@geekmidas/cli 10.0.0-alpha.10 → 10.0.0-alpha.11

package/dist/github-CrpsXSfV.mjs

@@ -0,0 +1,196 @@
+import "./discover-CAlFgYec.mjs";
+import { loadWorkspaceConfig } from "./config-B0L2tvvC.mjs";
+import { assertDeployedStage } from "./workspace-DaEX7FEg.mjs";
+import { getKeyPath } from "./keystore-TxeYM7an.mjs";
+import { existsSync, readFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { AttachRolePolicyCommand, CreateOpenIDConnectProviderCommand, CreateRoleCommand, GetRoleCommand, IAMClient, ListOpenIDConnectProvidersCommand, UpdateAssumeRolePolicyCommand } from "@aws-sdk/client-iam";
+
+//#region src/deploy/github.ts
+const logger = console;
+const GITHUB_OIDC_HOST = "token.actions.githubusercontent.com";
+const AUDIENCE = "sts.amazonaws.com";
+/**
+* What SST needs to create a stack is most of AWS, so this is the default —
+* said out loud in the output, and replaceable with `--policy-arn`.
+*/
+const DEFAULT_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess";
+const defaultGh = (args, input) => execFileSync("gh", args, {
+	encoding: "utf-8",
+	...input === void 0 ? {} : {
+		input,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	}
+}).trim();
+/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */
+function roleName(project, stage) {
+	return `${project}-github-${stage}`.toLowerCase().replace(/[^a-z0-9+=,.@_-]/g, "-").slice(0, 64);
+}
+/**
+* Who may assume the role: a workflow job running in this repository's
+* `<stage>` environment, and nothing else — not another branch's job, not
+* another environment's. That is what keeps a staging deploy from using the
+* production role.
+*/
+function trustPolicy(providerArn, repo, stage) {
+	return JSON.stringify({
+		Version: "2012-10-17",
+		Statement: [{
+			Effect: "Allow",
+			Principal: { Federated: providerArn },
+			Action: "sts:AssumeRoleWithWebIdentity",
+			Condition: { StringEquals: {
+				[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,
+				[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`
+			} }
+		}]
+	});
+}
+/** GitHub's OIDC provider in this account, created if it is not there. */
+async function ensureOidcProvider(iam) {
+	const { OpenIDConnectProviderList = [] } = await iam.send(new ListOpenIDConnectProvidersCommand({}));
+	const existing = OpenIDConnectProviderList.find((p) => p.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`))?.Arn;
+	if (existing) return existing;
+	const created = await iam.send(new CreateOpenIDConnectProviderCommand({
+		Url: `https://${GITHUB_OIDC_HOST}`,
+		ClientIDList: [AUDIENCE]
+	}));
+	return created.OpenIDConnectProviderArn;
+}
+/** The deploy role, created or brought back to this trust and policy. */
+async function ensureRole(iam, name, trust, policyArn) {
+	let arn;
+	try {
+		const { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));
+		await iam.send(new UpdateAssumeRolePolicyCommand({
+			RoleName: name,
+			PolicyDocument: trust
+		}));
+		arn = Role.Arn;
+	} catch (error) {
+		if (error.name !== "NoSuchEntityException") throw error;
+		const { Role } = await iam.send(new CreateRoleCommand({
+			RoleName: name,
+			AssumeRolePolicyDocument: trust,
+			Description: "Deploys from GitHub Actions (gkm deploy:github)",
+			MaxSessionDuration: 3600 * 2
+		}));
+		arn = Role.Arn;
+	}
+	await iam.send(new AttachRolePolicyCommand({
+		RoleName: name,
+		PolicyArn: policyArn
+	}));
+	return arn;
+}
+/**
+* An IAM client for the stage's account.
+*
+* `fromIni` for a named profile, deliberately: it resolves exactly that
+* profile — keys, assume-role, `credential_process` or SSO, whichever
+* ~/.aws/config says — and never falls back to AWS_* in the environment. The
+* provider chain checks the environment first, so exported staging keys would
+* quietly win over `--profile prod` and the production role would land in the
+* staging account.
+*/
+async function iamFor(profile, endpoint) {
+	const config = { region: "us-east-1" };
+	if (profile) {
+		const { fromIni } = await import("@aws-sdk/credential-providers");
+		config.credentials = fromIni({ profile });
+	}
+	if (endpoint) {
+		config.endpoint = endpoint;
+		config.credentials = {
+			accessKeyId: "test",
+			secretAccessKey: "test"
+		};
+	}
+	return new IAMClient(config);
+}
+async function deployGithubCommand(options, deps = {}) {
+	const gh = deps.gh ?? defaultGh;
+	const { workspace } = await loadWorkspaceConfig(deps.cwd);
+	assertDeployedStage(workspace.stages, options.stage);
+	const repo = options.repo ?? gh([
+		"repo",
+		"view",
+		"--json",
+		"nameWithOwner",
+		"-q",
+		".nameWithOwner"
+	]);
+	const role = roleName(workspace.name, options.stage);
+	const policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;
+	const keyPath = getKeyPath(options.stage, workspace.name);
+	const hasKey = existsSync(keyPath);
+	logger.log(`\n🔐 GitHub → AWS for stage "${options.stage}"\n`);
+	logger.log(`  Repository:   ${repo}`);
