@ninedeploy/schemas 0.10.6 → 0.16.1

package/dist/secretProviders.d.ts

@@ -0,0 +1,119 @@
+import { z } from 'zod';
+/** Mirrors `secretProviderKind` in `@ninedeploy/db`. */
+export declare const secretProviderKind: z.ZodEnum<{
+    aws: "aws";
+    vault: "vault";
+}>;
+export type SecretProviderKind = z.infer<typeof secretProviderKind>;
+/**
+ * A Vault path relative to the KV v2 mount: segments of `[A-Za-z0-9_.-]+`
+ * joined by `/`, no leading or trailing `/`, and no `.` or `..` segment.
+ */
+export declare const VAULT_PATH_RE: RegExp;
+/** A KV v2 field name. */
+export declare const VAULT_FIELD_RE: RegExp;
+/** An AWS secret name or full ARN. */
+export declare const AWS_SECRET_ID_RE: RegExp;
+export declare const AWS_REGION_RE: RegExp;
+export declare const AWS_ACCESS_KEY_ID_RE: RegExp;
+export declare const vaultPath: z.ZodString;
+export declare const awsSecretId: z.ZodString;
+export declare const vaultAuthMethod: z.ZodEnum<{
+    approle: "approle";
+    token: "token";
+}>;
+export type VaultAuthMethod = z.infer<typeof vaultAuthMethod>;
+export declare const vaultProviderConfig: z.ZodObject<{
+    address: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>;
+    namespace: z.ZodOptional<z.ZodString>;
+    mount: z.ZodDefault<z.ZodString>;
+    authMethod: z.ZodEnum<{
+        approle: "approle";
+        token: "token";
+    }>;
+    approleMount: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+export type VaultProviderConfig = z.input<typeof vaultProviderConfig>;
+export declare const vaultProviderCredentials: z.ZodObject<{
+    token: z.ZodOptional<z.ZodString>;
+    roleId: z.ZodOptional<z.ZodString>;
+    secretId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type VaultProviderCredentials = z.infer<typeof vaultProviderCredentials>;
+/** PUT /v1/settings/secret-providers/vault. */
+export declare const vaultProviderPut: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    config: z.ZodObject<{
+        address: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>;
+        namespace: z.ZodOptional<z.ZodString>;
+        mount: z.ZodDefault<z.ZodString>;
+        authMethod: z.ZodEnum<{
+            approle: "approle";
+            token: "token";
+        }>;
+        approleMount: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    credentials: z.ZodOptional<z.ZodObject<{
+        token: z.ZodOptional<z.ZodString>;
+        roleId: z.ZodOptional<z.ZodString>;
+        secretId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type VaultProviderPut = z.input<typeof vaultProviderPut>;
+export declare const awsProviderConfig: z.ZodObject<{
+    region: z.ZodString;
+    endpoint: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>>;
+    roleArn: z.ZodOptional<z.ZodString>;
+    externalId: z.ZodOptional<z.ZodString>;
+    roleSessionName: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+export type AwsProviderConfig = z.input<typeof awsProviderConfig>;
+export declare const awsProviderCredentials: z.ZodObject<{
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type AwsProviderCredentials = z.infer<typeof awsProviderCredentials>;
+/** PUT /v1/settings/secret-providers/aws. */
+export declare const awsProviderPut: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    config: z.ZodObject<{
+        region: z.ZodString;
+        endpoint: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>>;
+        roleArn: z.ZodOptional<z.ZodString>;
+        externalId: z.ZodOptional<z.ZodString>;
+        roleSessionName: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    credentials: z.ZodOptional<z.ZodObject<{
+        accessKeyId: z.ZodOptional<z.ZodString>;
+        secretAccessKey: z.ZodOptional<z.ZodString>;
