@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.66

package/dist/{state-DF26e_lo.cjs → state-Y6ATakMX.cjs}

@@ -1,12 +1,10 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_local = require("./local-BdH4XN0E.cjs");
-const require_discover = require("./discover-DHdECueV.cjs");
+const require_discover = require("./discover-OEfZ9OkA.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-BewAHZIo.cjs");
+const require_workspace = require("./workspace-ON-bqiJz.cjs");
 const require_config = require("./config.cjs");
-const require_storage = require("./storage-CSGoC3bK.cjs");
-const require_store = require("./store-CJF1Tqkq.cjs");
-const require_resolve = require("./resolve-N_i4XNd-.cjs");
+const require_resolve = require("./resolve-CVmch0wI.cjs");
 const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -30,6 +28,530 @@ let _aws_sdk_client_sqs = require("@aws-sdk/client-sqs");
 let pg = require("pg");
 let yaml = require("yaml");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
+//#region src/secrets/storage.ts
+var storage_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	initStageSecrets: () => initStageSecrets,
+	maskPassword: () => maskPassword,
+	toEmbeddableSecrets: () => toEmbeddableSecrets,
+	validateEnvironmentVariables: () => validateEnvironmentVariables,
+	withCustomSecret: () => withCustomSecret
+});
+/**
+* Initialize an empty StageSecrets object for a stage.
+*/
+function initStageSecrets(stage) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		stage,
+		createdAt: now,
+		updatedAt: now,
+		services: {},
+		urls: {},
+		custom: {}
+	};
+}
+/**
+* Convert StageSecrets to embeddable format (flat key-value pairs).
+* This is what gets encrypted and embedded in the bundle.
+*/
+function toEmbeddableSecrets(secrets) {
+	return {
+		...secrets.urls,
+		...secrets.custom,
+		...secrets.services.postgres && {
+			POSTGRES_USER: secrets.services.postgres.username,
+			POSTGRES_PASSWORD: secrets.services.postgres.password,
+			POSTGRES_DB: secrets.services.postgres.database ?? "app",
+			POSTGRES_HOST: secrets.services.postgres.host,
+			POSTGRES_PORT: String(secrets.services.postgres.port)
+		},
+		...secrets.services.redis && {
+			REDIS_PASSWORD: secrets.services.redis.password,
+			REDIS_HOST: secrets.services.redis.host,
+			REDIS_PORT: String(secrets.services.redis.port)
+		},
+		...secrets.services.minio && {
+			STORAGE_ACCESS_KEY_ID: secrets.services.minio.username,
+			STORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,
+			STORAGE_BUCKET: secrets.services.minio.bucket ?? "app",
+			STORAGE_REGION: "eu-west-1",
+			STORAGE_FORCE_PATH_STYLE: "true"
+		},
+		...secrets.services.mailpit && {
+			SMTP_HOST: secrets.services.mailpit.host,
+			SMTP_PORT: String(secrets.services.mailpit.port),
+			SMTP_USER: secrets.services.mailpit.username,
+			SMTP_PASS: secrets.services.mailpit.password,
+			SMTP_SECURE: "false",
+			MAIL_FROM: "noreply@localhost"
+		},
+		...secrets.services.localstack && {
+			AWS_ACCESS_KEY_ID: secrets.services.localstack.accessKeyId ?? secrets.services.localstack.username,
+			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
+			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
+			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
+		},
+		...secrets.services.pgboss && {
+			PGBOSS_DB_USER: secrets.services.pgboss.username,
+			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password
+		}
+	};
+}
+/** The same secrets with one custom value set, and `updatedAt` moved on. */
+function withCustomSecret(secrets, key, value) {
+	return {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		custom: {
+			...secrets.custom,
+			[key]: value
+		}
+	};
+}
+/**
+* Mask a password for display (show first 4 and last 2 chars).
+*/
+function maskPassword(password) {
+	if (password.length <= 8) return "********";
+	return `${password.slice(0, 4)}${"*".repeat(password.length - 6)}${password.slice(-2)}`;
+}
+/**
+* Validate that all required environment variables are present in secrets.
