@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.66

package/dist/rollback-DvAo4OKS.mjs

@@ -0,0 +1,133 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { t as LocalSandbox } from "./local-CWR4Y_kW.mjs";
+import { r as storedCredentials } from "./credentials-Dq1MnWQf.mjs";
+import { c as withSandbox } from "./sandbox-Dm247NGx.mjs";
+import { k as assertDeployedStage } from "./workspace-Be6uBhlF.mjs";
+import { findWorkspaceRoot, loadWorkspaceConfig } from "./config.mjs";
+import { o as recordRollback, p as DeployJournal, t as createEmptyState } from "./state-uuYqnRVO.mjs";
+import { g as createStateStore } from "./sniffer-BAQhLEsI.mjs";
+import { i as dokployApi, l as restoreImage, p as verifySettings } from "./engine-CunvOG3s.mjs";
+import { resolve } from "node:path";
+//#region src/target/dokploy/rollback.ts
+/**
+* `gkm deploy:rollback`: a stage's apps put back on the release before the
+* one they run, by hand — for a release that passed its checks and turned out
+* wrong anyway.
+*
+* One app by default, because an app is what usually broke: rolling the API
+* back over a site fix that shipped beside it undoes the fix too. `atomic`
+* rolls back every app that has a release to go back to, for apps that only
+* work together — an API and the site built against its newer contract.
+*
+* It restores images and nothing else. The environment an app runs with is
+* the stage's, resolved on every deploy, and migrations are forward-only: a
+* migration that the older code cannot run against is undone by a new
+* migration, never by a rollback.
+*/
+var rollback_exports = /* @__PURE__ */ __exportAll({
+	NothingToRollBack: () => NothingToRollBack,
+	RollbackNeedsApp: () => RollbackNeedsApp,
+	StageNeverDeployed: () => StageNeverDeployed,
+	rollbackStage: () => rollbackStage
+});
+/** Neither an app nor every app was asked for. */
+var RollbackNeedsApp = class extends Error {
+	stage;
+	apps;
+	constructor(stage, apps) {
+		super(`Say what to roll back: --app <name> for one app (${apps.join(", ") || "none has an earlier release"}), or --atomic for every app of "${stage}" together.`);
+		this.stage = stage;
+		this.apps = apps;
+		this.name = "RollbackNeedsApp";
+	}
+};
+/** An app has no release before the one it runs. */
+var NothingToRollBack = class extends Error {
+	stage;
+	app;
+	constructor(stage, app) {
+		super(`"${app}" has no earlier release on "${stage}" to roll back to: it has been released once, or every earlier release was itself rolled back. Deploy the version you want instead.`);
+		this.stage = stage;
+		this.app = app;
+		this.name = "NothingToRollBack";
+	}
+};
+/** The stage was never deployed through Dokploy from this state. */
+var StageNeverDeployed = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`"${stage}" has no deploy state, so there is nothing to roll back. Check the stage name, and that \`state\` in gkm.config.ts points at the store the deploys write to.`);
+		this.stage = stage;
+		this.name = "StageNeverDeployed";
+	}
+};
+/**
+* Roll a stage's app — or, `atomic`, all of them — back to its previous
+* release, holding the stage's lock as a deploy does.
+*/
+async function rollbackStage(input) {
+	const signal = input.signal ?? new AbortController().signal;
+	const log = input.log ?? (() => {});
+	const credentials = input.credentials ?? storedCredentials();
+	const sandbox = input.sandbox ?? new LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });
+	return withSandbox(sandbox, async () => {
+		const { workspace } = await loadWorkspaceConfig(resolve(input.cwd), { sandbox });
+		assertDeployedStage(workspace.stages, input.stage);
+		const store = await createStateStore({
+			config: workspace.state,
+			workspaceRoot: workspace.root,
+			workspaceName: workspace.name
+		});
+		if (!await store.read(input.stage)) throw new StageNeverDeployed(input.stage);
+		const lock = await store.lock(input.stage, { operation: "rollback" });
+		try {
+			const journal = await DeployJournal.open(store, input.stage, () => createEmptyState(input.stage, "", ""));
+			const { state } = journal;
+			const releases = state.releases ?? {};
+			const restorable = Object.keys(releases).filter((app) => releases[app].previous);
+			let apps;
+			if (input.atomic) {
+				apps = restorable;
+				if (apps.length === 0) throw new RollbackNeedsApp(input.stage, restorable);
+			} else if (input.app) {
+				if (!releases[input.app]?.previous) throw new NothingToRollBack(input.stage, input.app);
+				apps = [input.app];
+			} else throw new RollbackNeedsApp(input.stage, restorable);
+			const { api } = await dokployApi(workspace, {
+				credentials,
+				signal
+			});
+			const verify = verifySettings(workspace.deploy.dokploy?.verify);
+			const rolled = [];
+			for (const app of apps) {
+				signal.throwIfAborted();
+				const { current, previous } = releases[app];
+				const applicationId = state.applications[app];
+				if (!previous || !applicationId) throw new NothingToRollBack(input.stage, app);
+				log(`⏪ ${app}: ${current.ref} → ${previous.ref}`);
+				await restoreImage(api, {
+					applicationId,
+					image: previous,
+					registryId: state.registryId,
+					verify,
+					signal
+				});
+				recordRollback(state, app, previous);
+				await journal.save();
+				log(`   ✓ ${app} is running ${previous.ref}`);
+				rolled.push({
+					app,
+					from: current,
+					to: previous
+				});
+			}
+			return rolled;
+		} finally {
+			await lock.release();
+		}
+	});
+}
+//#endregion
+export { rollback_exports as a, rollbackStage as i, RollbackNeedsApp as n, StageNeverDeployed as r, NothingToRollBack as t };
+
+//# sourceMappingURL=rollback-DvAo4OKS.mjs.map