+        sessionToken: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AwsProviderPut = z.input<typeof awsProviderPut>;
+/** POST /v1/settings/secret-providers/:kind/test. Both probes are optional. */
+export declare const secretProviderTestRequest: z.ZodObject<{
+    probePath: z.ZodOptional<z.ZodString>;
+    probeSecretId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SecretProviderTestRequest = z.infer<typeof secretProviderTestRequest>;
+export declare const secretProviderTestResult: z.ZodObject<{
+    ok: z.ZodBoolean;
+    detail: z.ZodString;
+}, z.core.$strip>;
+export type SecretProviderTestResult = z.infer<typeof secretProviderTestResult>;
+/** One element of GET /v1/settings/secret-providers. Never carries a credential. */
+export declare const secretProviderView: z.ZodObject<{
+    kind: z.ZodEnum<{
+        aws: "aws";
+        vault: "vault";
+    }>;
+    configured: z.ZodBoolean;
+    enabled: z.ZodBoolean;
+    config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    hasCredential: z.ZodBoolean;
+    lastTestedAt: z.ZodNullable<z.ZodString>;
+    lastTestError: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type SecretProviderView = z.infer<typeof secretProviderView>;
+//# sourceMappingURL=secretProviders.d.ts.map

package/dist/secretProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretProviders.d.ts","sourceRoot":"","sources":["../src/secretProviders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;EAA2B,CAAC;AAC3D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE;;;GAGG;AACH,eAAO,MAAM,aAAa,QAA8E,CAAC;AACzG,0BAA0B;AAC1B,eAAO,MAAM,cAAc,QAAsB,CAAC;AAClD,sCAAsC;AACtC,eAAO,MAAM,gBAAgB,QAAkC,CAAC;AAChE,eAAO,MAAM,aAAa,QAAgC,CAAC;AAC3D,eAAO,MAAM,oBAAoB,QAA8B,CAAC;AAEhE,eAAO,MAAM,SAAS,aAAkE,CAAC;AACzF,eAAO,MAAM,WAAW,aAA8D,CAAC;AAIvF,eAAO,MAAM,eAAe;;;EAA+B,CAAC;AAC5D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;;kBASrB,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAItE,eAAO,MAAM,wBAAwB;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;kBAczB,CAAC;AACL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE,eAAO,MAAM,iBAAiB;;;;;;kBAyB1B,CAAC;AACL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,sBAAsB;;;;kBAMxB,CAAC;AACZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,6CAA6C;AAC7C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;kBAMhB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB;;;kBAO3B,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,eAAO,MAAM,wBAAwB;;;iBAInC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,oFAAoF;AACpF,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAS7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/secretProviders.js

@@ -0,0 +1,130 @@
+import { z } from 'zod';
+import { providerBaseUrl } from './common.js';
+// ── Secret managers (0.14) ─────────────────────────────────────────────────
+// Request and response shapes for `/v1/settings/secret-providers`. HashiCorp
+// Vault / OpenBao (KV v2) and AWS Secrets Manager run alongside the existing
+// settings-based Infisical / Doppler provider, which is untouched. Credentials
+// only ever appear in REQUEST shapes; on update an omitted credential field
+// keeps the stored value. The server enforces https (http only with private
+// egress) and proves the settings with a test call. Design: DESIGN.md §4.
+/** Mirrors `secretProviderKind` in `@ninedeploy/db`. */
+export const secretProviderKind = z.enum(['vault', 'aws']);
+// ── Reference grammar pieces (DESIGN §4.1) ─────────────────────────────────
+/**
+ * A Vault path relative to the KV v2 mount: segments of `[A-Za-z0-9_.-]+`
+ * joined by `/`, no leading or trailing `/`, and no `.` or `..` segment.
