@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.67

package/dist/{sniffer-BZ-OJO4Y.mjs → sniffer-BdFeLSmA.mjs}

@@ -1,206 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { t as LocalSandbox } from "./local-CWR4Y_kW.mjs";
-import { a as getDokployCredentials, d as storeHostingerToken, i as getCredentialsPath, l as removeDokployCredentials, u as storeDokployCredentials } from "./credentials-Dq1MnWQf.mjs";
-import { d as output, r as discover, s as nodeWithTsx } from "./discover-LMrqsWSU.mjs";
+import { i as LocalSandbox } from "./credentials-pAtB70k3.mjs";
+import { d as output, s as nodeWithTsx } from "./discover-BFoJWKGD.mjs";
 import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
-import { n as derivedApps } from "./derive-B4vDpzgP.mjs";
-import { o as builtinTarget } from "./define-DR8xGYfL.mjs";
-import { h as getPublicEnvPrefix, k as assertDeployedStage, s as getAppBuildOrder } from "./workspace-C06_pW4g.mjs";
-import { l as applicationName, n as secretsStoreFor, u as deployIdentity } from "./store-CLiHnqOY.mjs";
-import { D as constructGlobs } from "./state-B8YwmUZU.mjs";
-import { a as parseTargetOptions, o as resolveTarget } from "./resolve-DLkIXTct.mjs";
+import { h as getPublicEnvPrefix } from "./workspace-Be6uBhlF.mjs";
 import { dirname, resolve } from "node:path";
-import { stdin, stdout } from "node:process";
-import * as readline from "node:readline/promises";
 import { existsSync } from "node:fs";
 import { hostname, userInfo } from "node:os";
 import { fileURLToPath } from "node:url";
-import { createCipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
-//#region src/prompt.ts
-/**
-* Asking the person at the terminal.
-*
-* CLI layer only: a command's action may prompt, nothing it calls may. A
-* library call (`deploy()`) that needs something it was not given raises a
-* named error instead, and the command decides whether to ask.
-*/
-/** A prompt was needed with no terminal to ask at. */
-var PromptNeedsTerminal = class extends Error {
-	question;
-	instead;
-	constructor(question, instead) {
-		super(`Interactive input required. ${instead}`);
-		this.question = question;
-		this.instead = instead;
-		this.name = "PromptNeedsTerminal";
-	}
-};
-/** Whether there is a person at a terminal to ask. */
-function canPrompt() {
-	return process.stdin.isTTY === true;
-}
-/**
-* Ask `message` and resolve with the line typed — without echoing it when
-* `hidden`. Ctrl+C at a hidden prompt exits, as it would anywhere else in a
-* terminal program: raw mode has taken the signal away from the shell.
-*/
-async function prompt(message, options) {
-	if (!canPrompt()) throw new PromptNeedsTerminal(message, options.instead);
-	if (options.hidden) {
-		process.stdout.write(message);
-		return new Promise((resolve, reject) => {
-			let value = "";
-			const cleanup = () => {
-				process.stdin.setRawMode(false);
-				process.stdin.pause();
-				process.stdin.removeListener("data", onData);
-				process.stdin.removeListener("error", onError);
-			};
-			const onError = (err) => {
-				cleanup();
-				reject(err);
-			};
-			const onData = (char) => {
-				const c = char.toString();
-				if (c === "\n" || c === "\r") {
-					cleanup();
-					process.stdout.write("\n");
-					resolve(value);
-				} else if (c === "") {
-					cleanup();
-					process.stdout.write("\n");
-					process.exit(1);
-				} else if (c === "" || c === "\b") {
-					if (value.length > 0) value = value.slice(0, -1);
-				} else value += c;
-			};
-			process.stdin.setRawMode(true);
-			process.stdin.resume();
-			process.stdin.on("data", onData);
-			process.stdin.on("error", onError);
-		});
-	}
-	const rl = readline.createInterface({
-		input: stdin,
-		output: stdout
-	});
-	try {
-		return await rl.question(message);
-	} finally {
