@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.66

package/dist/{state-B8YwmUZU.mjs → state-uuYqnRVO.mjs}

@@ -1,23 +1,21 @@
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { s as run$1 } from "./local-CWR4Y_kW.mjs";
-import { d as output, r as discover } from "./discover-LMrqsWSU.mjs";
+import { s as run$1, u as gkmHome } from "./local-CWR4Y_kW.mjs";
+import { d as output, r as discover } from "./discover-BFoJWKGD.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-C06_pW4g.mjs";
+import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-Be6uBhlF.mjs";
 import { ConfigNotFound, NotInAnApp, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { i as toEmbeddableSecrets } from "./storage-BzaUxmqe.mjs";
-import { i as FileSecretsStore, n as secretsStoreFor } from "./store-CLiHnqOY.mjs";
-import { c as runtimeOf } from "./resolve-DLkIXTct.mjs";
+import { c as runtimeOf } from "./resolve-Db0tNlrW.mjs";
 import { i as DEFAULT_STORAGE, n as DEFAULT_CACHE, r as DEFAULT_EVENTS$1, t as readFakes } from "./fakes-C9RiT6XG.mjs";
 import { basename, dirname, join, parse, resolve } from "node:path";
-import { copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
-import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { networkInterfaces } from "node:os";
+import { constants, copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
+import { chmod, copyFile, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { homedir, networkInterfaces } from "node:os";
 import { promisify } from "node:util";
-import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
+import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase, scopedName } from "@geekmidas/manifest";
 import { execFile, spawn } from "node:child_process";
 import { createServer } from "node:net";
 import { config } from "dotenv";
-import { createHash, randomBytes } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { formatKeyring, generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import * as snsUrl from "@geekmidas/events/sns/url";
@@ -28,6 +26,530 @@ import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/clie
 import { Client } from "pg";
 import { stringify } from "yaml";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
+//#region src/secrets/storage.ts
+var storage_exports = /* @__PURE__ */ __exportAll({
+	initStageSecrets: () => initStageSecrets,
+	maskPassword: () => maskPassword,
+	toEmbeddableSecrets: () => toEmbeddableSecrets,
+	validateEnvironmentVariables: () => validateEnvironmentVariables,
+	withCustomSecret: () => withCustomSecret
+});
+/**
+* Initialize an empty StageSecrets object for a stage.
+*/
+function initStageSecrets(stage) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		stage,
+		createdAt: now,
+		updatedAt: now,
+		services: {},
+		urls: {},
+		custom: {}
+	};
+}
+/**
+* Convert StageSecrets to embeddable format (flat key-value pairs).
+* This is what gets encrypted and embedded in the bundle.
+*/
+function toEmbeddableSecrets(secrets) {
+	return {
+		...secrets.urls,
+		...secrets.custom,
+		...secrets.services.postgres && {
+			POSTGRES_USER: secrets.services.postgres.username,
+			POSTGRES_PASSWORD: secrets.services.postgres.password,
+			POSTGRES_DB: secrets.services.postgres.database ?? "app",
+			POSTGRES_HOST: secrets.services.postgres.host,
+			POSTGRES_PORT: String(secrets.services.postgres.port)
+		},
+		...secrets.services.redis && {
+			REDIS_PASSWORD: secrets.services.redis.password,
+			REDIS_HOST: secrets.services.redis.host,
+			REDIS_PORT: String(secrets.services.redis.port)
+		},
+		...secrets.services.minio && {
+			STORAGE_ACCESS_KEY_ID: secrets.services.minio.username,
+			STORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,
+			STORAGE_BUCKET: secrets.services.minio.bucket ?? "app",
+			STORAGE_REGION: "eu-west-1",
+			STORAGE_FORCE_PATH_STYLE: "true"
+		},
+		...secrets.services.mailpit && {
+			SMTP_HOST: secrets.services.mailpit.host,
+			SMTP_PORT: String(secrets.services.mailpit.port),
+			SMTP_USER: secrets.services.mailpit.username,
+			SMTP_PASS: secrets.services.mailpit.password,
+			SMTP_SECURE: "false",
+			MAIL_FROM: "noreply@localhost"
+		},
+		...secrets.services.localstack && {
+			AWS_ACCESS_KEY_ID: secrets.services.localstack.accessKeyId ?? secrets.services.localstack.username,
+			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
+			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
+			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
+		},
+		...secrets.services.pgboss && {
+			PGBOSS_DB_USER: secrets.services.pgboss.username,
+			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password
+		}
+	};
+}
+/** The same secrets with one custom value set, and `updatedAt` moved on. */
+function withCustomSecret(secrets, key, value) {
+	return {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		custom: {
+			...secrets.custom,
+			[key]: value
+		}
+	};
+}
+/**
+* Mask a password for display (show first 4 and last 2 chars).