+ */
+export const VAULT_PATH_RE = /^(?!\.\.?(?:\/|$))[A-Za-z0-9_.-]+(?:\/(?!\.\.?(?:\/|$))[A-Za-z0-9_.-]+)*$/;
+/** A KV v2 field name. */
+export const VAULT_FIELD_RE = /^[A-Za-z0-9_.-]+$/;
+/** An AWS secret name or full ARN. */
+export const AWS_SECRET_ID_RE = /^[A-Za-z0-9/_+=.@:-]{1,2048}$/;
+export const AWS_REGION_RE = /^[a-z]{2}(-gov)?-[a-z]+-\d$/;
+export const AWS_ACCESS_KEY_ID_RE = /^(AKIA|ASIA)[A-Z0-9]{16}$/;
+export const vaultPath = z.string().max(1024).regex(VAULT_PATH_RE, 'invalid Vault path');
+export const awsSecretId = z.string().regex(AWS_SECRET_ID_RE, 'invalid AWS secret id');
+// ── HashiCorp Vault / OpenBao ──────────────────────────────────────────────
+export const vaultAuthMethod = z.enum(['token', 'approle']);
+export const vaultProviderConfig = z
+    .object({
+    address: providerBaseUrl,
+    /** Vault Enterprise / OpenBao namespace (`X-Vault-Namespace`). */
+    namespace: vaultPath.optional(),
+    mount: vaultPath.default('secret'),
+    authMethod: vaultAuthMethod,
+    approleMount: vaultPath.default('approle'),
+})
+    .strict();
+const vaultSecret = z.string().min(1).max(4096);
+export const vaultProviderCredentials = z
+    .object({
+    token: vaultSecret.optional(),
+    roleId: vaultSecret.optional(),
+    secretId: vaultSecret.optional(),
+})
+    .strict();
+/** PUT /v1/settings/secret-providers/vault. */
+export const vaultProviderPut = z
+    .object({
+    enabled: z.boolean().optional(),
+    config: vaultProviderConfig,
+    credentials: vaultProviderCredentials.optional(),
+})
+    .strict()
+    .refine((v) => v.config.authMethod !== 'token' || (v.credentials?.roleId === undefined && v.credentials?.secretId === undefined), {
+    message: 'roleId and secretId belong to authMethod "approle"',
+    path: ['credentials'],
+})
+    .refine((v) => v.config.authMethod !== 'approle' || v.credentials?.token === undefined, {
+    message: 'token belongs to authMethod "token"',
+    path: ['credentials', 'token'],
+});
+// ── AWS Secrets Manager ────────────────────────────────────────────────────
+export const awsProviderConfig = z
+    .object({
+    region: z.string().regex(AWS_REGION_RE, 'invalid AWS region'),
+    /** VPC endpoint or compatible service; https. */
+    endpoint: providerBaseUrl.optional(),
+    roleArn: z
+        .string()
+        .max(2048)
+        .regex(/^arn:aws[a-z-]*:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, 'invalid IAM role ARN')
+        .optional(),
+    externalId: z
+        .string()
+        .min(2)
+        .max(1224)
+        .regex(/^[\w+=,.@:/-]+$/, 'invalid external id')
+        .optional(),
+    roleSessionName: z
+        .string()
+        .regex(/^[\w+=,.@-]{2,64}$/, 'invalid role session name')
+        .default('ninedeploy'),
+})
+    .strict()
+    .refine((v) => v.externalId === undefined || v.roleArn !== undefined, {
+    message: 'externalId needs roleArn',
+    path: ['externalId'],
+});
+export const awsProviderCredentials = z
+    .object({
+    accessKeyId: z.string().regex(AWS_ACCESS_KEY_ID_RE, 'invalid access key id').optional(),
+    secretAccessKey: z.string().min(1).max(256).optional(),
+    sessionToken: z.string().min(1).max(4096).optional(),
+})
+    .strict();
+/** PUT /v1/settings/secret-providers/aws. */
+export const awsProviderPut = z
+    .object({
+    enabled: z.boolean().optional(),
+    config: awsProviderConfig,
+    credentials: awsProviderCredentials.optional(),
+})
+    .strict();
+// ── Test and views ─────────────────────────────────────────────────────────
+/** POST /v1/settings/secret-providers/:kind/test. Both probes are optional. */
+export const secretProviderTestRequest = z
+    .object({
+    /** vault: also read this path (relative to the mount). */
+    probePath: vaultPath.optional(),
+    /** aws: also read this secret. */
+    probeSecretId: awsSecretId.optional(),
+})
+    .strict();
+export const secretProviderTestResult = z.object({
+    ok: z.boolean(),
+    /** Redacted; response bodies cut to 200 characters. */
+    detail: z.string(),
+});
+/** One element of GET /v1/settings/secret-providers. Never carries a credential. */
+export const secretProviderView = z.object({
