@geekmidas/cli 10.0.0-alpha.10 → 10.0.0-alpha.11

package/dist/index.mjs

@@ -1,21 +1,22 @@
 #!/usr/bin/env -S npx tsx
 import { __require } from "./chunk-Duj1WY3L.mjs";
 import { ConstructGenerator, DEFAULT_CACHE, discover, isPartitionedRoutes } from "./discover-CAlFgYec.mjs";
-import { derivedApps, getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig } from "./config-DVVph9yz.mjs";
-import { allConstructGlobs, assertDeployedStage, deployedProblems, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getPublicEnvPrefix, isDeployTargetSupported, stageProblems, stripPublicPrefix } from "./workspace-zoqRbihZ.mjs";
+import { derivedApps, getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig } from "./config-B0L2tvvC.mjs";
+import { InvalidStages, allConstructGlobs, assertDeployedStage, deployedProblems, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getPublicEnvPrefix, isDeployTargetSupported, stageProblems, stripPublicPrefix } from "./workspace-DaEX7FEg.mjs";
 import { getCredentialsPath, getDokployCredentials, getDokployRegistryId, getDokployToken, removeDokployCredentials, storeDokployCredentials, storeDokployRegistryId, storeHostingerToken } from "./credentials-B5zRHdAl.mjs";
-import { applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs } from "./credentials-dP8vRVRv.mjs";
+import { applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs } from "./credentials-CZrys9C5.mjs";
 import { createStageSecrets, rotateServicePassword } from "./generator-VE2JrFlY.mjs";
-import { getKeyPath, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-Bi24WfoW.mjs";
-import { EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, generateOpenApiFrom, normalizeRoutes, openapiCommand, resolveOpenApiConfig, runtimeFor } from "./openapi-Xx0A7Wg0.mjs";
-import { withCompute, withRoutes } from "./emit-CiZS_5Ub.mjs";
-import { DokployApi } from "./dokploy-api-aTFPz7_4.mjs";
-import { encryptSecrets } from "./encryption-D-abyhZx.mjs";
-import { CachedStateProvider } from "./CachedStateProvider-DTniehMP.mjs";
-import { generateDbPassword, generateDbUrl, generateFullstackCustomSecrets } from "./fullstack-secrets-D1o9-G5l.mjs";
-import { generateReactQueryCommand } from "./openapi-react-query-Byltvm_7.mjs";
-import "./sync-CmEuNZsB.mjs";
-import { setupCommand, trustCommand } from "./setup-C8KOx8_8.mjs";
+import { getKeyPath } from "./keystore-TxeYM7an.mjs";
+import { maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-B020InPW.mjs";
+import { EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, generateOpenApiFrom, normalizeRoutes, openapiCommand, resolveOpenApiConfig, runtimeFor } from "./openapi-y1d7Kalt.mjs";
+import { withCompute, withRoutes } from "./emit-CIlvnDvV.mjs";
+import { DokployApi } from "./dokploy-api-pdaBryoY.mjs";
+import { encryptSecrets } from "./encryption-_4zwjOAR.mjs";
+import { CachedStateProvider } from "./CachedStateProvider-Co4n5Wvs.mjs";
+import { generateDbPassword, generateDbUrl, generateFullstackCustomSecrets } from "./fullstack-secrets-METaRLS1.mjs";
+import { generateReactQueryCommand } from "./openapi-react-query-DoR5CmzQ.mjs";
+import "./sync-CzHXiR9c.mjs";
+import { setupCommand, trustCommand } from "./setup-DQo_h_yK.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
@@ -43,7 +44,7 @@ import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "10.0.0-alpha.10";
+var version = "10.0.0-alpha.11";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -188,7 +189,7 @@ const logger$11 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi: DokployApi$1 } = await import("./dokploy-api-BS2xnJLZ.mjs");
+	const { DokployApi: DokployApi$1 } = await import("./dokploy-api-D2Ny4Jrc.mjs");
 	const api = new DokployApi$1({
 		baseUrl: endpoint,
 		token
@@ -2639,7 +2640,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$7.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-Be8Zg4Wd.mjs");
+			const { bundleServer } = await import("./bundler-S3ek7ea-.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3592,11 +3593,11 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-Cft7lEYr.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-BcyFRbqV.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
-		const { Route53Provider } = await import("./Route53Provider-RdpUDJQk.mjs");
+		const { Route53Provider } = await import("./Route53Provider-C0xmer8U.mjs");
 		const route53Config = config;
