;CACtD,IAAI,WAAW,SAAS,SAAS,OAAO,yBAAyB;CACjE,OAAO,uBAAuB,OAAO,gCAAgC,OAAO,WAAW,MAAM;AAC9F;;;;;;;;;;AAWA,eAAsB,UACrB,QACA,SACA,KACwB;CACxB,MAAM,EAAE,UAAU;CAClB,MAAM,WAAW,IAAI,YAAY,IAAI,SAAS;CAC9C,MAAM,QAAQ,UACb,IAAI,KACH,MAAM,SAAS,QACZ;EAAE,GAAG;EAAO,SAAS,SAAS,OAAO,MAAM,OAAO;CAAE,IACpD,KACJ;;CAGD,MAAM,QAAQ,OAAU,MAAmB,SAA2B;EACrE,IAAI,QAAQ,eAAe;EAC3B,KAAK;GAAE,MAAM;GAAiB,OAAO;EAAK,CAAC;EAC3C,IAAI;GACH,MAAM,QAAQ,MAAM,KAAK;GACzB,KAAK;IAAE,MAAM;IAAkB,OAAO;GAAK,CAAC;GAC5C,OAAO;EACR,SAAS,OAAO;GACf,KAAK;IAAE,MAAM;IAAgB,OAAO;IAAM,OAAO,WAAW,KAAK;GAAE,CAAC;GACpE,MAAM;EACP;CACD;CAEA,IAAI,QAAQ,eAAe;CAC3B,KAAK;EAAE,MAAM;EAAiB,OAAO;CAAW,CAAC;CAEjD,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,QAAQ,QAAQ,SAAS,KAAK,MAAM,QAAQ;CAC9D,SAAS,OAAO;EACf,KAAK;GAAE,MAAM;GAAgB,OAAO;GAAY,OAAO,WAAW,KAAK;EAAE,CAAC;EAC1E,MAAM;CACP;CACA,MAAM,EAAE,UAAU,UAAU,UAAU;CACtC,MAAM,EAAE,WAAW;CAInB,IAAI,IAAI,QAAQ;EACf,MAAM,MAAM,MAAM,SAAS,QAAQ,UAAU,IAAI;EACjD,MAAM,MAAM,cAAc,OAAO,KAAK,UAAU,GAAG,CAAC;EACpD,OAAO,OAAO,OAAO,UAAU,GAAG;CACnC;CAOA,IAAI;CACJ,IAAI;EACH,OAAO,MAAM,MAAM,KAAK,OAAO,EAAE,WAAW,SAAS,CAAC;CACvD,SAAS,OAAO;EACf,KAAK;GAAE,MAAM;GAAgB,OAAO;GAAY,OAAO,WAAW,KAAK;EAAE,CAAC;EAC1E,MAAM;CACP;CAEA,IAAI;EACH,MAAM,MAAM,MAAM,SAAS,QAAQ,UAAU,IAAI;EACjD,IAAI,OAAO,WACV,MAAM,MAAM,mBAAmB,OAAO,UAAW,UAAU,GAAG,CAAC;EAEhE,IAAI,OAAO,OACV,MAAM,MAAM,eAAe,OAAO,MAAO,UAAU,GAAG,CAAC;EAGxD,IAAI,YAAkC;EACtC,IAAI;GACH,MAAM,MAAM,iBAAiB,OAAO,QAAQ,UAAU,GAAG,CAAC;GAC1D,YAAY;GACZ,IAAI,OAAO,QACV,MAAM,MAAM,gBAAgB,OAAO,OAAQ,UAAU,GAAG,CAAC;EAE3D,SAAS,OAAO;GAEf,IAAI,IAAI,QAAQ,WAAW,CAAC,OAAO,aAAa,UAAU,MAAM;GAChE,IAAI,CAAC,OAAO,UAAU,MAAM;GAC5B,IAAI;IACH,MAAM,MAAM,kBACX,OAAO,SAAU,UAAU,KAAK;KAAE,OAAO;KAAW;IAAM,CAAC,CAC5D;GACD,SAAS,eAAe;IACvB,MAAM,IAAI,eAAe,SAAS,MAAM,OAAO,aAAa;GAC7D;GACA,MAAM;EACP;EAEA,OAAO,MAAM,OAAO,OAAO,UAAU,GAAG;CACzC,UAAU;EACT,MAAM,KAAK,QAAQ;CACpB;AACD;;