+    kind: secretProviderKind,
+    configured: z.boolean(),
+    enabled: z.boolean(),
+    /** Non-secret settings; `{}` when unconfigured. */
+    config: z.record(z.string(), z.unknown()),
+    hasCredential: z.boolean(),
+    lastTestedAt: z.string().nullable(),
+    lastTestError: z.string().nullable(),
+});
+//# sourceMappingURL=secretProviders.js.map

package/dist/secretProviders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretProviders.js","sourceRoot":"","sources":["../src/secretProviders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAE1E,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAG3D,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,2EAA2E,CAAC;AACzG,0BAA0B;AAC1B,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAClD,sCAAsC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,6BAA6B,CAAC;AAC3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEhE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;AAEvF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAG5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,eAAe;IACxB,kEAAkE;IAClE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClC,UAAU,EAAE,eAAe;IAC3B,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEhD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,mBAAmB;IAC3B,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,CAAC,EAAE;IAChI,OAAO,EAAE,oDAAoD;IAC7D,IAAI,EAAE,CAAC,aAAa,CAAC;CACtB,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,SAAS,EAAE;IACtF,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;CAC/B,CAAC,CAAC;AAGL,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7D,iDAAiD;IACjD,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,KAAK,CAAC,uDAAuD,EAAE,sBAAsB,CAAC;SACtF,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC;SACT,KAAK,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;SAC/C,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,KAAK,CAAC,oBAAoB,EAAE,2BAA2B,CAAC;SACxD,OAAO,CAAC,YAAY,CAAC;CACzB,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE;IACpE,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,CAAC,YAAY,CAAC;CACrB,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACvF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,iBAAiB;IACzB,WAAW,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,0DAA0D;IAC1D,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC/B,kCAAkC;IAClC,aAAa,EAAE,WAAW,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,uDAAuD;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,kBAAkB;IACxB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,mDAAmD;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC"}

package/dist/secretScan.js

@@ -83,7 +83,7 @@ export const SECRET_PATTERNS = [
     {
         id: 'private-key',
         description: 'PEM private key block',
-        regex: /-----BEGIN [A-Z ]+PRIVATE KEY-----/,
+        regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
     },
     {
         id: 'jwt-bearer',

package/dist/service.d.ts

@@ -11,6 +11,127 @@ export declare const buildPack: z.ZodEnum<{
     railpack: "railpack";
     static: "static";
 }>;
+/**
+ * 0.16.1: names of the service's environment variables a Dockerfile build
+ * receives as `--build-arg` (the Dockerfile reads them with `ARG`). Opt-in per
+ * name: a build gets none unless listed. Nixpacks and Railpack builds already
+ * see the whole environment.
+ */
+export declare const buildArgNames: z.ZodArray<z.ZodString>;
+/**
+ * 0.16.1: capabilities a docker service may add. Deliberately short: the ones
+ * real workloads ask for (VPNs, packet capture, profilers, realtime audio,
+ * mlock). SYS_ADMIN, SYS_MODULE, DAC_READ_SEARCH and the like are left out —
+ * each is a known path out of the container.
+ */
+export declare const runtimeCapability: z.ZodEnum<{
+    IPC_LOCK: "IPC_LOCK";
+    NET_ADMIN: "NET_ADMIN";
+    NET_RAW: "NET_RAW";
+    SYS_NICE: "SYS_NICE";
+    SYS_PTRACE: "SYS_PTRACE";
+    SYS_RESOURCE: "SYS_RESOURCE";
+    SYS_TIME: "SYS_TIME";
+}>;
+/**
+ * 0.16.1 advanced container options for docker services (operator only):
+ * structured fields, never free-form `docker run` flags, so nothing outside
+ * this list (privileged, host mounts, host network…) can be asked for.
