@geekmidas/cli 10.0.0-alpha.9 → 10.0.0-alpha.91

package/dist/deploy/public.d.cts

@@ -0,0 +1,649 @@
+import { Ct as ReleasedImage, Et as deployIdentity, St as StateVersionConflict, Tt as DeployIdentity, U as AnyDeployTarget, _t as StoredCredentialsOptions, at as DeployPhase, bt as StateLocked, ct as AppDeployResult, dt as Credential, ft as CredentialKind, gt as MissingCredential, ht as CredentialRequest, it as DeployEventType, lt as DeployResult, mt as CredentialProvider, nt as DeployEvent, ot as ResourceChange, pt as CredentialKinds, rt as DeployEventError, st as ResourceVia, ut as AwsCredential, vt as chainCredentials, yt as storedCredentials } from "../types-NqX1Hz4P.cjs";
+import { a as SandboxOutput, c as confineCwd, i as SandboxExecOptions, n as Sandbox, o as SandboxResult, r as SandboxCwdEscape, s as SecretNameInvalid, t as SECRETS_DIR_ENV } from "../sandbox-M8UnLhXE.cjs";
+import { i as ConfigLoadFailed, o as ConfigObjectNotSerializable } from "../config-pST7E0CS.cjs";
+import { n as ConstructsNotSerializable, t as ConstructDiscoveryFailed } from "../discover-CU0paUyH.cjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-CN_kmqxo.cjs";
+import { ConstructManifest, Declaration } from "@geekmidas/manifest";
+import "@geekmidas/envkit/sniffer";
+import "@geekmidas/db/pg/roles";
+//#region src/home.d.ts
+/**
+ * Where the CLI keeps what belongs to a person rather than a project: stage
+ * keys and stored provider credentials.
+ *
+ * `GKM_HOME` names it, so a CI job, a shared build runner or a test can give
+ * every run its own instead of reaching into whoever's home directory the
+ * process happens to have. Unset, it is `~/.gkm`, where it has always been.
+ */
+/** The environment variable that moves the CLI's home. */
+export declare const GKM_HOME_ENV = "GKM_HOME";
+/** The CLI's home: `GKM_HOME` if set, else `~/.gkm`. */
+export declare function gkmHome(env?: NodeJS.ProcessEnv): string;
+//#endregion
+//#region src/providers/types.d.ts
+/** The manifest kinds a stage can name a provider for. */
+declare const PROVIDER_KINDS: readonly ['objects'];
+type ProviderKind = (typeof PROVIDER_KINDS)[number];
+//#endregion
+//#region src/providers/config.d.ts
+/** An entry that names no provider gkm has, or is not an entry at all. */
+export declare class UnknownStageProvider extends Error {
+  readonly kind: ProviderKind;
+  readonly stage: string;
+  readonly value: unknown;
+  constructor(kind: ProviderKind, stage: string, value: unknown);
+}
+//#endregion
+//#region src/deploy/devServices.d.ts
+/**
+ * The dev services a deployed stage can run — one per kind that has one on
+ * every server target: a bucket's MinIO and mail's Mailpit. A cache or a
+ * database is not here because a server stage runs its own anyway.
+ */
+export declare const DEV_SERVICES: readonly ['minio', 'mailpit'];
+type DevService = (typeof DEV_SERVICES)[number];
+/** Dev services asked of a target that runs no containers. */
+export declare class DevServicesNeedServerTarget extends Error {
+  readonly target: string;
+  constructor(target: string);
+}
+/**
+ * `--allow-dev-services` given a value — the list it used to take. It is a
+ * switch now: every construct the stage does not account for gets its dev
+ * service.
+ */
+export declare class AllowDevServicesTakesNoValue extends Error {
+  readonly value: string;
+  constructor(value: string);
+}
+/** One key a deployed stage needs and its secrets do not hold. */
+interface MissingServiceKey {
+  key: string;
+  /** The construct that reads it. */
+  id: string;
+  /** What it is, for the line that names it. */
+  what: string;
+  /** A line after `what`, for what else there is to know about it. */
+  note?: string;
+  /** A placeholder value to show in the `gkm secrets:set` line. */
+  example: string;
+  /** The dev service that would stand in for it, unless the stage accounts for it. */
+  service?: DevService;
+  /** The apps that read it, where known. */
+  apps?: readonly string[];
+  /** What creates it, where a provider backs it on the stage. */
+  hint?: string;
+}
+/**
+ * A deployed stage with mail or object storage that its secrets do not
+ * configure — every missing key, across every app, at once.
