@geekmidas/cli 10.0.0-alpha.64 → 10.0.0-alpha.66

package/dist/target/public.cjs

@@ -1,15 +1,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_define = require("../define-zUsP72ym.cjs");
-const require_runtime = require("../runtime-BGNDrHzh.cjs");
-const require_resolve = require("../resolve-BXsNQjMR.cjs");
+const require_define = require("../define-DzRz8FgH.cjs");
+const require_resolve = require("../resolve-CVmch0wI.cjs");
+const require_provider = require("../provider-C9_-45d5.cjs");
 exports.DeployTargetNotYetSupported = require_define.DeployTargetNotYetSupported;
 exports.InvalidTargetOptions = require_resolve.InvalidTargetOptions;
-exports.ProviderRemoved = require_resolve.ProviderRemoved;
+exports.ProviderRemoved = require_provider.ProviderRemoved;
 exports.TargetEntryInvalid = require_resolve.TargetEntryInvalid;
 exports.TargetPackageInvalid = require_resolve.TargetPackageInvalid;
-exports.TargetPackageNotFound = require_runtime.TargetPackageNotFound;
+exports.TargetPackageNotFound = require_resolve.TargetPackageNotFound;
 exports.TargetRuntimeMismatch = require_resolve.TargetRuntimeMismatch;
-exports.TargetRuntimeUndeclared = require_runtime.TargetRuntimeUndeclared;
+exports.TargetRuntimeUndeclared = require_resolve.TargetRuntimeUndeclared;
 exports.UnknownDeployTarget = require_define.UnknownDeployTarget;
 exports.defineTarget = require_define.defineTarget;
 exports.isDeployTarget = require_define.isDeployTarget;

package/dist/target/public.d.cts

@@ -1,5 +1,5 @@
-import { $ as DeployEventError, B as DeployFailure, G as DeployTargetCapabilities, H as DeployRuntime, J as TargetEvent, K as DeployTargetEntry, Q as DeployEvent, U as DeploySecrets, V as DeployPhaseContext, W as DeployTarget, X as TargetOptionsIssue, Y as TargetOptions, Z as TargetOptionsSchema, _t as StateStore, at as DeployResult, bt as DeployIdentity, ct as CredentialKind, dt as CredentialRequest, et as DeployEventType, it as AppDeployResult, lt as CredentialKinds, nt as ResourceChange, ot as AwsCredential, q as DeployTargetLogger, rt as ResourceVia, st as Credential, tt as DeployPhase, ut as CredentialProvider, yt as StageSecrets, z as AnyDeployTarget } from "../types-DkrDOMxw.cjs";
-import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-Cjq1jlVX.cjs";
+import { $ as DeployEventError, B as DeployFailure, G as DeployTargetCapabilities, H as DeployRuntime, J as TargetEvent, K as DeployTargetEntry, Q as DeployEvent, U as DeploySecrets, V as DeployPhaseContext, W as DeployTarget, X as TargetOptionsIssue, Y as TargetOptions, Z as TargetOptionsSchema, _t as StateStore, at as DeployResult, bt as StageSecrets, ct as CredentialKind, dt as CredentialRequest, et as DeployEventType, it as AppDeployResult, lt as CredentialKinds, nt as ResourceChange, ot as AwsCredential, q as DeployTargetLogger, rt as ResourceVia, st as Credential, tt as DeployPhase, ut as CredentialProvider, xt as DeployIdentity, z as AnyDeployTarget } from "../types-D5WIxRDP.cjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-BRqFOvPM.cjs";
 //#region src/target/define.d.ts
 /**
  * A deploy target, typed from what it is written with: the options from its

package/dist/target/public.d.mts

@@ -1,5 +1,5 @@
-import { $ as DeployEventError, B as DeployFailure, G as DeployTargetCapabilities, H as DeployRuntime, J as TargetEvent, K as DeployTargetEntry, Q as DeployEvent, U as DeploySecrets, V as DeployPhaseContext, W as DeployTarget, X as TargetOptionsIssue, Y as TargetOptions, Z as TargetOptionsSchema, _t as StateStore, at as DeployResult, bt as DeployIdentity, ct as CredentialKind, dt as CredentialRequest, et as DeployEventType, it as AppDeployResult, lt as CredentialKinds, nt as ResourceChange, ot as AwsCredential, q as DeployTargetLogger, rt as ResourceVia, st as Credential, tt as DeployPhase, ut as CredentialProvider, yt as StageSecrets, z as AnyDeployTarget } from "../types-B_bEQvb9.mjs";
-import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-CJEYK4Gz.mjs";
+import { $ as DeployEventError, B as DeployFailure, G as DeployTargetCapabilities, H as DeployRuntime, J as TargetEvent, K as DeployTargetEntry, Q as DeployEvent, U as DeploySecrets, V as DeployPhaseContext, W as DeployTarget, X as TargetOptionsIssue, Y as TargetOptions, Z as TargetOptionsSchema, _t as StateStore, at as DeployResult, bt as StageSecrets, ct as CredentialKind, dt as CredentialRequest, et as DeployEventType, it as AppDeployResult, lt as CredentialKinds, nt as ResourceChange, ot as AwsCredential, q as DeployTargetLogger, rt as ResourceVia, st as Credential, tt as DeployPhase, ut as CredentialProvider, xt as DeployIdentity, z as AnyDeployTarget } from "../types-CSw2w69a.mjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-CEk5n4VH.mjs";
 //#region src/target/define.d.ts
 /**
  * A deploy target, typed from what it is written with: the options from its

