@geekmidas/cli 10.0.0-alpha.83 → 10.0.0-alpha.85

package/dist/{workspace-DD9mtPy8.mjs → workspace-Drz4jsvy.mjs}

@@ -37,10 +37,92 @@ function assertKnownSecretsStore(store) {
 	if (typeof provider === "string" && !SECRETS_STORE_PROVIDERS.includes(provider)) throw new UnknownSecretsStoreProvider(provider);
 }
 //#endregion
+//#region src/compose/proxy.ts
+/**
+* Which proxy a stage's stack is served by, and with whose certificate —
+* `deploy.compose.proxy` and `deploy.compose.tls`, resolved for one stage.
+*
+* Pure, and kept apart from the stack so the workspace schema can check a
+* config with the same rules — and the same named errors — the stack applies.
+*/
+/** A per-stage setting keyed by a stage the workspace does not have. */
+var ComposeStageUnknown = class extends Error {
+	setting;
+	stage;
+	stages;
+	constructor(setting, stage, stages) {
+		super(`deploy.compose.${setting} names the stage '${stage}', which is not one of this workspace's (${stages.join(", ")}). Use a stage from stages.local or stages.deployed.`);
+		this.setting = setting;
+		this.stage = stage;
+		this.stages = stages;
+		this.name = "ComposeStageUnknown";
+	}
+};
+/**
+* A certificate for the local stage, whose certificates are always Caddy's
+* own CA — the one `gkm trust` installs.
+*/
+var ComposeTlsOnLocalStage = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`deploy.compose.tls sets a certificate for '${stage}', the local stage, whose certificates always come from Caddy's local CA (\`gkm trust\` installs it). Remove it, or set it for a deployed stage.`);
+		this.stage = stage;
+		this.name = "ComposeTlsOnLocalStage";
+	}
+};
+/** The stage's certificate or key file is not there to read. */
+var ComposeTlsFileMissing = class extends Error {
+	stage;
+	file;
+	constructor(stage, file) {
+		super(`deploy.compose.tls for '${stage}' names ${file}, and there is no file there. Point certFile and keyFile at the PEM certificate (with its chain) and key — relative to the workspace root, or absolute.`);
+		this.stage = stage;
+		this.file = file;
+		this.name = "ComposeTlsFileMissing";
+	}
+};
+/**
+* The proxy a stage's stack is served by. The local stage is always Caddy —
+* its internal CA and `gkm trust` — whatever is configured.
+*/
+function proxyFor(config, stage, local) {
+	if (local) return "caddy";
+	const proxy = config?.proxy;
+	if (!proxy) return "caddy";
+	if (typeof proxy === "string") return proxy;
+	return proxy[stage] ?? "caddy";
+}
+/** A deployed stage's own certificate, its paths absolute, when it sets one. */
+function certificateFor(config, stage, root) {
+	const tls = config?.tls?.[stage];
+	if (!tls) return void 0;
+	const absolute = (file) => isAbsolute(file) ? file : resolve(root, file);
+	return {
+		certFile: absolute(tls.certFile),
+		keyFile: absolute(tls.keyFile)
+	};
+}
+/**
+* Throws the named error for the first thing wrong with the per-stage
+* settings: a stage the workspace does not have, or a certificate for the
+* local stage.
+*/
+function checkComposeStages(config, stages) {
+	const known = [stages.local, ...stages.deployed];
+	if (config?.proxy && typeof config.proxy === "object") {
+		for (const stage of Object.keys(config.proxy)) if (!known.includes(stage)) throw new ComposeStageUnknown("proxy", stage, known);
+	}
+	for (const stage of Object.keys(config?.tls ?? {})) {
+		if (stage === stages.local) throw new ComposeTlsOnLocalStage(stage);
+		if (!known.includes(stage)) throw new ComposeStageUnknown("tls", stage, known);
+	}
+}
+//#endregion
 //#region src/compose/logsConfig.ts
 /**
-* `deploy.compose.logs`, read: whether the stack runs OpenObserve, and how it
-* is reached.
+* The self-hosted telemetry provider's options, read: how the stack's
+* OpenObserve is run and reached — `deploy.telemetry.<stage>` with
+* `provider: 'self-hosted'`.
 *
 * Kept apart from the stack so the workspace schema can check a config with
 * the same rules — and the same named errors — the stack applies.
