@geekmidas/cli 10.0.0-alpha.74 → 10.0.0-alpha.76

package/dist/{encryption-DSkJdoyk.cjs → encryption-vS3Qzw73.cjs}

@@ -1,6 +1,6 @@
-const require_workspace = require("./workspace-vdrcRI-m.cjs");
+const require_workspace = require("./workspace-DOm81oUo.cjs");
 const require_config = require("./config.cjs");
-const require_state = require("./state-DCwRWyh-.cjs");
+const require_state = require("./state-C2qi0iQw.cjs");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
 //#region src/encryption/index.ts
@@ -86,4 +86,4 @@ async function updateKeyring(construct, { stage }, context, update) {
 exports.encryptionRetireCommand = encryptionRetireCommand;
 exports.encryptionRotateCommand = encryptionRotateCommand;
 
-//# sourceMappingURL=encryption-DSkJdoyk.cjs.map
+//# sourceMappingURL=encryption-vS3Qzw73.cjs.map

package/dist/{encryption-DSkJdoyk.cjs.map → encryption-vS3Qzw73.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"encryption-DSkJdoyk.cjs","names":["rotateKeyring","parseKeyring","retireKey","loadWorkspaceSettings","canonicalId","providerOf","secretsStoreFor","provideKey","withCustomSecret"],"sources":["../src/encryption/index.ts"],"sourcesContent":["/**\n * `gkm encryption:rotate` and `gkm encryption:retire` — the keyring of an\n * `Encryption` construct on a server stage.\n *\n * Rotating adds a key in front and keeps every older one, so what they wrote\n * still opens. Retiring removes one, and is the half that makes rotating worth\n * doing: until a key is gone, it still opens everything it ever wrote. It is\n * never automatic, because the only thing that knows nothing is left under a\n * key is the sweep that re-encrypted the column — so it is done after one,\n * deliberately, by name.\n *\n * Neither applies everywhere, and each says so rather than doing something\n * that looks right: a local stage's keyring is derived and would be replaced on\n * the next `gkm dev`, and on AWS the key is KMS's, which rotates it itself and\n * never strands a value.\n */\n\nimport {\n\tparseKeyring,\n\tretireKey,\n\trotateKeyring,\n} from '@geekmidas/constructs/encryption';\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\nimport { loadWorkspaceSettings } from '../config';\nimport { withCustomSecret } from '../secrets/storage.js';\nimport { type SecretsStore, secretsStoreFor } from '../secrets/store.js';\nimport { providerOf } from '../workspace/backends.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\nconst logger = console;\n\nexport class LocalKeyringIsDerived extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' is the local stage, where ${construct}'s keyring is derived from the project and stage — nothing stored there would be read. Rotate a deployed stage: gkm encryption:rotate ${construct} --stage <stage>.`,\n\t\t);\n\t\tthis.name = 'LocalKeyringIsDerived';\n\t}\n}\n\nexport class KmsRotatesItself extends Error {\n\tconstructor(readonly construct: string) {\n\t\tsuper(\n\t\t\t`${construct} is a KMS key on AWS: KMS rotates it yearly and keeps every version, so no value is ever stranded and there is no key to retire. Nothing to do here.