@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.67

package/dist/{sniffer-BSwaL-dX.cjs → sniffer-D66HIvi9.cjs}

@@ -1,207 +1,13 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_local = require("./local-BdH4XN0E.cjs");
-const require_credentials = require("./credentials-Bzbg23n8.cjs");
-const require_discover = require("./discover-DHdECueV.cjs");
+const require_credentials = require("./credentials-BVs7mrtw.cjs");
+const require_discover = require("./discover-OEfZ9OkA.cjs");
 const require_sandbox = require("./sandbox-CL--ZDui.cjs");
-const require_derive = require("./derive-DAbo49sm.cjs");
-const require_define = require("./define-DzRz8FgH.cjs");
-const require_workspace = require("./workspace-BewAHZIo.cjs");
-const require_store = require("./store-CJF1Tqkq.cjs");
-const require_state = require("./state-DF26e_lo.cjs");
-const require_resolve = require("./resolve-N_i4XNd-.cjs");
+const require_workspace = require("./workspace-ON-bqiJz.cjs");
 let node_path = require("node:path");
-let node_process = require("node:process");
-let node_readline_promises = require("node:readline/promises");
-node_readline_promises = require_rolldown_runtime.__toESM(node_readline_promises, 1);
 let node_fs = require("node:fs");
 let node_os = require("node:os");
 let node_url = require("node:url");
 let node_crypto = require("node:crypto");
-//#region src/prompt.ts
-/**
-* Asking the person at the terminal.
-*
-* CLI layer only: a command's action may prompt, nothing it calls may. A
-* library call (`deploy()`) that needs something it was not given raises a
-* named error instead, and the command decides whether to ask.
-*/
-/** A prompt was needed with no terminal to ask at. */
-var PromptNeedsTerminal = class extends Error {
-	question;
-	instead;
-	constructor(question, instead) {
-		super(`Interactive input required. ${instead}`);
-		this.question = question;
-		this.instead = instead;
-		this.name = "PromptNeedsTerminal";
-	}
-};
-/** Whether there is a person at a terminal to ask. */
-function canPrompt() {
-	return process.stdin.isTTY === true;
-}
-/**
-* Ask `message` and resolve with the line typed — without echoing it when
-* `hidden`. Ctrl+C at a hidden prompt exits, as it would anywhere else in a
-* terminal program: raw mode has taken the signal away from the shell.
-*/
-async function prompt(message, options) {
-	if (!canPrompt()) throw new PromptNeedsTerminal(message, options.instead);
-	if (options.hidden) {
-		process.stdout.write(message);
-		return new Promise((resolve, reject) => {
-			let value = "";
-			const cleanup = () => {
-				process.stdin.setRawMode(false);
-				process.stdin.pause();
-				process.stdin.removeListener("data", onData);
-				process.stdin.removeListener("error", onError);
-			};
-			const onError = (err) => {
-				cleanup();
-				reject(err);
-			};
-			const onData = (char) => {
-				const c = char.toString();
-				if (c === "\n" || c === "\r") {
-					cleanup();
-					process.stdout.write("\n");
-					resolve(value);
-				} else if (c === "") {
-					cleanup();
-					process.stdout.write("\n");
-					process.exit(1);
-				} else if (c === "" || c === "\b") {
-					if (value.length > 0) value = value.slice(0, -1);
-				} else value += c;
-			};
-			process.stdin.setRawMode(true);
-			process.stdin.resume();
-			process.stdin.on("data", onData);
-			process.stdin.on("error", onError);
-		});
-	}
-	const rl = node_readline_promises.createInterface({
-		input: node_process.stdin,
-		output: node_process.stdout
-	});
-	try {
-		return await rl.question(message);
-	} finally {
-		rl.close();
-	}
-}
-//#endregion
-//#region src/auth/index.ts
-const logger = console;
-/**
-* Validate Dokploy token by making a test API call
-*/
