@geekmidas/cli 10.0.0-alpha.93 → 10.0.0-alpha.94

package/dist/{deploy-C3Mhnmus.cjs → deploy-C911Akkn.cjs}

@@ -1,15 +1,16 @@
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_credentials = require("./credentials-QBu7VgaQ.cjs");
+const require_credentials = require("./credentials-D7XJypNd.cjs");
 const require_discover = require("./discover-DPgu-ScS.cjs");
 const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-CHOB2Xg3.cjs");
+const require_workspace = require("./workspace-cSyi5nb1.cjs");
 const require_define = require("./define-crmMcXFS.cjs");
 const require_config = require("./config.cjs");
-const require_seeds = require("./seeds-c-ByX9je.cjs");
-const require_resolve = require("./resolve-g8htuR80.cjs");
-const require_local = require("./local-B61kUh0w.cjs");
-const require_sniffer = require("./sniffer-Dq5BS98f.cjs");
+const require_seeds = require("./seeds-BCg8X36S.cjs");
+const require_resolve = require("./resolve-CFEOtRsl.cjs");
+const require_local = require("./local-OPC9BCZt.cjs");
+const require_sniffer = require("./sniffer-C0z3NB2A.cjs");
+const require_providers = require("./providers-BFeP_mYw.cjs");
 let node_path = require("node:path");
 //#region src/target/secrets.ts
 /**
@@ -81,6 +82,13 @@ async function deploySecrets(workspace, stage, redactor, options = {}) {
 * reporting each as it starts, finishes or fails. Everything that is about
 * *where* the stage goes is the target's.
 */
+/** `--resources-only` with `--skip-resources`: the one asks for what the other skips. */
+var ResourcesOnlyAndSkipped = class extends require_errors.GkmError {
+	constructor() {
+		super("--resources-only creates the stage's resources and nothing else, and --skip-resources deploys without creating them. Run the first where the cloud credentials are (a CI runner), then the second where the stack runs.");
+		this.name = "ResourcesOnlyAndSkipped";
+	}
+};
 /** Apps were asked for by name that the workspace does not have. */
 var UnknownDeployApps = class extends require_errors.GkmError {
 	apps;
@@ -192,7 +200,23 @@ async function runDeploy(source, request, ctx) {
 	}
 	const { resolved, phaseCtx, store } = prepared;
 	const { target } = resolved;
+	const resources = !ctx.buildOnly && !request.skipResources && phaseCtx.stage !== phaseCtx.workspace.stages.local;
+	const provision = async () => {
+		if (!request.skipDns && resolved.target.runtime === "server") try {
+			await require_seeds.dnsCredentials(phaseCtx.stage, require_seeds.stageDnsDomains(phaseCtx.stage, phaseCtx.workspace.domains, phaseCtx.workspace.dns), ctx.credentials);
+		} catch (error) {
+			emit({
+				type: "phase.failed",
+				phase: "validate",
+				error: require_sniffer.eventError(error)
+			});
+			throw error;
+		}
+		await provisionResources(phaseCtx, request, ctx, store, emit);
+	};
 	if (ctx.dryRun) {
+		if (resources) await provision();
+		if (request.resourcesOnly) return resourcesOnly(target, phaseCtx, emit);
 		const run = await validate(target, phaseCtx, emit);
 		await phase("plan", () => target.plan(phaseCtx, run));
 		return target.result(phaseCtx, run);
@@ -205,7 +229,7 @@ async function runDeploy(source, request, ctx) {
 	}
 	let lock;
 	try {
-		require_seeds.assertStateOutlivesRun(phaseCtx.workspace, stage, "deploy");
+		require_sniffer.assertStateOutlivesRun(phaseCtx.workspace, stage, "deploy");
 		lock = await store.lock(stage, { operation: "deploy" });
 	} catch (error) {
 		emit({
@@ -216,6 +240,8 @@ async function runDeploy(source, request, ctx) {
 		throw error;
 	}
 	try {
+		if (resources) await provision();
+		if (request.resourcesOnly) return resourcesOnly(target, phaseCtx, emit);
 		const run = await validate(target, phaseCtx, emit);
 		if (target.provision) await phase("provision", () => target.provision(phaseCtx, run));
 		if (target.build) await phase("build", () => target.build(phaseCtx, run));
@@ -242,6 +268,88 @@ async function runDeploy(source, request, ctx) {
 		await lock.release();
 	}
 }
+/**
+* The stage's providers, run inside the validate phase. A dry run plans them
+* and, so the checks after it see the stage as the run would leave it, reads
+* the keys they would write as placeholders.
+*/
+async function provisionResources(phaseCtx, request, ctx, store, emit) {
+	try {
+		const reports = await require_providers.provisionStage({
+			workspace: phaseCtx.workspace,
+			stage: phaseCtx.stage,
+			manifest: phaseCtx.manifest,
+			runnables: phaseCtx.runnables ?? {},
+			secrets: phaseCtx.secrets,
+			state: store,
+			dryRun: ctx.dryRun,
+			...request.rotateKeys ? { rotateKeys: true } : {},
+			...request.retireOldKeys ? { retireOldKeys: true } : {},
+			...ctx.home ? { home: ctx.home } : {},
+			log: (line) => phaseCtx.logger.info(line)
+		});
+		if (!ctx.dryRun) return;
+		const planned = reports.flatMap((r) => r.planned);
+		if (planned.length === 0) return;
+		const secrets = phaseCtx.secrets;
+		phaseCtx.secrets = {
+			...secrets,
+			async read() {
+				const stored = await secrets.read() ?? require_seeds.initStageSecrets(phaseCtx.stage);
+				const custom = { ...stored.custom };
+				for (const key of planned) custom[key] ??= PLANNED_BY_THE_DEPLOY;
+				return {
+					...stored,
+					custom
+				};
+			}
+		};
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: require_sniffer.eventError(error)
+		});
+		throw error;
+	}
+}
+/** What a dry run reads for a key its providers would write. */
+const PLANNED_BY_THE_DEPLOY = "s3://planned-by-this-deploy";
+/** `--resources-only`: the target's own resources, and nothing else. */
+async function resourcesOnly(target, phaseCtx, emit) {
+	try {
+		if (target.resources) await target.resources(phaseCtx);
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: require_sniffer.eventError(error)
+		});
+		throw error;
+	}
+	emit({
+		type: "phase.finished",
+		phase: "validate"
+	});
+	return resourcesResult(phaseCtx);
+}
+/** A `--resources-only` run: no app was deployed. */
+function resourcesResult(phaseCtx) {
+	return {
+		apps: [],
+		projectId: "",
+		successCount: 0,
+		failedCount: 0,
+		stage: phaseCtx.stage,
+		identity: phaseCtx.identity.key,
+		tag: phaseCtx.tag,
+		dryRun: phaseCtx.dryRun,
+		environmentId: "",
+		skipped: [...phaseCtx.skipped],
+		urls: {},
+		changes: []
+	};
+}
 /** `validate`, then the run's `deploy.started`, inside the validate phase. */
 async function validate(target, phaseCtx, emit) {
 	try {
@@ -273,6 +381,7 @@ async function validate(target, phaseCtx, emit) {
 /** Everything the phases are handed, worked out before the first of them. */
 async function prepare(source, request, ctx, emit, redactor) {
 	const { stage } = request;
+	if (request.resourcesOnly && request.skipResources) throw new ResourcesOnlyAndSkipped();
 	const configured = typeof source === "function" ? await source() : source;
 	const local = stage === configured.stages.local;
 	if (!local) require_workspace.assertDeployedStage(configured.stages, stage);
@@ -341,7 +450,7 @@ async function prepare(source, request, ctx, emit, redactor) {
 		return false;
 	});
 	if (apps.length === 0) throw new NoDeployableApps(stage, targetName);
-	const store = await require_seeds.createStateStore({
+	const store = await require_sniffer.createStateStore({
 		config: workspace.state,
 		workspaceRoot: workspace.root,
 		workspaceName: workspace.name
@@ -376,7 +485,8 @@ async function prepare(source, request, ctx, emit, redactor) {
 			dryRun: ctx.dryRun,
 			atomic: request.atomic ?? false,
 			allowDevServices,
-			...request.skipDnsCheck ? { skipDnsCheck: true } : {},
+			...request.skipDns ? { skipDns: true } : {},
+			...request.skipResources ? { skipResources: true } : {},
 			credentials: ctx.credentials,
 			state: store,
 			secrets,
@@ -490,7 +600,11 @@ function deploy(input) {
 				...input.apps ? { apps: input.apps } : {},
 				...input.atomic ? { atomic: true } : {},
 				...input.allowDevServices ? { allowDevServices: input.allowDevServices } : {},
-				...input.skipDnsCheck ? { skipDnsCheck: true } : {}
+				...input.skipDns ? { skipDns: true } : {},
+				...input.resourcesOnly ? { resourcesOnly: true } : {},
+				...input.skipResources ? { skipResources: true } : {},
+				...input.rotateKeys ? { rotateKeys: true } : {},
+				...input.retireOldKeys ? { retireOldKeys: true } : {}
 			}, ctx));
 			emit({
 				type: "deploy.finished",
@@ -553,4 +667,4 @@ Object.defineProperty(exports, "deploy", {
 	}