+ */
+export declare class ExternalServicesNotConfigured extends Error {
+  readonly stage: string;
+  readonly missing: readonly MissingServiceKey[];
+  constructor(stage: string, missing: readonly MissingServiceKey[]);
+}
+//#endregion
+//#region src/providers/notes.d.ts
+/** A stage that names `false` for a kind, and declares constructs of it. */
+export declare class StageProviderDisabled extends Error {
+  readonly kind: ProviderKind;
+  readonly stage: string;
+  readonly ids: readonly string[];
+  constructor(kind: ProviderKind, stage: string, ids: readonly string[]);
+}
+//#endregion
+//#region src/providers/s3/errors.d.ts
+/** `verify()`: a provisioned bucket the stage's key cannot reach. */
+export declare class ProvisionedBucketUnreachable extends Error {
+  readonly id: string;
+  readonly bucket: string;
+  readonly stage: string;
+  readonly reason: string;
+  constructor(id: string, bucket: string, stage: string, reason: string);
+}
+//#endregion
+//#region src/run.d.ts
+/** The program ran and exited unsuccessfully; its own output said why. */
+export declare class CommandFailed extends Error {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly exitCode: number | null;
+  readonly signal: NodeJS.Signals | null;
+  constructor(command: string, args: readonly string[], exitCode: number | null, signal: NodeJS.Signals | null);
+}
+/** The program ran past its timeout and was killed. */
+export declare class CommandTimedOut extends Error {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly timeoutMs: number;
+  constructor(command: string, args: readonly string[], timeoutMs: number);
+}
+//#endregion
+//#region src/sandbox/env.d.ts
+/**
+ * What of the host's environment a local sandbox passes on.
+ *
+ * An allowlist, not a denylist: a credential's variable has any name its
+ * owner chose (`DOKPLOY_TOKEN`, `AWS_SECRET_ACCESS_KEY`, `MY_VAULT_TOKEN`), so
+ * the only safe default is to name what a program needs to *run* and pass
+ * nothing else.
+ */
+/**
+ * Variables a command needs to find programs, write temp files, print in the
+ * user's locale and reach the network through the host's proxy — and nothing
+ * that authenticates as anyone.
+ *
+ * Deliberately left out:
+ * - `NODE_OPTIONS`: it can `--require` or `--import` code into every node
+ *   process, and CI often holds `--import tsx` there. A step that needs a
+ *   loader passes its own.
+ * - `NODE_AUTH_TOKEN`, `NPM_TOKEN`, `npm_config_*`: registry tokens
+ *   (`actions/setup-node` writes `NODE_AUTH_TOKEN`), which is why there is no
+ *   `NODE_*` wildcard.
+ * - `AWS_*`, `DOCKER_*`, `DOKPLOY_*`, `GITHUB_TOKEN`, `TURBO_TOKEN`, `GKM_*`:
+ *   credentials, or where the deploy keeps them.
+ * - `SHELL`, `EDITOR` and the rest of a login session: nothing here starts a
+ *   shell.
+ *
+ * Proxies are passed: behind one, nothing installs or builds without it. A
+ * proxy URL with a password in it reaches the command too — a host that keeps
+ * one there and builds code it does not trust should pass a sandbox of its
+ * own.
+ */
+export declare const SANDBOX_ENV_ALLOWLIST: readonly (string | RegExp)[];
+/**
+ * The allowlisted part of `source`, plus each of `extra` the host chose to
+ * pass on by name.
+ */
+export declare function allowlistedEnv(source?: NodeJS.ProcessEnv, extra?: readonly string[]): Record<string, string>;
+//#endregion
+//#region src/docker/templates.d.ts
+type PackageManager = 'pnpm' | 'npm' | 'yarn' | 'bun';
+//#endregion
+//#region src/sandbox/install.d.ts
+/** Long enough for a cold install of a large monorepo. */
+export declare const INSTALL_TIMEOUT_MS: number;
+interface InstallOptions {
+  /** The directory to install in. Defaults to the sandbox's root. */
+  cwd?: string;
+  /** Defaults to the one the lockfile above `cwd` names. */
+  packageManager?: PackageManager;
+  /**
+   * Skip every lifecycle script — dependencies' and the project's own —
+   * except those of {@link allowScripts}. Defaults to false: scripts run as
+   * a plain install runs them, under the package manager's own policy —
+   * npm 12 and pnpm 10 skip dependencies' scripts nobody approved.
