npm - @geekmidas/cli - Versions diffs - 10.0.0-alpha.76 → 10.0.0-alpha.77 - Mend

@geekmidas/cli 10.0.0-alpha.76 → 10.0.0-alpha.77

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (99) hide show

package/dist/{bundler-DO6bHhnb.mjs.map → bundler-DgO_EMVs.mjs.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"bundler-DO6bHhnb.mjs","names":[],"sources":["../src/build/bundler.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\n\n/*\n Banner to inject into ESM bundle for CJS compatibility.\n * Creates a `require` function using Node's createRequire for packages\n * that internally use CommonJS require() for Node builtins.\n /\nconst ESM_CJS_COMPAT_BANNER =\n\t'import { createRequire } from \"module\"; const require = createRequire(import.meta.url);';\n\nexport interface BundleOptions {\n\t/* Entry point file (e.g., .gkm/server/server.ts) /\n\tentryPoint: string;\n\t/* Output directory for bundled files /\n\toutputDir: string;\n\t/* The bundle's file name in `outputDir`. Defaults to `server.mjs`. /\n\toutfile?: string;\n\t/* Minify the output (default: true) /\n\tminify: boolean;\n\t/* Generate sourcemaps (default: false) /\n\tsourcemap: boolean;\n\t/* Packages to exclude from bundling /\n\texternal: string[];\n\t/* Stage for secrets injection (optional) /\n\tstage?: string;\n\t/* Constructs to validate environment variables for /\n\tconstructs?: Construct[];\n}\n\nexport interface BundleResult {\n\t/* Path to the bundled output /\n\toutputPath: string;\n\t/* Ephemeral master key for deployment (only if stage was provided) /\n\tmasterKey?: string;\n}\n\n/\n The esbuild binary, resolved from this package rather than from PATH.\n \n It used to be `npx esbuild`, which is two assumptions: that esbuild is\n * installed somewhere npx can find, and that the app's directory is where to\n * look. Neither holds — the CLI did not depend on esbuild at all, so a deploy\n * run from an app that had not installed it failed at the bundle step with\n * `sh: esbuild: command not found`, after provisioning had already happened.\n \n The same fix `bin/gkm.mjs` makes for tsx: resolve from this package's own\n * `node_modules`, so the tool the CLI shells out to is the one it depends on.\n /\nfunction esbuildBinary(): string {\n\tconst require = createRequire(import.meta.url);\n\n\ttry {\n\t\t// The package root, then its bin — `require.resolve('esbuild')` gives the\n\t\t// JS entry point, which is a library rather than the CLI.\n\t\tconst pkg = require.resolve('esbuild/package.json');\n\t\treturn join(dirname(pkg), 'bin', 'esbuild');\n\t} catch {\n\t\t// Better a PATH lookup than a hard failure: a project that installed\n\t\t// esbuild itself still works.\n\t\treturn 'esbuild';\n\t}\n}\n\n/\n Collect the environment variables a build cannot proceed without.\n \n Uses the SnifferEnvironmentParser to detect which env vars each service\n * reads, and keeps only the ones it cannot do without. `markOptional` is what\n * separates them: the sniffer already knows which reads went through\n * `.optional()` or `.default()`, and asking for that distinction is the\n * difference between a build that stops and one that proceeds correctly.\n \n Without it, a key that is absent by design failed the build. A surface\n * publishes `AUTH_COOKIE_DOMAIN` only when there is a domain to widen a cookie\n * to — one host has nothing to share it with, so the derivation correctly\n * yields nothing, and Better Auth reads it as optional for exactly that\n * reason. Treating every sniffed read as required made the honest answer\n * indistinguishable from a missing secret.\n \n @param constructs - Array of constructs to analyze\n * @returns Deduplicated, sorted names of the required variables\n /\nasync function collectRequiredEnvVars(\n\tconstructs: Construct[],\n): Promise<string[]> {\n\t// A key read optionally by one construct and required by another stays\n\t// required: the strictest read is the one that fails at runtime, and taking\n\t// the union of the required reads is what says so.\n\tconst required = new Set<string>();\n\n\tfor (const construct of constructs) {\n\t\tfor (const name of await construct.getEnvironment({ markOptional: true })) {\n\t\t\tif (!name.endsWith('?')) required.add(name);\n\t\t}\n\t}\n\n\treturn Array.from(required).sort();\n}\n\n/\n Bundle the server application using esbuild.\n * Creates a fully standalone bundle with all dependencies included.\n \n @param options - Bundle configuration options\n * @returns Bundle result with output path and optional master key\n */\n\nexport async function bundleServer(\n\toptions: BundleOptions,\n): Promise<BundleResult> {\n\tconst {\n\t\tentryPoint,\n\t\toutputDir,\n\t\tminify,\n\t\tsourcemap,\n\t\texternal,\n\t\tstage,\n\t\tconstructs,\n\t} = options;\n\n\t// Ensure output directory exists\n\tawait mkdir(outputDir, { recursive: true });\n\n\tconst mjsOutput = join(outputDir, options.outfile ?? 'server.mjs');\n\n\t// Build command-line arguments for esbuild\n\tconst args = [\n\t\tesbuildBinary(),\n\t\tentryPoint,\n\t\t'--bundle',\n\t\t'--platform=node',\n\t\t'--target=node22',\n\t\t'--format=esm',\n\t\t`--outfile=${mjsOutput}`,\n\t\t'--packages=bundle', // Bundle all dependencies for standalone output\n\t\t`--banner:js=${ESM_CJS_COMPAT_BANNER}`, // CJS compatibility for packages like pino\n\t];\n\n\tif (minify) {\n\t\t// Names kept: an error's class name is what a log line's `err.type` and\n\t\t// a response's `name` say, and minified they read `_6`.\n\t\targs.push('--minify', '--keep-names');\n\t}\n\n\tif (sourcemap) {\n\t\targs.push('--sourcemap');\n\t}\n\n\t// Add external packages (user-specified)\n\tfor (const ext of external) {\n\t\targs.push(`--external:${ext}`);\n\t}\n\n\t// Handle secrets injection if stage is provided\n\tlet masterKey: string \| undefined;\n\n\tif (stage) {\n\t\tconst {\n\t\t\ttoEmbeddableSecrets,\n\t\t\tvalidateEnvironmentVariables,\n\t\t\tinitStageSecrets,\n\t\t} = await import('../secrets/storage');\n\t\tconst { FileSecretsStore, secretsStoreFor } = await import(\n\t\t\t'../secrets/store'\n\t\t);\n\t\tconst { ConfigNotFound, loadWorkspaceSettings } = await import('../config');\n\t\tconst { encryptSecrets, generateDefineOptions } = await import(\n\t\t\t'../secrets/encryption'\n\t\t);\n\n\t\t// The stage's own store — SSM or Secrets Manager for a deployed stage\n\t\t// kept there. Outside\n\t\t// any workspace nothing names one, so it is the file.\n\t\tconst store = await loadWorkspaceSettings().then(\n\t\t\t(workspace) => secretsStoreFor(workspace, stage),\n\t\t\t(error) => {\n\t\t\t\tif (error instanceof ConfigNotFound) {\n\t\t\t\t\treturn new FileSecretsStore(process.cwd());\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t},\n\t\t);\n\t\tlet secrets = await store.read(stage);\n\n\t\tif (!secrets) {\n\t\t\t// Auto-initialize secrets for the stage\n\t\t\tconsole.log(` Initializing secrets for stage \"${stage}\"...