@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.125

package/dist/index.cjs

@@ -2,30 +2,29 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_run = require("./run-fVZ-rLnc.cjs");
-const require_credentials = require("./credentials-Zqr3QQYB.cjs");
-const require_compose = require("./compose-ChVvb3xM.cjs");
-const require_workspace = require("./workspace-C82GLPnf.cjs");
-const require_dns = require("./dns-Bmnuttja.cjs");
+const require_credentials = require("./credentials-D7XJypNd.cjs");
+const require_compose = require("./compose-Bqcy0lqo.cjs");
+const require_workspace = require("./workspace-Du4Afb03.cjs");
+const require_snsSubscriptions = require("./snsSubscriptions-5Cqww8S7.cjs");
 const require_schemas = require("./schemas-BQ_v0lEX.cjs");
-const require_seeds = require("./seeds-BWC-qjSI.cjs");
+const require_seeds = require("./seeds-CPEcmoPn.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-C8CPxrCK.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-BDUp7OeY.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-BDa6pPgE.cjs");
-const require_discover = require("./discover-DozUKs8f.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-BGxf9jWE.cjs");
+const require_discover = require("./discover-DL6h-J97.cjs");
 const require_config = require("./config.cjs");
-const require_deploy = require("./deploy-BffR_uEN.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_appPorts = require("./appPorts-IW-OZmRi.cjs");
-const require_drivers = require("./drivers-DbjiYpW6.cjs");
-const require_emit = require("./emit-Dmc1nvdS.cjs");
-const require_local = require("./local-DNhnkugT.cjs");
-const require_sniffer = require("./sniffer-ctpwBBkT.cjs");
-const require_credentialSchemas = require("./credentialSchemas-B67WJOOm.cjs");
-const require_LocalStateStore = require("./LocalStateStore-43kSYNpw.cjs");
+const require_drivers = require("./drivers-L29WvE95.cjs");
+const require_emit = require("./emit-CYloptRS.cjs");
+const require_local = require("./local-OPC9BCZt.cjs");
+const require_sniffer = require("./sniffer-DdX_WN_-.cjs");
+const require_deploy = require("./deploy-DVrNjX1X.cjs");
+const require_credentialSchemas = require("./credentialSchemas-DFxvGEwa.cjs");
+const require_LocalStateStore = require("./LocalStateStore-CaJw9H-3.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
-const require_ready = require("./ready-BFFP838V.cjs");
+const require_ready = require("./ready-qnqp6JAY.cjs");
 let node_path = require("node:path");
 let commander = require("commander");
 let node_process = require("node:process");
@@ -58,7 +57,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.123";
+var version = "10.0.0-alpha.125";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -141,7 +140,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-ctpwBBkT.cjs")).then((n) => n.dokploy_api_exports);
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-DdX_WN_-.cjs")).then((n) => n.dokploy_api_exports);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -302,7 +301,7 @@ var BackupsNotOn = class extends require_errors.GkmError {
 var BackupsNotProvisioned = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
-		super(`'${stage}' has no ${require_dns.BACKUPS_URL_KEY} in its secrets, so it has never been deployed with backups. Deploy it: gkm deploy --stage ${stage}.`);
+		super(`'${stage}' has no ${require_snsSubscriptions.BACKUPS_URL_KEY} in its secrets, so it has never been deployed with backups. Deploy it: gkm deploy --stage ${stage}.`);
 		this.stage = stage;
 		this.name = "BackupsNotProvisioned";
 	}
@@ -373,7 +372,7 @@ var RestoreNotConfirmed = class extends require_errors.GkmError {
 var BackupsContainerNotRunning = class extends require_errors.GkmError {
 	project;
 	constructor(project) {
-		super(`No ${require_dns.BACKUPS_SERVICE} container of ${project} is running on this Docker. Point Docker at the stage's server, or deploy the stage.`);
+		super(`No ${require_snsSubscriptions.BACKUPS_SERVICE} container of ${project} is running on this Docker. Point Docker at the stage's server, or deploy the stage.`);
 		this.project = project;
 		this.name = "BackupsContainerNotRunning";
 	}
@@ -383,7 +382,7 @@ var BackupRunFailed = class extends require_errors.GkmError {
 	project;
 	code;
 	constructor(project, code) {
