@geekmidas/cli 10.0.0-alpha.94 → 10.0.0-alpha.95

package/dist/{providers-BFeP_mYw.cjs → deploy-Bw1FjX_x.cjs}

@@ -1,127 +1,84 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_credentials = require("./credentials-D7XJypNd.cjs");
+const require_run = require("./run-fVZ-rLnc.cjs");
+const require_credentials = require("./credentials-Zqr3QQYB.cjs");
+const require_discover = require("./discover-DPgu-ScS.cjs");
+const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-cSyi5nb1.cjs");
-const require_seeds = require("./seeds-BCg8X36S.cjs");
+const require_define = require("./define-crmMcXFS.cjs");
+const require_config = require("./config.cjs");
+const require_seeds = require("./seeds-CnXkgKUv.cjs");
+const require_resolve = require("./resolve-CFb4Navi.cjs");
+const require_local = require("./local-DNhnkugT.cjs");
+const require_sniffer = require("./sniffer-vbiQ2Isn.cjs");
+const require_dns = require("./dns-Bmk7P9c2.cjs");
+const require_dns$1 = require("./dns-CyMIq6to.cjs");
+const require_credentialSchemas = require("./credentialSchemas-CAPKFkrG.cjs");
+let node_path = require("node:path");
 let _geekmidas_manifest = require("@geekmidas/manifest");
+let node_crypto = require("node:crypto");
 let _geekmidas_storage_s3_url = require("@geekmidas/storage/s3-url");
 _geekmidas_storage_s3_url = require_rolldown_runtime.__toESM(_geekmidas_storage_s3_url, 1);
-//#region src/deploy/journal.ts
-var DeployJournal = class DeployJournal {
-	store;
-	stage;
-	state;
-	resources;
-	version;
-	existed;
-	constructor(store, stage, state, resources, version, existed) {
-		this.store = store;
-		this.stage = stage;
-		this.state = state;
-		this.resources = resources;
-		this.version = version;
-		this.existed = existed;
-	}
-	static async open(store, stage, initial, adopt = (stored) => stored) {
-		const stored = await store.read(stage);
-		if (stored) return new DeployJournal(store, stage, adopt(stored.state), stored.resources, stored.version, true);
-		const state = initial();
-		const version = await store.write(stage, state, { expectedVersion: null });
-		return new DeployJournal(store, stage, state, {}, version, false);
-	}
-	record(key) {
-		return this.resources[key];
-	}
-	/** The keys a previous run marked `pending` and never saw created. */
-	unfinished() {
-		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
-	}
-	/** Records that `entry` is about to be created. */
-	async pending(entry) {
-		await this.put({
-			...entry,
-			status: "pending"
-		});
-	}
-	/**
-	* Records `entry` as existing with `id`; a no-op if it already is, with
-	* the same data.
-	*/
-	async ready(entry, id) {
-		const current = this.resources[entry.key];
-		if (current?.status === "ready" && current.id === id && JSON.stringify(current.data) === JSON.stringify(entry.data)) return;
-		await this.put({
-			...entry,
-			status: "ready",
-			id
-		});
-	}
-	/**
-	* The resource `entry` names: by its recorded id, else by looking it up,
-	* else created — with `pending` written before the create and `ready`
-	* after, so a run that dies in between leaves a record the next run
-	* resolves by looking the resource up rather than creating another.
-	*/
-	async ensure(entry, steps) {
-		const record = this.resources[entry.key];
-		let staleId;
-		if (record?.status === "ready" && record.id && steps.get) {
-			const known = await steps.get(record.id);
-			if (known) {
-				await this.ready(entry, steps.id(known));
-				return {
-					resource: known,
-					via: "recorded"
-				};
-			}
-			staleId = record.id;
-		}
-		const existing = await steps.find();
-		if (existing) {
-			await this.ready(entry, steps.id(existing));
-			return {
-				resource: existing,
-				via: record?.status === "pending" ? "resumed" : "found",
-				...staleId ? { staleId } : {}
-			};
-		}
-		await this.pending(entry);
-		const created = await steps.create();
-		await this.ready(entry, steps.id(created));
-		return {
-			resource: created,
-			via: "created",
-			...staleId ? { staleId } : {}
-		};
-	}
-	/** Removes `key`'s record — a resource that no longer exists. */
-	async forget(key) {
-		if (!(key in this.resources)) return;
-		this.version = await this.store.deleteResource(this.stage, key, { expectedVersion: this.version });
-		const { [key]: _removed, ...resources } = this.resources;
-		this.resources = resources;
-	}
-	/** Every record, as the journal last wrote or read it. */
-	records() {
-		return this.resources;
-	}
-	/** Writes the stage's state, keeping its resource records. */
-	async save() {
-		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
+//#region src/target/secrets.ts
+/**
+* A stage's secrets as a target sees them: read and written through the
+* stage's own store, and masked in everything the run prints once read.
+*/
+/**
+* Shorter values are left alone: what a progress line legitimately prints —
+* a port, a stage, an app name — would otherwise come out as `***` wherever
+* a secret happened to share it.