 });
 
-//# sourceMappingURL=deploy-C3Mhnmus.cjs.map
+//# sourceMappingURL=deploy-C911Akkn.cjs.map

package/dist/deploy-C911Akkn.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-C911Akkn.cjs","names":["secretsStoreFor","GkmError","builtinTarget","eventError","dnsCredentials","stageDnsDomains","provisionStage","initStageSecrets","resolveTarget","parseTargetOptions","DevServicesNeedServerTarget","discover","constructGlobs","usesTelemetry","derivedApps","deployIdentity","getAppBuildOrder","createStateStore","applicationName","storedCredentials","gkmHome","withOutput","LocalSandbox","findWorkspaceRoot","resolve","withSandbox","eventError","loadWorkspaceConfig"],"sources":["../src/target/secrets.ts","../src/deploy/orchestrate.ts","../src/deploy/deploy.ts"],"sourcesContent":["/**\n * A stage's secrets as a target sees them: read and written through the\n * stage's own store, and masked in everything the run prints once read.\n */\n\nimport { secretsStoreFor } from '../secrets/store';\nimport type { StageSecrets } from '../secrets/types';\nimport type { NormalizedWorkspace } from '../workspace/types';\nimport type { DeploySecrets } from './types';\n\n/**\n * Shorter values are left alone: what a progress line legitimately prints —\n * a port, a stage, an app name — would otherwise come out as `***` wherever\n * a secret happened to share it.\n */\nconst SHORTEST_MASKED = 6;\n\n/** The values a run must never print, and the rewrite that keeps it so. */\nexport class Redactor {\n\tprivate readonly values = new Set<string>();\n\n\tadd(value: string | undefined): void {\n\t\tif (value && value.length >= SHORTEST_MASKED) this.values.add(value);\n\t}\n\n\t/** `text` with every masked value replaced by `***`, longest first. */\n\tredact(text: string): string {\n\t\tif (this.values.size === 0) return text;\n\t\tlet out = text;\n\t\tconst longestFirst = [...this.values].sort((a, b) => b.length - a.length);\n\t\tfor (const value of longestFirst) out = out.replaceAll(value, '***');\n\t\treturn out;\n\t}\n}\n\n/** Every value in `secrets` that is a secret rather than a label. */\nfunction secretValues(secrets: StageSecrets): string[] {\n\treturn [\n\t\tsecrets.seed,\n\t\t...Object.values(secrets.custom ?? {}),\n\t\t...Object.values(secrets.urls ?? {}),\n\t\t...Object.values(secrets.services ?? {}).map(\n\t\t\t(service) => service?.password,\n\t\t),\n\t].filter((value): value is string => typeof value === 'string');\n}\n\n/**\n * The stage's secrets through the store `secrets.store` names for it. Opening\n * one builds a client and makes no request, so a target that never reads them\n * costs nothing.\n */\nexport async function deploySecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\tredactor: Redactor,\n\toptions: { home?: string } = {},\n): Promise<DeploySecrets> {\n\tconst store = await secretsStoreFor(workspace, stage, options);\n\tconst mask = (secrets: StageSecrets) => {\n\t\tfor (const value of secretValues(secrets)) redactor.add(value);\n\t};\n\n\treturn {\n\t\tstore: store.name,\n\t\tasync read() {\n\t\t\tconst secrets = await store.read(stage);\n\t\t\tif (secrets) mask(secrets);\n\t\t\treturn secrets;\n\t\t},\n\t\tasync write(secrets) {\n\t\t\tmask(secrets);\n\t\t\tawait store.write(stage, secrets);\n\t\t},\n\t\tmask: (value) => redactor.add(value),\n\t};\n}\n","/**\n * The run around a target: what every deploy does whatever it deploys\n * through.\n *\n * It loads the workspace, resolves the target, works out the apps and the\n * identity, takes the stage's lock, and calls the target's phases in order,\n * reporting each as it starts, finishes or fails. Everything that is about\n * *where* the stage goes is the target's.\n */\n\nimport { dnsCredentials, stageDnsDomains } from '../compose/dns.js';\nimport { GkmError } from '../errors';\nimport { provisionStage } from '../providers/index.js';\nimport { discover } from '../reconcile/discover.js';\nimport { constructGlobs } from '../reconcile/workspace.js';\nimport { initStageSecrets } from '../secrets/storage.js';\nimport { builtinTarget } from '../target/builtins';\nimport {\n\tparseTargetOptions,\n\ttype ResolvedTarget,\n\tresolveTarget,\n} from '../target/resolve';\nimport { deploySecrets, Redactor } from '../target/secrets';\nimport type {\n\tAnyDeployTarget,\n\tDeployPhaseContext,\n\tDeployTargetLogger,\n} from '../target/types';\nimport { resolveStageTelemetry } from '../telemetry/config';\nimport { usesTelemetry } from '../telemetry/edges';\nimport { derivedApps } from '../workspace/derive.js';\nimport { getAppBuildOrder } from '../workspace/index.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { CredentialProvider } from './credentials';\nimport { DevServicesNeedServerTarget } from './devServices';\nimport { type DeployEvent, type DeployPhase, eventError } from './events';\nimport { applicationName, deployIdentity } from './identity.js';\nimport { assertStateOutlivesRun, createStateStore } from './StateStore.js';\nimport type { DeployResult } from './types';\n\n/** What a run deploys, once the workspace is loaded. */\nexport interface DeployRequest {\n\t/** Deployment stage (e.g., 'production', 'staging') */\n\tstage: string;\n\t/** Image tag (default: stage-timestamp) */\n\ttag?: string;\n\t/** Specific apps to deploy (default: all) */\n\tapps?: string[];\n\t/** The target to deploy through. Defaults to `deploy.default`. */\n\ttarget?: string;\n\t/** On a failed release, roll back every app rather than the failed ones. */\n\tatomic?: boolean;\n\t/**\n\t * `--allow-dev-services`: a deployed stage runs the dev service for every\n\t * bucket and mail it does not account for. Server targets only.\n\t */\n\tallowDevServices?: boolean;\n\t/** `--skip-dns`: a server target writes and checks no host's DNS. */\n\tskipDns?: boolean;\n\t/**\n\t * `--resources-only`: create what the stage needs — its providers'\n\t * resources and keys, and its DNS records — and nothing else: no image\n\t * built, nothing started. What a CI runner runs with the stage's cloud\n\t * credentials and DNS token before the server deploys.\n\t */\n\tresourcesOnly?: boolean;\n\t/**\n\t * `--skip-resources`: an earlier `--resources-only` run created them, so\n\t * no provider runs and no DNS record is written or checked.\n\t */\n\tskipResources?: boolean;\n\t/** `--rotate-keys`: each provider issues its runtime keys a successor. */\n\trotateKeys?: boolean;\n\t/** `--retire-old-keys`: delete a rotated-out key now. */\n\tretireOldKeys?: boolean;\n}\n\n/** `--resources-only` with `--skip-resources`: the one asks for what the other skips. */\nexport class ResourcesOnlyAndSkipped extends GkmError {\n\tconstructor() {\n\t\tsuper(\n\t\t\t\"--resources-only creates the stage's resources and nothing else, and \" +\n\t\t\t\t'--skip-resources deploys without creating them. Run the first where ' +\n\t\t\t\t'the cloud credentials are (a CI runner), then the second where the ' +\n\t\t\t\t'stack runs.',\n\t\t);\n\t\tthis.name = 'ResourcesOnlyAndSkipped';\n\t}\n}\n\n/**\n * What a run is handed by whoever started it: where its events go, where it\n * gets credentials, and whether it may change anything. Nothing in a run\n * reads a terminal or exits the process — that is its caller's business.\n */\nexport interface DeployContext {\n\temit: (event: DeployEvent) => void;\n\tcredentials: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Look everything up, create, build and push nothing. */\n\tdryRun: boolean;\n\t/**\n\t * Validate and build — the target's images built, and pushed where it\n\t * pushes them — and nothing else: no lock, nothing provisioned, released,\n\t * verified or recorded. What a CI job runs before a server pulls.\n\t */\n\tbuildOnly?: boolean;\n\t/** The CLI's home, for the stage's keys. Defaults to `GKM_HOME`. */\n\thome?: string;\n\t/** Where spawned processes' output goes. Defaults to the terminal. */\n\tchildOutput?: 'inherit' | 'stderr' | 'ignore';\n\t/** The host's own targets, which win over every other by the same name. */\n\ttargets?: Record<string, AnyDeployTarget>;\n\t/**\n\t * What the run masks in what it prints. `deploy()` passes the one its\n\t * progress lines go through; a run without one masks only its events.