package/dist/rollback-DvAo4OKS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback-DvAo4OKS.mjs","names":[],"sources":["../src/target/dokploy/rollback.ts"],"sourcesContent":["/**\n * `gkm deploy:rollback`: a stage's apps put back on the release before the\n * one they run, by hand — for a release that passed its checks and turned out\n * wrong anyway.\n *\n * One app by default, because an app is what usually broke: rolling the API\n * back over a site fix that shipped beside it undoes the fix too. `atomic`\n * rolls back every app that has a release to go back to, for apps that only\n * work together — an API and the site built against its newer contract.\n *\n * It restores images and nothing else. The environment an app runs with is\n * the stage's, resolved on every deploy, and migrations are forward-only: a\n * migration that the older code cannot run against is undone by a new\n * migration, never by a rollback.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../../config';\nimport {\n\ttype CredentialProvider,\n\tstoredCredentials,\n} from '../../deploy/credentials';\nimport { DeployJournal } from '../../deploy/journal';\nimport { createStateStore } from '../../deploy/StateStore';\nimport {\n\tcreateEmptyState,\n\ttype ReleasedImage,\n\trecordRollback,\n} from '../../deploy/state';\nimport { LocalSandbox } from '../../sandbox/local';\nimport { type Sandbox, withSandbox } from '../../sandbox/sandbox';\nimport { assertDeployedStage } from '../../workspace/stages';\nimport { dokployApi, restoreImage, verifySettings } from './engine';\n\nexport interface RollbackInput {\n\t/** The project: the directory holding `gkm.config.ts`, or one inside it. */\n\tcwd: string;\n\tstage: string;\n\t/** The app to roll back. */\n\tapp?: string;\n\t/** Every app with an earlier release, instead of one. */\n\tatomic?: boolean;\n\t/** Defaults to the environment, then the logins `gkm login` stored. */\n\tcredentials?: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Each progress line. Defaults to none. */\n\tlog?: (line: string) => void;\n\t/** Where the config is loaded. Defaults to a `LocalSandbox` on the project. */\n\tsandbox?: Sandbox;\n}\n\n/** One app rolled back. */\nexport interface RolledBack {\n\tapp: string;\n\tfrom: ReleasedImage;\n\tto: ReleasedImage;\n}\n\n/** Neither an app nor every app was asked for. */\nexport class RollbackNeedsApp extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** The apps that have a release to go back to. */\n\t\treadonly apps: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Say what to roll back: --app <name> for one app (${apps.join(', ') || 'none has an earlier release'}), ` +\n\t\t\t\t`or --atomic for every app of \"${stage}\" together.`,\n\t\t);\n\t\tthis.name = 'RollbackNeedsApp';\n\t}\n}\n\n/** An app has no release before the one it runs. */\nexport class NothingToRollBack extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly app: string,\n\t) {\n\t\tsuper(\n\t\t\t`\"${app}\" has no earlier release on \"${stage}\" to roll back to: it has been released once, ` +\n\t\t\t\t'or every earlier release was itself rolled back. Deploy the version you want instead.',\n\t\t);\n\t\tthis.name = 'NothingToRollBack';\n\t}\n}\n\n/** The stage was never deployed through Dokploy from this state. */\nexport class StageNeverDeployed extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`\"${stage}\" has no deploy state, so there is nothing to roll back. ` +\n\t\t\t\t'Check the stage name, and that `state` in gkm.config.ts points at the store the deploys write to.',\n\t\t);\n\t\tthis.name = 'StageNeverDeployed';\n\t}\n}\n\n/**\n * Roll a stage's app — or, `atomic`, all of them — back to its previous\n * release, holding the stage's lock as a deploy does.\n */\nexport async function rollbackStage(\n\tinput: RollbackInput,\n): Promise<RolledBack[]> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst log = input.log ?? (() => {});\n\tconst credentials = input.credentials ?? storedCredentials();\n\tconst sandbox =\n\t\tinput.sandbox ??\n\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\n\treturn withSandbox(sandbox, async () => {\n\t\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\t\tsandbox,\n\t\t});\n\t\tassertDeployedStage(workspace.stages, input.stage);\n\n\t\tconst store = await createStateStore({\n\t\t\tconfig: workspace.state,\n\t\t\tworkspaceRoot: workspace.root,\n\t\t\tworkspaceName: workspace.name,\n\t\t});\n\t\tif (!(await store.read(input.stage))) {\n\t\t\tthrow new StageNeverDeployed(input.stage);\n\t\t}\n\n\t\tconst lock = await store.lock(input.stage, { operation: 'rollback' });\n\t\ttry {\n\t\t\tconst journal = await DeployJournal.open(store, input.stage, () =>\n\t\t\t\tcreateEmptyState(input.stage, '', ''),\n\t\t\t);\n\t\t\tconst { state } = journal;\n\t\t\tconst releases = state.releases ?? {};\n\t\t\tconst restorable = Object.keys(releases).filter(\n\t\t\t\t(app) => releases[app]!.previous,\n\t\t\t);\n\n\t\t\tlet apps: string[];\n\t\t\tif (input.atomic) {\n\t\t\t\tapps = restorable;\n\t\t\t\tif (apps.length === 0) {\n\t\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t\t}\n\t\t\t} else if (input.app) {\n\t\t\t\tif (!releases[input.app]?.previous) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, input.app);\n\t\t\t\t}\n\t\t\t\tapps = [input.app];\n\t\t\t} else {\n\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t}\n\n\t\t\tconst { api } = await dokployApi(workspace, { credentials, signal });\n\t\t\tconst verify = verifySettings(workspace.deploy.dokploy?.verify);\n\t\t\tconst rolled: RolledBack[] = [];\n\n\t\t\tfor (const app of apps) {\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t\tconst { current, previous } = releases[app]!;\n\t\t\t\tconst applicationId = state.applications[app];\n\t\t\t\tif (!previous || !applicationId) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, app);\n\t\t\t\t}\n\n\t\t\t\tlog(`⏪ ${app}: ${current.ref} → ${previous.ref}`);\n\t\t\t\tawait restoreImage(api, {\n\t\t\t\t\tapplicationId,\n\t\t\t\t\timage: previous,\n\t\t\t\t\tregistryId: state.registryId,\n\t\t\t\t\tverify,\n\t\t\t\t\tsignal,\n\t\t\t\t});\n\t\t\t\trecordRollback(state, app, previous);\n\t\t\t\tawait journal.save();\n\t\t\t\tlog(`   ✓ ${app} is running ${previous.ref}`);\n\t\t\t\trolled.push({ app, from: current, to: previous });\n\t\t\t}\n\n\t\t\treturn rolled;\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CAEA;CAHV,YACC,OAEA,MACC;EACD,MACC,oDAAoD,KAAK,KAAK,IAAI,KAAK,8BAA8B,mCACnE,MAAM,YACzC;EAPS,KAAA,QAAA;EAEA,KAAA,OAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CACA;CAFV,YACC,OACA,KACC;EACD,MACC,IAAI,IAAI,+BAA+B,MAAM,oIAE9C;EANS,KAAA,QAAA;EACA,KAAA,MAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CACxB;CAArB,YAAY,OAAwB;EACnC,MACC,IAAI,MAAM,6JAEX;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,eAAsB,cACrB,OACwB;CACxB,MAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CACrD,MAAM,MAAM,MAAM,cAAc,CAAC;CACjC,MAAM,cAAc,MAAM,eAAe,kBAAkB;CAC3D,MAAM,UACL,MAAM,WACN,IAAI,aAAa,EAAE,MAAM,kBAAkB,QAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;CAEjE,OAAO,YAAY,SAAS,YAAY;EACvC,MAAM,EAAE,cAAc,MAAM,oBAAoB,QAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;EACD,oBAAoB,UAAU,QAAQ,MAAM,KAAK;EAEjD,MAAM,QAAQ,MAAM,iBAAiB;GACpC,QAAQ,UAAU;GAClB,eAAe,UAAU;GACzB,eAAe,UAAU;EAC1B,CAAC;EACD,IAAI,CAAE,MAAM,MAAM,KAAK,MAAM,KAAK,GACjC,MAAM,IAAI,mBAAmB,MAAM,KAAK;EAGzC,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,EAAE,WAAW,WAAW,CAAC;EACpE,IAAI;GACH,MAAM,UAAU,MAAM,cAAc,KAAK,OAAO,MAAM,aACrD,iBAAiB,MAAM,OAAO,IAAI,EAAE,CACrC;GACA,MAAM,EAAE,UAAU;GAClB,MAAM,WAAW,MAAM,YAAY,CAAC;GACpC,MAAM,aAAa,OAAO,KAAK,QAAQ,CAAC,CAAC,QACvC,QAAQ,SAAS,IAAI,CAAE,QACzB;GAEA,IAAI;GACJ,IAAI,MAAM,QAAQ;IACjB,OAAO;IACP,IAAI,KAAK,WAAW,GACnB,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAEpD,OAAO,IAAI,MAAM,KAAK;IACrB,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,UACzB,MAAM,IAAI,kBAAkB,MAAM,OAAO,MAAM,GAAG;IAEnD,OAAO,CAAC,MAAM,GAAG;GAClB,OACC,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAGnD,MAAM,EAAE,QAAQ,MAAM,WAAW,WAAW;IAAE;IAAa;GAAO,CAAC;GACnE,MAAM,SAAS,eAAe,UAAU,OAAO,SAAS,MAAM;GAC9D,MAAM,SAAuB,CAAC;GAE9B,KAAK,MAAM,OAAO,MAAM;IACvB,OAAO,eAAe;IACtB,MAAM,EAAE,SAAS,aAAa,SAAS;IACvC,MAAM,gBAAgB,MAAM,aAAa;IACzC,IAAI,CAAC,YAAY,CAAC,eACjB,MAAM,IAAI,kBAAkB,MAAM,OAAO,GAAG;IAG7C,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,SAAS,KAAK;IAChD,MAAM,aAAa,KAAK;KACvB;KACA,OAAO;KACP,YAAY,MAAM;KAClB;KACA;IACD,CAAC;IACD,eAAe,OAAO,KAAK,QAAQ;IACnC,MAAM,QAAQ,KAAK;IACnB,IAAI,QAAQ,IAAI,cAAc,SAAS,KAAK;IAC5C,OAAO,KAAK;KAAE;KAAK,MAAM;KAAS,IAAI;IAAS,CAAC;GACjD;GAEA,OAAO;EACR,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD,CAAC;AACF"}

