@geekmidas/cli 10.0.0-alpha.45 → 10.0.0-alpha.47

package/dist/index.cjs

@@ -1,16 +1,17 @@
 #!/usr/bin/env -S npx tsx
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_discover = require("./discover-B0f_kuNN.cjs");
-const require_config = require("./config-CJ-PAb7M.cjs");
-const require_workspace = require("./workspace-RYSYtHP7.cjs");
+const require_discover = require("./discover-DXNviAh-.cjs");
+const require_config = require("./config-CsYSyUya.cjs");
+const require_workspace = require("./workspace-DEibcoBe.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-DQgxT_WR.cjs");
-const require_workspace$1 = require("./workspace-dV6f-3vv.cjs");
-const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-B4Kj_qNU.cjs");
+const require_workspace$1 = require("./workspace-vafrzZTC.cjs");
+const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BN0PIZxd.cjs");
 const require_openapi = require("./openapi.cjs");
-const require_ready = require("./ready-3RfHxdA0.cjs");
-const require_emit = require("./emit-BdoPFjZf.cjs");
+const require_ready = require("./ready-lr2Fm-ep.cjs");
+const require_backends = require("./backends-B9V2XD2M.cjs");
+const require_emit = require("./emit-Dmc1nvdS.cjs");
 let commander = require("commander");
 let node_process = require("node:process");
 let node_readline_promises = require("node:readline/promises");
@@ -28,6 +29,7 @@ let chokidar = require("chokidar");
 chokidar = require_rolldown_runtime.__toESM(chokidar, 1);
 let node_crypto = require("node:crypto");
 let node_url = require("node:url");
+let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let pg = require("pg");
 let yaml = require("yaml");
@@ -46,7 +48,7 @@ let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
 //#region package.json
-var version = "10.0.0-alpha.45";
+var version = "10.0.0-alpha.47";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -180,7 +182,7 @@ async function getHostingerToken(options) {
 }
 //#endregion
 //#region src/auth/index.ts
-const logger$13 = console;
+const logger$12 = console;
 /**
 * Validate Dokploy token by making a test API call
 */
@@ -247,52 +249,52 @@ async function prompt$1(message, hidden = false) {
 async function loginCommand(options) {
 	const { provider, token: providedToken, endpoint: providedEndpoint } = options;
 	if (provider === "dokploy") {
-		logger$13.log("\n🔐 Logging in to Dokploy...\n");
+		logger$12.log("\n🔐 Logging in to Dokploy...\n");
 		let endpoint = providedEndpoint;
 		if (!endpoint) endpoint = await prompt$1("Dokploy URL (e.g., https://dokploy.example.com): ");
 		endpoint = endpoint.replace(/\/$/, "");
 		try {
 			new URL(endpoint);
 		} catch {
-			logger$13.error("Invalid URL format");
+			logger$12.error("Invalid URL format");
 			process.exit(1);
 		}
 		let token = providedToken;
 		if (!token) {
-			logger$13.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			logger$12.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
 			token = await prompt$1("API Token: ", true);
 		}
 		if (!token) {
-			logger$13.error("Token is required");
+			logger$12.error("Token is required");
 			process.exit(1);
 		}
-		logger$13.log("\nValidating credentials...");
+		logger$12.log("\nValidating credentials...");
 		if (!await validateDokployToken(endpoint, token)) {
-			logger$13.error("\n✗ Invalid credentials. Please check your token and try again.");
+			logger$12.error("\n✗ Invalid credentials. Please check your token and try again.");
 			process.exit(1);
 		}
 		await storeDokployCredentials(token, endpoint);
-		logger$13.log("\n✓ Successfully logged in to Dokploy!");
-		logger$13.log(`  Endpoint: ${endpoint}`);
-		logger$13.log(`  Credentials stored in: ${getCredentialsPath()}`);
-		logger$13.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
+		logger$12.log("\n✓ Successfully logged in to Dokploy!");
+		logger$12.log(`  Endpoint: ${endpoint}`);
+		logger$12.log(`  Credentials stored in: ${getCredentialsPath()}`);
+		logger$12.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
 	}
 	if (provider === "hostinger") {
-		logger$13.log("\n🔐 Logging in to Hostinger...\n");
+		logger$12.log("\n🔐 Logging in to Hostinger...\n");
 		let token = providedToken;
 		if (!token) {
-			logger$13.log("\nGenerate a token at: https://hpanel.hostinger.com/profile/api\n");
+			logger$12.log("\nGenerate a token at: https://hpanel.hostinger.com/profile/api\n");
 			token = await prompt$1("API Token: ", true);
 		}
 		if (!token) {
-			logger$13.error("Token is required");
+			logger$12.error("Token is required");
 			process.exit(1);
 		}
 		await storeHostingerToken(token);
-		logger$13.log("\n✓ Hostinger token stored.");
-		logger$13.log(`  Credentials stored in: ${getCredentialsPath()}`);
-		logger$13.log("  Not validated here: every DNS endpoint is scoped to a domain, so the\n  first deploy that touches DNS is where a bad token reports itself.");
-		logger$13.log("\nYou can now use it as a DNS provider without setting HOSTINGER_API_TOKEN.");
+		logger$12.log("\n✓ Hostinger token stored.");
+		logger$12.log(`  Credentials stored in: ${getCredentialsPath()}`);
+		logger$12.log("  Not validated here: every DNS endpoint is scoped to a domain, so the\n  first deploy that touches DNS is where a bad token reports itself.");
+		logger$12.log("\nYou can now use it as a DNS provider without setting HOSTINGER_API_TOKEN.");
 	}
 }
 /**
@@ -301,27 +303,27 @@ async function loginCommand(options) {
 async function logoutCommand(options) {
 	const { provider = "dokploy" } = options;
 	if (provider === "all") {
-		if (await removeDokployCredentials()) logger$13.log("\n✓ Logged out from all services");
-		else logger$13.log("\nNo stored credentials found");
+		if (await removeDokployCredentials()) logger$12.log("\n✓ Logged out from all services");
+		else logger$12.log("\nNo stored credentials found");
 		return;
 	}
 	if (provider === "dokploy") {
-		if (await removeDokployCredentials()) logger$13.log("\n✓ Logged out from Dokploy");
-		else logger$13.log("\nNo Dokploy credentials found");
+		if (await removeDokployCredentials()) logger$12.log("\n✓ Logged out from Dokploy");
+		else logger$12.log("\nNo Dokploy credentials found");
 	}
 }
 /**
 * Show current login status
 */
 async function whoamiCommand() {
-	logger$13.log("\n📋 Current credentials:\n");
+	logger$12.log("\n📋 Current credentials:\n");
 	const dokploy = await getDokployCredentials();
 	if (dokploy) {
-		logger$13.log("  Dokploy:");
-		logger$13.log(`    Endpoint: ${dokploy.endpoint}`);
-		logger$13.log(`    Token: ${maskToken(dokploy.token)}`);
-	} else logger$13.log("  Dokploy: Not logged in");
-	logger$13.log(`\n  Credentials file: ${getCredentialsPath()}`);
+		logger$12.log("  Dokploy:");
+		logger$12.log(`    Endpoint: ${dokploy.endpoint}`);
+		logger$12.log(`    Token: ${maskToken(dokploy.token)}`);
+	} else logger$12.log("  Dokploy: Not logged in");
+	logger$12.log(`\n  Credentials file: ${getCredentialsPath()}`);
 }
 /**
 * Mask a token for display
@@ -331,85 +333,14 @@ function maskToken(token) {
 	return `${token.slice(0, 4)}...${token.slice(-4)}`;
 }
 //#endregion
-//#region src/build/providerResolver.ts
-/**
-* Resolves provider configuration from the new simplified system
-* to the internal legacy format for backward compatibility
-*/
-function resolveProviders(config, options) {
-	const providers = [];
-	let enableOpenApi = options.enableOpenApi || false;
-	if (options.providers) return {
-		providers: options.providers,
-		enableOpenApi
-	};
-	if (options.provider) {
-		const resolvedProviders = resolveMainProvider(options.provider, config.providers);
-		providers.push(...resolvedProviders.providers);
-		enableOpenApi = resolvedProviders.enableOpenApi || enableOpenApi;
-	} else if (config.providers) {
-		const resolvedProviders = resolveAllConfiguredProviders(config.providers);
-		providers.push(...resolvedProviders.providers);
-		enableOpenApi = resolvedProviders.enableOpenApi || enableOpenApi;
-	} else providers.push("aws-apigatewayv2", "aws-lambda");
-	return {
-		providers: [...new Set(providers)],
-		enableOpenApi
-	};
-}
-function resolveMainProvider(mainProvider, providersConfig) {
-	const providers = [];
-	let enableOpenApi = false;
-	if (mainProvider === "aws") {
-		const awsConfig = providersConfig?.aws;
-		if (awsConfig?.apiGateway) {
-			if (isEnabled(awsConfig.apiGateway.v1)) providers.push("aws-apigatewayv1");
-			if (isEnabled(awsConfig.apiGateway.v2)) providers.push("aws-apigatewayv2");
-		} else providers.push("aws-apigatewayv2");
-		if (awsConfig?.lambda) {
-			if (isEnabled(awsConfig.lambda.functions) || isEnabled(awsConfig.lambda.crons)) providers.push("aws-lambda");
-		} else providers.push("aws-lambda");
-	} else if (mainProvider === "server") {
-		providers.push("server");
-		const serverConfig = providersConfig?.server;
-		if (typeof serverConfig === "object" && serverConfig?.enableOpenApi) enableOpenApi = true;
-	}
-	return {
-		providers,
-		enableOpenApi
-	};
-}
-function resolveAllConfiguredProviders(providersConfig) {
-	const providers = [];
-	let enableOpenApi = false;
-	if (providersConfig.aws) {
-		const awsProviders = resolveMainProvider("aws", providersConfig);
-		providers.push(...awsProviders.providers);
-	}
-	if (providersConfig.server && isEnabled(providersConfig.server)) {
-		providers.push("server");
-		if (typeof providersConfig.server === "object" && providersConfig.server.enableOpenApi) enableOpenApi = true;
-	}
-	return {
-		providers,
-		enableOpenApi
-	};
-}
-function isEnabled(config) {
-	if (config === void 0) return false;
-	if (typeof config === "boolean") return config;
-	return config.enabled !== false;
-}
-//#endregion
 //#region src/workspace/client-generator.ts
 /**
 * Normalize routes to an array of patterns.
-* Handles string, string[], and PartitionedRoutes (extracts paths).
+* Handles a glob or a list of them.