+*/
+function maskPassword(password) {
+	if (password.length <= 8) return "********";
+	return `${password.slice(0, 4)}${"*".repeat(password.length - 6)}${password.slice(-2)}`;
+}
+/**
+* Validate that all required environment variables are present in secrets.
+*
+* @param requiredVars - Array of environment variable names required by the application
+* @param secrets - Stage secrets to validate against
+* @returns Validation result with missing and provided variables
+*
+* @example
+* ```typescript
+* const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];
+* const secrets = await secretsStoreFor(workspace, 'production').then((s) => s.read('production'));
+* const result = validateEnvironmentVariables(required, secrets);
+*
+* if (!result.valid) {
+*   console.error(`Missing environment variables: ${result.missing.join(', ')}`);
+* }
+* ```
+*/
+function validateEnvironmentVariables(requiredVars, secrets) {
+	const embeddable = toEmbeddableSecrets(secrets);
+	const availableVars = new Set(Object.keys(embeddable));
+	const missing = [];
+	const provided = [];
+	for (const varName of requiredVars) if (availableVars.has(varName)) provided.push(varName);
+	else missing.push(varName);
+	return {
+		valid: missing.length === 0,
+		missing: missing.sort(),
+		provided: provided.sort(),
+		required: [...requiredVars].sort()
+	};
+}
+//#endregion
+//#region src/deploy/identity.ts
+/**
+* Who a deploy is, on a target it shares with other workspaces.
+*
+* A Dokploy server is one flat namespace of projects, images and Docker
+* service names. Deploys used to identify everything they made by the
+* workspace name alone, so two workspaces called `shop` — or `Shop` and
+* `shop` — deploying to one server landed in the same project, pushed over
+* each other's images and redeployed each other's applications. A
+* `DeployIdentity` is what a deploy names and claims its resources by instead.
+*/
+/** A namespace that cannot be part of a Dokploy name or an image path. */
+var DeployNamespaceInvalid = class extends Error {
+	namespace;
+	constructor(namespace) {
+		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
+		this.namespace = namespace;
+		this.name = "DeployNamespaceInvalid";
+	}
+};
+/** A workspace name with nothing a target can name a resource by. */
+var DeployProjectNameInvalid = class extends Error {
+	workspaceName;
+	constructor(workspaceName) {
+		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
+		this.workspaceName = workspaceName;
+		this.name = "DeployProjectNameInvalid";
+	}
+};
+const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* Lowercase `[a-z0-9-]`, runs of anything else collapsed to one `-`: valid as
+* a Docker image path component, a Docker service name and a Dokploy name.
+*/
+function slug(value) {
+	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+/** The namespace a workspace is in when it does not name one. */
+function defaultNamespace(workspaceName) {
+	return slug(kebabCase(workspaceName));
+}
+function deployIdentity(workspace, stage) {
+	const project = slug(workspace.name);
+	if (!project) throw new DeployProjectNameInvalid(workspace.name);
+	const fallback = defaultNamespace(workspace.name);
+	const namespace = workspace.deploy?.namespace ?? fallback;
+	if (!NAME.test(namespace)) throw new DeployNamespaceInvalid(namespace);
+	return {
+		namespace,
+		project,
+		stage,
+		key: `${namespace}/${project}`,
+		scope: namespace === fallback ? project : `${namespace}-${project}`
+	};
+}
+/**
+* The token a Dokploy project's description carries to say which identity
+* created it. A project with the right name and no marker belongs to someone
+* else, and a deploy never adopts it.