-		super(`The backup of ${project} failed (exit ${code}); its result is the last line above. docker logs on the ${require_dns.BACKUPS_SERVICE} container shows every run.`);
+		super(`The backup of ${project} failed (exit ${code}); its result is the last line above. docker logs on the ${require_snsSubscriptions.BACKUPS_SERVICE} container shows every run.`);
 		this.project = project;
 		this.code = code;
 		this.name = "BackupRunFailed";
@@ -414,7 +413,7 @@ async function listBackups(s3, bucket, prefix) {
 		for (const object of page.Contents ?? []) {
 			const rest = object.Key?.slice(prefix.length + 1) ?? "";
 			const match = /^(\d{4}-\d{2}-\d{2}\/\d{2}-\d{2}-\d{2}Z)\/(.+)\.sql\.gz$/.exec(rest);
-			const at = match ? require_dns.runTime(match[1]) : void 0;
+			const at = match ? require_snsSubscriptions.runTime(match[1]) : void 0;
 			if (!match || !at) continue;
 			const run = runs.get(match[1]) ?? {
 				folder: match[1],
@@ -465,9 +464,9 @@ async function backupNow(options) {
 		file: "",
 		cwd: process.cwd(),
 		...options.engine?.host ? { host: options.engine.host } : {}
-	}, require_dns.BACKUPS_SERVICE, [
+	}, require_snsSubscriptions.BACKUPS_SERVICE, [
 		"node",
-		require_dns.RUNNER_PATH,
+		require_snsSubscriptions.RUNNER_PATH,
 		"run"
 	]);
 	for (const line of `${result.stdout}${result.stderr}`.split("\n")) if (line.trim()) options.log?.(line);
@@ -523,7 +522,7 @@ async function restoreBackup(options) {
 	const has = run.files.map((f) => f.database);
 	for (const target of targets) if (!has.includes(target.file)) throw new BackupDatabaseMissing(run.folder, target.file, has);
 	const engine = options.engine ?? {};
-	const container = await options.docker.container(engine, options.project, require_dns.BACKUPS_SERVICE);
+	const container = await options.docker.container(engine, options.project, require_snsSubscriptions.BACKUPS_SERVICE);
 	if (!container) throw new BackupsContainerNotRunning(options.project);
 	const question = `Replace ${targets.map((t) => t.name).join(", ")} on '${options.stage}' with the backup ${run.folder}? Everything written since is lost (a backup is taken first).`;
 	if (!await options.confirm(question)) throw new RestoreNotConfirmed(options.stage);
@@ -537,7 +536,7 @@ async function restoreBackup(options) {
 	const { GetObjectCommand } = await import("@aws-sdk/client-s3");
 	const restored = [];
 	for (const target of targets) {
-		const Key = `${options.prefix}/${run.folder}/${require_dns.backupFile(target)}`;
+		const Key = `${options.prefix}/${run.folder}/${require_snsSubscriptions.backupFile(target)}`;
 		options.log(`♻️  Restoring ${target.name} from s3://${options.bucket}/${Key}…`);
 		const object = await options.s3.send(new GetObjectCommand({
 			Bucket: options.bucket,
@@ -577,7 +576,7 @@ async function resolveStage(options) {
 		patterns: require_seeds.constructGlobs(workspace),
 		cwd: workspace.root
 	});
-	const choice = require_dns.stageBackups(workspace, manifest, stage);
+	const choice = require_snsSubscriptions.stageBackups(workspace, manifest, stage);
 	if (choice.mode === "disabled") throw new BackupsNotOn(stage, `deploy.backups.${stage} is false`);
 	if (choice.mode === "none") throw new BackupsNotOn(stage, choice.reason === "local" ? "it is the local stage" : choice.reason === "no-postgres" ? "its stack runs no Postgres" : "the compose target does not deploy it");
 	const secrets = await (await require_seeds.secretsStoreFor(workspace, stage)).read(stage);
@@ -585,8 +584,8 @@ async function resolveStage(options) {
 		workspace,
 		manifest,
 		project: require_compose.composeProject(require_identity.deployIdentity(workspace, stage)),
-		prefix: require_dns.backupsPrefix(workspace, stage),
-		databases: require_dns.backupDatabases(require_compose.stackPlan(workspace, manifest, stage).resources),
+		prefix: require_snsSubscriptions.backupsPrefix(workspace, stage),
+		databases: require_snsSubscriptions.backupDatabases(require_compose.stackPlan(workspace, manifest, stage).resources),
 		custom: secrets?.custom ?? {},
 		...secrets?.seed ? { seed: secrets.seed } : {},
 		engine: stageEngine(workspace, stage, secrets?.custom)
@@ -607,17 +606,17 @@ function stageEngine(workspace, stage, custom) {
 * `BACKUPS_URL` — and an S3 client with the caller's own credentials.