+ */
+export declare const runtimeOptions: z.ZodObject<{
+    gpus: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodNumber]>>>;
+    shmSizeMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    init: z.ZodOptional<z.ZodBoolean>;
+    ulimitNofile: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    capAdd: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        IPC_LOCK: "IPC_LOCK";
+        NET_ADMIN: "NET_ADMIN";
+        NET_RAW: "NET_RAW";
+        SYS_NICE: "SYS_NICE";
+        SYS_PTRACE: "SYS_PTRACE";
+        SYS_RESOURCE: "SYS_RESOURCE";
+        SYS_TIME: "SYS_TIME";
+    }>>>;
+}, z.core.$strict>;
+export type RuntimeOptions = z.infer<typeof runtimeOptions>;
+/**
+ * 0.16.1: the most host ports one service may publish through `portMappings`.
+ * Docker starts one userland proxy process per published port and protocol,
+ * so a 10 000-port range costs 10 000 processes on the host.
+ */
+export declare const MAX_MAPPED_PORTS = 1000;
+/** Most port-mapping rules per service. */
+export declare const MAX_PORT_MAPPINGS = 20;
+/**
+ * A literal IPv4 or IPv6 address a port can be bound to (no zone, no CIDR).
+ * The unspecified addresses are refused: an empty IP already means "every
+ * address", and two spellings of it would dodge the overlap check.
+ */
+export declare function isBindableIp(ip: string): boolean;
+/**
+ * 0.16.1 extra host-port mappings of a docker service: one port or a range,
+ * TCP or UDP, on every host address or one dedicated IP
+ * (`docker run -p 203.0.113.7:27015-27030:27015-27030/udp`). The container
+ * range starts at `containerPort` and is as long as the host range.
+ */
+export declare const portMapping: z.ZodObject<{
+    hostIp: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    hostPort: z.ZodNumber;
+    hostPortEnd: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    containerPort: z.ZodNumber;
+    protocol: z.ZodDefault<z.ZodEnum<{
+        tcp: "tcp";
+        udp: "udp";
+    }>>;
+    allowFrom: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+}, z.core.$strict>;
+export type PortMapping = z.infer<typeof portMapping>;
+type PortMappingLike = Pick<PortMapping, 'hostPort' | 'hostPortEnd' | 'containerPort'> & {
+    hostIp?: string | null;
+    protocol?: 'tcp' | 'udp';
+    allowFrom?: readonly string[] | null;
+};
+/** How many host ports a mapping publishes. */
+export declare const mappedPortCount: (m: Pick<PortMapping, 'hostPort' | 'hostPortEnd'>) => number;
+/**
+ * Whether two mappings would bind the same host socket: same protocol,
+ * overlapping ports, and the same IP (or either on every address).
+ */
+export declare function portMappingsOverlap(a: PortMappingLike, b: PortMappingLike): boolean;
+/** Why a list of mappings cannot be published, or null. Shared by the server, the panel and the CLI. */
+export declare function portMappingsProblem(list: readonly PortMappingLike[]): string | null;
+/** The `docker run -p` operand: `27015-27030:27015-27030/udp`, `203.0.113.7:53:53/udp`, `[2001:db8::7]:53:53/udp`. */
+export declare function formatPortMapping(m: PortMappingLike): string;
+/**
+ * Parse `27015-27030:27015/udp`, `8080:80`, `5432@10.0.0.0/8`, `53/udp`, `10000-10100/udp`
+ * (no colon = the same ports inside the container), optionally after an IP:
+ * `203.0.113.7:53/udp`, `[2001:db8::7]:8080:80`. A container range must be as
+ * long as the host range. Returns the mapping, or why the text is not one.