`);\n\t\t\tsecrets = initStageSecrets(stage);\n\t\t\tawait store.write(stage, secrets);\n\t\t\tconsole.log(` ✓ Created the \"${stage}\" secrets (${store.name})`);\n\t\t}\n\n\t\t// Validate environment variables if constructs are provided\n\t\tif (constructs && constructs.length > 0) {\n\t\t\tconsole.log(' Analyzing environment variable requirements...');\n\t\t\tconst requiredVars = await collectRequiredEnvVars(constructs);\n\n\t\t\tif (requiredVars.length > 0) {\n\t\t\t\tconst validation = validateEnvironmentVariables(requiredVars, secrets);\n\n\t\t\t\tif (!validation.valid) {\n\t\t\t\t\tconst errorMessage = [\n\t\t\t\t\t\t`Missing environment variables for stage \"${stage}\":`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t...validation.missing.map((v) => ` ❌ ${v}`),\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'To fix this, either:',\n\t\t\t\t\t\t` 1. Add the missing variables to the \"${stage}\" secrets using:`,\n\t\t\t\t\t\t` gkm secrets:set <KEY> <VALUE> --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t` 2. Or import from a JSON file:`,\n\t\t\t\t\t\t` gkm secrets:import secrets.json --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'Required variables:',\n\t\t\t\t\t\t...validation.required.map((v) =>\n\t\t\t\t\t\t\tvalidation.missing.includes(v) ? ` ❌ ${v}` : ` ✓ ${v}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t].join('\\n');\n\n\t\t\t\t\tthrow new Error(errorMessage);\n\t\t\t\t}\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t` ✓ All ${requiredVars.length} required environment variables found`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Convert to embeddable format and encrypt\n\t\tconst embeddable = toEmbeddableSecrets(secrets);\n\t\tconst encrypted = encryptSecrets(embeddable);\n\t\tmasterKey = encrypted.masterKey;\n\n\t\t// Add define options for build-time injection using esbuild's --define:KEY=VALUE format\n\t\tconst defines = generateDefineOptions(encrypted);\n\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t// `value` is already a JS string literal; quoting it again would\n\t\t\t// embed the quotes, and the IV would not parse as hex.\n\t\t\targs.push(`--define:${key}=${value}`);\n\t\t}\n\n\t\tconsole.log(` Secrets encrypted for stage \"${stage}\"`);\n\t} else {\n\t\t// Credentials encrypted elsewhere — an image build hands them in as a\n\t\t// BuildKit secret and writes them beside the app's `.gkm/server` — are\n\t\t// embedded as they are; whoever encrypted them holds the key.\n\t\tconst gkmDir = join(outputDir, '..', '..');\n\t\tconst encryptedPath = join(gkmDir, 'credentials.enc');\n\t\tconst ivPath = join(gkmDir, 'credentials.iv');\n\t\tif (existsSync(encryptedPath) && existsSync(ivPath)) {\n\t\t\tconst { generateDefineOptions } = await import('../secrets/encryption');\n\t\t\tconst defines = generateDefineOptions({\n\t\t\t\tencrypted: readFileSync(encryptedPath, 'utf-8').trim(),\n\t\t\t\tiv: readFileSync(ivPath, 'utf-8').trim(),\n\t\t\t\tmasterKey: '',\n\t\t\t});\n\t\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t\targs.push(`--define:${key}=${value}`);\n\t\t\t}\n\t\t\tconsole.log(' Embedded the encrypted credentials the build was given');\n\t\t}\n\t}\n\n\ttry {\n\t\t// Run esbuild with command-line arguments\n\t\tconst [cmd, ...cmdArgs] = args as [string, ...string[]];\n\t\tconst result = spawnSync(cmd, cmdArgs, {\n\t\t\tcwd: process.cwd(),\n\t\t\tstdio: 'inherit',\n\t\t\tshell: process.platform === 'win32', // Only use shell on Windows for npx resolution\n\t\t});\n\n\t\tif (result.error) {\n\t\t\tthrow result.error;\n\t\t}\n\t\tif (result.status !== 0) {\n\t\t\tthrow new Error(`esbuild exited with code ${result.status}`);\n\t\t}\n\n\t\t// Add shebang to the bundled file\n\t\tconst { readFile } = await import('node:fs/promises');\n\t\tconst content = await readFile(mjsOutput, 'utf-8');\n\t\tif (!content.startsWith('#!')) {\n\t\t\tawait writeFile(mjsOutput, `#!/usr/bin/env node\\n${content}`);\n\t\t}\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to bundle server: ${error instanceof Error ? error.message : 'Unknown error'}`,\n\t\t);\n\t}\n\n\treturn {\n\t\toutputPath: mjsOutput,\n\t\tmasterKey,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,wBACL;;;;;;;;;;;;;AAwCD,SAAS,gBAAwB;CAChC,MAAM,UAAU,cAAc,YAAY,GAAG;CAE7C,IAAI;EAGH,MAAM,MAAM,QAAQ,QAAQ,sBAAsB;EAClD,OAAO,KAAK,QAAQ,GAAG,GAAG,OAAO,SAAS;CAC3C,QAAQ;EAGP,OAAO;CACR;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,uBACd,YACoB;CAIpB,MAAM,2BAAW,IAAI,IAAY;CAEjC,KAAK,MAAM,aAAa,YACvB,KAAK,MAAM,QAAQ,MAAM,UAAU,eAAe,EAAE,cAAc,KAAK,CAAC,GACvE,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,SAAS,IAAI,IAAI;CAI5C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;AAClC;;;;;;;;AAUA,eAAsB,aACrB,SACwB;CACxB,MAAM,EACL,YACA,WACA,QACA,WACA,UACA,OACA,eACG;CAGJ,MAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;CAE1C,MAAM,YAAY,KAAK,WAAW,QAAQ,WAAW,YAAY;CAGjE,MAAM,OAAO;EACZ,cAAc;EACd;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA,eAAe;CAChB;CAEA,IAAI,QAGH,KAAK,KAAK,YAAY,cAAc;CAGrC,IAAI,WACH,KAAK,KAAK,aAAa;CAIxB,KAAK,MAAM,OAAO,UACjB,KAAK,KAAK,cAAc,KAAK;CAI9B,IAAI;CAEJ,IAAI,OAAO;EACV,MAAM,EACL,qBACA,8BACA,qBACG,MAAM,OAAO,uBAAqB,CAAA,MAAA,MAAA,EAAA,EAAA;EACtC,MAAM,EAAE,kBAAkB,oBAAoB,MAAM,OACnD,uBACA,CAAA,MAAA,MAAA,EAAA,EAAA;EACD,MAAM,EAAE,gBAAgB,0BAA0B,MAAM,OAAO;EAC/D,MAAM,EAAE,gBAAgB,0BAA0B,MAAM,OACvD,yBACA,CAAA,MAAA,MAAA,EAAA,CAAA;EAKD,MAAM,QAAQ,MAAM,sBAAsB,CAAC,CAAC,MAC1C,cAAc,gBAAgB,WAAW,KAAK,IAC9C,UAAU;GACV,IAAI,iBAAiB,gBACpB,OAAO,IAAI,iBAAiB,QAAQ,IAAI,CAAC;GAE1C,MAAM;EACP,CACD;EACA,IAAI,UAAU,MAAM,MAAM,KAAK,KAAK;EAEpC,IAAI,CAAC,SAAS;GAEb,QAAQ,IAAI,qCAAqC,MAAM,KAAK;GAC5D,UAAU,iBAAiB,KAAK;GAChC,MAAM,MAAM,MAAM,OAAO,OAAO;GAChC,QAAQ,IAAI,oBAAoB,MAAM,aAAa,MAAM,KAAK,EAAE;EACjE;EAGA,IAAI,cAAc,WAAW,SAAS,GAAG;GACxC,QAAQ,IAAI,kDAAkD;GAC9D,MAAM,eAAe,MAAM,uBAAuB,UAAU;GAE5D,IAAI,aAAa,SAAS,GAAG;IAC5B,MAAM,aAAa,6BAA6B,cAAc,OAAO;IAErE,IAAI,CAAC,WAAW,OAAO;KACtB,MAAM,eAAe;MACpB,4CAA4C,MAAM;MAClD;MACA,GAAG,WAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;MAC3C;MACA;MACA,0CAA0C,MAAM;MAChD,8CAA8C;MAC9C;MACA;MACA,gDAAgD;MAChD;MACA;MACA,GAAG,WAAW,SAAS,KAAK,MAC3B,WAAW,QAAQ,SAAS,CAAC,IAAI,OAAO,MAAM,OAAO,GACtD;KACD,CAAC,CAAC,KAAK,IAAI;KAEX,MAAM,IAAI,MAAM,YAAY;IAC7B;IAEA,QAAQ,IACP,WAAW,aAAa,OAAO,sCAChC;GACD;EACD;EAIA,MAAM,YAAY,eADC,oBAAoB,OACG,CAAC;EAC3C,YAAY,UAAU;EAGtB,MAAM,UAAU,sBAAsB,SAAS;EAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAGhD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;EAGrC,QAAQ,IAAI,kCAAkC,MAAM,EAAE;CACvD,OAAO;EAIN,MAAM,SAAS,KAAK,WAAW,MAAM,IAAI;EACzC,MAAM,gBAAgB,KAAK,QAAQ,iBAAiB;EACpD,MAAM,SAAS,KAAK,QAAQ,gBAAgB;EAC5C,IAAI,WAAW,aAAa,KAAK,WAAW,MAAM,GAAG;GACpD,MAAM,EAAE,0BAA0B,MAAM,OAAO,yBAAwB,CAAA,MAAA,MAAA,EAAA,CAAA;GACvE,MAAM,UAAU,sBAAsB;IACrC,WAAW,aAAa,eAAe,OAAO,CAAC,CAAC,KAAK;IACrD,IAAI,aAAa,QAAQ,OAAO,CAAC,CAAC,KAAK;IACvC,WAAW;GACZ,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAChD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;GAErC,QAAQ,IAAI,0DAA0D;EACvE;CACD;CAEA,IAAI;EAEH,MAAM,CAAC,KAAK,GAAG,WAAW;EAC1B,MAAM,SAAS,UAAU,KAAK,SAAS;GACtC,KAAK,QAAQ,IAAI;GACjB,OAAO;GACP,OAAO,QAAQ,aAAa;EAC7B,CAAC;EAED,IAAI,OAAO,OACV,MAAM,OAAO;EAEd,IAAI,OAAO,WAAW,GACrB,MAAM,IAAI,MAAM,4BAA4B,OAAO,QAAQ;EAI5D,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,UAAU,MAAM,SAAS,WAAW,OAAO;EACjD,IAAI,CAAC,QAAQ,WAAW,IAAI,GAC3B,MAAM,UAAU,WAAW,wBAAwB,SAAS;CAE9D,SAAS,OAAO;EACf,MAAM,IAAI,MACT,4BAA4B,iBAAiB,QAAQ,MAAM,UAAU,iBACtE;CACD;CAEA,OAAO;EACN,YAAY;EACZ;CACD;AACD"}