+	logger.log(`  AWS profile:  ${options.profile ?? "(default credentials)"}`);
+	logger.log(`  Role:         ${role}`);
+	logger.log(`  Policy:       ${policyArn}${options.policyArn ? "" : "  (default; --policy-arn to narrow)"}`);
+	logger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);
+	logger.log(`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`);
+	if (options.dryRun) {
+		logger.log("\n  --dry-run: nothing changed.\n");
+		return { repo };
+	}
+	const iam = deps.iam ?? await iamFor(options.profile);
+	const providerArn = await ensureOidcProvider(iam).catch((error) => {
+		if (/SSO session/i.test(String(error?.message)) && options.profile) throw new SsoSessionExpired(options.profile);
+		throw error;
+	});
+	const roleArn = await ensureRole(iam, role, trustPolicy(providerArn, repo, options.stage), policyArn);
+	logger.log(`\n  ✓ AWS: ${roleArn}`);
+	gh([
+		"api",
+		"--method",
+		"PUT",
+		`repos/${repo}/environments/${options.stage}`
+	]);
+	gh([
+		"variable",
+		"set",
+		"AWS_ROLE_ARN",
+		"--env",
+		options.stage,
+		"--repo",
+		repo,
+		"--body",
+		roleArn
+	]);
+	logger.log(`  ✓ GitHub: environment "${options.stage}", AWS_ROLE_ARN`);
+	if (hasKey) {
+		gh([
+			"secret",
+			"set",
+			"GKM_SECRETS_KEY",
+			"--env",
+			options.stage,
+			"--repo",
+			repo
+		], readFileSync(keyPath, "utf-8").trim());
+		logger.log("  ✓ GitHub: GKM_SECRETS_KEY");
+	} else logger.log(`  ⚠ No secrets key for "${options.stage}"; run gkm secrets:init --stage ${options.stage}, then this again.`);
+	logger.log(`\n  Protect it: add required reviewers to the "${options.stage}" environment in the repository settings.\n`);
+	return {
+		roleArn,
+		repo
+	};
+}
+/** The profile's SSO login has lapsed; the fix is one command away. */
+var SsoSessionExpired = class extends Error {
+	constructor(profile) {
+		super(`The SSO session for profile "${profile}" has expired or is invalid. Run: aws sso login --profile ${profile}`);
+		this.profile = profile;
+		this.name = "SsoSessionExpired";
+	}
+};
+
+//#endregion
+export { deployGithubCommand };
+//# sourceMappingURL=github-CrpsXSfV.mjs.map

package/dist/github-CrpsXSfV.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-CrpsXSfV.mjs","names":["defaultGh: Gh","project: string","stage: string","providerArn: string","repo: string","iam: IAMClient","name: string","trust: string","policyArn: string","arn: string","profile?: string","endpoint?: string","config: IAMClientConfig","options: DeployGithubOptions","deps: { iam?: IAMClient; gh?: Gh; cwd?: string }","profile: string"],"sources":["../src/deploy/github.ts"],"sourcesContent":["/**\n * `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.\n *\n * A stage usually lives in its own AWS account — staging in one, production in\n * another — so this runs once per stage, with that account's profile:\n *\n *   gkm deploy:github --stage staging --profile acme-dev\n *   gkm deploy:github --stage prod    --profile acme-prod\n *\n * In the stage's account it makes sure GitHub's OIDC provider exists, and a\n * role that only this repository's `<stage>` environment can assume. On\n * GitHub it creates that environment and gives it what the generated deploy\n * workflow reads: `AWS_ROLE_ARN`, and the stage's secrets key as\n * `GKM_SECRETS_KEY`. Re-running it converges rather than duplicating.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport {\n\tAttachRolePolicyCommand,\n\tCreateOpenIDConnectProviderCommand,\n\tCreateRoleCommand,\n\tGetRoleCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tListOpenIDConnectProvidersCommand,\n\tUpdateAssumeRolePolicyCommand,\n} from '@aws-sdk/client-iam';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { getKeyPath } from '../secrets/keystore.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\n\nconst logger = console;\n\nconst GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';\nconst AUDIENCE = 'sts.amazonaws.com';\n\n/**\n * What SST needs to create a stack is most of AWS, so this is the default —\n * said out loud in the output, and replaceable with `--policy-arn`.\n */\nexport const DEFAULT_POLICY_ARN = 'arn:aws:iam::aws:policy/AdministratorAccess';\n\nexport interface DeployGithubOptions {\n\tstage: string;\n\t/** The AWS profile for the stage's account. */\n\tprofile?: string;\n\t/** `owner/name`; defaults to the repository `gh` sees here. */\n\trepo?: string;\n\t/** The policy the deploy role gets. */\n\tpolicyArn?: string;\n\tdryRun?: boolean;\n}\n\n/** Runs `gh` with the given arguments and optional stdin, returning stdout. */\nexport type Gh = (args: string[], input?: string) => string;\n\nconst defaultGh: Gh = (args, input) =>\n\texecFileSync('gh', args, {\n\t\tencoding: 'utf-8',\n\t\t...(input === undefined\n\t\t\t? {}\n\t\t\t: { input, stdio: ['pipe', 'pipe', 'pipe'] as const }),\n\t}).trim();\n\n/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */\nexport function roleName(project: string, stage: string): string {\n\treturn `${project}-github-${stage}`\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9+=,.