@geekmidas/cli 10.0.0-alpha.9 → 10.0.0-alpha.91

package/dist/sniffer-IAQEpsQb.cjs

@@ -0,0 +1,1333 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_discover = require("./discover-D1It5r_h.cjs");
+const require_sandbox = require("./sandbox-CL--ZDui.cjs");
+const require_workspace = require("./workspace-CwW3Gkru.cjs");
+const require_local = require("./local-BjxDfPvy.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_url = require("node:url");
+let node_crypto = require("node:crypto");
+//#region src/secrets/encryption.ts
+var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	encryptSecrets: () => encryptSecrets,
+	generateDefineOptions: () => generateDefineOptions,
+	keyFingerprint: () => keyFingerprint
+});
+/** AES-256-GCM configuration */
+const ALGORITHM = "aes-256-gcm";
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+/**
+* Encrypt secrets for embedding in a bundle.
+* Uses AES-256-GCM with a randomly generated ephemeral key.
+*
+* @param secrets - Key-value pairs to encrypt
+* @returns Encrypted payload with ephemeral master key
+*/
+function encryptSecrets(secrets) {
+	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
+	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
+	const plaintext = JSON.stringify(secrets);
+	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+	const authTag = cipher.getAuthTag();
+	return {
+		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
+		iv: iv.toString("hex"),
+		masterKey: masterKey.toString("hex")
+	};
+}
+/**
+* Generate the define options for tsdown/esbuild.
+* These will be injected at build time.
+*/
+function generateDefineOptions(payload) {
+	return {
+		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
+		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
+	};
+}
+/**
+* A short, one-way name for a master key: the first 8 hex characters of its
+* SHA-256.
+*
+* Printed where the key itself used to be, so a person can tell which key a
+* build used — and match it against the one they hold — without the output
+* carrying a value that decrypts every secret of the stage.
+*/
+function keyFingerprint(masterKey) {
+	return (0, node_crypto.createHash)("sha256").update(masterKey).digest("hex").slice(0, 8);
+}
+//#endregion
+//#region src/deploy/events.ts
+/** An error as an event carries it: its name and message, nothing else. */
+function eventError(error) {
+	if (error instanceof Error) return {
+		name: error.name,
+		message: error.message
+	};
+	return {
+		name: "Error",
+		message: String(error)
+	};
+}
+//#endregion
+//#region src/target/dokploy/dokploy-api.ts
+var dokploy_api_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	DEFAULT_DEPLOYMENT_TIMEOUT_MS: () => DEFAULT_DEPLOYMENT_TIMEOUT_MS,
+	DEFAULT_DOKPLOY_TIMEOUT_MS: () => DEFAULT_DOKPLOY_TIMEOUT_MS,
+	DeploymentFailed: () => DeploymentFailed,
+	DeploymentTimedOut: () => DeploymentTimedOut,
+	DokployApi: () => DokployApi,
+	DokployApiError: () => DokployApiError,
+	DokployRequestTimedOut: () => DokployRequestTimedOut
+});
+/** Per request, so a stalled server fails the deploy, not the CI job. */
+const DEFAULT_DOKPLOY_TIMEOUT_MS = 3e4;
+/**
+* Dokploy accepted the connection but did not answer in time.
+*
+* Not retried: a request that arrived and stalled may still be acted on, and
+* sending it again could repeat a deploy or a create the server is already
+* doing.
+*/
+var DokployRequestTimedOut = class extends Error {
+	baseUrl;
+	endpoint;
+	timeoutMs;
+	constructor(baseUrl, endpoint, timeoutMs) {
+		super(`Dokploy at ${baseUrl} did not answer ${endpoint} within ${timeoutMs}ms. Check that the Dokploy server is healthy, or raise \`timeoutMs\` if this call is known to be slow.`);
+		this.baseUrl = baseUrl;
+		this.endpoint = endpoint;
+		this.timeoutMs = timeoutMs;
+		this.name = "DokployRequestTimedOut";
+	}
+};
+/**
+* Waits `ms` between retries, or rejects with the signal's reason the moment
+* it aborts — a caller who gave up should not sit through the backoff.