+   */
+  ignoreScripts?: boolean;
+  /**
+   * With `ignoreScripts`, the packages whose scripts still run: rebuilt by
+   * name once the install is done.
+   */
+  allowScripts?: readonly string[];
+  /** Variables the install needs beyond the sandbox's own. */
+  env?: Readonly<Record<string, string>>;
+  /** Defaults to {@link INSTALL_TIMEOUT_MS}, for each command. */
+  timeoutMs?: number;
+  /** Where the package manager's output goes. Defaults to `inherit`. */
+  output?: SandboxOutput;
+  signal?: AbortSignal;
+}
+/** A name in `allowScripts` that is not a package name. */
+export declare class InstallAllowlistNameInvalid extends Error {
+  readonly packageName: string;
+  constructor(packageName: string);
+}
+/** The package manager has no way to run only some packages' scripts. */
+export declare class InstallScriptsAllowlistUnsupported extends Error {
+  readonly packageManager: string;
+  readonly allowScripts: readonly string[];
+  constructor(packageManager: string, allowScripts: readonly string[]);
+}
+/**
+ * Install the project's dependencies in `sandbox`.
+ *
+ * ```ts
+ * // A checkout nobody has reviewed: no scripts but esbuild's.
+ * await installDependencies(sandbox, {
+ *   ignoreScripts: true,
+ *   allowScripts: ['esbuild'],
+ * });
+ * ```
+ *
+ * Resolves with each command's result, in order — with its output when
+ * `output` is `capture`.
+ *
+ * @throws {CommandFailed} when the package manager exits unsuccessfully.
+ * @throws {InstallScriptsAllowlistUnsupported} for an allowlist the package
+ *   manager cannot honour, before anything is installed.
+ */
+export declare function installDependencies(sandbox: Sandbox, options?: InstallOptions): Promise<SandboxResult[]>;
+//#endregion
+//#region src/sandbox/local.d.ts
+interface LocalSandboxOptions {
+  /** The project. Every command runs at or below it. */
+  root: string;
+  /**
+   * `HOME` for every command. Defaults to the host's, because a build
+   * reuses the caches kept there — the pnpm store, corepack's package
+   * managers, turbo's cache — and a cold one re-downloads all of them.
+   * Point it at an empty directory to keep `~/.aws`, `~/.npmrc` and
+   * `~/.docker` out of reach of an SDK's default lookup — though, sharing
+   * the host's filesystem, a command that goes looking still finds them.
+   */
+  home?: string;
+  /**
+   * Host variables to pass on beyond the allowlist, by name — a remote
+   * cache's `TURBO_TOKEN`, for a build the host trusts with it.
+   */
+  passEnv?: readonly string[];
+  /** Where the allowlisted variables are read from. Defaults to `process.env`. */
+  hostEnv?: NodeJS.ProcessEnv;
+}
+/**
+ * A child process on this machine, as this user, with an allowlisted
+ * environment.
+ *
+ * What it withholds from the command: the host's environment beyond
+ * {@link SANDBOX_ENV_ALLOWLIST}, a shell, a working directory outside the
+ * project, and any time past the timeout. What it does not: the host's
+ * filesystem, which the command can read and write as the user running the
+ * deploy. So it is not `isolating`, and it is the default for projects the
+ * host already trusts — the developer's own, a team's own CI. Code nobody
+ * vetted belongs in a sandbox that is.
+ *
+ * A timed-out command is sent SIGTERM, then SIGKILL; processes it started
+ * itself are its to stop.