1	+ {"version":3,"file":"bundler-DgO_EMVs.mjs","names":[],"sources":["../src/build/bundler.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\n\n/*\n Banner to inject into ESM bundle for CJS compatibility.\n * Creates a `require` function using Node's createRequire for packages\n * that internally use CommonJS require() for Node builtins.\n /\nconst ESM_CJS_COMPAT_BANNER =\n\t'import { createRequire } from \"module\"; const require = createRequire(import.meta.url);';\n\nexport interface BundleOptions {\n\t/* Entry point file (e.g., .gkm/server/server.ts) /\n\tentryPoint: string;\n\t/* Output directory for bundled files /\n\toutputDir: string;\n\t/* The bundle's file name in `outputDir`. Defaults to `server.mjs`. /\n\toutfile?: string;\n\t/* Minify the output (default: true) /\n\tminify: boolean;\n\t/* Generate sourcemaps (default: false) /\n\tsourcemap: boolean;\n\t/* Packages to exclude from bundling /\n\texternal: string[];\n\t/* Stage for secrets injection (optional) /\n\tstage?: string;\n\t/* Constructs to validate environment variables for /\n\tconstructs?: Construct[];\n}\n\nexport interface BundleResult {\n\t/* Path to the bundled output /\n\toutputPath: string;\n\t/* Ephemeral master key for deployment (only if stage was provided) /\n\tmasterKey?: string;\n}\n\n/\n The esbuild binary, resolved from this package rather than from PATH.\n \n It used to be `npx esbuild`, which is two assumptions: that esbuild is\n * installed somewhere npx can find, and that the app's directory is where to\n * look. Neither holds — the CLI did not depend on esbuild at all, so a deploy\n * run from an app that had not installed it failed at the bundle step with\n * `sh: esbuild: command not found`, after provisioning had already happened.\n \n The same fix `bin/gkm.mjs` makes for tsx: resolve from this package's own\n * `node_modules`, so the tool the CLI shells out to is the one it depends on.\n /\nfunction esbuildBinary(): string {\n\tconst require = createRequire(import.meta.url);\n\n\ttry {\n\t\t// The package root, then its bin — `require.resolve('esbuild')` gives the\n\t\t// JS entry point, which is a library rather than the CLI.\n\t\tconst pkg = require.resolve('esbuild/package.json');\n\t\treturn join(dirname(pkg), 'bin', 'esbuild');\n\t} catch {\n\t\t// Better a PATH lookup than a hard failure: a project that installed\n\t\t// esbuild itself still works.\n\t\treturn 'esbuild';\n\t}\n}\n\n/\n Collect the environment variables a build cannot proceed without.\n \n Uses the SnifferEnvironmentParser to detect which env vars each service\n * reads, and keeps only the ones it cannot do without. `markOptional` is what\n * separates them: the sniffer already knows which reads went through\n * `.optional()` or `.default()`, and asking for that distinction is the\n * difference between a build that stops and one that proceeds correctly.\n \n Without it, a key that is absent by design failed the build. A surface\n * publishes `AUTH_COOKIE_DOMAIN` only when there is a domain to widen a cookie\n * to — one host has nothing to share it with, so the derivation correctly\n * yields nothing, and Better Auth reads it as optional for exactly that\n * reason. Treating every sniffed read as required made the honest answer\n * indistinguishable from a missing secret.\n \n @param constructs - Array of constructs to analyze\n * @returns Deduplicated, sorted names of the required variables\n /\nasync function collectRequiredEnvVars(\n\tconstructs: Construct[],\n): Promise<string[]> {\n\t// A key read optionally by one construct and required by another stays\n\t// required: the strictest read is the one that fails at runtime, and taking\n\t// the union of the required reads is what says so.\n\tconst required = new Set<string>();\n\n\tfor (const construct of constructs) {\n\t\tfor (const name of await construct.getEnvironment({ markOptional: true })) {\n\t\t\tif (!name.endsWith('?')) required.add(name);\n\t\t}\n\t}\n\n\treturn Array.from(required).sort();\n}\n\n/\n Bundle the server application using esbuild.\n * Creates a fully standalone bundle with all dependencies included.\n \n @param options - Bundle configuration options\n * @returns Bundle result with output path and optional master key\n */\n\nexport async function bundleServer(\n\toptions: BundleOptions,\n): Promise<BundleResult> {\n\tconst {\n\t\tentryPoint,\n\t\toutputDir,\n\t\tminify,\n\t\tsourcemap,\n\t\texternal,\n\t\tstage,\n\t\tconstructs,\n\t} = options;\n\n\t// Ensure output directory exists\n\tawait mkdir(outputDir, { recursive: true });\n\n\tconst mjsOutput = join(outputDir, options.outfile ?? 'server.mjs');\n\n\t// Build command-line arguments for esbuild\n\tconst args = [\n\t\tesbuildBinary(),\n\t\tentryPoint,\n\t\t'--bundle',\n\t\t'--platform=node',\n\t\t'--target=node22',\n\t\t'--format=esm',\n\t\t`--outfile=${mjsOutput}`,\n\t\t'--packages=bundle', // Bundle all dependencies for standalone output\n\t\t`--banner:js=${ESM_CJS_COMPAT_BANNER}`, // CJS compatibility for packages like pino\n\t];\n\n\tif (minify) {\n\t\t// Names kept: an error's class name is what a log line's `err.type` and\n\t\t// a response's `name` say, and minified they read `_6`.\n\t\targs.push('--minify', '--keep-names');\n\t}\n\n\tif (sourcemap) {\n\t\targs.push('--sourcemap');\n\t}\n\n\t// Add external packages (user-specified)\n\tfor (const ext of external) {\n\t\targs.push(`--external:${ext}`);\n\t}\n\n\t// Handle secrets injection if stage is provided\n\tlet masterKey: string \| undefined;\n\n\tif (stage) {\n\t\tconst {\n\t\t\ttoEmbeddableSecrets,\n\t\t\tvalidateEnvironmentVariables,\n\t\t\tinitStageSecrets,\n\t\t} = await import('../secrets/storage');\n\t\tconst { FileSecretsStore, secretsStoreFor } = await import(\n\t\t\t'../secrets/store'\n\t\t);\n\t\tconst { ConfigNotFound, loadWorkspaceSettings } = await import('../config');\n\t\tconst { encryptSecrets, generateDefineOptions } = await import(\n\t\t\t'../secrets/encryption'\n\t\t);\n\n\t\t// The stage's own store — SSM or Secrets Manager for a deployed stage\n\t\t// kept there. Outside\n\t\t// any workspace nothing names one, so it is the file.