@geekmidas/cli 10.0.0-alpha.25 → 10.0.0-alpha.27

package/dist/index.mjs

@@ -1,15 +1,14 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as DEFAULT_CACHE, r as ConstructGenerator, s as isPartitionedRoutes, t as discover } from "./discover-0fhCbnk0.mjs";
-import { i as loadConfig, l as derivedApps, n as getAppNameFromCwd, o as loadWorkspaceConfig, r as loadAppConfig, s as parseModuleConfig } from "./config-DBGpRTUy.mjs";
-import { A as stripPublicPrefix, C as InvalidStages, D as stageProblems, E as deployedProblems, T as assertDeployedStage, a as getAppBuildOrder, k as getPublicEnvPrefix, o as getAppGkmConfig, s as getDependencyEnvVars, t as allConstructGlobs, v as getDeployTargetError, w as TEST_STAGE, y as isDeployTargetSupported } from "./workspace-Bu3xNCej.mjs";
-import { C as providerOf, S as eventsBackendFor, _ as COMPOSE_PATH, a as loadEnvFiles, b as resourceName, c as resolveServicePorts, d as backendsOf, f as constructGlobs, h as usesConstructs, i as isPortAvailable, l as rewriteUrlsWithPorts, m as reconcileWorkspace, n as createEntryWrapper, o as loadSecretsForApp, p as derivedContainers, r as findAvailablePort, s as prepareEntryCredentials, t as createCredentialsPreload, u as startWorkspaceServices, v as LOCAL_CA_PATH, w as storageBackendFor, x as cacheBackendFor, y as applyPostgres } from "./credentials-BpoOUa74.mjs";
-import { a as generateServiceCredentials, i as generateSecurePassword, n as generateConnectionUrls, o as rotateServicePassword, t as createStageSecrets } from "./generator-LfZU7NlU.mjs";
+import { a as loadConfig, c as parseModuleConfig, i as loadAppConfig, r as getAppNameFromCwd, s as loadWorkspaceConfig, u as derivedApps } from "./config-DXrrYvob.mjs";
+import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-T4IVGSoB.mjs";
 import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-TP0x118M.mjs";
-import { a as openapiCommand, c as EndpointGenerator, l as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, s as OpenApiTsGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-DHQlstv6.mjs";
+import { _ as isPortAvailable, b as prepareEntryCredentials, c as applyPostgres, d as eventsBackendFor, f as providerOf, g as findAvailablePort, h as createEntryWrapper, i as reconcileWorkspace, l as resourceName, m as createCredentialsPreload, n as constructGlobs, o as COMPOSE_PATH, p as storageBackendFor, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as cacheBackendFor, v as loadEnvFiles, y as loadSecretsForApp } from "./workspace-CUmR_k4J.mjs";
+import { a as openapiCommand, c as EndpointGenerator, l as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, s as OpenApiTsGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-3NLVvtz-.mjs";
 import { i as withRoutes, r as withCompute } from "./emit-Bzq7JsMP.mjs";
-import { i as writeDockerEnvFromSecrets, r as generateFullstackCustomSecrets } from "./reconcile-gb1lz1Dk.mjs";
-import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-B88fTvnh.mjs";
+import { a as createStageSecrets, c as generateServiceCredentials, i as writeDockerEnvFromSecrets, l as rotateServicePassword, o as generateConnectionUrls, r as generateFullstackCustomSecrets, s as generateSecurePassword } from "./reconcile-DhbCvh4K.mjs";
+import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-BV00TxZv.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { stdin, stdout } from "node:process";
@@ -22,13 +21,13 @@ import { execFile, execSync, spawn } from "node:child_process";
 import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, kebabCase, provideKey, provisionOrder, scopedName, serviceKey } from "@geekmidas/manifest";
 import fg from "fast-glob";
 import chokidar from "chokidar";
-import { parse as parse$1, parseDocument } from "yaml";
 import { createCipheriv, createHash, randomBytes } from "node:crypto";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