@_-]/g, '-')\n\t\t.slice(0, 64);\n}\n\n/**\n * Who may assume the role: a workflow job running in this repository's\n * `<stage>` environment, and nothing else — not another branch's job, not\n * another environment's. That is what keeps a staging deploy from using the\n * production role.\n */\nexport function trustPolicy(\n\tproviderArn: string,\n\trepo: string,\n\tstage: string,\n): string {\n\treturn JSON.stringify({\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tPrincipal: { Federated: providerArn },\n\t\t\t\tAction: 'sts:AssumeRoleWithWebIdentity',\n\t\t\t\tCondition: {\n\t\t\t\t\tStringEquals: {\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t],\n\t});\n}\n\n/** GitHub's OIDC provider in this account, created if it is not there. */\nexport async function ensureOidcProvider(iam: IAMClient): Promise<string> {\n\tconst { OpenIDConnectProviderList = [] } = await iam.send(\n\t\tnew ListOpenIDConnectProvidersCommand({}),\n\t);\n\tconst existing = OpenIDConnectProviderList.find((p) =>\n\t\tp.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`),\n\t)?.Arn;\n\tif (existing) return existing;\n\n\tconst created = await iam.send(\n\t\tnew CreateOpenIDConnectProviderCommand({\n\t\t\tUrl: `https://${GITHUB_OIDC_HOST}`,\n\t\t\tClientIDList: [AUDIENCE],\n\t\t}),\n\t);\n\treturn created.OpenIDConnectProviderArn!;\n}\n\n/** The deploy role, created or brought back to this trust and policy. */\nexport async function ensureRole(\n\tiam: IAMClient,\n\tname: string,\n\ttrust: string,\n\tpolicyArn: string,\n): Promise<string> {\n\tlet arn: string;\n\ttry {\n\t\tconst { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));\n\t\tawait iam.send(\n\t\t\tnew UpdateAssumeRolePolicyCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tPolicyDocument: trust,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name !== 'NoSuchEntityException') {\n\t\t\tthrow error;\n\t\t}\n\t\tconst { Role } = await iam.send(\n\t\t\tnew CreateRoleCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tAssumeRolePolicyDocument: trust,\n\t\t\t\tDescription: 'Deploys from GitHub Actions (gkm deploy:github)',\n\t\t\t\t// SST deploys can run long; the default hour is tight.\n\t\t\t\tMaxSessionDuration: 3600 * 2,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t}\n\n\t// Attaching an attached policy is a no-op, so this converges too.\n\tawait iam.send(\n\t\tnew AttachRolePolicyCommand({ RoleName: name, PolicyArn: policyArn }),\n\t);\n\treturn arn;\n}\n\n/**\n * An IAM client for the stage's account.\n *\n * `fromIni` for a named profile, deliberately: it resolves exactly that\n * profile — keys, assume-role, `credential_process` or SSO, whichever\n * ~/.aws/config says — and never falls back to AWS_* in the environment. The\n * provider chain checks the environment first, so exported staging keys would\n * quietly win over `--profile prod` and the production role would land in the\n * staging account.\n */\nexport async function iamFor(\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<IAMClient> {\n\tconst config: IAMClientConfig = { region: 'us-east-1' };\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\tconfig.credentials = { accessKeyId: 'test', secretAccessKey: 'test' };\n\t}\n\treturn new IAMClient(config);\n}\n\nexport async function deployGithubCommand(\n\toptions: DeployGithubOptions,\n\tdeps: { iam?: IAMClient; gh?: Gh; cwd?: string } = {},\n): Promise<{ roleArn?: string; repo: string }> {\n\tconst gh = deps.gh ?? defaultGh;\n\tconst { workspace } = await loadWorkspaceConfig(deps.cwd);\n\tassertDeployedStage(workspace.stages, options.stage);\n\n\tconst repo =\n\t\toptions.repo ??\n\t\tgh(['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner']);\n\tconst role = roleName(workspace.name, options.stage);\n\tconst policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;\n\tconst keyPath = getKeyPath(options.stage, workspace.name);\n\tconst hasKey = existsSync(keyPath);\n\n\tlogger.log(`\\n🔐 GitHub → AWS for stage \"${options.stage}\"\\n`);\n\tlogger.log(`  Repository:   ${repo}`);\n\tlogger.log(`  AWS profile:  ${options.profile ?? '(default credentials)'}`);\n\tlogger.log(`  Role:         ${role}`);\n\tlogger.log(\n\t\t`  Policy:       ${policyArn}${options.policyArn ? '' : '  (default; --policy-arn to narrow)'}`,\n\t);\n\tlogger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);\n\tlogger.log(\n\t\t`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`,\n\t);\n\n\tif (options.dryRun) {\n\t\tlogger.log('\\n  --dry-run: nothing changed.\\n');\n\t\treturn { repo };\n\t}\n\n\tconst iam = deps.iam ?? (await iamFor(options.profile));\n\tconst providerArn = await ensureOidcProvider(iam).catch((error) => {\n\t\t// The first AWS call is where an expired SSO login surfaces; the SDK's\n\t\t// message does not say which profile, and this command knows.