+*
+* @param requiredVars - Array of environment variable names required by the application
+* @param secrets - Stage secrets to validate against
+* @returns Validation result with missing and provided variables
+*
+* @example
+* ```typescript
+* const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];
+* const secrets = await secretsStoreFor(workspace, 'production').then((s) => s.read('production'));
+* const result = validateEnvironmentVariables(required, secrets);
+*
+* if (!result.valid) {
+*   console.error(`Missing environment variables: ${result.missing.join(', ')}`);
+* }
+* ```
+*/
+function validateEnvironmentVariables(requiredVars, secrets) {
+	const embeddable = toEmbeddableSecrets(secrets);
+	const availableVars = new Set(Object.keys(embeddable));
+	const missing = [];
+	const provided = [];
+	for (const varName of requiredVars) if (availableVars.has(varName)) provided.push(varName);
+	else missing.push(varName);
+	return {
+		valid: missing.length === 0,
+		missing: missing.sort(),
+		provided: provided.sort(),
+		required: [...requiredVars].sort()
+	};
+}
+//#endregion
+//#region src/deploy/identity.ts
+/**
+* Who a deploy is, on a target it shares with other workspaces.
+*
+* A Dokploy server is one flat namespace of projects, images and Docker
+* service names. Deploys used to identify everything they made by the
+* workspace name alone, so two workspaces called `shop` — or `Shop` and
+* `shop` — deploying to one server landed in the same project, pushed over
+* each other's images and redeployed each other's applications. A
+* `DeployIdentity` is what a deploy names and claims its resources by instead.
+*/
+/** A namespace that cannot be part of a Dokploy name or an image path. */
+var DeployNamespaceInvalid = class extends Error {
+	namespace;
+	constructor(namespace) {
+		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
+		this.namespace = namespace;
+		this.name = "DeployNamespaceInvalid";
+	}
+};
+/** A workspace name with nothing a target can name a resource by. */
+var DeployProjectNameInvalid = class extends Error {
+	workspaceName;
+	constructor(workspaceName) {
+		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
+		this.workspaceName = workspaceName;
+		this.name = "DeployProjectNameInvalid";
+	}
+};
+const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* Lowercase `[a-z0-9-]`, runs of anything else collapsed to one `-`: valid as
+* a Docker image path component, a Docker service name and a Dokploy name.
+*/
+function slug(value) {
+	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+/** The namespace a workspace is in when it does not name one. */
+function defaultNamespace(workspaceName) {
+	return slug((0, _geekmidas_manifest.kebabCase)(workspaceName));
+}
+function deployIdentity(workspace, stage) {
+	const project = slug(workspace.name);
+	if (!project) throw new DeployProjectNameInvalid(workspace.name);
+	const fallback = defaultNamespace(workspace.name);
+	const namespace = workspace.deploy?.namespace ?? fallback;
+	if (!NAME.test(namespace)) throw new DeployNamespaceInvalid(namespace);
+	return {
+		namespace,
+		project,
+		stage,
+		key: `${namespace}/${project}`,
+		scope: namespace === fallback ? project : `${namespace}-${project}`
+	};
+}
+/**
+* The token a Dokploy project's description carries to say which identity
+* created it. A project with the right name and no marker belongs to someone
+* else, and a deploy never adopts it.
+*/
+function ownershipMarker(identity) {
+	return `gkm:${identity.key}`;
+}
+/** Whether a project description carries `identity`'s marker. */
+function isOwnedBy(description, identity) {
+	const marker = ownershipMarker(identity);
+	return (description ?? "").split(/\s+/).includes(marker);
+}
+/** Any `gkm:` marker a description carries — whoever's it is. */
+function markerOf(description) {
+	return (description ?? "").split(/\s+/).find((t) => t.startsWith("gkm:"));
+}
+/** What the Dokploy project is called. */
+function projectName(identity) {
+	return identity.scope;
+}
+/**
+* The repository an app's image is pushed to, below the registry:
+* `<namespace>/<project>-<app>`.
+*
+* The namespace is a path segment of its own so that a registry that maps
+* paths to owners (an organisation's packages, a Harbor project) can grant it
+* as one; the app is joined to the project so the two read as one name.
+*/
+function imageName(identity, app) {
+	return `${identity.namespace}/${identity.project}-${slug((0, _geekmidas_manifest.kebabCase)(app))}`;
+}
+/** The full image ref an app is built, pushed and deployed as. */
+function imageRef(identity, app, registry, tag) {
+	const name = imageName(identity, app);
+	return registry ? `${registry.replace(/\/+$/, "")}/${name}:${tag}` : `${name}:${tag}`;
+}
+/**
+* What one application is called on the target.