-		rl.close();
-	}
-}
-//#endregion
-//#region src/auth/index.ts
-const logger = console;
-/**
-* Validate Dokploy token by making a test API call
-*/
-async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => dokploy_api_exports);
-	return new DokployApi({
-		baseUrl: endpoint,
-		token
-	}).validateToken();
-}
-/** What answers a login prompt without a terminal. */
-const LOGIN_INSTEAD = "Please provide --token option.";
-/**
-* Login to a service
-*/
-async function loginCommand(options) {
-	const { provider, token: providedToken, endpoint: providedEndpoint } = options;
-	if (provider === "dokploy") {
-		logger.log("\n🔐 Logging in to Dokploy...\n");
-		let endpoint = providedEndpoint;
-		if (!endpoint) endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: LOGIN_INSTEAD });
-		endpoint = endpoint.replace(/\/$/, "");
-		try {
-			new URL(endpoint);
-		} catch {
-			logger.error("Invalid URL format");
-			process.exit(1);
-		}
-		let token = providedToken;
-		if (!token) {
-			logger.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
-			token = await prompt("API Token: ", {
-				hidden: true,
-				instead: LOGIN_INSTEAD
-			});
-		}
-		if (!token) {
-			logger.error("Token is required");
-			process.exit(1);
-		}
-		logger.log("\nValidating credentials...");
-		if (!await validateDokployToken(endpoint, token)) {
-			logger.error("\n✗ Invalid credentials. Please check your token and try again.");
-			process.exit(1);
-		}
-		await storeDokployCredentials(token, endpoint);
-		logger.log("\n✓ Successfully logged in to Dokploy!");
-		logger.log(`  Endpoint: ${endpoint}`);
-		logger.log(`  Credentials stored in: ${getCredentialsPath()}`);
-		logger.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
-	}
-	if (provider === "hostinger") {
-		logger.log("\n🔐 Logging in to Hostinger...\n");
-		let token = providedToken;
-		if (!token) {
-			logger.log("\nGenerate a token at: https://hpanel.hostinger.com/profile/api\n");
-			token = await prompt("API Token: ", {
-				hidden: true,
-				instead: LOGIN_INSTEAD
-			});
-		}
-		if (!token) {
-			logger.error("Token is required");
-			process.exit(1);
-		}
-		await storeHostingerToken(token);
-		logger.log("\n✓ Hostinger token stored.");
-		logger.log(`  Credentials stored in: ${getCredentialsPath()}`);
-		logger.log("  Not validated here: every DNS endpoint is scoped to a domain, so the\n  first deploy that touches DNS is where a bad token reports itself.");
-		logger.log("\nYou can now use it as a DNS provider without setting HOSTINGER_API_TOKEN.");
-	}
-}
-/**
-* Logout from a service
-*/
-async function logoutCommand(options) {
-	const { provider = "dokploy" } = options;
-	if (provider === "all") {
-		if (await removeDokployCredentials()) logger.log("\n✓ Logged out from all services");
-		else logger.log("\nNo stored credentials found");
-		return;
-	}
-	if (provider === "dokploy") {
-		if (await removeDokployCredentials()) logger.log("\n✓ Logged out from Dokploy");
-		else logger.log("\nNo Dokploy credentials found");
-	}
-}
-/**
-* Show current login status
-*/
-async function whoamiCommand() {
-	logger.log("\n📋 Current credentials:\n");
-	const dokploy = await getDokployCredentials();
-	if (dokploy) {
-		logger.log("  Dokploy:");
-		logger.log(`    Endpoint: ${dokploy.endpoint}`);
-		logger.log(`    Token: ${maskToken(dokploy.token)}`);
-	} else logger.log("  Dokploy: Not logged in");
-	logger.log(`\n  Credentials file: ${getCredentialsPath()}`);
-}
-/**
-* Mask a token for display
-*/
-function maskToken(token) {
-	if (token.length <= 8) return "****";
-	return `${token.slice(0, 4)}...${token.slice(-4)}`;
-}
-//#endregion
+import { createHash, randomUUID } from "node:crypto";
 //#region src/workspace/client-generator.ts
 /**
 * Normalize routes to an array of patterns.