+*/
+const SHORTEST_MASKED = 6;
+/** The values a run must never print, and the rewrite that keeps it so. */
+var Redactor = class {
+	values = /* @__PURE__ */ new Set();
+	add(value) {
+		if (value && value.length >= SHORTEST_MASKED) this.values.add(value);
 	}
-	async put(record) {
-		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
-		this.resources = {
-			...this.resources,
-			[record.key]: {
-				...record,
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			}
-		};
+	/** `text` with every masked value replaced by `***`, longest first. */
+	redact(text) {
+		if (this.values.size === 0) return text;
+		let out = text;
+		const longestFirst = [...this.values].sort((a, b) => b.length - a.length);
+		for (const value of longestFirst) out = out.replaceAll(value, "***");
+		return out;
 	}
 };
+/** Every value in `secrets` that is a secret rather than a label. */
+function secretValues(secrets) {
+	return [
+		secrets.seed,
+		...Object.values(secrets.custom ?? {}),
+		...Object.values(secrets.urls ?? {}),
+		...Object.values(secrets.services ?? {}).map((service) => service?.password)
+	].filter((value) => typeof value === "string");
+}
+/**
+* The stage's secrets through the store `secrets.store` names for it. Opening
+* one builds a client and makes no request, so a target that never reads them
+* costs nothing.
+*/
+async function deploySecrets(workspace, stage, redactor, options = {}) {
+	const store = await require_seeds.secretsStoreFor(workspace, stage, options);
+	const mask = (secrets) => {
+		for (const value of secretValues(secrets)) redactor.add(value);
+	};
+	return {
+		store: store.name,
+		async read() {
+			const secrets = await store.read(stage);
+			if (secrets) mask(secrets);
+			return secrets;
+		},
+		async write(secrets) {
+			mask(secrets);
+			await store.write(stage, secrets);
+		},
+		mask: (value) => redactor.add(value)
+	};
+}
 //#endregion
 //#region src/providers/aws.ts
 /**
@@ -195,6 +152,88 @@ async function awsClientConfig(credential, region) {
 	};
 	return { region };
 }
+const SUFFIX_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+/** A name that S3 would refuse — what the name builder never returns. */
+var InvalidBucketName = class extends require_errors.GkmError {
+	bucket;
+	reason;
+	constructor(bucket, reason) {
+		super(`'${bucket}' is not a valid S3 bucket name: ${reason}. Rename the construct or set deploy.namespace in gkm.config.ts to something that leaves room for it.`);
+		this.bucket = bucket;
+		this.reason = reason;
+		this.name = "InvalidBucketName";
+	}
+};
+/** Lowercase `[a-z0-9-]`, runs of anything else one `-`, no edge dashes. */
+function part(value) {
+	return (0, _geekmidas_manifest.kebabCase)(value).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+/**
+* `parts` joined by `-`, shortened to `max` characters by trimming the longest
+* part one character at a time — so a long construct id gives way before a
+* short stage name does, and every part keeps its start.
+*/
+function fitParts(parts, max) {
+	const kept = parts.map(part).filter(Boolean);
+	const length = () => kept.reduce((sum, p) => sum + p.length, 0) + kept.length - 1;
+	while (length() > max) {
+		let longest = 0;
+		for (let i = 1; i < kept.length; i++) if (kept[i].length > kept[longest].length) longest = i;
+		if (kept[longest].length <= 1) break;
+		kept[longest] = kept[longest].slice(0, -1).replace(/-+$/, "");
+	}
+	return kept.join("-");
+}
+/** Why `name` is not a valid bucket name, or undefined when it is. */
+function bucketNameProblem(name) {
+	if (name.length < 3 || name.length > 63) return `it is ${name.length} characters, and S3 takes 3 to 63`;
+	if (!/^[a-z0-9-]+$/.test(name)) return "it may hold only lowercase letters, digits and -";
+	if (!/^[a-z0-9].*[a-z0-9]$/.test(name)) return "it must start and end with a letter or a digit";
+	if (name.startsWith("xn--") || name.startsWith("sthree-")) return "it starts with a prefix S3 reserves ('xn--', 'sthree-')";
+	if (name.endsWith("-s3alias") || name.endsWith("--ol-s3")) return "it ends with a suffix S3 reserves ('-s3alias', '--ol-s3')";
+}
+/**
+* The good name: `<namespace>-<project>-<stage>-<bucket id>`, lowercased, no
+* dots, shortened to leave room for a clash's suffix.
+*
+* @throws {InvalidBucketName} when nothing usable is left
+*/
+function bucketName(input) {
+	const name = fitParts([
+		input.scope,
+		input.stage,
+		input.id
+	], 56);
+	const problem = bucketNameProblem(name);
+	if (problem) throw new InvalidBucketName(name, problem);
+	return name;
+}
+/** Six random `[a-z0-9]` characters. */
+function randomSuffix(random = node_crypto.randomInt) {
+	let suffix = "";
+	for (let i = 0; i < 6; i++) suffix += SUFFIX_ALPHABET[random(36)];
+	return suffix;
+}
+/** The good name with a clash's suffix. */
+function suffixedBucketName(good, suffix) {
+	return `${good}-${suffix}`;
+}
+/**
+* The IAM user a bucket is reached with on a stage:
+* `gkm-<project>-<stage>-<bucket id>`, at most 64 characters.