-async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => dokploy_api_exports);
-	return new DokployApi({
-		baseUrl: endpoint,
-		token
-	}).validateToken();
-}
-/** What answers a login prompt without a terminal. */
-const LOGIN_INSTEAD = "Please provide --token option.";
-/**
-* Login to a service
-*/
-async function loginCommand(options) {
-	const { provider, token: providedToken, endpoint: providedEndpoint } = options;
-	if (provider === "dokploy") {
-		logger.log("\n🔐 Logging in to Dokploy...\n");
-		let endpoint = providedEndpoint;
-		if (!endpoint) endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: LOGIN_INSTEAD });
-		endpoint = endpoint.replace(/\/$/, "");
-		try {
-			new URL(endpoint);
-		} catch {
-			logger.error("Invalid URL format");
-			process.exit(1);
-		}
-		let token = providedToken;
-		if (!token) {
-			logger.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
-			token = await prompt("API Token: ", {
-				hidden: true,
-				instead: LOGIN_INSTEAD
-			});
-		}
-		if (!token) {
-			logger.error("Token is required");
-			process.exit(1);
-		}
-		logger.log("\nValidating credentials...");
-		if (!await validateDokployToken(endpoint, token)) {
-			logger.error("\n✗ Invalid credentials. Please check your token and try again.");
-			process.exit(1);
-		}
-		await require_credentials.storeDokployCredentials(token, endpoint);
-		logger.log("\n✓ Successfully logged in to Dokploy!");
-		logger.log(`  Endpoint: ${endpoint}`);
-		logger.log(`  Credentials stored in: ${require_credentials.getCredentialsPath()}`);
-		logger.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
-	}
-	if (provider === "hostinger") {
-		logger.log("\n🔐 Logging in to Hostinger...\n");
-		let token = providedToken;
-		if (!token) {
-			logger.log("\nGenerate a token at: https://hpanel.hostinger.com/profile/api\n");
-			token = await prompt("API Token: ", {
-				hidden: true,
-				instead: LOGIN_INSTEAD
-			});
-		}
-		if (!token) {
-			logger.error("Token is required");
-			process.exit(1);
-		}
-		await require_credentials.storeHostingerToken(token);
-		logger.log("\n✓ Hostinger token stored.");
-		logger.log(`  Credentials stored in: ${require_credentials.getCredentialsPath()}`);
-		logger.log("  Not validated here: every DNS endpoint is scoped to a domain, so the\n  first deploy that touches DNS is where a bad token reports itself.");
-		logger.log("\nYou can now use it as a DNS provider without setting HOSTINGER_API_TOKEN.");
-	}
-}
-/**
-* Logout from a service
-*/
-async function logoutCommand(options) {
-	const { provider = "dokploy" } = options;
-	if (provider === "all") {
-		if (await require_credentials.removeDokployCredentials()) logger.log("\n✓ Logged out from all services");
-		else logger.log("\nNo stored credentials found");
-		return;
-	}
-	if (provider === "dokploy") {
-		if (await require_credentials.removeDokployCredentials()) logger.log("\n✓ Logged out from Dokploy");
-		else logger.log("\nNo Dokploy credentials found");
-	}
-}
-/**
-* Show current login status
-*/
-async function whoamiCommand() {
-	logger.log("\n📋 Current credentials:\n");
-	const dokploy = await require_credentials.getDokployCredentials();
-	if (dokploy) {
-		logger.log("  Dokploy:");
-		logger.log(`    Endpoint: ${dokploy.endpoint}`);
-		logger.log(`    Token: ${maskToken(dokploy.token)}`);
-	} else logger.log("  Dokploy: Not logged in");
-	logger.log(`\n  Credentials file: ${require_credentials.getCredentialsPath()}`);
-}
-/**
-* Mask a token for display
-*/
-function maskToken(token) {
-	if (token.length <= 8) return "****";
-	return `${token.slice(0, 4)}...${token.slice(-4)}`;
-}
-//#endregion
 //#region src/workspace/client-generator.ts
 /**
 * Normalize routes to an array of patterns.
