@geekmidas/cli 10.0.0-alpha.102 → 10.0.0-alpha.104

package/dist/index.cjs

@@ -4,27 +4,27 @@ const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_credentials = require("./credentials-Zqr3QQYB.cjs");
-const require_compose = require("./compose-uAWLy-nR.cjs");
+const require_compose = require("./compose-qbPKKAMC.cjs");
 const require_workspace = require("./workspace-BwqQnool.cjs");
-const require_dns = require("./dns-DnE_02tB.cjs");
-const require_seeds = require("./seeds-Dk4WHhjU.cjs");
+const require_dns = require("./dns-BUUEztBH.cjs");
+const require_seeds = require("./seeds-CjBwLvWY.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-BlIOdbi-.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-CeH7wbYt.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-By5_tYE9.cjs");
-const require_discover = require("./discover-BfhVW_kT.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-BwbYTMtB.cjs");
+const require_discover = require("./discover-Bsr7HjqJ.cjs");
 const require_config = require("./config.cjs");
-const require_deploy = require("./deploy-DUUc3jV9.cjs");
+const require_deploy = require("./deploy-Bsxl6nyG.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
-const require_drivers = require("./drivers-BLU1fNs_.cjs");
+const require_drivers = require("./drivers-GKaA6ITM.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
 const require_local = require("./local-DNhnkugT.cjs");
-const require_sniffer = require("./sniffer-BjBZ01PE.cjs");
-const require_credentialSchemas = require("./credentialSchemas-DDda4Mmm.cjs");
-const require_LocalStateStore = require("./LocalStateStore-BVKDADoG.cjs");
+const require_sniffer = require("./sniffer-t0NsMNNP.cjs");
+const require_credentialSchemas = require("./credentialSchemas-D_VUCDUh.cjs");
+const require_LocalStateStore = require("./LocalStateStore-Sf4B6kUn.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
-const require_ready = require("./ready-BtxiI7Qb.cjs");
+const require_ready = require("./ready-DU7wvxWk.cjs");
 let node_path = require("node:path");
 let commander = require("commander");
 let node_process = require("node:process");
@@ -57,7 +57,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.102";
+var version = "10.0.0-alpha.104";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -140,7 +140,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-BjBZ01PE.cjs")).then((n) => n.dokploy_api_exports);
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-t0NsMNNP.cjs")).then((n) => n.dokploy_api_exports);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2353,7 +2353,8 @@ async function devCommand(options) {
 		skipBundle: true,
 		bustCache,
 		serveEmpty: true,
-		workspaceName: workspace.name
+		workspaceName: workspace.name,
+		workspace
 	}));
 	logger$5.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
 	const initial = await build();
@@ -2381,8 +2382,9 @@ async function devCommand(options) {
 			}
 		}
 		Object.assign(appSecrets, reconciled.env);
+		const declared = reconciled.manifest;
 		const scoped = require_seeds.scopeTelemetryEnv(appSecrets, {
-			uses: reconciled.manifest !== void 0 && require_seeds.appTelemetry(reconciled.manifest, workspaceAppName) !== void 0,
+			uses: declared !== void 0 && (require_seeds.appTelemetry(declared, workspaceAppName) !== void 0 || (initial.workers ?? []).some((id) => require_seeds.telemetryOf(declared, id) !== void 0)),
 			serviceName: workspaceAppName,
 			telemetry: reconciled.env
 		});
@@ -2734,9 +2736,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-CWSCkzu3.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-DXVzuw-s.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-CWSCkzu3.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-DXVzuw-s.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3472,6 +3474,29 @@ function restApis(declared) {
 function servedSurface(declared, workspaceRoot, appRoot) {
 	return restApis(declared).find((d) => (0, node_path.resolve)(workspaceRoot, d.path) === (0, node_path.resolve)(appRoot));
 }
+/**
+* The declarations one process reaches: the constructs it runs as — a surface,
+* a worker — what each declared an edge to, and what each runnable it runs
+* depends on or consumes.
+*
+* What decides which drivers its entry registers: a process that reaches no
+* cache never resolves a cache client because another process in the
+* workspace does.
