@geekmidas/cli 10.0.0-alpha.92 → 10.0.0-alpha.94

package/dist/{rollback-D1d-fW0r.mjs → rollback-NroNbGC0.mjs}

@@ -1,12 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { r as storedCredentials } from "./credentials-C4KII3PD.mjs";
+import { r as storedCredentials } from "./credentials-DpfnUvIR.mjs";
 import { c as withSandbox } from "./sandbox-CbVB7uOD.mjs";
-import { N as assertDeployedStage } from "./workspace-Bzw7Zs82.mjs";
+import { N as assertDeployedStage } from "./workspace-DWK1PTXP.mjs";
 import { findWorkspaceRoot, loadWorkspaceConfig } from "./config.mjs";
-import { T as createEmptyState, U as createStateStore, k as recordRollback, s as DeployJournal } from "./seeds-CvGQJnPO.mjs";
-import { t as LocalSandbox } from "./local-Otp74ak0.mjs";
-import { i as dokployApi, l as restoreImage, p as verifySettings } from "./engine-C8Ye9MUm.mjs";
+import { ct as recordRollback, it as createEmptyState, nt as asDokployState } from "./seeds-CTxTZa-R.mjs";
+import { t as LocalSandbox } from "./local-B7Zv1NoA.mjs";
+import { _ as assertStateOutlivesRun, y as createStateStore } from "./sniffer-DCcuzHz_.mjs";
+import { r as DeployJournal } from "./providers-sTj-BG0S.mjs";
+import { i as dokployApi, l as restoreImage, p as verifySettings } from "./engine-DPMHThkg.mjs";
 import { resolve } from "node:path";
 //#region src/target/dokploy/rollback.ts
 /**
@@ -73,6 +75,7 @@ async function rollbackStage(input) {
 	return withSandbox(sandbox, async () => {
 		const { workspace } = await loadWorkspaceConfig(resolve(input.cwd), { sandbox });
 		assertDeployedStage(workspace.stages, input.stage);
+		assertStateOutlivesRun(workspace, input.stage, "deploy:rollback");
 		const store = await createStateStore({
 			config: workspace.state,
 			workspaceRoot: workspace.root,
@@ -81,7 +84,7 @@ async function rollbackStage(input) {
 		if (!await store.read(input.stage)) throw new StageNeverDeployed(input.stage);
 		const lock = await store.lock(input.stage, { operation: "rollback" });
 		try {
-			const journal = await DeployJournal.open(store, input.stage, () => createEmptyState(input.stage, "", ""));
+			const journal = await DeployJournal.open(store, input.stage, () => createEmptyState(input.stage, "", ""), asDokployState);
 			const { state } = journal;
 			const releases = state.releases ?? {};
 			const restorable = Object.keys(releases).filter((app) => releases[app].previous);
@@ -130,4 +133,4 @@ async function rollbackStage(input) {
 //#endregion
 export { rollback_exports as a, rollbackStage as i, RollbackNeedsApp as n, StageNeverDeployed as r, NothingToRollBack as t };
 
-//# sourceMappingURL=rollback-D1d-fW0r.mjs.map
+//# sourceMappingURL=rollback-NroNbGC0.mjs.map