@@ -213,118 +19,6 @@ function normalizeRoutes(routes) {
 	return Array.isArray(routes) ? routes : [routes];
 }
 //#endregion
-//#region src/secrets/encryption.ts
-var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
-	encryptSecrets: () => encryptSecrets,
-	generateDefineOptions: () => generateDefineOptions,
-	keyFingerprint: () => keyFingerprint
-});
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const KEY_LENGTH = 32;
-const IV_LENGTH = 12;
-/**
-* Encrypt secrets for embedding in a bundle.
-* Uses AES-256-GCM with a randomly generated ephemeral key.
-*
-* @param secrets - Key-value pairs to encrypt
-* @returns Encrypted payload with ephemeral master key
-*/
-function encryptSecrets(secrets) {
-	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
-	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
-		iv: iv.toString("hex"),
-		masterKey: masterKey.toString("hex")
-	};
-}
-/**
-* Generate the define options for tsdown/esbuild.
-* These will be injected at build time.
-*/
-function generateDefineOptions(payload) {
-	return {
-		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
-		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
-	};
-}
-/**
-* A short, one-way name for a master key: the first 8 hex characters of its
-* SHA-256.
-*
-* Printed where the key itself used to be, so a person can tell which key a
-* build used — and match it against the one they hold — without the output
-* carrying a value that decrypts every secret of the stage.
-*/
-function keyFingerprint(masterKey) {
-	return (0, node_crypto.createHash)("sha256").update(masterKey).digest("hex").slice(0, 8);
-}
-//#endregion
-//#region src/target/secrets.ts
-/**
-* A stage's secrets as a target sees them: read and written through the
-* stage's own store, and masked in everything the run prints once read.
-*/
-/**
-* Shorter values are left alone: what a progress line legitimately prints —
-* a port, a stage, an app name — would otherwise come out as `***` wherever
-* a secret happened to share it.
-*/
-const SHORTEST_MASKED = 6;
-/** The values a run must never print, and the rewrite that keeps it so. */
-var Redactor = class {
-	values = /* @__PURE__ */ new Set();
-	add(value) {
-		if (value && value.length >= SHORTEST_MASKED) this.values.add(value);
-	}
-	/** `text` with every masked value replaced by `***`, longest first. */
-	redact(text) {
-		if (this.values.size === 0) return text;
-		let out = text;
-		const longestFirst = [...this.values].sort((a, b) => b.length - a.length);
-		for (const value of longestFirst) out = out.replaceAll(value, "***");
-		return out;
-	}
-};
-/** Every value in `secrets` that is a secret rather than a label. */
-function secretValues(secrets) {
-	return [
-		secrets.seed,
-		...Object.values(secrets.custom ?? {}),
-		...Object.values(secrets.urls ?? {}),
-		...Object.values(secrets.services ?? {}).map((service) => service?.password)
-	].filter((value) => typeof value === "string");
-}
-/**
-* The stage's secrets through the store `secrets.store` names for it. Opening
-* one builds a client and makes no request, so a target that never reads them
-* costs nothing.
-*/
-async function deploySecrets(workspace, stage, redactor, options = {}) {
-	const store = await require_store.secretsStoreFor(workspace, stage, options);
-	const mask = (secrets) => {
-		for (const value of secretValues(secrets)) redactor.add(value);
-	};
-	return {
-		store: store.name,
-		async read() {
-			const secrets = await store.read(stage);
-			if (secrets) mask(secrets);
-			return secrets;
-		},
-		async write(secrets) {
-			mask(secrets);
-			await store.write(stage, secrets);
-		},
-		mask: (value) => redactor.add(value)
-	};
-}
-//#endregion
 //#region src/deploy/events.ts
 /** An error as an event carries it: its name and message, nothing else. */
 function eventError(error) {
@@ -659,17 +353,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-93urXyQe.cjs")).then((n) => n.LocalStateStore_exports);
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-DHVsZLyF.cjs")).then((n) => n.LocalStateStore_exports);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-BGoo__sO.cjs"));
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-BZiO9-Lw.cjs"));
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-Bt9acuAF.cjs"));
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-ACZ8hRvZ.cjs"));
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -679,7 +373,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-F4dxw6kS.cjs"));
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore--4tYVMAL.cjs"));
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -692,293 +386,12 @@ async function createStateStore(options) {
 	throw new UnknownStateProvider(config);
 }
 //#endregion
-//#region src/deploy/orchestrate.ts
-/**
-* The run around a target: what every deploy does whatever it deploys
-* through.
