@geekmidas/cli 10.0.0-alpha.113 → 10.0.0-alpha.115

package/dist/index.cjs

@@ -4,25 +4,25 @@ const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_credentials = require("./credentials-Zqr3QQYB.cjs");
-const require_compose = require("./compose-ByIbIrzs.cjs");
+const require_compose = require("./compose-CYeMW2_o.cjs");
 const require_workspace = require("./workspace-BwqQnool.cjs");
-const require_dns = require("./dns-C2TGXUF4.cjs");
-const require_seeds = require("./seeds-Dk8YkLkM.cjs");
+const require_dns = require("./dns-v9viladZ.cjs");
+const require_seeds = require("./seeds-DbKNcs3o.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-CeH7wbYt.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-BwbYTMtB.cjs");
 const require_discover = require("./discover-Bsr7HjqJ.cjs");
 const require_config = require("./config.cjs");
-const require_deploy = require("./deploy-Dl_NavYE.cjs");
+const require_deploy = require("./deploy-Q5qo1OP-.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_appPorts = require("./appPorts-IW-OZmRi.cjs");
 const require_drivers = require("./drivers-GKaA6ITM.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
 const require_local = require("./local-DNhnkugT.cjs");
-const require_sniffer = require("./sniffer-2aK7cB2u.cjs");
+const require_sniffer = require("./sniffer-B6T6za4n.cjs");
 const require_credentialSchemas = require("./credentialSchemas-D_VUCDUh.cjs");
-const require_LocalStateStore = require("./LocalStateStore-AtviUBky.cjs");
+const require_LocalStateStore = require("./LocalStateStore-CV-04jpI.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
 const require_ready = require("./ready-BMFjxBYA.cjs");
 let node_path = require("node:path");
@@ -57,7 +57,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.113";
+var version = "10.0.0-alpha.115";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -140,7 +140,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-2aK7cB2u.cjs")).then((n) => n.dokploy_api_exports);
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-B6T6za4n.cjs")).then((n) => n.dokploy_api_exports);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2180,7 +2180,7 @@ async function execCommand(commandArgs, options = {}, stageDeps) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	if (options.stage && !require_seeds.isImageBuild()) {
-		const { execOnStage } = await Promise.resolve().then(() => require("./stage-DrCS0vKD.cjs")).then((n) => n.stage_exports);
+		const { execOnStage } = await Promise.resolve().then(() => require("./stage-W3PUt7ar.cjs")).then((n) => n.stage_exports);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { workspace } = await loadWorkspaceConfig(cwd);
 		if (options.stage !== workspace.stages.local) {
@@ -2753,9 +2753,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-BYEmpoIg.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-BYEmpoIg.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3831,7 +3831,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-NrtItVBp.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-hvCgi0EG.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -4030,7 +4030,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-NrtItVBp.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-hvCgi0EG.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -4116,7 +4116,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-NrtItVBp.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-hvCgi0EG.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5839,6 +5839,7 @@ const DEPENDENCY_VERSIONS = {
 	"better-auth": "~1.7.6",
 	hono: "~4.13.9",
 	"@hono/node-server": "~1.19.17",
+	"@hono/node-ws": "~1.3.1",
 	kysely: "~0.29.6",
 	pg: "~8.23.0",
 	pino: "~10.3.1",
@@ -5949,25 +5950,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.113",
-	"@geekmidas/auth": "~10.0.0-alpha.113",
-	"@geekmidas/cache": "~10.0.0-alpha.113",
-	"@geekmidas/client": "~10.0.0-alpha.113",
-	"@geekmidas/cloud": "~10.0.0-alpha.113",
-	"@geekmidas/constructs": "~10.0.0-alpha.113",
-	"@geekmidas/db": "~10.0.0-alpha.113",
-	"@geekmidas/emailkit": "~10.0.0-alpha.113",
-	"@geekmidas/envkit": "~10.0.0-alpha.113",
-	"@geekmidas/errors": "~10.0.0-alpha.113",
-	"@geekmidas/events": "~10.0.0-alpha.113",
-	"@geekmidas/logger": "~10.0.0-alpha.113",
-	"@geekmidas/manifest": "~10.0.0-alpha.113",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.113",
-	"@geekmidas/schema": "~10.0.0-alpha.113",
-	"@geekmidas/services": "~10.0.0-alpha.113",
-	"@geekmidas/storage": "~10.0.0-alpha.113",
-	"@geekmidas/telescope": "~10.0.0-alpha.113",
-	"@geekmidas/testkit": "~10.0.0-alpha.113",
+	"@geekmidas/audit": "~10.0.0-alpha.115",
+	"@geekmidas/auth": "~10.0.0-alpha.115",
+	"@geekmidas/cache": "~10.0.0-alpha.115",
+	"@geekmidas/client": "~10.0.0-alpha.115",
+	"@geekmidas/cloud": "~10.0.0-alpha.115",
+	"@geekmidas/constructs": "~10.0.0-alpha.115",
+	"@geekmidas/db": "~10.0.0-alpha.115",
+	"@geekmidas/emailkit": "~10.0.0-alpha.115",
+	"@geekmidas/envkit": "~10.0.0-alpha.115",
+	"@geekmidas/errors": "~10.0.0-alpha.115",
+	"@geekmidas/events": "~10.0.0-alpha.115",
+	"@geekmidas/logger": "~10.0.0-alpha.115",
+	"@geekmidas/manifest": "~10.0.0-alpha.115",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.115",
+	"@geekmidas/schema": "~10.0.0-alpha.115",
+	"@geekmidas/services": "~10.0.0-alpha.115",
+	"@geekmidas/storage": "~10.0.0-alpha.115",
+	"@geekmidas/telescope": "~10.0.0-alpha.115",
+	"@geekmidas/testkit": "~10.0.0-alpha.115",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7160,7 +7161,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "18d6b7860652d3db231d361933ee2d5ec10f0941", version = cliVersion()) {
+function stagesActionUses(commit = "f1cb336edfa0ad66598783740950d96f53f1108c", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -7412,6 +7413,7 @@ function stagesJob(options) {
       has-build: \${{ steps.stages.outputs.has-build }}
       has-deploy: \${{ steps.stages.outputs.has-deploy }}
       aws-region: \${{ steps.stages.outputs.aws-region }}
+      registry: \${{ steps.stages.outputs.registry }}
     steps:
       - uses: actions/checkout@v4
 