package/dist/rollback-DxJK84hy.cjs

@@ -0,0 +1,162 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_local = require("./local-BdH4XN0E.cjs");
+const require_credentials = require("./credentials-Bzbg23n8.cjs");
+const require_sandbox = require("./sandbox-CL--ZDui.cjs");
+const require_workspace = require("./workspace-ON-bqiJz.cjs");
+const require_config = require("./config.cjs");
+const require_state = require("./state-Y6ATakMX.cjs");
+const require_sniffer = require("./sniffer-5xmrkh2a.cjs");
+const require_engine = require("./engine-DR6KurWX.cjs");
+let node_path = require("node:path");
+//#region src/target/dokploy/rollback.ts
+/**
+* `gkm deploy:rollback`: a stage's apps put back on the release before the
+* one they run, by hand — for a release that passed its checks and turned out
+* wrong anyway.
+*
+* One app by default, because an app is what usually broke: rolling the API
+* back over a site fix that shipped beside it undoes the fix too. `atomic`
+* rolls back every app that has a release to go back to, for apps that only
+* work together — an API and the site built against its newer contract.
+*
+* It restores images and nothing else. The environment an app runs with is
+* the stage's, resolved on every deploy, and migrations are forward-only: a
+* migration that the older code cannot run against is undone by a new
+* migration, never by a rollback.
+*/
+var rollback_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	NothingToRollBack: () => NothingToRollBack,
+	RollbackNeedsApp: () => RollbackNeedsApp,
+	StageNeverDeployed: () => StageNeverDeployed,
+	rollbackStage: () => rollbackStage
+});
+/** Neither an app nor every app was asked for. */
+var RollbackNeedsApp = class extends Error {
+	stage;
+	apps;
+	constructor(stage, apps) {
+		super(`Say what to roll back: --app <name> for one app (${apps.join(", ") || "none has an earlier release"}), or --atomic for every app of "${stage}" together.`);
+		this.stage = stage;
+		this.apps = apps;
+		this.name = "RollbackNeedsApp";
+	}
+};
+/** An app has no release before the one it runs. */
+var NothingToRollBack = class extends Error {
+	stage;
+	app;
+	constructor(stage, app) {
+		super(`"${app}" has no earlier release on "${stage}" to roll back to: it has been released once, or every earlier release was itself rolled back. Deploy the version you want instead.`);
+		this.stage = stage;
+		this.app = app;
+		this.name = "NothingToRollBack";
+	}
+};
+/** The stage was never deployed through Dokploy from this state. */
+var StageNeverDeployed = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`"${stage}" has no deploy state, so there is nothing to roll back. Check the stage name, and that \`state\` in gkm.config.ts points at the store the deploys write to.`);
+		this.stage = stage;
+		this.name = "StageNeverDeployed";
+	}
+};
+/**
+* Roll a stage's app — or, `atomic`, all of them — back to its previous
+* release, holding the stage's lock as a deploy does.
+*/
+async function rollbackStage(input) {
+	const signal = input.signal ?? new AbortController().signal;
+	const log = input.log ?? (() => {});
+	const credentials = input.credentials ?? require_credentials.storedCredentials();
+	const sandbox = input.sandbox ?? new require_local.LocalSandbox({ root: require_config.findWorkspaceRoot((0, node_path.resolve)(input.cwd)) });
+	return require_sandbox.withSandbox(sandbox, async () => {
+		const { workspace } = await require_config.loadWorkspaceConfig((0, node_path.resolve)(input.cwd), { sandbox });
+		require_workspace.assertDeployedStage(workspace.stages, input.stage);
+		const store = await require_sniffer.createStateStore({
+			config: workspace.state,
+			workspaceRoot: workspace.root,
+			workspaceName: workspace.name
+		});
+		if (!await store.read(input.stage)) throw new StageNeverDeployed(input.stage);
+		const lock = await store.lock(input.stage, { operation: "rollback" });
+		try {
+			const journal = await require_state.DeployJournal.open(store, input.stage, () => require_state.createEmptyState(input.stage, "", ""));
+			const { state } = journal;
+			const releases = state.releases ?? {};
+			const restorable = Object.keys(releases).filter((app) => releases[app].previous);
+			let apps;
+			if (input.atomic) {
+				apps = restorable;
+				if (apps.length === 0) throw new RollbackNeedsApp(input.stage, restorable);
+			} else if (input.app) {
+				if (!releases[input.app]?.previous) throw new NothingToRollBack(input.stage, input.app);
+				apps = [input.app];
+			} else throw new RollbackNeedsApp(input.stage, restorable);
+			const { api } = await require_engine.dokployApi(workspace, {
+				credentials,
+				signal
+			});
+			const verify = require_engine.verifySettings(workspace.deploy.dokploy?.verify);
+			const rolled = [];
+			for (const app of apps) {
+				signal.throwIfAborted();
+				const { current, previous } = releases[app];
+				const applicationId = state.applications[app];
+				if (!previous || !applicationId) throw new NothingToRollBack(input.stage, app);
+				log(`⏪ ${app}: ${current.ref} → ${previous.ref}`);
+				await require_engine.restoreImage(api, {
+					applicationId,
+					image: previous,
+					registryId: state.registryId,
+					verify,
+					signal
+				});
+				require_state.recordRollback(state, app, previous);
+				await journal.save();
+				log(`   ✓ ${app} is running ${previous.ref}`);
+				rolled.push({
+					app,
+					from: current,
+					to: previous
+				});
+			}
+			return rolled;
+		} finally {
+			await lock.release();
+		}
+	});
+}
+//#endregion
+Object.defineProperty(exports, "NothingToRollBack", {
+	enumerable: true,
+	get: function() {
+		return NothingToRollBack;
+	}
+});
+Object.defineProperty(exports, "RollbackNeedsApp", {
+	enumerable: true,
+	get: function() {
+		return RollbackNeedsApp;
+	}
+});
+Object.defineProperty(exports, "StageNeverDeployed", {
+	enumerable: true,
+	get: function() {
+		return StageNeverDeployed;
+	}
+});
+Object.defineProperty(exports, "rollbackStage", {
+	enumerable: true,
+	get: function() {
+		return rollbackStage;
+	}
+});
+Object.defineProperty(exports, "rollback_exports", {
+	enumerable: true,
+	get: function() {
+		return rollback_exports;
+	}
+});
+
+//# sourceMappingURL=rollback-DxJK84hy.cjs.map