 */
 async function callerS3(resolved, options) {
-	const url = resolved.custom[require_dns.BACKUPS_URL_KEY];
+	const url = resolved.custom[require_snsSubscriptions.BACKUPS_URL_KEY];
 	if (!url) throw new BackupsNotProvisioned(options.stage);
 	const address = (await import("@geekmidas/storage/s3-url")).parse(url);
-	const credential = await require_deploy.awsProvisioningCredentials({
+	const credential = await require_snsSubscriptions.awsProvisioningCredentials({
 		stage: options.stage,
 		env: process.env,
 		...options.profile ? { profile: options.profile } : {}
 	}) ?? { chain: true };
 	const region = address.region ?? "us-east-1";
-	const config = await require_deploy.awsClientConfig(credential, region);
-	const endpoint = require_deploy.awsEndpoint(process.env, "S3");
+	const config = await require_snsSubscriptions.awsClientConfig(credential, region);
+	const endpoint = require_snsSubscriptions.awsEndpoint(process.env, "S3");
 	const { S3Client } = await import("@aws-sdk/client-s3");
 	return {
 		s3: new S3Client({
@@ -2181,7 +2180,7 @@ async function execCommand(commandArgs, options = {}, stageDeps) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	if (options.stage && !require_seeds.isImageBuild()) {
-		const { execOnStage } = await Promise.resolve().then(() => require("./stage-DzALYUwY.cjs")).then((n) => n.stage_exports);
+		const { execOnStage } = await Promise.resolve().then(() => require("./stage-CUE5pMmw.cjs")).then((n) => n.stage_exports);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { workspace } = await loadWorkspaceConfig(cwd);
 		if (options.stage !== workspace.stages.local) {
@@ -2754,9 +2753,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-CrtxXeGY.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-CrtxXeGY.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3782,7 +3781,8 @@ async function writeManifest(input) {
 		functions: builds.flatMap((build) => build.functions),
 		crons: builds.flatMap((build) => build.crons),
 		queues: builds.flatMap((build) => build.queues),
-		subscribers: builds.flatMap((build) => build.subscribers)
+		subscribers: builds.flatMap((build) => build.subscribers),
+		processors: builds.flatMap((build) => build.processors ?? [])
 	});
 	const path = (0, node_path.join)(manifestDir, `${target}.ts`);
 	await (0, node_fs_promises.writeFile)(path, require_emit.manifestModule(folded, backends));
@@ -3832,7 +3832,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-Dk7tAvAX.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DVUXW95p.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3883,6 +3883,10 @@ async function buildApp(input) {
 	const hostedIds = new Set(hosted.map((unit) => unit.id));
 	const appRootAbs = (0, node_path.resolve)(appRoot);
 	const hostedHere = (list) => list.filter(({ construct, path }) => construct.owner !== void 0 ? hostedIds.has(construct.owner) : require_seeds.isUnder(path.absolute, appRootAbs));
+	const processorGenerator = new require_seeds.ProcessorGenerator();
+	const loadedProcessors = await processorGenerator.load(code, appRoot, bustCache);
+	const hostedUnits = input.workspace ? require_seeds.processorUnits(input.workspace, declared).filter((unit) => unit.app === appName) : [];
+	const hostedProcessors = input.workspace ? loadedProcessors.filter(({ construct }) => hostedUnits.some((unit) => unit.id === construct.surfaceId)) : loadedProcessors;