 		return new Route53Provider({
 			region: route53Config.region,
@@ -5923,20 +5924,20 @@ function isStateProvider(value) {
 async function createStateProvider(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config) {
-		const { LocalStateProvider } = await import("./LocalStateProvider-Bn6tS-oL.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Bq-0C0sg.mjs");
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (isStateProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "local") {
-		const { LocalStateProvider } = await import("./LocalStateProvider-Bn6tS-oL.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Bq-0C0sg.mjs");
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
 		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
-		const { LocalStateProvider } = await import("./LocalStateProvider-Bn6tS-oL.mjs");
-		const { SSMStateProvider } = await import("./SSMStateProvider-BRt2py-A.mjs");
-		const { CachedStateProvider: CachedStateProvider$1 } = await import("./CachedStateProvider-BxoAm-B2.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Bq-0C0sg.mjs");
+		const { SSMStateProvider } = await import("./SSMStateProvider-DOZifZfE.mjs");
+		const { CachedStateProvider: CachedStateProvider$1 } = await import("./CachedStateProvider-C-8wtlto.mjs");
 		const ssmConfig = config;
 		const local = new LocalStateProvider(workspaceRoot);
 		const ssm = SSMStateProvider.create({
@@ -6812,7 +6813,7 @@ async function workspaceDeployCommand(configured, options) {
 	const backupCluster = Object.values(declaredClusters)[0];
 	if (workspace.deploy?.backups && backupCluster) {
 		logger$3.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await import("./backup-provisioner-Bgj5Vi_L.mjs");
+		const { provisionBackupDestination } = await import("./backup-provisioner-DXXg6FIL.mjs");
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -8026,26 +8027,26 @@ const CLI_VERSION = `~${pkg.version}`;
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.10",
-	"@geekmidas/auth": "~10.0.0-alpha.10",
-	"@geekmidas/cache": "~10.0.0-alpha.10",
-	"@geekmidas/client": "~10.0.0-alpha.10",
-	"@geekmidas/cloud": "~10.0.0-alpha.10",
-	"@geekmidas/constructs": "~10.0.0-alpha.10",
-	"@geekmidas/db": "~10.0.0-alpha.10",
-	"@geekmidas/emailkit": "~10.0.0-alpha.10",
-	"@geekmidas/envkit": "~10.0.0-alpha.10",
-	"@geekmidas/errors": "~10.0.0-alpha.10",
-	"@geekmidas/events": "~10.0.0-alpha.10",
-	"@geekmidas/logger": "~10.0.0-alpha.10",
-	"@geekmidas/manifest": "~10.0.0-alpha.10",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.10",
-	"@geekmidas/schema": "~10.0.0-alpha.10",
-	"@geekmidas/services": "~10.0.0-alpha.10",
-	"@geekmidas/storage": "~10.0.0-alpha.10",
-	"@geekmidas/studio": "~10.0.0-alpha.10",
-	"@geekmidas/telescope": "~10.0.0-alpha.10",
-	"@geekmidas/testkit": "~10.0.0-alpha.10",
+	"@geekmidas/audit": "~10.0.0-alpha.11",
+	"@geekmidas/auth": "~10.0.0-alpha.11",
+	"@geekmidas/cache": "~10.0.0-alpha.11",
+	"@geekmidas/client": "~10.0.0-alpha.11",
+	"@geekmidas/cloud": "~10.0.0-alpha.11",
+	"@geekmidas/constructs": "~10.0.0-alpha.11",
+	"@geekmidas/db": "~10.0.0-alpha.11",
+	"@geekmidas/emailkit": "~10.0.0-alpha.11",
+	"@geekmidas/envkit": "~10.0.0-alpha.11",
+	"@geekmidas/errors": "~10.0.0-alpha.11",
+	"@geekmidas/events": "~10.0.0-alpha.11",
+	"@geekmidas/logger": "~10.0.0-alpha.11",
+	"@geekmidas/manifest": "~10.0.0-alpha.11",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.11",
+	"@geekmidas/schema": "~10.0.0-alpha.11",
+	"@geekmidas/services": "~10.0.0-alpha.11",
+	"@geekmidas/storage": "~10.0.0-alpha.11",
+	"@geekmidas/studio": "~10.0.0-alpha.11",
+	"@geekmidas/telescope": "~10.0.0-alpha.11",
+	"@geekmidas/testkit": "~10.0.0-alpha.11",
 	"@geekmidas/cli": CLI_VERSION
 };
 
@@ -9842,7 +9843,7 @@ function deployPackage(options) {
 }
 function generateDeployFiles(options) {
 	if (options.deployTarget !== "sst") return [];
-	if (!options.region) throw new Error("An SST deploy needs a region.");
+	if (!options.region) throw new SstNeedsRegion();
 	const db = databaseFor();
 	const mail = emailFor();
 	const hasDatabase = options.template === "fullstack" || options.services.db;
@@ -9910,6 +9911,16 @@ ${inputs.join("\n")}
 `
 	}];
 }
+/**
+* An SST scaffold asked for without a region. `init` always resolves one —
+* asked, `--region`, or eu-west-1 under `--yes` — so this is a caller's bug.