+import { parse as parse$1, parseDocument } from "yaml";
 import { promisify } from "node:util";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Function } from "@geekmidas/constructs/functions";
 import { Queue } from "@geekmidas/constructs/queue";
@@ -39,7 +38,7 @@ import prompts from "prompts";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { serviceContext } from "@geekmidas/services";
 //#region package.json
-var version = "10.0.0-alpha.25";
+var version = "10.0.0-alpha.27";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -431,10 +430,7 @@ async function execCommand(commandArgs, options = {}) {
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$12.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({
-		cwd,
-		resolveDockerPorts: "readonly"
-	});
+	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({ cwd });
 	if (appName) logger$12.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
 	if (secretCount > 0) logger$12.log(`🔐 Loaded ${secretCount} secret(s)`);
@@ -592,6 +588,7 @@ async function devCommand(options) {
 			return workspaceDevCommand(loadedConfig.workspace, options);
 		}
 		config = loadedConfig.raw;
+		workspace = loadedConfig.workspace;
 	}
 	else {
 		const loadedConfig = await loadWorkspaceConfig();
@@ -636,24 +633,13 @@ async function devCommand(options) {
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
 	const appSecrets = await loadSecretsForApp(secretsRoot, config.stages.local, workspaceAppName);
-	if (workspace && usesConstructs(workspace)) {
+	if (workspace) {
 		const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
 		if (reconciled.changed && reconciled.plan.containers.length > 0) {
 			logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
 			for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
 		}
 		Object.assign(appSecrets, reconciled.env);
-	} else {
-		const resolvedPorts = await resolveServicePorts(secretsRoot);
-		if (Object.keys(resolvedPorts.ports).length > 0) {
-			const rewritten = rewriteUrlsWithPorts(appSecrets, resolvedPorts);
-			Object.assign(appSecrets, rewritten);
-			logger$11.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
-		}
-	}
-	if (workspace && workspaceAppName) {
-		const depEnv = getDependencyEnvVars(workspace, workspaceAppName);
-		Object.assign(appSecrets, depEnv);
 	}
 	if (Object.keys(appSecrets).length > 0) {
 		const secretsDir = join(secretsRoot, ".gkm");
@@ -663,7 +649,7 @@ async function devCommand(options) {
 		await writeFile(secretsJsonPath, JSON.stringify(appSecrets, null, 2));
 		logger$11.log(`🔐 Loaded ${Object.keys(appSecrets).length} secret(s)`);
 	}
-	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? false, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath, initial.selfServing !== void 0);
+	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? workspaceAppPort !== void 0, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath, initial.selfServing !== void 0);
 	await devServer.start();
 	const hooksFile = (config.hooks?.server?.split("#"))?.[0];
 	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => p.startsWith("./") ? p.slice(2) : p);
@@ -722,19 +708,6 @@ async function devCommand(options) {
 	process.on("SIGTERM", shutdown);
 }
 /**
-* Generate all dependency environment variables for all apps.
-* Returns a flat object with all {APP_NAME}_URL variables.
-* @internal Exported for testing
-*/
-function generateAllDependencyEnvVars(workspace, urlPrefix = "http://localhost") {
-	const env = {};
-	for (const appName of Object.keys(workspace.apps)) {
-		const appEnv = getDependencyEnvVars(workspace, appName, urlPrefix);
-		Object.assign(env, appEnv);
-	}
-	return env;
-}
-/**
 * Check for port conflicts across all apps.
 * Returns list of conflicts if any ports are duplicated.