+*
+* The same rule the constructs use, through the same `scopedName`, scoped by
+* the stage and the identity: the application beside
+* `production-kitchen-sink-database` is `production-kitchen-sink-api`. A
+* Dokploy application's name is also its Docker service name, which is unique
+* on the whole server, so the namespace has to be in it too — `acme`'s and
+* `globex`'s `shop` would otherwise both run `production-shop-api`.
+*
+* The app id is dropped when it repeats the project, so a project named for its
+* one application is `production-kitchen-sink` rather than
+* `production-kitchen-sink-kitchen-sink`.
+*/
+function applicationName(identity, app) {
+	return slug(app) === identity.project ? `${identity.stage}-${identity.scope}` : (0, _geekmidas_manifest.scopedName)([identity.stage, identity.scope], app);
+}
+//#endregion
+//#region src/secrets/keystore.ts
+/**
+* The keys that open each stage's encrypted secrets file, kept outside the
+* project in the CLI's home.
+*
+* Keys were kept at `~/.gkm/<folder>/<stage>.key`, named after the project
+* directory — so two checkouts in folders with the same name (`~/work/api`
+* and `~/oss/api`) shared one key, and the second `gkm secrets:init`
+* overwrote the first project's. They are now kept under the project's
+* identity, `<home>/keys/<namespace>/<project>/<stage>.key`, the same
+* `<namespace>/<project>` a deploy claims its Dokploy project by. A key still
+* at the old place is copied to the new one the first time it is read; the
+* old file stays, so an older CLI on the same machine keeps working.
+*/
+/** Key length for AES-256 encryption */
+const KEY_LENGTH = 32;
+/** A keystore project key that is not `<namespace>/<project>`. */
+var KeystoreProjectInvalid = class extends Error {
+	key;
+	constructor(key) {
+		super(`'${key}' is not a keystore project: expected '<namespace>/<project>' in lowercase letters, digits and '-', as deployIdentity() produces. Pass the workspace's identity key.`);
+		this.key = key;
+		this.name = "KeystoreProjectInvalid";
+	}
+};
+/** A stage has no key, here or at the place keys used to be kept. */
+var KeyNotFound = class extends Error {
+	stage;
+	project;
+	path;
+	constructor(stage, project, path) {
+		super(`Encryption key not found for stage "${stage}" in project "${project}". Expected key at: ${path}. Run \`gkm secrets:init --stage ${stage}\` to create one, or copy the stage's key there.`);
+		this.stage = stage;
+		this.project = project;
+		this.path = path;
+		this.name = "KeyNotFound";
+	}
+};
+const PROJECT_KEY = /^[a-z0-9]+(?:-[a-z0-9]+)*\/[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* The keystore key of a workspace: its deploy identity without the stage, so
+* a project's keys and its Dokploy project are named by the same thing.
+*/
+function projectKey(workspace) {
+	return deployIdentity(workspace, "").key;
+}
+/** The keystore project of a loaded workspace. */
+function keystoreProject(workspace, home) {
+	const key = projectKey(workspace);
+	const unscoped = projectKey({ name: workspace.name });
+	return {
+		key,
+		legacy: [.../* @__PURE__ */ new Set([folderName(workspace.root), workspace.name])].filter((name) => !!name),
+		...unscoped !== key ? { aliases: [unscoped] } : {},
+		...home ? { home } : {}
+	};
+}
+/**
+* Whether `name` stays inside the home it is joined to. A workspace name was
+* joined as is — `@acme/shop` is `~/.gkm/@acme/shop` — but never upwards.
+*/
+function isLegacyName(name) {
+	return name.split(/[\\/]/).every((part) => part !== ".." && part !== "");
+}
+/** The last segment of a path, as the old keystore named projects. */
+function folderName(path) {
+	const name = path.split(/[\\/]/).filter(Boolean).at(-1);
+	return name && name !== "." && name !== ".." ? name : void 0;
+}
+/**
+* Get the keystore directory for a project:
+* `<home>/keys/<namespace>/<project>`.
