@geekmidas/cli 10.0.0-alpha.125 → 10.0.0-alpha.127

package/dist/index.cjs

@@ -3,28 +3,28 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_credentials = require("./credentials-D7XJypNd.cjs");
-const require_compose = require("./compose-Bqcy0lqo.cjs");
+const require_compose = require("./compose-BK9s_2Qe.cjs");
 const require_workspace = require("./workspace-Du4Afb03.cjs");
-const require_snsSubscriptions = require("./snsSubscriptions-5Cqww8S7.cjs");
+const require_snsSubscriptions = require("./snsSubscriptions-f_z4PSFb.cjs");
 const require_schemas = require("./schemas-BQ_v0lEX.cjs");
-const require_seeds = require("./seeds-CPEcmoPn.cjs");
-const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-BDUp7OeY.cjs");
+const require_seeds = require("./seeds-sMVADbkg.cjs");
+const require_derive = require("./derive-BtGidITm.cjs");
+const require_drivers = require("./drivers-C47nm-wB.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-BGxf9jWE.cjs");
-const require_discover = require("./discover-DL6h-J97.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-De0lknKD.cjs");
+const require_discover = require("./discover-DEOspD9M.cjs");
 const require_config = require("./config.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-CPjbWEOI.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_appPorts = require("./appPorts-IW-OZmRi.cjs");
-const require_drivers = require("./drivers-L29WvE95.cjs");
 const require_emit = require("./emit-CYloptRS.cjs");
 const require_local = require("./local-OPC9BCZt.cjs");
-const require_sniffer = require("./sniffer-DdX_WN_-.cjs");
-const require_deploy = require("./deploy-DVrNjX1X.cjs");
-const require_credentialSchemas = require("./credentialSchemas-DFxvGEwa.cjs");
-const require_LocalStateStore = require("./LocalStateStore-CaJw9H-3.cjs");
+const require_sniffer = require("./sniffer-DWLala8l.cjs");
+const require_deploy = require("./deploy-A_fzSa59.cjs");
+const require_credentialSchemas = require("./credentialSchemas-CM0rxWmS.cjs");
+const require_LocalStateStore = require("./LocalStateStore-HRnBQFe3.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
-const require_ready = require("./ready-qnqp6JAY.cjs");
+const require_ready = require("./ready-Cj4pI0dw.cjs");
 let node_path = require("node:path");
 let commander = require("commander");
 let node_process = require("node:process");
@@ -57,7 +57,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.125";
+var version = "10.0.0-alpha.127";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -140,7 +140,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-DdX_WN_-.cjs")).then((n) => n.dokploy_api_exports);
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-DWLala8l.cjs")).then((n) => n.dokploy_api_exports);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2180,7 +2180,7 @@ async function execCommand(commandArgs, options = {}, stageDeps) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	if (options.stage && !require_seeds.isImageBuild()) {
-		const { execOnStage } = await Promise.resolve().then(() => require("./stage-CUE5pMmw.cjs")).then((n) => n.stage_exports);
+		const { execOnStage } = await Promise.resolve().then(() => require("./stage-ZWOE0oLB.cjs")).then((n) => n.stage_exports);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { workspace } = await loadWorkspaceConfig(cwd);
 		if (options.stage !== workspace.stages.local) {
@@ -2407,7 +2407,7 @@ async function devCommand(options) {
 		});
 		for (const key of Object.keys(appSecrets)) if (!(key in scoped)) delete appSecrets[key];
 		Object.assign(appSecrets, scoped);
-		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_derive.appKey(r.id) === workspaceAppName);
+		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "websocket-api" || r.kind === "site") && require_derive.appKey(r.id) === workspaceAppName);
 		publicUrl = own ? reconciled.env[own.envKey] : void 0;
 		manifest = reconciled.manifest;
 		telemetryUi = telemetryUiOf(reconciled.services);
@@ -2753,14 +2753,14 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-DTv6LHux.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-DTv6LHux.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
 	for (const resource of reconciled.plan.resources) {
-		if (resource.kind !== "rest-api" && resource.kind !== "site") continue;
+		if (resource.kind !== "rest-api" && resource.kind !== "websocket-api" && resource.kind !== "site") continue;
 		const address = reconciled.env[resource.envKey];
 		if (address) appUrls[resource.id] = address;
 	}
@@ -3088,7 +3088,7 @@ ${credentialsInjection}${parentWatch}const port = process.argv.includes('--port'
 
 ${telemetry}
 // Dynamic import so Credentials are populated before the surface evaluates
-const { app: surface } = await import('${appImportPath}');
+const { app: surface, attach } = await import('${appImportPath}');
 