+*/
+var SstNeedsRegion = class extends Error {
+	constructor() {
+		super("An SST deploy needs a region: pass --region, e.g. eu-west-1.");
+		this.name = "SstNeedsRegion";
+	}
+};
 
 //#endregion
 //#region src/init/generators/monorepo.ts
@@ -14091,8 +14102,8 @@ const AWS_REGION = /^[a-z]{2}(-gov)?-[a-z]+-\d$/;
 async function initCommand(projectName, options = {}) {
 	const cwd = process.cwd();
 	const detectedPkgManager = detectPackageManager(cwd);
-	if (options.deploy && !deployTargetChoices.some((choice) => choice.value === options.deploy)) throw new Error(`Unknown deploy target "${options.deploy}". Use ${deployTargetChoices.map((c) => c.value).join(", ")}.`);
-	if (options.region && !AWS_REGION.test(options.region)) throw new Error(`"${options.region}" is not an AWS region. Use one like eu-west-1.`);
+	if (options.deploy && !deployTargetChoices.some((choice) => choice.value === options.deploy)) throw new UnknownDeployTarget(options.deploy, deployTargetChoices.map((c) => c.value));
+	if (options.region && !AWS_REGION.test(options.region)) throw new NotAnAwsRegion(options.region);
 	if (options.stages || options.localStage || options.protectedStage) {
 		const deployed = stageList(options.stages ?? "");
 		const problems = [
@@ -14103,7 +14114,7 @@ async function initCommand(projectName, options = {}) {
 			}) : [],
 			...options.protectedStage && !deployed.includes(options.protectedStage) ? [`--protected-stage "${options.protectedStage}" is not in --stages`] : []
 		];
-		if (problems.length) throw new Error([...new Set(problems)].join("\n"));
+		if (problems.length) throw new InvalidStages([...new Set(problems)]);
 	}
 	let deployedSoFar = [];
 	prompts.override({});
@@ -14511,9 +14522,26 @@ function resolveStages(options, answers) {
 		...kept ? { protected: [kept] } : {}
 	};
 	const problems = stageProblems(stages);
-	if (problems.length) throw new Error(problems.join("\n"));
+	if (problems.length) throw new InvalidStages(problems);
 	return stages;
 }
+/** `--deploy` naming a target init has no scaffold for. */
+var UnknownDeployTarget = class extends Error {
+	constructor(target, known) {
+		super(`Unknown deploy target "${target}". Use ${known.join(", ")}.`);
+		this.target = target;
+		this.known = known;
+		this.name = "UnknownDeployTarget";
+	}
+};
+/** `--region` that is not shaped like one, e.g. `europe` for `eu-west-1`. */
+var NotAnAwsRegion = class extends Error {
+	constructor(region) {
+		super(`"${region}" is not an AWS region. Use one like eu-west-1.`);
+		this.region = region;
+		this.name = "NotAnAwsRegion";
+	}
+};
 
 //#endregion
 //#region src/secrets/index.ts
@@ -14726,11 +14754,11 @@ function maskUrl(url) {
 async function testCommand(options = {}) {
 	const cwd = process.cwd();
 	const stage = options.stage ?? await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.stages.local).catch(() => void 0);
-	if (!stage) throw new Error("No stage to test with: add `stages` to gkm.config.ts, or pass --stage.");
+	if (!stage) throw new NoStageToTest();
 	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
 	const autoSetup = options.autoSetup || Boolean(process.env.GKM_AUTO_SETUP);
 	if (autoSetup) {
-		const { ensureStageSecrets } = await import("./setup-BA8ciTPU.mjs");
+		const { ensureStageSecrets } = await import("./setup-BWgMs4gg.mjs");
 		const generated = await ensureStageSecrets(stage, cwd);
 		if (generated) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
 	}
@@ -14817,6 +14845,13 @@ function rewriteDatabaseUrlForTests(env) {
 	}
 	return result;
 }
+/** `gkm test` outside a project that declares stages, with none named. */
+var NoStageToTest = class extends Error {
+	constructor() {
+		super("No stage to test with: add `stages` to gkm.config.ts, or pass --stage.");
+		this.name = "NoStageToTest";
+	}
