@geekmidas/cli 10.0.0-alpha.110 → 10.0.0-alpha.112

package/dist/index.cjs

@@ -4,25 +4,25 @@ const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_credentials = require("./credentials-Zqr3QQYB.cjs");
-const require_compose = require("./compose-DN9zySvQ.cjs");
+const require_compose = require("./compose-ByIbIrzs.cjs");
 const require_workspace = require("./workspace-BwqQnool.cjs");
-const require_dns = require("./dns-BdETzP10.cjs");
-const require_seeds = require("./seeds-DNqRA1aQ.cjs");
+const require_dns = require("./dns-C2TGXUF4.cjs");
+const require_seeds = require("./seeds-Dk8YkLkM.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-CeH7wbYt.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-BwbYTMtB.cjs");
 const require_discover = require("./discover-Bsr7HjqJ.cjs");
 const require_config = require("./config.cjs");
-const require_deploy = require("./deploy-CFvq8daZ.cjs");
+const require_deploy = require("./deploy-Dl_NavYE.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_appPorts = require("./appPorts-IW-OZmRi.cjs");
 const require_drivers = require("./drivers-GKaA6ITM.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
 const require_local = require("./local-DNhnkugT.cjs");
-const require_sniffer = require("./sniffer-DipSS8r8.cjs");
+const require_sniffer = require("./sniffer-2aK7cB2u.cjs");
 const require_credentialSchemas = require("./credentialSchemas-D_VUCDUh.cjs");
-const require_LocalStateStore = require("./LocalStateStore-Bm8Vmwjb.cjs");
+const require_LocalStateStore = require("./LocalStateStore-AtviUBky.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
 const require_ready = require("./ready-BMFjxBYA.cjs");
 let node_path = require("node:path");
@@ -57,7 +57,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.110";
+var version = "10.0.0-alpha.112";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -140,7 +140,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-DipSS8r8.cjs")).then((n) => n.dokploy_api_exports);
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-2aK7cB2u.cjs")).then((n) => n.dokploy_api_exports);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2180,7 +2180,7 @@ async function execCommand(commandArgs, options = {}, stageDeps) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	if (options.stage && !require_seeds.isImageBuild()) {
-		const { execOnStage } = await Promise.resolve().then(() => require("./stage-C_y2UovO.cjs"));
+		const { execOnStage } = await Promise.resolve().then(() => require("./stage-DrCS0vKD.cjs")).then((n) => n.stage_exports);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { workspace } = await loadWorkspaceConfig(cwd);
 		if (options.stage !== workspace.stages.local) {
@@ -2753,9 +2753,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-CTqhWtev.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-CTqhWtev.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3831,7 +3831,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-B4GDxImV.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-NrtItVBp.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -4030,7 +4030,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-B4GDxImV.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-NrtItVBp.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -4116,7 +4116,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-B4GDxImV.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-NrtItVBp.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5949,25 +5949,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.110",