package/dist/rollback-DxJK84hy.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback-DxJK84hy.cjs","names":["storedCredentials","LocalSandbox","findWorkspaceRoot","resolve","withSandbox","loadWorkspaceConfig","createStateStore","DeployJournal","createEmptyState","dokployApi","verifySettings","restoreImage"],"sources":["../src/target/dokploy/rollback.ts"],"sourcesContent":["/**\n * `gkm deploy:rollback`: a stage's apps put back on the release before the\n * one they run, by hand — for a release that passed its checks and turned out\n * wrong anyway.\n *\n * One app by default, because an app is what usually broke: rolling the API\n * back over a site fix that shipped beside it undoes the fix too. `atomic`\n * rolls back every app that has a release to go back to, for apps that only\n * work together — an API and the site built against its newer contract.\n *\n * It restores images and nothing else. The environment an app runs with is\n * the stage's, resolved on every deploy, and migrations are forward-only: a\n * migration that the older code cannot run against is undone by a new\n * migration, never by a rollback.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../../config';\nimport {\n\ttype CredentialProvider,\n\tstoredCredentials,\n} from '../../deploy/credentials';\nimport { DeployJournal } from '../../deploy/journal';\nimport { createStateStore } from '../../deploy/StateStore';\nimport {\n\tcreateEmptyState,\n\ttype ReleasedImage,\n\trecordRollback,\n} from '../../deploy/state';\nimport { LocalSandbox } from '../../sandbox/local';\nimport { type Sandbox, withSandbox } from '../../sandbox/sandbox';\nimport { assertDeployedStage } from '../../workspace/stages';\nimport { dokployApi, restoreImage, verifySettings } from './engine';\n\nexport interface RollbackInput {\n\t/** The project: the directory holding `gkm.config.ts`, or one inside it. */\n\tcwd: string;\n\tstage: string;\n\t/** The app to roll back. */\n\tapp?: string;\n\t/** Every app with an earlier release, instead of one. */\n\tatomic?: boolean;\n\t/** Defaults to the environment, then the logins `gkm login` stored. */\n\tcredentials?: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Each progress line. Defaults to none. */\n\tlog?: (line: string) => void;\n\t/** Where the config is loaded. Defaults to a `LocalSandbox` on the project. */\n\tsandbox?: Sandbox;\n}\n\n/** One app rolled back. */\nexport interface RolledBack {\n\tapp: string;\n\tfrom: ReleasedImage;\n\tto: ReleasedImage;\n}\n\n/** Neither an app nor every app was asked for. */\nexport class RollbackNeedsApp extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** The apps that have a release to go back to. */\n\t\treadonly apps: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Say what to roll back: --app <name> for one app (${apps.join(', ') || 'none has an earlier release'}), ` +\n\t\t\t\t`or --atomic for every app of \"${stage}\" together.`,\n\t\t);\n\t\tthis.name = 'RollbackNeedsApp';\n\t}\n}\n\n/** An app has no release before the one it runs. */\nexport class NothingToRollBack extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly app: string,\n\t) {\n\t\tsuper(\n\t\t\t`\"${app}\" has no earlier release on \"${stage}\" to roll back to: it has been released once, ` +\n\t\t\t\t'or every earlier release was itself rolled back. Deploy the version you want instead.',\n\t\t);\n\t\tthis.name = 'NothingToRollBack';\n\t}\n}\n\n/** The stage was never deployed through Dokploy from this state. */\nexport class StageNeverDeployed extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`\"${stage}\" has no deploy state, so there is nothing to roll back. ` +\n\t\t\t\t'Check the stage name, and that `state` in gkm.config.ts points at the store the deploys write to.',\n\t\t);\n\t\tthis.name = 'StageNeverDeployed';\n\t}\n}\n\n/**\n * Roll a stage's app — or, `atomic`, all of them — back to its previous\n * release, holding the stage's lock as a deploy does.\n */\nexport async function rollbackStage(\n\tinput: RollbackInput,\n): Promise<RolledBack[]> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst log = input.log ?? (() => {});\n\tconst credentials = input.credentials ?? storedCredentials();\n\tconst sandbox =\n\t\tinput.sandbox ??\n\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\n\treturn withSandbox(sandbox, async () => {\n\t\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\t\tsandbox,\n\t\t});\n\t\tassertDeployedStage(workspace.stages, input.stage);\n\n\t\tconst store = await createStateStore({\n\t\t\tconfig: workspace.state,\n\t\t\tworkspaceRoot: workspace.root,\n\t\t\tworkspaceName: workspace.name,\n\t\t});\n\t\tif (!