 * @internal Exported for use in dev command
 */
 function normalizeRoutes(routes) {
 	if (!routes) return [];
-	if (require_discover.isPartitionedRoutes(routes)) return Array.isArray(routes.paths) ? routes.paths : [routes.paths];
 	return Array.isArray(routes) ? routes : [routes];
 }
 //#endregion
@@ -428,7 +359,7 @@ function normalizeRoutes(routes) {
 * trade than one that tells you what to type. Caddy's own `caddy trust` draws
 * the line in the same place.
 */
-const logger$12 = console;
+const logger$11 = console;
 const run = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * How each platform is told about a new authority.
@@ -480,15 +411,15 @@ async function trustCommand(options = {}) {
 	const certificate = (0, node_path.join)(workspace.root, require_workspace$1.LOCAL_CA_PATH);
 	if (!(0, node_fs.existsSync)(certificate)) throw new NoLocalAuthority(certificate);
 	const { describe, steps } = installation(process.platform, certificate);
-	logger$12.log(`\n🔐 Trusting the local authority in ${describe}`);
-	logger$12.log(`   ${certificate}\n`);
+	logger$11.log(`\n🔐 Trusting the local authority in ${describe}`);
+	logger$11.log(`   ${certificate}\n`);
 	if (options.dryRun) {
-		for (const [command, args] of steps) logger$12.log(`   ${command} ${args.join(" ")}`);
+		for (const [command, args] of steps) logger$11.log(`   ${command} ${args.join(" ")}`);
 		return;
 	}
-	logger$12.log("   This needs an admin password.\n");
+	logger$11.log("   This needs an admin password.\n");
 	for (const [command, args] of steps) await run(command, args, { stdio: "inherit" });
-	logger$12.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
+	logger$11.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
 }
 /**
 * Trust the authority if this machine lacks it and its owner agrees.
@@ -505,7 +436,7 @@ async function ensureTrusted(root, url, options = {}) {
 	if (await isTrusted(url)) return;
 	if (!options.assumeYes) {
 		if (!process.stdin.isTTY) {
-			logger$12.log("   Local https addresses are not trusted here. Run \"gkm trust\", or \"gkm setup --yes\".");
+			logger$11.log("   Local https addresses are not trusted here. Run \"gkm trust\", or \"gkm setup --yes\".");
 			return;
 		}
 		if (await declined(root)) return;
@@ -517,7 +448,7 @@ async function ensureTrusted(root, url, options = {}) {
 		});
 		if (!install) {
 			await recordDeclined(root);
-			logger$12.log("   Skipped. Run \"gkm trust\" later.");
+			logger$11.log("   Skipped. Run \"gkm trust\" later.");
 			return;
 		}
 	}
@@ -1067,7 +998,7 @@ function closeFakes(served) {
 }
 //#endregion
 //#region src/exec/index.ts
-const logger$11 = console;
+const logger$10 = console;
 /** `gkm exec` was given nothing to run. */
 var NoCommandSpecified = class extends Error {
 	constructor() {
@@ -1090,17 +1021,17 @@ async function execCommand(commandArgs, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$11.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$10.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const { credentials, secretsJsonPath, appName } = await require_workspace$1.prepareEntryCredentials({ cwd });
-	if (appName) logger$11.log(`📦 App: ${appName}`);
+	if (appName) logger$10.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0) logger$11.log(`🔐 Loaded ${secretCount} secret(s)`);
+	if (secretCount > 0) logger$10.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const preloadDir = (0, node_path.join)(cwd, ".gkm");
 	await (0, node_fs_promises.mkdir)(preloadDir, { recursive: true });
 	const preloadPath = (0, node_path.join)(preloadDir, "credentials-preload.mjs");
 	await require_workspace$1.createCredentialsPreload(preloadPath, secretsJsonPath);
 	const [cmd, ...args] = commandArgs;
-	logger$11.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
+	logger$10.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const nodeOptions = [(process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim(), `--import=${preloadPath}`].filter(Boolean).join(" ");
 	const child = (0, node_child_process.spawn)(cmd, args, {
 		cwd,
@@ -1114,7 +1045,7 @@ async function execCommand(commandArgs, options = {}) {
 	const exitCode = await new Promise((resolve) => {
 		child.on("close", (code) => resolve(code ?? 0));
 		child.on("error", (error) => {
-			logger$11.error(`Failed to run command: ${error.message}`);
+			logger$10.error(`Failed to run command: ${error.message}`);
 			resolve(1);
 		});
 	});
@@ -1122,7 +1053,7 @@ async function execCommand(commandArgs, options = {}) {
 }
 //#endregion
 //#region src/dev/index.ts
-const logger$10 = console;
+const logger$9 = console;
 /**
 * Normalize telescope configuration
 * @internal Exported for testing
@@ -1187,39 +1118,36 @@ function normalizeHooksConfig(config, cwd = process.cwd()) {
 	return { serverHooksPath: (0, node_path.resolve)(cwd, serverPath) };
 }
 /**
-* Normalize production configuration
+* What a `--production` build is.
+*
+* A server runs its worker's background work itself — queues polled, crons
+* scheduled, subscribers drained — so the production entry wires all three.
+* The build writes their files on every server build, empty when there is
+* nothing, so including them costs an app without any nothing.
+*
 * @internal Exported for testing
 */
-function normalizeProductionConfig(cliProduction, configProduction) {
+function normalizeProductionConfig(cliProduction) {
 	if (!cliProduction) return;
-	const config = configProduction ?? {};
 	return {
 		enabled: true,
-		bundle: config.bundle ?? true,
-		minify: config.minify ?? true,
-		healthCheck: config.healthCheck ?? "/health",
-		gracefulShutdown: config.gracefulShutdown ?? true,
-		external: config.external ?? [],
-		subscribers: config.subscribers ?? "exclude",
-		openapi: config.openapi ?? false,
-		optimizedHandlers: config.optimizedHandlers ?? true
+		bundle: true,
+		minify: true,
+		healthCheck: "/health",
+		gracefulShutdown: true,
+		external: [],
+		subscribers: "include",
+		openapi: false,
+		optimizedHandlers: true
 	};
 }
-/**
-* Get production config from GkmConfig
-* @internal
-*/
-function getProductionConfigFromGkm(config) {
-	const serverConfig = config.providers?.server;
-	if (typeof serverConfig === "object") return serverConfig.production;
-}
 /** Read by the generated server: no subscriber is subscribed or polled. */
 const SUBSCRIBERS_ENV = "GKM_SUBSCRIBERS";
 async function devCommand(options) {
 	if (options.subscribers === false) process.env[SUBSCRIBERS_ENV] = "off";
 	if (options.entry) return entryDevCommand(options);
 	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$10.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$9.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const appConfig = await require_config.loadAppConfig().catch((error) => {
 		if (error instanceof require_config.NotInAnApp || error instanceof require_config.NotABackendApp) return;
 		throw error;
@@ -1235,7 +1163,7 @@ async function devCommand(options) {
 	const workspaceAppPort = appConfig.app.port;
 	const workspace = appConfig.workspace;
 	if (appConfig.app.entry) {
-		logger$10.log(`📄 Using entry point: ${appConfig.app.entry}`);
+		logger$9.log(`📄 Using entry point: ${appConfig.app.entry}`);
 		return entryDevCommand({
 			...options,
 			entry: appConfig.app.entry,
@@ -1245,21 +1173,20 @@ async function devCommand(options) {
 	}
 	if (config.env) {
 		const { loaded, missing } = require_workspace$1.loadEnvFiles(config.env, appRoot);
-		if (loaded.length > 0) logger$10.log(`📦 Loaded env: ${loaded.join(", ")}`);
-		if (missing.length > 0) logger$10.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
+		if (loaded.length > 0) logger$9.log(`📦 Loaded env: ${loaded.join(", ")}`);
+		if (missing.length > 0) logger$9.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
-	const resolved = resolveProviders(config, { provider: "server" });
 	const telescope = normalizeTelescopeConfig(config.telescope);
 	const studio = normalizeStudioConfig(config.studio);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
-	const enableOpenApi = require_openapi.resolveOpenApiConfig(config).enabled || resolved.enableOpenApi;
+	const enableOpenApi = require_openapi.resolveOpenApiConfig(config).enabled;
 	const build = (bustCache = false) => quietly(() => buildApp({
 		config,
 		workspaceRoot: workspace?.root ?? secretsRoot,
 		appRoot,
-		providers: ["server"],
+		target: "server",
 		enableOpenApi,
-		cacheBackend: require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(workspace ?? config)),
+		cacheBackend: require_backends.cacheBackendFor(require_backends.providerOf(workspace ?? config)),
 		telescope,
 		studio,
 		hooks,
@@ -1277,9 +1204,9 @@ async function devCommand(options) {
 			stage: workspace.stages.local,
 			...options.fake ? { fake: true } : {}
 		});
-		if (reconciled.changed && reconciled.plan.containers.length > 0) {
-			logger$10.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-			for (const [container, address] of Object.entries(reconciled.addresses)) logger$10.log(`   ${container}: ${address}`);
+		if (reconciled.services.length > 0) {
+			logger$9.log("🐳 Services");
+			for (const line of require_workspace$1.describeServices(reconciled.services)) logger$9.log(line);
 		}
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_config.appKey(r.id) === workspaceAppName);
@@ -1292,7 +1219,7 @@ async function devCommand(options) {
 		secretsJsonPath = (0, node_path.join)(secretsDir, secretsFileName);
 		await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(appSecrets, null, 2));
 	}
-	const devServer = new DevServer(resolved.providers[0], options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? workspaceAppPort !== void 0, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath, initial.selfServing !== void 0);
+	const devServer = new DevServer(options.port ?? workspaceAppPort ?? 3e3, options.portExplicit ?? workspaceAppPort !== void 0, enableOpenApi, telescope, studio, runtime, appRoot, secretsJsonPath, initial.selfServing !== void 0);
 	devServer.label = workspaceAppName ?? "server";
 	devServer.publicUrl = publicUrl;
 	await devServer.start();
@@ -1313,11 +1240,11 @@ async function devCommand(options) {
 		cwd: appRoot
 	});
 	watcher.on("error", (error) => {
-		logger$10.error("❌ Watcher error:", error);
+		logger$9.error("❌ Watcher error:", error);
 	});
 	let rebuildTimeout = null;
 	watcher.on("change", async (path) => {
-		logger$10.log(`🔄 ${path} changed — rebuilding`);
+		logger$9.log(`🔄 ${path} changed — rebuilding`);
 		if (rebuildTimeout) clearTimeout(rebuildTimeout);
 		rebuildTimeout = setTimeout(async () => {
 			try {
@@ -1326,8 +1253,8 @@ async function devCommand(options) {
 				await devServer.restart();
 			} catch (error) {
 				const err = error;