\n\t */\n\tredactor?: Redactor;\n}\n\n/** Apps were asked for by name that the workspace does not have. */\nexport class UnknownDeployApps extends GkmError {\n\tconstructor(\n\t\treadonly apps: readonly string[],\n\t\treadonly available: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Unknown apps: ${apps.join(', ')}\\n` +\n\t\t\t\t`Available apps: ${available.join(', ')}`,\n\t\t);\n\t\tthis.name = 'UnknownDeployApps';\n\t}\n}\n\n/** Every app asked for deploys through some other target. */\nexport class NoDeployableApps extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly target: string,\n\t) {\n\t\tsuper(\n\t\t\t`No apps to deploy through \"${target}\": every selected app deploys somewhere else. Pick the target with --target, or set each app's deploy in gkm.config.ts.`,\n\t\t);\n\t\tthis.name = 'NoDeployableApps';\n\t}\n}\n\n/** A build-only run through a target with no build phase. */\nexport class TargetBuildsNothing extends GkmError {\n\tconstructor(readonly target: string) {\n\t\tsuper(\n\t\t\t`\"${target}\" has no build phase, so a build-only run would do nothing. Deploy it in full, or build through a target that builds images (compose).`,\n\t\t);\n\t\tthis.name = 'TargetBuildsNothing';\n\t}\n}\n\n/** A failed rollback, after the failure that called for it. */\nexport class RollbackFailed extends Error {\n\tconstructor(\n\t\treadonly target: string,\n\t\t/** What failed first, and was being rolled back. */\n\t\treadonly failure: unknown,\n\t\tcause: unknown,\n\t) {\n\t\tsuper(\n\t\t\t`Deploying through \"${target}\" failed, and so did rolling it back: ${cause instanceof Error ? cause.message : String(cause)}. The stage may be part-released; deploy again, or roll it back by hand. The first failure: ${failure instanceof Error ? failure.message : String(failure)}`,\n\t\t\t{ cause },\n\t\t);\n\t\tthis.name = 'RollbackFailed';\n\t}\n}\n\n/**\n * Generate image tag from stage and timestamp\n */\nexport function generateTag(stage: string): string {\n\tconst timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);\n\treturn `${stage}-${timestamp}`;\n}\n\n/** Why an app that deploys through another target is left out. */\nfunction elsewhere(target: string, stage: string): string {\n\tconst instead = builtinTarget(target)?.instead?.(stage);\n\tif (instead) return `it deploys through \"${target}\" — ${instead}`;\n\treturn `it deploys through \"${target}\" — run \\`gkm deploy --target ${target} --stage ${stage}\\``;\n}\n\n/**\n * Deploy a workspace's stage through its target.\n *\n * The engine under `deploy()` and `gkm deploy`. It never prompts and never\n * exits: credentials come from `ctx.credentials`, progress goes to\n * `ctx.emit` and to `output`, and every failure is thrown.\n *\n * @internal\n */\nexport async function runDeploy(\n\tsource: NormalizedWorkspace | (() => Promise<NormalizedWorkspace>),\n\trequest: DeployRequest,\n\tctx: DeployContext,\n): Promise<DeployResult> {\n\tconst { stage } = request;\n\tconst redactor = ctx.redactor ?? new Redactor();\n\tconst emit = (event: DeployEvent) =>\n\t\tctx.emit(\n\t\t\tevent.type === 'log'\n\t\t\t\t? { ...event, message: redactor.redact(event.message) }\n\t\t\t\t: event,\n\t\t);\n\n\t/** Run one phase between its events. */\n\tconst phase = async <T>(name: DeployPhase, body: () => Promise<T>) => {\n\t\tctx.signal?.throwIfAborted();\n\t\temit({ type: 'phase.started', phase: name });\n\t\ttry {\n\t\t\tconst value = await body();\n\t\t\temit({ type: 'phase.finished', phase: name });\n\t\t\treturn value;\n\t\t} catch (error) {\n\t\t\temit({ type: 'phase.failed', phase: name, error: eventError(error) });\n\t\t\tthrow error;\n\t\t}\n\t};\n\n\tctx.signal?.throwIfAborted();\n\temit({ type: 'phase.started', phase: 'validate' });\n\n\tlet prepared: Prepared;\n\ttry {\n\t\tprepared = await prepare(source, request, ctx, emit, redactor);\n\t} catch (error) {\n\t\temit({ type: 'phase.failed', phase: 'validate', error: eventError(error) });\n\t\tthrow error;\n\t}\n\tconst { resolved, phaseCtx, store } = prepared;\n\tconst { target } = resolved;\n\n\t// The stage's resources — what its providers create, and the keys they\n\t// write into its secrets — before any check reads those secrets, so a key\n\t// the deploy creates is never reported missing. A build-only run creates\n\t// nothing, and neither does the local stage.\n\tconst resources =\n\t\t!ctx.buildOnly &&\n\t\t!request.skipResources &&\n\t\tphaseCtx.stage !== phaseCtx.workspace.stages.local;\n\tconst provision = async () => {\n\t\t// The token the stage's DNS records are written with, asked for first:\n\t\t// a deploy without it fails before anything is created or started.\n\t\tif (!request.skipDns && resolved.target.runtime === 'server') {\n\t\t\ttry {\n\t\t\t\tawait dnsCredentials(\n\t\t\t\t\tphaseCtx.stage,\n\t\t\t\t\tstageDnsDomains(\n\t\t\t\t\t\tphaseCtx.stage,\n\t\t\t\t\t\tphaseCtx.workspace.domains,\n\t\t\t\t\t\tphaseCtx.workspace.dns,\n\t\t\t\t\t),\n\t\t\t\t\tctx.credentials,\n\t\t\t\t);\n\t\t\t} catch (error) {\n\t\t\t\temit({\n\t\t\t\t\ttype: 'phase.failed',\n\t\t\t\t\tphase: 'validate',\n\t\t\t\t\terror: eventError(error),\n\t\t\t\t});\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\t\tawait provisionResources(phaseCtx, request, ctx, store, emit);\n\t};\n\n\t// A dry run takes no lock: it writes nothing a lock would protect, and it\n\t// should not stop a real deploy that starts while it is looking.\n\tif (ctx.dryRun) {\n\t\tif (resources) await provision();\n\t\tif (request.resourcesOnly) {\n\t\t\treturn resourcesOnly(target, phaseCtx, emit);\n\t\t}\n\t\tconst run = await validate(target, phaseCtx, emit);\n\t\tawait phase('plan', () => target.plan(phaseCtx, run));\n\t\treturn target.result(phaseCtx, run);\n\t}\n\n\t// Building changes no stage — nothing is provisioned, released or\n\t// recorded — so it takes no lock: a CI job building the next release must\n\t// not fail because a server is deploying the last one.\n\tif (ctx.buildOnly) {\n\t\tif (!target.build) throw new TargetBuildsNothing(resolved.name);\n\t\tconst run = await validate(target, phaseCtx, emit);\n\t\tawait phase('build', () => target.build!(phaseCtx, run));\n\t\treturn target.result(phaseCtx, run);\n\t}\n\n\t// One deploy of a stage at a time. Taken before the target generates,\n\t// provisions or records anything, and held until the run ends however it\n\t// ends. A second run of the stage — another CI job, a laptop — gets\n\t// `StateLocked` naming this one instead of racing it; a run killed with\n\t// the lock held is released with `gkm state:unlock`.\n\tlet lock: Awaited<ReturnType<typeof store.lock>>;\n\ttry {\n\t\t// A CI runner's disk is gone when the job ends; state kept on it is\n\t\t// lost with it, and the next run recreates every resource.\n\t\tassertStateOutlivesRun(phaseCtx.workspace, stage, 'deploy');\n\t\tlock = await store.lock(stage, { operation: 'deploy' });\n\t} catch (error) {\n\t\temit({ type: 'phase.failed', phase: 'validate', error: eventError(error) });\n\t\tthrow error;\n\t}\n\n\ttry {\n\t\tif (resources) await provision();\n\t\tif (request.resourcesOnly) {\n\t\t\treturn resourcesOnly(target, phaseCtx, emit);\n\t\t}\n\t\tconst run = await validate(target, phaseCtx, emit);\n\t\tif (target.provision) {\n\t\t\tawait phase('provision', () => target.provision!(phaseCtx, run));\n\t\t}\n\t\tif (target.build) {\n\t\t\tawait phase('build', () => target.build!(phaseCtx, run));\n\t\t}\n\n\t\tlet releasing: 'release' | 'verify' = 'release';\n\t\ttry {\n\t\t\tawait phase('release', () => target.release(phaseCtx, run));\n\t\t\treleasing = 'verify';\n\t\t\tif (target.verify) {\n\t\t\t\tawait phase('verify', () => target.verify!(phaseCtx, run));\n\t\t\t}\n\t\t} catch (error) {\n\t\t\t// The caller stopping the run is not a release to undo.\n\t\t\tif (ctx.signal?.aborted || !target.capabilities.rollback) throw error;\n\t\t\tif (!target.rollback) throw error;\n\t\t\ttry {\n\t\t\t\tawait phase('rollback', () =>\n\t\t\t\t\ttarget.rollback!(phaseCtx, run, { phase: releasing, error }),\n\t\t\t\t);\n\t\t\t} catch (rollbackError) {\n\t\t\t\tthrow new RollbackFailed(resolved.name, error, rollbackError);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\n\t\treturn await target.result(phaseCtx, run);\n\t} finally {\n\t\tawait lock.release();\n\t}\n}\n\n/**\n * The stage's providers, run inside the validate phase. A dry run plans them\n * and, so the checks after it see the stage as the run would leave it, reads\n * the keys they would write as placeholders.