(await store.read(input.stage))) {\n\t\t\tthrow new StageNeverDeployed(input.stage);\n\t\t}\n\n\t\tconst lock = await store.lock(input.stage, { operation: 'rollback' });\n\t\ttry {\n\t\t\tconst journal = await DeployJournal.open(store, input.stage, () =>\n\t\t\t\tcreateEmptyState(input.stage, '', ''),\n\t\t\t);\n\t\t\tconst { state } = journal;\n\t\t\tconst releases = state.releases ?? {};\n\t\t\tconst restorable = Object.keys(releases).filter(\n\t\t\t\t(app) => releases[app]!.previous,\n\t\t\t);\n\n\t\t\tlet apps: string[];\n\t\t\tif (input.atomic) {\n\t\t\t\tapps = restorable;\n\t\t\t\tif (apps.length === 0) {\n\t\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t\t}\n\t\t\t} else if (input.app) {\n\t\t\t\tif (!releases[input.app]?.previous) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, input.app);\n\t\t\t\t}\n\t\t\t\tapps = [input.app];\n\t\t\t} else {\n\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t}\n\n\t\t\tconst { api } = await dokployApi(workspace, { credentials, signal });\n\t\t\tconst verify = verifySettings(workspace.deploy.dokploy?.verify);\n\t\t\tconst rolled: RolledBack[] = [];\n\n\t\t\tfor (const app of apps) {\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t\tconst { current, previous } = releases[app]!;\n\t\t\t\tconst applicationId = state.applications[app];\n\t\t\t\tif (!previous || !applicationId) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, app);\n\t\t\t\t}\n\n\t\t\t\tlog(`⏪ ${app}: ${current.ref} → ${previous.ref}`);\n\t\t\t\tawait restoreImage(api, {\n\t\t\t\t\tapplicationId,\n\t\t\t\t\timage: previous,\n\t\t\t\t\tregistryId: state.registryId,\n\t\t\t\t\tverify,\n\t\t\t\t\tsignal,\n\t\t\t\t});\n\t\t\t\trecordRollback(state, app, previous);\n\t\t\t\tawait journal.save();\n\t\t\t\tlog(`   ✓ ${app} is running ${previous.ref}`);\n\t\t\t\trolled.push({ app, from: current, to: previous });\n\t\t\t}\n\n\t\t\treturn rolled;\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CAEA;CAHV,YACC,OAEA,MACC;EACD,MACC,oDAAoD,KAAK,KAAK,IAAI,KAAK,8BAA8B,mCACnE,MAAM,YACzC;EAPS,KAAA,QAAA;EAEA,KAAA,OAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CACA;CAFV,YACC,OACA,KACC;EACD,MACC,IAAI,IAAI,+BAA+B,MAAM,oIAE9C;EANS,KAAA,QAAA;EACA,KAAA,MAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CACxB;CAArB,YAAY,OAAwB;EACnC,MACC,IAAI,MAAM,6JAEX;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,eAAsB,cACrB,OACwB;CACxB,MAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CACrD,MAAM,MAAM,MAAM,cAAc,CAAC;CACjC,MAAM,cAAc,MAAM,eAAeA,oBAAAA,kBAAkB;CAC3D,MAAM,UACL,MAAM,WACN,IAAIC,cAAAA,aAAa,EAAE,MAAMC,eAAAA,mBAAAA,GAAkBC,UAAAA,QAAAA,CAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;CAEjE,OAAOC,gBAAAA,YAAY,SAAS,YAAY;EACvC,MAAM,EAAE,cAAc,MAAMC,eAAAA,qBAAAA,GAAoBF,UAAAA,QAAAA,CAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;EACD,kBAAA,oBAAoB,UAAU,QAAQ,MAAM,KAAK;EAEjD,MAAM,QAAQ,MAAMG,gBAAAA,iBAAiB;GACpC,QAAQ,UAAU;GAClB,eAAe,UAAU;GACzB,eAAe,UAAU;EAC1B,CAAC;EACD,IAAI,CAAE,MAAM,MAAM,KAAK,MAAM,KAAK,GACjC,MAAM,IAAI,mBAAmB,MAAM,KAAK;EAGzC,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,EAAE,WAAW,WAAW,CAAC;EACpE,IAAI;GACH,MAAM,UAAU,MAAMC,cAAAA,cAAc,KAAK,OAAO,MAAM,aACrDC,cAAAA,iBAAiB,MAAM,OAAO,IAAI,EAAE,CACrC;GACA,MAAM,EAAE,UAAU;GAClB,MAAM,WAAW,MAAM,YAAY,CAAC;GACpC,MAAM,aAAa,OAAO,KAAK,QAAQ,CAAC,CAAC,QACvC,QAAQ,SAAS,IAAI,CAAE,QACzB;GAEA,IAAI;GACJ,IAAI,MAAM,QAAQ;IACjB,OAAO;IACP,IAAI,KAAK,WAAW,GACnB,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAEpD,OAAO,IAAI,MAAM,KAAK;IACrB,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,UACzB,MAAM,IAAI,kBAAkB,MAAM,OAAO,MAAM,GAAG;IAEnD,OAAO,CAAC,MAAM,GAAG;GAClB,OACC,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAGnD,MAAM,EAAE,QAAQ,MAAMC,eAAAA,WAAW,WAAW;IAAE;IAAa;GAAO,CAAC;GACnE,MAAM,SAASC,eAAAA,eAAe,UAAU,OAAO,SAAS,MAAM;GAC9D,MAAM,SAAuB,CAAC;GAE9B,KAAK,MAAM,OAAO,MAAM;IACvB,OAAO,eAAe;IACtB,MAAM,EAAE,SAAS,aAAa,SAAS;IACvC,MAAM,gBAAgB,MAAM,aAAa;IACzC,IAAI,CAAC,YAAY,CAAC,eACjB,MAAM,IAAI,kBAAkB,MAAM,OAAO,GAAG;IAG7C,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,SAAS,KAAK;IAChD,MAAMC,eAAAA,aAAa,KAAK;KACvB;KACA,OAAO;KACP,YAAY,MAAM;KAClB;KACA;IACD,CAAC;IACD,cAAA,eAAe,OAAO,KAAK,QAAQ;IACnC,MAAM,QAAQ,KAAK;IACnB,IAAI,QAAQ,IAAI,cAAc,SAAS,KAAK;IAC5C,OAAO,KAAK;KAAE;KAAK,MAAM;KAAS,IAAI;IAAS,CAAC;GACjD;GAEA,OAAO;EACR,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD,CAAC;AACF"}