 // Behind the request spans when there are any, as the production server is.
 const { Hono } = await import('hono');
@@ -3098,7 +3098,9 @@ if (requestSpans) {
   app.route('/', surface);
 }
 
-${serveCode.replace(/^ {4}/gm, "")}
+${serveCode.replace(/^ {4}/gm, "")}${runtime === "bun" ? "" : `
+// A surface that takes upgrades — a WebSocket one — is handed them.
+attach?.(server);`}
 `;
 	return `#!/usr/bin/env node
 /**
@@ -3530,7 +3532,7 @@ function servesItself(construct) {
 */
 function selfServingSurface(options) {
 	const { declared, sources, workspaceRoot, appRoot } = options;
-	const served = servedSurface(declared, workspaceRoot, appRoot);
+	const served = servedSurface(declared, workspaceRoot, appRoot) ?? servedWebSocketApi(declared, workspaceRoot, appRoot);
 	const source = served ? sources[served.id] : void 0;
 	if (!served || !source || !servesItself(source.construct)) return void 0;
 	return {
@@ -3538,6 +3540,15 @@ function selfServingSurface(options) {
 		source
 	};
 }
+/** The WebSocket surface whose `path` is the directory being built. */
+function servedWebSocketApi(declared, workspaceRoot, appRoot) {
+	return Object.values(declared).find((d) => d.kind === "websocket-api" && (0, node_path.resolve)(workspaceRoot, d.path) === (0, node_path.resolve)(appRoot));
+}
+/** An import specifier for `file`, from `outputDir`, as the bundle sees it. */
+function specifierOf(outputDir, file) {
+	const rel = (0, node_path.relative)(outputDir, file).replace(/\.ts$/, ".js");
+	return rel.startsWith(".") ? rel : `./${rel}`;
+}
 /**
 * The entry for a surface that serves itself.
 *
@@ -3550,10 +3561,12 @@ function selfServingSurface(options) {
 * The import specifier comes from discovery, which globbed the file and
 * imported it. Nothing about the surface is named here.
 */
-async function writeSurfaceEntry(outputDir, source) {
+async function writeSurfaceEntry(outputDir, source, served = []) {
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
-	const rel = (0, node_path.relative)(outputDir, source.file).replace(/\.ts$/, ".js");
-	const specifier = rel.startsWith(".") ? rel : `./${rel}`;
+	const specifier = specifierOf(outputDir, source.file);
+	const modules = served.filter((file) => file !== source.file);
+	const imports = modules.map((file, index) => `import * as served${index} from '${specifierOf(outputDir, file)}';\n`).join("");
+	const options = modules.length ? `{ envParser, context: snifferContext, modules: [${modules.map((_, index) => `served${index}`).join(", ")}] }` : "{ envParser, context: snifferContext }";
 	await (0, node_fs_promises.writeFile)((0, node_path.join)(outputDir, "app.ts"), `/**
  * Generated entry for a surface that serves itself.
  *
@@ -3563,10 +3576,19 @@ async function writeSurfaceEntry(outputDir, source) {
 import { snifferContext } from '@geekmidas/constructs';
 import { defaultEnvParser } from '@geekmidas/constructs/endpoints';
 import { ${source.exportName} as surface } from '${specifier}';
-
+${imports}
 const envParser = defaultEnvParser();
 
-export const { app } = await surface.server({ envParser, context: snifferContext });
+const served = await surface.server(${options});
+
+export const app = served.app;
+/** Hands the HTTP server's upgrades to the surface, when it takes them. */
+export const attach: ((server: unknown) => void) | undefined = served.attach;
+/**
+ * Ends what the HTTP server would otherwise wait on forever — open sockets —
+ * before it is closed.
+ */
+export const release: (() => Promise<void>) | undefined = served.release;
 
 export default app;
 `);
@@ -3594,6 +3616,9 @@ const shutdown = async () => {
   shuttingDown = true;
   const deadline = Number(process.env.GKM_SHUTDOWN_TIMEOUT_MS) || 8000;
   setTimeout(() => process.exit(1), deadline).unref();
+  // Upgraded sockets hold the server open: they are closed first, with a code
+  // that tells a client to reconnect elsewhere.
+  await release?.();
   await new Promise<void>((resolve) => server.close(() => resolve()));
   await runShutdownHooks((error) => console.error(error));
   process.exit(0);
@@ -3612,7 +3637,7 @@ import { serve } from '@hono/node-server';
 import { Hono } from 'hono';
 ${options.gracefulShutdown ? "import { runShutdownHooks } from '@geekmidas/constructs';\n" : ""}
 ${require_EndpointGenerator.startTelemetryCode([options.healthCheck])}
-const { app: surface } = await import('./app.js');
+const { app: surface, attach, release } = await import('./app.js');
 
 const port = Number(process.env.PORT) || 3000;
 
