@geekmidas/cli 10.0.0-alpha.75 → 10.0.0-alpha.77

package/dist/{state-BrWIOce_.mjs → stale-DGzpiN5S.mjs}

@@ -2,10 +2,10 @@ import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-C7NqCsQF.mjs";
+import { F as UnknownSecretsStoreProvider, O as TEST_STAGE, h as getPublicEnvPrefix, m as PUBLIC_ENV_PREFIXES, n as allConstructGlobs } from "./workspace-QUTqYmVy.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { n as runtimeFor, r as generateTelemetryModule } from "./EndpointGenerator-DftalLYg.mjs";
-import { c as runtimeOf } from "./resolve-DZNx7rLy.mjs";
+import { c as runtimeOf } from "./resolve-BF1ICosS.mjs";
 import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-5looQ3gB.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
@@ -91,10 +91,6 @@ function toEmbeddableSecrets(secrets) {
 			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
 			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
 			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
-		},
-		...secrets.services.pgboss && {
-			PGBOSS_DB_USER: secrets.services.pgboss.username,
-			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password
 		}
 	};
 }
@@ -527,7 +523,8 @@ function decrypt(data, keyHex) {
 var store_exports = /* @__PURE__ */ __exportAll({
 	FileSecretsStore: () => FileSecretsStore,
 	isRemoteStore: () => isRemoteStore,
-	secretsStoreFor: () => secretsStoreFor
+	secretsStoreFor: () => secretsStoreFor,
+	storeFromConfig: () => storeFromConfig
 });
 /**
 * The store a stage's secrets are kept in — what every command reads and
@@ -539,13 +536,41 @@ var store_exports = /* @__PURE__ */ __exportAll({
 async function secretsStoreFor(workspace, stage, options = {}) {
 	const configured = workspace.secrets.store ?? "file";
 	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
-	if (configured.provider !== "ssm") return configured.provider;
-	const { AwsSecretsStore } = await import("./aws-DojzQnLd.mjs");
-	return new AwsSecretsStore({
-		project: workspace.name,
-		region: configured.region,
-		...options.profile ? { profile: options.profile } : {}
-	});
+	return storeFromConfig(workspace, configured, options);
+}
+/**
+* The store a `secrets.store` value describes, for any stage — what
+* {@link secretsStoreFor} answers for a deployed stage, and what
+* `gkm secrets:migrate` builds for the store it copies to.
+*/
+async function storeFromConfig(workspace, config, options = {}) {
+	if (config === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
+	const profile = options.profile ? { profile: options.profile } : {};
+	switch (config.provider) {
+		case "ssm": {
+			const { AwsSecretsStore } = await import("./aws-Bja4zGSs.mjs");
+			return new AwsSecretsStore({
+				project: workspace.name,
+				region: config.region,
+				...profile
+			});
+		}
+		case "secrets-manager": {
+			const { kmsKeyId } = config;
+			const { SecretsManagerSecretsStore } = await import("./secretsManager-Ti0oZwsS.mjs");
+			return new SecretsManagerSecretsStore({
+				project: workspace.name,
+				region: config.region,
+				...kmsKeyId ? { kmsKeyId } : {},
+				...profile
+			});
+		}
+		default: {
+			const provider = config.provider;
+			if (typeof provider === "object" && provider !== null) return provider;
+			throw new UnknownSecretsStoreProvider(provider);
+		}
+	}
 }
 /** Whether a stage's secrets live somewhere other than this machine. */
 function isRemoteStore(workspace, stage) {
@@ -632,24 +657,18 @@ async function savePortState(workspaceRoot, ports) {
 	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
 }
 /**
-* Load and flatten secrets for an app from encrypted storage.
-* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
+* Load and flatten a stage's secrets from its store.
+*
+* Every key as stored — nothing renamed. An app's database URL is its
+* construct's key, derived by reconcile, and never a stored per-app value
+* mapped onto `DATABASE_URL`.
 * @internal Exported for testing
 */
-async function loadSecretsForApp(store, stage, appName) {
-	let secrets = {};
+async function loadSecretsForApp(store, stage) {
 	const stageSecrets = await store.read(stage);
-	if (stageSecrets) {
-		logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
-		secrets = toEmbeddableSecrets(stageSecrets);
-	}
-	if (Object.keys(secrets).length === 0) return {};
-	if (!appName) return secrets;
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
-	return mapped;
+	if (!stageSecrets) return {};
+	logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
+	return toEmbeddableSecrets(stageSecrets);
 }
 /**
 * Walk up the directory tree to find the root containing .gkm/secrets/.
@@ -757,7 +776,7 @@ async function prepareEntryCredentials(options) {
 	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
 	const stage = options.stage ?? workspace?.stages.local;