package/dist/{runtime-BnD7Nn96.d.cts → runtime-BRqFOvPM.d.cts}

@@ -1,4 +1,4 @@
-import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-ByMWkXKP.cjs";
+import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-D5WIxRDP.cjs";
 //#region src/target/builtins.d.ts
 /** A target name that is neither built in nor in `deploy.targets`. */
 declare class UnknownDeployTarget extends Error {
@@ -87,4 +87,4 @@ declare class TargetRuntimeUndeclared extends Error {
 }
 //#endregion
 export { TargetRuntimeMismatch as a, DeployTargetNotYetSupported as c, TargetPackageInvalid as i, UnknownDeployTarget as l, InvalidTargetOptions as n, ProviderRemoved as o, TargetEntryInvalid as r, TargetPackageNotFound as s, TargetRuntimeUndeclared as t };
-//# sourceMappingURL=runtime-BnD7Nn96.d.cts.map
+//# sourceMappingURL=runtime-BRqFOvPM.d.cts.map

package/dist/{runtime-BnD7Nn96.d.cts.map → runtime-BRqFOvPM.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"runtime-BnD7Nn96.d.cts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cA+Da,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}
+{"version":3,"file":"runtime-BRqFOvPM.d.cts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cA+Da,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}

package/dist/{runtime-j-tmFL65.d.mts → runtime-CEk5n4VH.d.mts}

@@ -1,4 +1,4 @@
-import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-BCzMWBb6.mjs";
+import { H as DeployRuntime, X as TargetOptionsIssue } from "./types-CSw2w69a.mjs";
 //#region src/target/builtins.d.ts
 /** A target name that is neither built in nor in `deploy.targets`. */
 declare class UnknownDeployTarget extends Error {
@@ -87,4 +87,4 @@ declare class TargetRuntimeUndeclared extends Error {
 }
 //#endregion
 export { TargetRuntimeMismatch as a, DeployTargetNotYetSupported as c, TargetPackageInvalid as i, UnknownDeployTarget as l, InvalidTargetOptions as n, ProviderRemoved as o, TargetEntryInvalid as r, TargetPackageNotFound as s, TargetRuntimeUndeclared as t };
-//# sourceMappingURL=runtime-j-tmFL65.d.mts.map
+//# sourceMappingURL=runtime-CEk5n4VH.d.mts.map

package/dist/{runtime-j-tmFL65.d.mts.map → runtime-CEk5n4VH.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"runtime-j-tmFL65.d.mts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cA+Da,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}
+{"version":3,"file":"runtime-CEk5n4VH.d.mts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cA+Da,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;;;;;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}

package/dist/sandbox/discover-worker.cjs

@@ -1,4 +1,4 @@
-const require_discover = require("../discover-DHdECueV.cjs");
+const require_discover = require("../discover-OEfZ9OkA.cjs");
 const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
 //#region src/sandbox/discover-worker.ts
 /**

package/dist/sandbox/discover-worker.mjs

@@ -1,4 +1,4 @@
-import { r as discover } from "../discover-LMrqsWSU.mjs";
+import { r as discover } from "../discover-BFoJWKGD.mjs";
 import { a as registerAdjacentTsconfig, i as liveValuePaths, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
 //#region src/sandbox/discover-worker.ts
 /**