+*/
+function getKeystoreDir(project) {
+	if (!PROJECT_KEY.test(project.key)) throw new KeystoreProjectInvalid(project.key);
+	const [namespace, name] = project.key.split("/");
+	return (0, node_path.join)(project.home ?? require_local.gkmHome(), "keys", namespace, name);
+}
+/** Get the path to a stage's encryption key. */
+function getKeyPath(stage, project) {
+	return (0, node_path.join)(getKeystoreDir(project), `${stage}.key`);
+}
+/**
+* Where else a stage's key may be, most likely first: under an alias of the
+* project, then where keys were kept before they were keyed by identity —
+* under the configured home, then under `~/.gkm`, which is where every CLI
+* before `GKM_HOME` wrote.
+*/
+function legacyKeyPaths(stage, project) {
+	const aliases = (project.aliases ?? []).map((key) => getKeyPath(stage, {
+		key,
+		home: project.home
+	}));
+	const homes = [.../* @__PURE__ */ new Set([project.home ?? require_local.gkmHome(), (0, node_path.join)((0, node_os.homedir)(), ".gkm")])];
+	const names = (project.legacy ?? []).filter(isLegacyName);
+	return [...aliases, ...names.flatMap((name) => homes.map((home) => (0, node_path.join)(home, name, `${stage}.key`)))];
+}
+/**
+* Generate a new encryption key for a stage, stored owner-only at
+* `<home>/keys/<namespace>/<project>/<stage>.key`.
+*/
+async function generateKey(stage, project, flag = "w") {
+	const keyDir = getKeystoreDir(project);
+	const keyPath = getKeyPath(stage, project);
+	await (0, node_fs_promises.mkdir)(keyDir, {
+		recursive: true,
+		mode: 448
+	});
+	const key = (0, node_crypto.randomBytes)(KEY_LENGTH).toString("hex");
+	await (0, node_fs_promises.writeFile)(keyPath, key, {
+		mode: 384,
+		encoding: "utf-8",
+		flag
+	});
+	await (0, node_fs_promises.chmod)(keyPath, 384);
+	return key;
+}
+/**
+* Copy a key from where it used to be kept to where it is kept now.
+*
+* Copied, not moved: an older CLI on the same machine still reads the old
+* place. Exclusive, so two processes migrating at once cannot overwrite a key
+* one of them already put there.
+*/
+async function migrateLegacyKey(stage, project) {
+	const legacy = legacyKeyPaths(stage, project).find((path) => (0, node_fs.existsSync)(path));
+	if (!legacy) return false;
+	const keyPath = getKeyPath(stage, project);
+	await (0, node_fs_promises.mkdir)(getKeystoreDir(project), {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		await (0, node_fs_promises.copyFile)(legacy, keyPath, node_fs.constants.COPYFILE_EXCL);
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+	}
+	await (0, node_fs_promises.chmod)(keyPath, 384);
+	return true;
+}
+/**
+* Read an encryption key for a stage, or `null` when there is none — after
+* copying it over from where keys used to be kept, if it is still there.
+*/
+async function readKey(stage, project) {
+	const keyPath = getKeyPath(stage, project);
+	if (!(0, node_fs.existsSync)(keyPath) && !await migrateLegacyKey(stage, project)) return null;
+	return (await (0, node_fs_promises.readFile)(keyPath, "utf-8")).trim();
+}
+/**
+* Read an encryption key for a stage, throwing {@link KeyNotFound} if there
+* is none.
+*/
+async function requireKey(stage, project) {
+	const key = await readKey(stage, project);
+	if (!key) throw new KeyNotFound(stage, project.key, getKeyPath(stage, project));
+	return key;
+}
+/**
+* Get or create a key for a stage.
+* If the key already exists, it is returned. Otherwise, a new key is generated.
+*/
+async function getOrCreateKey(stage, project) {
+	const existingKey = await readKey(stage, project);
+	if (existingKey) return existingKey;
+	try {
+		return await generateKey(stage, project, "wx");
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		return requireKey(stage, project);
+	}
+}
+//#endregion
+//#region src/secrets/file.ts
+/** Where the files live, relative to the project root. */
+const SECRETS_DIR = ".gkm/secrets";
+/** AES-256-GCM configuration */
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
+/**
+* A stage's secrets as an encrypted file on this machine:
+* `.gkm/secrets/<stage>.json`, with its key in the CLI's home at
+* `keys/<namespace>/<project>/<stage>.key`.
+*
+* The local stage's store, always — its secrets belong to the machine running
+* `gkm dev` — and a deployed stage's when `secrets.store` is `'file'`.