+*/
+function ownershipMarker(identity) {
+	return `gkm:${identity.key}`;
+}
+/** Whether a project description carries `identity`'s marker. */
+function isOwnedBy(description, identity) {
+	const marker = ownershipMarker(identity);
+	return (description ?? "").split(/\s+/).includes(marker);
+}
+/** Any `gkm:` marker a description carries — whoever's it is. */
+function markerOf(description) {
+	return (description ?? "").split(/\s+/).find((t) => t.startsWith("gkm:"));
+}
+/** What the Dokploy project is called. */
+function projectName(identity) {
+	return identity.scope;
+}
+/**
+* The repository an app's image is pushed to, below the registry:
+* `<namespace>/<project>-<app>`.
+*
+* The namespace is a path segment of its own so that a registry that maps
+* paths to owners (an organisation's packages, a Harbor project) can grant it
+* as one; the app is joined to the project so the two read as one name.
+*/
+function imageName(identity, app) {
+	return `${identity.namespace}/${identity.project}-${slug(kebabCase(app))}`;
+}
+/** The full image ref an app is built, pushed and deployed as. */
+function imageRef(identity, app, registry, tag) {
+	const name = imageName(identity, app);
+	return registry ? `${registry.replace(/\/+$/, "")}/${name}:${tag}` : `${name}:${tag}`;
+}
+/**
+* What one application is called on the target.
+*
+* The same rule the constructs use, through the same `scopedName`, scoped by
+* the stage and the identity: the application beside
+* `production-kitchen-sink-database` is `production-kitchen-sink-api`. A
+* Dokploy application's name is also its Docker service name, which is unique
+* on the whole server, so the namespace has to be in it too — `acme`'s and
+* `globex`'s `shop` would otherwise both run `production-shop-api`.
+*
+* The app id is dropped when it repeats the project, so a project named for its
+* one application is `production-kitchen-sink` rather than
+* `production-kitchen-sink-kitchen-sink`.
+*/
+function applicationName(identity, app) {
+	return slug(app) === identity.project ? `${identity.stage}-${identity.scope}` : scopedName([identity.stage, identity.scope], app);
+}
+//#endregion
+//#region src/secrets/keystore.ts
+/**
+* The keys that open each stage's encrypted secrets file, kept outside the
+* project in the CLI's home.
+*
+* Keys were kept at `~/.gkm/<folder>/<stage>.key`, named after the project
+* directory — so two checkouts in folders with the same name (`~/work/api`
+* and `~/oss/api`) shared one key, and the second `gkm secrets:init`
+* overwrote the first project's. They are now kept under the project's
+* identity, `<home>/keys/<namespace>/<project>/<stage>.key`, the same
+* `<namespace>/<project>` a deploy claims its Dokploy project by. A key still
+* at the old place is copied to the new one the first time it is read; the
+* old file stays, so an older CLI on the same machine keeps working.
+*/
+/** Key length for AES-256 encryption */
+const KEY_LENGTH = 32;
+/** A keystore project key that is not `<namespace>/<project>`. */
+var KeystoreProjectInvalid = class extends Error {
+	key;
+	constructor(key) {
+		super(`'${key}' is not a keystore project: expected '<namespace>/<project>' in lowercase letters, digits and '-', as deployIdentity() produces. Pass the workspace's identity key.`);
+		this.key = key;
+		this.name = "KeystoreProjectInvalid";
+	}
+};
+/** A stage has no key, here or at the place keys used to be kept. */
+var KeyNotFound = class extends Error {
+	stage;
+	project;
+	path;
+	constructor(stage, project, path) {
+		super(`Encryption key not found for stage "${stage}" in project "${project}". Expected key at: ${path}. Run \`gkm secrets:init --stage ${stage}\` to create one, or copy the stage's key there.`);
+		this.stage = stage;
+		this.project = project;
+		this.path = path;
+		this.name = "KeyNotFound";
+	}
+};
+const PROJECT_KEY = /^[a-z0-9]+(?:-[a-z0-9]+)*\/[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* The keystore key of a workspace: its deploy identity without the stage, so
+* a project's keys and its Dokploy project are named by the same thing.
+*/
+function projectKey(workspace) {
+	return deployIdentity(workspace, "").key;
+}
+/** The keystore project of a loaded workspace. */
+function keystoreProject(workspace, home) {
+	const key = projectKey(workspace);
+	const unscoped = projectKey({ name: workspace.name });
+	return {
+		key,
+		legacy: [.../* @__PURE__ */ new Set([folderName(workspace.root), workspace.name])].filter((name) => !!name),
+		...unscoped !== key ? { aliases: [unscoped] } : {},
+		...home ? { home } : {}
+	};
+}
+/**
+* Whether `name` stays inside the home it is joined to. A workspace name was
+* joined as is — `@acme/shop` is `~/.gkm/@acme/shop` — but never upwards.