`,\n\t\t);\n\t\tthis.name = 'KmsRotatesItself';\n\t}\n}\n\nexport class NoKeyringYet extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t\treadonly key: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' has no ${key} yet. The first deploy generates ${construct}'s keyring: gkm deploy --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'NoKeyringYet';\n\t}\n}\n\nexport interface EncryptionCommandOptions {\n\tstage: string;\n}\n\n/** Where a command reads and writes; the real ones unless a test says. */\nexport interface EncryptionCommandContext {\n\tworkspace?: NormalizedWorkspace;\n\tstore?: SecretsStore;\n}\n\nexport async function encryptionRotateCommand(\n\tconstruct: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = rotateKeyring(id, url);\n\t\tconst [current, ...older] = parseKeyring(id, next).keys.map(({ id }) => id);\n\n\t\tlogger.log(`\\n✓ ${id} on '${options.stage}' now writes with '${current}'.`);\n\t\tlogger.log(\n\t\t\t`  Still opening: ${older.join(', ')}. Redeploy to start writing with '${current}', reencrypt what is stored, then: gkm encryption:retire ${id} <key> --stage ${options.stage}`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nexport async function encryptionRetireCommand(\n\tconstruct: string,\n\tkeyId: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = retireKey(id, url, keyId);\n\n\t\tlogger.log(\n\t\t\t`\\n✓ ${id} on '${options.stage}' no longer holds '${keyId}'. Anything still under it cannot be read after the next deploy.`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nasync function updateKeyring(\n\tconstruct: string,\n\t{ stage }: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext,\n\tupdate: (id: string, url: string) => string,\n): Promise<string> {\n\tconst workspace = context.workspace ?? (await loadWorkspaceSettings());\n\tconst id = canonicalId(construct);\n\n\tif (stage === workspace.stages.local) {\n\t\tthrow new LocalKeyringIsDerived(id, stage);\n\t}\n\tassertDeployedStage(workspace.stages, stage);\n\tif (providerOf(workspace) === 'aws') throw new KmsRotatesItself(id);\n\n\tconst store = context.store ?? (await secretsStoreFor(workspace, stage));\n\tconst key = provideKey(id, 'url');\n\tconst secrets = await store.read(stage);\n\tconst url = secrets?.custom[key];\n\tif (!secrets || !url) throw new NoKeyringYet(id, stage, key);\n\n\tconst next = update(id, url);\n\tawait store.write(stage, withCustomSecret(secrets, key, next));\n\treturn next;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,SAAS;AAEf,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,WACA,OACC;EACD,MACC,IAAI,MAAM,8BAA8B,UAAU,wIAAwI,UAAU,kBACrM;EALS,KAAA,YAAA;EACA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,MAAM;CACtB;CAArB,YAAY,WAA4B;EACvC,MACC,GAAG,UAAU,qJACd;EAHoB,KAAA,YAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,IAAa,eAAb,cAAkC,MAAM;CAE7B;CACA;CACA;CAHV,YACC,WACA,OACA,KACC;EACD,MACC,IAAI,MAAM,WAAW,IAAI,mCAAmC,UAAU,iCAAiC,MAAM,EAC9G;EANS,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,MAAA;EAKT,KAAK,OAAO;CACb;AACD;AAYA,eAAsB,wBACrB,WACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,QAAA,GAAOA,iCAAAA,cAAAA,CAAc,IAAI,GAAG;EAClC,MAAM,CAAC,SAAS,GAAG,UAAA,GAASC,iCAAAA,aAAAA,CAAa,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,SAAS,EAAE;EAE1E,OAAO,IAAI,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,QAAQ,GAAG;EAC1E,OAAO,IACN,oBAAoB,MAAM,KAAK,IAAI,EAAE,oCAAoC,QAAQ,2DAA2D,GAAG,iBAAiB,QAAQ,OACzK;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAsB,wBACrB,WACA,OACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,QAAA,GAAOC,iCAAAA,UAAAA,CAAU,IAAI,KAAK,KAAK;EAErC,OAAO,IACN,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,MAAM,iEAC3D;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAe,cACd,WACA,EAAE,SACF,SACA,QACkB;CAClB,MAAM,YAAY,QAAQ,aAAc,MAAMC,eAAAA,sBAAsB;CACpE,MAAM,MAAA,GAAKC,oBAAAA,YAAAA,CAAY,SAAS;CAEhC,IAAI,UAAU,UAAU,OAAO,OAC9B,MAAM,IAAI,sBAAsB,IAAI,KAAK;CAE1C,kBAAA,oBAAoB,UAAU,QAAQ,KAAK;CAC3C,IAAIC,cAAAA,WAAW,SAAS,MAAM,OAAO,MAAM,IAAI,iBAAiB,EAAE;CAElE,MAAM,QAAQ,QAAQ,SAAU,MAAMC,cAAAA,gBAAgB,WAAW,KAAK;CACtE,MAAM,OAAA,GAAMC,oBAAAA,WAAAA,CAAW,IAAI,KAAK;CAChC,MAAM,UAAU,MAAM,MAAM,KAAK,KAAK;CACtC,MAAM,MAAM,SAAS,OAAO;CAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,GAAG;CAE3D,MAAM,OAAO,OAAO,IAAI,GAAG;CAC3B,MAAM,MAAM,MAAM,OAAOC,cAAAA,iBAAiB,SAAS,KAAK,IAAI,CAAC;CAC7D,OAAO;AACR"}