\n\t\tif (/SSO session/i.test(String(error?.message)) && options.profile) {\n\t\t\tthrow new SsoSessionExpired(options.profile);\n\t\t}\n\t\tthrow error;\n\t});\n\tconst roleArn = await ensureRole(\n\t\tiam,\n\t\trole,\n\t\ttrustPolicy(providerArn, repo, options.stage),\n\t\tpolicyArn,\n\t);\n\tlogger.log(`\\n  ✓ AWS: ${roleArn}`);\n\n\t// The environment the generated deploy workflow runs the stage in.\n\tgh(['api', '--method', 'PUT', `repos/${repo}/environments/${options.stage}`]);\n\tgh([\n\t\t'variable',\n\t\t'set',\n\t\t'AWS_ROLE_ARN',\n\t\t'--env',\n\t\toptions.stage,\n\t\t'--repo',\n\t\trepo,\n\t\t'--body',\n\t\troleArn,\n\t]);\n\tlogger.log(`  ✓ GitHub: environment \"${options.stage}\", AWS_ROLE_ARN`);\n\n\tif (hasKey) {\n\t\t// Through stdin, so the key is never an argument a process list shows.\n\t\tgh(\n\t\t\t[\n\t\t\t\t'secret',\n\t\t\t\t'set',\n\t\t\t\t'GKM_SECRETS_KEY',\n\t\t\t\t'--env',\n\t\t\t\toptions.stage,\n\t\t\t\t'--repo',\n\t\t\t\trepo,\n\t\t\t],\n\t\t\treadFileSync(keyPath, 'utf-8').trim(),\n\t\t);\n\t\tlogger.log('  ✓ GitHub: GKM_SECRETS_KEY');\n\t} else {\n\t\tlogger.log(\n\t\t\t`  ⚠ No secrets key for \"${options.stage}\"; run gkm secrets:init --stage ${options.stage}, then this again.`,\n\t\t);\n\t}\n\n\tlogger.log(\n\t\t`\\n  Protect it: add required reviewers to the \"${options.stage}\" environment in the repository settings.\\n`,\n\t);\n\treturn { roleArn, repo };\n}\n\n/** The profile's SSO login has lapsed; the fix is one command away. */\nexport class SsoSessionExpired extends Error {\n\tconstructor(readonly profile: string) {\n\t\tsuper(\n\t\t\t`The SSO session for profile \"${profile}\" has expired or is invalid. Run: aws sso login --profile ${profile}`,\n\t\t);\n\t\tthis.name = 'SsoSessionExpired';\n\t}\n}\n"],"mappings":";;;;;;;;;AAgCA,MAAM,SAAS;AAEf,MAAM,mBAAmB;AACzB,MAAM,WAAW;;;;;AAMjB,MAAa,qBAAqB;AAgBlC,MAAMA,YAAgB,CAAC,MAAM,UAC5B,aAAa,MAAM,MAAM;CACxB,UAAU;CACV,GAAI,mBACD,CAAE,IACF;EAAE;EAAO,OAAO;GAAC;GAAQ;GAAQ;EAAO;CAAW;AACtD,EAAC,CAAC,MAAM;;AAGV,SAAgB,SAASC,SAAiBC,OAAuB;AAChE,QAAO,CAAC,EAAE,QAAQ,UAAU,MAAM,EAChC,aAAa,CACb,QAAQ,qBAAqB,IAAI,CACjC,MAAM,GAAG,GAAG;AACd;;;;;;;AAQD,SAAgB,YACfC,aACAC,MACAF,OACS;AACT,QAAO,KAAK,UAAU;EACrB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,WAAW,EAAE,WAAW,YAAa;GACrC,QAAQ;GACR,WAAW,EACV,cAAc;MACX,EAAE,iBAAiB,QAAQ;MAC3B,EAAE,iBAAiB,SAAS,OAAO,KAAK,eAAe,MAAM;GAC/D,EACD;EACD,CACD;CACD,EAAC;AACF;;AAGD,eAAsB,mBAAmBG,KAAiC;CACzE,MAAM,EAAE,4BAA4B,CAAE,GAAE,GAAG,MAAM,IAAI,KACpD,IAAI,kCAAkC,CAAE,GACxC;CACD,MAAM,WAAW,0BAA0B,KAAK,CAAC,MAChD,EAAE,KAAK,UAAU,gBAAgB,iBAAiB,EAAE,CACpD,EAAE;AACH,KAAI,SAAU,QAAO;CAErB,MAAM,UAAU,MAAM,IAAI,KACzB,IAAI,mCAAmC;EACtC,MAAM,UAAU,iBAAiB;EACjC,cAAc,CAAC,QAAS;CACxB,GACD;AACD,QAAO,QAAQ;AACf;;AAGD,eAAsB,WACrBA,KACAC,MACAC,OACAC,WACkB;CAClB,IAAIC;AACJ,KAAI;EACH,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,KAAK,IAAI,eAAe,EAAE,UAAU,KAAM,GAAE;AACvE,QAAM,IAAI,KACT,IAAI,8BAA8B;GACjC,UAAU;GACV,gBAAgB;EAChB,GACD;AACD,QAAM,KAAM;CACZ,SAAQ,OAAO;AACf,MAAK,MAA4B,SAAS,wBACzC,OAAM;EAEP,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,KAC1B,IAAI,kBAAkB;GACrB,UAAU;GACV,0BAA0B;GAC1B,aAAa;GAEb,oBAAoB,OAAO;EAC3B,GACD;AACD,QAAM,KAAM;CACZ;AAGD,OAAM,IAAI,KACT,IAAI,wBAAwB;EAAE,UAAU;EAAM,WAAW;CAAW,GACpE;AACD,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,OACrBC,SACAC,UACqB;CACrB,MAAMC,SAA0B,EAAE,QAAQ,YAAa;AACvD,KAAI,SAAS;EACZ,MAAM,EAAE,SAAS,GAAG,MAAM,OAAO;AACjC,SAAO,cAAc,QAAQ,EAAE,QAAS,EAAC;CACzC;AACD,KAAI,UAAU;AACb,SAAO,WAAW;AAClB,SAAO,cAAc;GAAE,aAAa;GAAQ,iBAAiB;EAAQ;CACrE;AACD,QAAO,IAAI,UAAU;AACrB;AAED,eAAsB,oBACrBC,SACAC,OAAmD,CAAE,GACP;CAC9C,MAAM,KAAK,KAAK,MAAM;CACtB,MAAM,EAAE,WAAW,GAAG,MAAM,oBAAoB,KAAK,IAAI;AACzD,qBAAoB,UAAU,QAAQ,QAAQ,MAAM;CAEpD,MAAM,OACL,QAAQ,QACR,GAAG;EAAC;EAAQ;EAAQ;EAAU;EAAiB;EAAM;CAAiB,EAAC;CACxE,MAAM,OAAO,SAAS,UAAU,MAAM,QAAQ,MAAM;CACpD,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,UAAU,WAAW,QAAQ,OAAO,UAAU,KAAK;CACzD,MAAM,SAAS,WAAW,QAAQ;AAElC,QAAO,KAAK,+BAA+B,QAAQ,MAAM,KAAK;AAC9D,QAAO,KAAK,kBAAkB,KAAK,EAAE;AACrC,QAAO,KAAK,kBAAkB,QAAQ,WAAW,wBAAwB,EAAE;AAC3E,QAAO,KAAK,kBAAkB,KAAK,EAAE;AACrC,QAAO,KACL,kBAAkB,UAAU,EAAE,QAAQ,YAAY,KAAK,sCAAsC,EAC9F;AACD,QAAO,KAAK,uBAAuB,KAAK,eAAe,QAAQ,MAAM,OAAO;AAC5E,QAAO,KACL,kBAAkB,SAAS,WAAW,UAAU,QAAQ,kCAAkC,QAAQ,MAAM,QAAQ,EACjH;AAED,KAAI,QAAQ,QAAQ;AACnB,SAAO,IAAI,oCAAoC;AAC/C,SAAO,EAAE,KAAM;CACf;CAED,MAAM,MAAM,KAAK,OAAQ,MAAM,OAAO,QAAQ,QAAQ;CACtD,MAAM,cAAc,MAAM,mBAAmB,IAAI,CAAC,MAAM,CAAC,UAAU;AAGlE,MAAI,eAAe,KAAK,OAAO,OAAO,QAAQ,CAAC,IAAI,QAAQ,QAC1D,OAAM,IAAI,kBAAkB,QAAQ;AAErC,QAAM;CACN,EAAC;CACF,MAAM,UAAU,MAAM,WACrB,KACA,MACA,YAAY,aAAa,MAAM,QAAQ,MAAM,EAC7C,UACA;AACD,QAAO,KAAK,aAAa,QAAQ,EAAE;AAGnC,IAAG;EAAC;EAAO;EAAY;GAAQ,QAAQ,KAAK,gBAAgB,QAAQ,MAAM;CAAE,EAAC;AAC7E,IAAG;EACF;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;EACA;CACA,EAAC;AACF,QAAO,KAAK,2BAA2B,QAAQ,MAAM,iBAAiB;AAEtE,KAAI,QAAQ;AAEX,KACC;GACC;GACA;GACA;GACA;GACA,QAAQ;GACR;GACA;EACA,GACD,aAAa,SAAS,QAAQ,CAAC,MAAM,CACrC;AACD,SAAO,IAAI,8BAA8B;CACzC,MACA,QAAO,KACL,0BAA0B,QAAQ,MAAM,kCAAkC,QAAQ,MAAM,oBACzF;AAGF,QAAO,KACL,iDAAiD,QAAQ,MAAM,6CAChE;AACD,QAAO;EAAE;EAAS;CAAM;AACxB;;AAGD,IAAa,oBAAb,cAAuC,MAAM;CAC5C,YAAqBC,SAAiB;AACrC,SACE,+BAA+B,QAAQ,4DAA4D,QAAQ,EAC5G;EAHmB;AAIpB,OAAK,OAAO;CACZ;AACD"}