-*
-* It loads the workspace, resolves the target, works out the apps and the
-* identity, takes the stage's lock, and calls the target's phases in order,
-* reporting each as it starts, finishes or fails. Everything that is about
-* *where* the stage goes is the target's.
-*/
-/** Apps were asked for by name that the workspace does not have. */
-var UnknownDeployApps = class extends Error {
-	apps;
-	available;
-	constructor(apps, available) {
-		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
-		this.apps = apps;
-		this.available = available;
-		this.name = "UnknownDeployApps";
-	}
-};
-/** Every app asked for deploys through some other target. */
-var NoDeployableApps = class extends Error {
-	stage;
-	target;
-	constructor(stage, target) {
-		super(`No apps to deploy through "${target}": every selected app deploys somewhere else. Pick the target with --target, or set each app's deploy in gkm.config.ts.`);
-		this.stage = stage;
-		this.target = target;
-		this.name = "NoDeployableApps";
-	}
-};
-/** A failed rollback, after the failure that called for it. */
-var RollbackFailed = class extends Error {
-	target;
-	failure;
-	constructor(target, failure, cause) {
-		super(`Deploying through "${target}" failed, and so did rolling it back: ${cause instanceof Error ? cause.message : String(cause)}. The stage may be part-released; deploy again, or roll it back by hand. The first failure: ${failure instanceof Error ? failure.message : String(failure)}`, { cause });
-		this.target = target;
-		this.failure = failure;
-		this.name = "RollbackFailed";
-	}
-};
-/**
-* Generate image tag from stage and timestamp
-*/
-function generateTag(stage) {
-	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
-}
-/** Why an app that deploys through another target is left out. */
-function elsewhere(target, stage) {
-	const instead = require_define.builtinTarget(target)?.instead?.(stage);
-	if (instead) return `it deploys through "${target}" — ${instead}`;
-	return `it deploys through "${target}" — run \`gkm deploy --target ${target} --stage ${stage}\``;
-}
-/**
-* Deploy a workspace's stage through its target.
-*
-* The engine under `deploy()` and `gkm deploy`. It never prompts and never
-* exits: credentials come from `ctx.credentials`, progress goes to
-* `ctx.emit` and to `output`, and every failure is thrown.
-*
-* @internal
-*/
-async function runDeploy(source, request, ctx) {
-	const { stage } = request;
-	const redactor = ctx.redactor ?? new Redactor();
-	const emit = (event) => ctx.emit(event.type === "log" ? {
-		...event,
-		message: redactor.redact(event.message)
-	} : event);
-	/** Run one phase between its events. */
-	const phase = async (name, body) => {
-		ctx.signal?.throwIfAborted();
-		emit({
-			type: "phase.started",
-			phase: name
-		});
-		try {
-			const value = await body();
-			emit({
-				type: "phase.finished",
-				phase: name
-			});
-			return value;
-		} catch (error) {
-			emit({
-				type: "phase.failed",
-				phase: name,
-				error: eventError(error)
-			});
-			throw error;
-		}
-	};
-	ctx.signal?.throwIfAborted();
-	emit({
-		type: "phase.started",
-		phase: "validate"
-	});
-	let prepared;
-	try {
-		prepared = await prepare(source, request, ctx, emit, redactor);
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-	const { resolved, phaseCtx, store } = prepared;
-	const { target } = resolved;
-	if (ctx.dryRun) {
-		const run = await validate(target, phaseCtx, emit);
-		await phase("plan", () => target.plan(phaseCtx, run));
-		return target.result(phaseCtx, run);
-	}
-	let lock;
-	try {
-		lock = await store.lock(stage, { operation: "deploy" });