 	const store = stage ? workspace ? await secretsStoreFor(workspace, stage) : new FileSecretsStore(secretsRoot) : void 0;
-	const credentials = store && stage ? await loadSecretsForApp(store, stage, appName) : {};
+	const credentials = store && stage ? await loadSecretsForApp(store, stage) : {};
 	credentials.PORT = String(resolvedPort);
 	if (appInfo?.app.type === "mobile") credentials.RCT_METRO_PORT = String(resolvedPort);
 	const declaredKeys = [];
@@ -1022,6 +1041,36 @@ function eventsBackendFor(on) {
 	return DEFAULT_EVENTS$1[on];
 }
 //#endregion
+//#region src/exec/imageBuild.ts
+/**
+* Set by a site's Dockerfile in its builder stage: this process is building
+* an image.
+*
+* Inside an image there is no stage to load secrets for and no local
+* container to resolve an address from — the public URLs the bundle inlines
+* arrived as the Dockerfile's build args, already in the environment. So
+* `gkm exec -- next build` there injects exactly those, and never the
+* `localhost` addresses a workspace resolves on a developer's machine.
+*/
+const IMAGE_BUILD_ENV = "GKM_IMAGE_BUILD";
+/** Whether this process is building an image. */
+function isImageBuild(env = process.env) {
+	return env[IMAGE_BUILD_ENV] === "1";
+}
+/**
+* What `gkm exec` injects inside an image build: the public values its build
+* args set — every `NEXT_PUBLIC_*`, `VITE_*` and `EXPO_PUBLIC_*` — and
+* nothing read from a secrets store, a file or a container.
+*/
+function imageBuildCredentials(env = process.env) {
+	const credentials = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (value === void 0) continue;
+		if (PUBLIC_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) credentials[key] = value;
+	}
+	return credentials;
+}
+//#endregion
 //#region src/docker/templates.ts
 /**
 * The turbo every image prunes and builds with when the build root resolves
@@ -1319,7 +1368,48 @@ function binPath(options) {
 * were installed.
 */
 function gkmCommand(args) {
-	return `GKM_BIN="$(node -e 'let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}')" && node "$GKM_BIN" ${args}`;
+	return `GKM_BIN="$(node -e '${FIND_GKM_BIN}')" && node "$GKM_BIN" ${args}`;
+}
+/** Prints the `bin/gkm.mjs` Node resolves from the cwd, or fails saying so. */
+const FIND_GKM_BIN = `let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}`;
+/**
+* What a site's builder does with the gkm workspace it carries, before its
+* framework builds it — all of it inside the image, nothing from the host:
+*
+* - `gkm` on the PATH: the CLI the workspace installs, so a build script that
+*   is `gkm exec -- next build` runs. Resolved from the gkm root rather than
+*   through `node_modules/.bin`, where a CLI that is a workspace package has
+*   no bin linked.
+* - `GKM_IMAGE_BUILD`, which has `gkm exec` inject the build args above — the
+*   stage's public URLs — and never load a secret or resolve a local address.
+* - each backend's typed client, generated from its endpoints at the
+*   workspace root's `.gkm/client/`, where the site's tsconfig paths point.
+*/
+function siteWorkspaceSteps(options) {
+	const { gkmRoot } = layout(options);
+	const root = `/app/${gkmRoot}`.replace(/\/\.$/, "");
+	const clients = options.clients ?? [];
+	const generate = clients.length ? `
+
+# The typed client of each API this site calls, generated from its endpoints
+# into ${gkmRoot === "." ? "" : `${gkmRoot}/`}.gkm/client/ — offline, with no secret and no container.
+RUN ${clients.map(({ app, path }) => `cd /app/${path} && gkm openapi --app ${app}`).join(" && \\\n    ")}` : "";
+	return `# The gkm CLI the workspace installs, as \`gkm\`
+RUN cd ${root} && GKM_BIN="$(node -e '${FIND_GKM_BIN}')" && \\
+    { echo '#!/bin/sh'; echo "exec node \\"$GKM_BIN\\" \\"\\$@\\""; } > /usr/local/bin/gkm && \\
+    chmod +x /usr/local/bin/gkm
+
+# \`gkm exec\` in this build injects the build args, never a stage's secrets
+ENV ${IMAGE_BUILD_ENV}=1${generate}`;
+}
+/**
+* Build the site with turbo. Loose env mode, so the task sees what the
+* Dockerfile set — the build args and `GKM_IMAGE_BUILD` — whatever the
+* project's turbo.json declares: the image's environment holds nothing else.
+*/
+function siteBuild(options) {
+	const { turbo } = layout(options);
+	return `RUN ${turbo} run build --filter='${options.turboPackage}' --env-mode=loose`;
 }
 /**
 * The encrypted credentials, from a build secret — never an ARG, which is
@@ -1473,8 +1563,7 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
 * @internal Exported for testing
 */
 function generateNextjsDockerfile(options) {
-	const { port, appPath, turboPackage, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
-	const { turbo } = layout(options);
+	const { port, appPath, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
 	return `# syntax=docker/dockerfile:1
 # Next.js standalone Dockerfile, built from a turbo-pruned slice
 