package/dist/{index-C6e-ULLx.d.mts → index-Ayxg_DQY.d.mts}

@@ -1,4 +1,4 @@
-import { AppsRecord, Framework, GkmConfig, InferredWorkspaceConfig, LoadedConfig, NormalizedWorkspace, Routes, WorkspaceConfig, WorkspaceInput } from "./types-6pkp2RRj.mjs";
+import { AppsRecord, Framework, GkmConfig, InferredWorkspaceConfig, LoadedConfig, NormalizedWorkspace, Routes, WorkspaceConfig, WorkspaceInput } from "./types-CL7jPFM2.mjs";
 
 //#region src/workspace/publicEnv.d.ts
 
@@ -172,4 +172,4 @@ declare function getEndpointForStage(dokployConfig: {
 //# sourceMappingURL=index.d.ts.map
 //#endregion
 export { PUBLIC_ENV_PREFIXES, allConstructGlobs, appConstructGlobs, constructPatterns, defineWorkspace, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getEndpointForStage, getPublicEnvPrefix, normalizeWorkspace, processConfig, stripPublicPrefix, workspaceConstructGlobs, wrapSingleAppAsWorkspace };
-//# sourceMappingURL=index-C6e-ULLx.d.mts.map
+//# sourceMappingURL=index-Ayxg_DQY.d.mts.map

package/dist/{index-C6e-ULLx.d.mts.map → index-Ayxg_DQY.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"index-C6e-ULLx.d.mts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"sourcesContent":[],"mappings":";;;;;;AASA;AAoBA;AAoBA;;;cAxCa;AC2Hb;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;AAAwC,iBDzLxB,kBAAA,CCyLwB,SAAA,CAAA,EDzLO,SCyLP,CAAA,EAAA,MAAA;;;AAGlB;AAsEtB;AAA6B,iBD9Ob,iBAAA,CC8Oa,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;;;;;;;;AA3J7B;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;;;;AAGsB;AAsEtB;;;;;AAGe;AA6Bf;AAmBA;AAwBA;AAaA;AAiBA;;;;AAGY;AAmCZ;AAmCA;;;;AAIS;AAgDO,iBAjYA,eAmYqB,CAAA,oBAnYe,UAmYT,CAAA,CAAA,MAAA,EAlYlC,cAkYkC,CAlYnB,KAkYmB,CAAA,CAAA,EAjYxC,uBAiYwC,CAjYhB,KAiYgB,CAAA;;;;iBAnW3B,kBAAA,SACP,+BAEN;;;;;iBA+Ca,wBAAA,SACP,yBAEN;;;;;iBAsEa,aAAA,SACP,YAAY,+BAElB;;;;;;;iBA6Ba,uBAAA,YACJ;;;;;;;;;;;;iBAkBI,iBAAA,YACJ;;;;;;;iBAuBI,iBAAA,YAA6B;;iBAa7B,iBAAA,SAA0B;;;;;iBAiB1B,eAAA,YACJ,uCAET;;;;;iBAmCa,gBAAA,YAA4B;;;;;;;;;;iBAmC5B,oBAAA,YACJ,2DAGT;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDa,mBAAA;;cAEqB"}
+{"version":3,"file":"index-Ayxg_DQY.d.mts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"sourcesContent":[],"mappings":";;;;;;AASA;AAoBA;AAoBA;;;cAxCa;AC2Hb;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;AAAwC,iBDzLxB,kBAAA,CCyLwB,SAAA,CAAA,EDzLO,SCyLP,CAAA,EAAA,MAAA;;;AAGlB;AAsEtB;AAA6B,iBD9Ob,iBAAA,CC8Oa,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;;;;;;;;AA3J7B;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;;;;AAGsB;AAsEtB;;;;;AAGe;AA6Bf;AAmBA;AAwBA;AAaA;AAiBA;;;;AAGY;AAmCZ;AAmCA;;;;AAIS;AAgDO,iBAjYA,eAmYqB,CAAA,oBAnYe,UAmYT,CAAA,CAAA,MAAA,EAlYlC,cAkYkC,CAlYnB,KAkYmB,CAAA,CAAA,EAjYxC,uBAiYwC,CAjYhB,KAiYgB,CAAA;;;;iBAnW3B,kBAAA,SACP,+BAEN;;;;;iBA+Ca,wBAAA,SACP,yBAEN;;;;;iBAsEa,aAAA,SACP,YAAY,+BAElB;;;;;;;iBA6Ba,uBAAA,YACJ;;;;;;;;;;;;iBAkBI,iBAAA,YACJ;;;;;;;iBAuBI,iBAAA,YAA6B;;iBAa7B,iBAAA,SAA0B;;;;;iBAiB1B,eAAA,YACJ,uCAET;;;;;iBAmCa,gBAAA,YAA4B;;;;;;;;;;iBAmC5B,oBAAA,YACJ,2DAGT;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDa,mBAAA;;cAEqB"}

package/dist/index.cjs

@@ -1,21 +1,22 @@
 #!/usr/bin/env -S npx tsx
 const require_chunk = require('./chunk-CUT6urMc.cjs');
 const require_discover = require('./discover-DTmFeloL.cjs');
-const require_config = require('./config-BZ1F0WuA.cjs');
-const require_workspace = require('./workspace-C6VJQVtG.cjs');
+const require_config = require('./config-HhDpJmLO.cjs');
+const require_workspace = require('./workspace-C-a3G_U0.cjs');
 const require_credentials = require('./credentials-BapzjyV5.cjs');
-const require_credentials$1 = require('./credentials-Xamqe_NJ.cjs');
+const require_credentials$1 = require('./credentials-B2Pyh3bJ.cjs');
 const require_generator = require('./generator-CNzBw7g5.cjs');
-const require_storage = require('./storage-BJmzYxt8.cjs');
-const require_openapi = require('./openapi-SjsgARie.cjs');
-const require_emit = require('./emit-CbcRolsa.cjs');
-const require_dokploy_api = require('./dokploy-api-BsVH0y_s.cjs');
-const require_encryption = require('./encryption-C6jaU0hE.cjs');
-const require_CachedStateProvider = require('./CachedStateProvider-CqPdW7CB.cjs');
-const require_fullstack_secrets = require('./fullstack-secrets-C-GGohke.cjs');
-const require_openapi_react_query = require('./openapi-react-query-CmJ1xDbn.cjs');
-require('./sync-SizaChmC.cjs');
-const require_setup = require('./setup-hC6hI86f.cjs');
+const require_keystore = require('./keystore-C9rint2E.cjs');
+const require_storage = require('./storage-CSNplaJn.cjs');
+const require_openapi = require('./openapi-DaKlTKxz.cjs');
+const require_emit = require('./emit-CUD1BWls.cjs');