+*/
+function isLegacyName(name) {
+	return name.split(/[\\/]/).every((part) => part !== ".." && part !== "");
+}
+/** The last segment of a path, as the old keystore named projects. */
+function folderName(path) {
+	const name = path.split(/[\\/]/).filter(Boolean).at(-1);
+	return name && name !== "." && name !== ".." ? name : void 0;
+}
+/**
+* Get the keystore directory for a project:
+* `<home>/keys/<namespace>/<project>`.
+*/
+function getKeystoreDir(project) {
+	if (!PROJECT_KEY.test(project.key)) throw new KeystoreProjectInvalid(project.key);
+	const [namespace, name] = project.key.split("/");
+	return join(project.home ?? gkmHome(), "keys", namespace, name);
+}
+/** Get the path to a stage's encryption key. */
+function getKeyPath(stage, project) {
+	return join(getKeystoreDir(project), `${stage}.key`);
+}
+/**
+* Where else a stage's key may be, most likely first: under an alias of the
+* project, then where keys were kept before they were keyed by identity —
+* under the configured home, then under `~/.gkm`, which is where every CLI
+* before `GKM_HOME` wrote.
+*/
+function legacyKeyPaths(stage, project) {
+	const aliases = (project.aliases ?? []).map((key) => getKeyPath(stage, {
+		key,
+		home: project.home
+	}));
+	const homes = [.../* @__PURE__ */ new Set([project.home ?? gkmHome(), join(homedir(), ".gkm")])];
+	const names = (project.legacy ?? []).filter(isLegacyName);
+	return [...aliases, ...names.flatMap((name) => homes.map((home) => join(home, name, `${stage}.key`)))];
+}
+/**
+* Generate a new encryption key for a stage, stored owner-only at
+* `<home>/keys/<namespace>/<project>/<stage>.key`.
+*/
+async function generateKey(stage, project, flag = "w") {
+	const keyDir = getKeystoreDir(project);
+	const keyPath = getKeyPath(stage, project);
+	await mkdir(keyDir, {
+		recursive: true,
+		mode: 448
+	});
+	const key = randomBytes(KEY_LENGTH).toString("hex");
+	await writeFile(keyPath, key, {
+		mode: 384,
+		encoding: "utf-8",
+		flag
+	});
+	await chmod(keyPath, 384);
+	return key;
+}
+/**
+* Copy a key from where it used to be kept to where it is kept now.
+*
+* Copied, not moved: an older CLI on the same machine still reads the old
+* place. Exclusive, so two processes migrating at once cannot overwrite a key
+* one of them already put there.
+*/
+async function migrateLegacyKey(stage, project) {
+	const legacy = legacyKeyPaths(stage, project).find((path) => existsSync(path));
+	if (!legacy) return false;
+	const keyPath = getKeyPath(stage, project);
+	await mkdir(getKeystoreDir(project), {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		await copyFile(legacy, keyPath, constants.COPYFILE_EXCL);
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+	}
+	await chmod(keyPath, 384);
+	return true;
+}
+/**
+* Read an encryption key for a stage, or `null` when there is none — after
+* copying it over from where keys used to be kept, if it is still there.
+*/
+async function readKey(stage, project) {
+	const keyPath = getKeyPath(stage, project);
+	if (!existsSync(keyPath) && !await migrateLegacyKey(stage, project)) return null;
+	return (await readFile(keyPath, "utf-8")).trim();
+}
+/**
+* Read an encryption key for a stage, throwing {@link KeyNotFound} if there
+* is none.
+*/
+async function requireKey(stage, project) {
+	const key = await readKey(stage, project);
+	if (!key) throw new KeyNotFound(stage, project.key, getKeyPath(stage, project));
+	return key;
+}
+/**
+* Get or create a key for a stage.
+* If the key already exists, it is returned. Otherwise, a new key is generated.
