@geekmidas/cli 10.0.0-alpha.71 → 10.0.0-alpha.73

package/dist/discover-DFiJxwfv.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover-DFiJxwfv.d.mts","names":[],"sources":["../src/reconcile/discover.ts"],"mappings":";;;;UAqCU;EACT;EACA,WAAW;;;;;;;;;iBAUI,aAAa,iBAAiB,SAAS;UAYtC;;EAEhB;EACA;;;;;;;EAOA;;;;;;;;;;;;EAYA,UAAU,eAAe;;;;;;;;;;;;EAYzB,YAAY;;;;;;;;;EASZ,aAAa;;;;;;;EAOb,UAAU;;;cAmGE,iCAAiC;WAEnC;WACA;EAFV,YACU,mBACA;;;;;;cAWE,kCAAkC;WACzB;EAArB,YAAqB;;;UAYL;;EAEhB;;EAEA;;;;;;;EAOA;;;;;;;;;;iBAWqB,SACrB,SAAS,kBACP,QAAQ"}

package/dist/{dokploy-D1UwQKm3.mjs → dokploy-CZ1vZt21.mjs}

@@ -1,5 +1,5 @@
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { a as dokployResult, c as releaseDokploy, d as validateDokploy, f as verifyDokploy, o as planDokploy, s as provisionDokploy, u as rollbackDokploy } from "./engine-DmQS3XHX.mjs";
+import { a as dokployResult, c as releaseDokploy, d as validateDokploy, f as verifyDokploy, o as planDokploy, s as provisionDokploy, u as rollbackDokploy } from "./engine-B37qBO5W.mjs";
 //#region src/target/dokploy/index.ts
 /**
 * The built-in `dokploy` target: the Dokploy engine `gkm deploy` has always
@@ -35,4 +35,4 @@ const dokployTarget = defineTarget({
 //#endregion
 export { dokployTarget };
 
-//# sourceMappingURL=dokploy-D1UwQKm3.mjs.map
+//# sourceMappingURL=dokploy-CZ1vZt21.mjs.map

package/dist/{dokploy-D1UwQKm3.mjs.map → dokploy-CZ1vZt21.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"dokploy-D1UwQKm3.mjs","names":[],"sources":["../src/target/dokploy/index.ts"],"sourcesContent":["/**\n * The built-in `dokploy` target: the Dokploy engine `gkm deploy` has always\n * run, behind the phases.\n *\n * - `provision`: the project, environment and registry, and what the\n *   manifest declares — its databases' roles applied over a port published\n *   for the purpose.\n * - `release`: the stage's migrations, then each image built and pushed\n *   beside its application and deployed, waited on until Dokploy has\n *   finished; backends first and checked before any site is released.\n * - `verify`: each site answering its health check.\n * - `rollback`: what failed — or, `--atomic`, everything the run released —\n *   pointed back at the image it ran before.\n */\n\nimport { defineTarget } from '../define';\nimport {\n\ttype DokployRun,\n\tdokployResult,\n\tplanDokploy,\n\tprovisionDokploy,\n\treleaseDokploy,\n\trollbackDokploy,\n\tvalidateDokploy,\n\tverifyDokploy,\n} from './engine';\n\nexport const dokployTarget = defineTarget<undefined, DokployRun>({\n\tname: 'dokploy',\n\truntime: 'server',\n\tcapabilities: { rollback: true, migrations: 'target', images: true },\n\tcredentials: ['dokploy', 'registry'],\n\tvalidate: (ctx) => validateDokploy(ctx),\n\tplan: (_ctx, run) => planDokploy(run),\n\tprovision: (_ctx, run) => provisionDokploy(run),\n\trelease: (_ctx, run) => releaseDokploy(run),\n\tverify: (_ctx, run) => verifyDokploy(run),\n\trollback: (_ctx, run, failure) => rollbackDokploy(run, failure),\n\tresult: (_ctx, run) => dokployResult(run),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,MAAa,gBAAgB,aAAoC;CAChE,MAAM;CACN,SAAS;CACT,cAAc;EAAE,UAAU;EAAM,YAAY;EAAU,QAAQ;CAAK;CACnE,aAAa,CAAC,WAAW,UAAU;CACnC,WAAW,QAAQ,gBAAgB,GAAG;CACtC,OAAO,MAAM,QAAQ,YAAY,GAAG;CACpC,YAAY,MAAM,QAAQ,iBAAiB,GAAG;CAC9C,UAAU,MAAM,QAAQ,eAAe,GAAG;CAC1C,SAAS,MAAM,QAAQ,cAAc,GAAG;CACxC,WAAW,MAAM,KAAK,YAAY,gBAAgB,KAAK,OAAO;CAC9D,SAAS,MAAM,QAAQ,cAAc,GAAG;AACzC,CAAC"}
+{"version":3,"file":"dokploy-CZ1vZt21.mjs","names":[],"sources":["../src/target/dokploy/index.ts"],"sourcesContent":["/**\n * The built-in `dokploy` target: the Dokploy engine `gkm deploy` has always\n * run, behind the phases.\n *\n * - `provision`: the project, environment and registry, and what the\n *   manifest declares — its databases' roles applied over a port published\n *   for the purpose.\n * - `release`: the stage's migrations, then each image built and pushed\n *   beside its application and deployed, waited on until Dokploy has\n *   finished; backends first and checked before any site is released.\n * - `verify`: each site answering its health check.\n * - `rollback`: what failed — or, `--atomic`, everything the run released —\n *   pointed back at the image it ran before.\n */\n\nimport { defineTarget } from '../define';\nimport {\n\ttype DokployRun,\n\tdokployResult,\n\tplanDokploy,\n\tprovisionDokploy,\n\treleaseDokploy,\n\trollbackDokploy,\n\tvalidateDokploy,\n\tverifyDokploy,\n} from './engine';\n\nexport const dokployTarget = defineTarget<undefined, DokployRun>({\n\tname: 'dokploy',\n\truntime: 'server',\n\tcapabilities: { rollback: true, migrations: 'target', images: true },\n\tcredentials: ['dokploy', 'registry'],\n\tvalidate: (ctx) => validateDokploy(ctx),\n\tplan: (_ctx, run) => planDokploy(run),\n\tprovision: (_ctx, run) => provisionDokploy(run),\n\trelease: (_ctx, run) => releaseDokploy(run),\n\tverify: (_ctx, run) => verifyDokploy(run),\n\trollback: (_ctx, run, failure) => rollbackDokploy(run, failure),\n\tresult: (_ctx, run) => dokployResult(run),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,MAAa,gBAAgB,aAAoC;CAChE,MAAM;CACN,SAAS;CACT,cAAc;EAAE,UAAU;EAAM,YAAY;EAAU,QAAQ;CAAK;CACnE,aAAa,CAAC,WAAW,UAAU;CACnC,WAAW,QAAQ,gBAAgB,GAAG;CACtC,OAAO,MAAM,QAAQ,YAAY,GAAG;CACpC,YAAY,MAAM,QAAQ,iBAAiB,GAAG;CAC9C,UAAU,MAAM,QAAQ,eAAe,GAAG;CAC1C,SAAS,MAAM,QAAQ,cAAc,GAAG;CACxC,WAAW,MAAM,KAAK,YAAY,gBAAgB,KAAK,OAAO;CAC9D,SAAS,MAAM,QAAQ,cAAc,GAAG;AACzC,CAAC"}

package/dist/{dokploy-lwmH05zr.cjs → dokploy-Ce_VTytN.cjs}

@@ -1,5 +1,5 @@
 const require_define = require("./define-DzRz8FgH.cjs");
-const require_engine = require("./engine-Cry1vwMz.cjs");
+const require_engine = require("./engine-DL2-PW6m.cjs");
 //#region src/target/dokploy/index.ts
 /**
 * The built-in `dokploy` target: the Dokploy engine `gkm deploy` has always
@@ -35,4 +35,4 @@ const dokployTarget = require_define.defineTarget({
 //#endregion
 exports.dokployTarget = dokployTarget;
 