+ */
+export declare class LocalSandbox implements Sandbox {
+  readonly root: string;
+  readonly isolating = false;
+  readonly env: Readonly<Record<string, string>>;
+  constructor(options: LocalSandboxOptions);
+  exec(command: string, args: readonly string[], options: SandboxExecOptions): Promise<SandboxResult>;
+}
+//#endregion
+//#region src/sandbox/worker.d.ts
+/** A worker ended without the answer it exists to give. */
+export declare class SandboxWorkerFailed extends Error {
+  readonly step: string;
+  readonly exitCode: number | null;
+  readonly stderr: string;
+  constructor(step: string, exitCode: number | null, stderr: string);
+}
+//#endregion
+//#region src/target/dokploy/dokploy-api.d.ts
+/** A deployment Dokploy ran and reported as failed. */
+export declare class DeploymentFailed extends Error {
+  readonly applicationId: string;
+  readonly deployment: DokployDeployment;
+  constructor(applicationId: string, deployment: DokployDeployment);
+}
+/** A deployment that had not finished when the deploy stopped waiting. */
+export declare class DeploymentTimedOut extends Error {
+  readonly applicationId: string;
+  readonly timeoutMs: number;
+  /** The last status seen, if a deployment had appeared at all. */
+  readonly lastStatus: DokployDeploymentStatus | undefined;
+  constructor(applicationId: string, timeoutMs: number,
+  /** The last status seen, if a deployment had appeared at all. */
+  lastStatus: DokployDeploymentStatus | undefined);
+}
+type DokployDeploymentStatus = 'running' | 'done' | 'error' | 'cancelled';
+/** One run of `application.deploy`, as `deployment.all` lists it. */
+interface DokployDeployment {
+  deploymentId: string;
+  status: DokployDeploymentStatus;
+  /** ISO timestamp, by Dokploy's clock. */
+  createdAt: string;
+  title?: string;
+  errorMessage?: string | null;
+}
+//#endregion
+//#region src/target/dokploy/engine.d.ts
+/** A backend failed, so the run stopped before deploying anything after it. */
+export declare class BackendDeployFailed extends Error {
+  readonly app: string;
+  constructor(app: string, cause: unknown);
+}
+/**
+ * Sites failed to release or to answer. Every site is attempted before this
+ * is thrown, so one broken site does not keep the others back — but the run
+ * fails, and what failed is rolled back.
+ */
+export declare class FrontendDeployFailed extends Error {
+  readonly apps: readonly string[];
+  constructor(apps: readonly string[], cause: unknown);
+}
+/** An app's environment needs values the stage does not have. */
+export declare class MissingEnvVars extends Error {
+  readonly app: string;
+  readonly missing: readonly string[];
+  readonly stage: string;
+  constructor(app: string, missing: readonly string[], stage: string);
+}
+//#endregion
+//#region src/target/dokploy/health.d.ts
+/** An app never answered healthy enough times in a row. */
+export declare class HealthCheckTimedOut extends Error {
+  readonly app: string;
+  readonly url: string;
+  readonly timeoutMs: number;
+  /** The last answer's status, or undefined when the last request failed. */
+  readonly lastStatus: number | undefined;
+  constructor(app: string, url: string, timeoutMs: number,
+  /** The last answer's status, or undefined when the last request failed. */
+  lastStatus: number | undefined);
+}
+//#endregion
+//#region src/target/dokploy/migrations.d.ts
+/** The migrations of a deployed stage failed; the release stopped before any app. */
+export declare class DeployMigrationsFailed extends Error {
+  readonly stage: string;
+  /** The failure's class name in the sandbox — `MigrationFailed`, … */
+  readonly reason: string;
+  constructor(stage: string,
+  /** The failure's class name in the sandbox — `MigrationFailed`, … */
+  reason: string, message: string);
+}
+//#endregion
+//#region src/target/dokploy/rollback.d.ts
+interface RollbackInput {
+  /** The project: the directory holding `gkm.config.ts`, or one inside it. */
+  cwd: string;
+  stage: string;
+  /** The app to roll back. */
+  app?: string;
+  /** Every app with an earlier release, instead of one. */
+  atomic?: boolean;
+  /** Defaults to the environment, then the logins `gkm login` stored. */
+  credentials?: CredentialProvider;
+  signal?: AbortSignal;
+  /** Each progress line. Defaults to none. */
+  log?: (line: string) => void;
+  /** Where the config is loaded. Defaults to a `LocalSandbox` on the project. */
+  sandbox?: Sandbox;
+}
+/** One app rolled back. */
+interface RolledBack {
+  app: string;
+  from: ReleasedImage;
+  to: ReleasedImage;
+}
+/** Neither an app nor every app was asked for. */
+export declare class RollbackNeedsApp extends Error {
+  readonly stage: string;
+  /** The apps that have a release to go back to. */
+  readonly apps: readonly string[];
+  constructor(stage: string,
+  /** The apps that have a release to go back to. */
+  apps: readonly string[]);
+}
+/** An app has no release before the one it runs. */
+export declare class NothingToRollBack extends Error {
+  readonly stage: string;
+  readonly app: string;
+  constructor(stage: string, app: string);
+}
+/** The stage was never deployed through Dokploy from this state. */
+export declare class StageNeverDeployed extends Error {
+  readonly stage: string;
+  constructor(stage: string);
+}
+/**
+ * Roll a stage's app — or, `atomic`, all of them — back to its previous
+ * release, holding the stage's lock as a deploy does.