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-	try {
-		const run = await validate(target, phaseCtx, emit);
-		if (target.provision) await phase("provision", () => target.provision(phaseCtx, run));
-		if (target.build) await phase("build", () => target.build(phaseCtx, run));
-		let releasing = "release";
-		try {
-			await phase("release", () => target.release(phaseCtx, run));
-			releasing = "verify";
-			if (target.verify) await phase("verify", () => target.verify(phaseCtx, run));
-		} catch (error) {
-			if (ctx.signal?.aborted || !target.capabilities.rollback) throw error;
-			if (!target.rollback) throw error;
-			try {
-				await phase("rollback", () => target.rollback(phaseCtx, run, {
-					phase: releasing,
-					error
-				}));
-			} catch (rollbackError) {
-				throw new RollbackFailed(resolved.name, error, rollbackError);
-			}
-			throw error;
-		}
-		return await target.result(phaseCtx, run);
-	} finally {
-		await lock.release();
-	}
-}
-/** `validate`, then the run's `deploy.started`, inside the validate phase. */
-async function validate(target, phaseCtx, emit) {
-	try {
-		const run = await target.validate(phaseCtx);
-		const skipped = new Set(phaseCtx.skipped.map((s) => s.app));
-		emit({
-			type: "deploy.started",
-			stage: phaseCtx.stage,
-			target: phaseCtx.target,
-			identity: phaseCtx.identity.key,
-			tag: phaseCtx.tag,
-			apps: phaseCtx.apps.filter((app) => !skipped.has(app)),
-			dryRun: phaseCtx.dryRun
-		});
-		emit({
-			type: "phase.finished",
-			phase: "validate"
-		});
-		return run;
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-}
-/** Everything the phases are handed, worked out before the first of them. */
-async function prepare(source, request, ctx, emit, redactor) {
-	const { stage } = request;
-	const configured = typeof source === "function" ? await source() : source;
-	const local = stage === configured.stages.local;
-	if (!local) require_workspace.assertDeployedStage(configured.stages, stage);
-	const targetName = request.target ?? configured.deploy?.default ?? "dokploy";
-	const resolved = await require_resolve.resolveTarget(targetName, {
-		workspace: configured,
-		stage,
-		...ctx.targets ? { host: ctx.targets } : {}
-	});
-	if (local && !resolved.target.capabilities.localStage) require_workspace.assertDeployedStage(configured.stages, stage);
-	const options = await require_resolve.parseTargetOptions(resolved);
-	const manifest = await require_discover.discover({
-		patterns: require_state.constructGlobs(configured),
-		cwd: configured.root
-	});
-	const units = require_derive.derivedApps(manifest, configured);
-	const workspace = Object.keys(units).length > 0 ? {
-		...configured,
-		apps: units
-	} : configured;
-	const identity = require_store.deployIdentity(workspace, stage);
-	const tag = request.tag ?? (resolved.target.tag ? await resolved.target.tag({
-		cwd: workspace.root,
-		stage
-	}) : generateTag(stage));
-	const buildOrder = require_workspace.getAppBuildOrder(workspace);
-	let selected = buildOrder;
-	if (request.apps && request.apps.length > 0) {
-		const unknown = request.apps.filter((name) => !workspace.apps[name]);
-		if (unknown.length > 0) throw new UnknownDeployApps(unknown, Object.keys(workspace.apps));
-		selected = buildOrder.filter((name) => request.apps.includes(name));
-	}
-	const skipped = [];
-	const skip = (app, reason) => {
-		skipped.push({
-			app,
-			reason
-		});
-		emit({
-			type: "app.skipped",
-			app,
-			reason
-		});
-	};
-	const byDefault = configured.deploy?.default ?? "dokploy";
-	const apps = selected.filter((name) => {