-//# sourceMappingURL=dokploy-lwmH05zr.cjs.map
+//# sourceMappingURL=dokploy-Ce_VTytN.cjs.map

package/dist/{dokploy-lwmH05zr.cjs.map → dokploy-Ce_VTytN.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"dokploy-lwmH05zr.cjs","names":["defineTarget","validateDokploy","planDokploy","provisionDokploy","releaseDokploy","verifyDokploy","rollbackDokploy","dokployResult"],"sources":["../src/target/dokploy/index.ts"],"sourcesContent":["/**\n * The built-in `dokploy` target: the Dokploy engine `gkm deploy` has always\n * run, behind the phases.\n *\n * - `provision`: the project, environment and registry, and what the\n *   manifest declares — its databases' roles applied over a port published\n *   for the purpose.\n * - `release`: the stage's migrations, then each image built and pushed\n *   beside its application and deployed, waited on until Dokploy has\n *   finished; backends first and checked before any site is released.\n * - `verify`: each site answering its health check.\n * - `rollback`: what failed — or, `--atomic`, everything the run released —\n *   pointed back at the image it ran before.\n */\n\nimport { defineTarget } from '../define';\nimport {\n\ttype DokployRun,\n\tdokployResult,\n\tplanDokploy,\n\tprovisionDokploy,\n\treleaseDokploy,\n\trollbackDokploy,\n\tvalidateDokploy,\n\tverifyDokploy,\n} from './engine';\n\nexport const dokployTarget = defineTarget<undefined, DokployRun>({\n\tname: 'dokploy',\n\truntime: 'server',\n\tcapabilities: { rollback: true, migrations: 'target', images: true },\n\tcredentials: ['dokploy', 'registry'],\n\tvalidate: (ctx) => validateDokploy(ctx),\n\tplan: (_ctx, run) => planDokploy(run),\n\tprovision: (_ctx, run) => provisionDokploy(run),\n\trelease: (_ctx, run) => releaseDokploy(run),\n\tverify: (_ctx, run) => verifyDokploy(run),\n\trollback: (_ctx, run, failure) => rollbackDokploy(run, failure),\n\tresult: (_ctx, run) => dokployResult(run),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,MAAa,gBAAgBA,eAAAA,aAAoC;CAChE,MAAM;CACN,SAAS;CACT,cAAc;EAAE,UAAU;EAAM,YAAY;EAAU,QAAQ;CAAK;CACnE,aAAa,CAAC,WAAW,UAAU;CACnC,WAAW,QAAQC,eAAAA,gBAAgB,GAAG;CACtC,OAAO,MAAM,QAAQC,eAAAA,YAAY,GAAG;CACpC,YAAY,MAAM,QAAQC,eAAAA,iBAAiB,GAAG;CAC9C,UAAU,MAAM,QAAQC,eAAAA,eAAe,GAAG;CAC1C,SAAS,MAAM,QAAQC,eAAAA,cAAc,GAAG;CACxC,WAAW,MAAM,KAAK,YAAYC,eAAAA,gBAAgB,KAAK,OAAO;CAC9D,SAAS,MAAM,QAAQC,eAAAA,cAAc,GAAG;AACzC,CAAC"}
+{"version":3,"file":"dokploy-Ce_VTytN.cjs","names":["defineTarget","validateDokploy","planDokploy","provisionDokploy","releaseDokploy","verifyDokploy","rollbackDokploy","dokployResult"],"sources":["../src/target/dokploy/index.ts"],"sourcesContent":["/**\n * The built-in `dokploy` target: the Dokploy engine `gkm deploy` has always\n * run, behind the phases.\n *\n * - `provision`: the project, environment and registry, and what the\n *   manifest declares — its databases' roles applied over a port published\n *   for the purpose.\n * - `release`: the stage's migrations, then each image built and pushed\n *   beside its application and deployed, waited on until Dokploy has\n *   finished; backends first and checked before any site is released.\n * - `verify`: each site answering its health check.\n * - `rollback`: what failed — or, `--atomic`, everything the run released —\n *   pointed back at the image it ran before.\n */\n\nimport { defineTarget } from '../define';\nimport {\n\ttype DokployRun,\n\tdokployResult,\n\tplanDokploy,\n\tprovisionDokploy,\n\treleaseDokploy,\n\trollbackDokploy,\n\tvalidateDokploy,\n\tverifyDokploy,\n} from './engine';\n\nexport const dokployTarget = defineTarget<undefined, DokployRun>({\n\tname: 'dokploy',\n\truntime: 'server',\n\tcapabilities: { rollback: true, migrations: 'target', images: true },\n\tcredentials: ['dokploy', 'registry'],\n\tvalidate: (ctx) => validateDokploy(ctx),\n\tplan: (_ctx, run) => planDokploy(run),\n\tprovision: (_ctx, run) => provisionDokploy(run),\n\trelease: (_ctx, run) => releaseDokploy(run),\n\tverify: (_ctx, run) => verifyDokploy(run),\n\trollback: (_ctx, run, failure) => rollbackDokploy(run, failure),\n\tresult: (_ctx, run) => dokployResult(run),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,MAAa,gBAAgBA,eAAAA,aAAoC;CAChE,MAAM;CACN,SAAS;CACT,cAAc;EAAE,UAAU;EAAM,YAAY;EAAU,QAAQ;CAAK;CACnE,aAAa,CAAC,WAAW,UAAU;CACnC,WAAW,QAAQC,eAAAA,gBAAgB,GAAG;CACtC,OAAO,MAAM,QAAQC,eAAAA,YAAY,GAAG;CACpC,YAAY,MAAM,QAAQC,eAAAA,iBAAiB,GAAG;CAC9C,UAAU,MAAM,QAAQC,eAAAA,eAAe,GAAG;CAC1C,SAAS,MAAM,QAAQC,eAAAA,cAAc,GAAG;CACxC,WAAW,MAAM,KAAK,YAAYC,eAAAA,gBAAgB,KAAK,OAAO;CAC9D,SAAS,MAAM,QAAQC,eAAAA,cAAc,GAAG;AACzC,CAAC"}

package/dist/{encryption-D05sNwED.cjs → encryption-CDGRdcMr.cjs}

@@ -1,6 +1,6 @@
 const require_workspace = require("./workspace-vdrcRI-m.cjs");
 const require_config = require("./config.cjs");
-const require_state = require("./state-CCuTJNRH.cjs");
+const require_state = require("./state-DMjFPOhf.cjs");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
 //#region src/encryption/index.ts
@@ -86,4 +86,4 @@ async function updateKeyring(construct, { stage }, context, update) {
 exports.encryptionRetireCommand = encryptionRetireCommand;
 exports.encryptionRotateCommand = encryptionRotateCommand;
 