package/dist/rollback-NroNbGC0.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback-NroNbGC0.mjs","names":[],"sources":["../src/target/dokploy/rollback.ts"],"sourcesContent":["/**\n * `gkm deploy:rollback`: a stage's apps put back on the release before the\n * one they run, by hand — for a release that passed its checks and turned out\n * wrong anyway.\n *\n * One app by default, because an app is what usually broke: rolling the API\n * back over a site fix that shipped beside it undoes the fix too. `atomic`\n * rolls back every app that has a release to go back to, for apps that only\n * work together — an API and the site built against its newer contract.\n *\n * It restores images and nothing else. The environment an app runs with is\n * the stage's, resolved on every deploy, and migrations are forward-only: a\n * migration that the older code cannot run against is undone by a new\n * migration, never by a rollback.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../../config';\nimport {\n\ttype CredentialProvider,\n\tstoredCredentials,\n} from '../../deploy/credentials';\nimport { DeployJournal } from '../../deploy/journal';\nimport {\n\tassertStateOutlivesRun,\n\tcreateStateStore,\n} from '../../deploy/StateStore';\nimport {\n\tasDokployState,\n\tcreateEmptyState,\n\ttype ReleasedImage,\n\trecordRollback,\n} from '../../deploy/state';\nimport { GkmError } from '../../errors';\nimport { LocalSandbox } from '../../sandbox/local';\nimport { type Sandbox, withSandbox } from '../../sandbox/sandbox';\nimport { assertDeployedStage } from '../../workspace/stages';\nimport { dokployApi, restoreImage, verifySettings } from './engine';\n\nexport interface RollbackInput {\n\t/** The project: the directory holding `gkm.config.ts`, or one inside it. */\n\tcwd: string;\n\tstage: string;\n\t/** The app to roll back. */\n\tapp?: string;\n\t/** Every app with an earlier release, instead of one. */\n\tatomic?: boolean;\n\t/** Defaults to the environment, then the logins `gkm login` stored. */\n\tcredentials?: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Each progress line. Defaults to none. */\n\tlog?: (line: string) => void;\n\t/** Where the config is loaded. Defaults to a `LocalSandbox` on the project. */\n\tsandbox?: Sandbox;\n}\n\n/** One app rolled back. */\nexport interface RolledBack {\n\tapp: string;\n\tfrom: ReleasedImage;\n\tto: ReleasedImage;\n}\n\n/** Neither an app nor every app was asked for. */\nexport class RollbackNeedsApp extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** The apps that have a release to go back to. */\n\t\treadonly apps: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Say what to roll back: --app <name> for one app (${apps.join(', ') || 'none has an earlier release'}), ` +\n\t\t\t\t`or --atomic for every app of \"${stage}\" together.