-	"@geekmidas/auth": "~10.0.0-alpha.110",
-	"@geekmidas/cache": "~10.0.0-alpha.110",
-	"@geekmidas/client": "~10.0.0-alpha.110",
-	"@geekmidas/cloud": "~10.0.0-alpha.110",
-	"@geekmidas/constructs": "~10.0.0-alpha.110",
-	"@geekmidas/db": "~10.0.0-alpha.110",
-	"@geekmidas/emailkit": "~10.0.0-alpha.110",
-	"@geekmidas/envkit": "~10.0.0-alpha.110",
-	"@geekmidas/errors": "~10.0.0-alpha.110",
-	"@geekmidas/events": "~10.0.0-alpha.110",
-	"@geekmidas/logger": "~10.0.0-alpha.110",
-	"@geekmidas/manifest": "~10.0.0-alpha.110",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.110",
-	"@geekmidas/schema": "~10.0.0-alpha.110",
-	"@geekmidas/services": "~10.0.0-alpha.110",
-	"@geekmidas/storage": "~10.0.0-alpha.110",
-	"@geekmidas/telescope": "~10.0.0-alpha.110",
-	"@geekmidas/testkit": "~10.0.0-alpha.110",
+	"@geekmidas/audit": "~10.0.0-alpha.112",
+	"@geekmidas/auth": "~10.0.0-alpha.112",
+	"@geekmidas/cache": "~10.0.0-alpha.112",
+	"@geekmidas/client": "~10.0.0-alpha.112",
+	"@geekmidas/cloud": "~10.0.0-alpha.112",
+	"@geekmidas/constructs": "~10.0.0-alpha.112",
+	"@geekmidas/db": "~10.0.0-alpha.112",
+	"@geekmidas/emailkit": "~10.0.0-alpha.112",
+	"@geekmidas/envkit": "~10.0.0-alpha.112",
+	"@geekmidas/errors": "~10.0.0-alpha.112",
+	"@geekmidas/events": "~10.0.0-alpha.112",
+	"@geekmidas/logger": "~10.0.0-alpha.112",
+	"@geekmidas/manifest": "~10.0.0-alpha.112",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.112",
+	"@geekmidas/schema": "~10.0.0-alpha.112",
+	"@geekmidas/services": "~10.0.0-alpha.112",
+	"@geekmidas/storage": "~10.0.0-alpha.112",
+	"@geekmidas/telescope": "~10.0.0-alpha.112",
+	"@geekmidas/testkit": "~10.0.0-alpha.112",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7160,7 +7160,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "1175be1a09457cf9cf3bfb9add2c61969c829df8", version = cliVersion()) {
+function stagesActionUses(commit = "4f82632d8355cb858b895c3caf36228e040d39b0", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -7764,6 +7764,133 @@ function generateGithubFiles(options) {
 	return files;
 }
 //#endregion
+//#region src/mobile/easWorkflow.ts
+/**
+* A stage's EAS workflow (`.eas/workflows/publish-<stage>.yml`): what
+* `gkm publish` does, run by EAS itself — so shipping the app needs no CI
+* of the project's own, no runner and no token in GitHub.
+*
+* Per platform: the native code's fingerprint, read with the stage's EAS
+* environment; a finished store build of the stage's profile with that
+* fingerprint; then an update on the stage's channel when there is one, or
+* a store build, submitted with the stage's submit profile, when there is
+* not. iOS is submitted once `submit.<stage>.ios.ascAppId` is set — until
+* then it is built and not submitted.
+*
+* It runs when the stage is deployed: the protected stage on a release tag
+* (`v*`), every other deployed stage on a push to `main` — and on demand,
+* `eas workflow:run .eas/workflows/publish-<stage>.yml`. The values a build
+* reads are the stage's EAS environment, which `gkm eas:sync` keeps.
+*
+* Generated: written by `gkm eas:sync`, and overwritten by the next one.