-//# sourceMappingURL=encryption-D05sNwED.cjs.map
+//# sourceMappingURL=encryption-CDGRdcMr.cjs.map

package/dist/{encryption-D05sNwED.cjs.map → encryption-CDGRdcMr.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"encryption-D05sNwED.cjs","names":["rotateKeyring","parseKeyring","retireKey","loadWorkspaceSettings","canonicalId","providerOf","secretsStoreFor","provideKey","withCustomSecret"],"sources":["../src/encryption/index.ts"],"sourcesContent":["/**\n * `gkm encryption:rotate` and `gkm encryption:retire` — the keyring of an\n * `Encryption` construct on a server stage.\n *\n * Rotating adds a key in front and keeps every older one, so what they wrote\n * still opens. Retiring removes one, and is the half that makes rotating worth\n * doing: until a key is gone, it still opens everything it ever wrote. It is\n * never automatic, because the only thing that knows nothing is left under a\n * key is the sweep that re-encrypted the column — so it is done after one,\n * deliberately, by name.\n *\n * Neither applies everywhere, and each says so rather than doing something\n * that looks right: a local stage's keyring is derived and would be replaced on\n * the next `gkm dev`, and on AWS the key is KMS's, which rotates it itself and\n * never strands a value.\n */\n\nimport {\n\tparseKeyring,\n\tretireKey,\n\trotateKeyring,\n} from '@geekmidas/constructs/encryption';\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\nimport { loadWorkspaceSettings } from '../config';\nimport { withCustomSecret } from '../secrets/storage.js';\nimport { type SecretsStore, secretsStoreFor } from '../secrets/store.js';\nimport { providerOf } from '../workspace/backends.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\nconst logger = console;\n\nexport class LocalKeyringIsDerived extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' is the local stage, where ${construct}'s keyring is derived from the project and stage — nothing stored there would be read. Rotate a deployed stage: gkm encryption:rotate ${construct} --stage <stage>.`,\n\t\t);\n\t\tthis.name = 'LocalKeyringIsDerived';\n\t}\n}\n\nexport class KmsRotatesItself extends Error {\n\tconstructor(readonly construct: string) {\n\t\tsuper(\n\t\t\t`${construct} is a KMS key on AWS: KMS rotates it yearly and keeps every version, so no value is ever stranded and there is no key to retire. Nothing to do here.`,\n\t\t);\n\t\tthis.name = 'KmsRotatesItself';\n\t}\n}\n\nexport class NoKeyringYet extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t\treadonly key: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' has no ${key} yet. The first deploy generates ${construct}'s keyring: gkm deploy --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'NoKeyringYet';\n\t}\n}\n\nexport interface EncryptionCommandOptions {\n\tstage: string;\n}\n\n/** Where a command reads and writes; the real ones unless a test says. */\nexport interface EncryptionCommandContext {\n\tworkspace?: NormalizedWorkspace;\n\tstore?: SecretsStore;\n}\n\nexport async function encryptionRotateCommand(\n\tconstruct: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = rotateKeyring(id, url);\n\t\tconst [current, ...older] = parseKeyring(id, next).keys.map(({ id }) => id);\n\n\t\tlogger.log(`\\n✓ ${id} on '${options.stage}' now writes with '${current}'.`);\n\t\tlogger.log(\n\t\t\t`  Still opening: ${older.join(', ')}. Redeploy to start writing with '${current}', reencrypt what is stored, then: gkm encryption:retire ${id} <key> --stage ${options.stage}`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nexport async function encryptionRetireCommand(\n\tconstruct: string,\n\tkeyId: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = retireKey(id, url, keyId);\n\n\t\tlogger.log(\n\t\t\t`\\n✓ ${id} on '${options.stage}' no longer holds '${keyId}'. Anything still under it cannot be read after the next deploy.`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nasync function updateKeyring(\n\tconstruct: string,\n\t{ stage }: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext,\n\tupdate: (id: string, url: string) => string,\n): Promise<string> {\n\tconst workspace = context.workspace ?? (await loadWorkspaceSettings());\n\tconst id = canonicalId(construct);\n\n\tif (stage === workspace.stages.local) {\n\t\tthrow new LocalKeyringIsDerived(id, stage);\n\t}\n\tassertDeployedStage(workspace.stages, stage);\n\tif (providerOf(workspace) === 'aws') throw new KmsRotatesItself(id);\n\n\tconst store = context.store ?? (await secretsStoreFor(workspace, stage));\n\tconst key = provideKey(id, 'url');\n\tconst secrets = await store.read(stage);\n\tconst url = secrets?.custom[key];\n\tif (!secrets || !url) throw new NoKeyringYet(id, stage, key);\n\n\tconst next = update(id, url);\n\tawait store.write(stage, withCustomSecret(secrets, key, next));\n\treturn next;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,SAAS;AAEf,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,WACA,OACC;EACD,MACC,IAAI,MAAM,8BAA8B,UAAU,wIAAwI,UAAU,kBACrM;EALS,KAAA,YAAA;EACA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,MAAM;CACtB;CAArB,YAAY,WAA4B;EACvC,MACC,GAAG,UAAU,qJACd;EAHoB,KAAA,YAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,IAAa,eAAb,cAAkC,MAAM;CAE7B;CACA;CACA;CAHV,YACC,WACA,OACA,KACC;EACD,MACC,IAAI,MAAM,WAAW,IAAI,mCAAmC,UAAU,iCAAiC,MAAM,EAC9G;EANS,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,MAAA;EAKT,KAAK,OAAO;CACb;AACD;AAYA,eAAsB,wBACrB,WACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,QAAA,GAAOA,iCAAAA,cAAAA,CAAc,IAAI,GAAG;EAClC,MAAM,CAAC,SAAS,GAAG,UAAA,GAASC,iCAAAA,aAAAA,CAAa,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,SAAS,EAAE;EAE1E,OAAO,IAAI,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,QAAQ,GAAG;EAC1E,OAAO,IACN,oBAAoB,MAAM,KAAK,IAAI,EAAE,oCAAoC,QAAQ,2DAA2D,GAAG,iBAAiB,QAAQ,OACzK;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAsB,wBACrB,WACA,OACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,QAAA,GAAOC,iCAAAA,UAAAA,CAAU,IAAI,KAAK,KAAK;EAErC,OAAO,IACN,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,MAAM,iEAC3D;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAe,cACd,WACA,EAAE,SACF,SACA,QACkB;CAClB,MAAM,YAAY,QAAQ,aAAc,MAAMC,eAAAA,sBAAsB;CACpE,MAAM,MAAA,GAAKC,oBAAAA,YAAAA,CAAY,SAAS;CAEhC,IAAI,UAAU,UAAU,OAAO,OAC9B,MAAM,IAAI,sBAAsB,IAAI,KAAK;CAE1C,kBAAA,oBAAoB,UAAU,QAAQ,KAAK;CAC3C,IAAIC,cAAAA,WAAW,SAAS,MAAM,OAAO,MAAM,IAAI,iBAAiB,EAAE;CAElE,MAAM,QAAQ,QAAQ,SAAU,MAAMC,cAAAA,gBAAgB,WAAW,KAAK;CACtE,MAAM,OAAA,GAAMC,oBAAAA,WAAAA,CAAW,IAAI,KAAK;CAChC,MAAM,UAAU,MAAM,MAAM,KAAK,KAAK;CACtC,MAAM,MAAM,SAAS,OAAO;CAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,GAAG;CAE3D,MAAM,OAAO,OAAO,IAAI,GAAG;CAC3B,MAAM,MAAM,MAAM,OAAOC,cAAAA,iBAAiB,SAAS,KAAK,IAAI,CAAC;CAC7D,OAAO;AACR"}