+*/
+async function getOrCreateKey(stage, project) {
+	const existingKey = await readKey(stage, project);
+	if (existingKey) return existingKey;
+	try {
+		return await generateKey(stage, project, "wx");
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		return requireKey(stage, project);
+	}
+}
+//#endregion
+//#region src/secrets/file.ts
+/** Where the files live, relative to the project root. */
+const SECRETS_DIR = ".gkm/secrets";
+/** AES-256-GCM configuration */
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
+/**
+* A stage's secrets as an encrypted file on this machine:
+* `.gkm/secrets/<stage>.json`, with its key in the CLI's home at
+* `keys/<namespace>/<project>/<stage>.key`.
+*
+* The local stage's store, always — its secrets belong to the machine running
+* `gkm dev` — and a deployed stage's when `secrets.store` is `'file'`.
+*/
+var FileSecretsStore = class {
+	root;
+	name = "file";
+	project;
+	/**
+	* @param project - Whose keys: a workspace's `keystoreProject()`. Outside a
+	*   workspace there is no config to name the project, so it is named the
+	*   way a workspace without `name` is — its package name, else its folder.
+	*/
+	constructor(root, project) {
+		this.root = root;
+		this.project = project ?? {
+			key: projectKey({ name: packageName(root) ?? basename(root) }),
+			legacy: [basename(root)]
+		};
+	}
+	/** The file a stage's secrets are kept in. */
+	path(stage) {
+		return join(this.root, SECRETS_DIR, `${stage}.json`);
+	}
+	async read(stage) {
+		const path = this.path(stage);
+		if (!existsSync(path)) return null;
+		const data = JSON.parse(await readFile(path, "utf-8"));
+		if (!(data.version === 1 && data.encrypted && data.iv)) return data;
+		const key = await readKey(stage, this.project);
+		if (!key) throw new MissingSecretsKey(stage, this.project.key, getKeyPath(stage, this.project));
+		return decrypt(data, key);
+	}
+	async write(stage, secrets) {
+		await mkdir(join(this.root, SECRETS_DIR), { recursive: true });
+		const key = await getOrCreateKey(stage, this.project);
+		await writeFile(this.path(stage), JSON.stringify(encrypt(secrets, key), null, 2), "utf-8");
+	}
+};
+/** A stage's secrets file exists, and the key that opens it does not. */
+var MissingSecretsKey = class extends Error {
+	stage;
+	project;
+	path;
+	constructor(stage, project, path) {
+		super(`Decryption key not found for stage "${stage}". Expected key at: ${path}. Copy the stage's key there from whoever created it, or set secrets.store to a store this machine can reach.`);
+		this.stage = stage;
+		this.project = project;
+		this.path = path;
+		this.name = "MissingSecretsKey";
+	}
+};
+/** A project's package name without its scope, as a workspace name reads it. */
+function packageName(root) {
+	try {
+		const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf-8"));
+		return typeof pkg.name === "string" ? pkg.name.replace(/^@[^/]+\//, "") : void 0;
+	} catch {
+		return;
+	}
+}
+function encrypt(secrets, keyHex) {
+	const key = Buffer.from(keyHex, "hex");
+	const iv = randomBytes(IV_LENGTH);
+	const cipher = createCipheriv(ALGORITHM, key, iv);
+	const ciphertext = Buffer.concat([cipher.update(JSON.stringify(secrets), "utf-8"), cipher.final()]);
+	return {
+		version: 1,
+		encrypted: Buffer.concat([ciphertext, cipher.getAuthTag()]).toString("base64"),
+		iv: iv.toString("hex")
+	};
+}
+function decrypt(data, keyHex) {
+	const key = Buffer.from(keyHex, "hex");
+	const combined = Buffer.from(data.encrypted, "base64");
+	const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(data.iv, "hex"));
+	decipher.setAuthTag(combined.subarray(-16));
+	const plaintext = Buffer.concat([decipher.update(combined.subarray(0, -16)), decipher.final()]);
+	return JSON.parse(plaintext.toString("utf-8"));
+}
+//#endregion
+//#region src/secrets/store.ts
+var store_exports = /* @__PURE__ */ __exportAll({
+	FileSecretsStore: () => FileSecretsStore,
+	isRemoteStore: () => isRemoteStore,
+	secretsStoreFor: () => secretsStoreFor
+});
+/**
+* The store a stage's secrets are kept in — what every command reads and
+* writes, for the stage it acts on.
+*
+* The local stage is always the file: its secrets belong to the machine
+* running `gkm dev`. A deployed stage uses `secrets.store`.
