@geekmidas/cli 10.0.0-alpha.102 → 10.0.0-alpha.104

package/dist/index.mjs

@@ -3,27 +3,27 @@ import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mj
 import { n as isGkmError, t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs";
 import { a as getDokployCredentials, d as removeGoDaddyCredentials, f as storeDokployCredentials, i as getCredentialsPath, l as readCredentials, m as storeHostingerToken, o as getDokployRegistryId, p as storeGoDaddyToken, s as getDokployToken, u as removeDokployCredentials } from "./credentials-B5N5yKk6.mjs";
-import { _ as sshTarget, a as stackOverrideFile, c as composeProject, d as stackPlan, f as EDGE_PROJECT, g as dockerHost, h as composeServer, i as ComposePushNeedsBuild, l as derivedCredentials, m as pinnedRef, o as edgeRef, p as parseDigests, r as ComposePinNeedsPull, s as removeEdgeRoutes, t as composeTarget, u as stackDir, v as dockerCompose, y as projectNetwork } from "./compose-FDP_TaFt.mjs";
+import { _ as sshTarget, a as stackOverrideFile, c as composeProject, d as stackPlan, f as EDGE_PROJECT, g as dockerHost, h as composeServer, i as ComposePushNeedsBuild, l as derivedCredentials, m as pinnedRef, o as edgeRef, p as parseDigests, r as ComposePinNeedsPull, s as removeEdgeRoutes, t as composeTarget, u as stackDir, v as dockerCompose, y as projectNetwork } from "./compose-B8ND6s9C.mjs";
 import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-D1QbNd55.mjs";
-import { b as runTime, d as BACKUPS_URL_KEY, f as RUNNER_PATH, g as backupDatabases, u as BACKUPS_SERVICE, v as backupFile, x as stageBackups, y as backupsPrefix } from "./dns-DDDCfj75.mjs";
-import { An as scopeTelemetryEnv, At as isPortAvailable, Bn as portsOf, Bt as maskPassword, Ct as cacheBackendFor, Dt as createCredentialsPreload, G as CronGenerator, H as workerBundleName, Hn as primaryPortKey, Ht as toEmbeddableSecrets, It as secretsStoreFor, L as dockerCommand, Ln as describeServices, Mn as telemetryOf, Mt as loadPortState, Nt as loadSecretsForApp, On as appTelemetry, Ot as createEntryWrapper, Pt as prepareEntryCredentials, Q as assertDevServicesFlag, Qt as workerUnits, Rn as fakeKey, Tn as TELEMETRY_CONTAINER, Tt as providerOf, U as workerEntryDir, Un as LOCAL_LOGS_EMAIL, Ut as withCustomSecret, V as WorkerGenerator, W as QueueGenerator, Xt as imageBuildCredentials, Zt as isImageBuild, a as dnsResources, an as quoteIdentifier, bt as pgClient, c as describeActor, dn as FileSecretsStore, dt as constructGlobs, fn as getKeyPath, ft as derivedContainers, gt as forgetState, ht as LOCAL_CA_PATH, jn as surfaceClientTraced, jt as loadEnvFiles, kt as findAvailablePort, lt as FAKE_ENV, mn as projectKey, pt as reconcileWorkspace, rn as postgresDatabaseNames, un as readLocalCredentials, ut as backendsOf$1, wt as eventsBackendFor, xt as CLUSTER_DATABASE } from "./seeds-BHKUAExH.mjs";
+import { b as runTime, d as BACKUPS_URL_KEY, f as RUNNER_PATH, g as backupDatabases, u as BACKUPS_SERVICE, v as backupFile, x as stageBackups, y as backupsPrefix } from "./dns-BQrhafpk.mjs";
+import { $t as workerUnits, At as isPortAvailable, Bt as maskPassword, Ct as cacheBackendFor, Dt as createCredentialsPreload, En as TELEMETRY_CONTAINER, G as CronGenerator, H as workerBundleName, Ht as toEmbeddableSecrets, It as secretsStoreFor, L as dockerCommand, Mn as surfaceClientTraced, Mt as loadPortState, Nn as telemetryOf, Nt as loadSecretsForApp, Ot as createEntryWrapper, Pt as prepareEntryCredentials, Q as assertDevServicesFlag, Qt as isUnder, Rn as describeServices, Tt as providerOf, U as workerEntryDir, Un as primaryPortKey, Ut as withCustomSecret, V as WorkerGenerator, Vn as portsOf, W as QueueGenerator, Wn as LOCAL_LOGS_EMAIL, Xt as imageBuildCredentials, Zt as isImageBuild, a as dnsResources, bt as pgClient, c as describeActor, dn as readLocalCredentials, dt as constructGlobs, fn as FileSecretsStore, ft as derivedContainers, gt as forgetState, hn as projectKey, ht as LOCAL_CA_PATH, in as postgresDatabaseNames, jn as scopeTelemetryEnv, jt as loadEnvFiles, kn as appTelemetry, kt as findAvailablePort, lt as FAKE_ENV, on as quoteIdentifier, pn as getKeyPath, pt as reconcileWorkspace, ut as backendsOf$1, wt as eventsBackendFor, xt as CLUSTER_DATABASE, zn as fakeKey } from "./seeds-DZGuovWF.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-1-IsjIwF.mjs";
+import { l as isCacheBackend, n as assertTestCredentials, t as SubscriberGenerator } from "./SubscriberGenerator-DHnIYwUU.mjs";
 import { n as deployIdentity } from "./identity-CBXr4wNi.mjs";