+{"version":3,"file":"encryption-vS3Qzw73.cjs","names":["rotateKeyring","parseKeyring","retireKey","loadWorkspaceSettings","canonicalId","providerOf","secretsStoreFor","provideKey","withCustomSecret"],"sources":["../src/encryption/index.ts"],"sourcesContent":["/**\n * `gkm encryption:rotate` and `gkm encryption:retire` — the keyring of an\n * `Encryption` construct on a server stage.\n *\n * Rotating adds a key in front and keeps every older one, so what they wrote\n * still opens. Retiring removes one, and is the half that makes rotating worth\n * doing: until a key is gone, it still opens everything it ever wrote. It is\n * never automatic, because the only thing that knows nothing is left under a\n * key is the sweep that re-encrypted the column — so it is done after one,\n * deliberately, by name.\n *\n * Neither applies everywhere, and each says so rather than doing something\n * that looks right: a local stage's keyring is derived and would be replaced on\n * the next `gkm dev`, and on AWS the key is KMS's, which rotates it itself and\n * never strands a value.\n */\n\nimport {\n\tparseKeyring,\n\tretireKey,\n\trotateKeyring,\n} from '@geekmidas/constructs/encryption';\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\nimport { loadWorkspaceSettings } from '../config';\nimport { withCustomSecret } from '../secrets/storage.js';\nimport { type SecretsStore, secretsStoreFor } from '../secrets/store.js';\nimport { providerOf } from '../workspace/backends.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\nconst logger = console;\n\nexport class LocalKeyringIsDerived extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' is the local stage, where ${construct}'s keyring is derived from the project and stage — nothing stored there would be read. Rotate a deployed stage: gkm encryption:rotate ${construct} --stage <stage>.`,\n\t\t);\n\t\tthis.name = 'LocalKeyringIsDerived';\n\t}\n}\n\nexport class KmsRotatesItself extends Error {\n\tconstructor(readonly construct: string) {\n\t\tsuper(\n\t\t\t`${construct} is a KMS key on AWS: KMS rotates it yearly and keeps every version, so no value is ever stranded and there is no key to retire. Nothing to do here.`,\n\t\t);\n\t\tthis.name = 'KmsRotatesItself';\n\t}\n}\n\nexport class NoKeyringYet extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t\treadonly key: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' has no ${key} yet. The first deploy generates ${construct}'s keyring: gkm deploy --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'NoKeyringYet';\n\t}\n}\n\nexport interface EncryptionCommandOptions {\n\tstage: string;\n}\n\n/** Where a command reads and writes; the real ones unless a test says. */\nexport interface EncryptionCommandContext {\n\tworkspace?: NormalizedWorkspace;\n\tstore?: SecretsStore;\n}\n\nexport async function encryptionRotateCommand(\n\tconstruct: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = rotateKeyring(id, url);\n\t\tconst [current, ...older] = parseKeyring(id, next).keys.map(({ id }) => id);\n\n\t\tlogger.log(`\\n✓ ${id} on '${options.stage}' now writes with '${current}'.