 	const hostedCrons = hostedHere(allCrons);
 	const hostedQueues = hostedHere(allQueues);
 	const hostedSubscribers = hostedHere(allSubscribers);
@@ -3896,12 +3900,20 @@ async function buildApp(input) {
 		queues: hostedQueues,
 		subscribers: hostedSubscribers
 	};
-	const reach = derived.surface ? reachedBy(declared, [derived.surface.id, ...servesOnly ? [] : hosted.map((unit) => unit.id)], [
+	const reach = derived.surface ? reachedBy(declared, [
+		derived.surface.id,
+		...servesOnly ? [] : hosted.map((unit) => unit.id),
+		...production?.enabled ? [] : hostedUnits.flatMap((unit) => {
+			const server = declared[unit.id];
+			return server?.kind === "file-server" ? [unit.id, server.of] : [unit.id];
+		})
+	], [
 		...allEndpoints,
 		...allFunctions,
 		...inProcess.crons,
 		...inProcess.queues,
-		...inProcess.subscribers
+		...inProcess.subscribers,
+		...production?.enabled ? [] : hostedProcessors
 	]) : declared;
 	Object.assign(buildContext, runtimeDrivers({
 		appRoot,
@@ -3933,6 +3945,10 @@ async function buildApp(input) {
 		...production,
 		subscribers: "exclude"
 	};
+	if (target === "server" && !production?.enabled && hostedProcessors.length) {
+		await processorGenerator.buildDev((0, node_path.join)(appRoot, ".gkm", "server"), hostedProcessors);
+		buildContext.devProcessors = true;
+	}
 	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, inProcess.crons, inProcess.subscribers, inProcess.queues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
 	if (target === "server" && production?.enabled) await buildWorkers({
 		context: (workerId, work) => ({
@@ -3961,6 +3977,32 @@ async function buildApp(input) {
 		bundle: Boolean(production.bundle && !input.skipBundle),
 		...input.stage ? { stage: input.stage } : {}
 	});
+	let processors = [];
+	if (target === "aws") processors = await processorGenerator.build(buildContext, hostedProcessors, (0, node_path.join)(appRoot, ".gkm", target), {
+		target,
+		root: workspaceRoot
+	});
+	else if (production?.enabled) processors = await buildProcessors({
+		context: buildContext,
+		units: hostedUnits.map((unit) => unit.id),
+		serverDir: (0, node_path.join)(appRoot, ".gkm", "server"),
+		processors: hostedProcessors,
+		telemetry: (fileServerId) => require_EndpointGenerator.telemetryFor({
+			node: require_seeds.telemetryOf(declared, fileServerId),
+			appRoot,
+			app: appNameOf(input),
+			cwd: workspaceRoot,
+			serviceName: fileServerId,
+			...input.workspaceName && { workspaceName: input.workspaceName }
+		}),
+		workspaceRoot,
+		bundle: Boolean(production.bundle && !input.skipBundle),
+		...input.stage ? { stage: input.stage } : {}
+	});
+	if (processors.length > 0 && result.built) result.built = {
+		...result.built,
+		processors
+	};
 	await require_openapi.generateOpenApi(allEndpoints.map(({ construct }) => construct), {
 		openapi: config.openapi,
 		root: workspaceRoot,
@@ -4035,7 +4077,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-Dk7tAvAX.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DVUXW95p.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -4055,6 +4097,45 @@ async function buildWorkers(input) {
 	}
 }
 /**
+* Write each processor unit's entry — and, for an image, bundle it — from the
+* processors of its file server and no other.