+*/
+function pause(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** How long a deployment may take to finish before a deploy gives up on it. */
+const DEFAULT_DEPLOYMENT_TIMEOUT_MS = 6e5;
+/** A deployment Dokploy ran and reported as failed. */
+var DeploymentFailed = class extends Error {
+	applicationId;
+	deployment;
+	constructor(applicationId, deployment) {
+		super(`Dokploy's deployment ${deployment.deploymentId} of application ${applicationId} ended in "${deployment.status}"${deployment.errorMessage ? `: ${deployment.errorMessage}` : ""}. Its log in Dokploy says why — usually an image the server could not pull, or a container that exited on start.`);
+		this.applicationId = applicationId;
+		this.deployment = deployment;
+		this.name = "DeploymentFailed";
+	}
+};
+/** A deployment that had not finished when the deploy stopped waiting. */
+var DeploymentTimedOut = class extends Error {
+	applicationId;
+	timeoutMs;
+	lastStatus;
+	constructor(applicationId, timeoutMs, lastStatus) {
+		super(`Application ${applicationId} did not finish deploying within ${Math.round(timeoutMs / 1e3)}s (${lastStatus ? `last status "${lastStatus}"` : "no deployment started"}). Check its deployment log in Dokploy, or raise deploy.dokploy.verify.deploymentTimeoutMs for an image that is slow to pull.`);
+		this.applicationId = applicationId;
+		this.timeoutMs = timeoutMs;
+		this.lastStatus = lastStatus;
+		this.name = "DeploymentTimedOut";
+	}
+};
+var DokployApiError = class extends Error {
+	status;
+	statusText;
+	issues;
+	constructor(message, status, statusText, issues) {
+		super(message);
+		this.status = status;
+		this.statusText = statusText;
+		this.issues = issues;
+		this.name = "DokployApiError";
+	}
+};
+/**
+* Dokploy API client
+*/
+var DokployApi = class {
+	baseUrl;
+	token;
+	timeoutMs;
+	signal;
+	constructor(options) {
+		this.baseUrl = options.baseUrl.replace(/\/$/, "");
+		this.token = options.token;
+		this.timeoutMs = options.timeoutMs ?? 3e4;
+		this.signal = options.signal;
+	}
+	/**
+	* Make a GET request to the Dokploy API
+	*/
+	async get(endpoint) {
+		return this.request("GET", endpoint);
+	}
+	/**
+	* Make a POST request to the Dokploy API
+	*/
+	async post(endpoint, body) {
+		return this.request("POST", endpoint, body);
+	}
+	/**
+	* Make a request to the Dokploy API
+	*/
+	async request(method, endpoint, body) {
+		const url = `${this.baseUrl}/api/${endpoint}`;
+		let response;
+		let timeout;
+		let lastError;
+		for (let attempt = 1; attempt <= 3; attempt++) {
+			this.signal?.throwIfAborted();
+			timeout = AbortSignal.timeout(this.timeoutMs);
+			try {
+				response = await fetch(url, {
+					method,
+					headers: {
+						"Content-Type": "application/json",
+						"x-api-key": this.token
+					},
+					body: body ? JSON.stringify(body) : void 0,
+					signal: this.signal ? AbortSignal.any([this.signal, timeout]) : timeout
+				});
+				break;
+			} catch (error) {
+				const stopped = this.stopped(timeout, endpoint);
+				if (stopped) throw stopped;
+				lastError = error;
+				if (attempt === 3) break;
+				await pause(attempt * 750, this.signal);
+			}
+		}
+		if (!response || !timeout) {
+			const detail = lastError instanceof Error ? lastError.message : String(lastError);
+			throw new DokployApiError(`Could not reach Dokploy at ${this.baseUrl} (${endpoint}): ${detail}`, 0, "Network error");
+		}
+		try {
+			return await this.read(response);
+		} catch (error) {
+			throw this.stopped(timeout, endpoint) ?? error;
+		}
+	}
+	/**
+	* What a request cut short should reject with: the caller's own reason
+	* when they aborted, `DokployRequestTimedOut` when the deadline passed,
+	* nothing when it was neither.
+	*/
+	stopped(timeout, endpoint) {
+		if (this.signal?.aborted) return this.signal.reason;
+		if (timeout.aborted) return new DokployRequestTimedOut(this.baseUrl, endpoint, this.timeoutMs);
+	}
+	/** Turns a response into its JSON body, or a `DokployApiError`. */
+	async read(response) {
+		if (!response.ok) {
+			let errorMessage = `Dokploy API error: ${response.status} ${response.statusText}`;
+			let issues;
+			try {
+				const errorBody = await response.json();
+				if (errorBody.message) errorMessage = `Dokploy API error: ${errorBody.message}`;
+				if (errorBody.issues?.length) {
+					issues = errorBody.issues;
+					errorMessage += `\n  Issues: ${errorBody.issues.map((i) => i.message).join(", ")}`;
+				}
+			} catch {}
+			throw new DokployApiError(errorMessage, response.status, response.statusText, issues);
+		}
+		const text = await response.text();
+		if (!text || text.trim() === "") return;
+		return JSON.parse(text);
+	}
+	/**
+	* Every external port published on this server, across every project.
+	*
+	* Dokploy knows what it has bound; guessing does not. A port that looks free
+	* from here can be held by a service in a project this deploy has never
+	* heard of — which surfaces as `Port 5432 is already in use by container
+	* "…"`, naming something the caller cannot see.
+	*
+	* `project.all` is a summary, so each project is fetched: the per-service
+	* `externalPort` only appears on `project.one`.
+	*/
+	async publishedPorts() {
+		const ports = /* @__PURE__ */ new Set();
+		const projects = await this.listProjects();
+		for (const project of projects) {
+			const details = await this.getProject(project.projectId);
+			for (const environment of details.environments ?? []) {
+				const resources = [
+					...environment.postgres ?? [],
+					...environment.redis ?? [],
+					...environment.applications ?? []
+				];
+				for (const resource of resources) if (typeof resource.externalPort === "number") ports.add(resource.externalPort);
+			}
+		}
+		return ports;
+	}
+	/**
+	* Validate the API token by making a test request
+	*/
+	async validateToken() {
+		try {
+			await this.get("project.all");
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* List all projects
+	*/
+	async listProjects() {
+		return this.get("project.all");
+	}
+	/**
+	* Get a single project by ID
+	*/
+	async getProject(projectId) {
+		return this.get(`project.one?projectId=${projectId}`);
+	}
+	/**
+	* Create a new project
+	*/
+	async createProject(name, description) {
+		return this.post("project.create", {
+			name,
+			description: description ?? `Created by gkm CLI`
+		});
+	}
+	/**
+	* Change a project's name or description.