+*/
+function iamUserName(input) {
+	return fitParts([
+		"gkm",
+		input.scope,
+		input.stage,
+		input.id
+	], 64);
+}
+/** The path every user gkm creates is under, so it finds its own. */
+const IAM_USER_PATH = "/gkm/";
+/** The inline policy each user is given. */
+const IAM_POLICY_NAME = "gkm-bucket";
 //#endregion
 //#region src/providers/s3/origins.ts
 /**
@@ -472,7 +511,7 @@ async function ensureBucket(ctx, clients, construct) {
 	};
 	const versioning = ctx.config.versioning ?? construct.versioned;
 	const open = [...new Set(construct.servers.flatMap((s) => s.open))].sort();
-	const { bucket, exists } = await ensureBucketName(ctx, clients, id, require_seeds.bucketName(nameInput));
+	const { bucket, exists } = await ensureBucketName(ctx, clients, id, bucketName(nameInput));
 	await ensureBucketSettings(ctx, clients, {
 		id,
 		bucket,
@@ -483,7 +522,7 @@ async function ensureBucket(ctx, clients, construct) {
 	await ensureAccessKey(ctx, clients, {
 		id,
 		bucket,
-		...await ensureUser(ctx, clients, id, require_seeds.iamUserName(nameInput), userPolicy(bucket, { versioning }))
+		...await ensureUser(ctx, clients, id, iamUserName(nameInput), userPolicy(bucket, { versioning }))
 	});
 	const publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);
 	for (const server of construct.servers) {
@@ -595,7 +634,7 @@ async function ensureBucketName(ctx, clients, id, good) {
 	const names = [
 		...typeof pending === "string" && pending !== good ? [pending] : [],
 		good,
-		...Array.from({ length: 5 }, () => require_seeds.suffixedBucketName(good, require_seeds.randomSuffix()))
+		...Array.from({ length: 5 }, () => suffixedBucketName(good, randomSuffix()))
 	];
 	const tried = [];
 	for (const name of names) {
@@ -713,12 +752,12 @@ async function ensureUser(ctx, clients, id, user, policy) {
 	} else await ctx.change({
 		construct: id,
 		resource: `IAM user ${user}`,
-		change: `create under ${require_seeds.IAM_USER_PATH}`
+		change: `create under ${IAM_USER_PATH}`
 	}, async () => {
 		await ctx.state.pending(entry);
 		await iam.send(new IAM.CreateUserCommand({
 			UserName: user,
-			Path: require_seeds.IAM_USER_PATH,
+			Path: IAM_USER_PATH,
 			Tags: identityTags(ctx, id)
 		}));
 		await ctx.state.ready(entry, user);
@@ -726,17 +765,17 @@ async function ensureUser(ctx, clients, id, user, policy) {
 	const exists = Boolean(found?.User) || !ctx.dryRun;
 	const current = exists ? await readOr(() => iam.send(new IAM.GetUserPolicyCommand({
 		UserName: user,
-		PolicyName: require_seeds.IAM_POLICY_NAME
+		PolicyName: IAM_POLICY_NAME
 	})), ["NoSuchEntity", "NoSuchEntityException"]) : void 0;
 	const document = current?.PolicyDocument ? JSON.parse(decodePolicy(current.PolicyDocument)) : void 0;
 	if (!document || canonicalPolicy(document) !== canonicalPolicy(policy)) await ctx.change({
 		construct: id,
 		resource: `IAM user ${user}`,
-		change: `policy ${require_seeds.IAM_POLICY_NAME}: this bucket only`
+		change: `policy ${IAM_POLICY_NAME}: this bucket only`
 	}, async () => {
 		await iam.send(new IAM.PutUserPolicyCommand({
 			UserName: user,
-			PolicyName: require_seeds.IAM_POLICY_NAME,
+			PolicyName: IAM_POLICY_NAME,
 			PolicyDocument: JSON.stringify(policy)
 		}));
 	});
@@ -909,12 +948,10 @@ function constructsOf(manifest, kind) {
 /**
 * What every deploy runs: each provider's `verify()` — the cheap check that
 * what it created is still there and the stage's key reaches it. Nothing on
-* the local stage, and nothing for a kind on `external`.
-*
-* @throws {StageProviderDisabled} for a declared kind the stage has none of
+* the local stage, and nothing for a kind on `external` or `false` — a kind
+* the stage has none of is the deploy's readiness check's to refuse.
 */
 async function verifyStageProviders(input) {
-	require_seeds.assertStageProvidersEnabled(input.workspace, input.manifest, input.stage);
 	const verified = [];
 	for (const kind of require_seeds.PROVIDER_KINDS) {
 		if (constructsOf(input.manifest, kind).length === 0) continue;
@@ -1012,7 +1049,7 @@ async function provisionStage(options) {
 	const identity = require_seeds.deployIdentity(workspace, stage);
 	let secrets = (await options.secrets.read())?.custom ?? {};
 	for (const entry of configured) entry.report.planned = entry.provider.runtimeKeys(manifest).filter((key) => secrets[key] === void 0);
-	const state = dryRun ? await readOnlyState(options.state, stage) : journalState(await DeployJournal.open(options.state, stage, () => require_seeds.deploysWithCompose(workspace) ? require_seeds.createComposeState(stage) : require_seeds.createEmptyState(stage, "", "")));
+	const state = dryRun ? await readOnlyState(options.state, stage) : journalState(await require_seeds.DeployJournal.open(options.state, stage, () => require_dns$1.deploysWithCompose(workspace) ? require_seeds.createComposeState(stage) : require_seeds.createEmptyState(stage, "", "")));
 	const writeSecrets = async (values) => {
 		if (dryRun) return;
 		const stored = await options.secrets.read() ?? require_seeds.initStageSecrets(stage);
@@ -1076,23 +1113,791 @@ async function readOnlyState(store, stage) {
 	};
 }
 //#endregion
-Object.defineProperty(exports, "DeployJournal", {
+//#region src/secrets/stale.ts
+/**
+* Stored secrets an older gkm generated that now shadow a derived value.