@@ -7430,17 +7432,25 @@ ${pm.setup}
 `;
 }
 /**
-* The registry login a compose build pushes with: GitHub's own token on
-* ghcr.io, otherwise a username variable and a password secret.
+* The registry login a compose build pushes with, and a deploy pulls with.
+* The host is `deploy.registry`'s, read from gkm.config.ts by the stages
+* job at run time — never written here, so the workflow follows the config:
+* GitHub's own token on ghcr.io, otherwise the stage environment's
+* `REGISTRY_USERNAME` variable and `REGISTRY_PASSWORD` secret.
 */
-function registryLogin(registry) {
-	const host = registry.split("/")[0];
-	const ghcr = host === "ghcr.io";
-	return `      - uses: docker/login-action@v3
+function registryLogin() {
+	const ghcr = "needs.stages.outputs.registry == 'ghcr.io'";
+	return `      # deploy.registry in gkm.config.ts: GitHub's registry with this
+      # workflow's own token (the job's \`packages\` permission decides push
+      # or pull), any other with the stage's REGISTRY_USERNAME variable and
+      # REGISTRY_PASSWORD secret.
+      - name: Log in to the registry
+        if: needs.stages.outputs.registry != ''
+        uses: docker/login-action@v3
         with:
-          registry: ${host}
-          username: ${ghcr ? "${{ github.actor }}" : "${{ vars.REGISTRY_USERNAME }}"}
-          password: ${ghcr ? "${{ secrets.GITHUB_TOKEN }}" : "${{ secrets.REGISTRY_PASSWORD }}"}
+          registry: \${{ needs.stages.outputs.registry }}
+          username: \${{ ${ghcr} && github.actor || vars.REGISTRY_USERNAME }}
+          password: \${{ ${ghcr} && secrets.GITHUB_TOKEN || secrets.REGISTRY_PASSWORD }}
 `;
 }
 /**
@@ -7459,8 +7469,14 @@ function registryLogin(registry) {
 */
 function composeDeploy(options) {
 	const pm = tooling(options);
-	const registry = options.registry ?? "";
 	return `${deployHeader(true)}
+# A push to main builds main's newest commit: a later push cancels an earlier
+# push's run, so several merges in a row build once. A release or a manual
+# run shares no group (its run id is in the name), and is never cancelled.
+concurrency:
+  group: \${{ github.workflow }}-\${{ github.event_name == 'push' && github.ref || github.run_id }}
+  cancel-in-progress: \${{ github.event_name == 'push' }}
+
 jobs:
 ${stagesJob(options)}
   build:
@@ -7479,13 +7495,22 @@ ${stagesJob(options)}
       packages: write
       id-token: write
     steps:
+      # The runner's preinstalled toolchains, none of them used here: with
+      # them, building every image of a workspace runs out of disk.
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc \\
+            /usr/local/.ghcup /opt/hostedtoolcache/CodeQL
+          sudo docker image prune --all --force
+          df -h /
+
       - uses: actions/checkout@v4
 