\n */\nasync function provisionResources(\n\tphaseCtx: DeployPhaseContext<unknown>,\n\trequest: DeployRequest,\n\tctx: DeployContext,\n\tstore: Awaited<ReturnType<typeof createStateStore>>,\n\temit: (event: DeployEvent) => void,\n): Promise<void> {\n\ttry {\n\t\tconst reports = await provisionStage({\n\t\t\tworkspace: phaseCtx.workspace,\n\t\t\tstage: phaseCtx.stage,\n\t\t\tmanifest: phaseCtx.manifest,\n\t\t\trunnables: (phaseCtx.runnables ?? {}) as Record<string, string[]>,\n\t\t\tsecrets: phaseCtx.secrets,\n\t\t\tstate: store,\n\t\t\tdryRun: ctx.dryRun,\n\t\t\t...(request.rotateKeys ? { rotateKeys: true } : {}),\n\t\t\t...(request.retireOldKeys ? { retireOldKeys: true } : {}),\n\t\t\t...(ctx.home ? { home: ctx.home } : {}),\n\t\t\tlog: (line) => phaseCtx.logger.info(line),\n\t\t});\n\t\tif (!ctx.dryRun) return;\n\t\tconst planned = reports.flatMap((r) => r.planned);\n\t\tif (planned.length === 0) return;\n\t\tconst secrets = phaseCtx.secrets;\n\t\t(phaseCtx as { secrets: typeof secrets }).secrets = {\n\t\t\t...secrets,\n\t\t\tasync read() {\n\t\t\t\tconst stored =\n\t\t\t\t\t(await secrets.read()) ?? initStageSecrets(phaseCtx.stage);\n\t\t\t\tconst custom = { ...stored.custom };\n\t\t\t\tfor (const key of planned) custom[key] ??= PLANNED_BY_THE_DEPLOY;\n\t\t\t\treturn { ...stored, custom };\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\temit({ type: 'phase.failed', phase: 'validate', error: eventError(error) });\n\t\tthrow error;\n\t}\n}\n\n/** What a dry run reads for a key its providers would write. */\nexport const PLANNED_BY_THE_DEPLOY = 's3://planned-by-this-deploy';\n\n/** `--resources-only`: the target's own resources, and nothing else. */\nasync function resourcesOnly(\n\ttarget: AnyDeployTarget,\n\tphaseCtx: DeployPhaseContext<unknown>,\n\temit: (event: DeployEvent) => void,\n): Promise<DeployResult> {\n\ttry {\n\t\tif (target.resources) await target.resources(phaseCtx);\n\t} catch (error) {\n\t\temit({ type: 'phase.failed', phase: 'validate', error: eventError(error) });\n\t\tthrow error;\n\t}\n\temit({ type: 'phase.finished', phase: 'validate' });\n\treturn resourcesResult(phaseCtx);\n}\n\n/** A `--resources-only` run: no app was deployed. */\nfunction resourcesResult(phaseCtx: DeployPhaseContext<unknown>): DeployResult {\n\treturn {\n\t\tapps: [],\n\t\tprojectId: '',\n\t\tsuccessCount: 0,\n\t\tfailedCount: 0,\n\t\tstage: phaseCtx.stage,\n\t\tidentity: phaseCtx.identity.key,\n\t\ttag: phaseCtx.tag,\n\t\tdryRun: phaseCtx.dryRun,\n\t\tenvironmentId: '',\n\t\tskipped: [...phaseCtx.skipped],\n\t\turls: {},\n\t\tchanges: [],\n\t};\n}\n\n/** `validate`, then the run's `deploy.started`, inside the validate phase. */\nasync function validate(\n\ttarget: AnyDeployTarget,\n\tphaseCtx: DeployPhaseContext<unknown>,\n\temit: (event: DeployEvent) => void,\n): Promise<unknown> {\n\ttry {\n\t\tconst run = await target.validate(phaseCtx);\n\t\tconst skipped = new Set(phaseCtx.skipped.map((s) => s.app));\n\t\temit({\n\t\t\ttype: 'deploy.started',\n\t\t\tstage: phaseCtx.stage,\n\t\t\ttarget: phaseCtx.target,\n\t\t\tidentity: phaseCtx.identity.key,\n\t\t\ttag: phaseCtx.tag,\n\t\t\tapps: phaseCtx.apps.filter((app) => !skipped.has(app)),\n\t\t\tdryRun: phaseCtx.dryRun,\n\t\t});\n\t\temit({ type: 'phase.finished', phase: 'validate' });\n\t\treturn run;\n\t} catch (error) {\n\t\temit({ type: 'phase.failed', phase: 'validate', error: eventError(error) });\n\t\tthrow error;\n\t}\n}\n\ninterface Prepared {\n\tresolved: ResolvedTarget;\n\tphaseCtx: DeployPhaseContext<unknown>;\n\tstore: Awaited<ReturnType<typeof createStateStore>>;\n}\n\n/** Everything the phases are handed, worked out before the first of them. */\nasync function prepare(\n\tsource: NormalizedWorkspace | (() => Promise<NormalizedWorkspace>),\n\trequest: DeployRequest,\n\tctx: DeployContext,\n\temit: (event: DeployEvent) => void,\n\tredactor: Redactor,\n): Promise<Prepared> {\n\tconst { stage } = request;\n\tif (request.resourcesOnly && request.skipResources) {\n\t\tthrow new ResourcesOnlyAndSkipped();\n\t}\n\tconst configured = typeof source === 'function' ? await source() : source;\n\n\t// Before anything is provisioned: a typo'd stage would otherwise create a\n\t// whole second environment under the wrong name. The local stage is left\n\t// to the target, which says whether it can run it.\n\tconst local = stage === configured.stages.local;\n\tif (!local) assertDeployedStage(configured.stages, stage);\n\n\t// Before anything is discovered or derived: a target that cannot be found\n\t// — or a package that would not load — fails a deploy that has done\n\t// nothing yet.\n\tconst targetName = request.target ?? configured.deploy?.default ?? 'dokploy';\n\tconst resolved = await resolveTarget(targetName, {\n\t\tworkspace: configured,\n\t\tstage,\n\t\t...(ctx.targets ? { host: ctx.targets } : {}),\n\t});\n\tif (local && !resolved.target.capabilities.localStage) {\n\t\tassertDeployedStage(configured.stages, stage);\n\t}\n\tconst options = await parseTargetOptions(resolved);\n\n\t// Before anything is discovered: dev services asked of a target that runs\n\t// no containers fail a deploy that has done nothing.\n\tconst allowDevServices = request.allowDevServices === true;\n\tif (allowDevServices && resolved.target.runtime === 'aws') {\n\t\tthrow new DevServicesNeedServerTarget(targetName);\n\t}\n\n\t// What to deploy comes from the manifest.\n\t//\n\t// Discovered here rather than by the target, because the list of things\n\t// to deploy is the *declarations* — one `rest-api` is one server, one\n\t// `site` is one site — and the config only says how to run each. A project\n\t// that declares no surfaces keeps its configured apps, so adopting\n\t// constructs stays something you do a piece at a time.\n\tconst runnables: Record<string, string[]> = {};\n\tconst background: Record<string, string[]> = {};\n\tconst manifest = await discover({\n\t\tpatterns: constructGlobs(configured),\n\t\tcwd: configured.root,\n\t\trunnables,\n\t\tbackground,\n\t});\n\t// Where the stage's telemetry goes, settled before anything is built: a\n\t// stage that uses a `Telemetry` node on a target that cannot choose for it\n\t// — AWS has no self-hosted provider — fails here, naming the config.\n\tresolveStageTelemetry({\n\t\t...(configured.deploy?.telemetry\n\t\t\t? { telemetry: configured.deploy.telemetry }\n\t\t\t: {}),\n\t\tstage,\n\t\tlocal,\n\t\ttarget: targetName,\n\t\truntime: resolved.target.runtime,\n\t\tselfHosted: resolved.target.capabilities.selfHostedTelemetry === true,\n\t\tused: usesTelemetry(manifest),\n\t});\n\n\tconst units = derivedApps(manifest, configured);\n\tconst workspace: NormalizedWorkspace =\n\t\tObject.keys(units).length > 0 ? { ...configured, apps: units } : configured;\n\n\t// What every resource this deploy touches is named and claimed by —\n\t// resolved first, so a namespace that cannot be a name fails before\n\t// anything is built.\n\tconst identity = deployIdentity(workspace, stage);\n\tconst tag =\n\t\trequest.tag ??\n\t\t(resolved.target.tag\n\t\t\t? await resolved.target.tag({ cwd: workspace.root, stage })\n\t\t\t: generateTag(stage));\n\n\t// The apps asked for, in dependency order.\n\tconst buildOrder = getAppBuildOrder(workspace);\n\tlet selected = buildOrder;\n\tif (request.apps && request.apps.length > 0) {\n\t\tconst unknown = request.apps.filter((name) => !workspace.apps[name]);\n\t\tif (unknown.length > 0) {\n\t\t\tthrow new UnknownDeployApps(unknown, Object.keys(workspace.apps));\n\t\t}\n\t\tselected = buildOrder.filter((name) => request.apps!.includes(name));\n\t}\n\n\tconst skipped: { app: string; reason: string }[] = [];\n\tconst skip = (app: string, reason: string) => {\n\t\tskipped.push({ app, reason });\n\t\temit({ type: 'app.skipped', app, reason });\n\t};\n\n\t// An app that names another target deploys there, in a run of its own.\n\t// One on the default follows the run, so `--target` moves the stage\n\t// without every app having to be told.\n\tconst byDefault = configured.deploy?.default ?? 'dokploy';\n\tconst apps = selected.filter((name) => {\n\t\tconst own = workspace.apps[name]!.resolvedDeployTarget;\n\t\tconst deploysThrough = own === byDefault ? targetName : own;\n\t\tif (deploysThrough === targetName) return true;\n\t\tskip(name, elsewhere(deploysThrough, stage));\n\t\treturn false;\n\t});\n\tif (apps.length === 0) throw new NoDeployableApps(stage, targetName);\n\n\tconst store = await createStateStore({\n\t\tconfig: workspace.state,\n\t\tworkspaceRoot: workspace.root,\n\t\tworkspaceName: workspace.name,\n\t});\n\tconst secrets = await deploySecrets(workspace, stage, redactor, {\n\t\t...