`,\n\t\t);\n\t\tthis.name = 'RollbackNeedsApp';\n\t}\n}\n\n/** An app has no release before the one it runs. */\nexport class NothingToRollBack extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly app: string,\n\t) {\n\t\tsuper(\n\t\t\t`\"${app}\" has no earlier release on \"${stage}\" to roll back to: it has been released once, ` +\n\t\t\t\t'or every earlier release was itself rolled back. Deploy the version you want instead.',\n\t\t);\n\t\tthis.name = 'NothingToRollBack';\n\t}\n}\n\n/** The stage was never deployed through Dokploy from this state. */\nexport class StageNeverDeployed extends GkmError {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`\"${stage}\" has no deploy state, so there is nothing to roll back. ` +\n\t\t\t\t'Check the stage name, and that `state` in gkm.config.ts points at the store the deploys write to.',\n\t\t);\n\t\tthis.name = 'StageNeverDeployed';\n\t}\n}\n\n/**\n * Roll a stage's app — or, `atomic`, all of them — back to its previous\n * release, holding the stage's lock as a deploy does.\n */\nexport async function rollbackStage(\n\tinput: RollbackInput,\n): Promise<RolledBack[]> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst log = input.log ?? (() => {});\n\tconst credentials = input.credentials ?? storedCredentials();\n\tconst sandbox =\n\t\tinput.sandbox ??\n\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\n\treturn withSandbox(sandbox, async () => {\n\t\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\t\tsandbox,\n\t\t});\n\t\tassertDeployedStage(workspace.stages, input.stage);\n\t\tassertStateOutlivesRun(workspace, input.stage, 'deploy:rollback');\n\n\t\tconst store = await createStateStore({\n\t\t\tconfig: workspace.state,\n\t\t\tworkspaceRoot: workspace.root,\n\t\t\tworkspaceName: workspace.name,\n\t\t});\n\t\tif (!(await store.read(input.stage))) {\n\t\t\tthrow new StageNeverDeployed(input.stage);\n\t\t}\n\n\t\tconst lock = await store.lock(input.stage, { operation: 'rollback' });\n\t\ttry {\n\t\t\tconst journal = await DeployJournal.open(\n\t\t\t\tstore,\n\t\t\t\tinput.stage,\n\t\t\t\t() => createEmptyState(input.stage, '', ''),\n\t\t\t\tasDokployState,\n\t\t\t);\n\t\t\tconst { state } = journal;\n\t\t\tconst releases = state.releases ?? {};\n\t\t\tconst restorable = Object.keys(releases).filter(\n\t\t\t\t(app) => releases[app]!.previous,\n\t\t\t);\n\n\t\t\tlet apps: string[];\n\t\t\tif (input.atomic) {\n\t\t\t\tapps = restorable;\n\t\t\t\tif (apps.length === 0) {\n\t\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t\t}\n\t\t\t} else if (input.app) {\n\t\t\t\tif (!releases[input.app]?.previous) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, input.app);\n\t\t\t\t}\n\t\t\t\tapps = [input.app];\n\t\t\t} else {\n\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t}\n\n\t\t\tconst { api } = await dokployApi(workspace, { credentials, signal });\n\t\t\tconst verify = verifySettings(workspace.deploy.dokploy?.verify);\n\t\t\tconst rolled: RolledBack[] = [];\n\n\t\t\tfor (const app of apps) {\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t\tconst { current, previous } = releases[app]!;\n\t\t\t\tconst applicationId = state.applications[app];\n\t\t\t\tif (!previous || !applicationId) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, app);\n\t\t\t\t}\n\n\t\t\t\tlog(`⏪ ${app}: ${current.ref} → ${previous.ref}`);\n\t\t\t\tawait restoreImage(api, {\n\t\t\t\t\tapplicationId,\n\t\t\t\t\timage: previous,\n\t\t\t\t\tregistryId: state.registryId,\n\t\t\t\t\tverify,\n\t\t\t\t\tsignal,\n\t\t\t\t});\n\t\t\t\trecordRollback(state, app, previous);\n\t\t\t\tawait journal.save();\n\t\t\t\tlog(`   ✓ ${app} is running ${previous.ref}`);\n\t\t\t\trolled.push({ app, from: current, to: previous });\n\t\t\t}\n\n\t\t\treturn rolled;\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgEA,IAAa,mBAAb,cAAsC,SAAS;CAEpC;CAEA;CAHV,YACC,OAEA,MACC;EACD,MACC,oDAAoD,KAAK,KAAK,IAAI,KAAK,8BAA8B,mCACnE,MAAM,YACzC;EAPS,KAAA,QAAA;EAEA,KAAA,OAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,SAAS;CAErC;CACA;CAFV,YACC,OACA,KACC;EACD,MACC,IAAI,IAAI,+BAA+B,MAAM,oIAE9C;EANS,KAAA,QAAA;EACA,KAAA,MAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,SAAS;CAC3B;CAArB,YAAY,OAAwB;EACnC,MACC,IAAI,MAAM,6JAEX;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,eAAsB,cACrB,OACwB;CACxB,MAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CACrD,MAAM,MAAM,MAAM,cAAc,CAAC;CACjC,MAAM,cAAc,MAAM,eAAe,kBAAkB;CAC3D,MAAM,UACL,MAAM,WACN,IAAI,aAAa,EAAE,MAAM,kBAAkB,QAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;CAEjE,OAAO,YAAY,SAAS,YAAY;EACvC,MAAM,EAAE,cAAc,MAAM,oBAAoB,QAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;EACD,oBAAoB,UAAU,QAAQ,MAAM,KAAK;EACjD,uBAAuB,WAAW,MAAM,OAAO,iBAAiB;EAEhE,MAAM,QAAQ,MAAM,iBAAiB;GACpC,QAAQ,UAAU;GAClB,eAAe,UAAU;GACzB,eAAe,UAAU;EAC1B,CAAC;EACD,IAAI,CAAE,MAAM,MAAM,KAAK,MAAM,KAAK,GACjC,MAAM,IAAI,mBAAmB,MAAM,KAAK;EAGzC,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,EAAE,WAAW,WAAW,CAAC;EACpE,IAAI;GACH,MAAM,UAAU,MAAM,cAAc,KACnC,OACA,MAAM,aACA,iBAAiB,MAAM,OAAO,IAAI,EAAE,GAC1C,cACD;GACA,MAAM,EAAE,UAAU;GAClB,MAAM,WAAW,MAAM,YAAY,CAAC;GACpC,MAAM,aAAa,OAAO,KAAK,QAAQ,CAAC,CAAC,QACvC,QAAQ,SAAS,IAAI,CAAE,QACzB;GAEA,IAAI;GACJ,IAAI,MAAM,QAAQ;IACjB,OAAO;IACP,IAAI,KAAK,WAAW,GACnB,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAEpD,OAAO,IAAI,MAAM,KAAK;IACrB,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,UACzB,MAAM,IAAI,kBAAkB,MAAM,OAAO,MAAM,GAAG;IAEnD,OAAO,CAAC,MAAM,GAAG;GAClB,OACC,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAGnD,MAAM,EAAE,QAAQ,MAAM,WAAW,WAAW;IAAE;IAAa;GAAO,CAAC;GACnE,MAAM,SAAS,eAAe,UAAU,OAAO,SAAS,MAAM;GAC9D,MAAM,SAAuB,CAAC;GAE9B,KAAK,MAAM,OAAO,MAAM;IACvB,OAAO,eAAe;IACtB,MAAM,EAAE,SAAS,aAAa,SAAS;IACvC,MAAM,gBAAgB,MAAM,aAAa;IACzC,IAAI,CAAC,YAAY,CAAC,eACjB,MAAM,IAAI,kBAAkB,MAAM,OAAO,GAAG;IAG7C,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,SAAS,KAAK;IAChD,MAAM,aAAa,KAAK;KACvB;KACA,OAAO;KACP,YAAY,MAAM;KAClB;KACA;IACD,CAAC;IACD,eAAe,OAAO,KAAK,QAAQ;IACnC,MAAM,QAAQ,KAAK;IACnB,IAAI,QAAQ,IAAI,cAAc,SAAS,KAAK;IAC5C,OAAO,KAAK;KAAE;KAAK,MAAM;KAAS,IAAI;IAAS,CAAC;GACjD;GAEA,OAAO;EACR,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD,CAAC;AACF"}