+*
+* Before constructs, initialising a stage wrote an address for each app into
+* its custom secrets: `<APP>_DATABASE_URL` as a `postgresql://…@localhost`
+* URL with a password of its own, and `http://localhost:<port>` for a site or
+* an auth server. Those keys are now a construct's — `database.schema('AuthDatabase')`
+* provides `AUTH_DATABASE_URL`, `new BetterAuth('Auth')` provides `AUTH_URL`
+* — and a deploy derives them. A value the stage holds is a value set by hand,
+* and set by hand wins: the container is handed `localhost`, where nothing
+* answers, with a password no role has.
+*
+* So a deploy refuses such a stage rather than run it, naming each key and
+* the command that removes it. Nothing is deleted for the user: the value is
+* theirs, and only they can say it is stale. A URL that names a real host — a
+* managed database — is a deliberate choice and still wins.
+*/
+/** The kinds whose URL an older gkm wrote into a stage's secrets. */
+const ADDRESSED = /* @__PURE__ */ new Set([
+	"database",
+	"database-reader",
+	"database-schema",
+	"rest-api",
+	"site"
+]);
+/** Hosts that are this machine — never anything, inside a container. */
+const LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1"
+]);
+/**
+* A stage holds a construct's address as a custom secret, pointing at
+* `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
+* generated. Set by hand wins over derived, so the app would be handed it.
+*/
+var StaleStageSecrets = class extends require_errors.GkmError {
+	stage;
+	stale;
+	constructor(stage, stale) {
+		const one = stale.length === 1;
+		super(`The stage '${stage}' holds ${one ? "a value" : "values"} an older gkm generated for ${one ? "an address a construct" : "addresses constructs"} now ${one ? "provides" : "provide"}:\n` + stale.map((s) => `  ${s.key}: ${s.construct}'s, stored pointing at ${s.host}`).join("\n") + `
+A stored value wins over the derived one, so the app would be handed an address where nothing answers inside its container. Remove ${one ? "it" : "each"}, and the construct's own value is used:\n` + stale.map((s) => `  gkm secrets:unset ${s.key} --stage ${stage}`).join("\n") + "\nA managed service set with its real host is not affected.");
+		this.stage = stage;
+		this.stale = stale;
+		this.name = "StaleStageSecrets";
+	}
+};
+/** The host a stored value names, if it is a URL. */
+function hostOf(value) {
+	try {
+		return new URL(value).hostname;
+	} catch {
+		return;
+	}
+}
+/**
+* Each stored key that a construct provides an address for, holding an
+* address on this machine.
+*/
+function staleStageSecrets(manifest, supplied) {
+	const stale = [];
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (!ADDRESSED.has(declaration.kind)) continue;
+		const key = (0, _geekmidas_manifest.providedKeyFor)(id, declaration.kind, "url");
+		const value = supplied[key];
+		if (value === void 0) continue;
+		const host = hostOf(value);
+		if (host === void 0 || !LOOPBACK.has(host)) continue;
+		stale.push({
+			key,
+			construct: id,
+			host
+		});
+	}
+	return stale.sort((a, b) => a.key.localeCompare(b.key));
+}
+/**
+* Refuse a stage whose stored secrets would shadow a construct's address with
+* `localhost`.
+*
+* @throws {StaleStageSecrets} naming each key and the command removing it
+*/
+function assertNoStaleSecrets(options) {
+	const stale = staleStageSecrets(options.manifest, options.supplied);
+	if (stale.length > 0) throw new StaleStageSecrets(options.stage, stale);
+}
+//#endregion
+//#region src/deploy/readiness.ts
+/**
+* Whether a stage is ready to be deployed: the one check, run once by every
+* deploy through a server target — after the stage's providers have created
+* what they create and written its keys, and before the target touches
+* anything.
+*
+* A build is not a deploy. Images carry no stage's keys, so a build-only run
+* (`gkm compose --build --push`) never calls this: a key the deploy itself
+* writes — a provider's bucket URL — is not there yet when CI builds, and
+* must not stop the build.
+*/
+/**
+* The stage has every key it needs, read from its secrets as the providers
+* left them:
+*
+* 1. no kind it declares is one the stage set to `false`;
+* 2. its mail and storage are its own — or a dev service, where allowed,
+*    reported once, loudly;
+* 3. what its providers created is still there, and its key reaches it;
+* 4. no key holds an address an older gkm stored for what a construct now
+*    provides;
+* 5. each third party's credentials match their construct's schema.
+*
+* The local stage derives its mail and storage, so only 4 and 5 apply to it.
+*
+* @throws {StageProviderDisabled}
+* @throws {ExternalServicesNotConfigured} naming every missing key at once
+* @throws {StaleStageSecrets}
+* @throws {CredentialsInvalid}
+*/
+async function assertStageReady(ctx) {
+	const { workspace, manifest, stage } = ctx;
+	const supplied = (await ctx.secrets.read())?.custom ?? {};
+	if (stage !== workspace.stages.local) {
+		require_seeds.assertStageProvidersEnabled(workspace, manifest, stage);
+		const domain = workspace.domains?.[stage];
+		const services = require_seeds.externalServices({
+			stage,
+			declarations: require_seeds.stageServiceDeclarations({
+				manifest,
+				...ctx.runnables ? { runnables: ctx.runnables } : {}
+			}),
+			supplied,
+			allow: ctx.allowDevServices,
+			...domain ? { domain } : {},
+			providers: require_seeds.stageProviderNotes(workspace, stage)
+		});
+		if (services.missing.length > 0) throw new require_seeds.ExternalServicesNotConfigured(stage, services.missing);
+		require_seeds.reportDevServices(ctx, require_seeds.devServicesUsed(services));
+		const verified = await verifyStageProviders({
+			workspace,
+			manifest,
+			stage,
+			secrets: supplied
+		});
+		for (const line of verified) ctx.logger.info(`✓ ${line} verified`);
+	}
+	assertNoStaleSecrets({
+		manifest,
+		stage,
+		supplied
+	});
+	await require_credentialSchemas.assertStageCredentials({
+		root: workspace.root,
+		patterns: require_seeds.constructGlobs(workspace),
+		manifest,
+		stage,
+		supplied
+	});
+}
+//#endregion
+//#region src/deploy/orchestrate.ts
+/**
+* The run around a target: what every deploy does whatever it deploys
+* through.