+{"version":3,"file":"encryption-CDGRdcMr.cjs","names":["rotateKeyring","parseKeyring","retireKey","loadWorkspaceSettings","canonicalId","providerOf","secretsStoreFor","provideKey","withCustomSecret"],"sources":["../src/encryption/index.ts"],"sourcesContent":["/**\n * `gkm encryption:rotate` and `gkm encryption:retire` — the keyring of an\n * `Encryption` construct on a server stage.\n *\n * Rotating adds a key in front and keeps every older one, so what they wrote\n * still opens. Retiring removes one, and is the half that makes rotating worth\n * doing: until a key is gone, it still opens everything it ever wrote. It is\n * never automatic, because the only thing that knows nothing is left under a\n * key is the sweep that re-encrypted the column — so it is done after one,\n * deliberately, by name.\n *\n * Neither applies everywhere, and each says so rather than doing something\n * that looks right: a local stage's keyring is derived and would be replaced on\n * the next `gkm dev`, and on AWS the key is KMS's, which rotates it itself and\n * never strands a value.\n */\n\nimport {\n\tparseKeyring,\n\tretireKey,\n\trotateKeyring,\n} from '@geekmidas/constructs/encryption';\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\nimport { loadWorkspaceSettings } from '../config';\nimport { withCustomSecret } from '../secrets/storage.js';\nimport { type SecretsStore, secretsStoreFor } from '../secrets/store.js';\nimport { providerOf } from '../workspace/backends.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\nconst logger = console;\n\nexport class LocalKeyringIsDerived extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' is the local stage, where ${construct}'s keyring is derived from the project and stage — nothing stored there would be read. Rotate a deployed stage: gkm encryption:rotate ${construct} --stage <stage>.`,\n\t\t);\n\t\tthis.name = 'LocalKeyringIsDerived';\n\t}\n}\n\nexport class KmsRotatesItself extends Error {\n\tconstructor(readonly construct: string) {\n\t\tsuper(\n\t\t\t`${construct} is a KMS key on AWS: KMS rotates it yearly and keeps every version, so no value is ever stranded and there is no key to retire. Nothing to do here.`,\n\t\t);\n\t\tthis.name = 'KmsRotatesItself';\n\t}\n}\n\nexport class NoKeyringYet extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t\treadonly key: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' has no ${key} yet. The first deploy generates ${construct}'s keyring: gkm deploy --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'NoKeyringYet';\n\t}\n}\n\nexport interface EncryptionCommandOptions {\n\tstage: string;\n}\n\n/** Where a command reads and writes; the real ones unless a test says. */\nexport interface EncryptionCommandContext {\n\tworkspace?: NormalizedWorkspace;\n\tstore?: SecretsStore;\n}\n\nexport async function encryptionRotateCommand(\n\tconstruct: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = rotateKeyring(id, url);\n\t\tconst [current, ...older] = parseKeyring(id, next).keys.map(({ id }) => id);\n\n\t\tlogger.log(`\\n✓ ${id} on '${options.stage}' now writes with '${current}'.`);\n\t\tlogger.log(\n\t\t\t`  Still opening: ${older.join(', ')}. Redeploy to start writing with '${current}', reencrypt what is stored, then: gkm encryption:retire ${id} <key> --stage ${options.stage}`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nexport async function encryptionRetireCommand(\n\tconstruct: string,\n\tkeyId: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = retireKey(id, url, keyId);\n\n\t\tlogger.log(\n\t\t\t`\\n✓ ${id} on '${options.stage}' no longer holds '${keyId}'. Anything still under it cannot be read after the next deploy.`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nasync function updateKeyring(\n\tconstruct: string,\n\t{ stage }: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext,\n\tupdate: (id: string, url: string) => string,\n): Promise<string> {\n\tconst workspace = context.workspace ?? (await loadWorkspaceSettings());\n\tconst id = canonicalId(construct);\n\n\tif (stage === workspace.stages.local) {\n\t\tthrow new LocalKeyringIsDerived(id, stage);\n\t}\n\tassertDeployedStage(workspace.stages, stage);\n\tif (providerOf(workspace) === 'aws') throw new KmsRotatesItself(id);\n\n\tconst store = context.store ?? (await secretsStoreFor(workspace, stage));\n\tconst key = provideKey(id, 'url');\n\tconst secrets = await store.read(stage);\n\tconst url = secrets?.custom[key];\n\tif (!secrets || !url) throw new NoKeyringYet(id, stage, key);\n\n\tconst next = update(id, url);\n\tawait store.write(stage, withCustomSecret(secrets, key, next));\n\treturn next;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,SAAS;AAEf,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,WACA,OACC;EACD,MACC,IAAI,MAAM,8BAA8B,UAAU,wIAAwI,UAAU,kBACrM;EALS,KAAA,YAAA;EACA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,MAAM;CACtB;CAArB,YAAY,WAA4B;EACvC,MACC,GAAG,UAAU,qJACd;EAHoB,KAAA,YAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,IAAa,eAAb,cAAkC,MAAM;CAE7B;CACA;CACA;CAHV,YACC,WACA,OACA,KACC;EACD,MACC,IAAI,MAAM,WAAW,IAAI,mCAAmC,UAAU,iCAAiC,MAAM,EAC9G;EANS,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,MAAA;EAKT,KAAK,OAAO;CACb;AACD;AAYA,eAAsB,wBACrB,WACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,QAAA,GAAOA,iCAAAA,cAAAA,CAAc,IAAI,GAAG;EAClC,MAAM,CAAC,SAAS,GAAG,UAAA,GAASC,iCAAAA,aAAAA,CAAa,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,SAAS,EAAE;EAE1E,OAAO,IAAI,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,QAAQ,GAAG;EAC1E,OAAO,IACN,oBAAoB,MAAM,KAAK,IAAI,EAAE,oCAAoC,QAAQ,2DAA2D,GAAG,iBAAiB,QAAQ,OACzK;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAsB,wBACrB,WACA,OACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,QAAA,GAAOC,iCAAAA,UAAAA,CAAU,IAAI,KAAK,KAAK;EAErC,OAAO,IACN,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,MAAM,iEAC3D;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAe,cACd,WACA,EAAE,SACF,SACA,QACkB;CAClB,MAAM,YAAY,QAAQ,aAAc,MAAMC,eAAAA,sBAAsB;CACpE,MAAM,MAAA,GAAKC,oBAAAA,YAAAA,CAAY,SAAS;CAEhC,IAAI,UAAU,UAAU,OAAO,OAC9B,MAAM,IAAI,sBAAsB,IAAI,KAAK;CAE1C,kBAAA,oBAAoB,UAAU,QAAQ,KAAK;CAC3C,IAAIC,cAAAA,WAAW,SAAS,MAAM,OAAO,MAAM,IAAI,iBAAiB,EAAE;CAElE,MAAM,QAAQ,QAAQ,SAAU,MAAMC,cAAAA,gBAAgB,WAAW,KAAK;CACtE,MAAM,OAAA,GAAMC,oBAAAA,WAAAA,CAAW,IAAI,KAAK;CAChC,MAAM,UAAU,MAAM,MAAM,KAAK,KAAK;CACtC,MAAM,MAAM,SAAS,OAAO;CAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,GAAG;CAE3D,MAAM,OAAO,OAAO,IAAI,GAAG;CAC3B,MAAM,MAAM,MAAM,OAAOC,cAAAA,iBAAiB,SAAS,KAAK,IAAI,CAAC;CAC7D,OAAO;AACR"}