@@ -1484,13 +1573,15 @@ ${depsStage(options)}
 
 ${builderStage(options, { args: publicUrlArgs })}
 
+${siteWorkspaceSteps(options)}
+
 # Ensure public directory exists (may be empty for scaffolded projects)
 RUN mkdir -p ${appPath}/public
 
 ENV NEXT_TELEMETRY_DISABLED=1
 
 # Build the application
-RUN ${turbo} run build --filter='${turboPackage}'
+${siteBuild(options)}
 
 # The runner needs the standalone server; without it there is nothing to run.
 RUN if [ ! -d ${appPath}/.next/standalone ]; then \\
@@ -1678,8 +1769,7 @@ CMD ["node", "index.mjs"]
 * @internal Exported for testing
 */
 function generateNodeWebDockerfile(options) {
-	const { port, appPath, turboPackage } = options;
-	const { turbo } = layout(options);
+	const { port, appPath } = options;
 	return `# syntax=docker/dockerfile:1
 # Node SSR web Dockerfile (TanStack Start / Remix), from a turbo-pruned slice
 
@@ -1688,7 +1778,10 @@ ${prunerStage(options)}
 ${depsStage(options)}
 
 ${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-RUN ${turbo} run build --filter='${turboPackage}'
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
 
 FROM ${options.baseImage} AS runner
 WORKDIR /app
@@ -1722,8 +1815,7 @@ CMD ["sh", "-c", "cd ${appPath} && npm start"]
 * @internal Exported for testing
 */
 function generateViteStaticDockerfile(options) {
-	const { port, appPath, turboPackage } = options;
-	const { turbo } = layout(options);
+	const { port, appPath } = options;
 	return `# syntax=docker/dockerfile:1
 # Vite SPA Dockerfile — a turbo-pruned slice built to static files, served by Caddy
 
@@ -1732,7 +1824,10 @@ ${prunerStage(options)}
 ${depsStage(options)}
 
 ${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-RUN ${turbo} run build --filter='${turboPackage}'
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
 