+*/
+var FileSecretsStore = class {
+	root;
+	name = "file";
+	project;
+	/**
+	* @param project - Whose keys: a workspace's `keystoreProject()`. Outside a
+	*   workspace there is no config to name the project, so it is named the
+	*   way a workspace without `name` is — its package name, else its folder.
+	*/
+	constructor(root, project) {
+		this.root = root;
+		this.project = project ?? {
+			key: projectKey({ name: packageName(root) ?? (0, node_path.basename)(root) }),
+			legacy: [(0, node_path.basename)(root)]
+		};
+	}
+	/** The file a stage's secrets are kept in. */
+	path(stage) {
+		return (0, node_path.join)(this.root, SECRETS_DIR, `${stage}.json`);
+	}
+	async read(stage) {
+		const path = this.path(stage);
+		if (!(0, node_fs.existsSync)(path)) return null;
+		const data = JSON.parse(await (0, node_fs_promises.readFile)(path, "utf-8"));
+		if (!(data.version === 1 && data.encrypted && data.iv)) return data;
+		const key = await readKey(stage, this.project);
+		if (!key) throw new MissingSecretsKey(stage, this.project.key, getKeyPath(stage, this.project));
+		return decrypt(data, key);
+	}
+	async write(stage, secrets) {
+		await (0, node_fs_promises.mkdir)((0, node_path.join)(this.root, SECRETS_DIR), { recursive: true });
+		const key = await getOrCreateKey(stage, this.project);
+		await (0, node_fs_promises.writeFile)(this.path(stage), JSON.stringify(encrypt(secrets, key), null, 2), "utf-8");
+	}
+};
+/** A stage's secrets file exists, and the key that opens it does not. */
+var MissingSecretsKey = class extends Error {
+	stage;
+	project;
+	path;
+	constructor(stage, project, path) {
+		super(`Decryption key not found for stage "${stage}". Expected key at: ${path}. Copy the stage's key there from whoever created it, or set secrets.store to a store this machine can reach.`);
+		this.stage = stage;
+		this.project = project;
+		this.path = path;
+		this.name = "MissingSecretsKey";
+	}
+};
+/** A project's package name without its scope, as a workspace name reads it. */
+function packageName(root) {
+	try {
+		const pkg = JSON.parse((0, node_fs.readFileSync)((0, node_path.join)(root, "package.json"), "utf-8"));
+		return typeof pkg.name === "string" ? pkg.name.replace(/^@[^/]+\//, "") : void 0;
+	} catch {
+		return;
+	}
+}
+function encrypt(secrets, keyHex) {
+	const key = Buffer.from(keyHex, "hex");
+	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
+	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, key, iv);
+	const ciphertext = Buffer.concat([cipher.update(JSON.stringify(secrets), "utf-8"), cipher.final()]);
+	return {
+		version: 1,
+		encrypted: Buffer.concat([ciphertext, cipher.getAuthTag()]).toString("base64"),
+		iv: iv.toString("hex")
+	};
+}
+function decrypt(data, keyHex) {
+	const key = Buffer.from(keyHex, "hex");
+	const combined = Buffer.from(data.encrypted, "base64");
+	const decipher = (0, node_crypto.createDecipheriv)(ALGORITHM, key, Buffer.from(data.iv, "hex"));
+	decipher.setAuthTag(combined.subarray(-16));
+	const plaintext = Buffer.concat([decipher.update(combined.subarray(0, -16)), decipher.final()]);
+	return JSON.parse(plaintext.toString("utf-8"));
+}
+//#endregion
+//#region src/secrets/store.ts
+var store_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	FileSecretsStore: () => FileSecretsStore,
+	isRemoteStore: () => isRemoteStore,
+	secretsStoreFor: () => secretsStoreFor
+});
+/**
+* The store a stage's secrets are kept in — what every command reads and
+* writes, for the stage it acts on.
+*
+* The local stage is always the file: its secrets belong to the machine
+* running `gkm dev`. A deployed stage uses `secrets.store`.