-				logger$10.error(`❌ Rebuild failed: ${err.message}`);
-				if (err.stack) logger$10.error(err.stack);
+				logger$9.error(`❌ Rebuild failed: ${err.message}`);
+				if (err.stack) logger$9.error(err.stack);
 			}
 		}, 300);
 	});
@@ -1335,9 +1262,9 @@ async function devCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$10.log("\n🛑 Shutting down...");
+		logger$9.log("\n🛑 Shutting down...");
 		Promise.all([watcher.close(), devServer.stop()]).catch((err) => {
-			logger$10.error("Error during shutdown:", err);
+			logger$9.error("Error during shutdown:", err);
 		}).finally(() => {
 			process.exit(0);
 		});
@@ -1539,7 +1466,7 @@ async function workspaceDevCommand(workspace, options) {
 	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "web");
 	const conflicts = checkPortConflicts(workspace);
 	if (conflicts.length > 0) {
-		for (const conflict of conflicts) logger$10.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
+		for (const conflict of conflicts) logger$9.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
 		throw new Error("Port conflicts detected. Please assign unique ports to each app.");
 	}
 	if (frontendApps.length > 0) {
@@ -1548,10 +1475,10 @@ async function workspaceDevCommand(workspace, options) {
 		for (const result of validationResults) {
 			if (!result.valid) {
 				hasErrors = true;
-				logger$10.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
-				for (const error of result.errors) logger$10.error(`   • ${error}`);
+				logger$9.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
+				for (const error of result.errors) logger$9.error(`   • ${error}`);
 			}
-			for (const warning of result.warnings) logger$10.warn(`   ⚠️  ${result.appName}: ${warning}`);
+			for (const warning of result.warnings) logger$9.warn(`   ⚠️  ${result.appName}: ${warning}`);
 		}
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
 	}
@@ -1560,21 +1487,21 @@ async function workspaceDevCommand(workspace, options) {
 		stage: workspace.stages.local,
 		...options.fake ? { fake: true } : {}
 	});
-	if (reconciled.changed && reconciled.plan.containers.length > 0) {
-		logger$10.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-		for (const [container, address] of Object.entries(reconciled.addresses)) logger$10.log(`   ${container}: ${address}`);
+	if (reconciled.services.length > 0) {
+		logger$9.log("🐳 Services");
+		for (const line of require_workspace$1.describeServices(reconciled.services)) logger$9.log(line);
 	}
 	const secretsEnv = {
 		...rawSecrets,
 		...reconciled.env
 	};
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
-	for (const { id, port } of fakes) logger$10.log(`🎭 ${id} fake: http://localhost:${port}`);
+	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-PJi4b1ga.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-PJi4b1ga.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
-		logger$10.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
+	} else await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
 	for (const resource of reconciled.plan.resources) {
@@ -1595,11 +1522,11 @@ async function workspaceDevCommand(workspace, options) {
 	else {
 		const { filters, unpackaged } = turboFilters(workspace);
 		turboFilter = filters.flatMap((name) => ["--filter", name]);
-		if (unpackaged.length > 0) logger$10.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
+		if (unpackaged.length > 0) logger$9.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
 	}
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
 	const width = Math.max(...buildOrder.map((name) => name.length));
-	logger$10.log(`\n${workspace.name}: ${appCount} app(s)`);
+	logger$9.log(`\n${workspace.name}: ${appCount} app(s)`);
 	for (const appName of buildOrder) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
@@ -1607,14 +1534,14 @@ async function workspaceDevCommand(workspace, options) {
 			const own = reconciled.plan.resources.find((r) => r.kind === "mobile-app" && require_config.appKey(r.id) === appName);
 			const scheme = own ? reconciled.env[own.envKey] : void 0;
 			const device = Object.entries(reconciled.env).find(([key]) => key.endsWith("_DEVICE_URL"))?.[1];
-			logger$10.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
+			logger$9.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
 			continue;
 		}
 		const local = `http://localhost:${app.port}`;
 		const url = Object.entries(appUrls).find(([id]) => require_config.appKey(id) === appName)?.[1];
-		logger$10.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
+		logger$9.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
 	}
-	logger$10.log("");
+	logger$9.log("");
 	const configFiles = [
 		"gkm.config.ts",
 		"gkm.config.js",
@@ -1661,7 +1588,7 @@ async function workspaceDevCommand(workspace, options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$10.log("\n🛑 Shutting down workspace...");
+		logger$9.log("\n🛑 Shutting down workspace...");
 		closeFakes(fakes);
 		const pid = turboProcess.pid;
 		if (pid) try {
@@ -1686,7 +1613,7 @@ async function workspaceDevCommand(workspace, options) {
 	process.on("SIGTERM", shutdown);
 	return new Promise((resolve, reject) => {
 		turboProcess.on("error", (error) => {
-			logger$10.error("❌ Turbo error:", error);
+			logger$9.error("❌ Turbo error:", error);
 			reject(error);
 		});
 		turboProcess.on("exit", (code) => {
@@ -1705,11 +1632,11 @@ async function entryDevCommand(options) {
 	const entryPath = (0, node_path.resolve)(process.cwd(), entry);
 	if (!(0, node_fs.existsSync)(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
 	const defaultEnv = require_workspace$1.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$10.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$9.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_workspace$1.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
-	if (appName) logger$10.log(`📦 App: ${appName} (port ${resolvedPort})`);
-	logger$10.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
-	if (Object.keys(credentials).length > 1) logger$10.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
+	if (appName) logger$9.log(`📦 App: ${appName} (port ${resolvedPort})`);
+	logger$9.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
+	if (Object.keys(credentials).length > 1) logger$9.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
 	const wrapperDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(wrapperDir, { recursive: true });
 	const wrapperPath = (0, node_path.join)(wrapperDir, "entry-wrapper.ts");
@@ -1720,7 +1647,7 @@ async function entryDevCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$10.log("\n🛑 Shutting down...");
+		logger$9.log("\n🛑 Shutting down...");
 		runner.stop();
 		process.exit(0);
 	};
@@ -1756,14 +1683,14 @@ var EntryRunner = class {
 			});
 			let restartTimeout = null;
 			this.watcher.on("change", (path) => {
-				logger$10.log(`📝 File changed: ${path}`);
+				logger$9.log(`📝 File changed: ${path}`);
 				if (restartTimeout) clearTimeout(restartTimeout);
 				restartTimeout = setTimeout(async () => {
-					logger$10.log("🔄 Restarting...");
+					logger$9.log("🔄 Restarting...");
 					await this.restart();
 				}, 300);
 			});
-			logger$10.log(`👀 Watching for changes in: ${watchDir}`);
+			logger$9.log(`👀 Watching for changes in: ${watchDir}`);
 		}
 	}
 	async runProcess() {
@@ -1778,17 +1705,17 @@ var EntryRunner = class {
 		});
 		this.isRunning = true;
 		this.childProcess.on("error", (error) => {
-			logger$10.error("❌ Process error:", error);
+			logger$9.error("❌ Process error:", error);
 		});
 		this.childProcess.on("exit", (code) => {
-			if (code !== null && code !== 0 && code !== 143) logger$10.error(`❌ Process exited with code ${code}`);
+			if (code !== null && code !== 0 && code !== 143) logger$9.error(`❌ Process exited with code ${code}`);
 			this.isRunning = false;
 		});
 		await new Promise((resolve) => setTimeout(resolve, 500));
 		if (this.isRunning) {
-			logger$10.log("");
-			logger$10.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
-			logger$10.log("");
+			logger$9.log("");
+			logger$9.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
+			logger$9.log("");
 		}
 	}
 	async restart() {
@@ -1966,7 +1893,6 @@ function listenerOn(port) {
 	}
 }
 var DevServer = class {
-	provider;
 	requestedPort;
 	portExplicit;
 	enableOpenApi;
@@ -1980,8 +1906,7 @@ var DevServer = class {
 	isRunning = false;
 	actualPort;
 	startTime = Date.now();
-	constructor(provider, requestedPort, portExplicit, enableOpenApi, telescope, studio, runtime = "node", appRoot = process.cwd(), secretsJsonPath, selfServing = false) {
-		this.provider = provider;
+	constructor(requestedPort, portExplicit, enableOpenApi, telescope, studio, runtime = "node", appRoot = process.cwd(), secretsJsonPath, selfServing = false) {
 		this.requestedPort = requestedPort;
 		this.portExplicit = portExplicit;
 		this.enableOpenApi = enableOpenApi;
@@ -2008,9 +1933,9 @@ var DevServer = class {
 			this.actualPort = this.requestedPort;
 		} else {
 			this.actualPort = await require_workspace$1.findAvailablePort(this.requestedPort);
-			if (this.actualPort !== this.requestedPort) logger$10.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
+			if (this.actualPort !== this.requestedPort) logger$9.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
-		const serverEntryPath = (0, node_path.join)(this.appRoot, ".gkm", this.provider, "server.ts");
+		const serverEntryPath = (0, node_path.join)(this.appRoot, ".gkm", "server", "server.ts");
 		await this.createServerEntry();
 		this.serverProcess = (0, node_child_process.spawn)(...tsxCommand(this.appRoot, [
 			serverEntryPath,
@@ -2027,10 +1952,10 @@ var DevServer = class {
 		});
 		this.isRunning = true;
 		this.serverProcess.on("error", (error) => {
-			logger$10.error("❌ Server error:", error);
+			logger$9.error("❌ Server error:", error);
 		});
 		this.serverProcess.on("exit", (code, signal) => {
-			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$10.error(`❌ Server exited with code ${code}`);
+			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$9.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 		});
 		await new Promise((resolve) => setTimeout(resolve, 1e3));
@@ -2038,13 +1963,13 @@ var DevServer = class {
 			const local = `http://localhost:${this.actualPort}`;
 			const address = this.publicUrl ? `${this.publicUrl} -> ${local}` : local;
 			const seconds = ((Date.now() - this.startTime) / 1e3).toFixed(1);
-			logger$10.log(`\x1b[32m✓\x1b[0m ${this.label} ready in ${seconds}s  ${address}`);
+			logger$9.log(`\x1b[32m✓\x1b[0m ${this.label} ready in ${seconds}s  ${address}`);
 			const tools = this.selfServing ? [] : [
 				...this.enableOpenApi ? ["docs /__docs"] : [],
 				...this.telescope ? [`telescope ${this.telescope.path}`] : [],