@@ -212,118 +19,6 @@ function normalizeRoutes(routes) {
 	return Array.isArray(routes) ? routes : [routes];
 }
 //#endregion
-//#region src/secrets/encryption.ts
-var encryption_exports = /* @__PURE__ */ __exportAll({
-	encryptSecrets: () => encryptSecrets,
-	generateDefineOptions: () => generateDefineOptions,
-	keyFingerprint: () => keyFingerprint
-});
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const KEY_LENGTH = 32;
-const IV_LENGTH = 12;
-/**
-* Encrypt secrets for embedding in a bundle.
-* Uses AES-256-GCM with a randomly generated ephemeral key.
-*
-* @param secrets - Key-value pairs to encrypt
-* @returns Encrypted payload with ephemeral master key
-*/
-function encryptSecrets(secrets) {
-	const masterKey = randomBytes(KEY_LENGTH);
-	const iv = randomBytes(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = createCipheriv(ALGORITHM, masterKey, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
-		iv: iv.toString("hex"),
-		masterKey: masterKey.toString("hex")
-	};
-}
-/**
-* Generate the define options for tsdown/esbuild.
-* These will be injected at build time.
-*/
-function generateDefineOptions(payload) {
-	return {
-		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
-		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
-	};
-}
-/**
-* A short, one-way name for a master key: the first 8 hex characters of its
-* SHA-256.
-*
-* Printed where the key itself used to be, so a person can tell which key a
-* build used — and match it against the one they hold — without the output
-* carrying a value that decrypts every secret of the stage.
-*/
-function keyFingerprint(masterKey) {
-	return createHash("sha256").update(masterKey).digest("hex").slice(0, 8);
-}
-//#endregion
-//#region src/target/secrets.ts
-/**
-* A stage's secrets as a target sees them: read and written through the
-* stage's own store, and masked in everything the run prints once read.
-*/
-/**
-* Shorter values are left alone: what a progress line legitimately prints —
-* a port, a stage, an app name — would otherwise come out as `***` wherever
-* a secret happened to share it.
-*/
-const SHORTEST_MASKED = 6;
-/** The values a run must never print, and the rewrite that keeps it so. */
-var Redactor = class {
-	values = /* @__PURE__ */ new Set();
-	add(value) {
-		if (value && value.length >= SHORTEST_MASKED) this.values.add(value);
-	}
-	/** `text` with every masked value replaced by `***`, longest first. */
-	redact(text) {
-		if (this.values.size === 0) return text;
-		let out = text;
-		const longestFirst = [...this.values].sort((a, b) => b.length - a.length);
-		for (const value of longestFirst) out = out.replaceAll(value, "***");
-		return out;
-	}
-};
-/** Every value in `secrets` that is a secret rather than a label. */
-function secretValues(secrets) {
-	return [
-		secrets.seed,
-		...Object.values(secrets.custom ?? {}),
-		...Object.values(secrets.urls ?? {}),
-		...Object.values(secrets.services ?? {}).map((service) => service?.password)
-	].filter((value) => typeof value === "string");
-}
-/**
-* The stage's secrets through the store `secrets.store` names for it. Opening
-* one builds a client and makes no request, so a target that never reads them
-* costs nothing.
-*/
-async function deploySecrets(workspace, stage, redactor, options = {}) {
-	const store = await secretsStoreFor(workspace, stage, options);
-	const mask = (secrets) => {
-		for (const value of secretValues(secrets)) redactor.add(value);
-	};
-	return {
-		store: store.name,
-		async read() {
-			const secrets = await store.read(stage);
-			if (secrets) mask(secrets);
-			return secrets;
-		},
-		async write(secrets) {
-			mask(secrets);
-			await store.write(stage, secrets);
-		},
-		mask: (value) => redactor.add(value)
-	};
-}
-//#endregion
 //#region src/deploy/events.ts
 /** An error as an event carries it: its name and message, nothing else. */
 function eventError(error) {
@@ -658,17 +353,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await import("./LocalStateStore-BRhMQRuy.mjs").then((n) => n.n);
+		const { LocalStateStore } = await import("./LocalStateStore-Dk3Wbvzk.mjs").then((n) => n.n);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await import("./LegacyStateStore-BUu1nQ5u.mjs");
+		const { LegacyStateStore } = await import("./LegacyStateStore-C39UKwmf.mjs");
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await import("./SSMStateStore-Dmj7zzFO.mjs");
+		const { SSMStateStore } = await import("./SSMStateStore-DjPuKqrm.mjs");
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -678,7 +373,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await import("./S3StateStore-pw1GhWwt.mjs");
+		const { S3StateStore } = await import("./S3StateStore-B_ZF9eHt.mjs");
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -691,293 +386,12 @@ async function createStateStore(options) {
 	throw new UnknownStateProvider(config);
 }
 //#endregion
-//#region src/deploy/orchestrate.ts
-/**
-* The run around a target: what every deploy does whatever it deploys
-* through.