-		const own = workspace.apps[name].resolvedDeployTarget;
-		const deploysThrough = own === byDefault ? targetName : own;
-		if (deploysThrough === targetName) return true;
-		skip(name, elsewhere(deploysThrough, stage));
-		return false;
-	});
-	if (apps.length === 0) throw new NoDeployableApps(stage, targetName);
-	const store = await createStateStore({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	const secrets = await deploySecrets(workspace, stage, redactor, { ...ctx.home ? { home: ctx.home } : {} });
-	const line = (level) => (message) => emit({
-		type: "log",
-		level,
-		message
-	});
-	const logger = {
-		info: line("info"),
-		warn: line("warn"),
-		error: line("error")
-	};
-	return {
-		resolved,
-		phaseCtx: {
-			target: targetName,
-			cwd: workspace.root,
-			stage,
-			tag,
-			tagGiven: request.tag !== void 0,
-			apps,
-			skipped,
-			identity,
-			workspace,
-			manifest,
-			options,
-			dryRun: ctx.dryRun,
-			credentials: ctx.credentials,
-			state: store,
-			secrets,
-			logger,
-			signal: ctx.signal ?? new AbortController().signal,
-			childOutput: ctx.childOutput ?? "inherit",
-			emit,
-			skip,
-			name: (resource) => require_store.applicationName(identity, resource)
-		},
-		store
-	};
-}
-//#endregion
-//#region src/deploy/dokploy-api.ts
+//#region src/target/dokploy/dokploy-api.ts
 var dokploy_api_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	DEFAULT_DEPLOYMENT_TIMEOUT_MS: () => DEFAULT_DEPLOYMENT_TIMEOUT_MS,
 	DEFAULT_DOKPLOY_TIMEOUT_MS: () => DEFAULT_DOKPLOY_TIMEOUT_MS,
+	DeploymentFailed: () => DeploymentFailed,
+	DeploymentTimedOut: () => DeploymentTimedOut,
 	DokployApi: () => DokployApi,
 	DokployApiError: () => DokployApiError,
 	DokployRequestTimedOut: () => DokployRequestTimedOut
@@ -1025,6 +438,32 @@ function pause(ms, signal) {
 		signal?.addEventListener("abort", onAbort, { once: true });
 	});
 }
+/** How long a deployment may take to finish before a deploy gives up on it. */
+const DEFAULT_DEPLOYMENT_TIMEOUT_MS = 6e5;
+/** A deployment Dokploy ran and reported as failed. */
+var DeploymentFailed = class extends Error {
+	applicationId;
+	deployment;
+	constructor(applicationId, deployment) {
+		super(`Dokploy's deployment ${deployment.deploymentId} of application ${applicationId} ended in "${deployment.status}"${deployment.errorMessage ? `: ${deployment.errorMessage}` : ""}. Its log in Dokploy says why — usually an image the server could not pull, or a container that exited on start.`);
+		this.applicationId = applicationId;
+		this.deployment = deployment;
+		this.name = "DeploymentFailed";
+	}
+};
+/** A deployment that had not finished when the deploy stopped waiting. */
+var DeploymentTimedOut = class extends Error {
+	applicationId;
+	timeoutMs;
+	lastStatus;
+	constructor(applicationId, timeoutMs, lastStatus) {
+		super(`Application ${applicationId} did not finish deploying within ${Math.round(timeoutMs / 1e3)}s (${lastStatus ? `last status "${lastStatus}"` : "no deployment started"}). Check its deployment log in Dokploy, or raise deploy.dokploy.verify.deploymentTimeoutMs for an image that is slow to pull.`);
+		this.applicationId = applicationId;
+		this.timeoutMs = timeoutMs;
+		this.lastStatus = lastStatus;
+		this.name = "DeploymentTimedOut";
+	}
+};
 var DokployApiError = class extends Error {
 	status;
 	statusText;
@@ -1332,6 +771,63 @@ var DokployApi = class {
 		await this.post("application.deploy", { applicationId });
 	}
 	/**
+	* An application's deployments, newest first.
+	*
+	* Sorted here rather than trusted to arrive sorted: which deployment is
+	* the latest is the whole question `waitForDeployment` asks.