package/dist/sandbox/migrate-worker.cjs

@@ -0,0 +1,61 @@
+const require_discover = require("../discover-OEfZ9OkA.cjs");
+const require_sandbox = require("../sandbox-CL--ZDui.cjs");
+const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
+const require_databases = require("../databases-C2p5LGAp.cjs");
+let node_path = require("node:path");
+let node_fs_promises = require("node:fs/promises");
+//#region src/sandbox/migrate-worker.ts
+/**
+* Applies a deployed stage's migrations in a sandbox — the migrator
+* `gkm migrate` runs, against URLs the deploy hands it as secret files.
+*
+* Usage (by the Dokploy target's release, never by hand):
+*   node --import=<tsx> migrate-worker.ts '{"root":"…","manifest":{…},"patterns":[…]}'
+*
+* Migrations are the project's own code, which is why they run here rather
+* than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,
+* named by its key, and is read into this process's memory only: never into
+* `process.env`, where a child the migration starts would inherit it.
+*/
+/** Every secret file the sandbox mounted, by name. */
+async function mountedSecrets() {
+	const dir = process.env[require_sandbox.SECRETS_DIR_ENV];
+	if (!dir) return {};
+	const secrets = {};
+	for (const name of await (0, node_fs_promises.readdir)(dir)) secrets[name] = (await (0, node_fs_promises.readFile)((0, node_path.join)(dir, name), "utf8")).trim();
+	return secrets;
+}
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await require_workerRuntime.registerAdjacentTsconfig();
+		const sources = {};
+		if (request.patterns.length > 0) await require_discover.discover({
+			patterns: request.patterns,
+			cwd: request.root,
+			sources
+		});
+		const runs = await require_databases.migrateDatabases({
+			root: request.root,
+			manifest: request.manifest,
+			sources,
+			env: await mountedSecrets()
+		});
+		require_workerRuntime.answer({
+			reason: "migrated",
+			runs: runs.map(({ target, applied }) => ({
+				migrations: target.migrations,
+				applied
+			}))
+		});
+	} catch (error) {
+		require_workerRuntime.answer({
+			reason: "failed",
+			error: require_workerRuntime.errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+
+//# sourceMappingURL=migrate-worker.cjs.map

package/dist/sandbox/migrate-worker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-worker.cjs","names":["SECRETS_DIR_ENV","readdir","readFile","join","registerAdjacentTsconfig","discover","migrateDatabases","errorData"],"sources":["../../src/sandbox/migrate-worker.ts"],"sourcesContent":["/**\n * Applies a deployed stage's migrations in a sandbox — the migrator\n * `gkm migrate` runs, against URLs the deploy hands it as secret files.\n *\n * Usage (by the Dokploy target's release, never by hand):\n *   node --import=<tsx> migrate-worker.ts '{\"root\":\"…\",\"manifest\":{…},\"patterns\":[…]}'\n *\n * Migrations are the project's own code, which is why they run here rather\n * than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,\n * named by its key, and is read into this process's memory only: never into\n * `process.env`, where a child the migration starts would inherit it.\n */\n\nimport { readdir, readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport { migrateDatabases } from '../migrate/databases';\nimport { type ConstructSource, discover } from '../reconcile/discover';\nimport { SECRETS_DIR_ENV } from './sandbox';\nimport { answer, errorData, registerAdjacentTsconfig } from './workerRuntime';\n\n/** Every secret file the sandbox mounted, by name. */\nasync function mountedSecrets(): Promise<Record<string, string>> {\n\tconst dir = process.env[SECRETS_DIR_ENV];\n\tif (!dir) return {};\n\n\tconst secrets: Record<string, string> = {};\n\tfor (const name of await readdir(dir)) {\n\t\tsecrets[name] = (await readFile(join(dir, name), 'utf8')).trim();\n\t}\n\treturn secrets;\n}\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\troot: string;\n\t\t\tmanifest: ConstructManifest;\n\t\t\tpatterns: string[];\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\t// Where each construct is declared, so a migration runs with the Kysely\n\t\t// its own file resolves. The manifest itself is the deploy's: what it\n\t\t// provisioned is what gets migrated, not a second reading of the files.\n\t\tconst sources: Record<string, ConstructSource> = {};\n\t\tif (request.patterns.length > 0) {\n\t\t\tawait discover({\n\t\t\t\tpatterns: request.patterns,\n\t\t\t\tcwd: request.root,\n\t\t\t\tsources,\n\t\t\t});\n\t\t}\n\n\t\tconst runs = await migrateDatabases({\n\t\t\troot: request.root,\n\t\t\tmanifest: request.manifest,\n\t\t\tsources,\n\t\t\tenv: await mountedSecrets(),\n\t\t});\n\n\t\tanswer({\n\t\t\treason: 'migrated',\n\t\t\truns: runs.map(({ target, applied }) => ({\n\t\t\t\tmigrations: target.migrations,\n\t\t\t\tapplied,\n\t\t\t})),\n\t\t});\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAsBA,eAAe,iBAAkD;CAChE,MAAM,MAAM,QAAQ,IAAIA,gBAAAA;CACxB,IAAI,CAAC,KAAK,OAAO,CAAC;CAElB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,QAAAA,CAAQ,GAAG,GACnC,QAAQ,SAAS,OAAA,GAAMC,iBAAAA,SAAAA,EAAAA,GAASC,UAAAA,KAAAA,CAAK,KAAK,IAAI,GAAG,MAAM,EAAA,CAAG,KAAK;CAEhE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAKlD,MAAMC,sBAAAA,yBAAyB;EAK/B,MAAM,UAA2C,CAAC;EAClD,IAAI,QAAQ,SAAS,SAAS,GAC7B,MAAMC,iBAAAA,SAAS;GACd,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAGF,MAAM,OAAO,MAAMC,kBAAAA,iBAAiB;GACnC,MAAM,QAAQ;GACd,UAAU,QAAQ;GAClB;GACA,KAAK,MAAM,eAAe;EAC3B,CAAC;EAED,sBAAA,OAAO;GACN,QAAQ;GACR,MAAM,KAAK,KAAK,EAAE,QAAQ,eAAe;IACxC,YAAY,OAAO;IACnB;GACD,EAAE;EACH,CAAC;CACF,SAAS,OAAO;EACf,sBAAA,OAAO;GAAE,QAAQ;GAAU,OAAOC,sBAAAA,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/migrate-worker.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/migrate-worker.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/migrate-worker.mjs