-*
-* It loads the workspace, resolves the target, works out the apps and the
-* identity, takes the stage's lock, and calls the target's phases in order,
-* reporting each as it starts, finishes or fails. Everything that is about
-* *where* the stage goes is the target's.
-*/
-/** Apps were asked for by name that the workspace does not have. */
-var UnknownDeployApps = class extends Error {
-	apps;
-	available;
-	constructor(apps, available) {
-		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
-		this.apps = apps;
-		this.available = available;
-		this.name = "UnknownDeployApps";
-	}
-};
-/** Every app asked for deploys through some other target. */
-var NoDeployableApps = class extends Error {
-	stage;
-	target;
-	constructor(stage, target) {
-		super(`No apps to deploy through "${target}": every selected app deploys somewhere else. Pick the target with --target, or set each app's deploy in gkm.config.ts.`);
-		this.stage = stage;
-		this.target = target;
-		this.name = "NoDeployableApps";
-	}
-};
-/** A failed rollback, after the failure that called for it. */
-var RollbackFailed = class extends Error {
-	target;
-	failure;
-	constructor(target, failure, cause) {
-		super(`Deploying through "${target}" failed, and so did rolling it back: ${cause instanceof Error ? cause.message : String(cause)}. The stage may be part-released; deploy again, or roll it back by hand. The first failure: ${failure instanceof Error ? failure.message : String(failure)}`, { cause });
-		this.target = target;
-		this.failure = failure;
-		this.name = "RollbackFailed";
-	}
-};
-/**
-* Generate image tag from stage and timestamp
-*/
-function generateTag(stage) {
-	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
-}
-/** Why an app that deploys through another target is left out. */
-function elsewhere(target, stage) {
-	const instead = builtinTarget(target)?.instead?.(stage);
-	if (instead) return `it deploys through "${target}" — ${instead}`;
-	return `it deploys through "${target}" — run \`gkm deploy --target ${target} --stage ${stage}\``;
-}
-/**
-* Deploy a workspace's stage through its target.
-*
-* The engine under `deploy()` and `gkm deploy`. It never prompts and never
-* exits: credentials come from `ctx.credentials`, progress goes to
-* `ctx.emit` and to `output`, and every failure is thrown.