+*/
+function reachedBy(declared, processes, runnables) {
+	const reached = /* @__PURE__ */ new Set();
+	for (const id of processes) {
+		const declaration = declared[id];
+		if (!declaration) continue;
+		reached.add(id);
+		for (const edge of (0, _geekmidas_manifest.dependenciesOf)(declaration)) reached.add(edge.target);
+	}
+	for (const { construct } of runnables) {
+		for (const id of construct.constructs ?? []) reached.add((0, _geekmidas_manifest.canonicalId)(id));
+		for (const id of require_discover.consumedBy(construct)) reached.add(id);
+	}
+	return Object.fromEntries(Object.entries(declared).filter(([id]) => reached.has(id)));
+}
 //#endregion
 //#region src/build/surfaceEntry.ts
 /** Whether a construct serves itself, asked of the construct. */
@@ -3789,7 +3814,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-Ba6BER3w.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DBTA8gXs.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3809,7 +3834,6 @@ async function buildApp(input) {
 		appRoot,
 		databaseApi
 	});
-	const eventsBackends = require_drivers.eventsBackendsIn(declared, eventsBackend);
 	const buildContext = {
 		...derived,
 		telescope,
@@ -3818,12 +3842,6 @@ async function buildApp(input) {
 		constructGlobs,
 		cacheBackend,
 		emailBackend: "ses",
-		storageDrivers: require_drivers.driversFor({
-			appRoot,
-			cache: require_drivers.cacheBackendsIn(declared, cacheBackend),
-			events: eventsBackends
-		}),
-		eventsBackends,
 		markOptional: input.markOptional ?? false
 	};
 	const endpointGenerator = new require_EndpointGenerator.EndpointGenerator();
@@ -3842,8 +3860,39 @@ async function buildApp(input) {
 		topicGenerator.load(code, appRoot, bustCache)
 	]);
 	const allEndpoints = servedBy(loadedEndpoints, derived.surface);
+	const appName = appNameOf(input);
+	const hosted = require_seeds.workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName);
+	const hostedIds = new Set(hosted.map((unit) => unit.id));
+	const appRootAbs = (0, node_path.resolve)(appRoot);
+	const hostedHere = (list) => list.filter(({ construct, path }) => construct.owner !== void 0 ? hostedIds.has(construct.owner) : require_seeds.isUnder(path.absolute, appRootAbs));
+	const hostedCrons = hostedHere(allCrons);
+	const hostedQueues = hostedHere(allQueues);
+	const hostedSubscribers = hostedHere(allSubscribers);
+	const servesOnly = Boolean(production?.enabled && derived.surface);
+	const inProcess = servesOnly ? {
+		crons: [],
+		queues: [],
+		subscribers: []
+	} : {
+		crons: hostedCrons,
+		queues: hostedQueues,
+		subscribers: hostedSubscribers
+	};
+	const reach = derived.surface ? reachedBy(declared, [derived.surface.id, ...servesOnly ? [] : hosted.map((unit) => unit.id)], [
+		...allEndpoints,
+		...allFunctions,
+		...inProcess.crons,
+		...inProcess.queues,
+		...inProcess.subscribers
+	]) : declared;
+	Object.assign(buildContext, runtimeDrivers({
+		appRoot,
+		reach,
+		cacheBackend,
+		eventsBackend
+	}));
 	if (target === "server") buildContext.telemetry = require_EndpointGenerator.telemetryFor({
-		node: derived.surface ? require_seeds.telemetryOf(declared, derived.surface.id) : void 0,
+		node: processTelemetry(declared, derived.surface?.id, servesOnly ? [] : hosted.map((unit) => unit.id)),
 		appRoot,
 		app: appNameOf(input),
 		cwd: workspaceRoot,
@@ -3861,40 +3910,37 @@ async function buildApp(input) {
 		logger$4.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
-	if (production?.subscribers === "include" && derived.surface) {
-		buildContext.production = {
-			...production,
-			subscribers: "exclude"
-		};
-		const left = [
-			[allCrons.length, "cron"],
-			[allQueues.length, "queue consumer"],
-			[allSubscribers.length, "subscriber"]
-		].filter(([n]) => n > 0).map(([n, what]) => `${n} ${what}${n === 1 ? "" : "s"}`);
-		if (left.length > 0) logger$4.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
-	}
-	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
-	if (target === "server" && production?.enabled && input.workspace) {
-		const appName = Object.entries(input.workspace.apps).find(([, app]) => (0, node_path.resolve)(input.workspace.root, app.path) === (0, node_path.resolve)(appRoot))?.[0];
-		await buildWorkers({
-			context: buildContext,
-			telemetry: (workerId) => require_EndpointGenerator.telemetryFor({
-				node: require_seeds.telemetryOf(declared, workerId),
+	if (servesOnly && production) buildContext.production = {
+		...production,
+		subscribers: "exclude"
+	};
+	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, inProcess.crons, inProcess.subscribers, inProcess.queues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
+	if (target === "server" && production?.enabled) await buildWorkers({
+		context: (workerId, work) => ({
+			...buildContext,
+			...runtimeDrivers({
 				appRoot,
-				app: appNameOf(input),
-				cwd: workspaceRoot,
-				serviceName: workerId,
-				...input.workspaceName && { workspaceName: input.workspaceName }
-			}),