+const require_dokploy_api = require('./dokploy-api-zqKe9lHH.cjs');
+const require_encryption = require('./encryption-D2pL3tHH.cjs');
+const require_CachedStateProvider = require('./CachedStateProvider-BEBl2wQT.cjs');
+const require_fullstack_secrets = require('./fullstack-secrets-D6MyHhQP.cjs');
+const require_openapi_react_query = require('./openapi-react-query-BKH334Ug.cjs');
+require('./sync-0ILCb-1S.cjs');
+const require_setup = require('./setup-DOv92pIu.cjs');
 const node_fs = require_chunk.__toESM(require("node:fs"));
 const node_path = require_chunk.__toESM(require("node:path"));
 const __geekmidas_manifest = require_chunk.__toESM(require("@geekmidas/manifest"));
@@ -43,7 +44,7 @@ const prompts = require_chunk.__toESM(require("prompts"));
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "10.0.0-alpha.10";
+var version = "10.0.0-alpha.11";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -188,7 +189,7 @@ const logger$11 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi: DokployApi$1 } = await Promise.resolve().then(() => require("./dokploy-api-BuxDRo3l.cjs"));
+	const { DokployApi: DokployApi$1 } = await Promise.resolve().then(() => require("./dokploy-api-5cK2InBm.cjs"));
 	const api = new DokployApi$1({
 		baseUrl: endpoint,
 		token
@@ -2639,7 +2640,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$7.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BY1OmV1e.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CaTGtiaO.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3592,11 +3593,11 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-h3EbEp-Z.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-BOvsgATO.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
-		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-di2fMM5N.cjs"));
+		const { Route53Provider } = await Promise.resolve().then(() => require("./Route53Provider-CH9XH7bz.cjs"));
 		const route53Config = config;
 		return new Route53Provider({
 			region: route53Config.region,
@@ -5923,20 +5924,20 @@ function isStateProvider(value) {
 async function createStateProvider(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config) {
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-Db9SEjyH.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-yjXZXZDM.cjs"));
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (isStateProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "local") {
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-Db9SEjyH.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-yjXZXZDM.cjs"));
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
 		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-Db9SEjyH.cjs"));
-		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-DyX8s9HI.cjs"));
-		const { CachedStateProvider: CachedStateProvider$1 } = await Promise.resolve().then(() => require("./CachedStateProvider-BLo7zv7S.cjs"));
+		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-yjXZXZDM.cjs"));
+		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-CXtNgPfy.cjs"));
+		const { CachedStateProvider: CachedStateProvider$1 } = await Promise.resolve().then(() => require("./CachedStateProvider-DqhGpzsm.cjs"));
 		const ssmConfig = config;
 		const local = new LocalStateProvider(workspaceRoot);
 		const ssm = SSMStateProvider.create({
@@ -6812,7 +6813,7 @@ async function workspaceDeployCommand(configured, options) {
 	const backupCluster = Object.values(declaredClusters)[0];
 	if (workspace.deploy?.backups && backupCluster) {
 		logger$3.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-BrsHwYG0.cjs"));
+		const { provisionBackupDestination } = await Promise.resolve().then(() => require("./backup-provisioner-cE2PuCTb.cjs"));
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -8026,26 +8027,26 @@ const CLI_VERSION = `~${pkg.version}`;
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.10",
-	"@geekmidas/auth": "~10.0.0-alpha.10",
-	"@geekmidas/cache": "~10.0.0-alpha.10",
-	"@geekmidas/client": "~10.0.0-alpha.10",
-	"@geekmidas/cloud": "~10.0.0-alpha.10",
-	"@geekmidas/constructs": "~10.0.0-alpha.10",
-	"@geekmidas/db": "~10.0.0-alpha.10",
-	"@geekmidas/emailkit": "~10.0.0-alpha.10",
-	"@geekmidas/envkit": "~10.0.0-alpha.10",
-	"@geekmidas/errors": "~10.0.0-alpha.10",
-	"@geekmidas/events": "~10.0.0-alpha.10",
-	"@geekmidas/logger": "~10.0.0-alpha.10",
-	"@geekmidas/manifest": "~10.0.0-alpha.10",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.10",
-	"@geekmidas/schema": "~10.0.0-alpha.10",
-	"@geekmidas/services": "~10.0.0-alpha.10",
-	"@geekmidas/storage": "~10.0.0-alpha.10",
-	"@geekmidas/studio": "~10.0.0-alpha.10",
-	"@geekmidas/telescope": "~10.0.0-alpha.10",
-	"@geekmidas/testkit": "~10.0.0-alpha.10",
+	"@geekmidas/audit": "~10.0.0-alpha.11",
+	"@geekmidas/auth": "~10.0.0-alpha.11",
+	"@geekmidas/cache": "~10.0.0-alpha.11",
+	"@geekmidas/client": "~10.0.0-alpha.11",