+	*
+	* The name is sent with the description because `project.update` validates
+	* the whole project on some Dokploy versions, and a missing name fails it.
+	*/
+	async updateProject(projectId, updates) {
+		await this.post("project.update", {
+			projectId,
+			...updates
+		});
+	}
+	/**
+	* Delete a project and all its resources
+	*/
+	async deleteProject(projectId) {
+		await this.post("project.remove", { projectId });
+	}
+	/**
+	* Create an environment in a project
+	*/
+	async createEnvironment(projectId, name, description) {
+		return this.post("environment.create", {
+			projectId,
+			name,
+			description: description ?? `${name} environment`
+		});
+	}
+	/**
+	* List all applications in a project
+	*/
+	async listApplications(projectId) {
+		return this.listInProject(projectId, (env) => env.applications);
+	}
+	/**
+	* Everything of one kind in a project, across its environments.
+	*
+	* From `project.one`, because the per-kind `*.all?projectId=` endpoints
+	* return **404** on current Dokploy: resources live under environments now.
+	* Those calls used to be wrapped in `catch { return [] }`, which turned "I
+	* could not ask" into "there are none" — and for a find-or-create that is
+	* the worst available answer. Every deploy created a second application, a
+	* second Postgres and a second Redis, silently, for as long as the project
+	* existed.
+	*
+	* A failure here is not swallowed: creating a duplicate is worse than
+	* stopping.
+	*/
+	async listInProject(projectId, pick) {
+		return ((await this.getProject(projectId)).environments ?? []).flatMap((environment) => (pick(environment) ?? []).map((resource) => ({
+			...resource,
+			environmentId: environment.environmentId
+		})));
+	}
+	/**
+	* Find an application by name in a project
+	*/
+	async findApplicationByName(projectId, name, environmentId) {
+		const applications = await this.listApplications(projectId);
+		const normalizedName = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+		return applications.find((app) => (!environmentId || app.environmentId === environmentId) && (app.name === name || app.appName === normalizedName));
+	}
+	/**
+	* Create a new application
+	*/
+	async createApplication(name, projectId, environmentId) {
+		return this.post("application.create", {
+			name,
+			projectId,
+			environmentId,
+			appName: name.toLowerCase().replace(/[^a-z0-9-]/g, "-")
+		});
+	}
+	/**
+	* Find or create an application by name
+	*/
+	async findOrCreateApplication(name, projectId, environmentId) {
+		const existing = await this.findApplicationByName(projectId, name, environmentId);
+		if (existing) return {
+			application: existing,
+			created: false
+		};
+		return {
+			application: await this.createApplication(name, projectId, environmentId),
+			created: true
+		};
+	}
+	/**
+	* Get an application by ID
+	*/
+	async getApplication(applicationId) {
+		try {
+			return await this.get(`application.one?applicationId=${applicationId}`);
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Update an application
+	*/
+	async updateApplication(applicationId, updates) {
+		await this.post("application.update", {
+			applicationId,
+			...updates
+		});
+	}
+	/**
+	* Save environment variables for an application
+	*/
+	async saveApplicationEnv(applicationId, env, options) {
+		await this.post("application.saveEnvironment", {
+			applicationId,
+			env,
+			buildArgs: options?.buildArgs ?? null,
+			buildSecrets: options?.buildSecrets ?? null,
+			createEnvFile: false
+		});
+	}
+	/**
+	* Configure application to use Docker provider (pull from registry)
+	*
+	* For private registries, either:
+	* - Use `registryId` if the registry is configured in Dokploy
+	* - Or provide `username`, `password`, and `registryUrl` directly
+	*/
+	async saveDockerProvider(applicationId, dockerImage, options) {
+		await this.post("application.saveDockerProvider", {
+			applicationId,
+			dockerImage,
+			...options,
+			username: options?.username ?? null,
+			password: options?.password ?? null,
+			registryUrl: options?.registryUrl ?? null
+		});
+	}
+	/**
+	* Deploy an application
+	*/
+	async deployApplication(applicationId) {
+		await this.post("application.deploy", { applicationId });
+	}
+	/**
+	* An application's deployments, newest first.
+	*
+	* Sorted here rather than trusted to arrive sorted: which deployment is
+	* the latest is the whole question `waitForDeployment` asks.
+	*/
+	async listDeployments(applicationId) {
+		return [...await this.get(`deployment.all?applicationId=${encodeURIComponent(applicationId)}`)].sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+	}
+	/**
+	* When the application's latest deployment was created, by Dokploy's own
+	* clock — what `waitForDeployment`'s `since` is measured against. Epoch
+	* when it has none.
+	*/
+	async latestDeploymentAt(applicationId) {
+		const [latest] = await this.listDeployments(applicationId);
+		return new Date(latest ? Date.parse(latest.createdAt) : 0);
+	}
+	/**
+	* Wait for the deployment `application.deploy` queued to finish.
+	*
+	* `application.deploy` only queues one: it answers before the image is
+	* pulled, let alone running, so a deploy that stopped there reported
+	* success for containers that had not started. This polls the latest
+	* deployment created after `since` — Dokploy's clock, from
+	* `latestDeploymentAt` before deploying, so a laptop's skew cannot pick an
+	* older one — and the application's own status, backing off from
+	* `intervalMs` to `maxIntervalMs`.
+	*
+	* @throws {DeploymentFailed} when the deployment ends in `error` or is
+	*   cancelled, or the application reports `error` once it has finished.