package/dist/{runtime-Es1V4e9M.d.mts → runtime-BRCq6dQ7.d.mts}

@@ -1,4 +1,4 @@
-import { Dt as GkmError, K as DeployRuntime, et as TargetOptionsIssue } from "./types-B3Gqs175.mjs";
+import { K as DeployRuntime, et as TargetOptionsIssue, jt as GkmError } from "./types-DMoaFrjg.mjs";
 //#region src/target/builtins.d.ts
 /** A target name that is neither built in nor in `deploy.targets`. */
 declare class UnknownDeployTarget extends GkmError {
@@ -79,4 +79,4 @@ declare class TargetRuntimeUndeclared extends GkmError {
 }
 //#endregion
 export { TargetRuntimeMismatch as a, DeployTargetNotYetSupported as c, TargetPackageInvalid as i, UnknownDeployTarget as l, InvalidTargetOptions as n, ProviderRemoved as o, TargetEntryInvalid as r, TargetPackageNotFound as s, TargetRuntimeUndeclared as t };
-//# sourceMappingURL=runtime-Es1V4e9M.d.mts.map
+//# sourceMappingURL=runtime-BRCq6dQ7.d.mts.map

package/dist/{runtime-DDrHlYe5.d.cts.map → runtime-BRCq6dQ7.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"runtime-DDrHlYe5.d.cts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cAgEa,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}
+{"version":3,"file":"runtime-BRCq6dQ7.d.mts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cAgEa,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}

package/dist/{runtime-DDrHlYe5.d.cts → runtime-VktAo_8B.d.cts}

@@ -1,4 +1,4 @@
-import { Dt as GkmError, K as DeployRuntime, et as TargetOptionsIssue } from "./types-Bk9st2cd.cjs";
+import { K as DeployRuntime, et as TargetOptionsIssue, jt as GkmError } from "./types-DXyaSmqu.cjs";
 //#region src/target/builtins.d.ts
 /** A target name that is neither built in nor in `deploy.targets`. */
 declare class UnknownDeployTarget extends GkmError {
@@ -79,4 +79,4 @@ declare class TargetRuntimeUndeclared extends GkmError {
 }
 //#endregion
 export { TargetRuntimeMismatch as a, DeployTargetNotYetSupported as c, TargetPackageInvalid as i, UnknownDeployTarget as l, InvalidTargetOptions as n, ProviderRemoved as o, TargetEntryInvalid as r, TargetPackageNotFound as s, TargetRuntimeUndeclared as t };
-//# sourceMappingURL=runtime-DDrHlYe5.d.cts.map
+//# sourceMappingURL=runtime-VktAo_8B.d.cts.map

package/dist/{runtime-Es1V4e9M.d.mts.map → runtime-VktAo_8B.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"runtime-Es1V4e9M.d.mts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cAgEa,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}
+{"version":3,"file":"runtime-VktAo_8B.d.cts","names":[],"sources":["../src/target/builtins.ts","../src/target/package.ts","../src/target/provider.ts","../src/target/resolve.ts","../src/target/runtime.ts"],"mappings":";;;cAgEa,4BAA4B;WAE9B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAUE,oCAAoC;WAEtC;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;;;cCrDE,8BAA8B;WAEhC;WACA;WACA;EAHV,YACU,gBACA,qBACA;;;;;cCZE,wBAAwB;WAE1B;;WAEA;EAHV,YACU,kBAEA;;EAAA;;;;;cCoCE,6BAA6B;WAE/B;WACA;EAFV,YACU,gBACA;;;cAUE,2BAA2B;WAClB;EAArB,YAAqB;;;cAST,8BAA8B;WAEhC;WACA;WACA,UAAU;WACV,QAAQ;EAJlB,YACU,gBACA,qBACA,UAAU,eACV,QAAQ;;;cAUN,6BAA6B;WAE/B;WACA,iBAAiB;EAF3B,YACU,gBACA,iBAAiB;;;;;cC1Ef,gCAAgC;WAElC;WACA;;WAEA;EAJV,YACU,gBACA,qBAEA;;EAAA"}

package/dist/{sandbox-MaxSeU92.d.cts → sandbox-D1gd0iDz.d.cts}

@@ -1,4 +1,4 @@
-import { Dt as GkmError } from "./types-Bk9st2cd.cjs";
+import { jt as GkmError } from "./types-DXyaSmqu.cjs";
 //#region src/sandbox/sandbox.d.ts
 /** Where a command's output goes. */
 type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
@@ -101,4 +101,4 @@ declare class SecretNameInvalid extends GkmError {
 }
 //#endregion
 export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
-//# sourceMappingURL=sandbox-MaxSeU92.d.cts.map
+//# sourceMappingURL=sandbox-D1gd0iDz.d.cts.map

package/dist/{sandbox-C3WsTa5m.d.mts.map → sandbox-D1gd0iDz.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"sandbox-C3WsTa5m.d.mts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}
+{"version":3,"file":"sandbox-D1gd0iDz.d.cts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}