-import { a as startTelemetryCode, c as parseTelemetryFlag, i as routeTelemetry, n as runtimeFor, o as telemetryFor, r as mountRequestSpansCode, s as writeTelemetryModule, t as EndpointGenerator } from "./EndpointGenerator-Br97xgs_.mjs";
-import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-kziEht4W.mjs";
+import { a as startTelemetryCode, c as parseTelemetryFlag, i as routeTelemetry, n as runtimeFor, o as telemetryFor, r as mountRequestSpansCode, s as writeTelemetryModule, t as EndpointGenerator } from "./EndpointGenerator-CvLX8bpx.mjs";
+import { d as ConstructGenerator, i as discover, r as consumedBy, u as withOwningTsconfigJsx } from "./discover-Ca8U75dl.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { d as awsEndpoint, f as awsProvisioningCredentials, t as deploy$1, u as awsClientConfig } from "./deploy-DgZxTnGS.mjs";
+import { d as awsEndpoint, f as awsProvisioningCredentials, t as deploy$1, u as awsClientConfig } from "./deploy-yLGEWuam.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-C08LL4E8.mjs";
+import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-D11JHxrD.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
 import { t as LocalSandbox } from "./local-BwC2v2Y8.mjs";
-import { S as createStateStore, k as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-CaXl51vO.mjs";
-import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-DvitraL-.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-FVsg0UoM.mjs";
+import { S as createStateStore, k as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-bo0KeZsK.mjs";
+import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-Cf5Pf8VE.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-wSKMDDh5.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
-import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-CzHNHhI6.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-CVNE5Pix.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Command, Option } from "commander";
@@ -35,7 +35,7 @@ import { homedir } from "node:os";
 import { execFile, execSync, spawn } from "node:child_process";
 import { connect } from "node:net";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { canonicalId, kebabCase, migrationFolder, provideKey, schemeBase, serviceKey } from "@geekmidas/manifest";
+import { canonicalId, dependenciesOf, kebabCase, migrationFolder, provideKey, schemeBase, serviceKey } from "@geekmidas/manifest";
 import { pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import fg from "fast-glob";
@@ -51,7 +51,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.102";
+var version = "10.0.0-alpha.104";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -134,7 +134,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-CaXl51vO.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-bo0KeZsK.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2347,7 +2347,8 @@ async function devCommand(options) {
 		skipBundle: true,
 		bustCache,
 		serveEmpty: true,
-		workspaceName: workspace.name
+		workspaceName: workspace.name,
+		workspace
 	}));
 	logger$5.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
 	const initial = await build();
@@ -2375,8 +2376,9 @@ async function devCommand(options) {
 			}
 		}
 		Object.assign(appSecrets, reconciled.env);
+		const declared = reconciled.manifest;
 		const scoped = scopeTelemetryEnv(appSecrets, {
-			uses: reconciled.manifest !== void 0 && appTelemetry(reconciled.manifest, workspaceAppName) !== void 0,
+			uses: declared !== void 0 && (appTelemetry(declared, workspaceAppName) !== void 0 || (initial.workers ?? []).some((id) => telemetryOf(declared, id) !== void 0)),
 			serviceName: workspaceAppName,
 			telemetry: reconciled.env
 		});
@@ -2728,9 +2730,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-DIVxoju6.mjs");
+		const { prepareDevDatabases } = await import("./migrate-CQal4P1q.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-DIVxoju6.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-CQal4P1q.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3466,6 +3468,29 @@ function restApis(declared) {
 function servedSurface(declared, workspaceRoot, appRoot) {
 	return restApis(declared).find((d) => resolve(workspaceRoot, d.path) === resolve(appRoot));
 }
+/**
+* The declarations one process reaches: the constructs it runs as — a surface,
+* a worker — what each declared an edge to, and what each runnable it runs
+* depends on or consumes.