`);\n\t\tlogger.log(\n\t\t\t`  Still opening: ${older.join(', ')}. Redeploy to start writing with '${current}', reencrypt what is stored, then: gkm encryption:retire ${id} <key> --stage ${options.stage}`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nexport async function encryptionRetireCommand(\n\tconstruct: string,\n\tkeyId: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = retireKey(id, url, keyId);\n\n\t\tlogger.log(\n\t\t\t`\\n✓ ${id} on '${options.stage}' no longer holds '${keyId}'. Anything still under it cannot be read after the next deploy.`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nasync function updateKeyring(\n\tconstruct: string,\n\t{ stage }: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext,\n\tupdate: (id: string, url: string) => string,\n): Promise<string> {\n\tconst workspace = context.workspace ?? (await loadWorkspaceSettings());\n\tconst id = canonicalId(construct);\n\n\tif (stage === workspace.stages.local) {\n\t\tthrow new LocalKeyringIsDerived(id, stage);\n\t}\n\tassertDeployedStage(workspace.stages, stage);\n\tif (providerOf(workspace) === 'aws') throw new KmsRotatesItself(id);\n\n\tconst store = context.store ?? (await secretsStoreFor(workspace, stage));\n\tconst key = provideKey(id, 'url');\n\tconst secrets = await store.read(stage);\n\tconst url = secrets?.custom[key];\n\tif (!secrets || !url) throw new NoKeyringYet(id, stage, key);\n\n\tconst next = update(id, url);\n\tawait store.write(stage, withCustomSecret(secrets, key, next));\n\treturn next;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,SAAS;AAEf,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,WACA,OACC;EACD,MACC,IAAI,MAAM,8BAA8B,UAAU,wIAAwI,UAAU,kBACrM;EALS,KAAA,YAAA;EACA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,MAAM;CACtB;CAArB,YAAY,WAA4B;EACvC,MACC,GAAG,UAAU,qJACd;EAHoB,KAAA,YAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,IAAa,eAAb,cAAkC,MAAM;CAE7B;CACA;CACA;CAHV,YACC,WACA,OACA,KACC;EACD,MACC,IAAI,MAAM,WAAW,IAAI,mCAAmC,UAAU,iCAAiC,MAAM,EAC9G;EANS,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,MAAA;EAKT,KAAK,OAAO;CACb;AACD;AAYA,eAAsB,wBACrB,WACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,QAAA,GAAOA,iCAAAA,cAAAA,CAAc,IAAI,GAAG;EAClC,MAAM,CAAC,SAAS,GAAG,UAAA,GAASC,iCAAAA,aAAAA,CAAa,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,SAAS,EAAE;EAE1E,OAAO,IAAI,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,QAAQ,GAAG;EAC1E,OAAO,IACN,oBAAoB,MAAM,KAAK,IAAI,EAAE,oCAAoC,QAAQ,2DAA2D,GAAG,iBAAiB,QAAQ,OACzK;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAsB,wBACrB,WACA,OACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,QAAA,GAAOC,iCAAAA,UAAAA,CAAU,IAAI,KAAK,KAAK;EAErC,OAAO,IACN,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,MAAM,iEAC3D;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAe,cACd,WACA,EAAE,SACF,SACA,QACkB;CAClB,MAAM,YAAY,QAAQ,aAAc,MAAMC,eAAAA,sBAAsB;CACpE,MAAM,MAAA,GAAKC,oBAAAA,YAAAA,CAAY,SAAS;CAEhC,IAAI,UAAU,UAAU,OAAO,OAC9B,MAAM,IAAI,sBAAsB,IAAI,KAAK;CAE1C,kBAAA,oBAAoB,UAAU,QAAQ,KAAK;CAC3C,IAAIC,cAAAA,WAAW,SAAS,MAAM,OAAO,MAAM,IAAI,iBAAiB,EAAE;CAElE,MAAM,QAAQ,QAAQ,SAAU,MAAMC,cAAAA,gBAAgB,WAAW,KAAK;CACtE,MAAM,OAAA,GAAMC,oBAAAA,WAAAA,CAAW,IAAI,KAAK;CAChC,MAAM,UAAU,MAAM,MAAM,KAAK,KAAK;CACtC,MAAM,MAAM,SAAS,OAAO;CAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,GAAG;CAE3D,MAAM,OAAO,OAAO,IAAI,GAAG;CAC3B,MAAM,MAAM,MAAM,OAAOC,cAAAA,iBAAiB,SAAS,KAAK,IAAI,CAAC;CAC7D,OAAO;AACR"}

package/dist/{engine-B1b4I34Z.mjs → engine-BOO5TWZd.mjs}

@@ -1,20 +1,208 @@
+import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
 import { i as LocalSandbox, t as MissingCredential } from "./credentials-pAtB70k3.mjs";