 FROM ${STATIC_SITE_IMAGE} AS runner
 
@@ -1841,7 +1936,7 @@ function fromBuildRoot(layout, path) {
 	return joined === "" ? "." : joined;
 }
 /** Everything a template needs about one app, relative to the build root. */
-function appImageOptions(layout, appName, app, workspaceRoot) {
+function appImageOptions(layout, appName, app, workspaceRoot, apps = {}) {
 	const turboPackage = packageName(isAbsolute(app.path) ? app.path : join(workspaceRoot, app.path)) ?? appName;
 	return {
 		imageName: appName,
@@ -1857,10 +1952,49 @@ function appImageOptions(layout, appName, app, workspaceRoot) {
 		...app.type === "backend" ? {
 			gkmPaths: layout.gkmPaths,
 			...layout.workspacePackage && layout.workspacePackage !== turboPackage ? { prunePackages: [layout.workspacePackage] } : {}
-		} : {}
+		} : app.type === "web" ? siteWorkspace(layout, app, apps, workspaceRoot, turboPackage) : {}
 	};
 }
 /**
+* What a site's image carries of the gkm workspace: its config and construct
+* directories, the workspace's own package where it is nested in a monorepo
+* (it holds the CLI), and each backend the site calls — whose endpoints its
+* client is generated from, and whose package their imports resolve in.
+*/
+function siteWorkspace(layout, site, apps, workspaceRoot, turboPackage) {
+	const clients = siteClients(site, apps);
+	const packages = /* @__PURE__ */ new Set();
+	if (layout.workspacePackage) packages.add(layout.workspacePackage);
+	for (const { app } of clients) {
+		const backend = apps[app];
+		const name = packageName(isAbsolute(backend.path) ? backend.path : join(workspaceRoot, backend.path));
+		if (name) packages.add(name);
+	}
+	packages.delete(turboPackage);
+	return {
+		gkmPaths: layout.gkmPaths,
+		...packages.size > 0 ? { prunePackages: [...packages].sort() } : {},
+		...clients.length > 0 ? { clients: clients.map(({ app }) => ({
+			app,
+			path: fromBuildRoot(layout, apps[app].path)
+		})) } : {}
+	};
+}
+/**
+* The backends whose clients a site imports: each it depends on that gkm
+* builds from endpoints — not one with an entry of its own, and not one that
+* turned OpenAPI off.
+*/
+function siteClients(site, apps) {
+	return site.dependencies.filter((name) => {
+		const app = apps[name];
+		if (!app || app.type !== "backend" || app.entry) return false;
+		if (app.openapi === false) return false;
+		if (typeof app.openapi === "object" && app.openapi.enabled === false) return false;
+		return true;
+	}).sort().map((app) => ({ app }));
+}
+/**
 * The directories the workspace's construct globs start in, relative to its
 * root: `./constructs/**\/*.ts` reads from `constructs`.
 */
@@ -5883,6 +6017,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		const dockerfile = appDockerfile(appName, app, {
 			layout,
 			workspaceRoot: workspace.root,
+			apps: workspace.apps,
 			...manifest ? { manifest } : {}
 		});
 		const path = dockerfileOf(appName, app.path);
@@ -5938,7 +6073,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 * framework. The one choice every builder of images makes.
 */
 function appDockerfile(appName, app, options) {
-	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot);
+	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot, options.apps);
 	if (app.type === "web") return siteDockerfile(appName, app, {
 		image,
 		...options.manifest ? { manifest: options.manifest } : {},
@@ -6352,6 +6487,96 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { LOCAL_CA_PATH as $, imageRef as $t, ExternalServicesNotConfigured as A, DEFAULT_IMAGES as At, suppliedOnly as B, loadSecretsForApp as Bt, NoDomainForStage as C, WORKER_PORT as Ct, otelEnv as D, eventsBackendFor as Dt, isOtlpDestination as E, cacheBackendFor as Et, externalServices as F, createCredentialsPreload as Ft, QueueGenerator as G, FileSecretsStore as Gt, WorkerGenerator as H, isRemoteStore as Ht, manifestServiceDeclarations as I, createEntryWrapper as It, backendsOf as J, projectKey as Jt, CronGenerator as K, getKeyPath as Kt, parseDevServices as L, findAvailablePort as Lt, UnknownDevService as M, fakeKey as Mt, assertExternalServices as