+*
+* What decides which drivers its entry registers: a process that reaches no
+* cache never resolves a cache client because another process in the
+* workspace does.
+*/
+function reachedBy(declared, processes, runnables) {
+	const reached = /* @__PURE__ */ new Set();
+	for (const id of processes) {
+		const declaration = declared[id];
+		if (!declaration) continue;
+		reached.add(id);
+		for (const edge of dependenciesOf(declaration)) reached.add(edge.target);
+	}
+	for (const { construct } of runnables) {
+		for (const id of construct.constructs ?? []) reached.add(canonicalId(id));
+		for (const id of consumedBy(construct)) reached.add(id);
+	}
+	return Object.fromEntries(Object.entries(declared).filter(([id]) => reached.has(id)));
+}
 //#endregion
 //#region src/build/surfaceEntry.ts
 /** Whether a construct serves itself, asked of the construct. */
@@ -3783,7 +3808,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await import("./bundler-CHjRYVKh.mjs");
+			const { bundleServer } = await import("./bundler-DVPoeMRa.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3803,7 +3828,6 @@ async function buildApp(input) {
 		appRoot,
 		databaseApi
 	});
-	const eventsBackends = eventsBackendsIn(declared, eventsBackend);
 	const buildContext = {
 		...derived,
 		telescope,
@@ -3812,12 +3836,6 @@ async function buildApp(input) {
 		constructGlobs,
 		cacheBackend,
 		emailBackend: "ses",
-		storageDrivers: driversFor({
-			appRoot,
-			cache: cacheBackendsIn(declared, cacheBackend),
-			events: eventsBackends
-		}),
-		eventsBackends,
 		markOptional: input.markOptional ?? false
 	};
 	const endpointGenerator = new EndpointGenerator();
@@ -3836,8 +3854,39 @@ async function buildApp(input) {
 		topicGenerator.load(code, appRoot, bustCache)
 	]);
 	const allEndpoints = servedBy(loadedEndpoints, derived.surface);
+	const appName = appNameOf(input);
+	const hosted = workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName);
+	const hostedIds = new Set(hosted.map((unit) => unit.id));
+	const appRootAbs = resolve(appRoot);
+	const hostedHere = (list) => list.filter(({ construct, path }) => construct.owner !== void 0 ? hostedIds.has(construct.owner) : isUnder(path.absolute, appRootAbs));
+	const hostedCrons = hostedHere(allCrons);
+	const hostedQueues = hostedHere(allQueues);
+	const hostedSubscribers = hostedHere(allSubscribers);
+	const servesOnly = Boolean(production?.enabled && derived.surface);
+	const inProcess = servesOnly ? {
+		crons: [],
+		queues: [],
+		subscribers: []
+	} : {
+		crons: hostedCrons,
+		queues: hostedQueues,
+		subscribers: hostedSubscribers
+	};
+	const reach = derived.surface ? reachedBy(declared, [derived.surface.id, ...servesOnly ? [] : hosted.map((unit) => unit.id)], [
+		...allEndpoints,
+		...allFunctions,
+		...inProcess.crons,
+		...inProcess.queues,
+		...inProcess.subscribers
+	]) : declared;
+	Object.assign(buildContext, runtimeDrivers({
+		appRoot,
+		reach,
+		cacheBackend,
+		eventsBackend
+	}));
 	if (target === "server") buildContext.telemetry = telemetryFor({
-		node: derived.surface ? telemetryOf(declared, derived.surface.id) : void 0,
+		node: processTelemetry(declared, derived.surface?.id, servesOnly ? [] : hosted.map((unit) => unit.id)),