package/dist/{sandbox-C3WsTa5m.d.mts → sandbox-zHnRLCj0.d.mts}

@@ -1,4 +1,4 @@
-import { Dt as GkmError } from "./types-B3Gqs175.mjs";
+import { jt as GkmError } from "./types-DMoaFrjg.mjs";
 //#region src/sandbox/sandbox.d.ts
 /** Where a command's output goes. */
 type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
@@ -101,4 +101,4 @@ declare class SecretNameInvalid extends GkmError {
 }
 //#endregion
 export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
-//# sourceMappingURL=sandbox-C3WsTa5m.d.mts.map
+//# sourceMappingURL=sandbox-zHnRLCj0.d.mts.map

package/dist/{sandbox-MaxSeU92.d.cts.map → sandbox-zHnRLCj0.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"sandbox-MaxSeU92.d.cts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}
+{"version":3,"file":"sandbox-zHnRLCj0.d.mts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}

package/dist/secrets-CwLauUB_.mjs

@@ -0,0 +1,36 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { L as resolveStageTelemetry } from "./workspace-DWK1PTXP.mjs";
+import { At as withGeneratedSecrets, En as usesTelemetry, It as withRedisPassword, Pt as runsRedis, ir as initStageSecrets, mr as withLogsPassword } from "./seeds-CTxTZa-R.mjs";
+//#region src/compose/secrets.ts
+var secrets_exports = /* @__PURE__ */ __exportAll({ deployedStackSecrets: () => deployedStackSecrets });
+function deployedStackSecrets(workspace, stage, stored, manifest) {
+	const withSeed = withGeneratedSecrets(stored ?? initStageSecrets(stage), manifest);
+	const withLogs = resolveStageTelemetry({
+		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
+		stage,
+		local: false,
+		target: "compose",
+		runtime: "server",
+		selfHosted: true,
+		used: usesTelemetry(manifest)
+	})?.provider === "self-hosted" ? withLogsPassword(withSeed.secrets) : {
+		secrets: withSeed.secrets,
+		generated: []
+	};
+	const withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {}) ? withRedisPassword(withLogs.secrets) : {
+		secrets: withLogs.secrets,
+		generated: []
+	};
+	return {
+		secrets: withRedis.secrets,
+		generated: [
+			...withSeed.generated,
+			...withLogs.generated,
+			...withRedis.generated
+		]
+	};
+}
+//#endregion
+export { secrets_exports as n, deployedStackSecrets as t };
+
+//# sourceMappingURL=secrets-CwLauUB_.mjs.map