+	"@geekmidas/cloud": "~10.0.0-alpha.11",
+	"@geekmidas/constructs": "~10.0.0-alpha.11",
+	"@geekmidas/db": "~10.0.0-alpha.11",
+	"@geekmidas/emailkit": "~10.0.0-alpha.11",
+	"@geekmidas/envkit": "~10.0.0-alpha.11",
+	"@geekmidas/errors": "~10.0.0-alpha.11",
+	"@geekmidas/events": "~10.0.0-alpha.11",
+	"@geekmidas/logger": "~10.0.0-alpha.11",
+	"@geekmidas/manifest": "~10.0.0-alpha.11",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.11",
+	"@geekmidas/schema": "~10.0.0-alpha.11",
+	"@geekmidas/services": "~10.0.0-alpha.11",
+	"@geekmidas/storage": "~10.0.0-alpha.11",
+	"@geekmidas/studio": "~10.0.0-alpha.11",
+	"@geekmidas/telescope": "~10.0.0-alpha.11",
+	"@geekmidas/testkit": "~10.0.0-alpha.11",
 	"@geekmidas/cli": CLI_VERSION
 };
 
@@ -9842,7 +9843,7 @@ function deployPackage(options) {
 }
 function generateDeployFiles(options) {
 	if (options.deployTarget !== "sst") return [];
-	if (!options.region) throw new Error("An SST deploy needs a region.");
+	if (!options.region) throw new SstNeedsRegion();
 	const db = databaseFor();
 	const mail = emailFor();
 	const hasDatabase = options.template === "fullstack" || options.services.db;
@@ -9910,6 +9911,16 @@ ${inputs.join("\n")}
 `
 	}];
 }
+/**
+* An SST scaffold asked for without a region. `init` always resolves one —
+* asked, `--region`, or eu-west-1 under `--yes` — so this is a caller's bug.
+*/
+var SstNeedsRegion = class extends Error {
+	constructor() {
+		super("An SST deploy needs a region: pass --region, e.g. eu-west-1.");
+		this.name = "SstNeedsRegion";
+	}
+};
 
 //#endregion
 //#region src/init/generators/monorepo.ts
@@ -14091,8 +14102,8 @@ const AWS_REGION = /^[a-z]{2}(-gov)?-[a-z]+-\d$/;
 async function initCommand(projectName, options = {}) {
 	const cwd = process.cwd();
 	const detectedPkgManager = detectPackageManager(cwd);
-	if (options.deploy && !deployTargetChoices.some((choice) => choice.value === options.deploy)) throw new Error(`Unknown deploy target "${options.deploy}". Use ${deployTargetChoices.map((c) => c.value).join(", ")}.`);
-	if (options.region && !AWS_REGION.test(options.region)) throw new Error(`"${options.region}" is not an AWS region. Use one like eu-west-1.`);
+	if (options.deploy && !deployTargetChoices.some((choice) => choice.value === options.deploy)) throw new UnknownDeployTarget(options.deploy, deployTargetChoices.map((c) => c.value));
+	if (options.region && !AWS_REGION.test(options.region)) throw new NotAnAwsRegion(options.region);
 	if (options.stages || options.localStage || options.protectedStage) {
 		const deployed = stageList(options.stages ?? "");
 		const problems = [
@@ -14103,7 +14114,7 @@ async function initCommand(projectName, options = {}) {
 			}) : [],
 			...options.protectedStage && !deployed.includes(options.protectedStage) ? [`--protected-stage "${options.protectedStage}" is not in --stages`] : []
 		];
-		if (problems.length) throw new Error([...new Set(problems)].join("\n"));
+		if (problems.length) throw new require_workspace.InvalidStages([...new Set(problems)]);
 	}
 	let deployedSoFar = [];
 	prompts.default.override({});
@@ -14382,7 +14393,7 @@ async function initCommand(projectName, options = {}) {
 	}
 	devSecrets.custom = customSecrets;
 	await require_storage.writeStageSecrets(devSecrets, targetDir);
-	const keyPath = require_storage.getKeyPath(local, name$1);
+	const keyPath = require_keystore.getKeyPath(local, name$1);
 	console.log(`  Secrets: .gkm/secrets/${local}.json (encrypted)`);
 	console.log(`  Key: ${keyPath}\n`);
 	if (!options.skipInstall) {
@@ -14511,9 +14522,26 @@ function resolveStages(options, answers) {
 		...kept ? { protected: [kept] } : {}
 	};
 	const problems = require_workspace.stageProblems(stages);
-	if (problems.length) throw new Error(problems.join("\n"));
+	if (problems.length) throw new require_workspace.InvalidStages(problems);
 	return stages;
 }
+/** `--deploy` naming a target init has no scaffold for. */
+var UnknownDeployTarget = class extends Error {
+	constructor(target, known) {
+		super(`Unknown deploy target "${target}". Use ${known.join(", ")}.`);
+		this.target = target;
+		this.known = known;
+		this.name = "UnknownDeployTarget";
+	}
+};
+/** `--region` that is not shaped like one, e.g. `europe` for `eu-west-1`. */
+var NotAnAwsRegion = class extends Error {
+	constructor(region) {
+		super(`"${region}" is not an AWS region. Use one like eu-west-1.`);
+		this.region = region;
+		this.name = "NotAnAwsRegion";
+	}
+};
 
 //#endregion
 //#region src/secrets/index.ts
@@ -14726,11 +14754,11 @@ function maskUrl(url) {
 async function testCommand(options = {}) {
 	const cwd = process.cwd();
 	const stage = options.stage ?? await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.stages.local).catch(() => void 0);
-	if (!stage) throw new Error("No stage to test with: add `stages` to gkm.config.ts, or pass --stage.");
+	if (!stage) throw new NoStageToTest();
 	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