+*/
+/** Where a stage's workflow is written, relative to the app. */
+function easWorkflowPath(stage) {
+	return `.eas/workflows/publish-${stage}.yml`;
+}
+/** The stage's EAS workflow, as YAML. */
+function easWorkflow(stage, options) {
+	const profile = stage.stage;
+	const jobs = { fingerprint: {
+		name: "Fingerprint",
+		type: "fingerprint",
+		environment: stage.environment
+	} };
+	for (const platform of ["android", "ios"]) {
+		const existing = `get_${platform}_build`;
+		const build = `build_${platform}`;
+		const name = platform === "ios" ? "iOS" : "Android";
+		jobs[existing] = {
+			name: `Find an ${name} store build with this native code`,
+			needs: ["fingerprint"],
+			type: "get-build",
+			params: {
+				fingerprint_hash: `\${{ needs.fingerprint.outputs.${platform}_fingerprint_hash }}`,
+				profile,
+				platform,
+				distribution: "store"
+			}
+		};
+		jobs[build] = {
+			name: `Build ${name}`,
+			needs: [existing],
+			if: `\${{ !needs.${existing}.outputs.build_id }}`,
+			type: "build",
+			params: {
+				platform,
+				profile
+			}
+		};
+		if (platform === "android" || options.iosSubmits) jobs[`submit_${platform}`] = {
+			name: `Submit ${name}`,
+			needs: [build],
+			type: "submit",
+			params: {
+				build_id: `\${{ needs.${build}.outputs.build_id }}`,
+				profile
+			}
+		};
+		jobs[`update_${platform}`] = {
+			name: `Update ${name} on '${stage.channel}'`,
+			needs: [existing],
+			if: `\${{ needs.${existing}.outputs.build_id }}`,
+			type: "update",
+			environment: stage.environment,
+			params: {
+				platform,
+				channel: stage.channel
+			}
+		};
+	}
+	return `${[
+		`# Generated by \`gkm eas:sync --stage ${stage.stage}\`: run it again rather than`,
+		"# editing this file. An update when a store build has this native code,",
+		`# a store build submitted to the stores when none does. Run by hand:`,
+		`#   eas workflow:run ${easWorkflowPath(stage.stage)}`,
+		""
+	].join("\n")}${(0, yaml.stringify)({
+		name: `Publish to ${stage.stage}`,
+		on: options.release ? { push: { tags: ["v*"] } } : { push: { branches: ["main"] } },
+		jobs
+	}, { lineWidth: 0 })}`;
+}
+//#endregion
+//#region src/mobile/stage.ts
+/** A `MobileApp`'s `stages` names a stage the project does not deploy. */
+var MobileAppStageUndeclared = class extends require_errors.GkmError {
+	app;
+	stage;
+	deployed;
+	constructor(app, stage, deployed) {
+		super(`'${app}' says how the stage '${stage}' ships it, and '${stage}' is not a deployed stage (gkm.config.ts deploys ${deployed.join(", ") || "nothing"}). Rename it in the MobileApp's stages, or add it to stages.deployed.`);
+		this.app = app;
+		this.stage = stage;
+		this.deployed = deployed;
+		this.name = "MobileAppStageUndeclared";
+	}
+};
+/**
+* `stage`'s way of shipping `app`.
+*
+* @throws {MobileAppStageUndeclared} when the app's `stages` names a stage
+*   the workspace does not deploy
+*/
+function mobileStage(workspace, app, stage) {
+	const { deployed } = workspace.stages;
+	for (const named of Object.keys(app.stages ?? {})) if (!deployed.includes(named)) throw new MobileAppStageUndeclared(app.id, named, deployed);
+	const users = workspace.stages.protected?.includes(stage) ?? false;
+	const given = app.stages?.[stage];
+	return {
+		stage,
+		environment: given?.environment ?? (users ? "production" : "preview"),
+		channel: stage,
+		android: {
+			track: given?.android?.track ?? (users ? "production" : "internal"),
+			releaseStatus: given?.android?.releaseStatus ?? "draft"
+		}
+	};
+}
+//#endregion
 //#region src/init/generators/mobile-expo.ts
 /**
 * The fullstack template's mobile app, when it has one (`mobileApp`).