 ${pm.setup}
       - name: Install
         run: ${pm.install}
 
-${registryLogin(registry)}
+${registryLogin()}
       # A site's public URLs are built into it, so the build reads the stage's
       # secrets store. With secrets.store on S3, SSM or Secrets Manager the job
       # assumes the stage's role (AWS_ROLE_ARN, set by gkm deploy:github);
@@ -7511,6 +7536,7 @@ ${registryLogin(registry)}
         with:
           name: digests-\${{ matrix.stage }}
           path: digests.json
+          if-no-files-found: error
           retention-days: 90
 
   deploy:
@@ -7544,8 +7570,14 @@ ${registryLogin(registry)}
             workflow_dispatch) ref="\${REF:-$SHA}" ;;
             *) ref="$SHA" ;;
           esac
-          sha=$(gh api "repos/$REPO/commits/$ref" --jq .sha)
-          echo "Deploying $sha"
+          case "$ref" in
+            ''|-*) echo "::error::Not a tag or commit: '$ref'"; exit 1 ;;
+          esac
+          if ! sha=$(gh api "repos/$REPO/commits/$ref" --jq .sha); then
+            echo "::error::'$ref' is not a tag, branch or commit in this repository"
+            exit 1
+          fi
+          echo "Deploying $ref = $sha"
           echo "sha=$sha" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: \${{ github.token }}
@@ -7566,7 +7598,7 @@ ${pm.setup}
 