+	* @throws {DeploymentTimedOut} when it has not finished within `timeoutMs`.
+	*/
+	async waitForDeployment(applicationId, options) {
+		const { since, timeoutMs = DEFAULT_DEPLOYMENT_TIMEOUT_MS, signal, intervalMs = 2e3, maxIntervalMs = 15e3 } = options;
+		const after = since.getTime();
+		const deadline = Date.now() + timeoutMs;
+		let interval = intervalMs;
+		let last;
+		while (true) {
+			signal?.throwIfAborted();
+			const deployment = (await this.listDeployments(applicationId)).find((d) => Date.parse(d.createdAt) > after);
+			last = deployment ?? last;
+			if (deployment) {
+				if (deployment.status === "error" || deployment.status === "cancelled") throw new DeploymentFailed(applicationId, deployment);
+				if (deployment.status === "done") {
+					const { applicationStatus } = await this.get(`application.one?applicationId=${encodeURIComponent(applicationId)}`);
+					if (applicationStatus === "error") throw new DeploymentFailed(applicationId, deployment);
+					if (applicationStatus !== "running") return deployment;
+				}
+			}
+			const left = deadline - Date.now();
+			if (left <= 0) throw new DeploymentTimedOut(applicationId, timeoutMs, last?.status);
+			await pause(Math.min(interval, left), signal);
+			interval = Math.min(interval * 2, maxIntervalMs);
+		}
+	}
+	/**
+	* Delete an application
+	*/
+	async deleteApplication(applicationId) {
+		await this.post("application.remove", { applicationId });
+	}
+	/**
+	* List all registries
+	*/
+	async listRegistries() {
+		return this.get("registry.all");
+	}
+	/**
+	* Create a new registry
+	*/
+	async createRegistry(registryName, registryUrl, username, password, options) {
+		return this.post("registry.create", {
+			registryName,
+			registryUrl,
+			username,
+			password,
+			imagePrefix: options?.imagePrefix
+		});
+	}
+	/**
+	* Get a registry by ID
+	*/
+	async getRegistry(registryId) {
+		return this.get(`registry.one?registryId=${registryId}`);
+	}
+	/**
+	* Update a registry
+	*/
+	async updateRegistry(registryId, updates) {
+		await this.post("registry.update", {
+			registryId,
+			...updates
+		});
+	}
+	/**
+	* Delete a registry
+	*/
+	async deleteRegistry(registryId) {
+		await this.post("registry.remove", { registryId });
+	}
+	/**
+	* List all Postgres databases in a project
+	*/
+	async listPostgres(projectId) {
+		return this.listInProject(projectId, (env) => env.postgres);
+	}
+	/**
+	* Find a Postgres database by name in a project
+	*/
+	async findPostgresByName(projectId, name) {
+		const databases = await this.listPostgres(projectId);
+		const normalizedName = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+		const match = databases.find((db) => db.name === name || db.appName === normalizedName);
+		if (!match) return void 0;
+		return this.getPostgres(match.postgresId);
+	}
+	/**
+	* Create a new Postgres database
+	*/
+	async createPostgres(name, projectId, environmentId, options) {
+		return this.post("postgres.create", {
+			name,
+			projectId,
+			environmentId,
+			appName: options?.appName ?? name.toLowerCase().replace(/[^a-z0-9-]/g, "-"),
+			databaseName: options?.databaseName,
+			databaseUser: options?.databaseUser ?? "postgres",
+			databasePassword: options?.databasePassword,
+			dockerImage: options?.dockerImage ?? "postgres:18",
+			description: options?.description ?? `Postgres database for ${name}`
+		});
+	}
+	/**
+	* Find or create a Postgres database by name
+	*/
+	async findOrCreatePostgres(name, projectId, environmentId, options) {
+		const existing = await this.findPostgresByName(projectId, name);
+		if (existing) return {
+			postgres: existing,
+			created: false
+		};
+		return {
+			postgres: await this.createPostgres(name, projectId, environmentId, options),
+			created: true
+		};
+	}
+	/**
+	* Get a Postgres database by ID
+	*/
+	async getPostgres(postgresId) {
+		return this.get(`postgres.one?postgresId=${postgresId}`);
+	}
+	/**
+	* Deploy a Postgres database
+	*/
+	async deployPostgres(postgresId) {
+		await this.post("postgres.deploy", { postgresId });
+	}
+	/**
+	* Save environment variables for Postgres
+	*/
+	async savePostgresEnv(postgresId, env) {
+		await this.post("postgres.saveEnvironment", {
+			postgresId,
+			env
+		});
+	}
+	/**
+	* Set external port for Postgres (for external access)
+	*/
+	async savePostgresExternalPort(postgresId, externalPort) {
+		await this.post("postgres.saveExternalPort", {
+			postgresId,
+			externalPort
+		});
+	}
+	/**
+	* Update Postgres configuration
+	*/
+	async updatePostgres(postgresId, updates) {
+		await this.post("postgres.update", {
+			postgresId,
+			...updates
+		});
+	}
+	/**
+	* Delete a Postgres database
+	*/
+	async deletePostgres(postgresId) {
+		await this.post("postgres.remove", { postgresId });
+	}
+	/**
+	* The compose stacks in a project.
+	*
+	* Dokploy has first-class primitives for Postgres and Redis and none for
+	* MinIO, so an object store is a compose stack — the one kind whose contents
+	* this target writes rather than configures.