+*/
+async function buildProcessors(input) {
+	const generator = new require_seeds.ProcessorGenerator();
+	const infos = [];
+	for (const fileServerId of input.units) {
+		const processors = input.processors.filter(({ construct }) => construct.surfaceId === fileServerId);
+		if (processors.length === 0) continue;
+		const { context } = input;
+		const telemetry = input.telemetry(fileServerId);
+		const entryPoint = await generator.buildEntry({
+			context,
+			fileServerId,
+			...telemetry ? { telemetry } : {},
+			outputDir: require_seeds.processorEntryDir(input.serverDir, fileServerId),
+			processors
+		});
+		const handler = (0, node_path.relative)(input.workspaceRoot, entryPoint);
+		for (const { key, construct } of processors) infos.push(await require_seeds.processorInfo(key, construct, handler, context));
+		logger$4.log(`Generated processors for ${fileServerId}: ${processors.map(({ key }) => key).join(", ")}`);
+		if (!input.bundle) continue;
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DVUXW95p.cjs"));
+		const outfile = require_seeds.processorBundleName(fileServerId);
+		await bundleServer({
+			entryPoint,
+			outputDir: (0, node_path.join)(input.serverDir, "dist"),
+			outfile,
+			minify: context.production?.minify ?? false,
+			sourcemap: false,
+			external: [...context.production?.external ?? [], ...new Set(processors.flatMap(({ construct }) => construct.native))],
+			...input.stage ? { stage: input.stage } : {},
+			constructs: processors.map((p) => p.construct)
+		});
+		logger$4.log(`✅ Bundle complete: .gkm/server/dist/${outfile}`);
+	}
+	return infos;
+}
+/**
 * Whether the surface's generated client propagates trace context, and at
 * what rate: on when a site that calls it has an edge to a `Telemetry`
 * construct, at the stage's sample rate — every trace locally, and on a build
@@ -4121,7 +4202,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-Dk7tAvAX.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DVUXW95p.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -4295,10 +4376,10 @@ async function workspaceBuildCommand(workspace, options) {
 					...sandbox.env,
 					NODE_ENV: options.production ? "production" : "development"
 				},
-				timeoutMs: require_run.DEFAULT_TIMEOUT_MS,
+				timeoutMs: require_credentials.DEFAULT_TIMEOUT_MS,
 				output: "inherit"
 			});
-			if (built.exitCode !== 0) throw new require_run.CommandFailed(turboBin, turboArgs, built.exitCode, built.signal);
+			if (built.exitCode !== 0) throw new require_credentials.CommandFailed(turboBin, turboArgs, built.exitCode, built.signal);
 		}
 		for (const [appName, app] of apps) {
 			const outputPath = getAppOutputPath(workspace, appName, app);
@@ -5955,25 +6036,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.123",
-	"@geekmidas/auth": "~10.0.0-alpha.123",
-	"@geekmidas/cache": "~10.0.0-alpha.123",
-	"@geekmidas/client": "~10.0.0-alpha.123",
-	"@geekmidas/cloud": "~10.0.0-alpha.123",
-	"@geekmidas/constructs": "~10.0.0-alpha.123",
-	"@geekmidas/db": "~10.0.0-alpha.123",
-	"@geekmidas/emailkit": "~10.0.0-alpha.123",
-	"@geekmidas/envkit": "~10.0.0-alpha.123",
-	"@geekmidas/errors": "~10.0.0-alpha.123",
-	"@geekmidas/events": "~10.0.0-alpha.123",
-	"@geekmidas/logger": "~10.0.0-alpha.123",
-	"@geekmidas/manifest": "~10.0.0-alpha.123",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.123",
-	"@geekmidas/schema": "~10.0.0-alpha.123",
-	"@geekmidas/services": "~10.0.0-alpha.123",
-	"@geekmidas/storage": "~10.0.0-alpha.123",
-	"@geekmidas/telescope": "~10.0.0-alpha.123",
-	"@geekmidas/testkit": "~10.0.0-alpha.123",
+	"@geekmidas/audit": "~10.0.0-alpha.125",
+	"@geekmidas/auth": "~10.0.0-alpha.125",
+	"@geekmidas/cache": "~10.0.0-alpha.125",
+	"@geekmidas/client": "~10.0.0-alpha.125",
+	"@geekmidas/cloud": "~10.0.0-alpha.125",
+	"@geekmidas/constructs": "~10.0.0-alpha.125",
+	"@geekmidas/db": "~10.0.0-alpha.125",
+	"@geekmidas/emailkit": "~10.0.0-alpha.125",
+	"@geekmidas/envkit": "~10.0.0-alpha.125",
+	"@geekmidas/errors": "~10.0.0-alpha.125",
+	"@geekmidas/events": "~10.0.0-alpha.125",
+	"@geekmidas/logger": "~10.0.0-alpha.125",
+	"@geekmidas/manifest": "~10.0.0-alpha.125",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.125",
+	"@geekmidas/schema": "~10.0.0-alpha.125",
+	"@geekmidas/services": "~10.0.0-alpha.125",
+	"@geekmidas/storage": "~10.0.0-alpha.125",
+	"@geekmidas/telescope": "~10.0.0-alpha.125",
+	"@geekmidas/testkit": "~10.0.0-alpha.125",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7166,7 +7247,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "b2c0e982c54d32dc7eb885a479e6b13102209584", version = cliVersion()) {
+function stagesActionUses(commit = "72a50c6bd9e71af983cc5e2a7c9f3654bfc1afdc", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -16138,8 +16219,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-CrtxXeGY.cjs"));