+*/
+async function secretsStoreFor(workspace, stage, options = {}) {
+	const configured = workspace.secrets.store ?? "file";
+	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
+	if (configured.provider !== "ssm") return configured.provider;
+	const { AwsSecretsStore } = await import("./aws-DojzQnLd.mjs");
+	return new AwsSecretsStore({
+		project: workspace.name,
+		region: configured.region,
+		...options.profile ? { profile: options.profile } : {}
+	});
+}
+/** Whether a stage's secrets live somewhere other than this machine. */
+function isRemoteStore(workspace, stage) {
+	const configured = workspace.secrets.store ?? "file";
+	return stage !== workspace.stages.local && configured !== "file";
+}
+//#endregion
 //#region src/credentials/index.ts
 const logger$1 = console;
 /**
@@ -3158,7 +3680,7 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-//#region src/deploy/domain.ts
+//#region src/target/dokploy/domain.ts
 /** A stage was deployed that `deploy.domains` gives no domain. */
 var NoDomainForStage = class extends Error {
 	stage;
@@ -3772,6 +4294,12 @@ USER nextjs
 
 EXPOSE ${port}
 
+# A site answers at its root; Docker, and Dokploy, read the container's
+# health from it rather than from the process merely running. 127.0.0.1, not
+# localhost: the server listens on IPv4, and localhost can resolve to ::1.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
+
 ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["node", "${appPath}/server.js"]
 `;
@@ -4039,6 +4567,12 @@ ENV HOSTNAME="0.0.0.0"
 USER app
 EXPOSE ${port}
 
+# A site answers at its root; Docker, and Dokploy, read the container's
+# health from it rather than from the process merely running. 127.0.0.1, not
+# localhost: the server listens on IPv4, and localhost can resolve to ::1.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
+
 ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["sh", "-c", "cd ${appPath} && ${startCmd}"]
 `;
@@ -4086,6 +4620,11 @@ COPY --from=builder /app/${appPath}/dist /usr/share/nginx/html
 RUN printf 'server {\\n  listen ${port};\\n  root /usr/share/nginx/html;\\n  index index.html;\\n  location / { try_files $uri $uri/ /index.html; }\\n}\\n' \\
     > /etc/nginx/conf.d/default.conf
 EXPOSE ${port}
+# A site answers at its root; Docker, and Dokploy, read the container's
+# health from it rather than from the process merely running. 127.0.0.1, not
+# localhost: the server listens on IPv4, and localhost can resolve to ::1.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
 CMD ["nginx", "-g", "daemon off;"]
 `;
 }
@@ -4584,13 +5123,60 @@ function createEmptyState(stage, projectId, environmentId) {
 function setApplicationId(state, appName, applicationId) {
 	state.applications[appName] = applicationId;
 }
+/** Two records naming the same image: by digest when both have one. */
+function sameImage(a, b) {
+	return a.digest && b.digest ? a.digest === b.digest : a.ref === b.ref;
+}
+/** The newest release in `history` after `index` that a rollback may restore. */
+function restorable(history, index, current) {
+	return history.slice(index + 1).find((entry) => !entry.rolledBack && !sameImage(entry, current));
+}
 /**
-* Record the image an app was deployed with (mutates state)
+* Record that `image` went live for `appName` (mutates state): it becomes
+* `current`, and what was current becomes `previous`. Releasing what already
+* runs — a redeploy of the same digest — changes nothing.
 */
-function setDeployedImage(state, appName, image) {
-	state.images = {
-		...state.images,
-		[appName]: image
+function recordRelease(state, appName, image, releasedAt = /* @__PURE__ */ new Date()) {
+	const releases = state.releases?.[appName];
+	if (releases && sameImage(releases.current, image)) return;
+	const entry = {
+		...image,
+		releasedAt: releasedAt.toISOString()
+	};
+	const history = [entry, ...releases?.history ?? []].slice(0, 10);
+	const previous = releases?.current;
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current: entry,
+			...previous ? { previous } : {},
+			history
+		}
+	};
+}
+/**
+* Record that `appName` was rolled back to `to` (mutates state): every
+* release newer than it is marked rolled back, so neither this rollback nor
+* a later one restores it, and `previous` moves to the release before `to`.