package/dist/{encryption-DcrxWl1s.mjs → encryption-CmfPICSN.mjs}

@@ -1,6 +1,6 @@
 import { k as assertDeployedStage } from "./workspace-C7NqCsQF.mjs";
 import { loadWorkspaceSettings } from "./config.mjs";
-import { It as secretsStoreFor, tn as withCustomSecret, xt as providerOf } from "./state-BJFherj1.mjs";
+import { Kt as secretsStoreFor, dn as withCustomSecret, jt as providerOf } from "./state-DtS2HEfi.mjs";
 import { canonicalId, provideKey } from "@geekmidas/manifest";
 import { parseKeyring, retireKey, rotateKeyring } from "@geekmidas/constructs/encryption";
 //#region src/encryption/index.ts
@@ -85,4 +85,4 @@ async function updateKeyring(construct, { stage }, context, update) {
 //#endregion
 export { encryptionRetireCommand, encryptionRotateCommand };
 
-//# sourceMappingURL=encryption-DcrxWl1s.mjs.map
+//# sourceMappingURL=encryption-CmfPICSN.mjs.map

package/dist/{encryption-DcrxWl1s.mjs.map → encryption-CmfPICSN.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"encryption-DcrxWl1s.mjs","names":[],"sources":["../src/encryption/index.ts"],"sourcesContent":["/**\n * `gkm encryption:rotate` and `gkm encryption:retire` — the keyring of an\n * `Encryption` construct on a server stage.\n *\n * Rotating adds a key in front and keeps every older one, so what they wrote\n * still opens. Retiring removes one, and is the half that makes rotating worth\n * doing: until a key is gone, it still opens everything it ever wrote. It is\n * never automatic, because the only thing that knows nothing is left under a\n * key is the sweep that re-encrypted the column — so it is done after one,\n * deliberately, by name.\n *\n * Neither applies everywhere, and each says so rather than doing something\n * that looks right: a local stage's keyring is derived and would be replaced on\n * the next `gkm dev`, and on AWS the key is KMS's, which rotates it itself and\n * never strands a value.\n */\n\nimport {\n\tparseKeyring,\n\tretireKey,\n\trotateKeyring,\n} from '@geekmidas/constructs/encryption';\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\nimport { loadWorkspaceSettings } from '../config';\nimport { withCustomSecret } from '../secrets/storage.js';\nimport { type SecretsStore, secretsStoreFor } from '../secrets/store.js';\nimport { providerOf } from '../workspace/backends.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\nconst logger = console;\n\nexport class LocalKeyringIsDerived extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' is the local stage, where ${construct}'s keyring is derived from the project and stage — nothing stored there would be read. Rotate a deployed stage: gkm encryption:rotate ${construct} --stage <stage>.`,\n\t\t);\n\t\tthis.name = 'LocalKeyringIsDerived';\n\t}\n}\n\nexport class KmsRotatesItself extends Error {\n\tconstructor(readonly construct: string) {\n\t\tsuper(\n\t\t\t`${construct} is a KMS key on AWS: KMS rotates it yearly and keeps every version, so no value is ever stranded and there is no key to retire. Nothing to do here.`,\n\t\t);\n\t\tthis.name = 'KmsRotatesItself';\n\t}\n}\n\nexport class NoKeyringYet extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t\treadonly key: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' has no ${key} yet. The first deploy generates ${construct}'s keyring: gkm deploy --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'NoKeyringYet';\n\t}\n}\n\nexport interface EncryptionCommandOptions {\n\tstage: string;\n}\n\n/** Where a command reads and writes; the real ones unless a test says. */\nexport interface EncryptionCommandContext {\n\tworkspace?: NormalizedWorkspace;\n\tstore?: SecretsStore;\n}\n\nexport async function encryptionRotateCommand(\n\tconstruct: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = rotateKeyring(id, url);\n\t\tconst [current, ...older] = parseKeyring(id, next).keys.map(({ id }) => id);\n\n\t\tlogger.log(`\\n✓ ${id} on '${options.stage}' now writes with '${current}'.`);\n\t\tlogger.log(\n\t\t\t`  Still opening: ${older.join(', ')}. Redeploy to start writing with '${current}', reencrypt what is stored, then: gkm encryption:retire ${id} <key> --stage ${options.stage}`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nexport async function encryptionRetireCommand(\n\tconstruct: string,\n\tkeyId: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = retireKey(id, url, keyId);\n\n\t\tlogger.log(\n\t\t\t`\\n✓ ${id} on '${options.stage}' no longer holds '${keyId}'. Anything still under it cannot be read after the next deploy.`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nasync function updateKeyring(\n\tconstruct: string,\n\t{ stage }: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext,\n\tupdate: (id: string, url: string) => string,\n): Promise<string> {\n\tconst workspace = context.workspace ?? (await loadWorkspaceSettings());\n\tconst id = canonicalId(construct);\n\n\tif (stage === workspace.stages.local) {\n\t\tthrow new LocalKeyringIsDerived(id, stage);\n\t}\n\tassertDeployedStage(workspace.stages, stage);\n\tif (providerOf(workspace) === 'aws') throw new KmsRotatesItself(id);\n\n\tconst store = context.store ?? (await secretsStoreFor(workspace, stage));\n\tconst key = provideKey(id, 'url');\n\tconst secrets = await store.read(stage);\n\tconst url = secrets?.custom[key];\n\tif (!secrets || !url) throw new NoKeyringYet(id, stage, key);\n\n\tconst next = update(id, url);\n\tawait store.write(stage, withCustomSecret(secrets, key, next));\n\treturn next;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,SAAS;AAEf,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,WACA,OACC;EACD,MACC,IAAI,MAAM,8BAA8B,UAAU,wIAAwI,UAAU,kBACrM;EALS,KAAA,YAAA;EACA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,MAAM;CACtB;CAArB,YAAY,WAA4B;EACvC,MACC,GAAG,UAAU,qJACd;EAHoB,KAAA,YAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,IAAa,eAAb,cAAkC,MAAM;CAE7B;CACA;CACA;CAHV,YACC,WACA,OACA,KACC;EACD,MACC,IAAI,MAAM,WAAW,IAAI,mCAAmC,UAAU,iCAAiC,MAAM,EAC9G;EANS,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,MAAA;EAKT,KAAK,OAAO;CACb;AACD;AAYA,eAAsB,wBACrB,WACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,OAAO,cAAc,IAAI,GAAG;EAClC,MAAM,CAAC,SAAS,GAAG,SAAS,aAAa,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,SAAS,EAAE;EAE1E,OAAO,IAAI,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,QAAQ,GAAG;EAC1E,OAAO,IACN,oBAAoB,MAAM,KAAK,IAAI,EAAE,oCAAoC,QAAQ,2DAA2D,GAAG,iBAAiB,QAAQ,OACzK;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAsB,wBACrB,WACA,OACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,OAAO,UAAU,IAAI,KAAK,KAAK;EAErC,OAAO,IACN,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,MAAM,iEAC3D;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAe,cACd,WACA,EAAE,SACF,SACA,QACkB;CAClB,MAAM,YAAY,QAAQ,aAAc,MAAM,sBAAsB;CACpE,MAAM,KAAK,YAAY,SAAS;CAEhC,IAAI,UAAU,UAAU,OAAO,OAC9B,MAAM,IAAI,sBAAsB,IAAI,KAAK;CAE1C,oBAAoB,UAAU,QAAQ,KAAK;CAC3C,IAAI,WAAW,SAAS,MAAM,OAAO,MAAM,IAAI,iBAAiB,EAAE;CAElE,MAAM,QAAQ,QAAQ,SAAU,MAAM,gBAAgB,WAAW,KAAK;CACtE,MAAM,MAAM,WAAW,IAAI,KAAK;CAChC,MAAM,UAAU,MAAM,MAAM,KAAK,KAAK;CACtC,MAAM,MAAM,SAAS,OAAO;CAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,GAAG;CAE3D,MAAM,OAAO,OAAO,IAAI,GAAG;CAC3B,MAAM,MAAM,MAAM,OAAO,iBAAiB,SAAS,KAAK,IAAI,CAAC;CAC7D,OAAO;AACR"}