package/dist/secrets-CwLauUB_.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-CwLauUB_.mjs","names":[],"sources":["../src/compose/secrets.ts"],"sourcesContent":["/**\n * What a deployed stage's stack generates once and keeps: its seed, each\n * `secret` construct's value, the log UI's root password where its telemetry\n * is self-hosted, and the stack's Redis password where a cache lives in it.\n *\n * Pure: the compose target writes the result back to the stage's store, and\n * `gkm deploy --resources-only` composes the stack with it to read its hosts,\n * writing nothing.\n */\n\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\ttype GeneratedSecrets,\n\twithGeneratedSecrets,\n} from '../deploy/generated.js';\nimport { initStageSecrets } from '../secrets/storage.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { resolveStageTelemetry } from '../telemetry/config';\nimport { usesTelemetry } from '../telemetry/edges';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { withLogsPassword } from './logs';\nimport { runsRedis, withRedisPassword } from './redis';\n\nexport function deployedStackSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\tstored: StageSecrets | null,\n\tmanifest: ConstructManifest,\n): GeneratedSecrets {\n\tconst withSeed = withGeneratedSecrets(\n\t\tstored ?? initStageSecrets(stage),\n\t\tmanifest,\n\t);\n\t// The log UI's root password, generated once like the seed, where the\n\t// stage's telemetry is self-hosted and the stage set none.\n\tconst telemetry = resolveStageTelemetry({\n\t\t...(workspace.deploy?.telemetry\n\t\t\t? { telemetry: workspace.deploy.telemetry }\n\t\t\t: {}),\n\t\tstage,\n\t\tlocal: false,\n\t\ttarget: 'compose',\n\t\truntime: 'server',\n\t\tselfHosted: true,\n\t\tused: usesTelemetry(manifest),\n\t});\n\tconst withLogs =\n\t\ttelemetry?.provider === 'self-hosted'\n\t\t\t? withLogsPassword(withSeed.secrets)\n\t\t\t: { secrets: withSeed.secrets, generated: [] };\n\t// The stack's Redis password, the same way, where a cache lives in it.\n\tconst withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {})\n\t\t? withRedisPassword(withLogs.secrets)\n\t\t: { secrets: withLogs.secrets, generated: [] };\n\treturn {\n\t\tsecrets: withRedis.secrets,\n\t\tgenerated: [\n\t\t\t...withSeed.generated,\n\t\t\t...withLogs.generated,\n\t\t\t...withRedis.generated,\n\t\t],\n\t};\n}\n"],"mappings":";;;;;AAuBA,SAAgB,qBACf,WACA,OACA,QACA,UACmB;CACnB,MAAM,WAAW,qBAChB,UAAU,iBAAiB,KAAK,GAChC,QACD;CAcA,MAAM,WAXY,sBAAsB;EACvC,GAAI,UAAU,QAAQ,YACnB,EAAE,WAAW,UAAU,OAAO,UAAU,IACxC,CAAC;EACJ;EACA,OAAO;EACP,QAAQ;EACR,SAAS;EACT,YAAY;EACZ,MAAM,cAAc,QAAQ;CAC7B,CAES,CAAC,EAAE,aAAa,gBACrB,iBAAiB,SAAS,OAAO,IACjC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAE/C,MAAM,YAAY,UAAU,UAAU,SAAS,QAAQ,UAAU,CAAC,CAAC,IAChE,kBAAkB,SAAS,OAAO,IAClC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAC9C,OAAO;EACN,SAAS,UAAU;EACnB,WAAW;GACV,GAAG,SAAS;GACZ,GAAG,SAAS;GACZ,GAAG,UAAU;EACd;CACD;AACD"}

package/dist/secrets-DAvi_O9g.cjs

@@ -0,0 +1,47 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_workspace = require("./workspace-cSyi5nb1.cjs");
+const require_seeds = require("./seeds-BCg8X36S.cjs");
+//#region src/compose/secrets.ts
+var secrets_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ deployedStackSecrets: () => deployedStackSecrets });
+function deployedStackSecrets(workspace, stage, stored, manifest) {
+	const withSeed = require_seeds.withGeneratedSecrets(stored ?? require_seeds.initStageSecrets(stage), manifest);
+	const withLogs = require_workspace.resolveStageTelemetry({
+		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
+		stage,
+		local: false,
+		target: "compose",
+		runtime: "server",
+		selfHosted: true,
+		used: require_seeds.usesTelemetry(manifest)
+	})?.provider === "self-hosted" ? require_seeds.withLogsPassword(withSeed.secrets) : {
+		secrets: withSeed.secrets,
+		generated: []
+	};
+	const withRedis = require_seeds.runsRedis(manifest, withLogs.secrets.custom ?? {}) ? require_seeds.withRedisPassword(withLogs.secrets) : {
+		secrets: withLogs.secrets,
+		generated: []
+	};
+	return {
+		secrets: withRedis.secrets,
+		generated: [
+			...withSeed.generated,
+			...withLogs.generated,
+			...withRedis.generated
+		]
+	};
+}
+//#endregion
+Object.defineProperty(exports, "deployedStackSecrets", {
+	enumerable: true,
+	get: function() {
+		return deployedStackSecrets;
+	}
+});
+Object.defineProperty(exports, "secrets_exports", {
+	enumerable: true,
+	get: function() {
+		return secrets_exports;
+	}
+});
+
+//# sourceMappingURL=secrets-DAvi_O9g.cjs.map