 				...this.studio ? [`studio ${this.studio.path}`] : []
 			];
-			if (tools.length > 0) logger$10.log(`  ${tools.join(" · ")}`);
+			if (tools.length > 0) logger$9.log(`  ${tools.join(" · ")}`);
 		}
 	}
 	async stop() {
@@ -2082,7 +2007,7 @@ var DevServer = class {
 	}
 	async createServerEntry() {
 		const { writeFile: fsWriteFile } = await import("node:fs/promises");
-		await fsWriteFile((0, node_path.join)(this.appRoot, ".gkm", this.provider, "server.ts"), generateServerEntryContent({
+		await fsWriteFile((0, node_path.join)(this.appRoot, ".gkm", "server", "server.ts"), generateServerEntryContent({
 			secretsJsonPath: this.secretsJsonPath,
 			runtime: this.runtime,
 			enableOpenApi: this.enableOpenApi,
@@ -2094,22 +2019,22 @@ var DevServer = class {
 //#region src/generators/CronGenerator.ts
 var CronGenerator = class extends require_discover.ConstructGenerator {
 	async build(context, constructs, outputDir, options) {
-		const provider = options?.provider || "aws-lambda";
+		const target = options?.target ?? "aws";
 		const logger = console;
 		const cronInfos = [];
-		if (provider === "server") {
+		if (target === "server") {
 			await this.generateServerCronsFile(outputDir, constructs);
 			logger.log(`Generated server crons file with ${constructs.length} crons`);
 			return cronInfos;
 		}
-		if (constructs.length === 0 || provider !== "aws-lambda") return cronInfos;
+		if (constructs.length === 0) return cronInfos;
 		const cronsDir = (0, node_path.join)(outputDir, "crons");
 		await (0, node_fs_promises.mkdir)(cronsDir, { recursive: true });
 		for (const { key, construct, path } of constructs) {
 			const handlerFile = await this.generateCronHandler(cronsDir, path.relative, key, context, construct.owner);
 			cronInfos.push({
 				name: key,
-				handler: (0, node_path.relative)(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				handler: (0, node_path.relative)(options?.root ?? process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
 				schedule: construct.schedule || "rate(1 hour)",
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
@@ -2299,17 +2224,17 @@ var FunctionGenerator = class extends require_discover.ConstructGenerator {
 		return _geekmidas_constructs_functions.Function.isFunction(value);
 	}
 	async build(context, constructs, outputDir, options) {
-		const provider = options?.provider || "aws-lambda";
+		const target = options?.target ?? "aws";
 		const logger = console;
 		const functionInfos = [];
-		if (constructs.length === 0 || provider !== "aws-lambda") return functionInfos;
+		if (constructs.length === 0 || target === "server") return functionInfos;
 		const functionsDir = (0, node_path.join)(outputDir, "functions");
 		await (0, node_fs_promises.mkdir)(functionsDir, { recursive: true });
 		for (const { key, construct, path } of constructs) {
 			const handlerFile = await this.generateFunctionHandler(functionsDir, path.relative, key, context, construct.owner);
 			functionInfos.push({
 				name: key,
-				handler: (0, node_path.relative)(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				handler: (0, node_path.relative)(options?.root ?? process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
 				timeout: construct.timeout,
 				memorySize: construct.memorySize,
 				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
@@ -2353,22 +2278,22 @@ var QueueGenerator = class extends require_discover.ConstructGenerator {
 		return _geekmidas_constructs_queue.Queue.isQueue(value);
 	}
 	async build(context, constructs, outputDir, options) {
-		const provider = options?.provider || "aws-lambda";
+		const target = options?.target ?? "aws";
 		const logger = console;
 		const queueInfos = [];
-		if (provider === "server") {
+		if (target === "server") {
 			await this.generateServerQueuesFile(outputDir, constructs);
 			logger.log(`Generated server queues file with ${constructs.length} queues (polling mode)`);
 			return queueInfos;
 		}
-		if (constructs.length === 0 || provider !== "aws-lambda") return queueInfos;
+		if (constructs.length === 0) return queueInfos;
 		const queuesDir = (0, node_path.join)(outputDir, "queues");
 		await (0, node_fs_promises.mkdir)(queuesDir, { recursive: true });
 		for (const { key, construct, path } of constructs) {
 			const handlerFile = await this.generateQueueHandler(queuesDir, path.relative, key, context, construct.owner);
 			queueInfos.push({
 				name: construct.name,
-				handler: (0, node_path.relative)(process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
+				handler: (0, node_path.relative)(options?.root ?? process.cwd(), handlerFile).replace(/\.ts$/, ".handler"),
 				batchSize: construct.batchSize,
 				fifo: construct.fifo,
 				timeout: construct.timeout,
@@ -2534,217 +2459,6 @@ var TopicGenerator = class extends require_discover.ConstructGenerator {
 	}
 };
 //#endregion
-//#region src/build/manifests.ts
-const logger$9 = console;
-function isPartitioned(field) {
-	return !Array.isArray(field);
-}
-/**
-* Serialize a manifest field to a TypeScript string.
-* Flat arrays serialize as JSON arrays, partitioned fields as objects of arrays.
-*/
-function serializeField(field, indent = 2) {
-	if (Array.isArray(field)) return JSON.stringify(field, null, indent);
-	return `{\n${Object.entries(field).map(([key, value]) => `    ${JSON.stringify(key)}: ${JSON.stringify(value, null, indent)}`).join(",\n")},\n  }`;
-}
-/**
-* Count total items across a manifest field (flat or partitioned).
-*/
-function countItems(field) {
-	if (Array.isArray(field)) return field.length;
-	return Object.values(field).reduce((sum, arr) => sum + arr.length, 0);
-}
-/**
-* Generate derived types for a construct field.
-* @param fieldName - The field name in the manifest (e.g., 'routes')
-* @param typeName - The exported type name (e.g., 'Route')
-* @param partitioned - Whether this field is partitioned
-*/
-function generateDerivedType(fieldName, typeName, partitioned) {
-	if (partitioned) {
-		const partitionTypeName = `${typeName}Partition`;
-		return [`export type ${partitionTypeName} = keyof typeof manifest.${fieldName};`, `export type ${typeName}<P extends ${partitionTypeName} = ${partitionTypeName}> = (typeof manifest.${fieldName})[P][number];`].join("\n");
-	}
-	return `export type ${typeName} = (typeof manifest.${fieldName})[number];`;
-}
-/** A manifest field as a flat list, whether or not it is partitioned. */
-function flatten(field) {
-	return Array.isArray(field) ? field : Object.values(field).flat();
-}
-async function generateAwsManifest(outputDir, routes, functions, crons, subscribers, queues = [], topics = [], constructs = {}, backends = {}) {
-	const manifestDir = (0, node_path.join)(outputDir, "manifest");
-	await (0, node_fs_promises.mkdir)(manifestDir, { recursive: true });
-	const awsRoutes = filterAllRoutes(routes);
-	const routesPartitioned = isPartitioned(awsRoutes);
-	const functionsPartitioned = isPartitioned(functions);
-	const cronsPartitioned = isPartitioned(crons);
-	const subscribersPartitioned = isPartitioned(subscribers);
-	const queuesPartitioned = isPartitioned(queues);
-	const topicsPartitioned = isPartitioned(topics);
-	const awsConstructs = require_emit.withCompute(require_emit.withRoutes(constructs, flatten(awsRoutes), { perRoute: true }), {
-		functions: flatten(functions),
-		crons: flatten(crons),
-		queues: flatten(queues),
-		subscribers: flatten(subscribers)
-	});
-	const content = `export const manifest = {
-  routes: ${serializeField(awsRoutes)},
-  functions: ${serializeField(functions)},
-  crons: ${serializeField(crons)},
-  subscribers: ${serializeField(subscribers)},
-  queues: ${serializeField(queues)},
-  topics: ${serializeField(topics)},
-} as const;
-
-/**
- * What the application declares, as opposed to what this build generated.
- *
- * Discovery imports application code, so it runs once here rather than in every
- * consumer — a deploy config calling it would evaluate the whole runtime graph
- * inside its own toolchain.
- */
-export const constructs = ${JSON.stringify(awsConstructs, null, 2)} as const;
-
-/**
- * Where the backends that are config rather than declaration resolved to.
- *
- * Recorded because they were answered twice: once by the build, which registers
- * exactly one cache driver, and once by a deploy, which told the provisioner
- * something else — leaving the running code with a URL it had no driver for.
- */
-export const backends = ${JSON.stringify(backends, null, 2)} as const;
-
-// Derived types
-${generateDerivedType("routes", "Route", routesPartitioned)}
-${generateDerivedType("functions", "Function", functionsPartitioned)}
-${generateDerivedType("crons", "Cron", cronsPartitioned)}
-${generateDerivedType("subscribers", "Subscriber", subscribersPartitioned)}
-${generateDerivedType("queues", "Queue", queuesPartitioned)}
-${generateDerivedType("topics", "Topic", topicsPartitioned)}
-
-export type ConstructId = keyof typeof constructs;
-export type Construct<Id extends ConstructId> = (typeof constructs)[Id];
-
-// Useful union types
-export type Authorizer = Route['authorizer'];
-export type HttpMethod = Route['method'];
-export type RoutePath = Route['path'];
-`;
-	const manifestPath = (0, node_path.join)(manifestDir, "aws.ts");
-	await (0, node_fs_promises.writeFile)(manifestPath, content);
-	logger$9.log(`Generated AWS manifest with ${countItems(awsRoutes)} routes, ${countItems(functions)} functions, ${countItems(crons)} crons, ${countItems(subscribers)} subscribers, ${countItems(queues)} queues, ${countItems(topics)} topics`);
-	logger$9.log(`Manifest: ${(0, node_path.relative)(process.cwd(), manifestPath)}`);
-}
-async function generateServerManifest(outputDir, appInfo, routes, subscribers, queues = [], topics = [], constructs = {}, backends = {}) {
-	const manifestDir = (0, node_path.join)(outputDir, "manifest");
-	await (0, node_fs_promises.mkdir)(manifestDir, { recursive: true });
-	const serverRoutes = mapRouteMetadata(filterAllRoutes(routes));
-	const serverSubscribers = mapSubscriberMetadata(subscribers);
-	const serverQueues = mapQueueMetadata(queues);
-	const serverTopics = mapTopicMetadata(topics);
-	const routesPartitioned = isPartitioned(serverRoutes);
-	const subscribersPartitioned = isPartitioned(serverSubscribers);
-	const queuesPartitioned = isPartitioned(serverQueues);
-	const topicsPartitioned = isPartitioned(serverTopics);
-	const content = `export const manifest = {
-  app: ${JSON.stringify(appInfo, null, 2)},
-  routes: ${serializeField(serverRoutes)},
-  subscribers: ${serializeField(serverSubscribers)},
-  queues: ${serializeField(serverQueues)},
-  topics: ${serializeField(serverTopics)},
-} as const;
-
-/**
- * What the application declares, as opposed to what this build generated.