       # The server's engine pulls with the login docker sends from here: it
       # holds none of its own.
-${registryLogin(registry)}
+${registryLogin()}
       # The stage's secrets and deploy state are read and written here, with
       # the stage's role (AWS_ROLE_ARN, set by gkm deploy:github). With the
       # default 'file' secrets store there is no role, and no secrets file in
@@ -10675,7 +10707,10 @@ function generatePackageJson(options, template) {
 	const devDependencies = { ...template.devDependencies };
 	const scripts = { ...template.scripts };
 	if (options.loggerType === "pino") dependencies.pino = DEPENDENCY_VERSIONS.pino;
-	if (telescope) dependencies["@geekmidas/telescope"] = GEEKMIDAS_VERSIONS["@geekmidas/telescope"];
+	if (telescope) {
+		dependencies["@geekmidas/telescope"] = GEEKMIDAS_VERSIONS["@geekmidas/telescope"];
+		dependencies["@hono/node-ws"] = DEPENDENCY_VERSIONS["@hono/node-ws"];
+	}
 	const declares = !monorepo;
 	if (declares && (database || uploads || cache || mail)) dependencies["@geekmidas/manifest"] = GEEKMIDAS_VERSIONS["@geekmidas/manifest"];
 	if (declares && uploads) dependencies["@geekmidas/storage"] = GEEKMIDAS_VERSIONS["@geekmidas/storage"];
@@ -13046,6 +13081,7 @@ export default function RootLayout({
 `;
 	const pages = app.key === "admin" ? adminPages() : webPages(options);
 	const gitignore = `.next/
+next-env.d.ts
 node_modules/
 .env.local
 *.log
@@ -15996,7 +16032,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-BYEmpoIg.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-Bsr7HjqJ.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -16420,7 +16456,7 @@ program.command("eas:sync").description("Set up a mobile app's EAS project for a
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { easSync } = await Promise.resolve().then(() => require("./eas-Cne743nQ.cjs"));
+		const { easSync } = await Promise.resolve().then(() => require("./eas-CIvNT6qa.cjs"));
 		await easSync(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16430,7 +16466,7 @@ program.command("publish").description("Ship a mobile app for a deployed stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { publish, PublishModeConflict } = await Promise.resolve().then(() => require("./publish-SDG1WfYn.cjs"));
+		const { publish, PublishModeConflict } = await Promise.resolve().then(() => require("./publish-BUvYjiZH.cjs"));
 		if (options.build && options.update) throw new PublishModeConflict();
 		const { build, update, ...rest } = options;
 		await publish({
@@ -16446,7 +16482,7 @@ program.command("deploy:google-play").description("Let EAS Submit publish a mobi
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGooglePlay } = await Promise.resolve().then(() => require("./googlePlay-B6uiHi65.cjs"));
+		const { deployGooglePlay } = await Promise.resolve().then(() => require("./googlePlay-BNH729It.cjs"));
 		await deployGooglePlay(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16468,7 +16504,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BYEmpoIg.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16481,7 +16517,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-BYEmpoIg.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16494,7 +16530,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-bDQzFvBN.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BYEmpoIg.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16594,7 +16630,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-Cs8yT5iH.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-0XI8_HOf.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16604,7 +16640,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-DoVnVU82.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption--U4NsK7N.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16614,7 +16650,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-DoVnVU82.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption--U4NsK7N.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16653,7 +16689,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-Dk8YkLkM.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-DbKNcs3o.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -16662,7 +16698,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-Dk8YkLkM.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-DbKNcs3o.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16679,14 +16715,14 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-GLBZlrlJ.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-DZ2--SaO.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-CHzpFBh-.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-5k6kV_i4.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -16706,7 +16742,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-Cw-Z0mWn.cjs")).then((n) => n.rollback_exports);
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-D4xeUQvG.cjs")).then((n) => n.rollback_exports);
 		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-D_NRPW4W.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -16721,11 +16757,11 @@ program.command("deploy:rollback").description("Put a stage's app back on its pr
 		exitWithError(error);
 	}
 });
-program.command("compose:server").description("Set up a stage's server for compose deploys: harden it (SSH keys only, no root login, firewall, security updates, fail2ban), install Docker, create the deploy user, and give its key to GitHub").requiredOption("--stage <stage>", "A deployed stage from gkm.config.ts").option("--admin <user>", "The sudo user you log in to the server as — never root (asked when absent)").option("--key-file <path>", "The deploy key pair (default: ~/.ssh/gkm-<project>-<stage>)").option("--repo <owner/name>", "GitHub repository (default: this one)").option("--no-github", "Leave the GitHub environment's key and host alone").option("--yes", "Set the server up without asking first").option("--dry-run", "Print the plan and the script; connect to nothing").action(async (options) => {
+program.command("compose:server").description("Set up a stage's server for compose deploys: harden it (SSH keys only, no root login, firewall, security updates, fail2ban), install Docker, create the deploy user, and give its key to GitHub").requiredOption("--stage <stage>", "A deployed stage from gkm.config.ts").option("--admin <user>", "The sudo user you log in to the server as — never root (default: ssh's own user for the host)").option("--identity <path>", "The SSH key the admin logs in with (default: ssh's own choice)").option("--key-file <path>", "The deploy key pair (default: ~/.ssh/gkm-<project>-<stage>)").option("--repo <owner/name>", "GitHub repository (default: this one)").option("--no-github", "Leave the GitHub environment's key and host alone").option("--yes", "Set the server up without asking first").option("--dry-run", "Print the plan and the script; connect to nothing").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { composeServerCommand } = await Promise.resolve().then(() => require("./serverSetup-BCbD8ksJ.cjs"));
+		const { composeServerCommand } = await Promise.resolve().then(() => require("./serverSetup-CcWgNtiC.cjs"));
 		await composeServerCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16750,7 +16786,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-C3gblUvr.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-CTlPQ5Ra.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16760,7 +16796,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-_3RVNG83.cjs"));
+		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-D4SnG5yl.cjs"));
 		await stagesCommand(options);
 	} catch (error) {
 		exitWithError(error);