-	const { discover } = await Promise.resolve().then(() => require("./discover-DozUKs8f.cjs")).then((n) => n.discover_exports);
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs"));
+	const { discover } = await Promise.resolve().then(() => require("./discover-DL6h-J97.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
 		patterns: require_seeds.constructGlobs(workspace),
@@ -16562,7 +16643,7 @@ program.command("eas:sync").description("Set up a mobile app's EAS project for a
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { easSync } = await Promise.resolve().then(() => require("./eas-CN_cUXth.cjs"));
+		const { easSync } = await Promise.resolve().then(() => require("./eas-D3clzkni.cjs"));
 		await easSync(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16572,7 +16653,7 @@ program.command("publish").description("Ship a mobile app for a deployed stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { publish, PublishModeConflict } = await Promise.resolve().then(() => require("./publish-qSpnvmdX.cjs"));
+		const { publish, PublishModeConflict } = await Promise.resolve().then(() => require("./publish-ZOo4xEuZ.cjs"));
 		if (options.build && options.update) throw new PublishModeConflict();
 		const { build, update, ...rest } = options;
 		await publish({
@@ -16588,7 +16669,7 @@ program.command("deploy:google-play").description("Let EAS Submit publish a mobi
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGooglePlay } = await Promise.resolve().then(() => require("./googlePlay-SX_jQeJf.cjs"));
+		const { deployGooglePlay } = await Promise.resolve().then(() => require("./googlePlay-C-UfBXJU.cjs"));
 		await deployGooglePlay(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16610,7 +16691,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-CrtxXeGY.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16623,7 +16704,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-CrtxXeGY.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16636,7 +16717,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-CrtxXeGY.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16736,7 +16817,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-C2CvXrYw.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-CrxvmSpq.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16746,7 +16827,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CPDM49Hi.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-DBkIFiR2.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16756,7 +16837,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CPDM49Hi.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-DBkIFiR2.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16795,7 +16876,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-BWC-qjSI.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-CPEcmoPn.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -16804,7 +16885,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-BWC-qjSI.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-CPEcmoPn.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16821,14 +16902,14 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-BCz1lkh_.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-hlNKNWmg.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-Di464j1O.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-BMRhE6cZ.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -16848,8 +16929,8 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-Bxq_URgL.cjs")).then((n) => n.rollback_exports);
-		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-DJlqcW_U.cjs"));
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-CTWdDBgB.cjs")).then((n) => n.rollback_exports);
+		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-PKhPAajN.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -16867,7 +16948,7 @@ program.command("compose:server").description("Set up a stage's server for compo
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { composeServerCommand } = await Promise.resolve().then(() => require("./serverSetup-CtV80a5M.cjs"));
+		const { composeServerCommand } = await Promise.resolve().then(() => require("./serverSetup-C6t6Vtt7.cjs"));
 		await composeServerCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16892,7 +16973,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-D56PSK39.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-CsvtWSBW.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16902,7 +16983,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-B7mCWI_R.cjs"));
+		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-3yUZaZeA.cjs"));
 		await stagesCommand(options);
 	} catch (error) {
 		exitWithError(error);