+	*/
+	async listCompose(projectId) {
+		return this.listInProject(projectId, (env) => env.compose);
+	}
+	/** A compose stack by name, hydrated — `project.one` returns summaries. */
+	async findComposeByName(projectId, name) {
+		const summary = (await this.listCompose(projectId)).find((compose) => compose.name === name);
+		return summary ? this.getCompose(summary.composeId) : void 0;
+	}
+	async getCompose(composeId) {
+		return this.get(`compose.one?composeId=${composeId}`);
+	}
+	/**
+	* A compose stack carrying the file this target wrote.
+	*
+	* Created empty and then updated, because `compose.create` takes no file:
+	* it defaults to `sourceType: 'github'` and expects a repository. `raw` is
+	* what makes the file ours.
+	*/
+	async findOrCreateCompose(name, projectId, environmentId, composeFile) {
+		const existing = await this.findComposeByName(projectId, name);
+		const compose = existing ?? await this.post("compose.create", {
+			name,
+			environmentId,
+			composeType: "docker-compose"
+		});
+		await this.post("compose.update", {
+			composeId: compose.composeId,
+			sourceType: "raw",
+			composeFile
+		});
+		return {
+			compose,
+			created: !existing
+		};
+	}
+	async deployCompose(composeId) {
+		await this.post("compose.deploy", { composeId });
+	}
+	async deleteCompose(composeId) {
+		await this.post("compose.delete", {
+			composeId,
+			deleteVolumes: false
+		});
+	}
+	/**
+	* List all Redis instances in a project
+	*/
+	async listRedis(projectId) {
+		return this.listInProject(projectId, (env) => env.redis);
+	}
+	/**
+	* Find a Redis instance by name in a project
+	*/
+	async findRedisByName(projectId, name) {
+		const instances = await this.listRedis(projectId);
+		const normalizedName = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+		const match = instances.find((redis) => redis.name === name || redis.appName === normalizedName);
+		return match ? this.getRedis(match.redisId) : void 0;
+	}
+	/**
+	* Create a new Redis instance
+	*/
+	async createRedis(name, projectId, environmentId, options) {
+		return this.post("redis.create", {
+			name,
+			projectId,
+			environmentId,
+			appName: options?.appName ?? name.toLowerCase().replace(/[^a-z0-9-]/g, "-"),
+			databasePassword: options?.databasePassword,
+			dockerImage: options?.dockerImage ?? "redis:8",
+			description: options?.description ?? `Redis instance for ${name}`
+		});
+	}
+	/**
+	* Find or create a Redis instance by name
+	*/
+	async findOrCreateRedis(name, projectId, environmentId, options) {
+		const existing = await this.findRedisByName(projectId, name);
+		if (existing) return {
+			redis: existing,
+			created: false
+		};
+		return {
+			redis: await this.createRedis(name, projectId, environmentId, options),
+			created: true
+		};
+	}
+	/**
+	* Get a Redis instance by ID
+	*/
+	async getRedis(redisId) {
+		return this.get(`redis.one?redisId=${redisId}`);
+	}
+	/**
+	* Deploy a Redis instance
+	*/
+	async deployRedis(redisId) {
+		await this.post("redis.deploy", { redisId });
+	}
+	/**
+	* Save environment variables for Redis
+	*/
+	async saveRedisEnv(redisId, env) {
+		await this.post("redis.saveEnvironment", {
+			redisId,
+			env
+		});
+	}
+	/**
+	* Set external port for Redis (for external access)
+	*/
+	async saveRedisExternalPort(redisId, externalPort) {
+		await this.post("redis.saveExternalPort", {
+			redisId,
+			externalPort
+		});
+	}
+	/**
+	* Update Redis configuration
+	*/
+	async updateRedis(redisId, updates) {
+		await this.post("redis.update", {
+			redisId,
+			...updates
+		});
+	}
+	/**
+	* Delete a Redis instance
+	*/
+	async deleteRedis(redisId) {
+		await this.post("redis.remove", { redisId });
+	}
+	/**
+	* Create a new domain for an application
+	*/
+	async createDomain(options) {
+		return this.post("domain.create", options);
+	}
+	/**
+	* Update an existing domain
+	*/
+	async updateDomain(domainId, updates) {
+		await this.post("domain.update", {
+			domainId,
+			...updates
+		});
+	}
+	/**
+	* Delete a domain
+	*/
+	async deleteDomain(domainId) {
+		await this.post("domain.delete", { domainId });
+	}
+	/**
+	* Get a domain by ID
+	*/
+	async getDomain(domainId) {
+		return this.get(`domain.one?domainId=${domainId}`);
+	}
+	/**
+	* Get all domains for an application
+	*/
+	async getDomainsByApplicationId(applicationId) {
+		return this.get(`domain.byApplicationId?applicationId=${applicationId}`);
+	}
+	/**
+	* Validate a domain and trigger SSL certificate generation
+	*
+	* This should be called after DNS records are created and propagated.
+	* It triggers Let's Encrypt certificate generation for HTTPS domains.