\n\t\tconst store = await loadWorkspaceSettings().then(\n\t\t\t(workspace) => secretsStoreFor(workspace, stage),\n\t\t\t(error) => {\n\t\t\t\tif (error instanceof ConfigNotFound) {\n\t\t\t\t\treturn new FileSecretsStore(process.cwd());\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t},\n\t\t);\n\t\tlet secrets = await store.read(stage);\n\n\t\tif (!secrets) {\n\t\t\t// Auto-initialize secrets for the stage\n\t\t\tconsole.log(` Initializing secrets for stage \"${stage}\"...`);\n\t\t\tsecrets = initStageSecrets(stage);\n\t\t\tawait store.write(stage, secrets);\n\t\t\tconsole.log(` ✓ Created the \"${stage}\" secrets (${store.name})`);\n\t\t}\n\n\t\t// Validate environment variables if constructs are provided\n\t\tif (constructs && constructs.length > 0) {\n\t\t\tconsole.log(' Analyzing environment variable requirements...');\n\t\t\tconst requiredVars = await collectRequiredEnvVars(constructs);\n\n\t\t\tif (requiredVars.length > 0) {\n\t\t\t\tconst validation = validateEnvironmentVariables(requiredVars, secrets);\n\n\t\t\t\tif (!validation.valid) {\n\t\t\t\t\tconst errorMessage = [\n\t\t\t\t\t\t`Missing environment variables for stage \"${stage}\":`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t...validation.missing.map((v) => ` ❌ ${v}`),\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'To fix this, either:',\n\t\t\t\t\t\t` 1. Add the missing variables to the \"${stage}\" secrets using:`,\n\t\t\t\t\t\t` gkm secrets:set <KEY> <VALUE> --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t` 2. Or import from a JSON file:`,\n\t\t\t\t\t\t` gkm secrets:import secrets.json --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'Required variables:',\n\t\t\t\t\t\t...validation.required.map((v) =>\n\t\t\t\t\t\t\tvalidation.missing.includes(v) ? ` ❌ ${v}` : ` ✓ ${v}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t].join('\\n');\n\n\t\t\t\t\tthrow new Error(errorMessage);\n\t\t\t\t}\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t` ✓ All ${requiredVars.length} required environment variables found`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Convert to embeddable format and encrypt\n\t\tconst embeddable = toEmbeddableSecrets(secrets);\n\t\tconst encrypted = encryptSecrets(embeddable);\n\t\tmasterKey = encrypted.masterKey;\n\n\t\t// Add define options for build-time injection using esbuild's --define:KEY=VALUE format\n\t\tconst defines = generateDefineOptions(encrypted);\n\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t// `value` is already a JS string literal; quoting it again would\n\t\t\t// embed the quotes, and the IV would not parse as hex.\n\t\t\targs.push(`--define:${key}=${value}`);\n\t\t}\n\n\t\tconsole.log(` Secrets encrypted for stage \"${stage}\"`);\n\t} else {\n\t\t// Credentials encrypted elsewhere — an image build hands them in as a\n\t\t// BuildKit secret and writes them beside the app's `.gkm/server` — are\n\t\t// embedded as they are; whoever encrypted them holds the key.\n\t\tconst gkmDir = join(outputDir, '..', '..');\n\t\tconst encryptedPath = join(gkmDir, 'credentials.enc');\n\t\tconst ivPath = join(gkmDir, 'credentials.iv');\n\t\tif (existsSync(encryptedPath) && existsSync(ivPath)) {\n\t\t\tconst { generateDefineOptions } = await import('../secrets/encryption');\n\t\t\tconst defines = generateDefineOptions({\n\t\t\t\tencrypted: readFileSync(encryptedPath, 'utf-8').trim(),\n\t\t\t\tiv: readFileSync(ivPath, 'utf-8').trim(),\n\t\t\t\tmasterKey: '',\n\t\t\t});\n\t\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t\targs.push(`--define:${key}=${value}`);\n\t\t\t}\n\t\t\tconsole.log(' Embedded the encrypted credentials the build was given');\n\t\t}\n\t}\n\n\ttry {\n\t\t// Run esbuild with command-line arguments\n\t\tconst [cmd, ...cmdArgs] = args as [string, ...string[]];\n\t\tconst result = spawnSync(cmd, cmdArgs, {\n\t\t\tcwd: process.cwd(),\n\t\t\tstdio: 'inherit',\n\t\t\tshell: process.platform === 'win32', // Only use shell on Windows for npx resolution\n\t\t});\n\n\t\tif (result.error) {\n\t\t\tthrow result.error;\n\t\t}\n\t\tif (result.status !== 0) {\n\t\t\tthrow new Error(`esbuild exited with code ${result.status}`);\n\t\t}\n\n\t\t// Add shebang to the bundled file\n\t\tconst { readFile } = await import('node:fs/promises');\n\t\tconst content = await readFile(mjsOutput, 'utf-8');\n\t\tif (!content.startsWith('#!')) {\n\t\t\tawait writeFile(mjsOutput, `#!/usr/bin/env node\\n${content}`);\n\t\t}\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to bundle server: ${error instanceof Error ? error.message : 'Unknown error'}`,\n\t\t);\n\t}\n\n\treturn {\n\t\toutputPath: mjsOutput,\n\t\tmasterKey,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,wBACL;;;;;;;;;;;;;AAwCD,SAAS,gBAAwB;CAChC,MAAM,UAAU,cAAc,YAAY,GAAG;CAE7C,IAAI;EAGH,MAAM,MAAM,QAAQ,QAAQ,sBAAsB;EAClD,OAAO,KAAK,QAAQ,GAAG,GAAG,OAAO,SAAS;CAC3C,QAAQ;EAGP,OAAO;CACR;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,uBACd,YACoB;CAIpB,MAAM,2BAAW,IAAI,IAAY;CAEjC,KAAK,MAAM,aAAa,YACvB,KAAK,MAAM,QAAQ,MAAM,UAAU,eAAe,EAAE,cAAc,KAAK,CAAC,GACvE,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,SAAS,IAAI,IAAI;CAI5C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;AAClC;;;;;;;;AAUA,eAAsB,aACrB,SACwB;CACxB,MAAM,EACL,YACA,WACA,QACA,WACA,UACA,OACA,eACG;CAGJ,MAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;CAE1C,MAAM,YAAY,KAAK,WAAW,QAAQ,WAAW,YAAY;CAGjE,MAAM,OAAO;EACZ,cAAc;EACd;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA,eAAe;CAChB;CAEA,IAAI,QAGH,KAAK,KAAK,YAAY,cAAc;CAGrC,IAAI,WACH,KAAK,KAAK,aAAa;CAIxB,KAAK,MAAM,OAAO,UACjB,KAAK,KAAK,cAAc,KAAK;CAI9B,IAAI;CAEJ,IAAI,OAAO;EACV,MAAM,EACL,qBACA,8BACA,qBACG,MAAM,OAAO,uBAAqB,CAAA,MAAA,MAAA,EAAA,EAAA;EACtC,MAAM,EAAE,kBAAkB,oBAAoB,MAAM,OACnD,uBACA,CAAA,MAAA,MAAA,EAAA,EAAA;EACD,MAAM,EAAE,gBAAgB,0BAA0B,MAAM,OAAO;EAC/D,MAAM,EAAE,gBAAgB,0BAA0B,MAAM,OACvD,yBACA,CAAA,MAAA,MAAA,EAAA,CAAA;EAKD,MAAM,QAAQ,MAAM,sBAAsB,CAAC,CAAC,MAC1C,cAAc,gBAAgB,WAAW,KAAK,IAC9C,UAAU;GACV,IAAI,iBAAiB,gBACpB,OAAO,IAAI,iBAAiB,QAAQ,IAAI,CAAC;GAE1C,MAAM;EACP,CACD;EACA,IAAI,UAAU,MAAM,MAAM,KAAK,KAAK;EAEpC,IAAI,CAAC,SAAS;GAEb,QAAQ,IAAI,qCAAqC,MAAM,KAAK;GAC5D,UAAU,iBAAiB,KAAK;GAChC,MAAM,MAAM,MAAM,OAAO,OAAO;GAChC,QAAQ,IAAI,oBAAoB,MAAM,aAAa,MAAM,KAAK,EAAE;EACjE;EAGA,IAAI,cAAc,WAAW,SAAS,GAAG;GACxC,QAAQ,IAAI,kDAAkD;GAC9D,MAAM,eAAe,MAAM,uBAAuB,UAAU;GAE5D,IAAI,aAAa,SAAS,GAAG;IAC5B,MAAM,aAAa,6BAA6B,cAAc,OAAO;IAErE,IAAI,CAAC,WAAW,OAAO;KACtB,MAAM,eAAe;MACpB,4CAA4C,MAAM;MAClD;MACA,GAAG,WAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;MAC3C;MACA;MACA,0CAA0C,MAAM;MAChD,8CAA8C;MAC9C;MACA;MACA,gDAAgD;MAChD;MACA;MACA,GAAG,WAAW,SAAS,KAAK,MAC3B,WAAW,QAAQ,SAAS,CAAC,IAAI,OAAO,MAAM,OAAO,GACtD;KACD,CAAC,CAAC,KAAK,IAAI;KAEX,MAAM,IAAI,MAAM,YAAY;IAC7B;IAEA,QAAQ,IACP,WAAW,aAAa,OAAO,sCAChC;GACD;EACD;EAIA,MAAM,YAAY,eADC,oBAAoB,OACG,CAAC;EAC3C,YAAY,UAAU;EAGtB,MAAM,UAAU,sBAAsB,SAAS;EAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAGhD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;EAGrC,QAAQ,IAAI,kCAAkC,MAAM,EAAE;CACvD,OAAO;EAIN,MAAM,SAAS,KAAK,WAAW,MAAM,IAAI;EACzC,MAAM,gBAAgB,KAAK,QAAQ,iBAAiB;EACpD,MAAM,SAAS,KAAK,QAAQ,gBAAgB;EAC5C,IAAI,WAAW,aAAa,KAAK,WAAW,MAAM,GAAG;GACpD,MAAM,EAAE,0BAA0B,MAAM,OAAO,yBAAwB,CAAA,MAAA,MAAA,EAAA,CAAA;GACvE,MAAM,UAAU,sBAAsB;IACrC,WAAW,aAAa,eAAe,OAAO,CAAC,CAAC,KAAK;IACrD,IAAI,aAAa,QAAQ,OAAO,CAAC,CAAC,KAAK;IACvC,WAAW;GACZ,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAChD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;GAErC,QAAQ,IAAI,0DAA0D;EACvE;CACD;CAEA,IAAI;EAEH,MAAM,CAAC,KAAK,GAAG,WAAW;EAC1B,MAAM,SAAS,UAAU,KAAK,SAAS;GACtC,KAAK,QAAQ,IAAI;GACjB,OAAO;GACP,OAAO,QAAQ,aAAa;EAC7B,CAAC;EAED,IAAI,OAAO,OACV,MAAM,OAAO;EAEd,IAAI,OAAO,WAAW,GACrB,MAAM,IAAI,MAAM,4BAA4B,OAAO,QAAQ;EAI5D,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,UAAU,MAAM,SAAS,WAAW,OAAO;EACjD,IAAI,CAAC,QAAQ,WAAW,IAAI,GAC3B,MAAM,UAAU,WAAW,wBAAwB,SAAS;CAE9D,SAAS,OAAO;EACf,MAAM,IAAI,MACT,4BAA4B,iBAAiB,QAAQ,MAAM,UAAU,iBACtE;CACD;CAEA,OAAO;EACN,YAAY;EACZ;CACD;AACD"}

package/dist/{cli-BCPOHmg9.mjs → cli-B74Ru-V1.mjs} RENAMED Viewed

@@ -1,6 +1,6 @@
 import { r as storedCredentials } from "./credentials-pAtB70k3.mjs";
-import { L as parseDevServices } from "./state-CUecOCNJ.mjs";
-import { t as deploy } from "./deploy-CVXEx7Nm.mjs";
+import { R as parseDevServices } from "./stale-DGzpiN5S.mjs";
+import { t as deploy } from "./deploy-Q6X6RXRG.mjs";
 import { i as formatError } from "./index.mjs";
 import { n as targetForProvider } from "./provider-q4lsYzYG.mjs";
 import { terminalCredentials } from "./terminal-BdvrmkaC.mjs";
@@ -73,4 +73,4 @@ async function deployCli(options, streams = { stdout: process.stdout }) {
 //#endregion
 export { deployCli };
-//# sourceMappingURL=cli-BCPOHmg9.mjs.map
+//# sourceMappingURL=cli-B74Ru-V1.mjs.map

package/dist/{cli-BCPOHmg9.mjs.map → cli-B74Ru-V1.mjs.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cli-~~BCPOHmg9~~.mjs","names":[],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/*\n `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n \n Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n /\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/* The project directory: `--cwd`, else where the command was run. /\n\tcwd: string;\n\t/* `--target`: where to deploy. Defaults to `deploy.default`. /\n\ttarget?: string;\n\t/* `--provider`, deprecated: `dokploy` means `--target dokploy`. /\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/\n\t Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t /\n\tjson?: boolean;\n\t/* Plan only: create, change, build and push nothing. /\n\tdryRun?: boolean;\n\t/* On a failed release, roll back every app, not only the failed ones. /\n\tatomic?: boolean;\n\t/* `--allow-dev-services minio,mailpit`, as typed. /\n\tallowDevServices?: string;\n}\n\n/* Where the command writes. The process's own streams, outside tests. /\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/\n Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAAS,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmB,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAM,OAAO;GAClB,GAAG;GACH,aAAa,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAM,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAM,OAAO;EAClB,GAAG;EACH,aAAa,oBAAoB,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}
1	+ {"version":3,"file":"cli-B74Ru-V1.mjs","names":[],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/*\n `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n \n Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n /\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/* The project directory: `--cwd`, else where the command was run. /\n\tcwd: string;\n\t/* `--target`: where to deploy. Defaults to `deploy.default`. /\n\ttarget?: string;\n\t/* `--provider`, deprecated: `dokploy` means `--target dokploy`. /\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/\n\t Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t /\n\tjson?: boolean;\n\t/* Plan only: create, change, build and push nothing. /\n\tdryRun?: boolean;\n\t/* On a failed release, roll back every app, not only the failed ones. /\n\tatomic?: boolean;\n\t/* `--allow-dev-services minio,mailpit`, as typed. /\n\tallowDevServices?: string;\n}\n\n/* Where the command writes. The process's own streams, outside tests. /\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/\n Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAAS,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmB,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAM,OAAO;GAClB,GAAG;GACH,aAAa,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAM,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAM,OAAO;EAClB,GAAG;EACH,aAAa,oBAAoB,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}

package/dist/{cli-CNanUB7a.cjs → cli-ZpFTMbGw.cjs} RENAMED Viewed

@@ -1,6 +1,6 @@
 const require_credentials = require("./credentials-BVs7mrtw.cjs");
-const require_state = require("./state-C2qi0iQw.cjs");
-const require_deploy = require("./deploy-CT3R9de9.cjs");
+const require_stale = require("./stale-yu2FkH3G.cjs");
+const require_deploy = require("./deploy-XHXi-_tL.cjs");
 const require_index = require("./index.cjs");
 const require_provider = require("./provider-C9_-45d5.cjs");
 const require_terminal = require("./terminal-BL5E0xbR.cjs");
@@ -27,7 +27,7 @@ async function deployCli(options, streams = { stdout: process.stdout }) {
 	}
 	let allowDevServices;
 	try {
-		allowDevServices = require_state.parseDevServices(options.allowDevServices);
+		allowDevServices = require_stale.parseDevServices(options.allowDevServices);
 	} catch (error) {
 		console.error(require_index.formatError(error));
 		return 1;
@@ -73,4 +73,4 @@ async function deployCli(options, streams = { stdout: process.stdout }) {
 //#endregion
 exports.deployCli = deployCli;
-//# sourceMappingURL=cli-CNanUB7a.cjs.map
+//# sourceMappingURL=cli-ZpFTMbGw.cjs.map