@@ -7903,6 +8030,14 @@ export default function expoConfig({ config: base }: ConfigContext): ExpoConfig
   };
 }
 `;
+	const mobile = {
+		kind: "mobile-app",
+		id: "App",
+		variant: "expo",
+		app: { path: "apps/app" },
+		dependencies: []
+	};
+	const stages = options.stages.deployed.map((stage) => mobileStage({ stages: options.stages }, mobile, stage));
 	const easJson = {
 		cli: {
 			version: ">= 10.2.1",
@@ -7914,25 +8049,16 @@ export default function expoConfig({ config: base }: ConfigContext): ExpoConfig
 				distribution: "internal",
 				environment: "development"
 			},
-			preview: {
-				distribution: "internal",
-				environment: "preview",
-				env: {
-					APP_SCHEME: scheme,
-					EXPO_PUBLIC_API_URL: "https://api.example.com",
-					EXPO_PUBLIC_AUTH_URL: "https://auth.example.com"
-				}
-			},
-			production: {
+			...Object.fromEntries(stages.map((stage) => [stage.stage, {
 				autoIncrement: true,
-				environment: "production",
-				env: {
-					APP_SCHEME: scheme,
-					EXPO_PUBLIC_API_URL: "https://api.example.com",
-					EXPO_PUBLIC_AUTH_URL: "https://auth.example.com"
-				}
-			}
-		}
+				environment: stage.environment,
+				channel: stage.channel
+			}]))
+		},
+		submit: Object.fromEntries(stages.map((stage) => [stage.stage, { android: {
+			track: stage.android.track,
+			releaseStatus: stage.android.releaseStatus
+		} }]))
 	};
 	const babelConfig = `module.exports = function (api) {
   api.cache(true);
@@ -8647,6 +8773,35 @@ export default function SigningInScreen() {
     </SafeAreaView>
   );
 }
+`;
+	const appConstructTs = `import { MobileApp } from '@geekmidas/constructs/mobile-app';
+import { api } from './api.ts';
+import { auth } from './auth.ts';
+import { email } from './email.ts';
+
+/**
+ * The mobile app — a construct like a site, which is what makes it an app.
+ *
+ * \`.dependsOn()\` is the single fact behind what a mobile app otherwise has
+ * written down by hand: its API and auth URLs, its URL scheme, the scheme in
+ * the auth server's trusted origins, Better Auth's Expo plugin, sign-in links
+ * a phone can open — and, on a local stage, the mailer's inbox, so a link sent
+ * in development is read on the device.
+ */
+export const app = new MobileApp('App', { path: 'apps/app' }).dependsOn([
+  api,
+  auth,
+  email,
+]);
+`;
+	const gitignore = `node_modules/
+.expo/
+dist/
+*.log
+.env*.local
+ios/
+android/
+.eas/
 `;
 	return [
 		{
@@ -8661,6 +8816,13 @@ export default function SigningInScreen() {
 			path: "apps/app/eas.json",
 			content: `${JSON.stringify(easJson, null, 2)}\n`
 		},
+		...stages.map((stage) => ({
+			path: `apps/app/${easWorkflowPath(stage.stage)}`,
+			content: easWorkflow(stage, {
+				release: options.stages.protected?.includes(stage.stage) ?? false,
+				iosSubmits: false
+			})
+		})),
 		{
 			path: "apps/app/babel.config.js",
 			content: babelConfig
@@ -8751,38 +8913,11 @@ export default function SigningInScreen() {
 		},
 		{
 			path: "apps/app/.gitignore",
-			content: `node_modules/
-.expo/
-dist/
-*.log
-.env*.local
-ios/
-android/
-.eas/
-`
+			content: gitignore
 		},
 		{
 			path: "constructs/app.ts",
-			content: `import { MobileApp } from '@geekmidas/constructs/mobile-app';
-import { api } from './api.ts';
-import { auth } from './auth.ts';
-import { email } from './email.ts';
-
-/**
- * The mobile app — a construct like a site, which is what makes it an app.
- *
- * \`.dependsOn()\` is the single fact behind what a mobile app otherwise has
- * written down by hand: its API and auth URLs, its URL scheme, the scheme in
- * the auth server's trusted origins, Better Auth's Expo plugin, sign-in links
- * a phone can open — and, on a local stage, the mailer's inbox, so a link sent
- * in development is read on the device.