+{"version":3,"file":"encryption-CmfPICSN.mjs","names":[],"sources":["../src/encryption/index.ts"],"sourcesContent":["/**\n * `gkm encryption:rotate` and `gkm encryption:retire` — the keyring of an\n * `Encryption` construct on a server stage.\n *\n * Rotating adds a key in front and keeps every older one, so what they wrote\n * still opens. Retiring removes one, and is the half that makes rotating worth\n * doing: until a key is gone, it still opens everything it ever wrote. It is\n * never automatic, because the only thing that knows nothing is left under a\n * key is the sweep that re-encrypted the column — so it is done after one,\n * deliberately, by name.\n *\n * Neither applies everywhere, and each says so rather than doing something\n * that looks right: a local stage's keyring is derived and would be replaced on\n * the next `gkm dev`, and on AWS the key is KMS's, which rotates it itself and\n * never strands a value.\n */\n\nimport {\n\tparseKeyring,\n\tretireKey,\n\trotateKeyring,\n} from '@geekmidas/constructs/encryption';\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\nimport { loadWorkspaceSettings } from '../config';\nimport { withCustomSecret } from '../secrets/storage.js';\nimport { type SecretsStore, secretsStoreFor } from '../secrets/store.js';\nimport { providerOf } from '../workspace/backends.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\nconst logger = console;\n\nexport class LocalKeyringIsDerived extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' is the local stage, where ${construct}'s keyring is derived from the project and stage — nothing stored there would be read. Rotate a deployed stage: gkm encryption:rotate ${construct} --stage <stage>.`,\n\t\t);\n\t\tthis.name = 'LocalKeyringIsDerived';\n\t}\n}\n\nexport class KmsRotatesItself extends Error {\n\tconstructor(readonly construct: string) {\n\t\tsuper(\n\t\t\t`${construct} is a KMS key on AWS: KMS rotates it yearly and keeps every version, so no value is ever stranded and there is no key to retire. Nothing to do here.`,\n\t\t);\n\t\tthis.name = 'KmsRotatesItself';\n\t}\n}\n\nexport class NoKeyringYet extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t\treadonly key: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' has no ${key} yet. The first deploy generates ${construct}'s keyring: gkm deploy --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'NoKeyringYet';\n\t}\n}\n\nexport interface EncryptionCommandOptions {\n\tstage: string;\n}\n\n/** Where a command reads and writes; the real ones unless a test says. */\nexport interface EncryptionCommandContext {\n\tworkspace?: NormalizedWorkspace;\n\tstore?: SecretsStore;\n}\n\nexport async function encryptionRotateCommand(\n\tconstruct: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = rotateKeyring(id, url);\n\t\tconst [current, ...older] = parseKeyring(id, next).keys.map(({ id }) => id);\n\n\t\tlogger.log(`\\n✓ ${id} on '${options.stage}' now writes with '${current}'.`);\n\t\tlogger.log(\n\t\t\t`  Still opening: ${older.join(', ')}. Redeploy to start writing with '${current}', reencrypt what is stored, then: gkm encryption:retire ${id} <key> --stage ${options.stage}`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nexport async function encryptionRetireCommand(\n\tconstruct: string,\n\tkeyId: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = retireKey(id, url, keyId);\n\n\t\tlogger.log(\n\t\t\t`\\n✓ ${id} on '${options.stage}' no longer holds '${keyId}'. Anything still under it cannot be read after the next deploy.`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nasync function updateKeyring(\n\tconstruct: string,\n\t{ stage }: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext,\n\tupdate: (id: string, url: string) => string,\n): Promise<string> {\n\tconst workspace = context.workspace ?? (await loadWorkspaceSettings());\n\tconst id = canonicalId(construct);\n\n\tif (stage === workspace.stages.local) {\n\t\tthrow new LocalKeyringIsDerived(id, stage);\n\t}\n\tassertDeployedStage(workspace.stages, stage);\n\tif (providerOf(workspace) === 'aws') throw new KmsRotatesItself(id);\n\n\tconst store = context.store ?? (await secretsStoreFor(workspace, stage));\n\tconst key = provideKey(id, 'url');\n\tconst secrets = await store.read(stage);\n\tconst url = secrets?.custom[key];\n\tif (!secrets || !url) throw new NoKeyringYet(id, stage, key);\n\n\tconst next = update(id, url);\n\tawait store.write(stage, withCustomSecret(secrets, key, next));\n\treturn next;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,SAAS;AAEf,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,WACA,OACC;EACD,MACC,IAAI,MAAM,8BAA8B,UAAU,wIAAwI,UAAU,kBACrM;EALS,KAAA,YAAA;EACA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,MAAM;CACtB;CAArB,YAAY,WAA4B;EACvC,MACC,GAAG,UAAU,qJACd;EAHoB,KAAA,YAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,IAAa,eAAb,cAAkC,MAAM;CAE7B;CACA;CACA;CAHV,YACC,WACA,OACA,KACC;EACD,MACC,IAAI,MAAM,WAAW,IAAI,mCAAmC,UAAU,iCAAiC,MAAM,EAC9G;EANS,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,MAAA;EAKT,KAAK,OAAO;CACb;AACD;AAYA,eAAsB,wBACrB,WACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,OAAO,cAAc,IAAI,GAAG;EAClC,MAAM,CAAC,SAAS,GAAG,SAAS,aAAa,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,SAAS,EAAE;EAE1E,OAAO,IAAI,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,QAAQ,GAAG;EAC1E,OAAO,IACN,oBAAoB,MAAM,KAAK,IAAI,EAAE,oCAAoC,QAAQ,2DAA2D,GAAG,iBAAiB,QAAQ,OACzK;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAsB,wBACrB,WACA,OACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,OAAO,UAAU,IAAI,KAAK,KAAK;EAErC,OAAO,IACN,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,MAAM,iEAC3D;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAe,cACd,WACA,EAAE,SACF,SACA,QACkB;CAClB,MAAM,YAAY,QAAQ,aAAc,MAAM,sBAAsB;CACpE,MAAM,KAAK,YAAY,SAAS;CAEhC,IAAI,UAAU,UAAU,OAAO,OAC9B,MAAM,IAAI,sBAAsB,IAAI,KAAK;CAE1C,oBAAoB,UAAU,QAAQ,KAAK;CAC3C,IAAI,WAAW,SAAS,MAAM,OAAO,MAAM,IAAI,iBAAiB,EAAE;CAElE,MAAM,QAAQ,QAAQ,SAAU,MAAM,gBAAgB,WAAW,KAAK;CACtE,MAAM,MAAM,WAAW,IAAI,KAAK;CAChC,MAAM,UAAU,MAAM,MAAM,KAAK,KAAK;CACtC,MAAM,MAAM,SAAS,OAAO;CAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,GAAG;CAE3D,MAAM,OAAO,OAAO,IAAI,GAAG;CAC3B,MAAM,MAAM,MAAM,OAAO,iBAAiB,SAAS,KAAK,IAAI,CAAC;CAC7D,OAAO;AACR"}