- *
- * Discovery imports application code, so it runs once in the build rather than
- * in every consumer — a deploy config calling it would evaluate the whole
- * runtime graph inside its own toolchain.
- */
-export const constructs = ${JSON.stringify(constructs, null, 2)} as const;
-
-/**
- * Where the backends that are config rather than declaration resolved to.
- *
- * Recorded because they were answered twice: once by the build, which registers
- * exactly one cache driver, and once by a deploy, which told the provisioner
- * something else — leaving the running code with a URL it had no driver for.
- */
-export const backends = ${JSON.stringify(backends, null, 2)} as const;
-
-// Derived types
-${generateDerivedType("routes", "Route", routesPartitioned)}
-${generateDerivedType("subscribers", "Subscriber", subscribersPartitioned)}
-${generateDerivedType("queues", "Queue", queuesPartitioned)}
-${generateDerivedType("topics", "Topic", topicsPartitioned)}
-
-export type ConstructId = keyof typeof constructs;
-export type Construct<Id extends ConstructId> = (typeof constructs)[Id];
-
-// Useful union types
-export type Authorizer = Route['authorizer'];
-export type HttpMethod = Route['method'];
-export type RoutePath = Route['path'];
-`;
-	const manifestPath = (0, node_path.join)(manifestDir, "server.ts");
-	await (0, node_fs_promises.writeFile)(manifestPath, content);
-	logger$9.log(`Generated server manifest with ${countItems(serverRoutes)} routes, ${countItems(serverSubscribers)} subscribers, ${countItems(serverQueues)} queues, ${countItems(serverTopics)} topics`);
-	logger$9.log(`Manifest: ${(0, node_path.relative)(process.cwd(), manifestPath)}`);
-}
-/**
-* Filter out 'ALL' method routes from a manifest field (flat or partitioned).
-*/
-function filterAllRoutes(routes) {
-	if (Array.isArray(routes)) return routes.filter((r) => r.method !== "ALL");
-	const result = {};
-	for (const [partition, partitionRoutes] of Object.entries(routes)) result[partition] = partitionRoutes.filter((r) => r.method !== "ALL");
-	return result;
-}
-/**
-* Map routes to server metadata (path, method, authorizer only).
-*/
-function mapRouteMetadata(routes) {
-	const mapFn = (r) => ({
-		path: r.path,
-		method: r.method,
-		authorizer: r.authorizer
-	});
-	if (Array.isArray(routes)) return routes.map(mapFn);
-	const result = {};
-	for (const [partition, partitionRoutes] of Object.entries(routes)) result[partition] = partitionRoutes.map(mapFn);
-	return result;
-}
-/**
-* Map subscribers to server metadata (name, subscribedEvents only).
-*/
-function mapSubscriberMetadata(subscribers) {
-	const mapFn = (s) => ({
-		name: s.name,
-		subscribedEvents: s.subscribedEvents
-	});
-	if (Array.isArray(subscribers)) return subscribers.map(mapFn);
-	const result = {};
-	for (const [partition, partitionSubs] of Object.entries(subscribers)) result[partition] = partitionSubs.map(mapFn);
-	return result;
-}
-function mapQueueMetadata(queues) {
-	const mapFn = (q) => ({ name: q.name });
-	if (Array.isArray(queues)) return queues.map(mapFn);
-	const result = {};
-	for (const [partition, partitionQueues] of Object.entries(queues)) result[partition] = partitionQueues.map(mapFn);
-	return result;
-}
-function mapTopicMetadata(topics) {
-	const mapFn = (t) => ({
-		name: t.name,
-		events: t.events
-	});
-	if (Array.isArray(topics)) return topics.map(mapFn);
-	const result = {};
-	for (const [partition, partitionTopics] of Object.entries(topics)) result[partition] = partitionTopics.map(mapFn);
-	return result;
-}
-//#endregion
 //#region src/build/owners.ts
 /**
 * What a generated entry imports its runtime from, read off the discovered
@@ -2814,27 +2528,6 @@ function restApis(declared) {
 function servedSurface(declared, workspaceRoot, appRoot) {
 	return restApis(declared).find((d) => (0, node_path.resolve)(workspaceRoot, d.path) === (0, node_path.resolve)(appRoot));
 }
-/**
-* Check if any construct across the given arrays has a non-undefined partition.
-* When true, the manifest should use the partitioned shape for that construct type.
-*/
-function hasPartitions(constructs) {
-	return constructs.some((c) => c.partition !== void 0);
-}
-/**
-* Group an info array by partition, using the partition values from
-* the corresponding construct array. Both arrays must be the same length
-* and in the same order.
-*/
-function groupInfosByPartition(infos, constructs) {
-	const groups = {};
-	for (let i = 0; i < infos.length; i++) {
-		const partition = constructs[i]?.partition ?? "default";
-		if (!groups[partition]) groups[partition] = [];
-		groups[partition].push(infos[i]);
-	}
-	return groups;
-}
 //#endregion
 //#region src/build/surfaceEntry.ts
 /** Whether a construct serves itself, asked of the construct. */
@@ -2911,6 +2604,24 @@ function rootGkmConfig(workspace) {
 		constructs: require_workspace.allConstructGlobs(workspace)
 	};
 }
+/** Directories under `.gkm/` that the removed per-provider builds wrote. */
+const SUPERSEDED_OUTPUT = [
+	"aws-apigatewayv1",
+	"aws-apigatewayv2",
+	"aws-lambda"
+];
+/** Whether `--provider` named something a build can target. */
+function isMainProvider(value) {
+	return value === "aws" || value === "server";
+}
+var UnknownBuildProvider = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`'${provider}' is not a build target. Pass --provider aws or --provider server, or leave it out to build for where gkm.config.ts deploys.`);
+		this.provider = provider;
+		this.name = "UnknownBuildProvider";
+	}
+};
 async function buildCommand(options) {
 	const loadedConfig = await require_config.loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
@@ -2924,25 +2635,62 @@ async function buildCommand(options) {
 		}
 	}
 	const config = loadedConfig.type !== "workspace" ? await require_config.loadConfig() : (0, node_path.resolve)(process.cwd()) === (0, node_path.resolve)(loadedConfig.workspace.root) ? rootGkmConfig(loadedConfig.workspace) : (await require_config.loadAppConfig()).gkmConfig;
-	const resolved = resolveProviders(config, options);
-	const cacheBackend = require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(loadedConfig.workspace));
-	const productionConfigFromGkm = getProductionConfigFromGkm(config);
-	const production = normalizeProductionConfig(options.production ?? false, productionConfigFromGkm);
+	const target = options.provider ?? require_backends.providerOf(loadedConfig.workspace);
+	const workspaceRoot = loadedConfig.workspace.root;
+	const appRoot = process.cwd();
+	const output = await buildOneApp({
+		config,
+		options,
+		workspace: loadedConfig.workspace,
+		appRoot,
+		target
+	});
+	if ((0, node_path.resolve)(appRoot) === (0, node_path.resolve)(workspaceRoot)) await writeManifest({
+		workspaceRoot,
+		target,
+		builds: output.built ? [output.built] : [],
+		constructs: await declaredIn(config, workspaceRoot),
+		backends: backendsOf(loadedConfig.workspace)
+	});
+	return output;
+}
+/** What the workspace declares, read through a config's globs. */
+async function declaredIn(config, cwd) {
+	return require_discover.discover({
+		patterns: config.constructs,
+		cwd
+	});
+}
+/**
+* The backend choices the manifest records — answered by the deploy target,
+* the same place reconcile and the build's drivers read them.
+*/
+function backendsOf(workspace) {
+	return {
+		cache: require_backends.cacheBackendFor(require_backends.providerOf(workspace)),
+		email: "ses"
+	};
+}
+/** One app's build, from its config and the command's options. */
+async function buildOneApp(input) {
+	const { config, options, workspace, appRoot, target } = input;
+	const cacheBackend = require_backends.cacheBackendFor(require_backends.providerOf(workspace));
+	const production = normalizeProductionConfig(options.production ?? false);
 	if (production) logger$8.log(`🏭 Building for PRODUCTION`);
-	logger$8.log(`Building with providers: ${resolved.providers.join(", ")}`);
+	logger$8.log(`Building for ${target}`);
 	logger$8.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
 	const telescope = production ? void 0 : normalizeTelescopeConfig(config.telescope);
 	if (telescope) logger$8.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const studio = production ? void 0 : normalizeStudioConfig(config.studio);
 	if (studio) logger$8.log(`🗄️  Studio enabled at ${studio.path}`);
-	const hooks = normalizeHooksConfig(config.hooks);
+	const hooks = normalizeHooksConfig(config.hooks, appRoot);
 	if (hooks) logger$8.log(`🪝 Server hooks enabled`);
 	return buildApp({
 		config,
-		workspaceRoot: loadedConfig.workspace.root,
-		appRoot: process.cwd(),
-		providers: resolved.providers,
-		enableOpenApi: resolved.enableOpenApi,
+		workspaceRoot: workspace.root,
+		appRoot,
+		target,
+		enableOpenApi: options.enableOpenApi ?? false,
 		cacheBackend,
 		production,
 		telescope,
@@ -2954,6 +2702,33 @@ async function buildCommand(options) {
 	});
 }
 /**
+* Write the application's manifest: every declared construct, with what each
+* app generated folded into it.
+*
+* The manifest belongs to the whole application, so only the root writes it —
+* once, after every app has built, from the constructs the workspace declares.
+* An app's own build generates its handlers and nothing else.
+*/
+async function writeManifest(input) {
+	const { workspaceRoot, target, builds, constructs, backends } = input;
+	const manifestDir = (0, node_path.join)(workspaceRoot, ".gkm", "manifest");
+	await (0, node_fs_promises.mkdir)(manifestDir, { recursive: true });
+	await (0, node_fs_promises.rm)((0, node_path.join)(manifestDir, `${target === "aws" ? "server" : "aws"}.ts`), { force: true });
+	const withServed = builds.reduce((manifest, build) => require_emit.withRoutes(manifest, build.routes.filter((route) => route.method !== "ALL"), {
+		perRoute: true,
+		...build.surface ? { surface: build.surface } : {}
+	}), constructs);
+	const folded = require_emit.withCompute(withServed, {
+		functions: builds.flatMap((build) => build.functions),
+		crons: builds.flatMap((build) => build.crons),
+		queues: builds.flatMap((build) => build.queues),
+		subscribers: builds.flatMap((build) => build.subscribers)
+	});
+	const path = (0, node_path.join)(manifestDir, `${target}.ts`);
+	await (0, node_fs_promises.writeFile)(path, require_emit.manifestModule(folded, backends));
+	logger$8.log(`Manifest: ${(0, node_path.relative)(process.cwd(), path)}`);
+}
+/**
 * Turn one app's constructs into its generated entry.