@@ -49,34 +131,42 @@ function assertKnownSecretsStore(store) {
 const LOGS_PORT = 5080;
 /** `public` with no address to allow: nobody could reach it. */
 var LogsAllowEmpty = class extends Error {
-	constructor() {
-		super("deploy.compose.logs.public.allow is empty, so the logs site would answer every request with 403. List the addresses that may reach it (public: { allow: ['203.0.113.7', '10.0.0.0/8'] }), or remove public and reach it through an SSH tunnel.");
+	stage;
+	constructor(stage) {
+		super(`deploy.telemetry.${stage}.public.allow is empty, so the logs site would answer every request with 403. List the addresses that may reach it (public: { allow: ['203.0.113.7', '10.0.0.0/8'] }), or remove public and reach it through an SSH tunnel.`);
+		this.stage = stage;
 		this.name = "LogsAllowEmpty";
 	}
 };
 /** An `allow` entry that is not an IP address or a CIDR range. */
 var LogsAllowEntryInvalid = class extends Error {
+	stage;
 	entry;
-	constructor(entry) {
-		super(`deploy.compose.logs.public.allow has '${entry}', which is not an IP address or a CIDR range. Write one like '203.0.113.7', '10.0.0.0/8' or '2001:db8::/32'.`);
+	constructor(stage, entry) {
+		super(`deploy.telemetry.${stage}.public.allow has '${entry}', which is not an IP address or a CIDR range. Write one like '203.0.113.7', '10.0.0.0/8' or '2001:db8::/32'.`);
+		this.stage = stage;
 		this.entry = entry;
 		this.name = "LogsAllowEntryInvalid";
 	}
 };
 /** A retention OpenObserve would refuse to start with. */
 var LogsRetentionInvalid = class extends Error {
+	stage;
 	retentionDays;
-	constructor(retentionDays) {
-		super(`deploy.compose.logs.retentionDays is ${String(retentionDays)}; it must be a whole number of days, at least 3 — OpenObserve refuses to start with fewer. Leave it out for 30.`);
+	constructor(stage, retentionDays) {
+		super(`deploy.telemetry.${stage}.retentionDays is ${String(retentionDays)}; it must be a whole number of days, at least 3 — OpenObserve refuses to start with fewer. Leave it out for 30.`);
+		this.stage = stage;
 		this.retentionDays = retentionDays;
 		this.name = "LogsRetentionInvalid";
 	}
 };
 /** A port that is not one. */
 var LogsPortInvalid = class extends Error {
+	stage;
 	port;
-	constructor(port) {
-		super(`deploy.compose.logs.port is ${String(port)}; set it to a number between 1 and 65535, or leave it out for ${LOGS_PORT}.`);
+	constructor(stage, port) {
+		super(`deploy.telemetry.${stage}.port is ${String(port)}; set it to a number between 1 and 65535, or leave it out for ${LOGS_PORT}.`);
+		this.stage = stage;
 		this.port = port;
 		this.name = "LogsPortInvalid";
 	}
@@ -92,20 +182,18 @@ function isAddressOrRange(entry) {
 	return Number(prefix) <= (family === 4 ? 32 : 128);
 }
 /**
-* `deploy.compose.logs` with its defaults, or undefined when it is off.
-* Throws the named error for the first thing wrong with it.
+* The self-hosted provider's options with their defaults — `{}` for all of
+* them. Throws the named error for the first thing wrong with them.
 */
-function resolveLogs(logs) {
-	if (!logs) return void 0;
-	const config = logs === true ? {} : logs;
+function resolveSelfHosted(config, stage) {
 	const port = config.port ?? 5080;
-	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new LogsPortInvalid(config.port);
+	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new LogsPortInvalid(stage, config.port);
 	const retentionDays = config.retentionDays ?? 30;
-	if (!Number.isInteger(retentionDays) || retentionDays < 3) throw new LogsRetentionInvalid(config.retentionDays);
+	if (!Number.isInteger(retentionDays) || retentionDays < 3) throw new LogsRetentionInvalid(stage, config.retentionDays);
 	if (config.public) {
 		const allow = config.public.allow ?? [];
-		if (allow.length === 0) throw new LogsAllowEmpty();
-		for (const entry of allow) if (!isAddressOrRange(entry)) throw new LogsAllowEntryInvalid(entry);
+		if (allow.length === 0) throw new LogsAllowEmpty(stage);
+		for (const entry of allow) if (!isAddressOrRange(entry)) throw new LogsAllowEntryInvalid(stage, entry);
 		return {
 			port,
 			retentionDays,
@@ -118,85 +206,189 @@ function resolveLogs(logs) {
 	};
 }
 //#endregion
-//#region src/compose/proxy.ts
+//#region src/telemetry/config.ts
 /**
-* Which proxy a stage's stack is served by, and with whose certificate —
-* `deploy.compose.proxy` and `deploy.compose.tls`, resolved for one stage.