+*/
+async function secretsStoreFor(workspace, stage, options = {}) {
+	const configured = workspace.secrets.store ?? "file";
+	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
+	if (configured.provider !== "ssm") return configured.provider;
+	const { AwsSecretsStore } = await Promise.resolve().then(() => require("./aws-DkHdTV-p.cjs"));
+	return new AwsSecretsStore({
+		project: workspace.name,
+		region: configured.region,
+		...options.profile ? { profile: options.profile } : {}
+	});
+}
+/** Whether a stage's secrets live somewhere other than this machine. */
+function isRemoteStore(workspace, stage) {
+	const configured = workspace.secrets.store ?? "file";
+	return stage !== workspace.stages.local && configured !== "file";
+}
+//#endregion
 //#region src/credentials/index.ts
 const logger$1 = console;
 /**
@@ -118,7 +640,7 @@ async function loadSecretsForApp(store, stage, appName) {
 	const stageSecrets = await store.read(stage);
 	if (stageSecrets) {
 		logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
-		secrets = require_storage.toEmbeddableSecrets(stageSecrets);
+		secrets = toEmbeddableSecrets(stageSecrets);
 	}
 	if (Object.keys(secrets).length === 0) return {};
 	if (!appName) return secrets;
@@ -233,7 +755,7 @@ async function prepareEntryCredentials(options) {
 	}
 	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
 	const stage = options.stage ?? workspace?.stages.local;
-	const store = stage ? workspace ? await require_store.secretsStoreFor(workspace, stage) : new require_store.FileSecretsStore(secretsRoot) : void 0;
+	const store = stage ? workspace ? await secretsStoreFor(workspace, stage) : new FileSecretsStore(secretsRoot) : void 0;
 	const credentials = store && stage ? await loadSecretsForApp(store, stage, appName) : {};
 	credentials.PORT = String(resolvedPort);
 	if (appInfo?.app.type === "mobile") credentials.RCT_METRO_PORT = String(resolvedPort);
@@ -3160,7 +3682,7 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-//#region src/deploy/domain.ts
+//#region src/target/dokploy/domain.ts
 /** A stage was deployed that `deploy.domains` gives no domain. */
 var NoDomainForStage = class extends Error {
 	stage;
@@ -3774,6 +4296,12 @@ USER nextjs
 
 EXPOSE ${port}
 
+# A site answers at its root; Docker, and Dokploy, read the container's
+# health from it rather than from the process merely running. 127.0.0.1, not
+# localhost: the server listens on IPv4, and localhost can resolve to ::1.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
+
 ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["node", "${appPath}/server.js"]
 `;
@@ -4041,6 +4569,12 @@ ENV HOSTNAME="0.0.0.0"
 USER app
 EXPOSE ${port}
 
+# A site answers at its root; Docker, and Dokploy, read the container's
+# health from it rather than from the process merely running. 127.0.0.1, not
+# localhost: the server listens on IPv4, and localhost can resolve to ::1.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
+
 ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["sh", "-c", "cd ${appPath} && ${startCmd}"]
 `;
@@ -4088,6 +4622,11 @@ COPY --from=builder /app/${appPath}/dist /usr/share/nginx/html
 RUN printf 'server {\\n  listen ${port};\\n  root /usr/share/nginx/html;\\n  index index.html;\\n  location / { try_files $uri $uri/ /index.html; }\\n}\\n' \\
     > /etc/nginx/conf.d/default.conf
 EXPOSE ${port}
+# A site answers at its root; Docker, and Dokploy, read the container's
+# health from it rather than from the process merely running. 127.0.0.1, not
+# localhost: the server listens on IPv4, and localhost can resolve to ::1.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
 CMD ["nginx", "-g", "daemon off;"]
 `;
 }
@@ -4592,13 +5131,60 @@ function createEmptyState(stage, projectId, environmentId) {
 function setApplicationId(state, appName, applicationId) {
 	state.applications[appName] = applicationId;
 }
+/** Two records naming the same image: by digest when both have one. */
+function sameImage(a, b) {
+	return a.digest && b.digest ? a.digest === b.digest : a.ref === b.ref;
+}
+/** The newest release in `history` after `index` that a rollback may restore. */
+function restorable(history, index, current) {
+	return history.slice(index + 1).find((entry) => !entry.rolledBack && !sameImage(entry, current));
+}
 /**
-* Record the image an app was deployed with (mutates state)
+* Record that `image` went live for `appName` (mutates state): it becomes
+* `current`, and what was current becomes `previous`. Releasing what already
+* runs — a redeploy of the same digest — changes nothing.