(ctx.home ? { home: ctx.home } : {}),\n\t});\n\n\tconst line =\n\t\t(level: 'info' | 'warn' | 'error') =>\n\t\t(message: string): void =>\n\t\t\temit({ type: 'log', level, message });\n\tconst logger: DeployTargetLogger = {\n\t\tinfo: line('info'),\n\t\twarn: line('warn'),\n\t\terror: line('error'),\n\t};\n\n\tconst phaseCtx: DeployPhaseContext<unknown> = {\n\t\ttarget: targetName,\n\t\tcwd: workspace.root,\n\t\tstage,\n\t\ttag,\n\t\ttagGiven: request.tag !== undefined,\n\t\tapps,\n\t\tskipped,\n\t\tidentity,\n\t\tworkspace,\n\t\tmanifest,\n\t\trunnables,\n\t\tbackground,\n\t\toptions,\n\t\tdryRun: ctx.dryRun,\n\t\tatomic: request.atomic ?? false,\n\t\tallowDevServices,\n\t\t...(request.skipDns ? { skipDns: true } : {}),\n\t\t...(request.skipResources ? { skipResources: true } : {}),\n\t\tcredentials: ctx.credentials,\n\t\tstate: store,\n\t\tsecrets,\n\t\tlogger,\n\t\tsignal: ctx.signal ?? new AbortController().signal,\n\t\tchildOutput: ctx.childOutput ?? 'inherit',\n\t\temit,\n\t\tskip,\n\t\tname: (resource) => applicationName(identity, resource),\n\t};\n\n\treturn { resolved, phaseCtx, store };\n}\n","/**\n * `deploy()`: a deploy as a library call.\n *\n * `gkm deploy` could only be driven from an interactive terminal: it prompted\n * for what it lacked and exited the process on failure, worked out of\n * `process.cwd()`, and reported progress by printing. Here the caller says\n * where the project is, hands over the credentials and a signal, and gets back\n * a run — events to iterate while it goes, and a structured result at the end.\n * Nothing below this asks a person anything or ends the process; `gkm deploy`\n * is a thin wrapper that does both.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../config';\nimport { gkmHome } from '../home';\nimport { type OutputLevel, withOutput } from '../output';\nimport { LocalSandbox } from '../sandbox/local';\nimport { type Sandbox, withSandbox } from '../sandbox/sandbox';\nimport { Redactor } from '../target/secrets';\nimport type { AnyDeployTarget } from '../target/types';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { type CredentialProvider, storedCredentials } from './credentials';\nimport { type DeployEvent, eventError } from './events';\nimport { type DeployContext, runDeploy } from './orchestrate';\nimport type { DeployResult } from './types';\n\n/**\n * Where a run's progress lines go, besides its events. `@geekmidas/logger`'s\n * `Logger` is one.\n */\nexport interface DeployLogger {\n\tinfo(message: string): void;\n\twarn(message: string): void;\n\terror?(message: string): void;\n}\n\nexport interface DeployInput {\n\t/**\n\t * The project to deploy: the directory holding `gkm.config.ts`, or any\n\t * directory inside it. Never assumed to be `process.cwd()`.\n\t */\n\tcwd: string;\n\t/**\n\t * The stage to deploy — one of the config's deployed stages, or its local\n\t * stage through a target that runs one (`compose`).\n\t */\n\tstage: string;\n\t/**\n\t * The target to deploy through, by name. Defaults to `deploy.default`,\n\t * else `dokploy`.\n\t */\n\ttarget?: string;\n\t/**\n\t * The host's own targets, by name. Consulted before the built-ins and the\n\t * config's `deploy.targets`, so a host can deploy through an\n\t * implementation of its own — `{ dokploy: myDokploy }` included.\n\t */\n\ttargets?: Record<string, AnyDeployTarget>;\n\t/** The image tag. Defaults to `<stage>-<timestamp>`. */\n\ttag?: string;\n\t/** Deploy only these apps (in dependency order). Defaults to all. */\n\tapps?: string[];\n\t/**\n\t * Look everything up and report what would happen — as `resource.planned`\n\t * events — without taking the lock, writing state, generating secrets,\n\t * changing Dokploy or building and pushing images.\n\t */\n\tdryRun?: boolean;\n\t/**\n\t * Validate and build only: the target's images built — and pushed, where\n\t * it pushes them — with no lock taken and nothing provisioned, released,\n\t * verified or recorded. `gkm compose --build --push` runs this way.\n\t */\n\tbuildOnly?: boolean;\n\t/**\n\t * When a release or its verification fails, roll back every app the run\n\t * released rather than only the ones that failed — on a target that can\n\t * roll back. For apps that must move together.\n\t */\n\tatomic?: boolean;\n\t/**\n\t * Where credentials come from. Defaults to the environment, then the\n\t * logins `gkm login` stored. A credential no provider has stops the run\n\t * with `MissingCredential`; nothing prompts.\n\t */\n\tcredentials?: CredentialProvider;\n\t/**\n\t * On a server target, run a dev service for every construct a deployed\n\t * stage does not account for — no key in its secrets, and no provider\n\t * (`deploy.objects`) backing its kind: MinIO for a bucket, Mailpit for\n\t * mail. Neither is production-grade — Mailpit delivers no mail — and every\n\t * run that uses one emits `dev-service.used`. Without it, a deployed stage\n\t * missing a mail or storage key fails with `ExternalServicesNotConfigured`;\n\t * on an AWS target it fails with `DevServicesNeedServerTarget`.\n\t */\n\tallowDevServices?: boolean;\n\t/**\n\t * On a server target, neither write the public hosts' DNS records nor\n\t * check that they point at the stage's server (`GKM_SERVER_IPV4`) — for a\n\t * CDN or proxy in front of the server, or records written by another step.\n\t */\n\tskipDns?: boolean;\n\t/**\n\t * Create the stage's resources — its providers' (deploy.<kind>.<stage>)\n\t * and its DNS records — and nothing else: what a CI runner runs with the\n\t * cloud credentials and DNS token before the server deploys.\n\t */\n\tresourcesOnly?: boolean;\n\t/**\n\t * An earlier `resourcesOnly` run created the stage's resources: run no\n\t * provider, and write or check no DNS record.\n\t */\n\tskipResources?: boolean;\n\t/** Each provider issues its runtime keys a successor. */\n\trotateKeys?: boolean;\n\t/** Delete a rotated-out key now, not after the next deploy. */\n\tretireOldKeys?: boolean;\n\t/** Receives each progress line as it is written. Defaults to none. */\n\tlogger?: DeployLogger;\n\t/**\n\t * Stops the run: in-flight Dokploy requests and docker children are\n\t * cancelled, the stage's lock is released, and `result` rejects with the\n\t * signal's reason.\n\t */\n\tsignal?: AbortSignal;\n\t/**\n\t * The CLI's home: stage keys and stored logins. Defaults to `GKM_HOME`,\n\t * else `~/.gkm`.\n\t */\n\thome?: string;\n\t/**\n\t * Where docker's own output goes: the host's terminal (`inherit`, the\n\t * default), its stderr, or nowhere.\n\t */\n\tchildOutput?: 'inherit' | 'stderr' | 'ignore';\n\t/**\n\t * Where the project's own code runs: loading `gkm.config.ts`, discovering\n\t * its constructs, sniffing each app's environment. Defaults to a\n\t * `LocalSandbox` on the project — a child process here with an\n\t * allowlisted environment, for a project the host trusts.\n\t *\n\t * A host deploying repositories it does not trust passes one that\n\t * isolates — a container per build — and the config then reaches the\n\t * deploy only as data. Credentials never enter a sandbox: they go from\n\t * `credentials` to the steps that provision, push and release.\n\t */\n\tsandbox?: Sandbox;\n}\n\n/** A deploy in progress. */\nexport interface DeployRun extends AsyncIterable<DeployEvent> {\n\t/**\n\t * What the deploy did, once it is done. Rejects with the error that\n\t * stopped it — `MissingCredential`, `StateLocked`, `ProjectNotOwned`, … —\n\t * after a `deploy.failed` event carrying the same.\n\t */\n\treadonly result: Promise<DeployResult>;\n}\n\n/**\n * Every event a run emits, kept so that each iteration — however late it\n * starts — sees the run from its first event to its last.\n */\nclass EventLog {\n\tprivate readonly events: DeployEvent[] = [];\n\tprivate closed = false;\n\tprivate waiting: (() => void)[] = [];\n\n\tpush(event: DeployEvent): void {\n\t\tthis.events.push(event);\n\t\tthis.wake();\n\t}\n\n\tclose(): void {\n\t\tthis.closed = true;\n\t\tthis.wake();\n\t}\n\n\tprivate wake(): void {\n\t\tconst waiting = this.waiting;\n\t\tthis.waiting = [];\n\t\tfor (const resume of waiting) resume();\n\t}\n\n\tasync *iterate(): AsyncGenerator<DeployEvent> {\n\t\tlet next = 0;\n\t\twhile (true) {\n\t\t\tif (next < this.events.length) {\n\t\t\t\tyield this.events[next++]!;\n\t\t\t} else if (this.closed) {\n\t\t\t\treturn;\n\t\t\t} else {\n\t\t\t\tawait new Promise<void>((resume) => this.waiting.push(resume));\n\t\t\t}\n\t\t}\n\t}\n}\n\nfunction forward(\n\tlogger: DeployLogger | undefined,\n\tlevel: OutputLevel,\n\tmessage: string,\n): void {\n\tif (!logger) return;\n\tif (level === 'info') logger.info(message);\n\telse if (level === 'error' && logger.error) logger.error(message);\n\telse logger.warn(message);\n}\n\n/**\n * Deploy a project's stage.