+* `deploy.telemetry`, read: where one stage's telemetry goes, and how much.
 *
-* Pure, and kept apart from the stack so the workspace schema can check a
-* config with the same rules — and the same named errors — the stack applies.
+* The application says what it emits (the `Telemetry` construct). This says
+* where it is sent, per stage, and is the only place that does:
+*
+* - **self-hosted** — the target runs OpenObserve beside the apps (#189's
+*   stack service). A server target that can run it uses it when a stage
+*   names nothing.
+* - **otlp** — any OTLP/HTTP endpoint, with its headers.
+* - **false** — nothing is sent.
+*
+* Vendor presets (a known endpoint and header shape, with the stage secret
+* `TELEMETRY_CREDENTIALS`) are one more entry in {@link PROVIDERS}: a
+* resolver from the stage's config to a {@link ResolvedTelemetry}, which
+* every target already consumes through {@link telemetryEnv}.
+*
+* The local stage ignores all of it: `gkm dev` and `gkm compose` on it run
+* OpenObserve and keep every trace.
 */
-/** A per-stage setting keyed by a stage the workspace does not have. */
-var ComposeStageUnknown = class extends Error {
-	setting;
+/** A deployed stage uses telemetry and its target cannot choose for it. */
+var TelemetryProviderRequired = class extends Error {
 	stage;
-	stages;
-	constructor(setting, stage, stages) {
-		super(`deploy.compose.${setting} names the stage '${stage}', which is not one of this workspace's (${stages.join(", ")}). Use a stage from stages.local or stages.deployed.`);
-		this.setting = setting;
+	target;
+	constructor(stage, target) {
+		super(`The stage '${stage}' deploys through ${target}, which cannot run telemetry itself, and a process uses a Telemetry construct. Say where it goes in gkm.config.ts: deploy: { telemetry: { ${stage}: { provider: 'otlp', endpoint: 'https://…' } } } — or deploy: { telemetry: { ${stage}: false } } to send nothing.`);
 		this.stage = stage;
-		this.stages = stages;
-		this.name = "ComposeStageUnknown";
+		this.target = target;
+		this.name = "TelemetryProviderRequired";
 	}
 };
-/**
-* A certificate for the local stage, whose certificates are always Caddy's
-* own CA — the one `gkm trust` installs.
-*/
-var ComposeTlsOnLocalStage = class extends Error {
+/** A stage asks for the self-hosted provider on a target that cannot run it. */
+var SelfHostedTelemetryUnavailable = class extends Error {
 	stage;
-	constructor(stage) {
-		super(`deploy.compose.tls sets a certificate for '${stage}', the local stage, whose certificates always come from Caddy's local CA (\`gkm trust\` installs it). Remove it, or set it for a deployed stage.`);
+	target;
+	constructor(stage, target) {
+		super(`deploy.telemetry.${stage} is 'self-hosted', and ${target} does not run OpenObserve beside the apps — the compose target does. Deploy '${stage}' through compose, or send its telemetry elsewhere: deploy: { telemetry: { ${stage}: { provider: 'otlp', endpoint: 'https://…' } } }.`);
 		this.stage = stage;
-		this.name = "ComposeTlsOnLocalStage";
+		this.target = target;
+		this.name = "SelfHostedTelemetryUnavailable";
 	}
 };
-/** The stage's certificate or key file is not there to read. */
-var ComposeTlsFileMissing = class extends Error {
+/** A sample rate that is not a fraction. */
+var TelemetrySampleRateInvalid = class extends Error {
 	stage;
-	file;
-	constructor(stage, file) {
-		super(`deploy.compose.tls for '${stage}' names ${file}, and there is no file there. Point certFile and keyFile at the PEM certificate (with its chain) and key — relative to the workspace root, or absolute.`);
+	sampleRate;
+	constructor(stage, sampleRate) {
+		super(`deploy.telemetry.${stage}.sampleRate is ${String(sampleRate)}; set it to a number from 0 to 1 — the fraction of traces kept — or leave it out to keep every one.`);
 		this.stage = stage;
-		this.file = file;
-		this.name = "ComposeTlsFileMissing";
+		this.sampleRate = sampleRate;
+		this.name = "TelemetrySampleRateInvalid";
+	}
+};
+/** An OTLP endpoint that is not an http(s) URL. */