+*/
+function recordRollback(state, appName, to) {
+	const releases = state.releases?.[appName];
+	if (!releases) return;
+	const index = releases.history.findIndex((entry) => !entry.rolledBack && sameImage(entry, to));
+	if (index === -1) return;
+	const history = releases.history.map((entry, i) => i < index ? {
+		...entry,
+		rolledBack: true
+	} : entry);
+	const current = history[index];
+	const previous = restorable(history, index, current);
+	state.releases = {
+		...state.releases,
+		[appName]: {
+			current,
+			...previous ? { previous } : {},
+			history
+		}
 	};
 }
 /**
@@ -4659,6 +5245,6 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { portKeys as $, workspace_exports as A, networkEnv as B, isMainFrontendApp as C, constructGlobs as D, backendsOf as E, postgresStatements as F, hostFor as G, localRolePassword as H, quoteIdentifier as I, providerOf as J, cacheBackendFor as K, composeFor as L, forgetState as M, applyPostgres as N, derivedContainers as O, postgresDatabaseNames as P, fakeKey as Q, pgClient as R, validateImageRef as S, FAKE_ENV as T, planFor as U, envFor as V, resourceName as W, DEFAULT_IMAGES as X, storageBackendFor as Y, describeServices as Z, dockerCommand as _, setApplicationId as a, loadEnvFiles as at, generateDockerignore as b, setDnsRecord as c, setPostgresBackupId as d, primaryPortKey as et, DeployJournal as f, appPackageName as g, DockerPushFailed as h, isDnsVerified as i, isPortAvailable as it, LOCAL_CA_PATH as j, reconcileWorkspace as k, setDnsVerification as l, DockerBuildFailed as m, getBackupState as n, createEntryWrapper as nt, setBackupState as o, loadSecretsForApp as ot, withGeneratedSecrets as p, eventsBackendFor as q, getGeneratedSecret as r, findAvailablePort as rt, setDeployedImage as s, prepareEntryCredentials as st, createEmptyState as t, createCredentialsPreload as tt, setGeneratedSecret as u, siteDockerfile as v, resolveHost as w, generateSlimDockerfile as x, detectPackageManager as y, appEnvKeys as z };
+export { describeServices as $, reconcileWorkspace as A, withCustomSecret as At, appEnvKeys as B, validateImageRef as C, markerOf as Ct, backendsOf as D, maskPassword as Dt, FAKE_ENV as E, initStageSecrets as Et, postgresDatabaseNames as F, planFor as G, networkEnv as H, postgresStatements as I, cacheBackendFor as J, resourceName as K, quoteIdentifier as L, LOCAL_CA_PATH as M, forgetState as N, constructGlobs as O, storage_exports as Ot, applyPostgres as P, DEFAULT_IMAGES as Q, composeFor as R, generateSlimDockerfile as S, isOwnedBy as St, resolveHost as T, projectName as Tt, envFor as U, dockerfileOf as V, localRolePassword as W, providerOf as X, eventsBackendFor as Y, storageBackendFor as Z, appPackageName as _, readKey as _t, recordRelease as a, findAvailablePort as at, detectPackageManager as b, imageName as bt, setBackupState as c, loadSecretsForApp as ct, setGeneratedSecret as d, secretsStoreFor as dt, fakeKey as et, setPostgresBackupId as f, store_exports as ft, DockerPushFailed as g, projectKey as gt, DockerBuildFailed as h, keystoreProject as ht, isDnsVerified as i, createEntryWrapper as it, workspace_exports as j, derivedContainers as k, toEmbeddableSecrets as kt, setDnsRecord as l, prepareEntryCredentials as lt, withGeneratedSecrets as m, getKeyPath as mt, getBackupState as n, primaryPortKey as nt, recordRollback as o, isPortAvailable as ot, DeployJournal as p, FileSecretsStore as pt, hostFor as q, getGeneratedSecret as r, createCredentialsPreload as rt, setApplicationId as s, loadEnvFiles as st, createEmptyState as t, portKeys as tt, setDnsVerification as u, isRemoteStore as ut, dockerCommand as v, applicationName as vt, isMainFrontendApp as w, ownershipMarker as wt, generateDockerignore as x, imageRef as xt, siteDockerfile as y, deployIdentity as yt, pgClient as z };
 
-//# sourceMappingURL=state-B8YwmUZU.mjs.map
+//# sourceMappingURL=state-uuYqnRVO.mjs.map