+ */
+export declare function rollbackStage(input: RollbackInput): Promise<RolledBack[]>;
+//#endregion
+//#region src/target/seeds.d.ts
+/** A seed of a deployed stage failed; the release stopped before any app. */
+export declare class DeploySeedsFailed extends Error {
+  readonly stage: string;
+  /** The construct whose seed failed: `Database`. */
+  readonly construct: string;
+  /** The seed file, by name: `001_roles`. */
+  readonly seed: string;
+  readonly cause: unknown;
+  constructor(stage: string,
+  /** The construct whose seed failed: `Database`. */
+  construct: string,
+  /** The seed file, by name: `001_roles`. */
+  seed: string, cause: unknown);
+}
+//#endregion
+//#region src/target/sst/health.d.ts
+/** Surfaces that never answered healthy. */
+export declare class SurfacesUnhealthy extends Error {
+  readonly stage: string;
+  /** Each surface that failed, with the last thing it answered. */
+  readonly surfaces: readonly {
+    app: string;
+    url: string;
+    status?: number;
+    error?: string;
+  }[];
+  constructor(stage: string,
+  /** Each surface that failed, with the last thing it answered. */
+  surfaces: readonly {
+    app: string;
+    url: string;
+    status?: number;
+    error?: string;
+  }[]);
+}
+//#endregion
+//#region src/target/sst/outputs.d.ts
+/** `.sst/outputs.json` is there, and is not JSON. */
+export declare class SstOutputsUnreadable extends Error {
+  readonly path: string;
+  readonly reason: string;
+  constructor(path: string, reason: string);
+}
+//#endregion
+//#region src/target/sst/index.d.ts
+/** The workspace has no `sst.config.ts` for `sst deploy` to run. */
+export declare class SstConfigNotFound extends Error {
+  readonly cwd: string;
+  constructor(cwd: string);
+}
+//#endregion
+//#region src/deploy/deploy.d.ts
+/**
+ * Where a run's progress lines go, besides its events. `@geekmidas/logger`'s
+ * `Logger` is one.
+ */
+interface DeployLogger {
+  info(message: string): void;
+  warn(message: string): void;
+  error?(message: string): void;
+}
+interface DeployInput {
+  /**
+   * The project to deploy: the directory holding `gkm.config.ts`, or any
+   * directory inside it. Never assumed to be `process.cwd()`.
+   */
+  cwd: string;
+  /**
+   * The stage to deploy — one of the config's deployed stages, or its local
+   * stage through a target that runs one (`compose`).
+   */
+  stage: string;
+  /**
+   * The target to deploy through, by name. Defaults to `deploy.default`,
+   * else `dokploy`.
+   */
+  target?: string;
+  /**
+   * The host's own targets, by name. Consulted before the built-ins and the
+   * config's `deploy.targets`, so a host can deploy through an
+   * implementation of its own — `{ dokploy: myDokploy }` included.
+   */
+  targets?: Record<string, AnyDeployTarget>;
+  /** The image tag. Defaults to `<stage>-<timestamp>`. */
+  tag?: string;
+  /** Deploy only these apps (in dependency order). Defaults to all. */
+  apps?: string[];
+  /**
+   * Look everything up and report what would happen — as `resource.planned`
+   * events — without taking the lock, writing state, generating secrets,
+   * changing Dokploy or building and pushing images.
+   */
+  dryRun?: boolean;
+  /**
+   * Validate and build only: the target's images built — and pushed, where
+   * it pushes them — with no lock taken and nothing provisioned, released,
+   * verified or recorded. `gkm compose --build --push` runs this way.
+   */
+  buildOnly?: boolean;
+  /**
+   * When a release or its verification fails, roll back every app the run
+   * released rather than only the ones that failed — on a target that can
+   * roll back. For apps that must move together.