package/dist/target/public.mjs

@@ -1,4 +1,4 @@
-import { a as UnknownDeployTarget, i as DeployTargetNotYetSupported, n as isDeployTarget, t as defineTarget } from "../define-CYs0PEfZ.mjs";
-import { i as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-Cmn-FeYO.mjs";
-import { i as TargetRuntimeMismatch, n as TargetEntryInvalid, r as TargetPackageInvalid, s as ProviderRemoved, t as InvalidTargetOptions } from "../resolve-DZ2IJ0qY.mjs";
+import { a as UnknownDeployTarget, i as DeployTargetNotYetSupported, n as isDeployTarget, t as defineTarget } from "../define-DR8xGYfL.mjs";
+import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-Db0tNlrW.mjs";
+import { t as ProviderRemoved } from "../provider-q4lsYzYG.mjs";
 export { DeployTargetNotYetSupported, InvalidTargetOptions, ProviderRemoved, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, defineTarget, isDeployTarget };

package/dist/terminal-CHy_MdjG.cjs

@@ -0,0 +1,84 @@
+const require_credentials = require("./credentials-Bzbg23n8.cjs");
+const require_discover = require("./discover-OEfZ9OkA.cjs");
+const require_index = require("./index.cjs");
+//#region src/deploy/terminal.ts
+/**
+* The credentials `gkm deploy` can ask a person for. CLI layer only.
+*
+* `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`
+* when the answer is nothing. At a terminal, `gkm deploy` would rather ask:
+* this provider reads the environment and the stored login first, and only
+* when both are empty prompts — and stores a Dokploy login it validated, so
+* the next deploy does not ask again. With no terminal it answers nothing, and
+* the deploy says what was missing instead of waiting on a prompt nobody sees.
+*/
+const logger = require_discover.output;
+/** What answers a deploy prompt without a terminal. */
+const INSTEAD = "Please configure manually.";
+/** The Dokploy URL typed at the prompt is not a URL. */
+var DokployEndpointInvalid = class extends Error {
+	endpoint;
+	constructor(endpoint) {
+		super("Invalid URL format");
+		this.endpoint = endpoint;
+		this.name = "DokployEndpointInvalid";
+	}
+};
+/** Dokploy refused the token typed at the prompt; nothing was stored. */
+var DokployTokenRejected = class extends Error {
+	endpoint;
+	constructor(endpoint) {
+		super("Invalid credentials. Please check your token.");
+		this.endpoint = endpoint;
+		this.name = "DokployTokenRejected";
+	}
+};
+/** Asks the person at the terminal for what nothing else supplied. */
+function asking() {
+	return { async get(asked) {
+		if (!require_index.canPrompt()) return void 0;
+		const request = asked;
+		if (request.kind === "dokploy") {
+			logger.log("\n📋 Dokploy credentials not found. Let's set them up.");
+			const endpoint = (await require_index.prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: INSTEAD })).replace(/\/$/, "");
+			try {
+				new URL(endpoint);
+			} catch {
+				throw new DokployEndpointInvalid(endpoint);
+			}
+			logger.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			const token = await require_index.prompt("API Token: ", {
+				hidden: true,
+				instead: INSTEAD
+			});
+			logger.log("\nValidating credentials...");
+			if (!await require_index.validateDokployToken(endpoint, token)) throw new DokployTokenRejected(endpoint);
+			await require_credentials.storeDokployCredentials(token, endpoint);
+			logger.log("✓ Credentials saved");
+			return {
+				endpoint,
+				token
+			};
+		}
+		if (request.kind !== "registry") return void 0;
+		logger.log(`   Dokploy has no registry for ${request.url}. Let's create one.`);
+		return {
+			username: await require_index.prompt("Registry username: ", { instead: INSTEAD }),
+			password: await require_index.prompt("Registry password/token: ", {
+				hidden: true,
+				instead: INSTEAD
+			})
+		};
+	} };
+}
+/**
+* The environment, then the stored login, then — at a terminal — the person
+* running the command.
+*/
+function terminalCredentials(base = require_credentials.storedCredentials()) {
+	return require_credentials.chainCredentials(base, asking());
+}
+//#endregion
+exports.terminalCredentials = terminalCredentials;
+
+//# sourceMappingURL=terminal-CHy_MdjG.cjs.map