-*
-* @internal
-*/
-async function runDeploy(source, request, ctx) {
-	const { stage } = request;
-	const redactor = ctx.redactor ?? new Redactor();
-	const emit = (event) => ctx.emit(event.type === "log" ? {
-		...event,
-		message: redactor.redact(event.message)
-	} : event);
-	/** Run one phase between its events. */
-	const phase = async (name, body) => {
-		ctx.signal?.throwIfAborted();
-		emit({
-			type: "phase.started",
-			phase: name
-		});
-		try {
-			const value = await body();
-			emit({
-				type: "phase.finished",
-				phase: name
-			});
-			return value;
-		} catch (error) {
-			emit({
-				type: "phase.failed",
-				phase: name,
-				error: eventError(error)
-			});
-			throw error;
-		}
-	};
-	ctx.signal?.throwIfAborted();
-	emit({
-		type: "phase.started",
-		phase: "validate"
-	});
-	let prepared;
-	try {
-		prepared = await prepare(source, request, ctx, emit, redactor);
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-	const { resolved, phaseCtx, store } = prepared;
-	const { target } = resolved;
-	if (ctx.dryRun) {
-		const run = await validate(target, phaseCtx, emit);
-		await phase("plan", () => target.plan(phaseCtx, run));
-		return target.result(phaseCtx, run);
-	}
-	let lock;
-	try {
-		lock = await store.lock(stage, { operation: "deploy" });
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-	try {
-		const run = await validate(target, phaseCtx, emit);
-		if (target.provision) await phase("provision", () => target.provision(phaseCtx, run));
-		if (target.build) await phase("build", () => target.build(phaseCtx, run));
-		let releasing = "release";
-		try {
-			await phase("release", () => target.release(phaseCtx, run));
-			releasing = "verify";
-			if (target.verify) await phase("verify", () => target.verify(phaseCtx, run));
-		} catch (error) {
-			if (ctx.signal?.aborted || !target.capabilities.rollback) throw error;
-			if (!target.rollback) throw error;
-			try {
-				await phase("rollback", () => target.rollback(phaseCtx, run, {
-					phase: releasing,
-					error
-				}));
-			} catch (rollbackError) {
-				throw new RollbackFailed(resolved.name, error, rollbackError);
-			}
-			throw error;
-		}
-		return await target.result(phaseCtx, run);
-	} finally {
-		await lock.release();
-	}
-}
-/** `validate`, then the run's `deploy.started`, inside the validate phase. */
-async function validate(target, phaseCtx, emit) {
-	try {
-		const run = await target.validate(phaseCtx);
-		const skipped = new Set(phaseCtx.skipped.map((s) => s.app));
-		emit({
-			type: "deploy.started",
-			stage: phaseCtx.stage,
-			target: phaseCtx.target,
-			identity: phaseCtx.identity.key,
-			tag: phaseCtx.tag,
-			apps: phaseCtx.apps.filter((app) => !skipped.has(app)),
-			dryRun: phaseCtx.dryRun
-		});
-		emit({
-			type: "phase.finished",
-			phase: "validate"
-		});
-		return run;
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-}
-/** Everything the phases are handed, worked out before the first of them. */
-async function prepare(source, request, ctx, emit, redactor) {
-	const { stage } = request;
-	const configured = typeof source === "function" ? await source() : source;
-	const local = stage === configured.stages.local;
-	if (!local) assertDeployedStage(configured.stages, stage);
-	const targetName = request.target ?? configured.deploy?.default ?? "dokploy";
-	const resolved = await resolveTarget(targetName, {
-		workspace: configured,
-		stage,
-		...ctx.targets ? { host: ctx.targets } : {}
-	});
-	if (local && !resolved.target.capabilities.localStage) assertDeployedStage(configured.stages, stage);
-	const options = await parseTargetOptions(resolved);
-	const manifest = await discover({
-		patterns: constructGlobs(configured),
-		cwd: configured.root
-	});
-	const units = derivedApps(manifest, configured);
-	const workspace = Object.keys(units).length > 0 ? {
-		...configured,
-		apps: units
-	} : configured;
-	const identity = deployIdentity(workspace, stage);
-	const tag = request.tag ?? (resolved.target.tag ? await resolved.target.tag({
-		cwd: workspace.root,
-		stage
-	}) : generateTag(stage));
-	const buildOrder = getAppBuildOrder(workspace);
-	let selected = buildOrder;