 *
 * `gkm build` and `gkm dev` both run this. They used to be two copies of it,
@@ -2962,8 +2737,8 @@ async function buildCommand(options) {
 * dev did not, and failed on exactly the apps the build had learned to handle.
 */
 async function buildApp(input) {
-	const { config, workspaceRoot, appRoot, providers, enableOpenApi, cacheBackend, production, telescope, studio, hooks, bustCache = false } = input;
-	const constructGlobs = typeof config.constructs === "string" || Array.isArray(config.constructs) ? config.constructs : void 0;
+	const { config, workspaceRoot, appRoot, target, enableOpenApi, cacheBackend, production, telescope, studio, hooks, bustCache = false } = input;
+	const constructGlobs = config.constructs;
 	const constructSources = {};
 	const declared = constructGlobs ? await require_discover.discover({
 		patterns: constructGlobs,
@@ -3029,50 +2804,58 @@ async function buildApp(input) {
 		logger$8.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
-	const rootOutputDir = (0, node_path.join)(appRoot, ".gkm");
-	await (0, node_fs_promises.mkdir)(rootOutputDir, { recursive: true });
-	let result = {};
-	for (const provider of providers) {
-		const providerResult = await buildForProvider(provider, buildContext, appRoot, declared, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
-		if (providerResult.masterKey) result = providerResult;
-	}
+	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
 	await require_openapi.generateOpenApi(allEndpoints.map(({ construct }) => construct), { openapi: config.openapi });
 	return result;
 }
-async function buildForProvider(provider, context, appRoot, discovered, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
-	const rootOutputDir = (0, node_path.join)(appRoot, ".gkm");
-	const outputDir = (0, node_path.join)(rootOutputDir, provider);
+async function buildForTarget(target, context, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
+	const outputDir = (0, node_path.join)(appRoot, ".gkm", target);
+	await Promise.all([...SUPERSEDED_OUTPUT.map((dir) => (0, node_path.join)(appRoot, ".gkm", dir)), ...appRoot === workspaceRoot ? [] : [(0, node_path.join)(appRoot, ".gkm", "manifest")]].map((dir) => (0, node_fs_promises.rm)(dir, {
+		recursive: true,
+		force: true
+	})));
+	if (target === "aws") await (0, node_fs_promises.rm)(outputDir, {
+		recursive: true,
+		force: true
+	});
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
-	logger$8.log(`\nGenerating handlers for provider: ${provider}`);
+	logger$8.log(`\nGenerating handlers for ${target}`);
+	const options = {
+		target,
+		root: workspaceRoot
+	};
 	const [routes, functionInfos, cronInfos, subscriberInfos, queueInfos, topicInfos] = await Promise.all([
 		endpointGenerator.build(context, endpoints, outputDir, {
-			provider,
+			...options,
 			enableOpenApi
 		}),
-		functionGenerator.build(context, functions, outputDir, { provider }),
-		cronGenerator.build(context, crons, outputDir, { provider }),
-		subscriberGenerator.build(context, subscribers, outputDir, { provider }),
-		queueGenerator.build(context, queues, outputDir, { provider }),
-		topicGenerator.build(context, topics, outputDir, { provider })
+		functionGenerator.build(context, functions, outputDir, options),
+		cronGenerator.build(context, crons, outputDir, options),
+		subscriberGenerator.build(context, subscribers, outputDir, options),
+		queueGenerator.build(context, queues, outputDir, options),
+		topicGenerator.build(context, topics, outputDir, options)
 	]);
-	logger$8.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${provider}`);
-	const manifestRoutes = assembleManifestField(routes, endpoints);
-	const manifestFunctions = assembleManifestField(functionInfos, functions);
-	const manifestCrons = assembleManifestField(cronInfos, crons);
-	const manifestQueues = assembleManifestField(queueInfos, queues);
-	const manifestTopics = assembleManifestField(topicInfos, topics);
-	const manifestSubscribers = assembleManifestField(subscriberInfos, subscribers);
-	if (provider === "server") {
-		const serverRouteField = assembleManifestField(await Promise.all(endpoints.map(async ({ construct }) => ({
-			path: construct._path,
-			method: construct.method,
-			handler: "",
-			authorizer: construct.authorizer?.name ?? "none"
-		}))), endpoints);
-		await generateServerManifest(rootOutputDir, {
-			handler: (0, node_path.relative)(appRoot, (0, node_path.join)(outputDir, "app.ts")),
-			endpoints: (0, node_path.relative)(appRoot, (0, node_path.join)(outputDir, "endpoints.ts"))
-		}, serverRouteField, manifestSubscribers, manifestQueues, manifestTopics);
+	logger$8.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${target}`);
+	const fields = {
+		...context.surface ? { surface: context.surface.id } : {},
+		functions: functionInfos,
+		crons: cronInfos,
+		queues: queueInfos,
+		subscribers: subscriberInfos
+	};
+	if (target === "server") {
+		const handler = (0, node_path.relative)(workspaceRoot, (0, node_path.join)(outputDir, "app.ts"));
+		const built = {
+			...fields,
+			routes: await Promise.all(endpoints.map(async ({ construct }) => ({
+				path: construct._path,
+				method: construct.method,
+				handler,
+				environment: await construct.getEnvironment({ markOptional: context.markOptional }),
+				dependencies: construct.constructs,
+				authorizer: construct.authorizer?.name ?? "none"
+			})))
+		};
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$8.log(`\n📦 Bundling production server...`);
@@ -3099,12 +2882,15 @@ async function buildForProvider(provider, context, appRoot, discovered, endpoint
 				logger$8.log(`   Deploy with: GKM_MASTER_KEY=${masterKey}`);
 			}
 		}
-		return { masterKey };
-	} else await generateAwsManifest(rootOutputDir, manifestRoutes, manifestFunctions, manifestCrons, manifestSubscribers, manifestQueues, manifestTopics, discovered, {
-		cache: context.cacheBackend,
-		email: context.emailBackend
-	});
-	return {};
+		return {
+			masterKey,
+			built
+		};
+	}
+	return { built: {
+		...fields,
+		routes
+	} };
 }
 /**
 * Detect available package manager.
@@ -3126,8 +2912,8 @@ function detectPackageManager$2() {
 *
 * @internal Exported for testing
 */
-function getTurboCommand(pm, filters = []) {
-	const filterArgs = (typeof filters === "string" ? [filters] : filters).map((f) => ` --filter=${f}`).join("");
+function getTurboCommand(pm, filters = [], { only = false } = {}) {
+	const filterArgs = (typeof filters === "string" ? [filters] : filters).map((f) => ` --filter=${f}`).join("") + (only ? " --only" : "");
 	switch (pm) {
 		case "pnpm": return `pnpm exec turbo run build${filterArgs}`;
 		case "yarn": return `yarn turbo run build${filterArgs}`;
@@ -3147,10 +2933,11 @@ function getTurboCommand(pm, filters = []) {
 *
 * @internal Exported for testing
 */
-function turboFilters(workspace) {
+function turboFilters(workspace, { exclude } = {}) {
 	const filters = [];
 	const unpackaged = [];
-	for (const appName of Object.keys(workspace.apps)) {
+	for (const [appName, app] of Object.entries(workspace.apps)) {
+		if (app.type === exclude) continue;
 		const name = appPackageName(workspace, appName);
 		if (name) filters.push(name);
 		else unpackaged.push(appName);
@@ -3189,31 +2976,59 @@ async function workspaceBuildCommand(workspace, options) {
 	if (options.production) logger$8.log(`   🏭 Production mode enabled`);
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
 	logger$8.log(`   Build order: ${buildOrder.join(" → ")}`);
-	const pm = detectPackageManager$2();
-	logger$8.log(`\n📦 Using ${pm} with Turbo for parallel builds...\n`);
 	try {
-		const { filters, unpackaged } = turboFilters(workspace);
-		if (unpackaged.length > 0) throw new Error(`No package.json for workspace app(s): ${unpackaged.join(", ")}. Each app needs one — turbo builds packages, and gkm reads the name back to know which app it is building.`);
-		const turboCommand = getTurboCommand(pm, filters);
-		logger$8.log(`Running: ${turboCommand}`);
-		await new Promise((resolve, reject) => {
-			const child = (0, node_child_process.spawn)(turboCommand, {
-				shell: true,
-				cwd: workspace.root,
-				stdio: "inherit",
-				env: {
-					...process.env,
-					NODE_ENV: options.production ? "production" : "development"
-				}
-			});
-			child.on("close", (code) => {
-				if (code === 0) resolve();
-				else reject(/* @__PURE__ */ new Error(`Turbo build failed with exit code ${code}`));
-			});
-			child.on("error", (err) => {
-				reject(err);
+		const target = options.provider ?? require_backends.providerOf(workspace);
+		const builds = [];
+		for (const appName of buildOrder) {
+			const app = workspace.apps[appName];
+			const config = require_workspace.getAppGkmConfig(workspace, appName);
+			if (!app || app.type !== "backend" || !config) continue;
+			logger$8.log(`\n⚙️  ${appName}`);
+			const output = await buildOneApp({
+				config,
+				options,
+				workspace,
+				appRoot: (0, node_path.join)(workspace.root, app.path),
+				target
 			});
+			if (output.built) builds.push(output.built);
+		}
+		await writeManifest({
+			workspaceRoot: workspace.root,
+			target,
+			builds,
+			constructs: await require_discover.discover({
+				patterns: require_workspace.allConstructGlobs(workspace),
+				cwd: workspace.root
+			}),
+			backends: backendsOf(workspace)
 		});
+		const { filters, unpackaged } = turboFilters(workspace, { exclude: "backend" });
+		if (unpackaged.length > 0) throw new Error(`No package.json for workspace app(s): ${unpackaged.join(", ")}. Each app needs one — turbo builds packages, and gkm reads the name back to know which app it is building.`);
+		const pm = detectPackageManager$2();
+		const turboCommand = getTurboCommand(pm, filters, { only: true });
+		if (filters.length > 0) {
+			logger$8.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
+			logger$8.log(`Running: ${turboCommand}`);
+			await new Promise((resolve, reject) => {
+				const child = (0, node_child_process.spawn)(turboCommand, {
+					shell: true,
+					cwd: workspace.root,
+					stdio: "inherit",
+					env: {
+						...process.env,
+						NODE_ENV: options.production ? "production" : "development"
+					}
+				});
+				child.on("close", (code) => {
+					if (code === 0) resolve();
+					else reject(/* @__PURE__ */ new Error(`Turbo build failed with exit code ${code}`));
+				});
+				child.on("error", (err) => {
+					reject(err);
+				});
+			});
+		}
 		for (const [appName, app] of apps) {
 			const outputPath = getAppOutputPath(workspace, appName, app);
 			results.push({
@@ -3256,23 +3071,11 @@ function getAppOutputPath(workspace, _appName, app) {
 	}
 	return (0, node_path.join)(appPath, ".gkm");
 }
-/**
-* Format routes for logging, handling PartitionedRoutes.