package/dist/terminal-CHy_MdjG.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-CHy_MdjG.cjs","names":["output","canPrompt","prompt","validateDokployToken","storeDokployCredentials","storedCredentials","chainCredentials"],"sources":["../src/deploy/terminal.ts"],"sourcesContent":["/**\n * The credentials `gkm deploy` can ask a person for. CLI layer only.\n *\n * `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`\n * when the answer is nothing. At a terminal, `gkm deploy` would rather ask:\n * this provider reads the environment and the stored login first, and only\n * when both are empty prompts — and stores a Dokploy login it validated, so\n * the next deploy does not ask again. With no terminal it answers nothing, and\n * the deploy says what was missing instead of waiting on a prompt nobody sees.\n */\n\nimport { validateDokployToken } from '../auth';\nimport { storeDokployCredentials } from '../auth/credentials';\nimport { output } from '../output';\nimport { canPrompt, prompt } from '../prompt';\nimport {\n\ttype CredentialProvider,\n\ttype CredentialRequest,\n\tchainCredentials,\n\tstoredCredentials,\n} from './credentials';\n\nconst logger = output;\n\n/** What answers a deploy prompt without a terminal. */\nconst INSTEAD = 'Please configure manually.';\n\n/** The Dokploy URL typed at the prompt is not a URL. */\nexport class DokployEndpointInvalid extends Error {\n\tconstructor(readonly endpoint: string) {\n\t\tsuper('Invalid URL format');\n\t\tthis.name = 'DokployEndpointInvalid';\n\t}\n}\n\n/** Dokploy refused the token typed at the prompt; nothing was stored. */\nexport class DokployTokenRejected extends Error {\n\tconstructor(readonly endpoint: string) {\n\t\tsuper('Invalid credentials. Please check your token.');\n\t\tthis.name = 'DokployTokenRejected';\n\t}\n}\n\n/** Asks the person at the terminal for what nothing else supplied. */\nfunction asking(): CredentialProvider {\n\treturn {\n\t\tasync get(asked) {\n\t\t\tif (!canPrompt()) return undefined;\n\t\t\t// The union, so checking `kind` narrows it: `K` itself never is.\n\t\t\tconst request = asked as CredentialRequest;\n\n\t\t\tif (request.kind === 'dokploy') {\n\t\t\t\tlogger.log(\"\\n📋 Dokploy credentials not found. Let's set them up.\");\n\t\t\t\tconst endpoint = (\n\t\t\t\t\tawait prompt('Dokploy URL (e.g., https://dokploy.example.com): ', {\n\t\t\t\t\t\tinstead: INSTEAD,\n\t\t\t\t\t})\n\t\t\t\t).replace(/\\/$/, '');\n\n\t\t\t\ttry {\n\t\t\t\t\tnew URL(endpoint);\n\t\t\t\t} catch {\n\t\t\t\t\tthrow new DokployEndpointInvalid(endpoint);\n\t\t\t\t}\n\n\t\t\t\tlogger.log(`\\nGenerate a token at: ${endpoint}/settings/profile\\n`);\n\t\t\t\tconst token = await prompt('API Token: ', {\n\t\t\t\t\thidden: true,\n\t\t\t\t\tinstead: INSTEAD,\n\t\t\t\t});\n\n\t\t\t\tlogger.log('\\nValidating credentials...');\n\t\t\t\tif (!(await validateDokployToken(endpoint, token))) {\n\t\t\t\t\tthrow new DokployTokenRejected(endpoint);\n\t\t\t\t}\n\n\t\t\t\tawait storeDokployCredentials(token, endpoint);\n\t\t\t\tlogger.log('✓ Credentials saved');\n\t\t\t\treturn { endpoint, token } as never;\n\t\t\t}\n\n\t\t\t// AWS is a profile or a role, set up with the AWS CLI — not keys\n\t\t\t// typed into a deploy.\n\t\t\tif (request.kind !== 'registry') return undefined;\n\n\t\t\tlogger.log(\n\t\t\t\t`   Dokploy has no registry for ${request.url}. Let's create one.`,\n\t\t\t);\n\t\t\tconst username = await prompt('Registry username: ', {\n\t\t\t\tinstead: INSTEAD,\n\t\t\t});\n\t\t\tconst password = await prompt('Registry password/token: ', {\n\t\t\t\thidden: true,\n\t\t\t\tinstead: INSTEAD,\n\t\t\t});\n\t\t\treturn { username, password } as never;\n\t\t},\n\t};\n}\n\n/**\n * The environment, then the stored login, then — at a terminal — the person\n * running the command.\n */\nexport function terminalCredentials(\n\tbase: CredentialProvider = storedCredentials(),\n): CredentialProvider {\n\treturn chainCredentials(base, asking());\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,MAAM,SAASA,iBAAAA;;AAGf,MAAM,UAAU;;AAGhB,IAAa,yBAAb,cAA4C,MAAM;CAC5B;CAArB,YAAY,UAA2B;EACtC,MAAM,oBAAoB;EADN,KAAA,WAAA;EAEpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,uBAAb,cAA0C,MAAM;CAC1B;CAArB,YAAY,UAA2B;EACtC,MAAM,+CAA+C;EADjC,KAAA,WAAA;EAEpB,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,SAA6B;CACrC,OAAO,EACN,MAAM,IAAI,OAAO;EAChB,IAAI,CAACC,cAAAA,UAAU,GAAG,OAAO,KAAA;EAEzB,MAAM,UAAU;EAEhB,IAAI,QAAQ,SAAS,WAAW;GAC/B,OAAO,IAAI,wDAAwD;GACnE,MAAM,YACL,MAAMC,cAAAA,OAAO,qDAAqD,EACjE,SAAS,QACV,CAAC,EAAA,CACA,QAAQ,OAAO,EAAE;GAEnB,IAAI;IACH,IAAI,IAAI,QAAQ;GACjB,QAAQ;IACP,MAAM,IAAI,uBAAuB,QAAQ;GAC1C;GAEA,OAAO,IAAI,0BAA0B,SAAS,oBAAoB;GAClE,MAAM,QAAQ,MAAMA,cAAAA,OAAO,eAAe;IACzC,QAAQ;IACR,SAAS;GACV,CAAC;GAED,OAAO,IAAI,6BAA6B;GACxC,IAAI,CAAE,MAAMC,cAAAA,qBAAqB,UAAU,KAAK,GAC/C,MAAM,IAAI,qBAAqB,QAAQ;GAGxC,MAAMC,oBAAAA,wBAAwB,OAAO,QAAQ;GAC7C,OAAO,IAAI,qBAAqB;GAChC,OAAO;IAAE;IAAU;GAAM;EAC1B;EAIA,IAAI,QAAQ,SAAS,YAAY,OAAO,KAAA;EAExC,OAAO,IACN,kCAAkC,QAAQ,IAAI,oBAC/C;EAQA,OAAO;GAAE,UAAA,MAPcF,cAAAA,OAAO,uBAAuB,EACpD,SAAS,QACV,CAAC;GAKkB,UAAA,MAJIA,cAAAA,OAAO,6BAA6B;IAC1D,QAAQ;IACR,SAAS;GACV,CAAC;EAC2B;CAC7B,EACD;AACD;;;;;AAMA,SAAgB,oBACf,OAA2BG,oBAAAA,kBAAkB,GACxB;CACrB,OAAOC,oBAAAA,iBAAiB,MAAM,OAAO,CAAC;AACvC"}