-	if (request.apps && request.apps.length > 0) {
-		const unknown = request.apps.filter((name) => !workspace.apps[name]);
-		if (unknown.length > 0) throw new UnknownDeployApps(unknown, Object.keys(workspace.apps));
-		selected = buildOrder.filter((name) => request.apps.includes(name));
-	}
-	const skipped = [];
-	const skip = (app, reason) => {
-		skipped.push({
-			app,
-			reason
-		});
-		emit({
-			type: "app.skipped",
-			app,
-			reason
-		});
-	};
-	const byDefault = configured.deploy?.default ?? "dokploy";
-	const apps = selected.filter((name) => {
-		const own = workspace.apps[name].resolvedDeployTarget;
-		const deploysThrough = own === byDefault ? targetName : own;
-		if (deploysThrough === targetName) return true;
-		skip(name, elsewhere(deploysThrough, stage));
-		return false;
-	});
-	if (apps.length === 0) throw new NoDeployableApps(stage, targetName);
-	const store = await createStateStore({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	const secrets = await deploySecrets(workspace, stage, redactor, { ...ctx.home ? { home: ctx.home } : {} });
-	const line = (level) => (message) => emit({
-		type: "log",
-		level,
-		message
-	});
-	const logger = {
-		info: line("info"),
-		warn: line("warn"),
-		error: line("error")
-	};
-	return {
-		resolved,
-		phaseCtx: {
-			target: targetName,
-			cwd: workspace.root,
-			stage,
-			tag,
-			tagGiven: request.tag !== void 0,
-			apps,
-			skipped,
-			identity,
-			workspace,
-			manifest,
-			options,
-			dryRun: ctx.dryRun,
-			credentials: ctx.credentials,
-			state: store,
-			secrets,
-			logger,
-			signal: ctx.signal ?? new AbortController().signal,
-			childOutput: ctx.childOutput ?? "inherit",
-			emit,
-			skip,
-			name: (resource) => applicationName(identity, resource)
-		},
-		store
-	};
-}
-//#endregion
-//#region src/deploy/dokploy-api.ts
+//#region src/target/dokploy/dokploy-api.ts
 var dokploy_api_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_DEPLOYMENT_TIMEOUT_MS: () => DEFAULT_DEPLOYMENT_TIMEOUT_MS,
 	DEFAULT_DOKPLOY_TIMEOUT_MS: () => DEFAULT_DOKPLOY_TIMEOUT_MS,
+	DeploymentFailed: () => DeploymentFailed,
+	DeploymentTimedOut: () => DeploymentTimedOut,
 	DokployApi: () => DokployApi,
 	DokployApiError: () => DokployApiError,
 	DokployRequestTimedOut: () => DokployRequestTimedOut
@@ -1024,6 +438,32 @@ function pause(ms, signal) {
 		signal?.addEventListener("abort", onAbort, { once: true });
 	});
 }
+/** How long a deployment may take to finish before a deploy gives up on it. */
+const DEFAULT_DEPLOYMENT_TIMEOUT_MS = 6e5;
+/** A deployment Dokploy ran and reported as failed. */
+var DeploymentFailed = class extends Error {
+	applicationId;
+	deployment;
+	constructor(applicationId, deployment) {
+		super(`Dokploy's deployment ${deployment.deploymentId} of application ${applicationId} ended in "${deployment.status}"${deployment.errorMessage ? `: ${deployment.errorMessage}` : ""}. Its log in Dokploy says why — usually an image the server could not pull, or a container that exited on start.`);
+		this.applicationId = applicationId;
+		this.deployment = deployment;
+		this.name = "DeploymentFailed";
+	}
+};
+/** A deployment that had not finished when the deploy stopped waiting. */
+var DeploymentTimedOut = class extends Error {
+	applicationId;
+	timeoutMs;
+	lastStatus;
+	constructor(applicationId, timeoutMs, lastStatus) {
+		super(`Application ${applicationId} did not finish deploying within ${Math.round(timeoutMs / 1e3)}s (${lastStatus ? `last status "${lastStatus}"` : "no deployment started"}). Check its deployment log in Dokploy, or raise deploy.dokploy.verify.deploymentTimeoutMs for an image that is slow to pull.`);
+		this.applicationId = applicationId;
+		this.timeoutMs = timeoutMs;
+		this.lastStatus = lastStatus;
+		this.name = "DeploymentTimedOut";
+	}
+};
 var DokployApiError = class extends Error {
 	status;
 	statusText;
@@ -1331,6 +771,63 @@ var DokployApi = class {
 		await this.post("application.deploy", { applicationId });
 	}
 	/**
+	* An application's deployments, newest first.
+	*
+	* Sorted here rather than trusted to arrive sorted: which deployment is
+	* the latest is the whole question `waitForDeployment` asks.