 */
-function setDeployedImage(state, appName, image) {
-	state.images = {
-		...state.images,
-		[appName]: image
+function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
+	const releases = state.releases?.[appName];
+	if (releases && sameImage(releases.current, image)) return;
+	const entry = {
+		...image,
+		releasedAt: releasedAt.toISOString()
+	};
+	const history = [entry, ...releases?.history ?? []].slice(0, 10);
+	const previous = releases?.current;
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current: entry,
+			...previous ? { previous } : {},
+			history
+		}
+	};
+}
+/**
+* Record that `appName` was rolled back to `to` (mutates state): every
+* release newer than it is marked rolled back, so neither this rollback nor
+* a later one restores it, and `previous` moves to the release before `to`.
+*/
+function recordRollback(state, appName, to) {
+	const releases = state.releases?.[appName];
+	if (!releases) return;
+	const index = releases.history.findIndex((entry) => !entry.rolledBack && sameImage(entry, to));
+	if (index === -1) return;
+	const history = releases.history.map((entry, i) => i < index ? {
+		...entry,
+		rolledBack: true
+	} : entry);
+	const current = history[index];
+	const previous = restorable(history, index, current);
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current,
+			...previous ? { previous } : {},
+			history
+		}
 	};
 }
 /**
@@ -4697,6 +5283,12 @@ Object.defineProperty(exports, "FAKE_ENV", {
 		return FAKE_ENV;
 	}
 });
+Object.defineProperty(exports, "FileSecretsStore", {
+	enumerable: true,
+	get: function() {
+		return FileSecretsStore;
+	}
+});
 Object.defineProperty(exports, "LOCAL_CA_PATH", {
 	enumerable: true,
 	get: function() {
@@ -4715,6 +5307,12 @@ Object.defineProperty(exports, "appPackageName", {
 		return appPackageName;
 	}
 });
+Object.defineProperty(exports, "applicationName", {
+	enumerable: true,
+	get: function() {
+		return applicationName;
+	}
+});
 Object.defineProperty(exports, "applyPostgres", {
 	enumerable: true,
 	get: function() {
@@ -4763,6 +5361,12 @@ Object.defineProperty(exports, "createEntryWrapper", {
 		return createEntryWrapper;
 	}
 });
+Object.defineProperty(exports, "deployIdentity", {
+	enumerable: true,
+	get: function() {
+		return deployIdentity;
+	}
+});
 Object.defineProperty(exports, "derivedContainers", {
 	enumerable: true,
 	get: function() {
@@ -4787,6 +5391,12 @@ Object.defineProperty(exports, "dockerCommand", {
 		return dockerCommand;
 	}
 });
+Object.defineProperty(exports, "dockerfileOf", {
+	enumerable: true,
+	get: function() {
+		return dockerfileOf;
+	}
+});
 Object.defineProperty(exports, "envFor", {
 	enumerable: true,
 	get: function() {
@@ -4841,12 +5451,36 @@ Object.defineProperty(exports, "getGeneratedSecret", {
 		return getGeneratedSecret;
 	}
 });
+Object.defineProperty(exports, "getKeyPath", {
+	enumerable: true,
+	get: function() {
+		return getKeyPath;
+	}
+});
 Object.defineProperty(exports, "hostFor", {
 	enumerable: true,
 	get: function() {
 		return hostFor;
 	}
 });
+Object.defineProperty(exports, "imageName", {
+	enumerable: true,
+	get: function() {
+		return imageName;
+	}
+});
+Object.defineProperty(exports, "imageRef", {
+	enumerable: true,
+	get: function() {
+		return imageRef;
+	}
+});
+Object.defineProperty(exports, "initStageSecrets", {
+	enumerable: true,
+	get: function() {
+		return initStageSecrets;
+	}
+});
 Object.defineProperty(exports, "isDnsVerified", {
 	enumerable: true,
 	get: function() {
@@ -4859,12 +5493,30 @@ Object.defineProperty(exports, "isMainFrontendApp", {
 		return isMainFrontendApp;
 	}
 });
+Object.defineProperty(exports, "isOwnedBy", {
+	enumerable: true,
+	get: function() {
+		return isOwnedBy;
+	}
+});
 Object.defineProperty(exports, "isPortAvailable", {
 	enumerable: true,
 	get: function() {
 		return isPortAvailable;
 	}
 });
+Object.defineProperty(exports, "isRemoteStore", {