package/dist/terminal-DUhcZ1ND.mjs

@@ -0,0 +1,84 @@
+import { n as chainCredentials, r as storedCredentials, u as storeDokployCredentials } from "./credentials-Dq1MnWQf.mjs";
+import { d as output } from "./discover-BFoJWKGD.mjs";
+import { a as validateDokployToken, o as canPrompt, s as prompt } from "./index.mjs";
+//#region src/deploy/terminal.ts
+/**
+* The credentials `gkm deploy` can ask a person for. CLI layer only.
+*
+* `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`
+* when the answer is nothing. At a terminal, `gkm deploy` would rather ask:
+* this provider reads the environment and the stored login first, and only
+* when both are empty prompts — and stores a Dokploy login it validated, so
+* the next deploy does not ask again. With no terminal it answers nothing, and
+* the deploy says what was missing instead of waiting on a prompt nobody sees.
+*/
+const logger = output;
+/** What answers a deploy prompt without a terminal. */
+const INSTEAD = "Please configure manually.";
+/** The Dokploy URL typed at the prompt is not a URL. */
+var DokployEndpointInvalid = class extends Error {
+	endpoint;
+	constructor(endpoint) {
+		super("Invalid URL format");
+		this.endpoint = endpoint;
+		this.name = "DokployEndpointInvalid";
+	}
+};
+/** Dokploy refused the token typed at the prompt; nothing was stored. */
+var DokployTokenRejected = class extends Error {
+	endpoint;
+	constructor(endpoint) {
+		super("Invalid credentials. Please check your token.");
+		this.endpoint = endpoint;
+		this.name = "DokployTokenRejected";
+	}
+};
+/** Asks the person at the terminal for what nothing else supplied. */
+function asking() {
+	return { async get(asked) {
+		if (!canPrompt()) return void 0;
+		const request = asked;
+		if (request.kind === "dokploy") {
+			logger.log("\n📋 Dokploy credentials not found. Let's set them up.");
+			const endpoint = (await prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: INSTEAD })).replace(/\/$/, "");
+			try {
+				new URL(endpoint);
+			} catch {
+				throw new DokployEndpointInvalid(endpoint);
+			}
+			logger.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			const token = await prompt("API Token: ", {
+				hidden: true,
+				instead: INSTEAD
+			});
+			logger.log("\nValidating credentials...");
+			if (!await validateDokployToken(endpoint, token)) throw new DokployTokenRejected(endpoint);
+			await storeDokployCredentials(token, endpoint);
+			logger.log("✓ Credentials saved");
+			return {
+				endpoint,
+				token
+			};
+		}
+		if (request.kind !== "registry") return void 0;
+		logger.log(`   Dokploy has no registry for ${request.url}. Let's create one.`);
+		return {
+			username: await prompt("Registry username: ", { instead: INSTEAD }),
+			password: await prompt("Registry password/token: ", {
+				hidden: true,
+				instead: INSTEAD
+			})
+		};
+	} };
+}
+/**
+* The environment, then the stored login, then — at a terminal — the person
+* running the command.
+*/
+function terminalCredentials(base = storedCredentials()) {
+	return chainCredentials(base, asking());
+}
+//#endregion
+export { terminalCredentials };
+
+//# sourceMappingURL=terminal-DUhcZ1ND.mjs.map