+	*
+	* @param domain - The domain hostname to validate (e.g., 'api.example.com')
+	*/
+	async validateDomain(domain) {
+		return this.post("domain.validateDomain", { domain });
+	}
+	/**
+	* Auto-generate a domain name for an application
+	*/
+	async generateDomain(appName, serverId) {
+		return this.post("domain.generateDomain", {
+			appName,
+			serverId
+		});
+	}
+	/**
+	* List all backup destinations
+	*/
+	async listDestinations() {
+		return this.get("destination.all");
+	}
+	/**
+	* Get a destination by ID
+	*/
+	async getDestination(destinationId) {
+		return this.get(`destination.one?destinationId=${destinationId}`);
+	}
+	/**
+	* Create a new S3 backup destination
+	*/
+	async createDestination(options) {
+		return this.post("destination.create", { ...options });
+	}
+	/**
+	* Find a destination by name
+	*/
+	async findDestinationByName(name) {
+		return (await this.listDestinations()).find((d) => d.name === name);
+	}
+	/**
+	* Find or create a destination by name
+	*/
+	async findOrCreateDestination(name, options) {
+		const existing = await this.findDestinationByName(name);
+		if (existing) return {
+			destination: existing,
+			created: false
+		};
+		return {
+			destination: await this.createDestination({
+				name,
+				...options
+			}),
+			created: true
+		};
+	}
+	/**
+	* Update a destination
+	*/
+	async updateDestination(destinationId, updates) {
+		await this.post("destination.update", {
+			destinationId,
+			...updates
+		});
+	}
+	/**
+	* Delete a destination
+	*/
+	async deleteDestination(destinationId) {
+		await this.post("destination.remove", { destinationId });
+	}
+	/**
+	* Test connection to a destination
+	*/
+	async testDestinationConnection(destinationId) {
+		return this.post("destination.testConnection", { destinationId });
+	}
+	/**
+	* Create a backup schedule for postgres
+	*/
+	async createPostgresBackup(options) {
+		return this.post("backup.create", {
+			...options,
+			databaseType: "postgres"
+		});
+	}
+	/**
+	* List backups for a postgres database
+	*/
+	async listPostgresBackups(postgresId) {
+		return this.get(`backup.all?postgresId=${postgresId}&databaseType=postgres`);
+	}
+	/**
+	* Get a backup by ID
+	*/
+	async getBackup(backupId) {
+		return this.get(`backup.one?backupId=${backupId}`);
+	}
+	/**
+	* Update a backup schedule
+	*/
+	async updateBackup(backupId, updates) {
+		await this.post("backup.update", {
+			backupId,
+			...updates
+		});
+	}
+	/**
+	* Delete a backup schedule
+	*/
+	async deleteBackup(backupId) {
+		await this.post("backup.remove", { backupId });
+	}
+	/**
+	* Trigger a manual backup run
+	*/
+	async runBackupManually(backupId) {
+		await this.post("backup.manualBackup", { backupId });
+	}
+};
+//#endregion
+//#region src/workspace/client-generator.ts
+/**
+* Normalize routes to an array of patterns.
+* Handles a glob or a list of them.
+* @internal Exported for use in dev command
+*/
+function normalizeRoutes(routes) {
+	if (!routes) return [];
+	return Array.isArray(routes) ? routes : [routes];
+}
+//#endregion
+//#region src/deploy/sniffer.ts
+const __filename$1 = (0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href);
+const __dirname$1 = (0, node_path.dirname)(__filename$1);
+/**
+* Resolve the path to a sniffer helper file.
+* Handles both dev (.ts with tsx) and production (.mjs from dist).
+*
+* In production: sniffer.ts is bundled into dist/index.mjs, but sniffer helper
+* files are output to dist/deploy/ as standalone modules for subprocess loading.
+*
+* In development: All files are in src/deploy/ and loaded via tsx.
+*/
+function resolveSnifferFile(baseName) {
+	const deployMjsPath = (0, node_path.resolve)(__dirname$1, "deploy", `${baseName}.mjs`);
+	if ((0, node_fs.existsSync)(deployMjsPath)) return deployMjsPath;
+	const mjsPath = (0, node_path.resolve)(__dirname$1, `${baseName}.mjs`);
+	if ((0, node_fs.existsSync)(mjsPath)) return mjsPath;
+	const tsPath = (0, node_path.resolve)(__dirname$1, `${baseName}.ts`);
+	if ((0, node_fs.existsSync)(tsPath)) return tsPath;
+	return tsPath;
+}
+/**
+* Run a sniffer worker in the sandbox, with the sandbox's environment and
+* nothing of the deploy's: the deploy's Dokploy token, registry login and AWS
+* keys stay where they are. A worker that outlives the timeout is killed, and
+* comes back as the error the caller reports.
+*/
+async function runSniffer(run, workspacePath, cwd, nodeArgs) {
+	const sandbox = run.sandbox ?? require_sandbox.activeSandbox() ?? new require_local.LocalSandbox({ root: (0, node_path.resolve)(workspacePath) });
+	try {
+		const result = await sandbox.exec("node", nodeArgs, {
+			cwd,
+			env: { ...sandbox.env },
+			timeoutMs: run.timeoutMs ?? 3e4,
+			output: "capture"
+		});
+		return {
+			stdout: result.stdout,
+			stderr: result.stderr,
+			code: result.exitCode
+		};
+	} catch (error) {
+		return { error: error instanceof Error ? error : new Error(String(error)) };
+	}
+}
+/** The worker's JSON answer: the last object on stdout naming `envVars`. */
+function snifferAnswer(stdout) {
+	try {
+		const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+		return jsonMatch ? JSON.parse(jsonMatch[0]) : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Get required environment variables for an app.