+   */
+  atomic?: boolean;
+  /**
+   * Where credentials come from. Defaults to the environment, then the
+   * logins `gkm login` stored. A credential no provider has stops the run
+   * with `MissingCredential`; nothing prompts.
+   */
+  credentials?: CredentialProvider;
+  /**
+   * On a server target, run a dev service for every construct a deployed
+   * stage does not account for — no key in its secrets, and no provider
+   * (`deploy.objects`) backing its kind: MinIO for a bucket, Mailpit for
+   * mail. Neither is production-grade — Mailpit delivers no mail — and every
+   * run that uses one emits `dev-service.used`. Without it, a deployed stage
+   * missing a mail or storage key fails with `ExternalServicesNotConfigured`;
+   * on an AWS target it fails with `DevServicesNeedServerTarget`.
+   */
+  allowDevServices?: boolean;
+  /**
+   * Do not check, on a server target, that each public host resolves to
+   * the stage's server (`GKM_SERVER_IPV4`) before the stack starts — for a CDN
+   * or proxy in front of the server.
+   */
+  skipDnsCheck?: boolean;
+  /** Receives each progress line as it is written. Defaults to none. */
+  logger?: DeployLogger;
+  /**
+   * Stops the run: in-flight Dokploy requests and docker children are
+   * cancelled, the stage's lock is released, and `result` rejects with the
+   * signal's reason.
+   */
+  signal?: AbortSignal;
+  /**
+   * The CLI's home: stage keys and stored logins. Defaults to `GKM_HOME`,
+   * else `~/.gkm`.
+   */
+  home?: string;
+  /**
+   * Where docker's own output goes: the host's terminal (`inherit`, the
+   * default), its stderr, or nowhere.
+   */
+  childOutput?: 'inherit' | 'stderr' | 'ignore';
+  /**
+   * Where the project's own code runs: loading `gkm.config.ts`, discovering
+   * its constructs, sniffing each app's environment. Defaults to a
+   * `LocalSandbox` on the project — a child process here with an
+   * allowlisted environment, for a project the host trusts.
+   *
+   * A host deploying repositories it does not trust passes one that
+   * isolates — a container per build — and the config then reaches the
+   * deploy only as data. Credentials never enter a sandbox: they go from
+   * `credentials` to the steps that provision, push and release.
+   */
+  sandbox?: Sandbox;
+}
+/** A deploy in progress. */
+interface DeployRun extends AsyncIterable<DeployEvent> {
+  /**
+   * What the deploy did, once it is done. Rejects with the error that
+   * stopped it — `MissingCredential`, `StateLocked`, `ProjectNotOwned`, … —
+   * after a `deploy.failed` event carrying the same.
+   */
+  readonly result: Promise<DeployResult>;
+}
+/**
+ * Deploy a project's stage.
+ *
+ * ```ts
+ * import { deploy } from '@geekmidas/cli/deploy';
+ *
+ * const run = deploy({ cwd: '/srv/checkouts/shop', stage: 'production' });
+ * for await (const event of run) {
+ *   if (event.type === 'app.deployed') console.log(event.app, event.url);
+ * }
+ * const result = await run.result;
+ * ```
+ *
+ * The run starts at once; iterating it is optional, and an iteration started
+ * late still sees every event from the first.
+ */
+export declare function deploy(input: DeployInput): DeployRun;
+//#endregion
+//#region src/deploy/orchestrate.d.ts
+/** Apps were asked for by name that the workspace does not have. */
+export declare class UnknownDeployApps extends Error {
+  readonly apps: readonly string[];
+  readonly available: readonly string[];
+  constructor(apps: readonly string[], available: readonly string[]);
+}
+/** Every app asked for deploys through some other target. */
+export declare class NoDeployableApps extends Error {
+  readonly stage: string;
+  readonly target: string;
+  constructor(stage: string, target: string);
+}
+/** A build-only run through a target with no build phase. */
+export declare class TargetBuildsNothing extends Error {
+  readonly target: string;
+  constructor(target: string);
+}
+/** A failed rollback, after the failure that called for it. */
+export declare class RollbackFailed extends Error {
+  readonly target: string;
+  /** What failed first, and was being rolled back. */
+  readonly failure: unknown;
+  constructor(target: string,
+  /** What failed first, and was being rolled back. */
+  failure: unknown, cause: unknown);
+}
+//#endregion
+//#region src/deploy/ownership.d.ts
+/**
+ * A Dokploy project with the name this deploy would use exists, and nothing
+ * says this workspace created it.