package/dist/terminal-DUhcZ1ND.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-DUhcZ1ND.mjs","names":[],"sources":["../src/deploy/terminal.ts"],"sourcesContent":["/**\n * The credentials `gkm deploy` can ask a person for. CLI layer only.\n *\n * `deploy()` asks its `CredentialProvider` and stops with `MissingCredential`\n * when the answer is nothing. At a terminal, `gkm deploy` would rather ask:\n * this provider reads the environment and the stored login first, and only\n * when both are empty prompts — and stores a Dokploy login it validated, so\n * the next deploy does not ask again. With no terminal it answers nothing, and\n * the deploy says what was missing instead of waiting on a prompt nobody sees.\n */\n\nimport { validateDokployToken } from '../auth';\nimport { storeDokployCredentials } from '../auth/credentials';\nimport { output } from '../output';\nimport { canPrompt, prompt } from '../prompt';\nimport {\n\ttype CredentialProvider,\n\ttype CredentialRequest,\n\tchainCredentials,\n\tstoredCredentials,\n} from './credentials';\n\nconst logger = output;\n\n/** What answers a deploy prompt without a terminal. */\nconst INSTEAD = 'Please configure manually.';\n\n/** The Dokploy URL typed at the prompt is not a URL. */\nexport class DokployEndpointInvalid extends Error {\n\tconstructor(readonly endpoint: string) {\n\t\tsuper('Invalid URL format');\n\t\tthis.name = 'DokployEndpointInvalid';\n\t}\n}\n\n/** Dokploy refused the token typed at the prompt; nothing was stored. */\nexport class DokployTokenRejected extends Error {\n\tconstructor(readonly endpoint: string) {\n\t\tsuper('Invalid credentials. Please check your token.');\n\t\tthis.name = 'DokployTokenRejected';\n\t}\n}\n\n/** Asks the person at the terminal for what nothing else supplied. */\nfunction asking(): CredentialProvider {\n\treturn {\n\t\tasync get(asked) {\n\t\t\tif (!canPrompt()) return undefined;\n\t\t\t// The union, so checking `kind` narrows it: `K` itself never is.\n\t\t\tconst request = asked as CredentialRequest;\n\n\t\t\tif (request.kind === 'dokploy') {\n\t\t\t\tlogger.log(\"\\n📋 Dokploy credentials not found. Let's set them up.\");\n\t\t\t\tconst endpoint = (\n\t\t\t\t\tawait prompt('Dokploy URL (e.g., https://dokploy.example.com): ', {\n\t\t\t\t\t\tinstead: INSTEAD,\n\t\t\t\t\t})\n\t\t\t\t).replace(/\\/$/, '');\n\n\t\t\t\ttry {\n\t\t\t\t\tnew URL(endpoint);\n\t\t\t\t} catch {\n\t\t\t\t\tthrow new DokployEndpointInvalid(endpoint);\n\t\t\t\t}\n\n\t\t\t\tlogger.log(`\\nGenerate a token at: ${endpoint}/settings/profile\\n`);\n\t\t\t\tconst token = await prompt('API Token: ', {\n\t\t\t\t\thidden: true,\n\t\t\t\t\tinstead: INSTEAD,\n\t\t\t\t});\n\n\t\t\t\tlogger.log('\\nValidating credentials...');\n\t\t\t\tif (!(await validateDokployToken(endpoint, token))) {\n\t\t\t\t\tthrow new DokployTokenRejected(endpoint);\n\t\t\t\t}\n\n\t\t\t\tawait storeDokployCredentials(token, endpoint);\n\t\t\t\tlogger.log('✓ Credentials saved');\n\t\t\t\treturn { endpoint, token } as never;\n\t\t\t}\n\n\t\t\t// AWS is a profile or a role, set up with the AWS CLI — not keys\n\t\t\t// typed into a deploy.\n\t\t\tif (request.kind !== 'registry') return undefined;\n\n\t\t\tlogger.log(\n\t\t\t\t`   Dokploy has no registry for ${request.url}. Let's create one.`,\n\t\t\t);\n\t\t\tconst username = await prompt('Registry username: ', {\n\t\t\t\tinstead: INSTEAD,\n\t\t\t});\n\t\t\tconst password = await prompt('Registry password/token: ', {\n\t\t\t\thidden: true,\n\t\t\t\tinstead: INSTEAD,\n\t\t\t});\n\t\t\treturn { username, password } as never;\n\t\t},\n\t};\n}\n\n/**\n * The environment, then the stored login, then — at a terminal — the person\n * running the command.\n */\nexport function terminalCredentials(\n\tbase: CredentialProvider = storedCredentials(),\n): CredentialProvider {\n\treturn chainCredentials(base, asking());\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,MAAM,SAAS;;AAGf,MAAM,UAAU;;AAGhB,IAAa,yBAAb,cAA4C,MAAM;CAC5B;CAArB,YAAY,UAA2B;EACtC,MAAM,oBAAoB;EADN,KAAA,WAAA;EAEpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,uBAAb,cAA0C,MAAM;CAC1B;CAArB,YAAY,UAA2B;EACtC,MAAM,+CAA+C;EADjC,KAAA,WAAA;EAEpB,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,SAA6B;CACrC,OAAO,EACN,MAAM,IAAI,OAAO;EAChB,IAAI,CAAC,UAAU,GAAG,OAAO,KAAA;EAEzB,MAAM,UAAU;EAEhB,IAAI,QAAQ,SAAS,WAAW;GAC/B,OAAO,IAAI,wDAAwD;GACnE,MAAM,YACL,MAAM,OAAO,qDAAqD,EACjE,SAAS,QACV,CAAC,EAAA,CACA,QAAQ,OAAO,EAAE;GAEnB,IAAI;IACH,IAAI,IAAI,QAAQ;GACjB,QAAQ;IACP,MAAM,IAAI,uBAAuB,QAAQ;GAC1C;GAEA,OAAO,IAAI,0BAA0B,SAAS,oBAAoB;GAClE,MAAM,QAAQ,MAAM,OAAO,eAAe;IACzC,QAAQ;IACR,SAAS;GACV,CAAC;GAED,OAAO,IAAI,6BAA6B;GACxC,IAAI,CAAE,MAAM,qBAAqB,UAAU,KAAK,GAC/C,MAAM,IAAI,qBAAqB,QAAQ;GAGxC,MAAM,wBAAwB,OAAO,QAAQ;GAC7C,OAAO,IAAI,qBAAqB;GAChC,OAAO;IAAE;IAAU;GAAM;EAC1B;EAIA,IAAI,QAAQ,SAAS,YAAY,OAAO,KAAA;EAExC,OAAO,IACN,kCAAkC,QAAQ,IAAI,oBAC/C;EAQA,OAAO;GAAE,UAAA,MAPc,OAAO,uBAAuB,EACpD,SAAS,QACV,CAAC;GAKkB,UAAA,MAJI,OAAO,6BAA6B;IAC1D,QAAQ;IACR,SAAS;GACV,CAAC;EAC2B;CAC7B,EACD;AACD;;;;;AAMA,SAAgB,oBACf,OAA2B,kBAAkB,GACxB;CACrB,OAAO,iBAAiB,MAAM,OAAO,CAAC;AACvC"}