+*
+* Detection strategy (in order):
+* 1. Frontend apps: Returns empty (no server secrets)
+* 2. Apps with `requiredEnv`: Uses explicit list from config
+* 3. Entry apps: Imports entry file in subprocess to capture config.parse() calls
+* 4. Route-based apps: Loads route files and calls getEnvironment() on each construct
+* 5. Apps with `envParser` (no routes): Runs SnifferEnvironmentParser to detect usage
+* 6. Apps with neither: Returns empty
+*
+* This function handles "fire and forget" async operations gracefully,
+* capturing errors and unhandled rejections without failing the build.
+*
+* @param app - The normalized app configuration
+* @param appName - The name of the app
+* @param workspacePath - Absolute path to the workspace root
+* @param options - Optional configuration for sniffing behavior
+* @returns The sniffed environment with required variables
+*/
+async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
+	const { logWarnings = true, markOptional = false } = options;
+	const run = {
+		...options.sandbox ? { sandbox: options.sandbox } : {},
+		...options.timeoutMs ? { timeoutMs: options.timeoutMs } : {}
+	};
+	if (app.type === "web" || app.type === "mobile") {
+		const publicPrefix = require_workspace.getPublicEnvPrefix(app.framework);
+		const depVars = publicPrefix ? (app.dependencies ?? []).map((dep) => `${publicPrefix}${dep.toUpperCase()}_URL`) : [];
+		if (app.config) {
+			const sniffedVars = [];
+			const sniffedOptional = [];
+			const configPaths = [];
+			if (app.config.client) configPaths.push(app.config.client);
+			if (app.config.server) configPaths.push(app.config.server);
+			for (const configPath of configPaths) {
+				const result = await sniffEntryFile(configPath, app.path, workspacePath, run);
+				if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
+				sniffedVars.push(...result.envVars);
+				sniffedOptional.push(...result.optionalEnvVars);
+			}
+			const optionalEnvVars = [...new Set(sniffedOptional)];
+			return {
+				appName,
+				requiredEnvVars: applyMarkOptional([.../* @__PURE__ */ new Set([...depVars, ...sniffedVars])], optionalEnvVars, markOptional),
+				optionalEnvVars
+			};
+		}
+		return {
+			appName,
+			requiredEnvVars: depVars,
+			optionalEnvVars: []
+		};
+	}
+	if (app.entry) {
+		const result = await sniffEntryFile(app.entry, app.path, workspacePath, run);
+		if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	if (app.routes) {
+		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath, run);
+		if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	if (app.envParser) {
+		const result = await sniffEnvParser(app.envParser, app.path, workspacePath, run);
+		if (logWarnings) {
+			if (result.error) require_discover.output.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
+			if (result.unhandledRejections.length > 0) require_discover.output.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
+		}
+		return {
+			appName,
+			requiredEnvVars: applyMarkOptional(result.envVars, result.optionalEnvVars, markOptional),
+			optionalEnvVars: result.optionalEnvVars
+		};
+	}
+	return {
+		appName,
+		requiredEnvVars: [],
+		optionalEnvVars: []
+	};
+}
+/**
+* Apply the `?` suffix to optional variables in an env var list.
+* Only modifies the list when `markOptional` is true and there are optional vars.
+*/
+function applyMarkOptional(envVars, optionalEnvVars, markOptional) {
+	if (!markOptional || optionalEnvVars.length === 0) return envVars;
+	const optionalSet = new Set(optionalEnvVars);
+	return envVars.map((v) => optionalSet.has(v) ? `${v}?` : v);
+}
+/**
+* Sniff an entry file by importing it in a subprocess.
+*
+* Entry apps call `config.parse()` at module load time. To capture which
+* env vars are accessed, we:
+* 1. Spawn a subprocess with a module loader hook
+* 2. The loader intercepts `@geekmidas/envkit` and replaces EnvironmentParser
+*    with SnifferEnvironmentParser
+* 3. Import the entry file (triggers config.parse())
+* 4. Capture and return the accessed env var names
+*
+* This approach provides process isolation - each app is sniffed in its own
+* subprocess, preventing module cache pollution.
+*
+* @param entryPath - Relative path to the entry file (e.g., './src/index.ts')
+* @param appPath - The app's path relative to workspace (e.g., 'apps/auth')
+* @param workspacePath - Absolute path to workspace root
+* @returns EntrySniffResult with env vars and optional error
+*/
+async function sniffEntryFile(entryPath, appPath, workspacePath, run = {}) {
+	const fullEntryPath = (0, node_path.resolve)(workspacePath, appPath, entryPath);
+	const loaderPath = resolveSnifferFile("sniffer-loader");
+	const workerPath = resolveSnifferFile("sniffer-worker");
+	const ran = await runSniffer(run, workspacePath, (0, node_path.resolve)(workspacePath, appPath), require_discover.nodeWithTsx(workerPath, [fullEntryPath], [loaderPath]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: ran.error
+	};
+	const answer = snifferAnswer(ran.stdout);
+	if (answer) return {
+		envVars: answer.envVars || [],
+		optionalEnvVars: answer.optionalEnvVars || [],
+		error: answer.error ? new Error(answer.error) : void 0
+	};
+	return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff entry file (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
+}
+/**
+* Sniff route files by loading constructs and calling getEnvironment().
+*
+* Route-based apps have endpoints, functions, crons, and subscribers that
+* use services. Each service's register() method accesses environment variables.
+*
+* This runs in a subprocess with tsx loader to properly handle TypeScript
+* compilation and path alias resolution (e.g., `src/...` imports).