package/dist/{engine-DmQS3XHX.mjs → engine-B37qBO5W.mjs}

@@ -1,13 +1,13 @@
 import { i as LocalSandbox, t as MissingCredential } from "./credentials-pAtB70k3.mjs";
 import { a as discriminatedUnion, c as looseObject, f as string, n as array, s as literal, u as object } from "./schemas-D-xeKJDD.mjs";
-import { c as runWorker, d as output, r as discover } from "./discover-Buwf1z4P.mjs";
+import { c as runWorker, d as output, r as discover } from "./discover-BPelzeGW.mjs";
 import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-C7NqCsQF.mjs";
-import { $ as applyPostgres, A as STORAGE_KEY_PAIR, B as encryptSecrets, C as isMainFrontendApp, E as otelEnv, F as manifestServiceDeclarations, G as constructGlobs, Gt as imageName, Jt as markerOf, Kt as imageRef, L as reportDevServices, M as assertExternalServices, N as devServicesUsed, P as externalServices, St as storageBackendFor, Ut as applicationName, Xt as projectName, Yt as ownershipMarker, Zt as initStageSecrets, _ as deployDocker, a as recordRelease, bt as eventsBackendFor, c as setBackupState, d as setGeneratedSecret, en as toEmbeddableSecrets, f as setPostgresBackupId, ft as resourceName, i as isDnsVerified, k as ExternalServicesNotConfigured, l as setDnsRecord, m as withGeneratedSecrets, n as getBackupState, o as recordRollback, p as DeployJournal, qt as isOwnedBy, r as getGeneratedSecret, s as setApplicationId, t as createEmptyState, u as setDnsVerification, w as resolveHost, xt as providerOf, yt as cacheBackendFor } from "./state-BJFherj1.mjs";
-import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError } from "./sniffer-vAXsU_4G.mjs";
+import { $ as constructGlobs, $t as applicationName, At as eventsBackendFor, E as resolveHost, Et as WORKER_PORT, F as devServicesUsed, H as workerUnits, I as externalServices, L as manifestServiceDeclarations, M as STORAGE_KEY_PAIR, Mt as storageBackendFor, O as otelEnv, P as assertExternalServices, S as workerDockerfileOf, T as isMainFrontendApp, U as encryptSecrets, _ as deployDocker, _t as workerEnvKeys, a as recordRelease, an as ownershipMarker, c as setBackupState, d as setGeneratedSecret, f as setPostgresBackupId, i as isDnsVerified, in as markerOf, j as ExternalServicesNotConfigured, jt as providerOf, kt as cacheBackendFor, l as setDnsRecord, m as withGeneratedSecrets, n as getBackupState, nn as imageRef, o as recordRollback, on as projectName, p as DeployJournal, r as getGeneratedSecret, rn as isOwnedBy, s as setApplicationId, sn as initStageSecrets, st as applyPostgres, t as createEmptyState, tn as imageName, u as setDnsVerification, un as toEmbeddableSecrets, xt as resourceName, z as reportDevServices } from "./state-DtS2HEfi.mjs";
+import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError } from "./sniffer-BFmdZpZ2.mjs";
 import { o as migrationFiles } from "./provider-D7rQzzzf.mjs";
-import { n as assertStageCredentials } from "./credentialSchemas-BmYxnEz_.mjs";
+import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
 import { join } from "node:path";
 import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, migrationTargets, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
 import { createHash, randomBytes } from "node:crypto";
@@ -2102,9 +2102,15 @@ async function validateDokploy(phase) {
 		stage,
 		supplied: stored?.custom ?? {}
 	});
+	const runnables = phase.runnables ?? {};
+	const background = phase.background ?? {};
+	const workers = workerUnits(workspace, phase.manifest, background).filter((worker) => appsToDeployNames.includes(worker.app));
+	if (workers.length > 0) logger.log(`   Deploying workers: ${workers.map((w) => `${w.name} (from ${w.app})`).join(", ")}`);
 	return {
 		...run,
 		allowDevServices: phase.allowDevServices,
+		workers,
+		runnables,
 		preflight: await preflight(run),
 		verify: verifySettings(workspace.deploy.dokploy?.verify),
 		atomic: phase.atomic,
@@ -2428,7 +2434,6 @@ async function releaseDokploy(run) {
 	* release, with what ran before it as the one a rollback restores.
 	*/
 	const release = async (appName, applicationId, image, envVars, host) => {
-		const app = workspace.apps[appName];
 		released.applicationIds.set(appName, applicationId);
 		const since = await api.latestDeploymentAt(applicationId);
 		const before = state.releases?.[appName]?.current;
@@ -2440,9 +2445,11 @@ async function releaseDokploy(run) {
 		await api.saveApplicationEnv(applicationId, envVars.join("\n"));
 		logger.log(`      Deploying to Dokploy...`);
 		await api.deployApplication(applicationId);
-		const domainId = await ensureDomain(api, journal, host, app.port, applicationId, applied);
-		appHostnames.set(appName, host);
-		if (domainId) appDomainIds.set(appName, domainId);
+		if (host) {
+			const domainId = await ensureDomain(api, journal, host, workspace.apps[appName].port, applicationId, applied);
+			appHostnames.set(appName, host);
+			if (domainId) appDomainIds.set(appName, domainId);
+		}
 		logger.log(`      Waiting for the deployment to finish...`);
 		await api.waitForDeployment(applicationId, {
 			since,
@@ -2455,7 +2462,7 @@ async function releaseDokploy(run) {
 			tag: imageTag
 		});
 		await journal.save();
-		publicUrls[appName] = `https://${host}`;
+		if (host) publicUrls[appName] = `https://${host}`;
 	};
 	const frontendUrls = [];
 	for (const appName of frontendApps) frontendUrls.push(`https://${hostOf(workspace, appName, stage)}`);
@@ -2546,6 +2553,71 @@ async function releaseDokploy(run) {
 			throw new BackendDeployFailed(appName, error);
 		}
 	}
+	if (run.workers.length > 0) {
+		logger.log("\n🧵 Deploying workers...");
+		for (const worker of run.workers) {
+			ctx.signal?.throwIfAborted();
+			logger.log(`\n   🧵 Deploying ${worker.name} (worker ${worker.id})...`);
+			try {
+				const application = await ensureApplication(api, journal, worker.name, applicationName(identity, worker.name), project.projectId, environmentId, applied);
+				const keys = [...workerEnvKeys(run.manifest, worker.id, run.runnables) ?? []].sort();
+				const secrets = prepareSecretsForApp(stageSecrets, {
+					appName: worker.name,
+					requiredEnvVars: keys,
+					optionalEnvVars: []
+				});