+ */
+export declare function parsePortMapping(text: string): PortMapping | string;
+/** The PATCH field: rules checked together (ranges, overlaps, the port budget). */
+export declare const portMappings: z.ZodArray<z.ZodObject<{
+    hostIp: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    hostPort: z.ZodNumber;
+    hostPortEnd: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    containerPort: z.ZodNumber;
+    protocol: z.ZodDefault<z.ZodEnum<{
+        tcp: "tcp";
+        udp: "udp";
+    }>>;
+    allowFrom: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+}, z.core.$strict>>;
+/**
+ * 0.16.1 deploy healthcheck: `http` probes the container port (an HTTP answer
+ * below 500, then a TCP connect); `running` only waits for the container to
+ * stay up, for services with no HTTP or TCP port to probe (UDP game servers,
+ * VoIP, queue workers).
+ */
+export declare const healthCheckMode: z.ZodEnum<{
+    http: "http";
+    running: "running";
+}>;
+export type HealthCheckMode = z.infer<typeof healthCheckMode>;
 export declare const createService: z.ZodObject<{
     templateId: z.ZodOptional<z.ZodString>;
     tagProjectIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
@@ -63,6 +184,7 @@ export declare const createService: z.ZodObject<{
         preStopCmd: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         restartPolicy: z.ZodOptional<z.ZodString>;
         stopGraceSeconds: z.ZodOptional<z.ZodNumber>;
+        buildArgs: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type CreateService = z.infer<typeof createService>;
@@ -71,9 +193,6 @@ export type CreateService = z.infer<typeof createService>;
  * still applies `.default()` values for absent keys, which would silently
  * rewrite `type` back to 'docker' and `branch` to 'main' on every PATCH. */
 export declare const updateService: z.ZodObject<{
-    tagProjectIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
-    tagWorkspaceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
-    tagLabelIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     name: z.ZodOptional<z.ZodString>;
     slug: z.ZodOptional<z.ZodString>;
     type: z.ZodOptional<z.ZodEnum<{
@@ -95,8 +214,39 @@ export declare const updateService: z.ZodObject<{
     memLimitMb: z.ZodOptional<z.ZodNumber>;
     replicas: z.ZodOptional<z.ZodNumber>;
     healthPath: z.ZodOptional<z.ZodString>;
+    healthTimeoutSeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    healthCheck: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        http: "http";
+        running: "running";
+    }>>>;
+    runtimeOptions: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        gpus: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodNumber]>>>;
+        shmSizeMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        init: z.ZodOptional<z.ZodBoolean>;
+        ulimitNofile: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        capAdd: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            IPC_LOCK: "IPC_LOCK";
+            NET_ADMIN: "NET_ADMIN";
+            NET_RAW: "NET_RAW";
+            SYS_NICE: "SYS_NICE";
+            SYS_PTRACE: "SYS_PTRACE";
+            SYS_RESOURCE: "SYS_RESOURCE";
+            SYS_TIME: "SYS_TIME";
+        }>>>;
+    }, z.core.$strict>>>;
     port: z.ZodOptional<z.ZodNumber>;
     publishedPort: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    portMappings: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        hostIp: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        hostPort: z.ZodNumber;
+        hostPortEnd: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        containerPort: z.ZodNumber;
+        protocol: z.ZodDefault<z.ZodEnum<{
+            tcp: "tcp";
+            udp: "udp";
+        }>>;
+        allowFrom: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    }, z.core.$strict>>>>;
     previewDeploymentsEnabled: z.ZodOptional<z.ZodBoolean>;
     previewAutoDestroyOnClose: z.ZodOptional<z.ZodBoolean>;
     previewDomainPattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -122,6 +272,7 @@ export declare const updateService: z.ZodObject<{
         preStopCmd: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         restartPolicy: z.ZodOptional<z.ZodString>;
         stopGraceSeconds: z.ZodOptional<z.ZodNumber>;