+*
+* It loads the workspace, resolves the target, works out the apps and the
+* identity, takes the stage's lock, and calls the target's phases in order,
+* reporting each as it starts, finishes or fails. Everything that is about
+* *where* the stage goes is the target's.
+*/
+/** `--resources-only` with `--skip-resources`: the one asks for what the other skips. */
+var ResourcesOnlyAndSkipped = class extends require_errors.GkmError {
+	constructor() {
+		super("--resources-only creates the stage's resources and nothing else, and --skip-resources deploys without creating them. Run the first where the cloud credentials are (a CI runner), then the second where the stack runs.");
+		this.name = "ResourcesOnlyAndSkipped";
+	}
+};
+/** Apps were asked for by name that the workspace does not have. */
+var UnknownDeployApps = class extends require_errors.GkmError {
+	apps;
+	available;
+	constructor(apps, available) {
+		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
+		this.apps = apps;
+		this.available = available;
+		this.name = "UnknownDeployApps";
+	}
+};
+/** Every app asked for deploys through some other target. */
+var NoDeployableApps = class extends require_errors.GkmError {
+	stage;
+	target;
+	constructor(stage, target) {
+		super(`No apps to deploy through "${target}": every selected app deploys somewhere else. Pick the target with --target, or set each app's deploy in gkm.config.ts.`);
+		this.stage = stage;
+		this.target = target;
+		this.name = "NoDeployableApps";
+	}
+};
+/** A build-only run through a target with no build phase. */
+var TargetBuildsNothing = class extends require_errors.GkmError {
+	target;
+	constructor(target) {
+		super(`"${target}" has no build phase, so a build-only run would do nothing. Deploy it in full, or build through a target that builds images (compose).`);
+		this.target = target;
+		this.name = "TargetBuildsNothing";
+	}
+};
+/** A failed rollback, after the failure that called for it. */
+var RollbackFailed = class extends Error {
+	target;
+	failure;
+	constructor(target, failure, cause) {
+		super(`Deploying through "${target}" failed, and so did rolling it back: ${cause instanceof Error ? cause.message : String(cause)}. The stage may be part-released; deploy again, or roll it back by hand. The first failure: ${failure instanceof Error ? failure.message : String(failure)}`, { cause });
+		this.target = target;
+		this.failure = failure;
+		this.name = "RollbackFailed";
+	}
+};
+/**
+* Generate image tag from stage and timestamp
+*/
+function generateTag(stage) {
+	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
+}
+/** Why an app that deploys through another target is left out. */
+function elsewhere(target, stage) {
+	const instead = require_define.builtinTarget(target)?.instead?.(stage);
+	if (instead) return `it deploys through "${target}" — ${instead}`;
+	return `it deploys through "${target}" — run \`gkm deploy --target ${target} --stage ${stage}\``;
+}
+/**
+* Deploy a workspace's stage through its target.
+*
+* The engine under `deploy()` and `gkm deploy`. It never prompts and never
+* exits: credentials come from `ctx.credentials`, progress goes to
+* `ctx.emit` and to `output`, and every failure is thrown.
+*
+* @internal
+*/
+async function runDeploy(source, request, ctx) {
+	const { stage } = request;
+	const redactor = ctx.redactor ?? new Redactor();
+	const emit = (event) => ctx.emit(event.type === "log" ? {
+		...event,
+		message: redactor.redact(event.message)
+	} : event);
+	/** Run one phase between its events. */
+	const phase = async (name, body) => {
+		ctx.signal?.throwIfAborted();
+		emit({
+			type: "phase.started",
+			phase: name
+		});
+		try {
+			const value = await body();
+			emit({
+				type: "phase.finished",
+				phase: name
+			});
+			return value;
+		} catch (error) {
+			emit({
+				type: "phase.failed",
+				phase: name,
+				error: require_sniffer.eventError(error)
+			});
+			throw error;
+		}
+	};
+	ctx.signal?.throwIfAborted();
+	emit({
+		type: "phase.started",
+		phase: "validate"
+	});
+	let prepared;
+	try {
+		prepared = await prepare(source, request, ctx, emit, redactor);
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: require_sniffer.eventError(error)
+		});
+		throw error;
+	}
+	const { resolved, phaseCtx, store } = prepared;
+	const { target } = resolved;
+	const resources = !ctx.buildOnly && !request.skipResources && phaseCtx.stage !== phaseCtx.workspace.stages.local;
+	const provision = async () => {
+		if (!request.skipDns && resolved.target.runtime === "server") try {
+			await require_dns.dnsCredentials(phaseCtx.stage, require_dns.stageDnsDomains(phaseCtx.stage, phaseCtx.workspace.domains, phaseCtx.workspace.dns), ctx.credentials);