package/dist/{types-DkrDOMxw.d.cts → types-CSw2w69a.d.mts}

@@ -1,5 +1,4 @@
 import { ConstructManifest } from "@geekmidas/manifest";
-//#endregion
 //#region src/deploy/identity.d.ts
 /**
  * Who a deploy is, on a target it shares with other workspaces.
@@ -228,16 +227,40 @@ interface DokployStageState {
    * deployed with whoever deploys it next.
    */
   registryId?: string;
-  /** Each app's image as last deployed, keyed by app name. */
-  images?: Record<string, DeployedImage>;
+  /**
+   * Each app's releases, keyed by app name: what runs now, what ran before
+   * it — which `gkm deploy:rollback` restores — and the history behind both.
+   */
+  releases?: Record<string, AppReleases>;
   lastDeployedAt: string;
 }
 /** An image a stage runs: the ref it was pushed as, and what it resolved to. */
 interface DeployedImage {
   ref: string;
+  /**
+   * The tag it was released under — a site's carries its stage
+   * (`v1.4.0-production`). Recorded by targets that pull a release by tag.
+   */
+  tag?: string;
   /** The registry's digest, `sha256:…` — absent if it could not be read. */
   digest?: string;
 }
+/** An image that went live, and when. */
+interface ReleasedImage extends DeployedImage {
+  /** The image tag the deploy released under. */
+  tag?: string;
+  releasedAt: string;
+  /** Set when a rollback replaced it: it is never rolled back *to*. */
+  rolledBack?: true;
+}
+/** An app's releases: what runs, what ran before it, and what ran before that. */
+interface AppReleases {
+  current: ReleasedImage;
+  /** What a rollback restores; absent until a second release. */
+  previous?: ReleasedImage;
+  /** Every release, newest first, at most {@link RELEASE_HISTORY} of them. */
+  history: ReleasedImage[];
+}
 //#endregion
 //#region src/deploy/StateStore.d.ts
 /** Opaque: a file hash, an SSM parameter version or an S3 ETag. */
@@ -444,11 +467,11 @@ interface CredentialKinds {
   };
   /**
    * A container registry login, for Dokploy to pull with. Asked for only when
-   * Dokploy has no registry for `deploy.dokploy.registry` and one has to be
+   * Dokploy has no registry for `deploy.registry` and one has to be
    * created.
    */
   registry: {
-    /** `deploy.dokploy.registry`. */
+    /** `deploy.registry`. */
     request: {
       url: string;
     };
@@ -615,11 +638,12 @@ interface DeployResult extends WorkspaceDeployResult {
  * - `provision`: what the apps run on — for Dokploy the project, environment
  *   and registry — and the declared constructs
  * - `build`: each app's artifact, built without changing anything live
- * - `release`: the artifacts put live. Dokploy builds and pushes each image
- *   here, beside its application, because a site's build args are resolved
- *   per app
- * - `verify`: what was released answers — for Dokploy, DNS records and its
- *   domain validation
+ * - `release`: the artifacts put live. Dokploy applies the stage's
+ *   migrations, then builds and pushes each image here, beside its
+ *   application, because a site's build args are resolved per app — and
+ *   checks each backend before any site is released
+ * - `verify`: what was released answers — for Dokploy, each site's DNS
+ *   records and health
  * - `rollback`: the previous release restored, after `release` or `verify`
  *   failed, on a target that can
  */
@@ -765,6 +789,14 @@ interface DeployTargetCapabilities {
    * the deploy runs, and a registry to push to.
    */
   images: boolean;
+  /**
+   * Whether it can also run the project's local stage — `gkm deploy --stage
+   * <local>`. Only a target that runs on this machine can: a stack started
+   * here is the local stage's, while one on a server is shared, and the local
+   * stage's secrets are a developer's. Absent, a deploy refuses the local
+   * stage with `UndeclaredStage`.
+   */
+  localStage?: boolean;
 }
 /** A failed validation of a target's options, issue by issue. */
 interface TargetOptionsIssue {
@@ -838,6 +870,12 @@ interface DeployPhaseContext<Options = undefined> {
   readonly stage: string;
   /** The image tag, or whatever version label the target releases under. */
   readonly tag: string;
+  /**
+   * Whether `tag` was asked for (`--tag`) rather than made up for this run
+   * — by the target's own `tag()`, else `<stage>-<timestamp>`. A target that
+   * releases what CI already pushed when given one tells the two apart here.
+   */
+  readonly tagGiven: boolean;
   /**
    * The apps this target deploys, in dependency order: those asked for that
    * deploy here. Apps that deploy elsewhere are already in `skipped`.
@@ -861,6 +899,13 @@ interface DeployPhaseContext<Options = undefined> {
    * events — without changing anything. Only `validate` and `plan` run.
    */
   readonly dryRun: boolean;
+  /**