+        buildArgs: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type UpdateService = z.infer<typeof updateService>;
@@ -176,9 +327,40 @@ export declare const service: z.ZodObject<{
     commitSha: z.ZodNullable<z.ZodString>;
     runtimeId: z.ZodNullable<z.ZodString>;
     healthPath: z.ZodString;
+    healthTimeoutSeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    healthCheck: z.ZodOptional<z.ZodEnum<{
+        http: "http";
+        running: "running";
+    }>>;
+    runtimeOptions: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        gpus: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodNumber]>>>;
+        shmSizeMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        init: z.ZodOptional<z.ZodBoolean>;
+        ulimitNofile: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        capAdd: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            IPC_LOCK: "IPC_LOCK";
+            NET_ADMIN: "NET_ADMIN";
+            NET_RAW: "NET_RAW";
+            SYS_NICE: "SYS_NICE";
+            SYS_PTRACE: "SYS_PTRACE";
+            SYS_RESOURCE: "SYS_RESOURCE";
+            SYS_TIME: "SYS_TIME";
+        }>>>;
+    }, z.core.$strict>>>;
     autoUrl: z.ZodNullable<z.ZodString>;
     port: z.ZodNullable<z.ZodNumber>;
     publishedPort: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    portMappings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        hostIp: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        hostPort: z.ZodNumber;
+        hostPortEnd: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        containerPort: z.ZodNumber;
+        protocol: z.ZodDefault<z.ZodEnum<{
+            tcp: "tcp";
+            udp: "udp";
+        }>>;
+        allowFrom: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    }, z.core.$strict>>>;
     cpuShares: z.ZodNumber;
     cpuLimitMilli: z.ZodNumber;
     memLimitMb: z.ZodNumber;
@@ -211,11 +393,14 @@ export declare const service: z.ZodObject<{
         preStopCmd: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         restartPolicy: z.ZodString;
         stopGraceSeconds: z.ZodNumber;
+        buildArgs: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, z.core.$strip>;
 export type Service = z.infer<typeof service>;
+/** r512: a registry host a `registry` credential may be sent to (`ghcr.io`, `registry.local:5000`). */
+export declare const registryHost: z.ZodString;
 export declare const createSource: z.ZodObject<{
     name: z.ZodString;
     type: z.ZodEnum<{
@@ -229,7 +414,9 @@ export declare const createSource: z.ZodObject<{
     token: z.ZodOptional<z.ZodString>;
     deployKey: z.ZodOptional<z.ZodString>;
     registryUsername: z.ZodOptional<z.ZodString>;
+    registryHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     defaultBranch: z.ZodOptional<z.ZodString>;
+    baseUrl: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>>;
 }, z.core.$strip>;
 export type CreateSourceInput = z.input<typeof createSource>;
 export declare const source: z.ZodObject<{
@@ -239,7 +426,16 @@ export declare const source: z.ZodObject<{
     hasToken: z.ZodBoolean;
     hasDeployKey: z.ZodBoolean;
     registryUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    registryHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     defaultBranch: z.ZodNullable<z.ZodString>;
+    baseUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    allowOnNodes: z.ZodOptional<z.ZodBoolean>;
+    pinHostKeys: z.ZodOptional<z.ZodBoolean>;
+    pinnedHostKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        host: z.ZodString;
+        type: z.ZodString;
+        fingerprint: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>>;
     createdAt: z.ZodString;
     updatedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -334,6 +530,20 @@ export declare const createDomain: z.ZodObject<{
     rateLimitBurst: z.ZodNullable<z.ZodOptional<z.ZodNumber>>;
 }, z.core.$strip>;
 export type CreateDomainInput = z.input<typeof createDomain>;
+/**
+ * Why a redirect regex cannot go to Traefik, or null. Traefik compiles it
+ * with Go's RE2, which has no lookaround and no backreferences — and a regex
+ * Traefik refuses takes the whole dynamic config file down with it, so these
+ * are refused when saved. The rest is checked by compiling it here.