@@ -0,0 +1,62 @@
+import { r as discover } from "../discover-BFoJWKGD.mjs";
+import { t as SECRETS_DIR_ENV } from "../sandbox-Dm247NGx.mjs";
+import { a as registerAdjacentTsconfig, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
+import { u as migrateDatabases } from "../databases-hUHTuwhx.mjs";
+import { join } from "node:path";
+import { readFile, readdir } from "node:fs/promises";
+//#region src/sandbox/migrate-worker.ts
+/**
+* Applies a deployed stage's migrations in a sandbox — the migrator
+* `gkm migrate` runs, against URLs the deploy hands it as secret files.
+*
+* Usage (by the Dokploy target's release, never by hand):
+*   node --import=<tsx> migrate-worker.ts '{"root":"…","manifest":{…},"patterns":[…]}'
+*
+* Migrations are the project's own code, which is why they run here rather
+* than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,
+* named by its key, and is read into this process's memory only: never into
+* `process.env`, where a child the migration starts would inherit it.
+*/
+/** Every secret file the sandbox mounted, by name. */
+async function mountedSecrets() {
+	const dir = process.env[SECRETS_DIR_ENV];
+	if (!dir) return {};
+	const secrets = {};
+	for (const name of await readdir(dir)) secrets[name] = (await readFile(join(dir, name), "utf8")).trim();
+	return secrets;
+}
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await registerAdjacentTsconfig();
+		const sources = {};
+		if (request.patterns.length > 0) await discover({
+			patterns: request.patterns,
+			cwd: request.root,
+			sources
+		});
+		const runs = await migrateDatabases({
+			root: request.root,
+			manifest: request.manifest,
+			sources,
+			env: await mountedSecrets()
+		});
+		answer({
+			reason: "migrated",
+			runs: runs.map(({ target, applied }) => ({
+				migrations: target.migrations,
+				applied
+			}))
+		});
+	} catch (error) {
+		answer({
+			reason: "failed",
+			error: errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+export {};
+
+//# sourceMappingURL=migrate-worker.mjs.map

package/dist/sandbox/migrate-worker.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-worker.mjs","names":[],"sources":["../../src/sandbox/migrate-worker.ts"],"sourcesContent":["/**\n * Applies a deployed stage's migrations in a sandbox — the migrator\n * `gkm migrate` runs, against URLs the deploy hands it as secret files.\n *\n * Usage (by the Dokploy target's release, never by hand):\n *   node --import=<tsx> migrate-worker.ts '{\"root\":\"…\",\"manifest\":{…},\"patterns\":[…]}'\n *\n * Migrations are the project's own code, which is why they run here rather\n * than in the deploy. Each owner URL arrives as a file in `GKM_SECRETS_DIR`,\n * named by its key, and is read into this process's memory only: never into\n * `process.env`, where a child the migration starts would inherit it.\n */\n\nimport { readdir, readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport { migrateDatabases } from '../migrate/databases';\nimport { type ConstructSource, discover } from '../reconcile/discover';\nimport { SECRETS_DIR_ENV } from './sandbox';\nimport { answer, errorData, registerAdjacentTsconfig } from './workerRuntime';\n\n/** Every secret file the sandbox mounted, by name. */\nasync function mountedSecrets(): Promise<Record<string, string>> {\n\tconst dir = process.env[SECRETS_DIR_ENV];\n\tif (!dir) return {};\n\n\tconst secrets: Record<string, string> = {};\n\tfor (const name of await readdir(dir)) {\n\t\tsecrets[name] = (await readFile(join(dir, name), 'utf8')).trim();\n\t}\n\treturn secrets;\n}\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\troot: string;\n\t\t\tmanifest: ConstructManifest;\n\t\t\tpatterns: string[];\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\t// Where each construct is declared, so a migration runs with the Kysely\n\t\t// its own file resolves. The manifest itself is the deploy's: what it\n\t\t// provisioned is what gets migrated, not a second reading of the files.\n\t\tconst sources: Record<string, ConstructSource> = {};\n\t\tif (request.patterns.length > 0) {\n\t\t\tawait discover({\n\t\t\t\tpatterns: request.patterns,\n\t\t\t\tcwd: request.root,\n\t\t\t\tsources,\n\t\t\t});\n\t\t}\n\n\t\tconst runs = await migrateDatabases({\n\t\t\troot: request.root,\n\t\t\tmanifest: request.manifest,\n\t\t\tsources,\n\t\t\tenv: await mountedSecrets(),\n\t\t});\n\n\t\tanswer({\n\t\t\treason: 'migrated',\n\t\t\truns: runs.map(({ target, applied }) => ({\n\t\t\t\tmigrations: target.migrations,\n\t\t\t\tapplied,\n\t\t\t})),\n\t\t});\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAsBA,eAAe,iBAAkD;CAChE,MAAM,MAAM,QAAQ,IAAI;CACxB,IAAI,CAAC,KAAK,OAAO,CAAC;CAElB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,MAAM,QAAQ,GAAG,GACnC,QAAQ,SAAS,MAAM,SAAS,KAAK,KAAK,IAAI,GAAG,MAAM,EAAA,CAAG,KAAK;CAEhE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAKlD,MAAM,yBAAyB;EAK/B,MAAM,UAA2C,CAAC;EAClD,IAAI,QAAQ,SAAS,SAAS,GAC7B,MAAM,SAAS;GACd,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAGF,MAAM,OAAO,MAAM,iBAAiB;GACnC,MAAM,QAAQ;GACd,UAAU,QAAQ;GAClB;GACA,KAAK,MAAM,eAAe;EAC3B,CAAC;EAED,OAAO;GACN,QAAQ;GACR,MAAM,KAAK,KAAK,EAAE,QAAQ,eAAe;IACxC,YAAY,OAAO;IACnB;GACD,EAAE;EACH,CAAC;CACF,SAAS,OAAO;EACf,OAAO;GAAE,QAAQ;GAAU,OAAO,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/{schemas-D2LCF689.mjs → schemas-Cfhtpdo0.mjs}

@@ -5439,6 +5439,14 @@ function object(shape, params) {
 	};
 	return new ZodObject(def);
 }
+function looseObject(shape, params) {
+	return new ZodObject({
+		type: "object",
+		shape,
+		catchall: unknown(),
+		...normalizeParams(params)
+	});
+}
 const ZodUnion = /*@__PURE__*/ $constructor("ZodUnion", (inst, def) => {
 	$ZodUnion.init(inst, def);
 	ZodType.init(inst, def);
@@ -5754,6 +5762,6 @@ function superRefine(fn, params) {
 	return /* @__PURE__ */ _superRefine(fn, params);
 }
 //#endregion
-export { discriminatedUnion as a, object as c, tuple as d, union as f, custom as i, record as l, url as m, array as n, literal as o, unknown as p, boolean as r, number as s, _enum as t, string as u };
+export { discriminatedUnion as a, number as c, string as d, tuple as f, url as h, custom as i, object as l, unknown as m, array as n, literal as o, union as p, boolean as r, looseObject as s, _enum as t, record as u };
 
-//# sourceMappingURL=schemas-D2LCF689.mjs.map
+//# sourceMappingURL=schemas-Cfhtpdo0.mjs.map