-			workers: require_seeds.workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName),
-			serverDir: (0, node_path.join)(appRoot, ".gkm", "server"),
-			crons: allCrons,
-			queues: allQueues,
-			subscribers: allSubscribers,
-			bundle: Boolean(production.bundle && !input.skipBundle),
-			...input.stage ? { stage: input.stage } : {}
-		});
-	}
+				reach: reachedBy(declared, [workerId], work),
+				cacheBackend,
+				eventsBackend
+			})
+		}),
+		telemetry: (workerId) => require_EndpointGenerator.telemetryFor({
+			node: require_seeds.telemetryOf(declared, workerId),
+			appRoot,
+			app: appNameOf(input),
+			cwd: workspaceRoot,
+			serviceName: workerId,
+			...input.workspaceName && { workspaceName: input.workspaceName }
+		}),
+		workers: hosted,
+		serverDir: (0, node_path.join)(appRoot, ".gkm", "server"),
+		crons: hostedCrons,
+		queues: hostedQueues,
+		subscribers: hostedSubscribers,
+		bundle: Boolean(production.bundle && !input.skipBundle),
+		...input.stage ? { stage: input.stage } : {}
+	});
 	await require_openapi.generateOpenApi(allEndpoints.map(({ construct }) => construct), {
 		openapi: config.openapi,
 		root: workspaceRoot,
@@ -3908,7 +3954,35 @@ async function buildApp(input) {
 	});
 	return {
 		...result,
-		...buildContext.databaseApi ? { databaseApi: buildContext.databaseApi.path } : {}
+		...buildContext.databaseApi ? { databaseApi: buildContext.databaseApi.path } : {},
+		...!servesOnly && hosted.length > 0 ? { workers: hosted.map((unit) => unit.id) } : {}
+	};
+}
+/**
+* The `Telemetry` node a process emits through: its surface's, or — where it
+* runs a worker's work, under `gkm dev` — that worker's.
+*/
+function processTelemetry(declared, surfaceId, workers) {
+	for (const id of [...surfaceId ? [surfaceId] : [], ...workers]) {
+		const node = require_seeds.telemetryOf(declared, id);
+		if (node) return node;
+	}
+}
+/**
+* The drivers a process's entry registers, from the declarations it reaches:
+* the cache's — the declaration for one that named its database, the deploy
+* target's default for one that named nowhere — and the broker's, only when
+* it reaches a topic or a queue (see `eventsBackendsIn`).
+*/
+function runtimeDrivers(options) {
+	const eventsBackends = require_drivers.eventsBackendsIn(options.reach, options.eventsBackend);
+	return {
+		storageDrivers: require_drivers.driversFor({
+			appRoot: options.appRoot,
+			cache: require_drivers.cacheBackendsIn(options.reach, options.cacheBackend),
+			events: eventsBackends
+		}),
+		eventsBackends
 	};
 }
 /**
@@ -3923,8 +3997,13 @@ async function buildWorkers(input) {
 		const queues = owned(input.queues);
 		const subscribers = owned(input.subscribers);
 		const telemetry = input.telemetry(worker.id);
+		const context = input.context(worker.id, [
+			...crons,
+			...queues,
+			...subscribers
+		]);
 		const entryPoint = await generator.build({
-			context: input.context,
+			context,
 			workerId: worker.id,
 			...telemetry ? { telemetry } : {},
 			outputDir: require_seeds.workerEntryDir(input.serverDir, worker.id),
@@ -3934,15 +4013,15 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-Ba6BER3w.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DBTA8gXs.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
 			outputDir: (0, node_path.join)(input.serverDir, "dist"),
 			outfile,
-			minify: input.context.production?.minify ?? false,
+			minify: context.production?.minify ?? false,
 			sourcemap: false,
-			external: input.context.production?.external ?? [],
+			external: context.production?.external ?? [],
 			...input.stage ? { stage: input.stage } : {},
 			constructs: [
 				...crons,
@@ -4020,7 +4099,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-Ba6BER3w.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DBTA8gXs.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5848,25 +5927,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.102",
-	"@geekmidas/auth": "~10.0.0-alpha.102",
-	"@geekmidas/cache": "~10.0.0-alpha.102",
-	"@geekmidas/client": "~10.0.0-alpha.102",
-	"@geekmidas/cloud": "~10.0.0-alpha.102",
-	"@geekmidas/constructs": "~10.0.0-alpha.102",
-	"@geekmidas/db": "~10.0.0-alpha.102",
-	"@geekmidas/emailkit": "~10.0.0-alpha.102",
-	"@geekmidas/envkit": "~10.0.0-alpha.102",
-	"@geekmidas/errors": "~10.0.0-alpha.102",
-	"@geekmidas/events": "~10.0.0-alpha.102",
-	"@geekmidas/logger": "~10.0.0-alpha.102",
-	"@geekmidas/manifest": "~10.0.0-alpha.102",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.102",
-	"@geekmidas/schema": "~10.0.0-alpha.102",
-	"@geekmidas/services": "~10.0.0-alpha.102",
-	"@geekmidas/storage": "~10.0.0-alpha.102",
-	"@geekmidas/telescope": "~10.0.0-alpha.102",
-	"@geekmidas/testkit": "~10.0.0-alpha.102",
+	"@geekmidas/audit": "~10.0.0-alpha.104",
+	"@geekmidas/auth": "~10.0.0-alpha.104",
+	"@geekmidas/cache": "~10.0.0-alpha.104",
+	"@geekmidas/client": "~10.0.0-alpha.104",
+	"@geekmidas/cloud": "~10.0.0-alpha.104",
+	"@geekmidas/constructs": "~10.0.0-alpha.104",