+ */
+export declare function redirectRegexProblem(regex: string): string | null;
+/** 0.16.1 one redirect rule of a domain (Dokploy's "Redirects"): Traefik `redirectRegex`. */
+export declare const redirectRule: z.ZodObject<{
+    regex: z.ZodString;
+    replacement: z.ZodString;
+    permanent: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type RedirectRule = z.infer<typeof redirectRule>;
 /** PATCHable routing extras for an existing domain. */
 export declare const domainPatch: z.ZodObject<{
     ssl: z.ZodOptional<z.ZodBoolean>;
@@ -343,6 +553,11 @@ export declare const domainPatch: z.ZodObject<{
     ipAllowlist: z.ZodNullable<z.ZodOptional<z.ZodString>>;
     rateLimitAverage: z.ZodNullable<z.ZodOptional<z.ZodNumber>>;
     rateLimitBurst: z.ZodNullable<z.ZodOptional<z.ZodNumber>>;
+    redirects: z.ZodNullable<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        regex: z.ZodString;
+        replacement: z.ZodString;
+        permanent: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>>>;
 }, z.core.$strip>;
 export type DomainPatch = z.input<typeof domainPatch>;
 export declare const domain: z.ZodObject<{
@@ -357,16 +572,16 @@ export declare const domain: z.ZodObject<{
     ipAllowlist: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     rateLimitAverage: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     rateLimitBurst: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    redirects: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        regex: z.ZodString;
+        replacement: z.ZodString;
+        permanent: z.ZodBoolean;
+    }, z.core.$strip>>>;
     status: z.ZodString;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, z.core.$strip>;
 export type Domain = z.infer<typeof domain>;
-export declare const createWebhook: z.ZodObject<{
-    branch: z.ZodOptional<z.ZodString>;
-    watchPaths: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type CreateWebhookInput = z.input<typeof createWebhook>;
 export declare const webhook: z.ZodObject<{
     id: z.ZodNumber;
     branch: z.ZodString;
@@ -377,15 +592,17 @@ export declare const webhook: z.ZodObject<{
     createdAt: z.ZodString;
 }, z.core.$strip>;
 export type Webhook = z.infer<typeof webhook>;
-/** Returned once at creation time — the secret is never retrievable again. */
+/**
+ * Returned once at creation time — the secret is never retrievable again.
+ * r334: the create route answers id/branch/active/sourceId/url/secret only;
+ * `watchPaths` and `createdAt` come from `webhooks.list`.
+ */
 export declare const createdWebhook: z.ZodObject<{
     id: z.ZodNumber;
     branch: z.ZodString;
     active: z.ZodBoolean;
-    watchPaths: z.ZodString;
     sourceId: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     url: z.ZodString;
-    createdAt: z.ZodString;
     secret: z.ZodString;
 }, z.core.$strip>;
 export type CreatedWebhook = z.infer<typeof createdWebhook>;
@@ -393,6 +610,8 @@ export declare const createDatabase: z.ZodObject<{
     name: z.ZodString;
     engine: z.ZodEnum<{
         clickhouse: "clickhouse";
+        dragonfly: "dragonfly";
+        keydb: "keydb";
         mariadb: "mariadb";
         meilisearch: "meilisearch";
         mongo: "mongo";
@@ -408,14 +627,9 @@ export declare const createDatabase: z.ZodObject<{
     existingVolume: z.ZodOptional<z.ZodString>;
     extensions: z.ZodOptional<z.ZodArray<z.ZodString>>;
     webGuiEnabled: z.ZodOptional<z.ZodBoolean>;
+    serverId: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
 }, z.core.$strip>;
 export type CreateDatabaseInput = z.input<typeof createDatabase>;
-export declare const databasePatch: z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
-    extensions: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    webGuiEnabled: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-export type DatabasePatch = z.input<typeof databasePatch>;
 export declare const managedDatabase: z.ZodObject<{
     id: z.ZodNumber;
     projectId: z.ZodNullable<z.ZodNumber>;
@@ -437,6 +651,9 @@ export declare const managedDatabase: z.ZodObject<{
         name: z.ZodString;
         slug: z.ZodString;
     }, z.core.$strip>>>>;
+    serverId: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    serverName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    reachable: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, z.core.$strip>;
@@ -1142,4 +1359,5 @@ export declare const autoPruneRunResult: z.ZodObject<{
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type AutoPruneRunResult = z.infer<typeof autoPruneRunResult>;
+export {};
 //# sourceMappingURL=service.d.ts.map