\n *\n * ```ts\n * import { deploy } from '@geekmidas/cli/deploy';\n *\n * const run = deploy({ cwd: '/srv/checkouts/shop', stage: 'production' });\n * for await (const event of run) {\n *   if (event.type === 'app.deployed') console.log(event.app, event.url);\n * }\n * const result = await run.result;\n * ```\n *\n * The run starts at once; iterating it is optional, and an iteration started\n * late still sees every event from the first.\n */\nexport function deploy(input: DeployInput): DeployRun {\n\tconst log = new EventLog();\n\t// Every secret the run reads is masked in every line it reports — in the\n\t// events and in what the logger is handed.\n\tconst redactor = new Redactor();\n\tconst emit = (event: DeployEvent) => {\n\t\tconst masked =\n\t\t\tevent.type === 'log'\n\t\t\t\t? { ...event, message: redactor.redact(event.message) }\n\t\t\t\t: event;\n\t\tlog.push(masked);\n\t\tif (masked.type === 'log') {\n\t\t\tforward(input.logger, masked.level, masked.message);\n\t\t}\n\t};\n\n\tconst ctx: DeployContext = {\n\t\temit,\n\t\tcredentials:\n\t\t\tinput.credentials ?? storedCredentials({ home: input.home ?? gkmHome() }),\n\t\tdryRun: input.dryRun ?? false,\n\t\t...(input.buildOnly ? { buildOnly: true } : {}),\n\t\thome: input.home ?? gkmHome(),\n\t\tredactor,\n\t\t...(input.signal ? { signal: input.signal } : {}),\n\t\t...(input.childOutput ? { childOutput: input.childOutput } : {}),\n\t\t...(input.targets ? { targets: input.targets } : {}),\n\t};\n\n\t// Every line anything in the run writes through `output` — the deploy's\n\t// own, the Dockerfile generator's, discovery's warnings — becomes an event\n\t// of this run, and of no other.\n\tconst result = withOutput(\n\t\t(level, message) => emit({ type: 'log', level, message }),\n\t\tasync () => {\n\t\t\ttry {\n\t\t\t\tinput.signal?.throwIfAborted();\n\t\t\t\tconst sandbox =\n\t\t\t\t\tinput.sandbox ??\n\t\t\t\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\t\t\t\t// Every step of the run that executes the project's code — the\n\t\t\t\t// engine's own discoveries and sniffs included — runs in it.\n\t\t\t\tconst deployed = await withSandbox(sandbox, () =>\n\t\t\t\t\trunDeploy(\n\t\t\t\t\t\t() => load(input, sandbox),\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tstage: input.stage,\n\t\t\t\t\t\t\t...(input.target ? { target: input.target } : {}),\n\t\t\t\t\t\t\t...(input.tag ? { tag: input.tag } : {}),\n\t\t\t\t\t\t\t...(input.apps ? { apps: input.apps } : {}),\n\t\t\t\t\t\t\t...(input.atomic ? { atomic: true } : {}),\n\t\t\t\t\t\t\t...(input.allowDevServices\n\t\t\t\t\t\t\t\t? { allowDevServices: input.allowDevServices }\n\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t...(input.skipDns ? { skipDns: true } : {}),\n\t\t\t\t\t\t\t...(input.resourcesOnly ? { resourcesOnly: true } : {}),\n\t\t\t\t\t\t\t...(input.skipResources ? { skipResources: true } : {}),\n\t\t\t\t\t\t\t...(input.rotateKeys ? { rotateKeys: true } : {}),\n\t\t\t\t\t\t\t...(input.retireOldKeys ? { retireOldKeys: true } : {}),\n\t\t\t\t\t\t},\n\t\t\t\t\t\tctx,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\temit({ type: 'deploy.finished', result: deployed });\n\t\t\t\treturn deployed;\n\t\t\t} catch (error) {\n\t\t\t\temit({ type: 'deploy.failed', error: eventError(error) });\n\t\t\t\tthrow error;\n\t\t\t} finally {\n\t\t\t\tlog.close();\n\t\t\t}\n\t\t},\n\t);\n\n\t// A caller that only iterates still learns of the failure from the\n\t// `deploy.failed` event; the rejection must not also crash its process as\n\t// unhandled. Awaiting `result` still rejects.\n\tresult.catch(() => {});\n\n\treturn {\n\t\tresult,\n\t\t[Symbol.asyncIterator]: () => log.iterate(),\n\t};\n}\n\n/**\n * The workspace at `input.cwd`. The stage is checked by the run, once it\n * knows the target: one that runs on this machine may take the local stage.\n */\nasync function load(\n\tinput: DeployInput,\n\tsandbox: Sandbox,\n): Promise<NormalizedWorkspace> {\n\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\tsandbox,\n\t});\n\treturn workspace;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAM,kBAAkB;;AAGxB,IAAa,WAAb,MAAsB;CACrB,yBAA0B,IAAI,IAAY;CAE1C,IAAI,OAAiC;EACpC,IAAI,SAAS,MAAM,UAAU,iBAAiB,KAAK,OAAO,IAAI,KAAK;CACpE;;CAGA,OAAO,MAAsB;EAC5B,IAAI,KAAK,OAAO,SAAS,GAAG,OAAO;EACnC,IAAI,MAAM;EACV,MAAM,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM;EACxE,KAAK,MAAM,SAAS,cAAc,MAAM,IAAI,WAAW,OAAO,KAAK;EACnE,OAAO;CACR;AACD;;AAGA,SAAS,aAAa,SAAiC;CACtD,OAAO;EACN,QAAQ;EACR,GAAG,OAAO,OAAO,QAAQ,UAAU,CAAC,CAAC;EACrC,GAAG,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC;EACnC,GAAG,OAAO,OAAO,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,KACvC,YAAY,SAAS,QACvB;CACD,CAAC,CAAC,QAAQ,UAA2B,OAAO,UAAU,QAAQ;AAC/D;;;;;;AAOA,eAAsB,cACrB,WACA,OACA,UACA,UAA6B,CAAC,GACL;CACzB,MAAM,QAAQ,MAAMA,cAAAA,gBAAgB,WAAW,OAAO,OAAO;CAC7D,MAAM,QAAQ,YAA0B;EACvC,KAAK,MAAM,SAAS,aAAa,OAAO,GAAG,SAAS,IAAI,KAAK;CAC9D;CAEA,OAAO;EACN,OAAO,MAAM;EACb,MAAM,OAAO;GACZ,MAAM,UAAU,MAAM,MAAM,KAAK,KAAK;GACtC,IAAI,SAAS,KAAK,OAAO;GACzB,OAAO;EACR;EACA,MAAM,MAAM,SAAS;GACpB,KAAK,OAAO;GACZ,MAAM,MAAM,MAAM,OAAO,OAAO;EACjC;EACA,OAAO,UAAU,SAAS,IAAI,KAAK;CACpC;AACD;;;;;;;;;;;;;ACGA,IAAa,0BAAb,cAA6CC,eAAAA,SAAS;CACrD,cAAc;EACb,MACC,yNAID;EACA,KAAK,OAAO;CACb;AACD;;AAiCA,IAAa,oBAAb,cAAuCA,eAAAA,SAAS;CAErC;CACA;CAFV,YACC,MACA,WACC;EACD,MACC,iBAAiB,KAAK,KAAK,IAAI,EAAE,oBACb,UAAU,KAAK,IAAI,GACxC;EANS,KAAA,OAAA;EACA,KAAA,YAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,mBAAb,cAAsCA,eAAAA,SAAS;CAEpC;CACA;CAFV,YACC,OACA,QACC;EACD,MACC,8BAA8B,OAAO,wHACtC;EALS,KAAA,QAAA;EACA,KAAA,SAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,sBAAb,cAAyCA,eAAAA,SAAS;CAC5B;CAArB,YAAY,QAAyB;EACpC,MACC,IAAI,OAAO,uIACZ;EAHoB,KAAA,SAAA;EAIpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,iBAAb,cAAoC,MAAM;CAE/B;CAEA;CAHV,YACC,QAEA,SACA,OACC;EACD,MACC,sBAAsB,OAAO,wCAAwC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,8FAA8F,mBAAmB,QAAQ,QAAQ,UAAU,OAAO,OAAO,KACrR,EAAE,MAAM,CACT;EARS,KAAA,SAAA;EAEA,KAAA,UAAA;EAOT,KAAK,OAAO;CACb;AACD;;;;AAKA,SAAgB,YAAY,OAAuB;CAElD,OAAO,GAAG,MAAM,oBADE,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,QAAQ,SAAS,GAAG,CAAC,CAAC,MAAM,GAAG,EAC/C;AAC5B;;AAGA,SAAS,UAAU,QAAgB,OAAuB;CACzD,MAAM,UAAUC,eAAAA,cAAc,MAAM,CAAC,EAAE,UAAU,KAAK;CACtD,IAAI,SAAS,OAAO,uBAAuB,OAAO,MAAM;CACxD,OAAO,uBAAuB,OAAO,gCAAgC,OAAO,WAAW,MAAM;AAC9F;;;;;;;;;;AAWA,eAAsB,UACrB,QACA,SACA,KACwB;CACxB,MAAM,EAAE,UAAU;CAClB,MAAM,WAAW,IAAI,YAAY,IAAI,SAAS;CAC9C,MAAM,QAAQ,UACb,IAAI,KACH,MAAM,SAAS,QACZ;EAAE,GAAG;EAAO,SAAS,SAAS,OAAO,MAAM,OAAO;CAAE,IACpD,KACJ;;CAGD,MAAM,QAAQ,OAAU,MAAmB,SAA2B;EACrE,IAAI,QAAQ,eAAe;EAC3B,KAAK;GAAE,MAAM;GAAiB,OAAO;EAAK,CAAC;EAC3C,IAAI;GACH,MAAM,QAAQ,MAAM,KAAK;GACzB,KAAK;IAAE,MAAM;IAAkB,OAAO;GAAK,CAAC;GAC5C,OAAO;EACR,SAAS,OAAO;GACf,KAAK;IAAE,MAAM;IAAgB,OAAO;IAAM,OAAOC,gBAAAA,WAAW,KAAK;GAAE,CAAC;GACpE,MAAM;EACP;CACD;CAEA,IAAI,QAAQ,eAAe;CAC3B,KAAK;EAAE,MAAM;EAAiB,OAAO;CAAW,CAAC;CAEjD,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,QAAQ,QAAQ,SAAS,KAAK,MAAM,QAAQ;CAC9D,SAAS,OAAO;EACf,KAAK;GAAE,MAAM;GAAgB,OAAO;GAAY,OAAOA,gBAAAA,WAAW,KAAK;EAAE,CAAC;EAC1E,MAAM;CACP;CACA,MAAM,EAAE,UAAU,UAAU,UAAU;CACtC,MAAM,EAAE,WAAW;CAMnB,MAAM,YACL,CAAC,IAAI,aACL,CAAC,QAAQ,iBACT,SAAS,UAAU,SAAS,UAAU,OAAO;CAC9C,MAAM,YAAY,YAAY;EAG7B,IAAI,CAAC,QAAQ,WAAW,SAAS,OAAO,YAAY,UACnD,IAAI;GACH,MAAMC,cAAAA,eACL,SAAS,OACTC,cAAAA,gBACC,SAAS,OACT,SAAS,UAAU,SACnB,SAAS,UAAU,GACpB,GACA,IAAI,WACL;EACD,SAAS,OAAO;GACf,KAAK;IACJ,MAAM;IACN,OAAO;IACP,OAAOF,gBAAAA,WAAW,KAAK;GACxB,CAAC;GACD,MAAM;EACP;EAED,MAAM,mBAAmB,UAAU,SAAS,KAAK,OAAO,IAAI;CAC7D;CAIA,IAAI,IAAI,QAAQ;EACf,IAAI,WAAW,MAAM,UAAU;EAC/B,IAAI,QAAQ,eACX,OAAO,cAAc,QAAQ,UAAU,IAAI;EAE5C,MAAM,MAAM,MAAM,SAAS,QAAQ,UAAU,IAAI;EACjD,MAAM,MAAM,cAAc,OAAO,KAAK,UAAU,GAAG,CAAC;EACpD,OAAO,OAAO,OAAO,UAAU,GAAG;CACnC;CAKA,IAAI,IAAI,WAAW;EAClB,IAAI,CAAC,OAAO,OAAO,MAAM,IAAI,oBAAoB,SAAS,IAAI;EAC9D,MAAM,MAAM,MAAM,SAAS,QAAQ,UAAU,IAAI;EACjD,MAAM,MAAM,eAAe,OAAO,MAAO,UAAU,GAAG,CAAC;EACvD,OAAO,OAAO,OAAO,UAAU,GAAG;CACnC;CAOA,IAAI;CACJ,IAAI;EAGH,gBAAA,uBAAuB,SAAS,WAAW,OAAO,QAAQ;EAC1D,OAAO,MAAM,MAAM,KAAK,OAAO,EAAE,WAAW,SAAS,CAAC;CACvD,SAAS,OAAO;EACf,KAAK;GAAE,MAAM;GAAgB,OAAO;GAAY,OAAOA,gBAAAA,WAAW,KAAK;EAAE,CAAC;EAC1E,MAAM;CACP;CAEA,IAAI;EACH,IAAI,WAAW,MAAM,UAAU;EAC/B,IAAI,QAAQ,eACX,OAAO,cAAc,QAAQ,UAAU,IAAI;EAE5C,MAAM,MAAM,MAAM,SAAS,QAAQ,UAAU,IAAI;EACjD,IAAI,OAAO,WACV,MAAM,MAAM,mBAAmB,OAAO,UAAW,UAAU,GAAG,CAAC;EAEhE,IAAI,OAAO,OACV,MAAM,MAAM,eAAe,OAAO,MAAO,UAAU,GAAG,CAAC;EAGxD,IAAI,YAAkC;EACtC,IAAI;GACH,MAAM,MAAM,iBAAiB,OAAO,QAAQ,UAAU,GAAG,CAAC;GAC1D,YAAY;GACZ,IAAI,OAAO,QACV,MAAM,MAAM,gBAAgB,OAAO,OAAQ,UAAU,GAAG,CAAC;EAE3D,SAAS,OAAO;GAEf,IAAI,IAAI,QAAQ,WAAW,CAAC,OAAO,aAAa,UAAU,MAAM;GAChE,IAAI,CAAC,OAAO,UAAU,MAAM;GAC5B,IAAI;IACH,MAAM,MAAM,kBACX,OAAO,SAAU,UAAU,KAAK;KAAE,OAAO;KAAW;IAAM,CAAC,CAC5D;GACD,SAAS,eAAe;IACvB,MAAM,IAAI,eAAe,SAAS,MAAM,OAAO,aAAa;GAC7D;GACA,MAAM;EACP;EAEA,OAAO,MAAM,OAAO,OAAO,UAAU,GAAG;CACzC,UAAU;EACT,MAAM,KAAK,QAAQ;CACpB;AACD;;;;;;AAOA,eAAe,mBACd,UACA,SACA,KACA,OACA,MACgB;CAChB,IAAI;EACH,MAAM,UAAU,MAAMG,kBAAAA,eAAe;GACpC,WAAW,SAAS;GACpB,OAAO,SAAS;GAChB,UAAU,SAAS;GACnB,WAAY,SAAS,aAAa,CAAC;GACnC,SAAS,SAAS;GAClB,OAAO;GACP,QAAQ,IAAI;GACZ,GAAI,QAAQ,aAAa,EAAE,YAAY,KAAK,IAAI,CAAC;GACjD,GAAI,QAAQ,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC;GACvD,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;GACrC,MAAM,SAAS,SAAS,OAAO,KAAK,IAAI;EACzC,CAAC;EACD,IAAI,CAAC,IAAI,QAAQ;EACjB,MAAM,UAAU,QAAQ,SAAS,MAAM,EAAE,OAAO;EAChD,IAAI,QAAQ,WAAW,GAAG;EAC1B,MAAM,UAAU,SAAS;EACzB,SAA0C,UAAU;GACnD,GAAG;GACH,MAAM,OAAO;IACZ,MAAM,SACJ,MAAM,QAAQ,KAAK,KAAMC,cAAAA,iBAAiB,SAAS,KAAK;IAC1D,MAAM,SAAS,EAAE,GAAG,OAAO,OAAO;IAClC,KAAK,MAAM,OAAO,SAAS,OAAO,SAAS;IAC3C,OAAO;KAAE,GAAG;KAAQ;IAAO;GAC5B;EACD;CACD,SAAS,OAAO;EACf,KAAK;GAAE,MAAM;GAAgB,OAAO;GAAY,OAAOJ,gBAAAA,WAAW,KAAK;EAAE,CAAC;EAC1E,MAAM;CACP;AACD;;AAGA,MAAa,wBAAwB;;AAGrC,eAAe,cACd,QACA,UACA,MACwB;CACxB,IAAI;EACH,IAAI,OAAO,WAAW,MAAM,OAAO,UAAU,QAAQ;CACtD,SAAS,OAAO;EACf,KAAK;GAAE,MAAM;GAAgB,OAAO;GAAY,OAAOA,gBAAAA,WAAW,KAAK;EAAE,CAAC;EAC1E,MAAM;CACP;CACA,KAAK;EAAE,MAAM;EAAkB,OAAO;CAAW,CAAC;CAClD,OAAO,gBAAgB,QAAQ;AAChC;;AAGA,SAAS,gBAAgB,UAAqD;CAC7E,OAAO;EACN,MAAM,CAAC;EACP,WAAW;EACX,cAAc;EACd,aAAa;EACb,OAAO,SAAS;EAChB,UAAU,SAAS,SAAS;EAC5B,KAAK,SAAS;EACd,QAAQ,SAAS;EACjB,eAAe;EACf,SAAS,CAAC,GAAG,SAAS,OAAO;EAC7B,MAAM,CAAC;EACP,SAAS,CAAC;CACX;AACD;;AAGA,eAAe,SACd,QACA,UACA,MACmB;CACnB,IAAI;EACH,MAAM,MAAM,MAAM,OAAO,SAAS,QAAQ;EAC1C,MAAM,UAAU,IAAI,IAAI,SAAS,QAAQ,KAAK,MAAM,EAAE,GAAG,CAAC;EAC1D,KAAK;GACJ,MAAM;GACN,OAAO,SAAS;GAChB,QAAQ,SAAS;GACjB,UAAU,SAAS,SAAS;GAC5B,KAAK,SAAS;GACd,MAAM,SAAS,KAAK,QAAQ,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAC;GACrD,QAAQ,SAAS;EAClB,CAAC;EACD,KAAK;GAAE,MAAM;GAAkB,OAAO;EAAW,CAAC;EAClD,OAAO;CACR,SAAS,OAAO;EACf,KAAK;GAAE,MAAM;GAAgB,OAAO;GAAY,OAAOA,gBAAAA,WAAW,KAAK;EAAE,CAAC;EAC1E,MAAM;CACP;AACD;;AASA,eAAe,QACd,QACA,SACA,KACA,MACA,UACoB;CACpB,MAAM,EAAE,UAAU;CAClB,IAAI,QAAQ,iBAAiB,QAAQ,eACpC,MAAM,IAAI,wBAAwB;CAEnC,MAAM,aAAa,OAAO,WAAW,aAAa,MAAM,OAAO,IAAI;CAKnE,MAAM,QAAQ,UAAU,WAAW,OAAO;CAC1C,IAAI,CAAC,OAAO,kBAAA,oBAAoB,WAAW,QAAQ,KAAK;CAKxD,MAAM,aAAa,QAAQ,UAAU,WAAW,QAAQ,WAAW;CACnE,MAAM,WAAW,MAAMK,gBAAAA,cAAc,YAAY;EAChD,WAAW;EACX;EACA,GAAI,IAAI,UAAU,EAAE,MAAM,IAAI,QAAQ,IAAI,CAAC;CAC5C,CAAC;CACD,IAAI,SAAS,CAAC,SAAS,OAAO,aAAa,YAC1C,kBAAA,oBAAoB,WAAW,QAAQ,KAAK;CAE7C,MAAM,UAAU,MAAMC,gBAAAA,mBAAmB,QAAQ;CAIjD,MAAM,mBAAmB,QAAQ,qBAAqB;CACtD,IAAI,oBAAoB,SAAS,OAAO,YAAY,OACnD,MAAM,IAAIC,cAAAA,4BAA4B,UAAU;CAUjD,MAAM,YAAsC,CAAC;CAC7C,MAAM,aAAuC,CAAC;CAC9C,MAAM,WAAW,MAAMC,iBAAAA,SAAS;EAC/B,UAAUC,cAAAA,eAAe,UAAU;EACnC,KAAK,WAAW;EAChB;EACA;CACD,CAAC;CAID,kBAAA,sBAAsB;EACrB,GAAI,WAAW,QAAQ,YACpB,EAAE,WAAW,WAAW,OAAO,UAAU,IACzC,CAAC;EACJ;EACA;EACA,QAAQ;EACR,SAAS,SAAS,OAAO;EACzB,YAAY,SAAS,OAAO,aAAa,wBAAwB;EACjE,MAAMC,cAAAA,cAAc,QAAQ;CAC7B,CAAC;CAED,MAAM,QAAQC,eAAAA,YAAY,UAAU,UAAU;CAC9C,MAAM,YACL,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI;EAAE,GAAG;EAAY,MAAM;CAAM,IAAI;CAKlE,MAAM,WAAWC,cAAAA,eAAe,WAAW,KAAK;CAChD,MAAM,MACL,QAAQ,QACP,SAAS,OAAO,MACd,MAAM,SAAS,OAAO,IAAI;EAAE,KAAK,UAAU;EAAM;CAAM,CAAC,IACxD,YAAY,KAAK;CAGrB,MAAM,aAAaC,kBAAAA,iBAAiB,SAAS;CAC7C,IAAI,WAAW;CACf,IAAI,QAAQ,QAAQ,QAAQ,KAAK,SAAS,GAAG;EAC5C,MAAM,UAAU,QAAQ,KAAK,QAAQ,SAAS,CAAC,UAAU,KAAK,KAAK;EACnE,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,kBAAkB,SAAS,OAAO,KAAK,UAAU,IAAI,CAAC;EAEjE,WAAW,WAAW,QAAQ,SAAS,QAAQ,KAAM,SAAS,IAAI,CAAC;CACpE;CAEA,MAAM,UAA6C,CAAC;CACpD,MAAM,QAAQ,KAAa,WAAmB;EAC7C,QAAQ,KAAK;GAAE;GAAK;EAAO,CAAC;EAC5B,KAAK;GAAE,MAAM;GAAe;GAAK;EAAO,CAAC;CAC1C;CAKA,MAAM,YAAY,WAAW,QAAQ,WAAW;CAChD,MAAM,OAAO,SAAS,QAAQ,SAAS;EACtC,MAAM,MAAM,UAAU,KAAK,KAAK,CAAE;EAClC,MAAM,iBAAiB,QAAQ,YAAY,aAAa;EACxD,IAAI,mBAAmB,YAAY,OAAO;EAC1C,KAAK,MAAM,UAAU,gBAAgB,KAAK,CAAC;EAC3C,OAAO;CACR,CAAC;CACD,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,iBAAiB,OAAO,UAAU;CAEnE,MAAM,QAAQ,MAAMC,gBAAAA,iBAAiB;EACpC,QAAQ,UAAU;EAClB,eAAe,UAAU;EACzB,eAAe,UAAU;CAC1B,CAAC;CACD,MAAM,UAAU,MAAM,cAAc,WAAW,OAAO,UAAU,EAC/D,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC,EACtC,CAAC;CAED,MAAM,QACJ,WACA,YACA,KAAK;EAAE,MAAM;EAAO;EAAO;CAAQ,CAAC;CACtC,MAAM,SAA6B;EAClC,MAAM,KAAK,MAAM;EACjB,MAAM,KAAK,MAAM;EACjB,OAAO,KAAK,OAAO;CACpB;CAgCA,OAAO;EAAE;EAAU,UAAA;GA7BlB,QAAQ;GACR,KAAK,UAAU;GACf;GACA;GACA,UAAU,QAAQ,QAAQ,KAAA;GAC1B;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,QAAQ,IAAI;GACZ,QAAQ,QAAQ,UAAU;GAC1B;GACA,GAAI,QAAQ,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC;GAC3C,GAAI,QAAQ,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC;GACvD,aAAa,IAAI;GACjB,OAAO;GACP;GACA;GACA,QAAQ,IAAI,UAAU,IAAI,gBAAgB,CAAC,CAAC;GAC5C,aAAa,IAAI,eAAe;GAChC;GACA;GACA,OAAO,aAAaC,cAAAA,gBAAgB,UAAU,QAAQ;EAG7B;EAAG;CAAM;AACpC;;;;;;;;;;;;;;;;;;ACpdA,IAAM,WAAN,MAAe;CACd,SAAyC,CAAC;CAC1C,SAAiB;CACjB,UAAkC,CAAC;CAEnC,KAAK,OAA0B;EAC9B,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,KAAK;CACX;CAEA,QAAc;EACb,KAAK,SAAS;EACd,KAAK,KAAK;CACX;CAEA,OAAqB;EACpB,MAAM,UAAU,KAAK;EACrB,KAAK,UAAU,CAAC;EAChB,KAAK,MAAM,UAAU,SAAS,OAAO;CACtC;CAEA,OAAO,UAAuC;EAC7C,IAAI,OAAO;EACX,OAAO,MACN,IAAI,OAAO,KAAK,OAAO,QACtB,MAAM,KAAK,OAAO;OACZ,IAAI,KAAK,QACf;OAEA,MAAM,IAAI,SAAe,WAAW,KAAK,QAAQ,KAAK,MAAM,CAAC;CAGhE;AACD;AAEA,SAAS,QACR,QACA,OACA,SACO;CACP,IAAI,CAAC,QAAQ;CACb,IAAI,UAAU,QAAQ,OAAO,KAAK,OAAO;MACpC,IAAI,UAAU,WAAW,OAAO,OAAO,OAAO,MAAM,OAAO;MAC3D,OAAO,KAAK,OAAO;AACzB;;;;;;;;;;;;;;;;;AAkBA,SAAgB,OAAO,OAA+B;CACrD,MAAM,MAAM,IAAI,SAAS;CAGzB,MAAM,WAAW,IAAI,SAAS;CAC9B,MAAM,QAAQ,UAAuB;EACpC,MAAM,SACL,MAAM,SAAS,QACZ;GAAE,GAAG;GAAO,SAAS,SAAS,OAAO,MAAM,OAAO;EAAE,IACpD;EACJ,IAAI,KAAK,MAAM;EACf,IAAI,OAAO,SAAS,OACnB,QAAQ,MAAM,QAAQ,OAAO,OAAO,OAAO,OAAO;CAEpD;CAEA,MAAM,MAAqB;EAC1B;EACA,aACC,MAAM,eAAeC,oBAAAA,kBAAkB,EAAE,MAAM,MAAM,QAAQC,oBAAAA,QAAQ,EAAE,CAAC;EACzE,QAAQ,MAAM,UAAU;EACxB,GAAI,MAAM,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;EAC7C,MAAM,MAAM,QAAQA,oBAAAA,QAAQ;EAC5B;EACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C,GAAI,MAAM,cAAc,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;EAC9D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;CACnD;CAKA,MAAM,SAASC,iBAAAA,YACb,OAAO,YAAY,KAAK;EAAE,MAAM;EAAO;EAAO;CAAQ,CAAC,GACxD,YAAY;EACX,IAAI;GACH,MAAM,QAAQ,eAAe;GAC7B,MAAM,UACL,MAAM,WACN,IAAIC,cAAAA,aAAa,EAAE,MAAMC,eAAAA,mBAAAA,GAAkBC,UAAAA,QAAAA,CAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;GAGjE,MAAM,WAAW,MAAMC,gBAAAA,YAAY,eAClC,gBACO,KAAK,OAAO,OAAO,GACzB;IACC,OAAO,MAAM;IACb,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/C,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;IACtC,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;IACzC,GAAI,MAAM,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;IACvC,GAAI,MAAM,mBACP,EAAE,kBAAkB,MAAM,iBAAiB,IAC3C,CAAC;IACJ,GAAI,MAAM,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC;IACzC,GAAI,MAAM,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC;IACrD,GAAI,MAAM,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC;IACrD,GAAI,MAAM,aAAa,EAAE,YAAY,KAAK,IAAI,CAAC;IAC/C,GAAI,MAAM,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC;GACtD,GACA,GACD,CACD;GACA,KAAK;IAAE,MAAM;IAAmB,QAAQ;GAAS,CAAC;GAClD,OAAO;EACR,SAAS,OAAO;GACf,KAAK;IAAE,MAAM;IAAiB,OAAOC,gBAAAA,WAAW,KAAK;GAAE,CAAC;GACxD,MAAM;EACP,UAAU;GACT,IAAI,MAAM;EACX;CACD,CACD;CAKA,OAAO,YAAY,CAAC,CAAC;CAErB,OAAO;EACN;GACC,OAAO,sBAAsB,IAAI,QAAQ;CAC3C;AACD;;;;;AAMA,eAAe,KACd,OACA,SAC+B;CAC/B,MAAM,EAAE,cAAc,MAAMC,eAAAA,qBAAAA,GAAoBH,UAAAA,QAAAA,CAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;CACD,OAAO;AACR"}

package/dist/{deploy-DYIyIUYd.mjs → deploy-CeJ5D0xn.mjs}

@@ -1,15 +1,16 @@