+		} catch (error) {
+			emit({
+				type: "phase.failed",
+				phase: "validate",
+				error: require_sniffer.eventError(error)
+			});
+			throw error;
+		}
+		await provisionResources(phaseCtx, request, ctx, store, emit);
+	};
+	if (ctx.dryRun) {
+		if (resources) await provision();
+		if (request.resourcesOnly) return resourcesOnly(target, phaseCtx, emit);
+		const run = await validate(phaseCtx, emit, () => readyToDeploy(target, phaseCtx));
+		await phase("plan", () => target.plan(phaseCtx, run));
+		return target.result(phaseCtx, run);
+	}
+	if (ctx.buildOnly) {
+		if (!target.build) throw new TargetBuildsNothing(resolved.name);
+		const run = await validate(phaseCtx, emit, () => target.validate(phaseCtx));
+		await phase("build", () => target.build(phaseCtx, run));
+		return target.result(phaseCtx, run);
+	}
+	let lock;
+	try {
+		require_sniffer.assertStateOutlivesRun(phaseCtx.workspace, stage, "deploy");
+		lock = await store.lock(stage, { operation: "deploy" });
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: require_sniffer.eventError(error)
+		});
+		throw error;
+	}
+	try {
+		if (resources) await provision();
+		if (request.resourcesOnly) return resourcesOnly(target, phaseCtx, emit);
+		const run = await validate(phaseCtx, emit, () => readyToDeploy(target, phaseCtx));
+		if (target.provision) await phase("provision", () => target.provision(phaseCtx, run));
+		if (target.build) await phase("build", () => target.build(phaseCtx, run));
+		let releasing = "release";
+		try {
+			await phase("release", () => target.release(phaseCtx, run));
+			releasing = "verify";
+			if (target.verify) await phase("verify", () => target.verify(phaseCtx, run));
+		} catch (error) {
+			if (ctx.signal?.aborted || !target.capabilities.rollback) throw error;
+			if (!target.rollback) throw error;
+			try {
+				await phase("rollback", () => target.rollback(phaseCtx, run, {
+					phase: releasing,
+					error
+				}));
+			} catch (rollbackError) {
+				throw new RollbackFailed(resolved.name, error, rollbackError);
+			}
+			throw error;
+		}
+		return await target.result(phaseCtx, run);
+	} finally {
+		await lock.release();
+	}
+}
+/**
+* The stage's providers, run inside the validate phase. A dry run plans them
+* and, so the checks after it see the stage as the run would leave it, reads
+* the keys they would write as placeholders.
+*/
+async function provisionResources(phaseCtx, request, ctx, store, emit) {
+	try {
+		const reports = await provisionStage({
+			workspace: phaseCtx.workspace,
+			stage: phaseCtx.stage,
+			manifest: phaseCtx.manifest,
+			runnables: phaseCtx.runnables ?? {},
+			secrets: phaseCtx.secrets,
+			state: store,
+			dryRun: ctx.dryRun,
+			...request.rotateKeys ? { rotateKeys: true } : {},
+			...request.retireOldKeys ? { retireOldKeys: true } : {},
+			...ctx.home ? { home: ctx.home } : {},
+			log: (line) => phaseCtx.logger.info(line)
+		});
+		if (!ctx.dryRun) return;
+		const planned = reports.flatMap((r) => r.planned);
+		if (planned.length === 0) return;
+		const secrets = phaseCtx.secrets;
+		phaseCtx.secrets = {
+			...secrets,
+			async read() {
+				const stored = await secrets.read() ?? require_seeds.initStageSecrets(phaseCtx.stage);
+				const custom = { ...stored.custom };
+				for (const key of planned) custom[key] ??= PLANNED_BY_THE_DEPLOY;
+				return {
+					...stored,
+					custom
+				};
+			}
+		};
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: require_sniffer.eventError(error)
+		});
+		throw error;
+	}
+}
+/** What a dry run reads for a key its providers would write. */
+const PLANNED_BY_THE_DEPLOY = "s3://planned-by-this-deploy";
+/** `--resources-only`: the target's own resources, and nothing else. */
+async function resourcesOnly(target, phaseCtx, emit) {
+	try {
+		if (target.resources) await target.resources(phaseCtx);
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: require_sniffer.eventError(error)
+		});
+		throw error;
+	}
+	emit({
+		type: "phase.finished",
+		phase: "validate"
+	});
+	return resourcesResult(phaseCtx);
+}
+/** A `--resources-only` run: no app was deployed. */
+function resourcesResult(phaseCtx) {
+	return {
+		apps: [],
+		projectId: "",
+		successCount: 0,
+		failedCount: 0,
+		stage: phaseCtx.stage,
+		identity: phaseCtx.identity.key,
+		tag: phaseCtx.tag,
+		dryRun: phaseCtx.dryRun,
+		environmentId: "",
+		skipped: [...phaseCtx.skipped],
+		urls: {},
+		changes: []
+	};
+}
+/**
+* What a deploy validates: the stage ready to be deployed — every key it
+* needs, read as its providers left them — then what the target would run,
+* then whatever only the target checks. A build-only run validates the
+* target's run alone: it calls neither readiness check.