+   * When `release` or `verify` fails, roll back every app the run released
+   * rather than only those that failed — for apps that must move together,
+   * an API and the site built against it. Only a target that can roll back
+   * reads it.
+   */
+  readonly atomic: boolean;
   /** Where every credential comes from. Nothing prompts. */
   readonly credentials: CredentialProvider;
   /**
@@ -939,6 +984,15 @@ interface DeployTarget<Options = undefined, Run = unknown> {
    * host or `gkm login` can collect them up front.
    */
   readonly credentials?: readonly CredentialKind[];
+  /**
+   * The tag a run releases under when none is asked for. Without one it is
+   * `<stage>-<timestamp>`; a target that builds from the checkout can name
+   * its images after the commit instead.
+   */
+  tag?(where: {
+    readonly cwd: string;
+    readonly stage: string;
+  }): Promise<string>;
   /**
    * Everything the deploy needs, checked before anything changes: the
    * config, the apps, credentials, the stage's secrets.
@@ -5629,11 +5683,18 @@ declare const WorkspaceConfigSchema: ZodObject<{
     targets: ZodOptional<ZodRecord<ZodString, ZodUnion<readonly [ZodString, ZodCustom<unknown, unknown>, ZodTuple<[ZodUnion<readonly [ZodString, ZodCustom<unknown, unknown>]>, ZodUnknown], null>]>>>;
     namespace: ZodOptional<ZodString>;
     domains: ZodOptional<ZodRecord<ZodString, ZodString>>;
+    registry: ZodOptional<ZodString>;
     dokploy: ZodOptional<ZodObject<{
       endpoint: ZodOptional<ZodURL>;
       endpoints: ZodOptional<ZodRecord<ZodString, ZodURL>>;
-      registry: ZodOptional<ZodString>;
       registryId: ZodOptional<ZodString>;
+      verify: ZodOptional<ZodObject<{
+        deploymentTimeoutMs: ZodOptional<ZodNumber>;
+        healthCheckPath: ZodOptional<ZodString>;
+        healthyAfter: ZodOptional<ZodNumber>;
+        intervalMs: ZodOptional<ZodNumber>;
+        healthTimeoutMs: ZodOptional<ZodNumber>;
+      }, $strip>>;
     }, $strip>>;
     dns: ZodOptional<ZodUnion<readonly [ZodRecord<ZodString, ZodUnion<readonly [ZodDiscriminatedUnion<[ZodObject<{
       provider: ZodLiteral<"hostinger">;
@@ -5952,7 +6013,7 @@ declare function formatValidationErrors(error: ZodError): string;
  * deploy: 'acme' // deploy: { targets: { acme: '@acme/gkm-target' } }
  * ```
  */
-type DeployTargetName = 'dokploy' | 'sst' | (string & {});
+type DeployTargetName = 'dokploy' | 'compose' | 'sst' | (string & {});
 /**
  * Each deployed stage's base domain — `deploy.domains`.
  *
@@ -6005,9 +6066,9 @@ type AppDomainConfig = string | Record<string, string>;
  * ```ts
  * deploy: {
  *   default: 'dokploy',
+ *   registry: 'ghcr.io/myorg',
  *   dokploy: {
  *     endpoint: 'https://dokploy.myserver.com',
- *     registry: 'ghcr.io/myorg',
  *   },
  * }
  * ```
@@ -6016,12 +6077,12 @@ type AppDomainConfig = string | Record<string, string>;
  * ```ts
  * deploy: {
  *   default: 'dokploy',
+ *   registry: 'ghcr.io/myorg',
  *   dokploy: {
  *     endpoints: {
  *       development: 'https://dev-dokploy.myserver.com',
  *       production: 'https://dokploy.myserver.com',
  *     },
- *     registry: 'ghcr.io/myorg',
  *   },
  * }
  * ```
@@ -6031,10 +6092,33 @@ interface DokployWorkspaceConfig {
   endpoint?: string;
   /** Per-stage Dokploy API endpoints (overrides endpoint) */
   endpoints?: Record<string, string>;
-  /** Container registry for Docker images (e.g., 'ghcr.io/myorg') */
-  registry?: string;
   /** Registry ID in Dokploy (auto-configured) */
   registryId?: string;
+  /** How a release is waited for and checked before it counts as live. */
+  verify?: DokployVerifyConfig;
+}
+/**
+ * How a Dokploy release is waited for and checked.
+ *
+ * A release counts once Dokploy's deployment has finished and the app has
+ * answered its health route `healthyAfter` times in a row. One that does not
+ * is rolled back.
+ */
+interface DokployVerifyConfig {
+  /** How long Dokploy may take to finish a deployment. Default 10 minutes. */
+  deploymentTimeoutMs?: number;
+  /**
+   * The path each backend is checked on, under its domain. Default
+   * `/health`, which every production server build serves. A site is
+   * checked at `/`.
+   */
+  healthCheckPath?: string;
+  /** Consecutive 2xx answers that make an app healthy. Default 3. */
+  healthyAfter?: number;
+  /** Between health checks, and the first wait between polls. Default 2s. */
+  intervalMs?: number;
+  /** How long an app may take to become healthy. Default 5 minutes. */
+  healthTimeoutMs?: number;
 }
 /**
  * Deployment configuration for the workspace.
@@ -6049,10 +6133,10 @@ interface DokployWorkspaceConfig {
  * // Full configuration with DNS and backups
  * deploy: {
  *   default: 'dokploy',
+ *   registry: 'ghcr.io/myorg',
  *   dokploy: {
  *     endpoint: 'https://dokploy.myserver.com',