+ */
+export declare class ProjectNotOwned extends Error {
+  readonly projectName: string;
+  readonly projectId: string;
+  readonly identity: string;
+  /** The marker the project carries instead, if it carries one. */
+  readonly ownedBy: string | undefined;
+  constructor(projectName: string, projectId: string, identity: string,
+  /** The marker the project carries instead, if it carries one. */
+  ownedBy: string | undefined);
+}
+//#endregion
+//#region src/deploy/registry.d.ts
+/** There is nowhere to push images to, so Dokploy has nothing to pull. */
+export declare class RegistryNotConfigured extends Error {
+  readonly stage: string;
+  constructor(stage: string);
+}
+/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
+export declare class RegistryNotFound extends Error {
+  readonly registryId: string;
+  constructor(registryId: string);
+}
+/** More than one Dokploy registry serves the configured registry. */
+export declare class RegistryAmbiguous extends Error {
+  readonly registry: string;
+  readonly registryIds: readonly string[];
+  constructor(registry: string, registryIds: readonly string[]);
+}
+//#endregion
+export { type AppDeployResult, type AwsCredential, ConfigLoadFailed, ConfigObjectNotSerializable, ConstructDiscoveryFailed, ConstructsNotSerializable, type Credential, type CredentialKind, type CredentialKinds, type CredentialProvider, type CredentialRequest, type DeployEvent, type DeployEventError, type DeployEventType, type DeployIdentity, type DeployInput, type DeployLogger, type DeployPhase, type DeployResult, type DeployRun, DeployTargetNotYetSupported, type DevService, type InstallOptions, InvalidTargetOptions, type LocalSandboxOptions, MissingCredential, type MissingServiceKey, ProviderRemoved, type ResourceChange, type ResourceVia, type RollbackInput, type RolledBack, SECRETS_DIR_ENV, type Sandbox, SandboxCwdEscape, type SandboxExecOptions, type SandboxOutput, type SandboxResult, SecretNameInvalid, StateLocked, StateVersionConflict, type StoredCredentialsOptions, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, chainCredentials, confineCwd, deployIdentity, storedCredentials };
+//# sourceMappingURL=public.d.cts.map

package/dist/deploy/public.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/home.ts","../../src/providers/types.ts","../../src/providers/config.ts","../../src/deploy/devServices.ts","../../src/providers/notes.ts","../../src/providers/s3/errors.ts","../../src/run.ts","../../src/sandbox/env.ts","../../src/docker/templates.ts","../../src/sandbox/install.ts","../../src/sandbox/local.ts","../../src/sandbox/worker.ts","../../src/target/dokploy/dokploy-api.ts","../../src/target/dokploy/engine.ts","../../src/target/dokploy/health.ts","../../src/target/dokploy/migrations.ts","../../src/target/dokploy/rollback.ts","../../src/target/seeds.ts","../../src/target/sst/health.ts","../../src/target/sst/outputs.ts","../../src/target/sst/index.ts","../../src/deploy/deploy.ts","../../src/deploy/orchestrate.