deleting a secret provider warns which stacks it unbinds

src/lib/server/db.ts

@@ -354,6 +354,20 @@ export async function getSecretProviderById(id: number): Promise<SecretProviderW
 	};
 }
 
+/** Lightweight existence check (no config decrypt), for validating a bound provider id. */
+export async function secretProviderExists(id: number): Promise<boolean> {
+	const rows = await db.select({ id: secretProviders.id }).from(secretProviders).where(eq(secretProviders.id, id));
+	return rows.length > 0;
+}
+
+/** Stacks currently bound to a secret provider, so a delete can warn which ones lose it. */
+export async function getStacksUsingSecretProvider(id: number): Promise<Array<{ stackName: string; environmentId: number | null }>> {
+	return db
+		.select({ stackName: stackSources.stackName, environmentId: stackSources.environmentId })
+		.from(stackSources)
+		.where(eq(stackSources.secretProviderId, id));
+}
+
 export async function createSecretProvider(data: {
 	type: SecretProviderType;
 	name: string;

src/lib/server/git-deploy-policy.ts

@@ -0,0 +1,33 @@
+/**
+ * Pure git-stack deploy decisions, extracted so they are unit-testable without the
+ * I/O-heavy deployGitStack. A manual/one-off deploy (`force`) deploys but does NOT
+ * force-recreate, so only shouldDeployGitStack takes it.
+ */
+
+/**
+ * Whether to deploy at all. A manual/one-off deploy (`force`) or a real git change
+ * always deploys; the "always redeploy on webhook/scheduled sync" setting forces a
+ * deploy even when git reported no changes.
+ */
+export function shouldDeployGitStack(input: {
+	force: boolean;
+	forceRedeploy: boolean;
+	gitUpdated: boolean;
+}): boolean {
+	return input.force || input.forceRedeploy || input.gitUpdated;
+}
+
+/**
+ * Whether to pass `--force-recreate`. Recreate on a real git change OR when the user
+ * enabled "always redeploy": that setting exists to force the container back in step
+ * with its configuration (a changed env var, secret, or rebound provider leaves no git
+ * diff), and a plain `up` without --force-recreate would no-op and never re-inject the
+ * shell-env secrets (#1523). Default (setting off, no git change) does NOT recreate, so
+ * an ordinary sync never causes a surprise recreate.
+ */
+export function shouldForceRecreateGitStack(input: {
+	forceRedeploy: boolean;
+	gitUpdated: boolean;
+}): boolean {
+	return input.gitUpdated || input.forceRedeploy;
+}