  *     projectId: 'proj_abc123',
- *     registry: 'ghcr.io/myorg',
  *     domains: {
  *       production: 'myapp.com',
  *     },
@@ -6101,6 +6185,12 @@ interface DeployConfig {
   namespace?: string;
   /** Each deployed stage's base domain — see {@link DomainsConfig}. */
   domains?: DomainsConfig;
+  /**
+   * The container registry the apps' images are pushed to and pulled from,
+   * whatever the target — `ghcr.io/myorg`. An image is
+   * `<registry>/<namespace>/<project>-<app>:<tag>`.
+   */
+  registry?: string;
   /** Dokploy-specific configuration */
   dokploy?: DokployWorkspaceConfig;
   /** DNS configuration for automatic record creation */
@@ -6654,6 +6744,7 @@ type InferredWorkspaceConfig<TApps extends AppsRecord> = {
  *   // Deployment configuration
  *   deploy: {
  *     default: 'dokploy',
+ *     registry: 'ghcr.io/myorg',
  *     domains: {
  *       production: 'myapp.com',
  *       staging: 'staging.myapp.com',
@@ -6661,7 +6752,6 @@ type InferredWorkspaceConfig<TApps extends AppsRecord> = {
  *     dokploy: {
  *       endpoint: 'https://dokploy.myserver.com',
  *       projectId: 'proj_abc123',
- *       registry: 'ghcr.io/myorg',
  *     },
  *   },
  *
@@ -7034,5 +7124,5 @@ interface GkmConfig {
   deploy?: DeployConfig;
 }
 //#endregion
-export { DeployEventError as $, PHASE_2_DEPLOY_TARGETS as A, DeployFailure as B, WorkspaceConfig as C, Framework as D, BackendFramework as E, isDeployTargetSupported as F, DeployTargetCapabilities as G, DeployRuntime as H, isPhase2DeployTarget as I, TargetEvent as J, DeployTargetEntry as K, safeValidateWorkspaceConfig as L, WorkspaceConfigSchema as M, formatValidationErrors as N, FrontendFramework as O, getDeployTargetError as P, DeployEvent as Q, validateWorkspaceConfig as R, SharedConfig as S, isWorkspaceConfig as T, DeploySecrets as U, DeployPhaseContext as V, DeployTarget as W, TargetOptionsIssue as X, TargetOptions as Y, TargetOptionsSchema as Z, LoadedConfig as _, StateStore as _t, Routes as a, DeployResult as at, NormalizedWorkspace as b, DeployIdentity as bt, AppInput as c, CredentialKind as ct, DeployConfig as d, CredentialRequest as dt, DeployEventType as et, DeployTargetName as f, MissingCredential as ft, InferredWorkspaceConfig as g, StateLocked as gt, InferAppNames as h, storedCredentials as ht, OpenApiConfig as i, AppDeployResult as it, SUPPORTED_DEPLOY_TARGETS as j, MobileFramework as k, AppsRecord as l, CredentialKinds as lt, DokployWorkspaceConfig as m, chainCredentials as mt, EmailBackend as n, ResourceChange as nt, AppConfig as o, AwsCredential as ot, DevConfig as p, StoredCredentialsOptions as pt, DeployTargetLogger as q, GkmConfig as r, ResourceVia as rt, AppConfigInput as s, Credential as st, CacheBackend as t, DeployPhase as tt, ConstrainedApps as u, CredentialProvider as ut, ModelsConfig as v, StateVersionConflict as vt, WorkspaceInput as w, SecretsConfig as x, deployIdentity as xt, NormalizedAppConfig as y, StageSecrets as yt, AnyDeployTarget as z };
-//# sourceMappingURL=types-DkrDOMxw.d.cts.map
+export { DeployEventError as $, PHASE_2_DEPLOY_TARGETS as A, DeployFailure as B, WorkspaceConfig as C, Framework as D, BackendFramework as E, isDeployTargetSupported as F, DeployTargetCapabilities as G, DeployRuntime as H, isPhase2DeployTarget as I, TargetEvent as J, DeployTargetEntry as K, safeValidateWorkspaceConfig as L, WorkspaceConfigSchema as M, formatValidationErrors as N, FrontendFramework as O, getDeployTargetError as P, DeployEvent as Q, validateWorkspaceConfig as R, SharedConfig as S, deployIdentity as St, isWorkspaceConfig as T, DeploySecrets as U, DeployPhaseContext as V, DeployTarget as W, TargetOptionsIssue as X, TargetOptions as Y, TargetOptionsSchema as Z, LoadedConfig as _, StateStore as _t, Routes as a, DeployResult as at, NormalizedWorkspace as b, StageSecrets as bt, AppInput as c, CredentialKind as ct, DeployConfig as d, CredentialRequest as dt, DeployEventType as et, DeployTargetName as f, MissingCredential as ft, InferredWorkspaceConfig as g, StateLocked as gt, InferAppNames as h, storedCredentials as ht, OpenApiConfig as i, AppDeployResult as it, SUPPORTED_DEPLOY_TARGETS as j, MobileFramework as k, AppsRecord as l, CredentialKinds as lt, DokployWorkspaceConfig as m, chainCredentials as mt, EmailBackend as n, ResourceChange as nt, AppConfig as o, AwsCredential as ot, DevConfig as p, StoredCredentialsOptions as pt, DeployTargetLogger as q, GkmConfig as r, ResourceVia as rt, AppConfigInput as s, Credential as st, CacheBackend as t, DeployPhase as tt, ConstrainedApps as u, CredentialProvider as ut, ModelsConfig as v, StateVersionConflict as vt, WorkspaceInput as w, SecretsConfig as x, DeployIdentity as xt, NormalizedAppConfig as y, ReleasedImage as yt, AnyDeployTarget as z };
+//# sourceMappingURL=types-CSw2w69a.d.mts.map