 import { a as discriminatedUnion, c as looseObject, f as string, n as array, s as literal, u as object } from "./schemas-D-xeKJDD.mjs";
 import { c as runWorker, d as output, r as discover } from "./discover-BPelzeGW.mjs";
 import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-C7NqCsQF.mjs";
-import { $ as constructGlobs, $t as applicationName, At as eventsBackendFor, E as resolveHost, Et as WORKER_PORT, F as devServicesUsed, H as workerUnits, I as externalServices, L as manifestServiceDeclarations, M as STORAGE_KEY_PAIR, Mt as storageBackendFor, O as otelEnv, P as assertExternalServices, S as workerDockerfileOf, T as isMainFrontendApp, U as encryptSecrets, _ as deployDocker, _t as workerEnvKeys, a as recordRelease, an as ownershipMarker, c as setBackupState, d as setGeneratedSecret, f as setPostgresBackupId, i as isDnsVerified, in as markerOf, j as ExternalServicesNotConfigured, jt as providerOf, kt as cacheBackendFor, l as setDnsRecord, m as withGeneratedSecrets, n as getBackupState, nn as imageRef, o as recordRollback, on as projectName, p as DeployJournal, r as getGeneratedSecret, rn as isOwnedBy, s as setApplicationId, sn as initStageSecrets, st as applyPostgres, t as createEmptyState, tn as imageName, u as setDnsVerification, un as toEmbeddableSecrets, xt as resourceName, z as reportDevServices } from "./state-DpkxSwzI.mjs";
-import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError } from "./sniffer-BFmdZpZ2.mjs";
+import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-QUTqYmVy.mjs";
+import { $t as applicationName, A as ExternalServicesNotConfigured, At as providerOf, Ct as WORKER_PORT, D as otelEnv, F as externalServices, I as manifestServiceDeclarations, N as assertExternalServices, Ot as cacheBackendFor, P as devServicesUsed, R as reportDevServices, S as validateImageRef, T as resolveHost, V as workerUnits, Y as constructGlobs, a as recordRelease, an as ownershipMarker, c as setBackupState, d as setGeneratedSecret, f as setPostgresBackupId, ft as dockerfileOf, g as DockerPushFailed, h as DockerBuildFailed, i as isDnsVerified, in as markerOf, j as STORAGE_KEY_PAIR, jt as storageBackendFor, kt as eventsBackendFor, l as setDnsRecord, m as withGeneratedSecrets, mt as workerEnvKeys, n as getBackupState, nn as imageRef, o as recordRollback, on as projectName, p as DeployJournal, r as getGeneratedSecret, rn as isOwnedBy, rt as applyPostgres, s as setApplicationId, sn as initStageSecrets, t as createEmptyState, tn as imageName, u as setDnsVerification, un as toEmbeddableSecrets, v as dockerCommand, vt as resourceName, w as isMainFrontendApp, x as workerDockerfileOf } from "./state-CUecOCNJ.mjs";
+import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError, x as keyFingerprint, y as encryptSecrets } from "./sniffer-DR8AlRCk.mjs";
 import { o as migrationFiles } from "./provider-D7rQzzzf.mjs";
 import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
-import { join } from "node:path";
+import { join, relative } from "node:path";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, migrationTargets, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
 import { createHash, randomBytes } from "node:crypto";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import { lookup } from "node:dns/promises";
+//#region src/deploy/docker.ts
+const logger$3 = output;
+/**
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
+* Get the full image reference
+*/
+function getImageRef(registry, imageName, tag) {
+	if (registry) return `${registry}/${imageName}:${tag}`;
+	return `${imageName}:${tag}`;
+}
+/**
+* The `docker build` argv for an image.