 		appRoot,
 		app: appNameOf(input),
 		cwd: workspaceRoot,
@@ -3855,40 +3904,37 @@ async function buildApp(input) {
 		logger$4.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
-	if (production?.subscribers === "include" && derived.surface) {
-		buildContext.production = {
-			...production,
-			subscribers: "exclude"
-		};
-		const left = [
-			[allCrons.length, "cron"],
-			[allQueues.length, "queue consumer"],
-			[allSubscribers.length, "subscriber"]
-		].filter(([n]) => n > 0).map(([n, what]) => `${n} ${what}${n === 1 ? "" : "s"}`);
-		if (left.length > 0) logger$4.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
-	}
-	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
-	if (target === "server" && production?.enabled && input.workspace) {
-		const appName = Object.entries(input.workspace.apps).find(([, app]) => resolve(input.workspace.root, app.path) === resolve(appRoot))?.[0];
-		await buildWorkers({
-			context: buildContext,
-			telemetry: (workerId) => telemetryFor({
-				node: telemetryOf(declared, workerId),
+	if (servesOnly && production) buildContext.production = {
+		...production,
+		subscribers: "exclude"
+	};
+	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, inProcess.crons, inProcess.subscribers, inProcess.queues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
+	if (target === "server" && production?.enabled) await buildWorkers({
+		context: (workerId, work) => ({
+			...buildContext,
+			...runtimeDrivers({
 				appRoot,
-				app: appNameOf(input),
-				cwd: workspaceRoot,
-				serviceName: workerId,
-				...input.workspaceName && { workspaceName: input.workspaceName }
-			}),
-			workers: workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName),
-			serverDir: join(appRoot, ".gkm", "server"),
-			crons: allCrons,
-			queues: allQueues,
-			subscribers: allSubscribers,
-			bundle: Boolean(production.bundle && !input.skipBundle),
-			...input.stage ? { stage: input.stage } : {}
-		});
-	}
+				reach: reachedBy(declared, [workerId], work),
+				cacheBackend,
+				eventsBackend
+			})
+		}),
+		telemetry: (workerId) => telemetryFor({
+			node: telemetryOf(declared, workerId),
+			appRoot,
+			app: appNameOf(input),
+			cwd: workspaceRoot,
+			serviceName: workerId,
+			...input.workspaceName && { workspaceName: input.workspaceName }
+		}),
+		workers: hosted,
+		serverDir: join(appRoot, ".gkm", "server"),
+		crons: hostedCrons,
+		queues: hostedQueues,
+		subscribers: hostedSubscribers,
+		bundle: Boolean(production.bundle && !input.skipBundle),
+		...input.stage ? { stage: input.stage } : {}
+	});
 	await generateOpenApi(allEndpoints.map(({ construct }) => construct), {
 		openapi: config.openapi,
 		root: workspaceRoot,
@@ -3902,7 +3948,35 @@ async function buildApp(input) {
 	});
 	return {
 		...result,
-		...buildContext.databaseApi ? { databaseApi: buildContext.databaseApi.path } : {}
+		...buildContext.databaseApi ? { databaseApi: buildContext.databaseApi.path } : {},
+		...!servesOnly && hosted.length > 0 ? { workers: hosted.map((unit) => unit.id) } : {}
+	};
+}
+/**
+* The `Telemetry` node a process emits through: its surface's, or — where it
+* runs a worker's work, under `gkm dev` — that worker's.