package/dist/{cli-CNanUB7a.cjs.map → cli-ZpFTMbGw.cjs.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cli-~~CNanUB7a~~.cjs","names":["targetForProvider","formatError","parseDevServices","deploy","storedCredentials","terminalCredentials"],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/*\n `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n \n Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n /\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/* The project directory: `--cwd`, else where the command was run. /\n\tcwd: string;\n\t/* `--target`: where to deploy. Defaults to `deploy.default`. /\n\ttarget?: string;\n\t/* `--provider`, deprecated: `dokploy` means `--target dokploy`. /\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/\n\t Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t /\n\tjson?: boolean;\n\t/* Plan only: create, change, build and push nothing. /\n\tdryRun?: boolean;\n\t/* On a failed release, roll back every app, not only the failed ones. /\n\tatomic?: boolean;\n\t/* `--allow-dev-services minio,mailpit`, as typed. /\n\tallowDevServices?: string;\n}\n\n/* Where the command writes. The process's own streams, outside tests. /\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/\n Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAASA,iBAAAA,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAMC,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmBC,cAAAA,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAMD,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAME,eAAAA,OAAO;GAClB,GAAG;GACH,aAAaC,oBAAAA,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAME,eAAAA,OAAO;EAClB,GAAG;EACH,aAAaE,iBAAAA,oBAAoBD,oBAAAA,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}
1	+ {"version":3,"file":"cli-ZpFTMbGw.cjs","names":["targetForProvider","formatError","parseDevServices","deploy","storedCredentials","terminalCredentials"],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/*\n `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n \n Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n /\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/* The project directory: `--cwd`, else where the command was run. /\n\tcwd: string;\n\t/* `--target`: where to deploy. Defaults to `deploy.default`. /\n\ttarget?: string;\n\t/* `--provider`, deprecated: `dokploy` means `--target dokploy`. /\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/\n\t Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t /\n\tjson?: boolean;\n\t/* Plan only: create, change, build and push nothing. /\n\tdryRun?: boolean;\n\t/* On a failed release, roll back every app, not only the failed ones. /\n\tatomic?: boolean;\n\t/* `--allow-dev-services minio,mailpit`, as typed. /\n\tallowDevServices?: string;\n}\n\n/* Where the command writes. The process's own streams, outside tests. /\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/\n Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAASA,iBAAAA,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAMC,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmBC,cAAAA,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAMD,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAME,eAAAA,OAAO;GAClB,GAAG;GACH,aAAaC,oBAAAA,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAME,eAAAA,OAAO;EAClB,GAAG;EACH,aAAaE,iBAAAA,oBAAoBD,oBAAAA,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}

package/dist/{compose-h_6oNnHC.cjs → compose-CePlrbUw.cjs} RENAMED Viewed

@@ -4,7 +4,7 @@ const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-DOm81oUo.cjs");
 const require_define = require("./define-DzRz8FgH.cjs");
-const require_state = require("./state-C2qi0iQw.cjs");
+const require_stale = require("./stale-yu2FkH3G.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-CajwOa5W.cjs");
 const require_drivers = require("./drivers-BdvtCKc7.cjs");
 const require_databases = require("./databases-C2p5LGAp.cjs");
@@ -496,9 +496,9 @@ function otlpHeaders(email, password) {
 /** The stack's OpenObserve for one stage. */
 function stackLogs(options) {
 	const { config, stage, local, custom } = options;
-	const conflicting = Object.keys(custom).filter(require_state.isOtlpDestination).sort();
+	const conflicting = Object.keys(custom).filter(require_stale.isOtlpDestination).sort();
 	if (conflicting.length > 0) throw new LogsEndpointConflict(stage, conflicting);
-	if (!local && !options.domain) throw new require_state.NoDomainForStage(stage);
+	if (!local && !options.domain) throw new require_stale.NoDomainForStage(stage);
 	const email = custom["ZO_ROOT_USER_EMAIL"] ?? (local ? "admin@gkm.localhost" : `admin@${options.domain}`);
 	const set = custom[LOGS_PASSWORD_KEY];
 	if (!set && !local) throw new LogsPasswordMissing(stage);
@@ -596,7 +596,7 @@ const REDIS_SERVICE = "redis";
 /** The port it answers on, inside the network. */
 const REDIS_PORT = 6379;
 /** Reconcile's pin, so `gkm dev` and the stack run one Redis. */
-const REDIS_IMAGE = require_state.DEFAULT_IMAGES.redis;
+const REDIS_IMAGE = require_stale.DEFAULT_IMAGES.redis;
 /**
 * How much it may hold before it evicts. A cache that grows until the box
 * runs out of memory takes the apps with it; 256 MB is a lot of sessions and
@@ -907,7 +907,7 @@ function composeStack(input) {
 	const custom = input.secrets?.custom ?? {};
 	const https = input.ports?.https ?? 443;
 	const http = input.ports?.http ?? 80;
-	const plan = require_state.planFor(manifest, stage, (0, _geekmidas_manifest.provisionOrder)(manifest), {
+	const plan = require_stale.planFor(manifest, stage, (0, _geekmidas_manifest.provisionOrder)(manifest), {
 		localStage: workspace.stages.local,
 		events: require_SubscriberGenerator.DEFAULT_EVENTS.server,
 		cache: STACK_CACHE,
@@ -917,7 +917,7 @@ function composeStack(input) {
 	const seed = local ? void 0 : input.secrets?.seed;
 	if (!local && !seed) throw new StageSeedMissing(stage);
 	const credential = {
-		master: local ? "geekmidas" : require_state.localRolePassword(workspace.name, plan, "master", seed),
+		master: local ? "geekmidas" : require_stale.localRolePassword(workspace.name, plan, "master", seed),
 		...seed ? { seed } : {}
 	};
 	const apps = stackApps(workspace, manifest, plan, {
@@ -927,7 +927,7 @@ function composeStack(input) {
 		identity,
 		images: input.images
 	});
-	const workers = stackWorkers(require_state.workerUnits(workspace, manifest, input.background ?? {}), {
+	const workers = stackWorkers(require_stale.workerUnits(workspace, manifest, input.background ?? {}), {
 		stage,
 		identity,
 		images: input.images
@@ -945,9 +945,9 @@ function composeStack(input) {
 	const reads = /* @__PURE__ */ new Map();
 	for (const app of apps) {
 		const site = manifest[app.id];
-		reads.set(app.name, site?.kind === "site" ? Object.values((0, _geekmidas_manifest.publicEnvFor)(site, manifest)) : [...require_state.appEnvKeys(manifest, app.name, input.runnables) ?? []]);