+	enumerable: true,
+	get: function() {
+		return isRemoteStore;
+	}
+});
+Object.defineProperty(exports, "keystoreProject", {
+	enumerable: true,
+	get: function() {
+		return keystoreProject;
+	}
+});
 Object.defineProperty(exports, "loadEnvFiles", {
 	enumerable: true,
 	get: function() {
@@ -4883,12 +5535,30 @@ Object.defineProperty(exports, "localRolePassword", {
 		return localRolePassword;
 	}
 });
+Object.defineProperty(exports, "markerOf", {
+	enumerable: true,
+	get: function() {
+		return markerOf;
+	}
+});
+Object.defineProperty(exports, "maskPassword", {
+	enumerable: true,
+	get: function() {
+		return maskPassword;
+	}
+});
 Object.defineProperty(exports, "networkEnv", {
 	enumerable: true,
 	get: function() {
 		return networkEnv;
 	}
 });
+Object.defineProperty(exports, "ownershipMarker", {
+	enumerable: true,
+	get: function() {
+		return ownershipMarker;
+	}
+});
 Object.defineProperty(exports, "pgClient", {
 	enumerable: true,
 	get: function() {
@@ -4931,6 +5601,18 @@ Object.defineProperty(exports, "primaryPortKey", {
 		return primaryPortKey;
 	}
 });
+Object.defineProperty(exports, "projectKey", {
+	enumerable: true,
+	get: function() {
+		return projectKey;
+	}
+});
+Object.defineProperty(exports, "projectName", {
+	enumerable: true,
+	get: function() {
+		return projectName;
+	}
+});
 Object.defineProperty(exports, "providerOf", {
 	enumerable: true,
 	get: function() {
@@ -4943,12 +5625,30 @@ Object.defineProperty(exports, "quoteIdentifier", {
 		return quoteIdentifier;
 	}
 });
+Object.defineProperty(exports, "readKey", {
+	enumerable: true,
+	get: function() {
+		return readKey;
+	}
+});
 Object.defineProperty(exports, "reconcileWorkspace", {
 	enumerable: true,
 	get: function() {
 		return reconcileWorkspace;
 	}
 });
+Object.defineProperty(exports, "recordRelease", {
+	enumerable: true,
+	get: function() {
+		return recordRelease;
+	}
+});
+Object.defineProperty(exports, "recordRollback", {
+	enumerable: true,
+	get: function() {
+		return recordRollback;
+	}
+});
 Object.defineProperty(exports, "resolveHost", {
 	enumerable: true,
 	get: function() {
@@ -4961,22 +5661,22 @@ Object.defineProperty(exports, "resourceName", {
 		return resourceName;
 	}
 });
-Object.defineProperty(exports, "setApplicationId", {
+Object.defineProperty(exports, "secretsStoreFor", {
 	enumerable: true,
 	get: function() {
-		return setApplicationId;
+		return secretsStoreFor;
 	}
 });
-Object.defineProperty(exports, "setBackupState", {
+Object.defineProperty(exports, "setApplicationId", {
 	enumerable: true,
 	get: function() {
-		return setBackupState;
+		return setApplicationId;
 	}
 });
-Object.defineProperty(exports, "setDeployedImage", {
+Object.defineProperty(exports, "setBackupState", {
 	enumerable: true,
 	get: function() {
-		return setDeployedImage;
+		return setBackupState;
 	}
 });
 Object.defineProperty(exports, "setDnsRecord", {
@@ -5015,12 +5715,36 @@ Object.defineProperty(exports, "storageBackendFor", {
 		return storageBackendFor;
 	}
 });
+Object.defineProperty(exports, "storage_exports", {
+	enumerable: true,
+	get: function() {
+		return storage_exports;
+	}
+});
+Object.defineProperty(exports, "store_exports", {
+	enumerable: true,
+	get: function() {
+		return store_exports;
+	}
+});
+Object.defineProperty(exports, "toEmbeddableSecrets", {
+	enumerable: true,
+	get: function() {
+		return toEmbeddableSecrets;
+	}
+});
 Object.defineProperty(exports, "validateImageRef", {
 	enumerable: true,
 	get: function() {
 		return validateImageRef;
 	}
 });
+Object.defineProperty(exports, "withCustomSecret", {
+	enumerable: true,
+	get: function() {
+		return withCustomSecret;
+	}
+});
 Object.defineProperty(exports, "withGeneratedSecrets", {
 	enumerable: true,
 	get: function() {
@@ -5034,4 +5758,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=state-DF26e_lo.cjs.map
+//# sourceMappingURL=state-Y6ATakMX.cjs.map