+	*/
+	async listDeployments(applicationId) {
+		return [...await this.get(`deployment.all?applicationId=${encodeURIComponent(applicationId)}`)].sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+	}
+	/**
+	* When the application's latest deployment was created, by Dokploy's own
+	* clock — what `waitForDeployment`'s `since` is measured against. Epoch
+	* when it has none.
+	*/
+	async latestDeploymentAt(applicationId) {
+		const [latest] = await this.listDeployments(applicationId);
+		return new Date(latest ? Date.parse(latest.createdAt) : 0);
+	}
+	/**
+	* Wait for the deployment `application.deploy` queued to finish.
+	*
+	* `application.deploy` only queues one: it answers before the image is
+	* pulled, let alone running, so a deploy that stopped there reported
+	* success for containers that had not started. This polls the latest
+	* deployment created after `since` — Dokploy's clock, from
+	* `latestDeploymentAt` before deploying, so a laptop's skew cannot pick an
+	* older one — and the application's own status, backing off from
+	* `intervalMs` to `maxIntervalMs`.
+	*
+	* @throws {DeploymentFailed} when the deployment ends in `error` or is
+	*   cancelled, or the application reports `error` once it has finished.
+	* @throws {DeploymentTimedOut} when it has not finished within `timeoutMs`.
+	*/
+	async waitForDeployment(applicationId, options) {
+		const { since, timeoutMs = DEFAULT_DEPLOYMENT_TIMEOUT_MS, signal, intervalMs = 2e3, maxIntervalMs = 15e3 } = options;
+		const after = since.getTime();
+		const deadline = Date.now() + timeoutMs;
+		let interval = intervalMs;
+		let last;
+		while (true) {
+			signal?.throwIfAborted();
+			const deployment = (await this.listDeployments(applicationId)).find((d) => Date.parse(d.createdAt) > after);
+			last = deployment ?? last;
+			if (deployment) {
+				if (deployment.status === "error" || deployment.status === "cancelled") throw new DeploymentFailed(applicationId, deployment);
+				if (deployment.status === "done") {
+					const { applicationStatus } = await this.get(`application.one?applicationId=${encodeURIComponent(applicationId)}`);
+					if (applicationStatus === "error") throw new DeploymentFailed(applicationId, deployment);
+					if (applicationStatus !== "running") return deployment;
+				}
+			}
+			const left = deadline - Date.now();
+			if (left <= 0) throw new DeploymentTimedOut(applicationId, timeoutMs, last?.status);
+			await pause(Math.min(interval, left), signal);
+			interval = Math.min(interval * 2, maxIntervalMs);
+		}
+	}
+	/**
 	* Delete an application
 	*/
 	async deleteApplication(applicationId) {
@@ -1793,7 +1289,7 @@ function resolveSnifferFile(baseName) {
 * comes back as the error the caller reports.