 * @internal Exported for testing
@@ -959,27 +932,25 @@ async function workspaceDevCommand(workspace, options) {
 		logger$11.log("✅ Frontend apps validated");
 	}
 	const rawSecrets = await loadDevSecrets(workspace);
-	let secretsEnv;
-	if (usesConstructs(workspace)) {
-		const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
-		if (reconciled.changed && reconciled.plan.containers.length > 0) {
-			logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-			for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
-		}
-		secretsEnv = {
-			...rawSecrets,
-			...reconciled.env
-		};
-	} else {
-		const resolvedPorts = await resolveServicePorts(workspace.root);
-		await startWorkspaceServices(workspace, resolvedPorts.dockerEnv, rawSecrets);
-		secretsEnv = rewriteUrlsWithPorts(rawSecrets, resolvedPorts);
+	const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
+	if (reconciled.changed && reconciled.plan.containers.length > 0) {
+		logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
+		for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
+	}
+	const secretsEnv = {
+		...rawSecrets,
+		...reconciled.env
+	};
+	const appUrls = {};
+	for (const resource of reconciled.plan.resources) {
+		if (resource.kind !== "rest-api" && resource.kind !== "site") continue;
+		const address = reconciled.env[resource.envKey];
+		if (address) appUrls[resource.id] = address;
 	}
 	if (Object.keys(secretsEnv).length > 0) logger$11.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
-	const dependencyEnv = generateAllDependencyEnvVars(workspace);
-	if (Object.keys(dependencyEnv).length > 0) {
-		logger$11.log("📡 Dependency URLs:");
-		for (const [key, value] of Object.entries(dependencyEnv)) logger$11.log(`   ${key}=${value}`);
+	if (Object.keys(appUrls).length > 0) {
+		logger$11.log("🔒 App URLs:");
+		for (const [id, address] of Object.entries(appUrls)) logger$11.log(`   ${id}: ${address}`);
 	}
 	let turboFilter = [];
 	if (options.app) {
@@ -1023,10 +994,20 @@ async function workspaceDevCommand(workspace, options) {
 	const turboEnv = {
 		...process.env,
 		...secretsEnv,
-		...dependencyEnv,
 		NODE_ENV: "development",
 		...configPath ? { GKM_CONFIG_PATH: configPath } : {}
 	};
+	const scoped = options.app ? [options.app] : options.filter ? [] : Object.keys(workspace.apps);
+	const held = [];
+	for (const appName of scoped) {
+		const port = workspace.apps[appName]?.port;
+		if (port && !await isPortAvailable(port)) held.push({
+			app: appName,
+			port,
+			holder: listenerOn(port)
+		});
+	}
+	if (held.length > 0) throw new WorkspacePortsInUse(held);
 	logger$11.log("\n🏃 Starting turbo run dev...\n");
 	const turboProcess = spawn("pnpm", [
 		"turbo",
@@ -1204,6 +1185,19 @@ var EntryRunner = class {
 */
 function generateServerEntryContent(options) {
 	const { secretsJsonPath, runtime = "node", enableOpenApi = false, appImportPath = "./app.js", selfServing = false } = options;
+	const parentWatch = `// Exit when the gkm dev that started this server is gone.
+const __gkmDevPid = Number(process.env.GKM_DEV_PID);
+if (__gkmDevPid) {
+  setInterval(() => {
+    try {
+      process.kill(__gkmDevPid, 0);
+    } catch {
+      process.exit(0);
+    }
+  }, 1000).unref();
+}
+
+`;
 	const credentialsInjection = secretsJsonPath ? `import { existsSync, readFileSync } from 'node:fs';
 
 // Inject dev secrets via globalThis (must happen before app import)
@@ -1234,8 +1228,7 @@ if (existsSync(secretsPath)) {
  * Development server entry point for a surface that serves itself
  * This file is auto-generated by 'gkm dev'
  */
-${credentialsInjection}
-const port = process.argv.includes('--port')
+${credentialsInjection}${parentWatch}const port = process.argv.includes('--port')
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
   : 3000;
 
@@ -1250,8 +1243,7 @@ console.log(\`Server started on port \${port}\`);
  * Development server entry point
  * This file is auto-generated by 'gkm dev'
  */
-${credentialsInjection}
-const port = process.argv.includes('--port')
+${credentialsInjection}${parentWatch}const port = process.argv.includes('--port')
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
   : 3000;
 
@@ -1273,6 +1265,44 @@ start({
 });
 `;
 }
+/** A port this app must serve on is held by something else. */
+var DevPortInUse = class extends Error {