AAGA,eAAe,SACd,QACA,UACA,MACmB;CACnB,IAAI;EACH,MAAM,MAAM,MAAM,OAAO,SAAS,QAAQ;EAC1C,MAAM,UAAU,IAAI,IAAI,SAAS,QAAQ,KAAK,MAAM,EAAE,GAAG,CAAC;EAC1D,KAAK;GACJ,MAAM;GACN,OAAO,SAAS;GAChB,QAAQ,SAAS;GACjB,UAAU,SAAS,SAAS;GAC5B,KAAK,SAAS;GACd,MAAM,SAAS,KAAK,QAAQ,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAC;GACrD,QAAQ,SAAS;EAClB,CAAC;EACD,KAAK;GAAE,MAAM;GAAkB,OAAO;EAAW,CAAC;EAClD,OAAO;CACR,SAAS,OAAO;EACf,KAAK;GAAE,MAAM;GAAgB,OAAO;GAAY,OAAO,WAAW,KAAK;EAAE,CAAC;EAC1E,MAAM;CACP;AACD;;AASA,eAAe,QACd,QACA,SACA,KACA,MACA,UACoB;CACpB,MAAM,EAAE,UAAU;CAClB,MAAM,aAAa,OAAO,WAAW,aAAa,MAAM,OAAO,IAAI;CAKnE,MAAM,aAAa,QAAQ,UAAU,WAAW,QAAQ,WAAW;CACnE,MAAM,WAAW,MAAMC,gBAAAA,cAAc,YAAY;EAChD,WAAW;EACX;EACA,GAAI,IAAI,UAAU,EAAE,MAAM,IAAI,QAAQ,IAAI,CAAC;CAC5C,CAAC;CACD,MAAM,UAAU,MAAMC,gBAAAA,mBAAmB,QAAQ;CASjD,MAAM,WAAW,MAAMC,iBAAAA,SAAS;EAC/B,UAAUC,gBAAAA,eAAe,UAAU;EACnC,KAAK,WAAW;CACjB,CAAC;CACD,MAAM,QAAQC,eAAAA,YAAY,UAAU,UAAU;CAC9C,MAAM,YACL,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI;EAAE,GAAG;EAAY,MAAM;CAAM,IAAI;CAKlE,MAAM,WAAWC,cAAAA,eAAe,WAAW,KAAK;CAChD,MAAM,MAAM,QAAQ,OAAO,YAAY,KAAK;CAG5C,MAAM,aAAaC,kBAAAA,iBAAiB,SAAS;CAC7C,IAAI,WAAW;CACf,IAAI,QAAQ,QAAQ,QAAQ,KAAK,SAAS,GAAG;EAC5C,MAAM,UAAU,QAAQ,KAAK,QAAQ,SAAS,CAAC,UAAU,KAAK,KAAK;EACnE,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,kBAAkB,SAAS,OAAO,KAAK,UAAU,IAAI,CAAC;EAEjE,WAAW,WAAW,QAAQ,SAAS,QAAQ,KAAM,SAAS,IAAI,CAAC;CACpE;CAEA,MAAM,UAA6C,CAAC;CACpD,MAAM,QAAQ,KAAa,WAAmB;EAC7C,QAAQ,KAAK;GAAE;GAAK;EAAO,CAAC;EAC5B,KAAK;GAAE,MAAM;GAAe;GAAK;EAAO,CAAC;CAC1C;CAKA,MAAM,YAAY,WAAW,QAAQ,WAAW;CAChD,MAAM,OAAO,SAAS,QAAQ,SAAS;EACtC,MAAM,MAAM,UAAU,KAAK,KAAK,CAAE;EAClC,MAAM,iBAAiB,QAAQ,YAAY,aAAa;EACxD,IAAI,mBAAmB,YAAY,OAAO;EAC1C,KAAK,MAAM,UAAU,gBAAgB,KAAK,CAAC;EAC3C,OAAO;CACR,CAAC;CACD,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,iBAAiB,OAAO,UAAU;CAEnE,MAAM,QAAQ,MAAMC,gBAAAA,iBAAiB;EACpC,QAAQ,UAAU;EAClB,eAAe,UAAU;EACzB,eAAe,UAAU;CAC1B,CAAC;CACD,MAAM,UAAU,MAAM,cAAc,WAAW,OAAO,UAAU,EAC/D,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC,EACtC,CAAC;CAED,MAAM,QACJ,WACA,YACA,KAAK;EAAE,MAAM;EAAO;EAAO;CAAQ,CAAC;CACtC,MAAM,SAA6B;EAClC,MAAM,KAAK,MAAM;EACjB,MAAM,KAAK,MAAM;EACjB,OAAO,KAAK,OAAO;CACpB;CAyBA,OAAO;EAAE;EAAU,UAAA;GAtBlB,QAAQ;GACR,KAAK,UAAU;GACf;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,QAAQ,IAAI;GACZ,aAAa,IAAI;GACjB,OAAO;GACP;GACA;GACA,QAAQ,IAAI,UAAU,IAAI,gBAAgB,CAAC,CAAC;GAC5C,aAAa,IAAI,eAAe;GAChC;GACA;GACA,OAAO,aAAaC,cAAAA,gBAAgB,UAAU,QAAQ;EAG7B;EAAG;CAAM;AACpC;;;;;;;;;;;;;ACxWA,MAAM,SAASC,iBAAAA;;AAGf,MAAM,UAAU;;AAGhB,IAAa,yBAAb,cAA4C,MAAM;CAC5B;CAArB,YAAY,UAA2B;EACtC,MAAM,oBAAoB;EADN,KAAA,WAAA;EAEpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,uBAAb,cAA0C,MAAM;CAC1B;CAArB,YAAY,UAA2B;EACtC,MAAM,+CAA+C;EADjC,KAAA,WAAA;EAEpB,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,SAA6B;CACrC,OAAO,EACN,MAAM,IAAI,OAAO;EAChB,IAAI,CAACC,gBAAAA,UAAU,GAAG,OAAO,KAAA;EAEzB,MAAM,UAAU;EAEhB,IAAI,QAAQ,SAAS,WAAW;GAC/B,OAAO,IAAI,wDAAwD;GACnE,MAAM,YACL,MAAMC,gBAAAA,OAAO,qDAAqD,EACjE,SAAS,QACV,CAAC,EAAA,CACA,QAAQ,OAAO,EAAE;GAEnB,IAAI;IACH,IAAI,IAAI,QAAQ;GACjB,QAAQ;IACP,MAAM,IAAI,uBAAuB,QAAQ;GAC1C;GAEA,OAAO,IAAI,0BAA0B,SAAS,oBAAoB;GAClE,MAAM,QAAQ,MAAMA,gBAAAA,OAAO,eAAe;IACzC,QAAQ;IACR,SAAS;GACV,CAAC;GAED,OAAO,IAAI,6BAA6B;GACxC,IAAI,CAAE,MAAMC,gBAAAA,qBAAqB,UAAU,KAAK,GAC/C,MAAM,IAAI,qBAAqB,QAAQ;GAGxC,MAAMC,gBAAAA,wBAAwB,OAAO,QAAQ;GAC7C,OAAO,IAAI,qBAAqB;GAChC,OAAO;IAAE;IAAU;GAAM;EAC1B;EAEA,OAAO,IACN,kCAAkC,QAAQ,IAAI,oBAC/C;EAQA,OAAO;GAAE,UAAA,MAPcF,gBAAAA,OAAO,uBAAuB,EACpD,SAAS,QACV,CAAC;GAKkB,UAAA,MAJIA,gBAAAA,OAAO,6BAA6B;IAC1D,QAAQ;IACR,SAAS;GACV,CAAC;EAC2B;CAC7B,EACD;AACD;;;;;AAMA,SAAgB,oBACf,OAA2B,kBAAkB,GACxB;CACrB,OAAO,iBAAiB,MAAM,OAAO,CAAC;AACvC"}