+*
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
+*
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* The build arg that names which credentials an image embeds: a hash of the
+* ciphertext, which is not a secret. A BuildKit secret is no part of the
+* build cache's key, so without it a rebuild with credentials encrypted under
+* a new key would reuse the layer that embedded the old ones.
+*/
+function credentialsBuildArg(credentials) {
+	return `GKM_CIPHERTEXT_HASH=${createHash("sha256").update(`${credentials.encrypted}\n${credentials.iv}`).digest("hex").slice(0, 16)}`;
+}
+/** The secret file's content: ciphertext, then IV, one per line. */
+function credentialsFileContent(credentials) {
+	return `${credentials.encrypted}\n${credentials.iv}\n`;
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
+*
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
+*
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
+	const path = join(dir, CREDENTIALS_SECRET_ID);
+	await writeFile(path, credentialsFileContent(credentials), { mode: 384 });
+	await chmod(path, 384);
+	return {
+		path,
+		cleanup: () => rm(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
+* Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
+*/
+async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
+	logger$3.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$3.log("   Generating Dockerfile...");
+	const { buildRoot } = await dockerCommand({ cwd });
+	const dockerfilePath = relative(buildRoot, dockerfile);
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
+	try {
+		await run("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs: [...buildArgs ?? [], ...credentials ? [credentialsBuildArg(credentials)] : []],
+			credentialsFile: secret?.path
+		}), {
+			cwd: buildRoot,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			},
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$3.log(`✅ Image built: ${imageRef}`);
+	} catch (error) {
+		throw new DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
+	}
+}
+/**
+* Push Docker image to registry
+*/
+async function pushImage(imageRef, { cwd, signal, stdio }) {
+	logger$3.log(`\n☁️  Pushing image: ${imageRef}`);
+	try {
+		await run("docker", ["push", imageRef], {
+			cwd,
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$3.log(`✅ Image pushed: ${imageRef}`);
+	} catch (error) {
+		throw new DockerPushFailed(imageRef, error);
+	}
+}
+/**
+* The digest the registry gave a pushed image, `sha256:…`.
+*
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
+*/
+async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], {
+		cwd,
+		...signal ? { signal } : {}
+	});
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
+/**
+* Deploy using Docker (build and optionally push image)
+*/
+async function deployDocker(options) {
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
+	const imageName = config.imageName;
+	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
+	const cwd = options.cwd ?? process.cwd();
+	const docker = {
+		cwd,
+		dockerfile: join(cwd, options.dockerfile ?? dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
+		...options.signal ? { signal: options.signal } : {},
+		...options.stdio ? { stdio: options.stdio } : {}
+	};
+	await buildImage(imageRef, buildArgs, credentials, docker);
+	let digest;
+	if (!skipPush) {
+		if (!config.registry) logger$3.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		else {
+			await pushImage(imageRef, docker);
+			digest = await pushedDigest(imageRef, docker);
+		}
+	}
+	logger$3.log("\n✅ Docker deployment ready!");
+	logger$3.log(`\n📋 Deployment details:`);
+	logger$3.log(`   Image: ${imageRef}`);
+	logger$3.log(`   Stage: ${stage}`);
+	if (masterKey) logger$3.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
+	return {
+		imageRef,
+		...digest ? { digest } : {},
+		masterKey
+	};
+}
+//#endregion
 //#region src/deploy/ownership.ts
 /**
 * Which Dokploy project a deploy is allowed to deploy into.
@@ -3204,4 +3392,4 @@ const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
 export { RegistryNotConfigured as _, dokployResult as a, releaseDokploy as c, validateDokploy as d, verifyDokploy as f, RegistryAmbiguous as g, HealthCheckTimedOut as h, dokployApi as i, restoreImage as l, DeployMigrationsFailed as m, FrontendDeployFailed as n, planDokploy as o, verifySettings as p, MissingEnvVars as r, provisionDokploy as s, BackendDeployFailed as t, rollbackDokploy as u, RegistryNotFound as v, ProjectNotOwned as y };
 
-//# sourceMappingURL=engine-B1b4I34Z.mjs.map
+//# sourceMappingURL=engine-BOO5TWZd.mjs.map