+*/
+function processTelemetry(declared, surfaceId, workers) {
+	for (const id of [...surfaceId ? [surfaceId] : [], ...workers]) {
+		const node = telemetryOf(declared, id);
+		if (node) return node;
+	}
+}
+/**
+* The drivers a process's entry registers, from the declarations it reaches:
+* the cache's — the declaration for one that named its database, the deploy
+* target's default for one that named nowhere — and the broker's, only when
+* it reaches a topic or a queue (see `eventsBackendsIn`).
+*/
+function runtimeDrivers(options) {
+	const eventsBackends = eventsBackendsIn(options.reach, options.eventsBackend);
+	return {
+		storageDrivers: driversFor({
+			appRoot: options.appRoot,
+			cache: cacheBackendsIn(options.reach, options.cacheBackend),
+			events: eventsBackends
+		}),
+		eventsBackends
 	};
 }
 /**
@@ -3917,8 +3991,13 @@ async function buildWorkers(input) {
 		const queues = owned(input.queues);
 		const subscribers = owned(input.subscribers);
 		const telemetry = input.telemetry(worker.id);
+		const context = input.context(worker.id, [
+			...crons,
+			...queues,
+			...subscribers
+		]);
 		const entryPoint = await generator.build({
-			context: input.context,
+			context,
 			workerId: worker.id,
 			...telemetry ? { telemetry } : {},
 			outputDir: workerEntryDir(input.serverDir, worker.id),
@@ -3928,15 +4007,15 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-CHjRYVKh.mjs");
+		const { bundleServer } = await import("./bundler-DVPoeMRa.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
 			outputDir: join(input.serverDir, "dist"),
 			outfile,
-			minify: input.context.production?.minify ?? false,
+			minify: context.production?.minify ?? false,
 			sourcemap: false,
-			external: input.context.production?.external ?? [],
+			external: context.production?.external ?? [],
 			...input.stage ? { stage: input.stage } : {},
 			constructs: [
 				...crons,
@@ -4014,7 +4093,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-CHjRYVKh.mjs");
+			const { bundleServer } = await import("./bundler-DVPoeMRa.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5842,25 +5921,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.102",
-	"@geekmidas/auth": "~10.0.0-alpha.102",
-	"@geekmidas/cache": "~10.0.0-alpha.102",
-	"@geekmidas/client": "~10.0.0-alpha.102",
-	"@geekmidas/cloud": "~10.0.0-alpha.102",
-	"@geekmidas/constructs": "~10.0.0-alpha.102",
-	"@geekmidas/db": "~10.0.0-alpha.102",
-	"@geekmidas/emailkit": "~10.0.0-alpha.102",
-	"@geekmidas/envkit": "~10.0.0-alpha.102",
-	"@geekmidas/errors": "~10.0.0-alpha.102",
-	"@geekmidas/events": "~10.0.0-alpha.102",
-	"@geekmidas/logger": "~10.0.0-alpha.102",
-	"@geekmidas/manifest": "~10.0.0-alpha.102",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.102",
-	"@geekmidas/schema": "~10.0.0-alpha.102",
-	"@geekmidas/services": "~10.0.0-alpha.102",
-	"@geekmidas/storage": "~10.0.0-alpha.102",
-	"@geekmidas/telescope": "~10.0.0-alpha.102",
-	"@geekmidas/testkit": "~10.0.0-alpha.102",
+	"@geekmidas/audit": "~10.0.0-alpha.104",
+	"@geekmidas/auth": "~10.0.0-alpha.104",
+	"@geekmidas/cache": "~10.0.0-alpha.104",
+	"@geekmidas/client": "~10.0.0-alpha.104",
+	"@geekmidas/cloud": "~10.0.0-alpha.104",
+	"@geekmidas/constructs": "~10.0.0-alpha.104",
+	"@geekmidas/db": "~10.0.0-alpha.104",
+	"@geekmidas/emailkit": "~10.0.0-alpha.104",
+	"@geekmidas/envkit": "~10.0.0-alpha.104",
+	"@geekmidas/errors": "~10.0.0-alpha.104",
+	"@geekmidas/events": "~10.0.0-alpha.104",
+	"@geekmidas/logger": "~10.0.0-alpha.104",
+	"@geekmidas/manifest": "~10.0.0-alpha.104",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.104",
+	"@geekmidas/schema": "~10.0.0-alpha.104",
+	"@geekmidas/services": "~10.0.0-alpha.104",
+	"@geekmidas/storage": "~10.0.0-alpha.104",
+	"@geekmidas/telescope": "~10.0.0-alpha.104",
+	"@geekmidas/testkit": "~10.0.0-alpha.104",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -6261,7 +6340,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "49e00aa29d2a37c388cf8c2c67581f7d3eb1a81c", version = cliVersion()) {
+function stagesActionUses(commit = "088aa26a6c82b4916af4faddd5755e030fb459d5", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -11898,6 +11977,7 @@ async function testCommand(options = {}) {