-*/
+/** Format routes for logging. */
 function formatRoutes(routes) {
-	if (require_discover.isPartitionedRoutes(routes)) return `${Array.isArray(routes.paths) ? routes.paths.join(", ") : routes.paths} (partitioned)`;
 	return Array.isArray(routes) ? routes.join(", ") : routes;
 }
 /**
-* Assemble a ManifestField from build infos and constructs.
-* If any construct has a partition, returns a Record<string, T[]>.
-* Otherwise, returns a flat T[].
-*/
-function assembleManifestField(infos, constructs) {
-	if (!hasPartitions(constructs)) return infos;
-	return groupInfosByPartition(infos, constructs);
-}
-/**
 * Format a fatal error for display.
 * Always includes the full stack trace since these are process-ending errors.
 */
@@ -3575,6 +3378,19 @@ const PROVISIONERS = {
 		return { provides: { [key]: supplied(declaration.id, key, context) } };
 	},
 	/**
+	* The keyring the stage keeps in its secrets.
+	*
+	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
+	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
+	* written becomes unreadable. Nothing is created in Dokploy: the process
+	* holds the keyring.
+	*/
+	encryption: async (declaration, context) => {
+		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
 	* A third party's credentials, as the stage was given them.
 	*
 	* Nothing is created and nothing derived: the value was issued by somebody
@@ -3944,9 +3760,9 @@ async function provisionDeclared(options) {
 		environmentId: options.environmentId,
 		stage: options.stage,
 		project: workspace.name,
-		cache: require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(workspace)),
-		events: require_workspace$1.eventsBackendFor(require_workspace$1.providerOf(workspace)),
-		storage: require_workspace$1.storageBackendFor(require_workspace$1.providerOf(workspace)),
+		cache: require_backends.cacheBackendFor(require_backends.providerOf(workspace)),
+		events: require_backends.eventsBackendFor(require_backends.providerOf(workspace)),
+		storage: require_backends.storageBackendFor(require_backends.providerOf(workspace)),
 		addresses: surfaceAddresses(workspace, manifest, options.appUrls),
 		seed: options.seed,
 		...options.supplied ? { supplied: options.supplied } : {},
@@ -5424,9 +5240,8 @@ async function dockerCommand(options) {
 		logger$6.log("📦 Detected workspace configuration");
 		return workspaceDockerCommand(loadedConfig.workspace);
 	}
-	const config = await require_config.loadConfig();
-	const dockerConfig = resolveDockerConfig(config);
-	const healthCheckPath = (typeof config.providers?.server === "object" ? config.providers.server : void 0)?.production?.healthCheck ?? "/health";
+	const dockerConfig = resolveDockerConfig(await require_config.loadConfig());
+	const healthCheckPath = "/health";
 	const useSlim = options.slim === true;
 	if (useSlim) {
 		const distDir = (0, node_path.join)(process.cwd(), ".gkm", "server", "dist");
@@ -6585,6 +6400,8 @@ function validateEnvVars(requiredVars, context) {
 *   who could read the repo.
 * - **Each `secret` construct's value** — an auth server's signing secret —
 *   random, rather than derived.
+* - **Each `encryption` construct's keyring** — one random key and an index
+*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
 *
 * Both are generated on the first deploy that needs them and written to the
 * stage's store, so every later deploy reads the same values: sessions survive
@@ -6600,10 +6417,10 @@ function withGeneratedSecrets(secrets, manifest) {
 	const generated = [];
 	const custom = { ...secrets.custom };
 	for (const declaration of Object.values(manifest)) {
-		if (declaration?.kind !== "secret") continue;
+		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
 		const key = declaration.provides?.[0];
 		if (!key || custom[key]) continue;
-		custom[key] = random();
+		custom[key] = declaration.kind === "encryption" ? (0, _geekmidas_constructs_encryption.generateKeyring)() : random();
 		generated.push(key);
 	}
 	const seed = secrets.seed ?? random();
@@ -7432,6 +7249,10 @@ async function workspaceDeployCommand(configured, options) {
 	} else logger$4.log(`   Deploying all apps: ${appsToDeployNames.join(", ")}`);
 	const dokployApps = appsToDeployNames.filter((name) => {
 		const target = workspace.apps[name].resolvedDeployTarget;
+		if (target === "sst") {
+			logger$4.log(`   ⚠️  Skipping ${name}: it deploys with SST — run \`gkm build && sst deploy --stage ${stage}\``);
+			return false;
+		}
 		if (!require_workspace.isDeployTargetSupported(target)) {
 			logger$4.log(`   ⚠️  Skipping ${name}: ${require_workspace.getDeployTargetError(target, name)}`);
 			return false;
@@ -7952,66 +7773,6 @@ async function createApi(endpoint) {
 	});
 }
 /**
-* Update gkm.config.ts with Dokploy configuration
-*/
-/**
-* Whether the file's `dokploy` block is more than a flat literal.
-*
-* A spread, a `process.env`, a ternary or a nested object all defeat the
-* single-level regex below — the first two by being expressions it would
-* stringify away, the last by ending the match at the wrong brace.
-*/
-function unsafeToRewrite(content) {
-	const start = content.indexOf("dokploy:");
-	if (start === -1) return false;
-	const block = content.slice(start, content.indexOf("\n	},", start) + 1);
-	return /\.\.\.|process\.env|\?\s|`|\{[^}]*\{/s.test(block);
-}
-async function updateConfig(config, cwd = process.cwd()) {
-	const configPath = (0, node_path.join)(cwd, "gkm.config.ts");
-	if (!(0, node_fs.existsSync)(configPath)) {
-		logger$3.warn("\n  gkm.config.ts not found. Add this configuration manually:\n");
-		logger$3.log(`  providers: {`);
-		logger$3.log(`    dokploy: {`);
-		logger$3.log(`      endpoint: '${config.endpoint}',`);
-		logger$3.log(`      projectId: '${config.projectId}',`);
-		logger$3.log(`      applicationId: '${config.applicationId}',`);
-		logger$3.log(`    },`);
-		logger$3.log(`  },`);
-		return;
-	}
-	const content = await (0, node_fs_promises.readFile)(configPath, "utf-8");
-	if (unsafeToRewrite(content)) {
-		logger$3.warn("\n  gkm.config.ts holds a dokploy block this cannot safely rewrite —\n  it contains an expression or a nested object. Leaving it alone.");
-		logger$3.log(`\n  Discovered, if you want them written down:`);
-		logger$3.log(`    projectId: '${config.projectId}'`);
-		logger$3.log(`    applicationId: '${config.applicationId}'`);
-		if (config.registryId) logger$3.log(`    registryId: '${config.registryId}'`);
-		return;
-	}
-	if (content.includes("dokploy:") && content.includes("applicationId:")) {
-		logger$3.log("\n  Dokploy config already exists in gkm.config.ts");
-		logger$3.log("  Updating with new values...");
-	}
-	const registryLine = config.registryId ? `\n\t\t\tregistryId: '${config.registryId}',` : "";
-	const dokployConfigStr = `dokploy: {
-			endpoint: '${config.endpoint}',
-			projectId: '${config.projectId}',
-			applicationId: '${config.applicationId}',${registryLine}
-		}`;
-	let newContent;
-	if (content.includes("providers:")) {
-		if (content.includes("dokploy:")) newContent = content.replace(/dokploy:\s*\{[^}]*\}/s, dokployConfigStr);
-		else newContent = content.replace(/providers:\s*\{/, `providers: {\n\t\t${dokployConfigStr},`);
-	} else newContent = content.replace(/}\s*\)\s*;?\s*$/, `
-	providers: {
-		${dokployConfigStr},
-	},
-});`);
-	await (0, node_fs_promises.writeFile)(configPath, newContent);
-	logger$3.log("\n  ✓ Updated gkm.config.ts with Dokploy configuration");
-}
-/**
 * Initialize Dokploy deployment configuration
 */
 async function deployInitCommand(options) {
@@ -8064,7 +7825,6 @@ async function deployInitCommand(options) {
 		projectId,
 		applicationId: application.applicationId
 	};
-	await updateConfig(config);
 	logger$3.log(`\n✅ Dokploy deployment initialized!`);
 	logger$3.log(`\n📋 Configuration:`);
 	logger$3.log(`   Project ID: ${projectId}`);
@@ -9334,26 +9094,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.45",
-	"@geekmidas/auth": "~10.0.0-alpha.45",
-	"@geekmidas/cache": "~10.0.0-alpha.45",
-	"@geekmidas/client": "~10.0.0-alpha.45",
-	"@geekmidas/cloud": "~10.0.0-alpha.45",
-	"@geekmidas/constructs": "~10.0.0-alpha.45",
-	"@geekmidas/db": "~10.0.0-alpha.45",
-	"@geekmidas/emailkit": "~10.0.0-alpha.45",
-	"@geekmidas/envkit": "~10.0.0-alpha.45",
-	"@geekmidas/errors": "~10.0.0-alpha.45",
-	"@geekmidas/events": "~10.0.0-alpha.45",
-	"@geekmidas/logger": "~10.0.0-alpha.45",
-	"@geekmidas/manifest": "~10.0.0-alpha.45",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.45",
-	"@geekmidas/schema": "~10.0.0-alpha.45",
-	"@geekmidas/services": "~10.0.0-alpha.45",
-	"@geekmidas/storage": "~10.0.0-alpha.45",
-	"@geekmidas/studio": "~10.0.0-alpha.45",
-	"@geekmidas/telescope": "~10.0.0-alpha.45",
-	"@geekmidas/testkit": "~10.0.0-alpha.45",
+	"@geekmidas/audit": "~10.0.0-alpha.47",
+	"@geekmidas/auth": "~10.0.0-alpha.47",
+	"@geekmidas/cache": "~10.0.0-alpha.47",
+	"@geekmidas/client": "~10.0.0-alpha.47",
+	"@geekmidas/cloud": "~10.0.0-alpha.47",
+	"@geekmidas/constructs": "~10.0.0-alpha.47",
+	"@geekmidas/db": "~10.0.0-alpha.47",
+	"@geekmidas/emailkit": "~10.0.0-alpha.47",
+	"@geekmidas/envkit": "~10.0.0-alpha.47",
+	"@geekmidas/errors": "~10.0.0-alpha.47",
+	"@geekmidas/events": "~10.0.0-alpha.47",
+	"@geekmidas/logger": "~10.0.0-alpha.47",
+	"@geekmidas/manifest": "~10.0.0-alpha.47",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.47",
+	"@geekmidas/schema": "~10.0.0-alpha.47",
+	"@geekmidas/services": "~10.0.0-alpha.47",
+	"@geekmidas/storage": "~10.0.0-alpha.47",
+	"@geekmidas/studio": "~10.0.0-alpha.47",
+	"@geekmidas/telescope": "~10.0.0-alpha.47",
+	"@geekmidas/testkit": "~10.0.0-alpha.47",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10880,7 +10640,7 @@ function deployPackage(options) {
 		case "sst": {
 			const v = GEEKMIDAS_VERSIONS;
 			return {
-				scripts: perStage(options, (stage) => `gkm build --provider aws && sst deploy --stage ${stage}`),
+				scripts: perStage(options, (stage) => `gkm build && sst deploy --stage ${stage}`),
 				dependencies: {
 					"@geekmidas/cloud": v["@geekmidas/cloud"],
 					"@geekmidas/db": v["@geekmidas/db"],
@@ -10945,7 +10705,7 @@ export default $config({
 
   async run() {
     const { App, fromManifest, Stack } = await import('@geekmidas/cloud/sst');
-    // Written by \`gkm build --provider aws\`. Imported rather than discovered,
+    // Written by \`gkm build\`. Imported rather than discovered,
     // so SST's toolchain never evaluates the application's own modules.