 	const autoSetup = options.autoSetup || Boolean(process.env.GKM_AUTO_SETUP);
 	if (autoSetup) {
-		const { ensureStageSecrets } = await Promise.resolve().then(() => require("./setup-BsZvZP6f.cjs"));
+		const { ensureStageSecrets } = await Promise.resolve().then(() => require("./setup-lCx_DcUo.cjs"));
 		const generated = await ensureStageSecrets(stage, cwd);
 		if (generated) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
 	}
@@ -14817,6 +14845,13 @@ function rewriteDatabaseUrlForTests(env) {
 	}
 	return result;
 }
+/** `gkm test` outside a project that declares stages, with none named. */
+var NoStageToTest = class extends Error {
+	constructor() {
+		super("No stage to test with: add `stages` to gkm.config.ts, or pass --stage.");
+		this.name = "NoStageToTest";
+	}
+};
 
 //#endregion
 //#region src/upgrade/version.ts
@@ -15359,13 +15394,13 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pushSecrets } = await Promise.resolve().then(() => require("./sync-D306yOWu.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-D0pimNiy.cjs"));
-		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-BM9hGpgv.cjs"));
+		const { pushSecrets } = await Promise.resolve().then(() => require("./sync-DYENfOt4.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CYMhFSYy.cjs"));
+		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DlVol_oj.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
 		if (secrets) {
-			const { derivedContainers: derivedContainers$1 } = await Promise.resolve().then(() => require("./workspace-XXtNhqJl.cjs"));
+			const { derivedContainers: derivedContainers$1 } = await Promise.resolve().then(() => require("./workspace-DQxxs7Jk.cjs"));
 			const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 			if (result) {
 				await writeStageSecrets$1(result.secrets, workspace.root);
@@ -15385,16 +15420,16 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { pullSecrets } = await Promise.resolve().then(() => require("./sync-D306yOWu.cjs"));
-		const { writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-BM9hGpgv.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-D0pimNiy.cjs"));
+		const { pullSecrets } = await Promise.resolve().then(() => require("./sync-DYENfOt4.cjs"));
+		const { writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DlVol_oj.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CYMhFSYy.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		let secrets = await pullSecrets(options.stage, workspace);
 		if (!secrets) {
 			console.error(`No remote secrets found for stage "${options.stage}".`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await Promise.resolve().then(() => require("./workspace-XXtNhqJl.cjs"));
+		const { derivedContainers: derivedContainers$1 } = await Promise.resolve().then(() => require("./workspace-DQxxs7Jk.cjs"));
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
 		if (result) {
 			secrets = result.secrets;
@@ -15413,8 +15448,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-D0pimNiy.cjs"));
-		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-BM9hGpgv.cjs"));
+		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CYMhFSYy.cjs"));
+		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await Promise.resolve().then(() => require("./storage-DlVol_oj.cjs"));
 		const { workspace } = await loadWorkspaceConfig$1();
 		const stage = options.stage ?? workspace.stages.local;
 		const secrets = await readStageSecrets$1(stage, workspace.root);
@@ -15422,7 +15457,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await Promise.resolve().then(() => require("./workspace-XXtNhqJl.cjs"));
+		const { derivedContainers: derivedContainers$1 } = await Promise.resolve().then(() => require("./workspace-DQxxs7Jk.cjs"));
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -15477,6 +15512,17 @@ program.command("deploy:init").description("Initialize Dokploy deployment (creat
 		process.exit(1);
 	}
 });
+program.command("deploy:github").description("Let GitHub Actions deploy a stage: OIDC role in the stage's AWS account, and the GitHub environment the deploy workflow uses").requiredOption("--stage <stage>", "A deployed stage from gkm.config.ts").option("--profile <profile>", "AWS profile for the stage's account").option("--repo <owner/name>", "GitHub repository (default: this one)").option("--policy-arn <arn>", "Policy for the deploy role (default: AdministratorAccess)").option("--dry-run", "Show the plan without changing AWS or GitHub").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BrvaPkFf.cjs"));
+		await deployGithubCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("deploy:list").description("List Dokploy resources (projects, registries)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").option("--projects", "List projects").option("--registries", "List registries").action(async (options) => {
 	try {
 		const globalOptions = program.opts();