+*/
+async function readyToDeploy(target, phaseCtx) {
+	if (target.runtime === "server") await assertStageReady(phaseCtx);
+	const run = await target.validate(phaseCtx);
+	await target.ready?.(phaseCtx, run);
+	return run;
+}
+/** `body`, then the run's `deploy.started`, inside the validate phase. */
+async function validate(phaseCtx, emit, body) {
+	try {
+		const run = await body();
+		const skipped = new Set(phaseCtx.skipped.map((s) => s.app));
+		emit({
+			type: "deploy.started",
+			stage: phaseCtx.stage,
+			target: phaseCtx.target,
+			identity: phaseCtx.identity.key,
+			tag: phaseCtx.tag,
+			apps: phaseCtx.apps.filter((app) => !skipped.has(app)),
+			dryRun: phaseCtx.dryRun
+		});
+		emit({
+			type: "phase.finished",
+			phase: "validate"
+		});
+		return run;
+	} catch (error) {
+		emit({
+			type: "phase.failed",
+			phase: "validate",
+			error: require_sniffer.eventError(error)
+		});
+		throw error;
+	}
+}
+/** Everything the phases are handed, worked out before the first of them. */
+async function prepare(source, request, ctx, emit, redactor) {
+	const { stage } = request;
+	if (request.resourcesOnly && request.skipResources) throw new ResourcesOnlyAndSkipped();
+	const configured = typeof source === "function" ? await source() : source;
+	const local = stage === configured.stages.local;
+	if (!local) require_workspace.assertDeployedStage(configured.stages, stage);
+	const targetName = request.target ?? configured.deploy?.default ?? "dokploy";
+	const resolved = await require_resolve.resolveTarget(targetName, {
+		workspace: configured,
+		stage,
+		...ctx.targets ? { host: ctx.targets } : {}
+	});
+	if (local && !resolved.target.capabilities.localStage) require_workspace.assertDeployedStage(configured.stages, stage);
+	const options = await require_resolve.parseTargetOptions(resolved);
+	const allowDevServices = request.allowDevServices === true;
+	if (allowDevServices && resolved.target.runtime === "aws") throw new require_seeds.DevServicesNeedServerTarget(targetName);
+	const runnables = {};
+	const background = {};
+	const manifest = await require_discover.discover({
+		patterns: require_seeds.constructGlobs(configured),
+		cwd: configured.root,
+		runnables,
+		background
+	});
+	require_workspace.resolveStageTelemetry({
+		...configured.deploy?.telemetry ? { telemetry: configured.deploy.telemetry } : {},
+		stage,
+		local,
+		target: targetName,
+		runtime: resolved.target.runtime,
+		selfHosted: resolved.target.capabilities.selfHostedTelemetry === true,
+		used: require_seeds.usesTelemetry(manifest)
+	});
+	const units = require_derive.derivedApps(manifest, configured);
+	const workspace = Object.keys(units).length > 0 ? {
+		...configured,
+		apps: units
+	} : configured;
+	const identity = require_seeds.deployIdentity(workspace, stage);
+	const tag = request.tag ?? (resolved.target.tag ? await resolved.target.tag({
+		cwd: workspace.root,
+		stage
+	}) : generateTag(stage));
+	const buildOrder = require_workspace.getAppBuildOrder(workspace);
+	let selected = buildOrder;
+	if (request.apps && request.apps.length > 0) {
+		const unknown = request.apps.filter((name) => !workspace.apps[name]);
+		if (unknown.length > 0) throw new UnknownDeployApps(unknown, Object.keys(workspace.apps));
+		selected = buildOrder.filter((name) => request.apps.includes(name));
+	}
+	const skipped = [];
+	const skip = (app, reason) => {
+		skipped.push({
+			app,
+			reason
+		});
+		emit({
+			type: "app.skipped",
+			app,
+			reason
+		});
+	};
+	const byDefault = configured.deploy?.default ?? "dokploy";
+	const apps = selected.filter((name) => {
+		const own = workspace.apps[name].resolvedDeployTarget;
+		const deploysThrough = own === byDefault ? targetName : own;
+		if (deploysThrough === targetName) return true;
+		skip(name, elsewhere(deploysThrough, stage));
+		return false;
+	});
+	if (apps.length === 0) throw new NoDeployableApps(stage, targetName);
+	const store = await require_sniffer.createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	});
+	const secrets = await deploySecrets(workspace, stage, redactor, { ...ctx.home ? { home: ctx.home } : {} });
+	const line = (level) => (message) => emit({
+		type: "log",
+		level,
+		message
+	});
+	const logger = {
+		info: line("info"),
+		warn: line("warn"),
+		error: line("error")
+	};
+	return {
+		resolved,
+		phaseCtx: {
+			target: targetName,
+			cwd: workspace.root,
+			stage,
+			tag,
+			tagGiven: request.tag !== void 0,
+			apps,
+			skipped,
+			identity,
+			workspace,
+			manifest,
+			runnables,
+			background,
+			options,
+			dryRun: ctx.dryRun,
+			atomic: request.atomic ?? false,
+			allowDevServices,
+			...request.skipDns ? { skipDns: true } : {},
+			...request.skipResources ? { skipResources: true } : {},
+			credentials: ctx.credentials,
+			state: store,
+			secrets,
+			logger,
+			signal: ctx.signal ?? new AbortController().signal,
+			childOutput: ctx.childOutput ?? "inherit",
+			emit,
+			skip,
+			name: (resource) => require_seeds.applicationName(identity, resource)
+		},
+		store
+	};
+}
+//#endregion
+//#region src/deploy/deploy.ts
+/**
+* `deploy()`: a deploy as a library call.
+*
+* `gkm deploy` could only be driven from an interactive terminal: it prompted
+* for what it lacked and exited the process on failure, worked out of
+* `process.cwd()`, and reported progress by printing. Here the caller says
+* where the project is, hands over the credentials and a signal, and gets back
+* a run — events to iterate while it goes, and a structured result at the end.
+* Nothing below this asks a person anything or ends the process; `gkm deploy`
+* is a thin wrapper that does both.
+*/
+/**
+* Every event a run emits, kept so that each iteration — however late it
+* starts — sees the run from its first event to its last.