+				const credentials = secrets.secretCount > 0 ? {
+					encrypted: secrets.payload.encrypted,
+					iv: secrets.payload.iv
+				} : void 0;
+				const imageRef$2 = imageRef(identity, worker.name, registry, imageTag);
+				logger.log(`      Building Docker image: ${imageRef$2}`);
+				const image = await deployDocker({
+					stage,
+					tag: imageTag,
+					skipPush: false,
+					config: {
+						registry,
+						imageName: imageName(identity, worker.name),
+						appName: worker.name
+					},
+					credentials,
+					cwd: workspace.root,
+					dockerfile: workerDockerfileOf(worker.name),
+					...ctx.signal ? { signal: ctx.signal } : {},
+					...ctx.stdio ? { stdio: ctx.stdio } : {}
+				});
+				built(worker.name, image, imageRef$2);
+				const env = {
+					...Object.fromEntries(Object.entries(declaredEnv).filter(([key]) => keys.includes(key))),
+					...otelEnv(stageSecrets?.custom ?? {}, worker.name),
+					...credentials ? { GKM_MASTER_KEY: secrets.masterKey } : {},
+					NODE_ENV: "production",
+					PORT: String(WORKER_PORT),
+					STAGE: stage
+				};
+				logger.log(`      Resolved ${Object.keys(env).length} env vars: ${Object.keys(env).sort().join(", ")}`);
+				await release(worker.name, application.applicationId, {
+					ref: image.imageRef ?? imageRef$2,
+					...image.digest ? { digest: image.digest } : {}
+				}, Object.entries(env).map(([key, value]) => `${key}=${value}`), void 0);
+				await checkHealth(run, worker.name);
+				results.push({
+					appName: worker.name,
+					type: "backend",
+					success: true,
+					applicationId: application.applicationId,
+					imageRef: imageRef$2,
+					...image.digest ? { digest: image.digest } : {}
+				});
+				logger.log(`      ✓ ${worker.name} deployed successfully`);
+			} catch (error) {
+				if (ctx.signal?.aborted) throw ctx.signal.reason;
+				failed(run, worker.name, error);
+				throw new BackendDeployFailed(worker.name, error);
+			}
+		}
+	}
 	let frontendFailure;
 	if (frontendApps.length > 0) {
 		logger.log("\n🌐 PHASE 2: Deploying frontend applications...");
@@ -2583,8 +2655,8 @@ async function releaseDokploy(run) {
 					}
 				}
 				if (buildArgs.length > 0) logger.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
-				const imageRef$2 = imageRef(identity, appName, registry, imageTag);
-				logger.log(`      Building Docker image: ${imageRef$2}`);
+				const imageRef$3 = imageRef(identity, appName, registry, imageTag);
+				logger.log(`      Building Docker image: ${imageRef$3}`);
 				const image = await deployDocker({
 					stage,
 					tag: imageTag,
@@ -2598,7 +2670,7 @@ async function releaseDokploy(run) {
 					publicUrlArgs: publicUrlArgNames,
 					...dockerRun(workspace, app, ctx)
 				});
-				built(appName, image, imageRef$2);
+				built(appName, image, imageRef$3);
 				const envVars = [
 					`NODE_ENV=production`,
 					`PORT=${app.port}`,
@@ -2606,14 +2678,14 @@ async function releaseDokploy(run) {
 				];
 				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
 				await release(appName, application.applicationId, {
-					ref: image.imageRef ?? imageRef$2,
+					ref: image.imageRef ?? imageRef$3,
 					...image.digest ? { digest: image.digest } : {}
 				}, envVars, frontendHost);
 				deployed(appName, {
 					appName,
 					type: app.type,
 					applicationId: application.applicationId,
-					imageRef: imageRef$2,
+					imageRef: imageRef$3,
 					...image.digest ? { digest: image.digest } : {}
 				}, frontendHost);
 				logger.log(`      ✓ ${appName} deployed successfully`);
@@ -2651,7 +2723,7 @@ async function verifyDokploy(run) {
 * health is what failed.
 */
 function failed(run, appName, error) {
-	const app = run.workspace.apps[appName];
+	const type = run.workspace.apps[appName]?.type ?? "backend";
 	const message = error instanceof Error ? error.message : "Unknown error";
 	logger.log(`      ✗ Failed to deploy ${appName}: ${message}`);
 	const results = run.released.results;
@@ -2661,7 +2733,7 @@ function failed(run, appName, error) {
 		recorded.error = message;
 	} else results.push({
 		appName,
-		type: app.type,
+		type,
 		success: false,
 		error: message
 	});
@@ -3082,6 +3154,34 @@ async function planDokploy(run) {
 			...existing ? { applicationId: existing.applicationId } : {}
 		});
 	}
+	for (const worker of run.workers) {
+		const dokployAppName = applicationName(identity, worker.name);
+		const recordedId = state?.applications?.[worker.name];
+		const existing = project && environment ? (recordedId ? await api.getApplication(recordedId).catch(() => null) : null) ?? await api.findApplicationByName(project.projectId, dokployAppName, environment.environmentId) : null;
+		plan(existing ? {
+			key: `application:${worker.name}`,
+			resourceType: "application",
+			action: "reuse",
+			id: existing.applicationId
+		} : {
+			key: `application:${worker.name}`,
+			resourceType: "application",
+			action: "create"
+		}, `${dokployAppName}, worker ${worker.id} — no domain`);
+		const ref = imageRef(identity, worker.name, workspace.deploy.registry, imageTag);
+		plan({
+			key: `image:${worker.name}`,
+			resourceType: "image",
+			action: "build"
+		}, ref);
+		apps.push({
+			appName: worker.name,
+			type: "backend",
+			success: true,
+			imageRef: ref,
+			...existing ? { applicationId: existing.applicationId } : {}
+		});
+	}
 	const creates = changes.filter((c) => c.action !== "reuse").length;
 	logger.log(`\n✅ Dry run complete: ${creates} to create or build, ${changes.length - creates} to reuse.`);
 	run.result = {
@@ -3104,4 +3204,4 @@ const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
 export { RegistryNotConfigured as _, dokployResult as a, releaseDokploy as c, validateDokploy as d, verifyDokploy as f, RegistryAmbiguous as g, HealthCheckTimedOut as h, dokployApi as i, restoreImage as l, DeployMigrationsFailed as m, FrontendDeployFailed as n, planDokploy as o, verifySettings as p, MissingEnvVars as r, provisionDokploy as s, BackendDeployFailed as t, rollbackDokploy as u, RegistryNotFound as v, ProjectNotOwned as y };
 
-//# sourceMappingURL=engine-DmQS3XHX.mjs.map
+//# sourceMappingURL=engine-B37qBO5W.mjs.map