+	"@geekmidas/db": "~10.0.0-alpha.104",
+	"@geekmidas/emailkit": "~10.0.0-alpha.104",
+	"@geekmidas/envkit": "~10.0.0-alpha.104",
+	"@geekmidas/errors": "~10.0.0-alpha.104",
+	"@geekmidas/events": "~10.0.0-alpha.104",
+	"@geekmidas/logger": "~10.0.0-alpha.104",
+	"@geekmidas/manifest": "~10.0.0-alpha.104",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.104",
+	"@geekmidas/schema": "~10.0.0-alpha.104",
+	"@geekmidas/services": "~10.0.0-alpha.104",
+	"@geekmidas/storage": "~10.0.0-alpha.104",
+	"@geekmidas/telescope": "~10.0.0-alpha.104",
+	"@geekmidas/testkit": "~10.0.0-alpha.104",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -6267,7 +6346,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "49e00aa29d2a37c388cf8c2c67581f7d3eb1a81c", version = cliVersion()) {
+function stagesActionUses(commit = "088aa26a6c82b4916af4faddd5755e030fb459d5", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -11904,6 +11983,7 @@ async function testCommand(options = {}) {
 		secretsFileName: "test-secrets.json",
 		reconcileStage: "test"
 	});
+	const credentials = result.reconciled ? require_SubscriberGenerator.assertTestCredentials(result.secretsRoot, result.reconciled.plan, result.credentials) : {};
 	let finalCredentials = { ...result.credentials };
 	if (result.appInfo) {
 		const sniffed = await require_sniffer.sniffAppEnvironment(result.appInfo.app, result.appInfo.appName, result.appInfo.workspaceRoot, { logWarnings: false });
@@ -11911,7 +11991,10 @@ async function testCommand(options = {}) {
 			const needed = /* @__PURE__ */ new Set([...sniffed.requiredEnvVars, ...result.declaredKeys]);
 			const filtered = {};
 			for (const [key, value] of Object.entries(finalCredentials)) if (needed.has(key)) filtered[key] = value;
-			finalCredentials = filtered;
+			finalCredentials = {
+				...filtered,
+				...credentials
+			};
 			console.log(`  🔍 Sniffed ${sniffed.requiredEnvVars.length} required env var(s)` + (result.declaredKeys.length > 0 ? `, kept ${result.declaredKeys.length} declared` : ""));
 		}
 	}
@@ -12005,8 +12088,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-CWSCkzu3.cjs"));
-	const { discover } = await Promise.resolve().then(() => require("./discover-BfhVW_kT.cjs")).then((n) => n.discover_exports);
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-DXVzuw-s.cjs"));
+	const { discover } = await Promise.resolve().then(() => require("./discover-Bsr7HjqJ.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
 		patterns: require_seeds.constructGlobs(workspace),
@@ -12441,7 +12524,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-CWSCkzu3.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-DXVzuw-s.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12454,7 +12537,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-CWSCkzu3.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-DXVzuw-s.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12467,7 +12550,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-CWSCkzu3.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-DXVzuw-s.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -12567,7 +12650,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-BB2tLVc2.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-C_lp7-oD.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12577,7 +12660,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CeW3xpE1.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-2KOlWvfq.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12587,7 +12670,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CeW3xpE1.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-2KOlWvfq.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12626,7 +12709,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-Dk4WHhjU.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-CjBwLvWY.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12635,7 +12718,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-Dk4WHhjU.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-CjBwLvWY.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12652,14 +12735,14 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-B1OjPwUY.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-BQfq48xK.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-CtlqYRlN.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-D7FyFbeC.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -12679,8 +12762,8 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-Cz8F9xSB.cjs")).then((n) => n.rollback_exports);
-		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-CsQz4oT0.cjs"));
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-dkinZaOv.cjs")).then((n) => n.rollback_exports);
+		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-D_NRPW4W.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -12713,7 +12796,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-DWoFgxtl.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BM6afosB.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);