+	port;
+	holder;
+	constructor(port, holder) {
+		super(`Port ${port} is already in use${holder ? ` by ${holder}` : ""}. It is the port this app is provisioned on — the one every other app and its CORS origins point at — so dev will not move off it. Stop what is holding it (often a dev server a previous run left behind), or pass -p/--port to run this app somewhere else.`);
+		this.port = port;
+		this.holder = holder;
+		this.name = "DevPortInUse";
+	}
+};
+/** Apps whose provisioned ports are held before the workspace starts. */
+var WorkspacePortsInUse = class extends Error {
+	held;
+	constructor(held) {
+		super(`Ports this workspace's apps are provisioned on are already in use:\n${held.map(({ app, port, holder }) => `   ${app}: ${port}${holder ? ` — held by ${holder}` : ""}`).join("\n")}\nStop what is holding them (often dev servers a previous run left behind) and start again. Nothing was started.`);
+		this.held = held;
+		this.name = "WorkspacePortsInUse";
+	}
+};
+/** What is listening on a port, as `command (pid N)`, if `lsof` can tell. */
+function listenerOn(port) {
+	try {
+		const out = execSync(`lsof -nP -iTCP:${port} -sTCP:LISTEN -Fpc`, {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+		const pid = out.match(/^p(\d+)/m)?.[1];
+		const command = out.match(/^c(.+)$/m)?.[1];
+		return pid ? `${command ?? "a process"} (pid ${pid})` : void 0;
+	} catch {
+		return;
+	}
+}
 var DevServer = class {
 	provider;
 	requestedPort;
@@ -1305,7 +1335,7 @@ var DevServer = class {
 		this.startTime = Date.now();
 		if (this.isRunning) await this.stop();
 		if (this.portExplicit) {
-			if (!await isPortAvailable(this.requestedPort)) throw new Error(`Port ${this.requestedPort} is already in use. Either stop the process using that port or omit -p/--port to auto-select an available port.`);
+			if (!await isPortAvailable(this.requestedPort)) throw new DevPortInUse(this.requestedPort, listenerOn(this.requestedPort));
 			this.actualPort = this.requestedPort;
 		} else {
 			this.actualPort = await findAvailablePort(this.requestedPort);
@@ -1323,7 +1353,8 @@ var DevServer = class {
 			stdio: "inherit",
 			env: {
 				...process.env,
-				NODE_ENV: "development"
+				NODE_ENV: "development",
+				GKM_DEV_PID: String(process.pid)
 			},
 			detached: true
 		});
@@ -3496,10 +3527,6 @@ var UnprovisionableBucket = class extends Error {
 */
 /**
 * Provision everything the workspace declares, and return what it resolved.
-*
-* Nothing happens for a project that has not adopted the model: `usesConstructs`
-* is the same hard switch reconcile reads, so an existing deploy is untouched
-* until it declares something.
 */
 async function provisionDeclared(options) {
 	const { workspace } = options;
@@ -3509,7 +3536,6 @@ async function provisionDeclared(options) {
 		provisioned: {},
 		clusters: {}
 	};
-	if (!usesConstructs(workspace)) return empty;
 	const manifest = options.manifest ?? await discover({
 		patterns: constructGlobs(workspace),
 		cwd: workspace.root
@@ -8515,26 +8541,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.25",
-	"@geekmidas/auth": "~10.0.0-alpha.25",
-	"@geekmidas/cache": "~10.0.0-alpha.25",
-	"@geekmidas/client": "~10.0.0-alpha.25",
-	"@geekmidas/cloud": "~10.0.0-alpha.25",
-	"@geekmidas/constructs": "~10.0.0-alpha.25",
-	"@geekmidas/db": "~10.0.0-alpha.25",
-	"@geekmidas/emailkit": "~10.0.0-alpha.25",
-	"@geekmidas/envkit": "~10.0.0-alpha.25",
-	"@geekmidas/errors": "~10.0.0-alpha.25",
-	"@geekmidas/events": "~10.0.0-alpha.25",
-	"@geekmidas/logger": "~10.0.0-alpha.25",
-	"@geekmidas/manifest": "~10.0.0-alpha.25",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.25",
-	"@geekmidas/schema": "~10.0.0-alpha.25",
-	"@geekmidas/services": "~10.0.0-alpha.25",
-	"@geekmidas/storage": "~10.0.0-alpha.25",
-	"@geekmidas/studio": "~10.0.0-alpha.25",
-	"@geekmidas/telescope": "~10.0.0-alpha.25",
-	"@geekmidas/testkit": "~10.0.0-alpha.25",
+	"@geekmidas/audit": "~10.0.0-alpha.27",
+	"@geekmidas/auth": "~10.0.0-alpha.27",
+	"@geekmidas/cache": "~10.0.0-alpha.27",
+	"@geekmidas/client": "~10.0.0-alpha.27",
+	"@geekmidas/cloud": "~10.0.0-alpha.27",
+	"@geekmidas/constructs": "~10.0.0-alpha.27",
+	"@geekmidas/db": "~10.0.0-alpha.27",
+	"@geekmidas/emailkit": "~10.0.0-alpha.27",
+	"@geekmidas/envkit": "~10.0.0-alpha.27",