- */
-export const app = new MobileApp('App', { path: 'apps/app' }).dependsOn([
-  api,
-  auth,
-  email,
-]);
-`
+			content: appConstructTs
 		}
 	];
 }
@@ -15860,7 +15995,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-CTqhWtev.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-Bsr7HjqJ.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -16280,6 +16415,42 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		exitWithError(error);
 	}
 });
+program.command("eas:sync").description("Set up a mobile app's EAS project for a deployed stage: its eas.json profiles, and its public values in the stage's EAS environment").requiredOption("--stage <stage>", "A deployed compose stage").option("--app <app>", "The mobile app (default: the one here, or the only one)").option("--profile <profile>", "AWS profile for the stage's account").option("--dry-run", "Say what would be written, and write nothing").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { easSync } = await Promise.resolve().then(() => require("./eas-Cne743nQ.cjs"));
+		await easSync(options);
+	} catch (error) {
+		exitWithError(error);
+	}
+});
+program.command("publish").description("Ship a mobile app for a deployed stage: sync its EAS project, then an update when a store build has its native code, a store build submitted to the stores when none does").requiredOption("--stage <stage>", "A deployed compose stage").option("--app <app>", "The mobile app (default: the one here, or the only one)").option("--platform <platform>", "ios, android or all", "all").option("--build", "A store build, whatever the fingerprint says").option("--update", "An update, whatever the fingerprint says").option("--wait", "Wait for a build to finish, and submit, on EAS").option("--message <message>", "An update's message (default: the commit's subject)").option("--profile <profile>", "AWS profile for the stage's account").option("--dry-run", "Say what would be released, and release nothing").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { publish, PublishModeConflict } = await Promise.resolve().then(() => require("./publish-SDG1WfYn.cjs"));
+		if (options.build && options.update) throw new PublishModeConflict();
+		const { build, update, ...rest } = options;
+		await publish({
+			...rest,
+			...build ? { mode: "build" } : {},
+			...update ? { mode: "update" } : {}
+		});
+	} catch (error) {
+		exitWithError(error);
+	}
+});
+program.command("deploy:google-play").description("Let EAS Submit publish a mobile app to Google Play: a service account with a grant on the app alone, its key in EAS, each stage's track in eas.json, and the store listing from store/play/").option("--developer <id>", "The Play developer account (the number in Play Console's address)").option("--app <app>", "The mobile app (default: the one here, or the only one)").option("--project <project>", "The Google Cloud project (default: <workspace>-play, created when absent)").option("--stage <stage>", "The stage whose values evaluate the app's Expo config (default: the protected one)").option("--profile <profile>", "AWS profile for that stage's account").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { deployGooglePlay } = await Promise.resolve().then(() => require("./googlePlay-B6uiHi65.cjs"));
+		await deployGooglePlay(options);
+	} catch (error) {
+		exitWithError(error);
+	}
+});
 program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile, migrate and seed the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").option("--teardown", "Drop the test stage's databases the last setup created, then stop — what @geekmidas/cli/vitest runs when the suite ends").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();
@@ -16296,7 +16467,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-CTqhWtev.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16309,7 +16480,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-CTqhWtev.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16322,7 +16493,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-CTqhWtev.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16422,7 +16593,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-Cdg1kEqN.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-Cs8yT5iH.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16432,7 +16603,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-DVCxD-gV.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-DoVnVU82.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16442,7 +16613,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-DVCxD-gV.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-DoVnVU82.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16481,7 +16652,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-DNqRA1aQ.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-Dk8YkLkM.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -16490,7 +16661,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-DNqRA1aQ.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-Dk8YkLkM.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16507,14 +16678,14 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-Df81ew0k.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-GLBZlrlJ.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-BZYz55tO.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-CHzpFBh-.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -16534,7 +16705,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-CBiYsQ3T.cjs")).then((n) => n.rollback_exports);
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-Cw-Z0mWn.cjs")).then((n) => n.rollback_exports);
 		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-D_NRPW4W.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -16568,7 +16739,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-D902Vwr9.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-DDOHjdS9.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16748,8 +16919,11 @@ try {
 program.parse();
 //#endregion
 exports.canPrompt = canPrompt;
+exports.easWorkflow = easWorkflow;
+exports.easWorkflowPath = easWorkflowPath;
 exports.formatError = formatError;
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
+exports.mobileStage = mobileStage;
 exports.prompt = prompt;
 exports.slug = slug;
 exports.stamp = stamp;