package/dist/secrets-DAvi_O9g.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-DAvi_O9g.cjs","names":["withGeneratedSecrets","initStageSecrets","resolveStageTelemetry","usesTelemetry","withLogsPassword","runsRedis","withRedisPassword"],"sources":["../src/compose/secrets.ts"],"sourcesContent":["/**\n * What a deployed stage's stack generates once and keeps: its seed, each\n * `secret` construct's value, the log UI's root password where its telemetry\n * is self-hosted, and the stack's Redis password where a cache lives in it.\n *\n * Pure: the compose target writes the result back to the stage's store, and\n * `gkm deploy --resources-only` composes the stack with it to read its hosts,\n * writing nothing.\n */\n\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\ttype GeneratedSecrets,\n\twithGeneratedSecrets,\n} from '../deploy/generated.js';\nimport { initStageSecrets } from '../secrets/storage.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { resolveStageTelemetry } from '../telemetry/config';\nimport { usesTelemetry } from '../telemetry/edges';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { withLogsPassword } from './logs';\nimport { runsRedis, withRedisPassword } from './redis';\n\nexport function deployedStackSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\tstored: StageSecrets | null,\n\tmanifest: ConstructManifest,\n): GeneratedSecrets {\n\tconst withSeed = withGeneratedSecrets(\n\t\tstored ?? initStageSecrets(stage),\n\t\tmanifest,\n\t);\n\t// The log UI's root password, generated once like the seed, where the\n\t// stage's telemetry is self-hosted and the stage set none.\n\tconst telemetry = resolveStageTelemetry({\n\t\t...(workspace.deploy?.telemetry\n\t\t\t? { telemetry: workspace.deploy.telemetry }\n\t\t\t: {}),\n\t\tstage,\n\t\tlocal: false,\n\t\ttarget: 'compose',\n\t\truntime: 'server',\n\t\tselfHosted: true,\n\t\tused: usesTelemetry(manifest),\n\t});\n\tconst withLogs =\n\t\ttelemetry?.provider === 'self-hosted'\n\t\t\t? withLogsPassword(withSeed.secrets)\n\t\t\t: { secrets: withSeed.secrets, generated: [] };\n\t// The stack's Redis password, the same way, where a cache lives in it.\n\tconst withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {})\n\t\t? withRedisPassword(withLogs.secrets)\n\t\t: { secrets: withLogs.secrets, generated: [] };\n\treturn {\n\t\tsecrets: withRedis.secrets,\n\t\tgenerated: [\n\t\t\t...withSeed.generated,\n\t\t\t...withLogs.generated,\n\t\t\t...withRedis.generated,\n\t\t],\n\t};\n}\n"],"mappings":";;;;;AAuBA,SAAgB,qBACf,WACA,OACA,QACA,UACmB;CACnB,MAAM,WAAWA,cAAAA,qBAChB,UAAUC,cAAAA,iBAAiB,KAAK,GAChC,QACD;CAcA,MAAM,WAXYC,kBAAAA,sBAAsB;EACvC,GAAI,UAAU,QAAQ,YACnB,EAAE,WAAW,UAAU,OAAO,UAAU,IACxC,CAAC;EACJ;EACA,OAAO;EACP,QAAQ;EACR,SAAS;EACT,YAAY;EACZ,MAAMC,cAAAA,cAAc,QAAQ;CAC7B,CAES,CAAC,EAAE,aAAa,gBACrBC,cAAAA,iBAAiB,SAAS,OAAO,IACjC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAE/C,MAAM,YAAYC,cAAAA,UAAU,UAAU,SAAS,QAAQ,UAAU,CAAC,CAAC,IAChEC,cAAAA,kBAAkB,SAAS,OAAO,IAClC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAC9C,OAAO;EACN,SAAS,UAAU;EACnB,WAAW;GACV,GAAG,SAAS;GACZ,GAAG,SAAS;GACZ,GAAG,UAAU;EACd;CACD;AACD"}