+	"@geekmidas/errors": "~10.0.0-alpha.27",
+	"@geekmidas/events": "~10.0.0-alpha.27",
+	"@geekmidas/logger": "~10.0.0-alpha.27",
+	"@geekmidas/manifest": "~10.0.0-alpha.27",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.27",
+	"@geekmidas/schema": "~10.0.0-alpha.27",
+	"@geekmidas/services": "~10.0.0-alpha.27",
+	"@geekmidas/storage": "~10.0.0-alpha.27",
+	"@geekmidas/studio": "~10.0.0-alpha.27",
+	"@geekmidas/telescope": "~10.0.0-alpha.27",
+	"@geekmidas/testkit": "~10.0.0-alpha.27",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -15480,7 +15506,6 @@ async function testCommand(options = {}) {
 		stage,
 		startDocker: !options.prepare,
 		secretsFileName: "test-secrets.json",
-		resolveDockerPorts: "full",
 		reconcileStage: "test"
 	});
 	let finalCredentials = { ...result.credentials };
@@ -15494,14 +15519,13 @@ async function testCommand(options = {}) {
 			console.log(`  🔍 Sniffed ${sniffed.requiredEnvVars.length} required env var(s)` + (result.declaredKeys.length > 0 ? `, kept ${result.declaredKeys.length} declared` : ""));
 		}
 	}
-	finalCredentials = rewriteDatabaseUrlForTests(finalCredentials);
 	console.log("");
 	await writeFile(result.secretsJsonPath, JSON.stringify(finalCredentials, null, 2));
 	const gkmDir = join(cwd, ".gkm");
 	const preloadPath = join(gkmDir, "test-credentials-preload.ts");
 	await createCredentialsPreload(preloadPath, result.secretsJsonPath);
 	const workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
-	const manifestPath = workspace && usesConstructs(workspace) ? await writeTestHarness({
+	const manifestPath = workspace ? await writeTestHarness({
 		root: workspace.root,
 		targets: [workspace.root, ...Object.values(workspace.apps).map((app) => isAbsolute(app.path) ? app.path : join(workspace.root, app.path))],
 		patterns: constructGlobs(workspace),
@@ -15545,29 +15569,6 @@ async function testCommand(options = {}) {
 		});
 	});
 }
-const TEST_DB_SUFFIX = "_test";
-/**
-* Rewrite DATABASE_URL to point to a separate test database.
-* Appends `_test` to the database name (e.g., `app` -> `app_test`).
-* @internal Exported for testing
-*/
-function rewriteDatabaseUrlForTests(env) {
-	const result = { ...env };
-	for (const key of Object.keys(result)) {
-		if (!key.includes("DATABASE_URL")) continue;
-		const value = result[key];
-		try {
-			const url = new URL(value);
-			const dbName = url.pathname.slice(1);
-			if (dbName && !dbName.endsWith(TEST_DB_SUFFIX)) {
-				url.pathname = `/${dbName}${TEST_DB_SUFFIX}`;
-				result[key] = url.toString();
-				console.log(`  🧪 ${key}: using test database "${dbName}${TEST_DB_SUFFIX}"`);
-			}
-		} catch {}
-	}
-	return result;
-}
 /** `gkm test` outside a project that declares stages, with none named. */
 var NoStageToTest = class extends Error {
 	constructor() {
@@ -16108,7 +16109,7 @@ program.command("secrets:push").description("Send a deployed stage's secrets to
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pushStageSecrets } = await import("./transfer-B88fTvnh.mjs").then((n) => n.i);
+		const { pushStageSecrets } = await import("./transfer-BV00TxZv.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -16123,7 +16124,7 @@ program.command("secrets:pull").description("Bring a deployed stage's secrets fr
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pullStageSecrets } = await import("./transfer-B88fTvnh.mjs").then((n) => n.i);
+		const { pullStageSecrets } = await import("./transfer-BV00TxZv.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -16138,7 +16139,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-gb1lz1Dk.mjs").then((n) => n.n);
+		const { reconcileMissingSecrets } = await import("./reconcile-DhbCvh4K.mjs").then((n) => n.n);
 		const { readStageSecrets, writeStageSecrets } = await import("./storage-TP0x118M.mjs").then((n) => n.a);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
@@ -16147,7 +16148,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./credentials-BpoOUa74.mjs").then((n) => n.g);
+		const { derivedContainers } = await import("./workspace-CUmR_k4J.mjs").then((n) => n.a);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16206,7 +16207,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-BOaa3kQR.mjs");
+		const { deployGithubCommand } = await import("./github-Ba5kXEJo.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));