+	*/
+	async listDeployments(applicationId) {
+		return [...await this.get(`deployment.all?applicationId=${encodeURIComponent(applicationId)}`)].sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+	}
+	/**
+	* When the application's latest deployment was created, by Dokploy's own
+	* clock — what `waitForDeployment`'s `since` is measured against. Epoch
+	* when it has none.
+	*/
+	async latestDeploymentAt(applicationId) {
+		const [latest] = await this.listDeployments(applicationId);
+		return new Date(latest ? Date.parse(latest.createdAt) : 0);
+	}
+	/**
+	* Wait for the deployment `application.deploy` queued to finish.
+	*
+	* `application.deploy` only queues one: it answers before the image is
+	* pulled, let alone running, so a deploy that stopped there reported
+	* success for containers that had not started. This polls the latest
+	* deployment created after `since` — Dokploy's clock, from
+	* `latestDeploymentAt` before deploying, so a laptop's skew cannot pick an
+	* older one — and the application's own status, backing off from
+	* `intervalMs` to `maxIntervalMs`.
+	*
+	* @throws {DeploymentFailed} when the deployment ends in `error` or is
+	*   cancelled, or the application reports `error` once it has finished.
+	* @throws {DeploymentTimedOut} when it has not finished within `timeoutMs`.
+	*/
+	async waitForDeployment(applicationId, options) {
+		const { since, timeoutMs = DEFAULT_DEPLOYMENT_TIMEOUT_MS, signal, intervalMs = 2e3, maxIntervalMs = 15e3 } = options;
+		const after = since.getTime();
+		const deadline = Date.now() + timeoutMs;
+		let interval = intervalMs;
+		let last;
+		while (true) {
+			signal?.throwIfAborted();
+			const deployment = (await this.listDeployments(applicationId)).find((d) => Date.parse(d.createdAt) > after);
+			last = deployment ?? last;
+			if (deployment) {
+				if (deployment.status === "error" || deployment.status === "cancelled") throw new DeploymentFailed(applicationId, deployment);
+				if (deployment.status === "done") {
+					const { applicationStatus } = await this.get(`application.one?applicationId=${encodeURIComponent(applicationId)}`);
+					if (applicationStatus === "error") throw new DeploymentFailed(applicationId, deployment);
+					if (applicationStatus !== "running") return deployment;
+				}
+			}
+			const left = deadline - Date.now();
+			if (left <= 0) throw new DeploymentTimedOut(applicationId, timeoutMs, last?.status);
+			await pause(Math.min(interval, left), signal);
+			interval = Math.min(interval * 2, maxIntervalMs);
+		}
+	}
+	/**
 	* Delete an application
 	*/
 	async deleteApplication(applicationId) {
@@ -2063,6 +1560,6 @@ async function sniffAllApps(apps, workspacePath, options = {}) {
 	return results;
 }
 //#endregion
-export { loginCommand as C, canPrompt as D, whoamiCommand as E, prompt as O, keyFingerprint as S, validateDokployToken as T, newLockHolder as _, NoDeployableApps as a, encryptSecrets as b, runDeploy as c, StateLocked as d, StateStoreBusy as f, createStateStore as g, contentVersion as h, DokployApiError as i, DocumentStateStore as l, StateVersionConflict as m, sniffAppEnvironment as n, RollbackFailed as o, StateStoreWithoutLocking as p, DokployApi as r, UnknownDeployApps as s, sniffAllApps as t, StageStateMissing as u, eventError as v, logoutCommand as w, encryption_exports as x, Redactor as y };
+export { newLockHolder as _, DeploymentTimedOut as a, dokploy_api_exports as c, StateLocked as d, StateStoreBusy as f, createStateStore as g, contentVersion as h, DeploymentFailed as i, DocumentStateStore as l, StateVersionConflict as m, sniffAppEnvironment as n, DokployApi as o, StateStoreWithoutLocking as p, DEFAULT_DEPLOYMENT_TIMEOUT_MS as r, DokployApiError as s, sniffAllApps as t, StageStateMissing as u, eventError as v };
 
-//# sourceMappingURL=sniffer-BZ-OJO4Y.mjs.map
+//# sourceMappingURL=sniffer-BdFeLSmA.mjs.map