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { r as storedCredentials, x as gkmHome } from "./credentials-C4KII3PD.mjs";
+import { r as storedCredentials, x as gkmHome } from "./credentials-DpfnUvIR.mjs";
 import { f as withOutput, r as discover } from "./discover-qjFapetL.mjs";
 import { c as withSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { n as derivedApps } from "./derive-B4vDpzgP.mjs";
-import { L as resolveStageTelemetry, N as assertDeployedStage, u as getAppBuildOrder } from "./workspace-Bzw7Zs82.mjs";
+import { L as resolveStageTelemetry, N as assertDeployedStage, u as getAppBuildOrder } from "./workspace-DWK1PTXP.mjs";
 import { o as builtinTarget } from "./define-6poNqm5O.mjs";
 import { findWorkspaceRoot, loadWorkspaceConfig } from "./config.mjs";
-import { Dt as constructGlobs, Q as assertStateOutlivesRun, ct as DevServicesNeedServerTarget, et as createStateStore, jn as usesTelemetry, nr as deployIdentity, qn as secretsStoreFor, tr as applicationName } from "./seeds-BSL55F6q.mjs";
-import { a as parseTargetOptions, o as resolveTarget } from "./resolve-Ccjlpnd9.mjs";
-import { t as LocalSandbox } from "./local-Otp74ak0.mjs";
-import { l as eventError } from "./sniffer-BTtGAtm3.mjs";
+import { En as usesTelemetry, Hn as secretsStoreFor, K as dnsCredentials, Q as stageDnsDomains, St as constructGlobs, Xn as applicationName, Zn as deployIdentity, ir as initStageSecrets, x as DevServicesNeedServerTarget } from "./seeds-CTxTZa-R.mjs";
+import { a as parseTargetOptions, o as resolveTarget } from "./resolve-Dyd1S2wn.mjs";
+import { t as LocalSandbox } from "./local-B7Zv1NoA.mjs";
+import { S as eventError, _ as assertStateOutlivesRun, y as createStateStore } from "./sniffer-DCcuzHz_.mjs";
+import { t as provisionStage } from "./providers-sTj-BG0S.mjs";
 import { resolve } from "node:path";
 //#region src/target/secrets.ts
 /**
@@ -81,6 +82,13 @@ async function deploySecrets(workspace, stage, redactor, options = {}) {
 * reporting each as it starts, finishes or fails. Everything that is about
 * *where* the stage goes is the target's.
 */
+/** `--resources-only` with `--skip-resources`: the one asks for what the other skips. */
+var ResourcesOnlyAndSkipped = class extends GkmError {
+	constructor() {
+		super("--resources-only creates the stage's resources and nothing else, and --skip-resources deploys without creating them. Run the first where the cloud credentials are (a CI runner), then the second where the stack runs.");
+		this.name = "ResourcesOnlyAndSkipped";
+	}
+};
 /** Apps were asked for by name that the workspace does not have. */
 var UnknownDeployApps = class extends GkmError {
 	apps;
@@ -192,7 +200,23 @@ async function runDeploy(source, request, ctx) {
 	}
 	const { resolved, phaseCtx, store } = prepared;
 	const { target } = resolved;
+	const resources = !ctx.buildOnly && !request.skipResources && phaseCtx.stage !== phaseCtx.workspace.stages.local;
+	const provision = async () => {
+		if (!request.skipDns && resolved.target.runtime === "server") try {
+			await dnsCredentials(phaseCtx.stage, stageDnsDomains(phaseCtx.stage, phaseCtx.workspace.domains, phaseCtx.workspace.dns), ctx.credentials);
+		} catch (error) {
+			emit({
+				type: "phase.failed",
+				phase: "validate",
+				error: eventError(error)
+			});
+			throw error;
+		}
+		await provisionResources(phaseCtx, request, ctx, store, emit);
+	};
 	if (ctx.dryRun) {
+		if (resources) await provision();
+		if (request.resourcesOnly) return resourcesOnly(target, phaseCtx, emit);
 		const run = await validate(target, phaseCtx, emit);
 		await phase("plan", () => target.plan(phaseCtx, run));
 		return target.result(phaseCtx, run);
@@ -216,6 +240,8 @@ async function runDeploy(source, request, ctx) {
 		throw error;
 	}
 	try {
+		if (resources) await provision();
+		if (request.resourcesOnly) return resourcesOnly(target, phaseCtx, emit);
 		const run = await validate(target, phaseCtx, emit);
 		if (target.provision) await phase("provision", () => target.provision(phaseCtx, run));
 		if (target.build) await phase("build", () => target.build(phaseCtx, run));
@@ -242,6 +268,88 @@ async function runDeploy(source, request, ctx) {
 		await lock.release();
 	}
 }
+/**
+* The stage's providers, run inside the validate phase. A dry run plans them
+* and, so the checks after it see the stage as the run would leave it, reads
+* the keys they would write as placeholders.
+*/
+async function provisionResources(phaseCtx, request, ctx, store, emit) {
+	try {
+		const reports = await provisionStage({
+			workspace: phaseCtx.workspace,
+			stage: phaseCtx.stage,
+			manifest: phaseCtx.manifest,
+			runnables: phaseCtx.runnables ?? {},
+			secrets: phaseCtx.secrets,
+			state: store,
+			dryRun: ctx.dryRun,
+			...request.rotateKeys ? { rotateKeys: true } : {},
+			...request.retireOldKeys ? { retireOldKeys: true } : {},
+			...ctx.home ? { home: ctx.home } : {},
+			log: (line) => phaseCtx.logger.info(line)
+		});
+		if (!ctx.dryRun) return;
+		const planned = reports.flatMap((r) => r.planned);
+		if (planned.length === 0) return;
+		const secrets = phaseCtx.secrets;
+		phaseCtx.secrets = {
+			...secrets,
+			async read() {
+				const stored = await secrets.read() ?? initStageSecrets(phaseCtx.stage);
+				const custom = { ...stored.custom };
+				for (const key of planned) custom[key] ??= PLANNED_BY_THE_DEPLOY;
+				return {
+					...stored,
+					custom
+				};
+			}
+		};
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: eventError(error)
+		});
+		throw error;
+	}
+}
+/** What a dry run reads for a key its providers would write. */
+const PLANNED_BY_THE_DEPLOY = "s3://planned-by-this-deploy";
+/** `--resources-only`: the target's own resources, and nothing else. */
+async function resourcesOnly(target, phaseCtx, emit) {
+	try {
+		if (target.resources) await target.resources(phaseCtx);
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: eventError(error)
+		});
+		throw error;
+	}
+	emit({
+		type: "phase.finished",
+		phase: "validate"
+	});
+	return resourcesResult(phaseCtx);
+}
+/** A `--resources-only` run: no app was deployed. */
+function resourcesResult(phaseCtx) {
+	return {
+		apps: [],
+		projectId: "",
+		successCount: 0,
+		failedCount: 0,
+		stage: phaseCtx.stage,
+		identity: phaseCtx.identity.key,
+		tag: phaseCtx.tag,
+		dryRun: phaseCtx.dryRun,
+		environmentId: "",
+		skipped: [...phaseCtx.skipped],
+		urls: {},
+		changes: []
+	};
+}
 /** `validate`, then the run's `deploy.started`, inside the validate phase. */
 async function validate(target, phaseCtx, emit) {
 	try {
@@ -273,6 +381,7 @@ async function validate(target, phaseCtx, emit) {
 /** Everything the phases are handed, worked out before the first of them. */
 async function prepare(source, request, ctx, emit, redactor) {
 	const { stage } = request;
+	if (request.resourcesOnly && request.skipResources) throw new ResourcesOnlyAndSkipped();
 	const configured = typeof source === "function" ? await source() : source;
 	const local = stage === configured.stages.local;
 	if (!local) assertDeployedStage(configured.stages, stage);
@@ -376,7 +485,8 @@ async function prepare(source, request, ctx, emit, redactor) {
 			dryRun: ctx.dryRun,
 			atomic: request.atomic ?? false,
 			allowDevServices,
-			...request.skipDnsCheck ? { skipDnsCheck: true } : {},
+			...request.skipDns ? { skipDns: true } : {},
+			...request.skipResources ? { skipResources: true } : {},
 			credentials: ctx.credentials,
 			state: store,
 			secrets,
@@ -490,7 +600,11 @@ function deploy(input) {
 				...input.apps ? { apps: input.apps } : {},
 				...input.atomic ? { atomic: true } : {},
 				...input.allowDevServices ? { allowDevServices: input.allowDevServices } : {},
-				...input.skipDnsCheck ? { skipDnsCheck: true } : {}
+				...input.skipDns ? { skipDns: true } : {},
+				...input.resourcesOnly ? { resourcesOnly: true } : {},
+				...input.skipResources ? { skipResources: true } : {},
+				...input.rotateKeys ? { rotateKeys: true } : {},
+				...input.retireOldKeys ? { retireOldKeys: true } : {}
 			}, ctx));
 			emit({
 				type: "deploy.finished",
@@ -524,4 +638,4 @@ async function load(input, sandbox) {
 //#endregion
 export { UnknownDeployApps as a, TargetBuildsNothing as i, NoDeployableApps as n, RollbackFailed as r, deploy as t };
 
-//# sourceMappingURL=deploy-DYIyIUYd.mjs.map
+//# sourceMappingURL=deploy-CeJ5D0xn.mjs.map