@@ -3624,6 +3649,7 @@ app.get(${JSON.stringify(options.healthCheck)}, (c) =>
 app.route('/', surface);
 
 const server = serve({ fetch: app.fetch, port });
+attach?.(server);
 console.log(JSON.stringify({ msg: 'Production server started', port }));
 ${shutdown}`);
 	return path;
@@ -3801,12 +3827,14 @@ async function buildApp(input) {
 	const constructGlobs = config.constructs;
 	const constructSources = {};
 	const background = {};
+	const served = {};
 	const declared = constructGlobs ? await require_discover.discover({
 		patterns: constructGlobs,
 		cwd: appRoot,
 		bustCache,
 		sources: constructSources,
-		background
+		background,
+		served
 	}) : {};
 	const selfServing = selfServingSurface({
 		declared,
@@ -3815,7 +3843,7 @@ async function buildApp(input) {
 		appRoot
 	});
 	if (selfServing) {
-		await writeSurfaceEntry((0, node_path.join)(appRoot, ".gkm", "server"), selfServing.source);
+		await writeSurfaceEntry((0, node_path.join)(appRoot, ".gkm", "server"), selfServing.source, served[selfServing.id] ?? []);
 		const telemetry = require_EndpointGenerator.telemetryFor({
 			node: require_seeds.telemetryOf(declared, selfServing.id),
 			appRoot,
@@ -3832,7 +3860,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DVUXW95p.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BtAkF9wb.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -4077,7 +4105,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DVUXW95p.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BtAkF9wb.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -4119,7 +4147,7 @@ async function buildProcessors(input) {
 		for (const { key, construct } of processors) infos.push(await require_seeds.processorInfo(key, construct, handler, context));
 		logger$4.log(`Generated processors for ${fileServerId}: ${processors.map(({ key }) => key).join(", ")}`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DVUXW95p.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BtAkF9wb.cjs"));
 		const outfile = require_seeds.processorBundleName(fileServerId);
 		await bundleServer({
 			entryPoint,
@@ -4202,7 +4230,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DVUXW95p.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BtAkF9wb.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -6036,25 +6064,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.125",
-	"@geekmidas/auth": "~10.0.0-alpha.125",
-	"@geekmidas/cache": "~10.0.0-alpha.125",
-	"@geekmidas/client": "~10.0.0-alpha.125",
-	"@geekmidas/cloud": "~10.0.0-alpha.125",
-	"@geekmidas/constructs": "~10.0.0-alpha.125",
-	"@geekmidas/db": "~10.0.0-alpha.125",
-	"@geekmidas/emailkit": "~10.0.0-alpha.125",
-	"@geekmidas/envkit": "~10.0.0-alpha.125",
-	"@geekmidas/errors": "~10.0.0-alpha.125",
-	"@geekmidas/events": "~10.0.0-alpha.125",
-	"@geekmidas/logger": "~10.0.0-alpha.125",
-	"@geekmidas/manifest": "~10.0.0-alpha.125",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.125",
-	"@geekmidas/schema": "~10.0.0-alpha.125",
-	"@geekmidas/services": "~10.0.0-alpha.125",
-	"@geekmidas/storage": "~10.0.0-alpha.125",
-	"@geekmidas/telescope": "~10.0.0-alpha.125",
-	"@geekmidas/testkit": "~10.0.0-alpha.125",
+	"@geekmidas/audit": "~10.0.0-alpha.127",
+	"@geekmidas/auth": "~10.0.0-alpha.127",
+	"@geekmidas/cache": "~10.0.0-alpha.127",
+	"@geekmidas/client": "~10.0.0-alpha.127",
+	"@geekmidas/cloud": "~10.0.0-alpha.127",
+	"@geekmidas/constructs": "~10.0.0-alpha.127",
+	"@geekmidas/db": "~10.0.0-alpha.127",
+	"@geekmidas/emailkit": "~10.0.0-alpha.127",
+	"@geekmidas/envkit": "~10.0.0-alpha.127",
+	"@geekmidas/errors": "~10.0.0-alpha.127",
+	"@geekmidas/events": "~10.0.0-alpha.127",
+	"@geekmidas/logger": "~10.0.0-alpha.127",
+	"@geekmidas/manifest": "~10.0.0-alpha.127",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.127",
+	"@geekmidas/schema": "~10.0.0-alpha.127",
+	"@geekmidas/services": "~10.0.0-alpha.127",
+	"@geekmidas/storage": "~10.0.0-alpha.127",
+	"@geekmidas/telescope": "~10.0.0-alpha.127",
+	"@geekmidas/testkit": "~10.0.0-alpha.127",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7247,7 +7275,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "72a50c6bd9e71af983cc5e2a7c9f3654bfc1afdc", version = cliVersion()) {
+function stagesActionUses(commit = "ba2d3fd603ba7812a218838e777b845267582e05", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -16219,8 +16247,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs"));
-	const { discover } = await Promise.resolve().then(() => require("./discover-DL6h-J97.cjs")).then((n) => n.discover_exports);
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-DTv6LHux.cjs"));
+	const { discover } = await Promise.resolve().then(() => require("./discover-DEOspD9M.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
 		patterns: require_seeds.constructGlobs(workspace),
@@ -16232,7 +16260,8 @@ async function migrateTestStage(workspace, env) {
 		manifest,
 		sources,
 		env,
-		stage: require_workspace.TEST_STAGE
+		stage: require_workspace.TEST_STAGE,
+		backends: require_seeds.backendsOf(workspace)
 	});