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;;;;;;qBAaa;;wBAGG,QAAQ,MAAK,OAAO;;;;cCYvB;KAED,uBAAuB;;;;qBC6BtB,6BAA6B;WAE/B,MAAM;WACN;WACA;EAHV,YACU,MAAM,cACN,eACA;;;;;;;;;qBCrBE;KAED,qBAAqB;;qBAcpB,oCAAoC;WAC3B;EAArB,YAAqB;;;;;;;qBAeT,qCAAqC;WAC5B;EAArB,YAAqB;;;UAiCL;EAChB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,UAAU;;EAEV;;EAEA;;;;;;qBAOY,sCAAsC;WAExC;WACA,kBAAkB;EAF5B,YACU,eACA,kBAAkB;;;;;qBChHhB,8BAA8B;WAEhC,MAAM;WACN;WACA;EAHV,YACU,MAAM,cACN,eACA;;;;;qBCuHE,qCAAqC;WAEvC;WACA;WACA;WACA;EAJV,YACU,YACA,gBACA,eACA;;;;;qBC9GE,sBAAsB;WAExB;WACA;WACA;WACA,QAAQ,OAAO;EAJzB,YACU,iBACA,yBACA,yBACA,QAAQ,OAAO;;;qBAUb,wBAAwB;WAE1B;WACA;WACA;EAHV,YACU,iBACA,yBACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC3BE,0CAA0C;;;;;wBAyDvC,eACf,SAAQ,OAAO,YACf,4BACE;;;KClFS;;;;qBCUC;UAEI;;EAEhB;;EAEA,iBAAiB;;;;;;;EAOjB;;;;;EAKA;;EAEA,MAAM,SAAS;;EAEf;;EAEA,SAAS;EACT,SAAS;;;qBAIG,oCAAoC;WAC3B;EAArB,YAAqB;;;qBAWT,2CAA2C;WAE7C;WACA;EAFV,YACU,wBACA;;;;;;;;;;;;;;;;;;;;wBAqJW,oBACrB,SAAS,SACT,UAAS,iBACP,QAAQ;;;UCpMM;;EAEhB;;;;;;;;;EASA;;;;;EAKA;;EAEA,UAAU,OAAO;;;;;;;;;;;;;;;;;qBA0BL,wBAAwB;WAC3B;WACA;WACA,KAAK,SAAS;EAEvB,YAAY,SAAS;EAUf,KACL,iBACA,yBACA,SAAS,qBACP,QAAQ;;;;;qBCpBC,4BAA4B;WAE9B;WACA;WACA;EAHV,YACU,cACA,yBACA;;;;;qBCqBE,yBAAyB;WAE3B;WACA,YAAY;EAFtB,YACU,uBACA,YAAY;;;qBAYV,2BAA2B;WAE7B;WACA;;WAEA,YAAY;EAJtB,YACU,uBACA,mBAEA;;EAAA,YAAY;;KA0vCX;;UAOK;EAChB;EACA,QAAQ;;EAER;EACA;EACA;;;;;qBCvoCY,4BAA4B;WAE9B;EADV,YACU,aACT;;;;;;;qBAeW,6BAA6B;WAE/B;EADV,YACU,yBACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;qBC/OE,4BAA4B;WAE9B;WACA;WACA;;WAEA;EALV,YACU,aACA,aACA,mBAEA;;EAAA;;;;;qBCHE,+BAA+B;WAEjC;;WAEA;EAHV,YACU,eAEA;;EAAA,gBACT;;;;UCNe;;EAEhB;EACA;;EAEA;;EAEA;;EAEA,cAAc;EACd,SAAS;;EAET,OAAO;;EAEP,UAAU;;;UAIM;EAChB;EACA,MAAM;EACN,IAAI;;;qBAIQ,yBAAyB;WAE3B;;WAEA;EAHV,YACU,eAEA;;EAAA;;;qBAWE,0BAA0B;WAE5B;WACA;EAFV,YACU,eACA;;;qBAWE,2BAA2B;WAClB;EAArB,YAAqB;;;;;;wBAaA,cACrB,OAAO,gBACL,QAAQ;;;;qBC3FE,0BAA0B;WAE5B;;WAEA;;WAEA;WACS;EANnB,YACU,eAEA;;EAAA,mBAEA;;EAAA,cACS;;;;;qBCIP,0BAA0B;WAE5B;;WAEA;IACR;IACA;IACA;IACA;;EAPF,YACU,eAEA;;EAAA;IACR;IACA;IACA;IACA;;;;;;qBCZU,6BAA6B;WAE/B;WACA;EAFV,YACU,cACA;;;;;qBC2BE,0BAA0B;WACjB;EAArB,YAAqB;;;;;;;;UCrBL;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;;;;EAKA;;;;;EAKA;;;;;;EAMA,UAAU,eAAe;;EAEzB;;EAEA;;;;;;EAMA;;;;;;EAMA;;;;;;EAMA;;;;;;EAMA,cAAc;;;;;;;;;;EAUd;;;;;;EAMA;;EAEA,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;;;;;;;;;;EAYA,UAAU;;;UAIM,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBAqEV,OAAO,OAAO,cAAc;;;;qBCzH/B,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAE3B;WACA;EAFV,YACU,eACA;;;qBAUE,4BAA4B;WACnB;EAArB,YAAqB;;;qBAST,uBAAuB;WAEzB;;WAEA;EAHV,YACU,gBAEA;;EAAA,kBACT;;;;;;;;qBCvGW,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}