 */
 async function runSniffer(run, workspacePath, cwd, nodeArgs) {
-	const sandbox = run.sandbox ?? require_sandbox.activeSandbox() ?? new require_local.LocalSandbox({ root: (0, node_path.resolve)(workspacePath) });
+	const sandbox = run.sandbox ?? require_sandbox.activeSandbox() ?? new require_credentials.LocalSandbox({ root: (0, node_path.resolve)(workspacePath) });
 	try {
 		const result = await sandbox.exec("node", nodeArgs, {
 			cwd,
@@ -2064,40 +1560,40 @@ async function sniffAllApps(apps, workspacePath, options = {}) {
 	return results;
 }
 //#endregion
-Object.defineProperty(exports, "DocumentStateStore", {
+Object.defineProperty(exports, "DEFAULT_DEPLOYMENT_TIMEOUT_MS", {
 	enumerable: true,
 	get: function() {
-		return DocumentStateStore;
+		return DEFAULT_DEPLOYMENT_TIMEOUT_MS;
 	}
 });
-Object.defineProperty(exports, "DokployApi", {
+Object.defineProperty(exports, "DeploymentFailed", {
 	enumerable: true,
 	get: function() {
-		return DokployApi;
+		return DeploymentFailed;
 	}
 });
-Object.defineProperty(exports, "DokployApiError", {
+Object.defineProperty(exports, "DeploymentTimedOut", {
 	enumerable: true,
 	get: function() {
-		return DokployApiError;
+		return DeploymentTimedOut;
 	}
 });
-Object.defineProperty(exports, "NoDeployableApps", {
+Object.defineProperty(exports, "DocumentStateStore", {
 	enumerable: true,
 	get: function() {
-		return NoDeployableApps;
+		return DocumentStateStore;
 	}
 });
-Object.defineProperty(exports, "Redactor", {
+Object.defineProperty(exports, "DokployApi", {
 	enumerable: true,
 	get: function() {
-		return Redactor;
+		return DokployApi;
 	}
 });
-Object.defineProperty(exports, "RollbackFailed", {
+Object.defineProperty(exports, "DokployApiError", {
 	enumerable: true,
 	get: function() {
-		return RollbackFailed;
+		return DokployApiError;
 	}
 });
 Object.defineProperty(exports, "StageStateMissing", {
@@ -2130,18 +1626,6 @@ Object.defineProperty(exports, "StateVersionConflict", {
 		return StateVersionConflict;
 	}
 });
-Object.defineProperty(exports, "UnknownDeployApps", {
-	enumerable: true,
-	get: function() {
-		return UnknownDeployApps;
-	}
-});
-Object.defineProperty(exports, "canPrompt", {
-	enumerable: true,
-	get: function() {
-		return canPrompt;
-	}
-});
 Object.defineProperty(exports, "contentVersion", {
 	enumerable: true,
 	get: function() {
@@ -2154,16 +1638,10 @@ Object.defineProperty(exports, "createStateStore", {
 		return createStateStore;
 	}
 });
-Object.defineProperty(exports, "encryptSecrets", {
+Object.defineProperty(exports, "dokploy_api_exports", {
 	enumerable: true,
 	get: function() {
-		return encryptSecrets;
-	}
-});
-Object.defineProperty(exports, "encryption_exports", {
-	enumerable: true,
-	get: function() {
-		return encryption_exports;
+		return dokploy_api_exports;
 	}
 });
 Object.defineProperty(exports, "eventError", {
@@ -2172,42 +1650,12 @@ Object.defineProperty(exports, "eventError", {
 		return eventError;
 	}
 });
-Object.defineProperty(exports, "keyFingerprint", {
-	enumerable: true,
-	get: function() {
-		return keyFingerprint;
-	}
-});
-Object.defineProperty(exports, "loginCommand", {
-	enumerable: true,
-	get: function() {
-		return loginCommand;
-	}
-});
-Object.defineProperty(exports, "logoutCommand", {
-	enumerable: true,
-	get: function() {
-		return logoutCommand;
-	}
-});
 Object.defineProperty(exports, "newLockHolder", {
 	enumerable: true,
 	get: function() {
 		return newLockHolder;
 	}
 });
-Object.defineProperty(exports, "prompt", {
-	enumerable: true,
-	get: function() {
-		return prompt;
-	}
-});
-Object.defineProperty(exports, "runDeploy", {
-	enumerable: true,
-	get: function() {
-		return runDeploy;
-	}
-});
 Object.defineProperty(exports, "sniffAllApps", {
 	enumerable: true,
 	get: function() {
@@ -2220,17 +1668,5 @@ Object.defineProperty(exports, "sniffAppEnvironment", {
 		return sniffAppEnvironment;
 	}
 });
-Object.defineProperty(exports, "validateDokployToken", {
-	enumerable: true,
-	get: function() {
-		return validateDokployToken;
-	}
-});
-Object.defineProperty(exports, "whoamiCommand", {
-	enumerable: true,
-	get: function() {
-		return whoamiCommand;
-	}
-});
 
-//# sourceMappingURL=sniffer-BSwaL-dX.cjs.map
+//# sourceMappingURL=sniffer-D66HIvi9.cjs.map