+*/
+var EventLog = class {
+	events = [];
+	closed = false;
+	waiting = [];
+	push(event) {
+		this.events.push(event);
+		this.wake();
+	}
+	close() {
+		this.closed = true;
+		this.wake();
+	}
+	wake() {
+		const waiting = this.waiting;
+		this.waiting = [];
+		for (const resume of waiting) resume();
+	}
+	async *iterate() {
+		let next = 0;
+		while (true) if (next < this.events.length) yield this.events[next++];
+		else if (this.closed) return;
+		else await new Promise((resume) => this.waiting.push(resume));
+	}
+};
+function forward(logger, level, message) {
+	if (!logger) return;
+	if (level === "info") logger.info(message);
+	else if (level === "error" && logger.error) logger.error(message);
+	else logger.warn(message);
+}
+/**
+* Deploy a project's stage.
+*
+* ```ts
+* import { deploy } from '@geekmidas/cli/deploy';
+*
+* const run = deploy({ cwd: '/srv/checkouts/shop', stage: 'production' });
+* for await (const event of run) {
+*   if (event.type === 'app.deployed') console.log(event.app, event.url);
+* }
+* const result = await run.result;
+* ```
+*
+* The run starts at once; iterating it is optional, and an iteration started
+* late still sees every event from the first.
+*/
+function deploy(input) {
+	const log = new EventLog();
+	const redactor = new Redactor();
+	const emit = (event) => {
+		const masked = event.type === "log" ? {
+			...event,
+			message: redactor.redact(event.message)
+		} : event;
+		log.push(masked);
+		if (masked.type === "log") forward(input.logger, masked.level, masked.message);
+	};
+	const ctx = {
+		emit,
+		credentials: input.credentials ?? require_credentials.storedCredentials({ home: input.home ?? require_run.gkmHome() }),
+		dryRun: input.dryRun ?? false,
+		...input.buildOnly ? { buildOnly: true } : {},
+		home: input.home ?? require_run.gkmHome(),
+		redactor,
+		...input.signal ? { signal: input.signal } : {},
+		...input.childOutput ? { childOutput: input.childOutput } : {},
+		...input.targets ? { targets: input.targets } : {}
+	};
+	const result = require_discover.withOutput((level, message) => emit({
+		type: "log",
+		level,
+		message
+	}), async () => {
+		try {
+			input.signal?.throwIfAborted();
+			const sandbox = input.sandbox ?? new require_local.LocalSandbox({ root: require_config.findWorkspaceRoot((0, node_path.resolve)(input.cwd)) });
+			const deployed = await require_sandbox.withSandbox(sandbox, () => runDeploy(() => load(input, sandbox), {
+				stage: input.stage,
+				...input.target ? { target: input.target } : {},
+				...input.tag ? { tag: input.tag } : {},
+				...input.apps ? { apps: input.apps } : {},
+				...input.atomic ? { atomic: true } : {},
+				...input.allowDevServices ? { allowDevServices: input.allowDevServices } : {},
+				...input.skipDns ? { skipDns: true } : {},
+				...input.resourcesOnly ? { resourcesOnly: true } : {},
+				...input.skipResources ? { skipResources: true } : {},
+				...input.rotateKeys ? { rotateKeys: true } : {},
+				...input.retireOldKeys ? { retireOldKeys: true } : {}
+			}, ctx));
+			emit({
+				type: "deploy.finished",
+				result: deployed
+			});
+			return deployed;
+		} catch (error) {
+			emit({
+				type: "deploy.failed",
+				error: require_sniffer.eventError(error)
+			});
+			throw error;
+		} finally {
+			log.close();
+		}
+	});
+	result.catch(() => {});
+	return {
+		result,
+		[Symbol.asyncIterator]: () => log.iterate()
+	};
+}
+/**
+* The workspace at `input.cwd`. The stage is checked by the run, once it
+* knows the target: one that runs on this machine may take the local stage.
+*/
+async function load(input, sandbox) {
+	const { workspace } = await require_config.loadWorkspaceConfig((0, node_path.resolve)(input.cwd), { sandbox });
+	return workspace;
+}
+//#endregion
+Object.defineProperty(exports, "IAM_USER_PATH", {
+	enumerable: true,
+	get: function() {
+		return IAM_USER_PATH;
+	}
+});
+Object.defineProperty(exports, "NoDeployableApps", {
+	enumerable: true,
+	get: function() {
+		return NoDeployableApps;
+	}
+});
+Object.defineProperty(exports, "RollbackFailed", {
+	enumerable: true,
+	get: function() {
+		return RollbackFailed;
+	}
+});
+Object.defineProperty(exports, "TargetBuildsNothing", {
+	enumerable: true,
+	get: function() {
+		return TargetBuildsNothing;
+	}
+});
+Object.defineProperty(exports, "UnknownDeployApps", {
+	enumerable: true,
+	get: function() {
+		return UnknownDeployApps;
+	}
+});
+Object.defineProperty(exports, "bucketName", {
 	enumerable: true,
 	get: function() {
-		return DeployJournal;
+		return bucketName;
 	}
 });
-Object.defineProperty(exports, "provisionStage", {
+Object.defineProperty(exports, "deploy", {
 	enumerable: true,
 	get: function() {
-		return provisionStage;
+		return deploy;
 	}
 });
-Object.defineProperty(exports, "verifyStageProviders", {
+Object.defineProperty(exports, "iamUserName", {
 	enumerable: true,
 	get: function() {
-		return verifyStageProviders;
+		return iamUserName;
 	}
 });
 
-//# sourceMappingURL=providers-BFeP_mYw.cjs.map
+//# sourceMappingURL=deploy-Bw1FjX_x.cjs.map