 		secretsFileName: "test-secrets.json",
 		reconcileStage: "test"
 	});
+	const credentials = result.reconciled ? assertTestCredentials(result.secretsRoot, result.reconciled.plan, result.credentials) : {};
 	let finalCredentials = { ...result.credentials };
 	if (result.appInfo) {
 		const sniffed = await sniffAppEnvironment(result.appInfo.app, result.appInfo.appName, result.appInfo.workspaceRoot, { logWarnings: false });
@@ -11905,7 +11985,10 @@ async function testCommand(options = {}) {
 			const needed = /* @__PURE__ */ new Set([...sniffed.requiredEnvVars, ...result.declaredKeys]);
 			const filtered = {};
 			for (const [key, value] of Object.entries(finalCredentials)) if (needed.has(key)) filtered[key] = value;
-			finalCredentials = filtered;
+			finalCredentials = {
+				...filtered,
+				...credentials
+			};
 			console.log(`  🔍 Sniffed ${sniffed.requiredEnvVars.length} required env var(s)` + (result.declaredKeys.length > 0 ? `, kept ${result.declaredKeys.length} declared` : ""));
 		}
 	}
@@ -11999,8 +12082,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-DIVxoju6.mjs");
-	const { discover } = await import("./discover-kziEht4W.mjs").then((n) => n.i);
+	const { migrateAndSeed } = await import("./migrate-CQal4P1q.mjs");
+	const { discover } = await import("./discover-Ca8U75dl.mjs").then((n) => n.a);
 	const sources = {};
 	const manifest = await discover({
 		patterns: constructGlobs(workspace),
@@ -12435,7 +12518,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-DIVxoju6.mjs");
+		const { migrateCommand } = await import("./migrate-CQal4P1q.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12448,7 +12531,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-DIVxoju6.mjs");
+		const { seedCommand } = await import("./migrate-CQal4P1q.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12461,7 +12544,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-DIVxoju6.mjs");
+		const { migrationCommand } = await import("./migrate-CQal4P1q.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -12561,7 +12644,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-CIbhGE5v.mjs");
+		const { secretsAddCommand } = await import("./add-Dgdsb3ox.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12571,7 +12654,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-DC8zsh2s.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-BFs3ItV9.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12581,7 +12664,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-DC8zsh2s.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-BFs3ItV9.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12620,7 +12703,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./seeds-BHKUAExH.mjs").then((n) => n.Rt);
+		const { secretsStoreFor } = await import("./seeds-DZGuovWF.mjs").then((n) => n.Rt);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12629,7 +12712,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-BHKUAExH.mjs").then((n) => n.mt);
+		const { derivedContainers } = await import("./seeds-DZGuovWF.mjs").then((n) => n.mt);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12646,14 +12729,14 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-DoI2hWNH.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-BlLFYSIx.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
-	const { deployCli } = await import("./cli-DOlkhrsh.mjs");
+	const { deployCli } = await import("./cli-CGXOvWRP.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12673,8 +12756,8 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-CLtwbByg.mjs").then((n) => n.a);
-		const { terminalCredentials } = await import("./terminal-Bs_lNQhL.mjs");
+		const { rollbackStage } = await import("./rollback-YCj4_q9l.mjs").then((n) => n.a);
+		const { terminalCredentials } = await import("./terminal-CvRLxz6g.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12707,7 +12790,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-DJgO5z37.mjs");
+		const { deployGithubCommand } = await import("./github-DuXBKTvr.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);