+var TelemetryEndpointInvalid = class extends Error {
+	stage;
+	endpoint;
+	constructor(stage, endpoint) {
+		super(`deploy.telemetry.${stage}.endpoint is ${JSON.stringify(endpoint)}; set it to the collector's OTLP/HTTP base URL, like 'https://otlp.example.com' — /v1/traces and /v1/logs are added to it.`);
+		this.stage = stage;
+		this.endpoint = endpoint;
+		this.name = "TelemetryEndpointInvalid";
 	}
 };
+/** The sample rate a stage keeps, checked. */
+function sampleRateOf(stage, sampleRate) {
+	const rate = sampleRate ?? 1;
+	if (!Number.isFinite(rate) || rate < 0 || rate > 1) throw new TelemetrySampleRateInvalid(stage, sampleRate);
+	return rate;
+}
 /**
-* The proxy a stage's stack is served by. The local stage is always Caddy —
-* its internal CA and `gkm trust` — whatever is configured.
+* Each provider's resolver: a stage's config to what the targets consume.
+* A vendor preset is one more entry here.
 */
-function proxyFor(config, stage, local) {
-	if (local) return "caddy";
-	const proxy = config?.proxy;
-	if (!proxy) return "caddy";
-	if (typeof proxy === "string") return proxy;
-	return proxy[stage] ?? "caddy";
+const PROVIDERS = {
+	"self-hosted": (config, stage) => {
+		const { provider: _, sampleRate, ...options } = config;
+		return {
+			provider: "self-hosted",
+			selfHosted: resolveSelfHosted(options, stage),
+			sampleRate: sampleRateOf(stage, sampleRate)
+		};
+	},
+	otlp: (config, stage) => {
+		if (typeof config.endpoint !== "string" || !isHttpUrl(config.endpoint)) throw new TelemetryEndpointInvalid(stage, config.endpoint);
+		return {
+			provider: "otlp",
+			endpoint: config.endpoint.replace(/\/+$/, ""),
+			headers: { ...config.headers },
+			sampleRate: sampleRateOf(stage, config.sampleRate)
+		};
+	}
+};
+function isHttpUrl(value) {
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return false;
+	}
 }
-/** A deployed stage's own certificate, its paths absolute, when it sets one. */
-function certificateFor(config, stage, root) {
-	const tls = config?.tls?.[stage];
-	if (!tls) return void 0;
-	const absolute = (file) => isAbsolute(file) ? file : resolve(root, file);
-	return {
-		certFile: absolute(tls.certFile),
-		keyFile: absolute(tls.keyFile)
+/**
+* One stage's entry, checked on its own — what the workspace schema runs, so
+* a bad config fails to load with the words a deploy would fail with.
+*/
+function checkStageTelemetry(stage, config) {
+	if (config === false) return void 0;
+	const entry = config === "self-hosted" ? { provider: "self-hosted" } : config;
+	const resolve = PROVIDERS[entry.provider];
+	return resolve(entry, stage);
+}
+/**
+* Where a stage's telemetry goes, or undefined when nothing is sent — no
+* process uses a `Telemetry` node, or the stage opted out with `false`.
+*
+* The local stage always runs the self-hosted provider with its defaults and
+* keeps every trace, whatever `deploy.telemetry` says. A deployed stage that
+* names nothing gets the self-hosted provider where its target runs one, and
+* {@link TelemetryProviderRequired} where it cannot — AWS has none.
+*/
+function resolveStageTelemetry(input) {
+	const { stage } = input;
+	if (!input.used) return void 0;
+	if (input.local) return {
+		provider: "self-hosted",
+		selfHosted: resolveSelfHosted({}, stage),
+		sampleRate: 1
 	};
+	const config = input.telemetry?.[stage];
+	if (config === void 0) {
+		if (input.runtime === "server" && input.selfHosted) return checkStageTelemetry(stage, "self-hosted");
+		throw new TelemetryProviderRequired(stage, input.target);
+	}
+	const resolved = checkStageTelemetry(stage, config);
+	if (resolved?.provider === "self-hosted" && !input.selfHosted) throw new SelfHostedTelemetryUnavailable(stage, input.target);
+	return resolved;
 }
+/** The sampler every process with the edge runs, per the stage's rate. */
+const TRACES_SAMPLER = "parentbased_traceidratio";
 /**
-* Throws the named error for the first thing wrong with the per-stage
-* settings: a stage the workspace does not have, or a certificate for the
-* local stage.
+* `OTEL_EXPORTER_OTLP_HEADERS` for a set of headers: `key=value` pairs,
+* comma-separated, each value percent-encoded — the W3C baggage format the
+* SDK parses.
 */
-function checkComposeStages(config, stages) {
-	const known = [stages.local, ...stages.deployed];
-	if (config?.proxy && typeof config.proxy === "object") {
-		for (const stage of Object.keys(config.proxy)) if (!known.includes(stage)) throw new ComposeStageUnknown("proxy", stage, known);
-	}
-	for (const stage of Object.keys(config?.tls ?? {})) {
-		if (stage === stages.local) throw new ComposeTlsOnLocalStage(stage);
-		if (!known.includes(stage)) throw new ComposeStageUnknown("tls", stage, known);
-	}
+function otlpHeaderString(headers) {
+	return Object.entries(headers).map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join(",");
+}
+/**
+* The `OTEL_*` values a stage resolves for its `Telemetry` node, before any
+* one process is named: where to export, how to sign, and how much to keep.
+* `OTEL_SERVICE_NAME` is each process's own — see `scopeTelemetryEnv`.
+*/
+function telemetryEnv(destination, sampleRate) {
+	return {
+		OTEL_EXPORTER_OTLP_ENDPOINT: destination.endpoint,
+		...destination.headers ? { OTEL_EXPORTER_OTLP_HEADERS: destination.headers } : {},
+		OTEL_TRACES_SAMPLER: TRACES_SAMPLER,
+		OTEL_TRACES_SAMPLER_ARG: String(sampleRate)
+	};
+}
+/** What an `otlp` stage resolves, for every process with the edge. */
+function otlpTelemetryEnv(resolved) {
+	const headers = otlpHeaderString(resolved.headers);
+	return telemetryEnv({
+		endpoint: resolved.endpoint,
+		...headers ? { headers } : {}
+	}, resolved.sampleRate);
+}
+/**
+* The sample rate a stage's browsers trace page views at — a public value,
+* the same rate its servers sample at — or undefined when the stage sends no
+* telemetry. The local stage keeps every trace.
+*
+* Lenient where `resolveStageTelemetry` is strict: a site's client is built
+* before, and apart from, the deploy that refuses a stage with no provider.
+*/
+function stageSampleRate(telemetry, stage, local) {
+	if (local) return 1;
+	const config = telemetry?.[stage];
+	if (config === false) return void 0;
+	if (config === void 0 || config === "self-hosted") return 1;
+	return sampleRateOf(stage, config.sampleRate);
 }
 //#endregion
 //#region src/workspace/stages.ts
@@ -581,31 +773,46 @@ const BackupsConfigSchema = object({
 	/** Number of backups to retain (default: 30) */
 	retention: number().optional()
 });
-/**
-* `deploy.compose` — what the compose target runs beside the apps. The rules
-* past the shape are `resolveLogs`'s, so the schema and the stack refuse the
-* same configs with the same words.
-*/
+/** `deploy.compose` — what the compose target runs beside the apps. */
 const ComposeWorkspaceConfigSchema = object({
-	logs: union([boolean(), object({
-		port: number().optional(),
-		retentionDays: number().optional(),
-		public: object({ allow: array(string()) }).optional()
-	})]).superRefine((logs, ctx) => {
-		try {
-			resolveLogs(logs);
-		} catch (error) {
-			ctx.addIssue({
-				code: "custom",
-				message: error instanceof Error ? error.message : String(error)
-			});
-		}
-	}).optional(),
 	proxy: union([_enum(["caddy", "traefik"]), record(string(), _enum(["caddy", "traefik"]))]).optional(),
 	tls: record(string(), object({
 		certFile: string().min(1),
 		keyFile: string().min(1)
 	}).strict()).optional()
+}).strict();
+const TelemetrySampleRate = number().optional();
+/**
+* `deploy.telemetry` — where each stage's telemetry goes. The rules past the
+* shape are `checkStageTelemetry`'s, so the schema and a deploy refuse the
+* same configs with the same words.