     const { backends, constructs } = await import('./.gkm/manifest/aws.js');
 
@@ -11183,8 +10943,11 @@ coverage/
 ${isSst ? "\n# SST\n.sst/\n" : ""}`;
 	const tsConfig = {
 		compilerOptions: {
+			paths: {
+				...isFullstack ? { [`@${options.name}/constructs/*`]: ["./constructs/*"] } : {},
+				[`@${options.name}/manifest`]: [`./.gkm/manifest/${isSst ? "aws" : "server"}.ts`]
+			},
 			...isFullstack ? {
-				paths: { [`@${options.name}/constructs/*`]: ["./constructs/*"] },
 				allowImportingTsExtensions: true,
 				noEmit: true
 			} : {},
@@ -11325,7 +11088,7 @@ export default defineWorkspace({
   // \`production-${options.name}-database\` on Dokploy and on AWS alike.
   name: '${options.name}',
 ${stagesBlock(options.stages)}
-
+${deployBlock(options)}
   // Every kind, in every app. A declared database is why a Postgres exists, a
   // declared bucket is why MinIO does, a declared topic is why a broker does —
   // none of it listed here. It is also where the apps come from: a
@@ -11343,6 +11106,18 @@ ${workspaceConstructsGlobs(options.routesStructure, (0, node_path.dirname)(optio
 `;
 }
 /**
+* Where it deploys, when that is not the default Dokploy: what a bare
+* `gkm build` builds for, and which backends a cache or a broker resolves to.
+*/
+function deployBlock(options) {
+	if (options.deployTarget !== "sst") return "";
+	return `
+  // Deployed with \`sst deploy\`, from the manifest \`gkm build\` writes to
+  // \`.gkm/manifest/aws.ts\`. Each construct becomes a managed AWS resource.
+  deploy: { default: 'sst' },
+`;
+}
+/**
 * Where a deployed stage's secrets live. On AWS that is SSM in the stage's own
 * account, which the deploy job reaches with the role it already assumed; a
 * server target keeps the encrypted local file, the default.
@@ -11368,7 +11143,7 @@ function secretsStore(options) {
 */
 function generateRootConstructs(options) {
 	if (!options.monorepo || options.template !== "fullstack") return [];
-	const { name, frontendFramework } = options;
+	const { frontendFramework } = options;
 	const { cache, uploads, mail } = options.constructs;
 	const db = databaseFor();
 	const files = [];
@@ -12128,7 +11903,7 @@ const serverlessTemplate = {
 	},
 	scripts: {
 		dev: "gkm dev",
-		build: "gkm build --provider aws-apigatewayv2",
+		build: "gkm build --provider aws",
 		test: "vitest",
 		"test:once": "vitest run",
 		typecheck: "tsc --noEmit",
@@ -12137,7 +11912,7 @@ const serverlessTemplate = {
 		"fmt:check": "biome format ."
 	},
 	files: (options) => {
-		const { loggerType, routesStructure, name } = options;
+		const { loggerType, routesStructure } = options;
 		const loggerContent = `import { createLogger } from '@geekmidas/logger/${loggerType}';
 
 export const logger = createLogger();
@@ -12422,10 +12197,6 @@ export const telescope = new Telescope({
 */
 const OPENAPI_OUTPUT_PATH = "./.gkm/openapi/api.ts";
 /**
-* Endpoints output path (generated by gkm dev/build)
-*/
-const ENDPOINTS_OUTPUT_PATH = "./.gkm/server/endpoints.ts";
-/**
 * All available templates
 */
 const templates = {
@@ -12638,10 +12409,7 @@ function generatePackageJson(options, template) {
 		private: true,
 		type: "module",
 		...!monorepo && options.packageManager === "pnpm" ? { packageManager: PNPM_VERSION } : {},
-		exports: {
-			"./client": OPENAPI_OUTPUT_PATH,
-			"./endpoints": ENDPOINTS_OUTPUT_PATH
-		},
+		exports: { "./client": OPENAPI_OUTPUT_PATH },
 		scripts,
 		dependencies: sortObject(dependencies),
 		devDependencies: sortObject(devDependencies)
@@ -15367,7 +15135,7 @@ function printNextSteps(projectName, options, pkgManager) {
 	}
 	if (options.deployTarget === "sst") {
 		console.log("🚀 Deployment (AWS, through SST):");
-		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}  # gkm build --provider aws, then sst deploy`);
+		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}  # gkm build, then sst deploy`);
 		console.log(`  Uses your AWS credentials, in ${options.region}.`);
 		if (options.constructs.mail) console.log("  Set MAIL_FROM to a sender verified in SES first.");
 		console.log("");
@@ -15754,8 +15522,8 @@ async function reconcileLocal(workspace, stage, options) {
 		logger$1.log("🐳 Services already up to date");
 		return;
 	}
-	logger$1.log(`🐳 Services: ${result.plan.containers.join(", ")}`);
-	for (const [container, address] of Object.entries(result.addresses)) logger$1.log(`   ${container}: ${address}`);
+	logger$1.log("🐳 Services");
+	for (const line of require_workspace$1.describeServices(result.services)) logger$1.log(line);
 	const url = result.plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site" || r.kind === "file-server").map((r) => result.env[r.envKey]).find((address) => address?.startsWith("https://"));
 	if (url) await ensureTrusted(workspace.root, url, { ...options.yes ? { assumeYes: true } : {} });
 }
@@ -16102,8 +15870,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-PJi4b1ga.cjs"));
-	const { discover } = await Promise.resolve().then(() => require("./discover-B0f_kuNN.cjs")).then((n) => n.discover_exports);
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs"));
+	const { discover } = await Promise.resolve().then(() => require("./discover-DXNviAh-.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
 		patterns: require_workspace$1.constructGlobs(workspace),
@@ -16468,29 +16236,13 @@ program.command("setup").description("Reconcile declared constructs — containe
 		process.exit(1);
 	}
 });
-program.command("build").description("Build handlers and the manifest from declared constructs").option("--provider <provider>", "Target provider for generated handlers (aws, server)").option("--providers <providers>", "[DEPRECATED] Use --provider instead. Target providers for generated handlers (comma-separated)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").option("--mark-optional", "Suffix optional env vars with ? in manifest envVars field (e.g. PORT?)").action(async (options) => {
+program.command("build").description("Build handlers and the manifest from declared constructs").option("--provider <provider>", "Build for aws or server (default: where gkm.config.ts deploys)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").option("--mark-optional", "Suffix optional env vars with ? in manifest envVars field (e.g. PORT?)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		if (options.provider) {
-			if (!["aws", "server"].includes(options.provider)) process.exit(1);
-			await buildCommand({
-				provider: options.provider,
-				enableOpenApi: options.enableOpenapi || false,
-				production: options.production || false,
-				skipBundle: options.skipBundle || false,
-				stage: options.stage,
-				markOptional: options.markOptional || false
-			});
-		} else if (options.providers) await buildCommand({
-			providers: [...new Set(options.providers.split(",").map((p) => p.trim()))],
-			enableOpenApi: options.enableOpenapi || false,
-			production: options.production || false,
-			skipBundle: options.skipBundle || false,
-			stage: options.stage,
-			markOptional: options.markOptional || false
-		});
-		else await buildCommand({
+		if (options.provider !== void 0 && !isMainProvider(options.provider)) throw new UnknownBuildProvider(options.provider);
+		await buildCommand({
+			...options.provider ? { provider: options.provider } : {},
 			enableOpenApi: options.enableOpenapi || false,
 			production: options.production || false,
 			skipBundle: options.skipBundle || false,
@@ -16549,7 +16301,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-PJi4b1ga.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16563,7 +16315,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-PJi4b1ga.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16577,7 +16329,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-PJi4b1ga.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16671,6 +16423,28 @@ program.command("secrets:set").description("Set a custom secret for a stage").ar
 		process.exit(1);
 	}
 });
+program.command("encryption:rotate").description("Add a new current key to an Encryption construct's keyring on a server stage").argument("<construct>", "The Encryption construct (e.g. Pii)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-C7OGMve_.cjs"));
+		await encryptionRotateCommand(construct, options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
+program.command("encryption:retire").description("Remove an old key from an Encryption construct's keyring, once nothing is under it").argument("<construct>", "The Encryption construct (e.g. Pii)").argument("<key>", "The key to retire (e.g. k1)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, key, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-C7OGMve_.cjs"));
+		await encryptionRetireCommand(construct, key, options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("secrets:show").description("Show secrets for a stage").requiredOption("--stage <stage>", "Stage name").option("--reveal", "Show actual secret values (not masked)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -16716,7 +16490,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-dV6f-3vv.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-vafrzZTC.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16775,7 +16549,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BAr8WGkR.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BrI1tv6u.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));