+		reads.set(app.name, site?.kind === "site" ? Object.values((0, _geekmidas_manifest.publicEnvFor)(site, manifest)) : [...require_stale.appEnvKeys(manifest, app.name, input.runnables) ?? []]);
 	}
-	for (const worker of workers) reads.set(worker.name, [...require_state.workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
+	for (const worker of workers) reads.set(worker.name, [...require_stale.workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
 	const domain = workspace.deploy?.domains?.[stage];
 	const logsConfig = require_workspace.resolveLogs(workspace.deploy?.compose?.logs);
 	const logs = logsConfig ? stackLogs({
@@ -963,7 +963,7 @@ function composeStack(input) {
 		missing: [],
 		minio: plan.resources.filter((r) => r.kind === "objects").map((r) => r.id),
 		mailpit: plan.resources.filter((r) => r.kind === "email").map((r) => r.id)
-	} : require_state.assertExternalServices({
+	} : require_stale.assertExternalServices({
 		stage,
 		declarations: serviceDeclarations(plan, reads, owners),
 		supplied: custom,
@@ -981,9 +981,9 @@ function composeStack(input) {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
 			user: custom.AWS_ACCESS_KEY_ID ?? (local ? "geekmidas" : `${workspace.name}-minio`),
-			password: custom.AWS_SECRET_ACCESS_KEY ?? (local ? "geekmidas" : require_state.localRolePassword(workspace.name, plan, "minio", seed)),
+			password: custom.AWS_SECRET_ACCESS_KEY ?? (local ? "geekmidas" : require_stale.localRolePassword(workspace.name, plan, "minio", seed)),
 			buckets,
-			policies: require_state.bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
+			policies: require_stale.bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
 		};
 	})() : void 0;
 	const derivation = {
@@ -992,11 +992,11 @@ function composeStack(input) {
 		...credential.seed ? { seed: credential.seed } : {},
 		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
 	};
-	const outside = require_state.networkEnv(plan, {
+	const outside = require_stale.networkEnv(plan, {
 		...derivation,
 		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
 	});
-	const inside = require_state.networkEnv(plan, {
+	const inside = require_stale.networkEnv(plan, {
 		...derivation,
 		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
 	});
@@ -1008,9 +1008,9 @@ function composeStack(input) {
 		const bucket = byId.get(resource.of);
 		if (!bucket) continue;
 		let host;
-		if (local) host = require_state.hostFor(resource, workspace.name);
+		if (local) host = require_stale.hostFor(resource, workspace.name);
 		else {
-			if (!domain) throw new require_state.NoDomainForStage(stage);
+			if (!domain) throw new require_stale.NoDomainForStage(stage);
 			host = `${resource.subdomain ?? require_derive.appKey(resource.id)}.${domain}`;
 		}
 		fileServers.set(resource.id, {
@@ -1034,7 +1034,7 @@ function composeStack(input) {
 			if (owner.kind === "file-server") return fileServers.get(owner.id)?.url;
 			return outside[key];
 		}
-		if (owner && require_state.suppliedOnly(owner.kind, owner.id, key, local)) {
+		if (owner && require_stale.suppliedOnly(owner.kind, owner.id, key, local)) {
 			const value = custom[key];
 			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
 			return value;
@@ -1074,7 +1074,7 @@ function composeStack(input) {
 			continue;
 		}
 		if (input.buildOnly) continue;
-		const keys = require_state.appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
+		const keys = require_stale.appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
 		const values = valuesFor(app, keys);
 		const trusted = (0, _geekmidas_manifest.provideKey)(app.id, "trustedOrigins");
 		if (keys.has(trusted)) {
@@ -1084,7 +1084,7 @@ function composeStack(input) {
 		}
 		app.env = {
 			...values,
-			...require_state.otelEnv({
+			...require_stale.otelEnv({
 				...custom,
 				...logs?.appEnv
 			}, app.name),
@@ -1095,14 +1095,14 @@ function composeStack(input) {
 		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
 	}
 	for (const worker of input.buildOnly ? [] : workers) {
-		const keys = require_state.workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
+		const keys = require_stale.workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
 		worker.env = {
 			...valuesFor({
 				name: worker.name,
 				id: worker.id,
 				kind: "rest-api"
 			}, keys),
-			...require_state.otelEnv({
+			...require_stale.otelEnv({
 				...custom,
 				...logs?.appEnv
 			}, worker.name),
@@ -1145,7 +1145,7 @@ function composeStack(input) {
 	const dockerfiles = {};
 	for (const app of apps) {
 		if (!app.build) continue;
-		dockerfiles[app.build.dockerfile] = require_state.appDockerfile(app.name, workspace.apps[app.name], {
+		dockerfiles[app.build.dockerfile] = require_stale.appDockerfile(app.name, workspace.apps[app.name], {
 			layout,
 			workspaceRoot: workspace.root,
 			apps: workspace.apps,
@@ -1155,7 +1155,7 @@ function composeStack(input) {
 	}
 	for (const worker of workers) {
 		if (!worker.build) continue;
-		dockerfiles[worker.build.dockerfile] = require_state.workerDockerfile({
+		dockerfiles[worker.build.dockerfile] = require_stale.workerDockerfile({
 			id: worker.id,
 			name: worker.name,
 			app: worker.host
@@ -1178,7 +1178,7 @@ function composeStack(input) {
 		plan,
 		credential,
 		...storage ? { storage } : {},
-		devServices: local ? [] : require_state.devServicesUsed(services),
+		devServices: local ? [] : require_stale.devServicesUsed(services),
 		...logs ? { logs } : {},
 		...redis ? { redis } : {}
 	};
@@ -1239,7 +1239,7 @@ function stackApps(workspace, manifest, plan, options) {
 		if (!app || !resource || !app.port) continue;
 		const host = hostOf(name, app, workspace, resource, options);
 		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
-		const ref = require_state.validateImageRef(require_state.imageRef(options.identity, name, options.images.registry, tag));
+		const ref = require_stale.validateImageRef(require_stale.imageRef(options.identity, name, options.images.registry, tag));
 		apps.push({
 			app: name,
 			name,
@@ -1263,8 +1263,8 @@ function stackWorkers(units, options) {
 		name: unit.name,
 		id: unit.id,
 		host: unit.app,
-		port: require_state.WORKER_PORT,
-		ref: require_state.validateImageRef(require_state.imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
+		port: require_stale.WORKER_PORT,
+		ref: require_stale.validateImageRef(require_stale.imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
 		tag: options.images.tag,
 		...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${unit.name}` } } : {}
 	}));
@@ -1275,19 +1275,19 @@ function stackWorkers(units, options) {
 * same rule a deploy follows — for any other.