N, portKeys as Nt, DEV_SERVICES as O, providerOf as Ot, devServicesUsed as P, primaryPortKey as Pt, workspace_exports as Q, imageName as Qt, reportDevServices as R, isPortAvailable as Rt, validateImageRef as S, TURBO_VERSION as St, resolveHost as T, findBuildRoot as Tt, workerBundleName as U, secretsStoreFor as Ut, workerUnits as V, prepareEntryCredentials as Vt, workerEntryDir as W, store_exports as Wt, derivedContainers as X, applicationName as Xt, constructGlobs as Y, readKey as Yt, reconcileWorkspace as Z, deployIdentity as Zt, appDockerfile as _, planFor as _t, recordRelease as a, maskPassword as an, postgresDatabaseNames as at, workerDockerfile as b, composeBuildPaths as bt, setBackupState as c, withCustomSecret as cn, composeFor as ct, setGeneratedSecret as d, appEnvKeys as dt, isOwnedBy as en, forgetState as et, setPostgresBackupId as f, dockerfileOf as ft, DockerPushFailed as g, localRolePassword as gt, DockerBuildFailed as h, envFor as ht, isDnsVerified as i, initStageSecrets as in, bucketPolicies as it, STORAGE_KEY_PAIR as j, describeServices as jt, DevServicesNeedServerTarget as k, storageBackendFor as kt, setDnsRecord as l, bucketClient as lt, withGeneratedSecrets as m, workerEnvKeys as mt, getBackupState as n, ownershipMarker as nn, applyPolicies as nt, recordRollback as o, storage_exports as on, postgresStatements as ot, DeployJournal as p, networkEnv as pt, FAKE_ENV as q, keystoreProject as qt, getGeneratedSecret as r, projectName as rn, applyPostgres as rt, setApplicationId as s, toEmbeddableSecrets as sn, quoteIdentifier as st, createEmptyState as t, markerOf as tn, applyBuckets as tt, setDnsVerification as u, pgClient as ut, dockerCommand as v, resourceName as vt, isMainFrontendApp as w, detectPackageManager as wt, workerDockerfileOf as x, imageLayout as xt, ensureDockerignore as y, hostFor as yt, requiredStageKeys as z, loadEnvFiles as zt };
+//#region src/secrets/stale.ts
+/**
+* Stored secrets an older gkm generated that now shadow a derived value.
+*
+* Before constructs, initialising a stage wrote an address for each app into
+* its custom secrets: `<APP>_DATABASE_URL` as a `postgresql://…@localhost`
+* URL with a password of its own, and `http://localhost:<port>` for a site or
+* an auth server. Those keys are now a construct's — `database.schema('AuthDatabase')`
+* provides `AUTH_DATABASE_URL`, `new BetterAuth('Auth')` provides `AUTH_URL`
+* — and a deploy derives them. A value the stage holds is a value set by hand,
+* and set by hand wins: the container is handed `localhost`, where nothing
+* answers, with a password no role has.
+*
+* So a deploy refuses such a stage rather than run it, naming each key and
+* the command that removes it. Nothing is deleted for the user: the value is
+* theirs, and only they can say it is stale. A URL that names a real host — a
+* managed database — is a deliberate choice and still wins.
+*/
+/** The kinds whose URL an older gkm wrote into a stage's secrets. */
+const ADDRESSED = /* @__PURE__ */ new Set([
+	"database",
+	"database-reader",
+	"database-schema",
+	"rest-api",
+	"site"
+]);
+/** Hosts that are this machine — never anything, inside a container. */
+const LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1"
+]);
+/**
+* A stage holds a construct's address as a custom secret, pointing at
+* `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
+* generated. Set by hand wins over derived, so the app would be handed it.
+*/
+var StaleStageSecrets = class extends Error {
+	stage;
+	stale;
+	constructor(stage, stale) {
+		const one = stale.length === 1;
+		super(`The stage '${stage}' holds ${one ? "a value" : "values"} an older gkm generated for ${one ? "an address a construct" : "addresses constructs"} now ${one ? "provides" : "provide"}:\n` + stale.map((s) => `  ${s.key}: ${s.construct}'s, stored pointing at ${s.host}`).join("\n") + `
+A stored value wins over the derived one, so the app would be handed an address where nothing answers inside its container. Remove ${one ? "it" : "each"}, and the construct's own value is used:\n` + stale.map((s) => `  gkm secrets:unset ${s.key} --stage ${stage}`).join("\n") + "\nA managed service set with its real host is not affected.");