+*/
+const TelemetryConfigSchema = record(string(), union([
+	literal(false),
+	literal("self-hosted"),
+	object({
+		provider: literal("self-hosted"),
+		port: number().optional(),
+		retentionDays: number().optional(),
+		public: object({ allow: array(string()) }).optional(),
+		sampleRate: TelemetrySampleRate
+	}).strict(),
+	object({
+		provider: literal("otlp"),
+		endpoint: string(),
+		headers: record(string(), string()).optional(),
+		sampleRate: TelemetrySampleRate
+	}).strict()
+])).superRefine((telemetry, ctx) => {
+	for (const [stage, config] of Object.entries(telemetry)) try {
+		checkStageTelemetry(stage, config);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [stage]
+		});
+	}
 });
 /**
 * Deploy configuration schema.
@@ -627,6 +834,7 @@ const DeployConfigSchema = object({
 	registry: string().min(1).optional(),
 	dokploy: DokployWorkspaceConfigSchema.optional(),
 	compose: ComposeWorkspaceConfigSchema.optional(),
+	telemetry: TelemetryConfigSchema.optional(),
 	dns: DnsConfigWithLegacySchema.optional(),
 	backups: BackupsConfigSchema.optional()
 });
@@ -1297,6 +1505,6 @@ function getEndpointForStage(dokployConfig, stage) {
 	return dokployConfig.endpoint;
 }
 //#endregion
-export { UndeclaredStage as A, UnknownSecretsStoreProvider as B, getDeployTargetError as C, validateWorkspaceConfig as D, safeValidateWorkspaceConfig as E, certificateFor as F, proxyFor as I, LOGS_PORT as L, deployedProblems as M, stageProblems as N, InvalidStages as O, ComposeTlsFileMissing as P, resolveLogs as R, formatValidationErrors as S, isPhase2DeployTarget as T, stripPublicPrefix as _, assertNoMovedDeployKeys as a, SUPPORTED_DEPLOY_TARGETS as b, getAppBuildOrder as c, normalizeWorkspace as d, processConfig as f, getPublicEnvPrefix as g, PUBLIC_ENV_PREFIXES as h, appConstructGlobs as i, assertDeployedStage as j, TEST_STAGE as k, getAppGkmConfig as l, wrapSingleAppAsWorkspace as m, InvalidWorkspaceConfig as n, constructPatterns as o, workspaceConstructGlobs as p, allConstructGlobs as r, defineWorkspace as s, DokployRegistryMoved as t, getEndpointForStage as u, isWorkspaceConfig as v, isDeployTargetSupported as w, WorkspaceConfigSchema as x, PHASE_2_DEPLOY_TARGETS as y, SECRETS_STORE_PROVIDERS as z };
+export { UndeclaredStage as A, certificateFor as B, getDeployTargetError as C, validateWorkspaceConfig as D, safeValidateWorkspaceConfig as E, resolveStageTelemetry as F, SECRETS_STORE_PROVIDERS as H, stageSampleRate as I, telemetryEnv as L, deployedProblems as M, stageProblems as N, InvalidStages as O, otlpTelemetryEnv as P, LOGS_PORT as R, formatValidationErrors as S, isPhase2DeployTarget as T, UnknownSecretsStoreProvider as U, proxyFor as V, stripPublicPrefix as _, assertNoMovedDeployKeys as a, SUPPORTED_DEPLOY_TARGETS as b, getAppBuildOrder as c, normalizeWorkspace as d, processConfig as f, getPublicEnvPrefix as g, PUBLIC_ENV_PREFIXES as h, appConstructGlobs as i, assertDeployedStage as j, TEST_STAGE as k, getAppGkmConfig as l, wrapSingleAppAsWorkspace as m, InvalidWorkspaceConfig as n, constructPatterns as o, workspaceConstructGlobs as p, allConstructGlobs as r, defineWorkspace as s, DokployRegistryMoved as t, getEndpointForStage as u, isWorkspaceConfig as v, isDeployTargetSupported as w, WorkspaceConfigSchema as x, PHASE_2_DEPLOY_TARGETS as y, ComposeTlsFileMissing as z };
 
-//# sourceMappingURL=workspace-DD9mtPy8.mjs.map
+//# sourceMappingURL=workspace-Drz4jsvy.mjs.map