 	for (const { target, applied } of migrations) if (applied.length > 0) console.log(`  🗄️  ${target.migrations}: applied ${applied.join(", ")}`);
 	for (const { target, seeded } of seeds) if (seeded.length > 0) console.log(`  🌱 ${target.seeds}: ran ${seeded.join(", ")}`);
@@ -16587,7 +16616,7 @@ program.command("build").description("Build handlers and the manifest from decla
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		if (options.provider !== void 0 && !isMainProvider(options.provider)) throw new UnknownBuildProvider(options.provider);
-		if (options.cache !== void 0 && !require_SubscriberGenerator.isCacheBackend(options.cache)) throw new UnknownCacheBackend(options.cache);
+		if (options.cache !== void 0 && !require_drivers.isCacheBackend(options.cache)) throw new UnknownCacheBackend(options.cache);
 		await buildCommand({
 			...options.provider ? { provider: options.provider } : {},
 			...options.cache ? { cache: options.cache } : {},
@@ -16643,7 +16672,7 @@ program.command("eas:sync").description("Set up a mobile app's EAS project for a
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { easSync } = await Promise.resolve().then(() => require("./eas-D3clzkni.cjs"));
+		const { easSync } = await Promise.resolve().then(() => require("./eas-ApfPYR4-.cjs"));
 		await easSync(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16653,7 +16682,7 @@ program.command("publish").description("Ship a mobile app for a deployed stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { publish, PublishModeConflict } = await Promise.resolve().then(() => require("./publish-ZOo4xEuZ.cjs"));
+		const { publish, PublishModeConflict } = await Promise.resolve().then(() => require("./publish-CgwqwKDs.cjs"));
 		if (options.build && options.update) throw new PublishModeConflict();
 		const { build, update, ...rest } = options;
 		await publish({
@@ -16669,7 +16698,7 @@ program.command("deploy:google-play").description("Let EAS Submit publish a mobi
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGooglePlay } = await Promise.resolve().then(() => require("./googlePlay-C-UfBXJU.cjs"));
+		const { deployGooglePlay } = await Promise.resolve().then(() => require("./googlePlay-4KVtZ89D.cjs"));
 		await deployGooglePlay(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16691,7 +16720,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-DTv6LHux.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16704,7 +16733,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-DTv6LHux.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16717,7 +16746,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-Dp3GhFnf.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-DTv6LHux.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16817,7 +16846,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-CrxvmSpq.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-CH7-9AHI.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16827,7 +16856,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-DBkIFiR2.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-SGWvnBxV.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16837,7 +16866,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-DBkIFiR2.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-SGWvnBxV.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16876,7 +16905,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-CPEcmoPn.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-sMVADbkg.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -16885,7 +16914,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-CPEcmoPn.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-sMVADbkg.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16902,14 +16931,14 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-hlNKNWmg.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-BQPRclv2.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-BMRhE6cZ.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-D08bMg7m.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -16929,8 +16958,8 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-CTWdDBgB.cjs")).then((n) => n.rollback_exports);
-		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-PKhPAajN.cjs"));
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-CdBj1Boy.cjs")).then((n) => n.rollback_exports);
+		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-DBwedwSS.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -16948,7 +16977,7 @@ program.command("compose:server").description("Set up a stage's server for compo
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { composeServerCommand } = await Promise.resolve().then(() => require("./serverSetup-C6t6Vtt7.cjs"));
+		const { composeServerCommand } = await Promise.resolve().then(() => require("./serverSetup-4avavig6.cjs"));
 		await composeServerCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16973,7 +17002,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-CsvtWSBW.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-CxWaWQtW.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);