+		this.stage = stage;
+		this.stale = stale;
+		this.name = "StaleStageSecrets";
+	}
+};
+/** The host a stored value names, if it is a URL. */
+function hostOf(value) {
+	try {
+		return new URL(value).hostname;
+	} catch {
+		return;
+	}
+}
+/**
+* Each stored key that a construct provides an address for, holding an
+* address on this machine.
+*/
+function staleStageSecrets(manifest, supplied) {
+	const stale = [];
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (!ADDRESSED.has(declaration.kind)) continue;
+		const key = providedKeyFor(id, declaration.kind, "url");
+		const value = supplied[key];
+		if (value === void 0) continue;
+		const host = hostOf(value);
+		if (host === void 0 || !LOOPBACK.has(host)) continue;
+		stale.push({
+			key,
+			construct: id,
+			host
+		});
+	}
+	return stale.sort((a, b) => a.key.localeCompare(b.key));
+}
+/**
+* Refuse a stage whose stored secrets would shadow a construct's address with
+* `localhost`.
+*
+* @throws {StaleStageSecrets} naming each key and the command removing it
+*/
+function assertNoStaleSecrets(options) {
+	const stale = staleStageSecrets(options.manifest, options.supplied);
+	if (stale.length > 0) throw new StaleStageSecrets(options.stage, stale);
+}
+//#endregion
+export { workspace_exports as $, readKey as $t, DevServicesNeedServerTarget as A, eventsBackendFor as At, requiredStageKeys as B, findAvailablePort as Bt, validateImageRef as C, TURBO_VERSION as Ct, isOtlpDestination as D, imageBuildCredentials as Dt, resolveHost as E, findBuildRoot as Et, devServicesUsed as F, fakeKey as Ft, workerEntryDir as G, isRemoteStore as Gt, workerUnits as H, loadEnvFiles as Ht, externalServices as I, portKeys as It, FAKE_ENV as J, store_exports as Jt, QueueGenerator as K, secretsStoreFor as Kt, manifestServiceDeclarations as L, primaryPortKey as Lt, STORAGE_KEY_PAIR as M, storageBackendFor as Mt, UnknownDevService as N, DEFAULT_IMAGES as Nt, otelEnv as O, isImageBuild as Ot, assertExternalServices as P, describeServices as Pt, reconcileWorkspace as Q, projectKey as Qt, parseDevServices as R, createCredentialsPreload as Rt, workerDockerfileOf as S, imageLayout as St, isMainFrontendApp as T, detectPackageManager as Tt, WorkerGenerator as U, loadSecretsForApp as Ut, suppliedOnly as V, isPortAvailable as Vt, workerBundleName as W, prepareEntryCredentials as Wt, constructGlobs as X, getKeyPath as Xt, backendsOf as Y, FileSecretsStore as Yt, derivedContainers as Z, keystoreProject as Zt, DockerPushFailed as _, localRolePassword as _t, isDnsVerified as a, markerOf as an, bucketPolicies as at, ensureDockerignore as b, hostFor as bt, setApplicationId as c, initStageSecrets as cn, quoteIdentifier as ct, setDnsVerification as d, toEmbeddableSecrets as dn, pgClient as dt, applicationName as en, LOCAL_CA_PATH as et, setGeneratedSecret as f, withCustomSecret as fn, appEnvKeys as ft, DockerBuildFailed as g, envFor as gt, withGeneratedSecrets as h, workerEnvKeys as ht, getGeneratedSecret as i, isOwnedBy as in, applyPostgres as it, ExternalServicesNotConfigured as j, providerOf as jt, DEV_SERVICES as k, cacheBackendFor as kt, setBackupState as l, maskPassword as ln, composeFor as lt, DeployJournal as m, networkEnv as mt, createEmptyState as n, imageName as nn, applyBuckets as nt, recordRelease as o, ownershipMarker as on, postgresDatabaseNames as ot, setPostgresBackupId as p, dockerfileOf as pt, CronGenerator as q, storeFromConfig as qt, getBackupState as r, imageRef as rn, applyPolicies as rt, recordRollback as s, projectName as sn, postgresStatements as st, assertNoStaleSecrets as t, deployIdentity as tn, forgetState as tt, setDnsRecord as u, storage_exports as un, bucketClient as ut, appDockerfile as v, planFor as vt, NoDomainForStage as w, WORKER_PORT as wt, workerDockerfile as x, composeBuildPaths as xt, dockerCommand as y, resourceName as yt, reportDevServices as z, createEntryWrapper as zt };
 
-//# sourceMappingURL=state-BrWIOce_.mjs.map
+//# sourceMappingURL=stale-DGzpiN5S.mjs.map