+};
 
 //#endregion
 //#region src/upgrade/version.ts
@@ -15359,13 +15394,13 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { pushSecrets } = await import("./sync-hOqAWHR6.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-CFs8C_1a.mjs");
-		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-CYlGwWTj.mjs");
+		const { pushSecrets } = await import("./sync-HAau6h_R.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-C13ERt1U.mjs");
+		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-DGBzMLZa.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
 		if (secrets) {
-			const { derivedContainers: derivedContainers$1 } = await import("./workspace-BzrG_2SI.mjs");
+			const { derivedContainers: derivedContainers$1 } = await import("./workspace-DbI580qS.mjs");
 			const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 			if (result) {
 				await writeStageSecrets$1(result.secrets, workspace.root);
@@ -15385,16 +15420,16 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { pullSecrets } = await import("./sync-hOqAWHR6.mjs");
-		const { writeStageSecrets: writeStageSecrets$1 } = await import("./storage-CYlGwWTj.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-CFs8C_1a.mjs");
+		const { pullSecrets } = await import("./sync-HAau6h_R.mjs");
+		const { writeStageSecrets: writeStageSecrets$1 } = await import("./storage-DGBzMLZa.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-C13ERt1U.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		let secrets = await pullSecrets(options.stage, workspace);
 		if (!secrets) {
 			console.error(`No remote secrets found for stage "${options.stage}".`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await import("./workspace-BzrG_2SI.mjs");
+		const { derivedContainers: derivedContainers$1 } = await import("./workspace-DbI580qS.mjs");
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 		if (result) {
 			secrets = result.secrets;
@@ -15413,8 +15448,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-CFs8C_1a.mjs");
-		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-CYlGwWTj.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-C13ERt1U.mjs");
+		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-DGBzMLZa.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		const stage = options.stage ?? workspace.stages.local;
 		const secrets = await readStageSecrets$1(stage, workspace.root);
@@ -15422,7 +15457,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await import("./workspace-BzrG_2SI.mjs");
+		const { derivedContainers: derivedContainers$1 } = await import("./workspace-DbI580qS.mjs");
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -15477,6 +15512,17 @@ program.command("deploy:init").description("Initialize Dokploy deployment (creat
 		process.exit(1);
 	}
 });
+program.command("deploy:github").description("Let GitHub Actions deploy a stage: OIDC role in the stage's AWS account, and the GitHub environment the deploy workflow uses").requiredOption("--stage <stage>", "A deployed stage from gkm.config.ts").option("--profile <profile>", "AWS profile for the stage's account").option("--repo <owner/name>", "GitHub repository (default: this one)").option("--policy-arn <arn>", "Policy for the deploy role (default: AdministratorAccess)").option("--dry-run", "Show the plan without changing AWS or GitHub").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { deployGithubCommand } = await import("./github-CrpsXSfV.mjs");
+		await deployGithubCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("deploy:list").description("List Dokploy resources (projects, registries)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").option("--projects", "List projects").option("--registries", "List registries").action(async (options) => {
 	try {
 		const globalOptions = program.opts();