+*
+* @param routes - Glob pattern(s) for route files
+* @param appPath - The app's path relative to workspace (e.g., 'apps/api')
+* @param workspacePath - Absolute path to workspace root
+* @returns EntrySniffResult with env vars and optional error
+*/
+async function sniffRouteFiles(routes, appPath, workspacePath, run = {}) {
+	const fullAppPath = (0, node_path.resolve)(workspacePath, appPath);
+	const workerPath = resolveSnifferFile("sniffer-routes-worker");
+	const pattern = (Array.isArray(routes) ? routes : [routes])[0];
+	if (!pattern) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error("No route patterns provided")
+	};
+	const ran = await runSniffer(run, workspacePath, fullAppPath, require_discover.nodeWithTsx(workerPath, [fullAppPath, pattern]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: ran.error
+	};
+	if (ran.stderr) ran.stderr.split("\n").filter((line) => line.trim()).forEach((line) => require_discover.output.warn(line));
+	const answer = snifferAnswer(ran.stdout);
+	if (answer) return {
+		envVars: answer.envVars || [],
+		optionalEnvVars: answer.optionalEnvVars || [],
+		error: answer.error ? new Error(answer.error) : void 0
+	};
+	return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff route files (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
+}
+/**
+* Run the SnifferEnvironmentParser on an envParser module to detect
+* which environment variables it accesses.
+*
+* In a subprocess, like the entry and route sniffers: the module is the
+* project's code, and it was imported into the deploy itself before — with
+* every credential the deploy held in reach. Fire-and-forget rejections are
+* collected there with the shared `sniffWithFireAndForget`.
+*
+* @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
+* @param appPath - The app's path relative to workspace
+* @param workspacePath - Absolute path to workspace root
+* @returns SniffResult with env vars and any errors encountered
+*/
+async function sniffEnvParser(envParserPath, appPath, workspacePath, run = {}) {
+	const [modulePath, exportName = "default"] = envParserPath.split("#");
+	if (!modulePath) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: []
+	};
+	const appRoot = (0, node_path.resolve)(workspacePath, appPath);
+	const fullPath = (0, node_path.resolve)(appRoot, modulePath);
+	const workerPath = resolveSnifferFile("sniffer-envparser-worker");
+	const ran = await runSniffer(run, workspacePath, appRoot, require_discover.nodeWithTsx(workerPath, [fullPath, exportName]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: [],
+		error: ran.error
+	};
+	const answer = snifferAnswer(ran.stdout);
+	if (!answer) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff envParser (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
+	for (const warning of answer.warnings ?? []) require_discover.output.warn(warning);
+	return {
+		envVars: answer.envVars ?? [],
+		optionalEnvVars: answer.optionalEnvVars ?? [],
+		unhandledRejections: (answer.unhandledRejections ?? []).map((message) => new Error(message)),
+		...answer.error ? { error: new Error(answer.error) } : {}
+	};
+}
+/**
+* Sniff environment requirements for multiple apps.
+*
+* @param apps - Map of app name to app config
+* @param workspacePath - Absolute path to workspace root
+* @param options - Optional configuration for sniffing behavior
+* @returns Map of app name to sniffed environment
+*/
+async function sniffAllApps(apps, workspacePath, options = {}) {
+	const results = /* @__PURE__ */ new Map();
+	for (const [appName, app] of Object.entries(apps)) {
+		const sniffed = await sniffAppEnvironment(app, appName, workspacePath, options);
+		results.set(appName, sniffed);
+	}
+	return results;
+}
+//#endregion
+Object.defineProperty(exports, "DEFAULT_DEPLOYMENT_TIMEOUT_MS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_DEPLOYMENT_TIMEOUT_MS;
+	}
+});
+Object.defineProperty(exports, "DeploymentFailed", {
+	enumerable: true,
+	get: function() {
+		return DeploymentFailed;
+	}
+});
+Object.defineProperty(exports, "DeploymentTimedOut", {
+	enumerable: true,
+	get: function() {
+		return DeploymentTimedOut;
+	}
+});
+Object.defineProperty(exports, "DokployApi", {
+	enumerable: true,
+	get: function() {
+		return DokployApi;
+	}
+});
+Object.defineProperty(exports, "DokployApiError", {
+	enumerable: true,
+	get: function() {
+		return DokployApiError;
+	}
+});
+Object.defineProperty(exports, "dokploy_api_exports", {
+	enumerable: true,
+	get: function() {
+		return dokploy_api_exports;
+	}
+});
+Object.defineProperty(exports, "encryptSecrets", {
+	enumerable: true,
+	get: function() {
+		return encryptSecrets;
+	}
+});
+Object.defineProperty(exports, "encryption_exports", {
+	enumerable: true,
+	get: function() {
+		return encryption_exports;
+	}
+});
+Object.defineProperty(exports, "eventError", {
+	enumerable: true,
+	get: function() {
+		return eventError;
+	}
+});
+Object.defineProperty(exports, "keyFingerprint", {
+	enumerable: true,
+	get: function() {
+		return keyFingerprint;
+	}
+});
+Object.defineProperty(exports, "sniffAllApps", {
+	enumerable: true,
+	get: function() {
+		return sniffAllApps;
+	}
+});
+Object.defineProperty(exports, "sniffAppEnvironment", {
+	enumerable: true,
+	get: function() {
+		return sniffAppEnvironment;
+	}
+});
+
+//# sourceMappingURL=sniffer-IAQEpsQb.cjs.map