 */
 function hostOf(name, app, workspace, resource, options) {
-	if (options.local) return require_state.hostFor(resource, workspace.name);
-	return require_state.resolveHost(name, app, options.stage, workspace.deploy?.domains, require_state.isMainFrontendApp(name, app, workspace.apps));
+	if (options.local) return require_stale.hostFor(resource, workspace.name);
+	return require_stale.resolveHost(name, app, options.stage, workspace.deploy?.domains, require_stale.isMainFrontendApp(name, app, workspace.apps));
 }
 /** The compose document: the infrastructure, the apps, and the edge. */
 function stackFile(options) {
 	const { project, plan, apps } = options;
 	const infra = options.infra.filter((name) => name !== LOGS_SERVICE);
-	const derived = require_state.composeFor({
+	const derived = require_stale.composeFor({
 		...plan,
 		containers: [...infra]
 	}, {
 		project,
-		ports: Object.fromEntries(require_state.portKeys(infra, plan.fakes).map((key) => [key, 0]))
+		ports: Object.fromEntries(require_stale.portKeys(infra, plan.fakes).map((key) => [key, 0]))
 	});
 	const services = {};
 	const volumes = {
@@ -1325,7 +1325,7 @@ function stackFile(options) {
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
 		...app.build ? { build: {
-			...require_state.composeBuildPaths({
+			...require_stale.composeBuildPaths({
 				composeDir: options.composeDir,
 				buildRoot: options.buildRoot,
 				workspaceRoot: options.workspaceRoot,
@@ -1345,7 +1345,7 @@ function stackFile(options) {
 	};
 	for (const worker of options.workers) services[worker.name] = {
 		image: worker.ref,
-		...worker.build ? { build: require_state.composeBuildPaths({
+		...worker.build ? { build: require_stale.composeBuildPaths({
 			composeDir: options.composeDir,
 			buildRoot: options.buildRoot,
 			workspaceRoot: options.workspaceRoot,
@@ -1360,7 +1360,7 @@ function stackFile(options) {
 		healthcheck: probe(worker.port, "/health")
 	};
 	services.caddy = {
-		image: require_state.DEFAULT_IMAGES.caddy,
+		image: require_stale.DEFAULT_IMAGES.caddy,
 		restart: "unless-stopped",
 		ports: [`${options.https}:443`, `${options.http}:80`],
 		volumes: [
@@ -1403,7 +1403,7 @@ function defaultLayout(root) {
 		gkmRoot: ".",
 		tools: {
 			packageManager: "pnpm",
-			turboVersion: require_state.TURBO_VERSION,
+			turboVersion: require_stale.TURBO_VERSION,
 			monorepo: true
 		},
 		gkmPaths: ["gkm.config.*"]
@@ -1583,8 +1583,8 @@ function edgePorts(env = process.env) {
 const defaultDeps = {
 	docker: dockerCompose,
 	revision: gitRevision,
-	sql: require_state.pgClient,
-	buckets: require_state.bucketClient,
+	sql: require_stale.pgClient,
+	buckets: require_stale.bucketClient,
 	migrate: require_databases.migrateDatabases,
 	probe: httpsProbe,
 	healthAttempts: 90,
@@ -1604,24 +1604,31 @@ async function validateCompose(ctx, deps, options = {}) {
 	if (push && mode !== "build") throw new ComposePushNeedsBuild();
 	if (options.pin && mode !== "pull") throw new ComposePinNeedsPull();
 	const registry = workspace.deploy?.registry;
-	if (!registry && (push || mode === "pull")) throw new RegistryRequired(push ? "push" : "pull", require_state.imageRef(identity, ctx.apps[0] ?? workspace.name, void 0, tag));
+	if (!registry && (push || mode === "pull")) throw new RegistryRequired(push ? "push" : "pull", require_stale.imageRef(identity, ctx.apps[0] ?? workspace.name, void 0, tag));
 	const runnables = {};
 	const background = {};
 	const manifest = await require_discover.discover({
-		patterns: require_state.constructGlobs(workspace),
+		patterns: require_stale.constructGlobs(workspace),
 		cwd: root,
 		runnables,
 		background
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
-	if (!push) await require_credentialSchemas.assertStageCredentials({
-		root,
-		patterns: require_state.constructGlobs(workspace),
-		manifest,
-		stage,
-		supplied: secrets?.custom ?? {}
-	});
-	const layout = mode === "build" ? require_state.imageLayout(workspace) : void 0;
+	if (!push) {
+		require_stale.assertNoStaleSecrets({
+			manifest,
+			stage,
+			supplied: secrets?.custom ?? {}
+		});
+		await require_credentialSchemas.assertStageCredentials({
+			root,
+			patterns: require_stale.constructGlobs(workspace),
+			manifest,
+			stage,
+			supplied: secrets?.custom ?? {}
+		});
+	}
+	const layout = mode === "build" ? require_stale.imageLayout(workspace) : void 0;
 	const composed = composeStack({
 		workspace,
 		manifest,
@@ -1640,7 +1647,7 @@ async function validateCompose(ctx, deps, options = {}) {
 		...layout ? { layout } : {},
 		...push ? { buildOnly: true } : {}
 	});
-	require_state.reportDevServices(ctx, composed.devServices);
+	require_stale.reportDevServices(ctx, composed.devServices);
 	if (mode === "build") assertRedisClient(workspace, composed);
 	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
@@ -1717,7 +1724,7 @@ async function stageSecrets(ctx, manifest) {
 		secrets: stored,
 		generated: []
 	};
-	const withSeed = require_state.withGeneratedSecrets(stored ?? require_state.initStageSecrets(ctx.stage), manifest);
+	const withSeed = require_stale.withGeneratedSecrets(stored ?? require_stale.initStageSecrets(ctx.stage), manifest);
 	const withLogs = require_workspace.resolveLogs(ctx.workspace.deploy?.compose?.logs) ? withLogsPassword(withSeed.secrets) : {
 		secrets: withSeed.secrets,
 		generated: []
@@ -1855,7 +1862,7 @@ async function prepareBuckets(ctx, run, deps) {
 	if (storage.buckets.length === 0) return;
 	const port = await deps.docker.port(run.ref, "minio", 9e3);
 	const client = deps.buckets(port, storage);
-	const created = [...await require_state.applyBuckets(client, storage.buckets), ...await require_state.applyPolicies(client, storage.policies)].filter((entry) => entry.created).length;
+	const created = [...await require_stale.applyBuckets(client, storage.buckets), ...await require_stale.applyPolicies(client, storage.policies)].filter((entry) => entry.created).length;
 	ctx.logger.info(`🪣  Buckets: ${storage.buckets.join(", ")}${created ? ` (${created} change(s))` : ""}`);
 }
 /** Create what the plan names in the stack's Postgres, then migrate it. */
@@ -1863,19 +1870,19 @@ async function prepareDatabases(ctx, run, deps) {
 	const { stack } = run;
 	const workspace = ctx.workspace;
 	const port = await deps.docker.port(run.ref, "postgres", 5432);
-	const statements = require_state.postgresStatements(stack.plan, workspace.name, stack.credential.seed);
+	const statements = require_stale.postgresStatements(stack.plan, workspace.name, stack.credential.seed);
 	if (statements.length > 0) {
 		ctx.logger.info("🗄️  Creating databases, roles and grants…");
-		await require_state.applyPostgres(deps.sql(port, stack.credential.master), statements);
+		await require_stale.applyPostgres(deps.sql(port, stack.credential.master), statements);
 	}
 	const sources = {};
 	const manifest = await require_discover.discover({
-		patterns: require_state.constructGlobs(workspace),
+		patterns: require_stale.constructGlobs(workspace),
 		cwd: workspace.root,
 		sources
 	});
-	const env = require_state.envFor(stack.plan, {
-		ports: { [require_state.primaryPortKey("postgres")]: port },
+	const env = require_stale.envFor(stack.plan, {
+		ports: { [require_stale.primaryPortKey("postgres")]: port },
 		project: workspace.name,
 		master: stack.credential.master,
 		...stack.credential.seed ? { seed: stack.credential.seed } : {}
@@ -1977,13 +1984,13 @@ async function releaseCompose(ctx, run, deps) {
 * the tag resolved to.
 */
 async function recordImages(ctx, run) {
-	const journal = await require_state.DeployJournal.open(ctx.state, ctx.stage, () => require_state.createEmptyState(ctx.stage, "", ""));
+	const journal = await require_stale.DeployJournal.open(ctx.state, ctx.stage, () => require_stale.createEmptyState(ctx.stage, "", ""));
 	for (const app of [...run.stack.apps, ...run.stack.workers]) {
 		const image = run.images[app.app] ?? {
 			ref: app.ref,
 			tag: app.tag
 		};
-		require_state.recordRelease(journal.state, app.app, image);
+		require_stale.recordRelease(journal.state, app.app, image);
 	}
 	journal.state.identity = ctx.identity.key;
 	await journal.save();
@@ -2196,7 +2203,7 @@ async function writeStack(root, dir, stack) {
 	if (stack.redis && stack.compose.services["redis"]?.env_file) await write((0, node_path.join)(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
 	for (const entry of await (0, node_fs_promises.readdir)(dir)) if (entry.endsWith(".credentials")) await (0, node_fs_promises.rm)((0, node_path.join)(dir, entry));
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
-	await require_state.ensureDockerignore(require_state.findBuildRoot(root));
+	await require_stale.ensureDockerignore(require_stale.findBuildRoot(root));
 	return files;
 }
 function composeYaml(stack) {
@@ -2347,4 +2354,4 @@ Object.defineProperty(exports, "stackOverrideFile", {
 	}
 });
-//# sourceMappingURL=compose-h_6oNnHC.cjs.map
+//# sourceMappingURL=compose-CePlrbUw.cjs.map