@geekmidas/cli 10.0.0-alpha.50 → 10.0.0-alpha.52

package/dist/{index-BQhJXpaQ.d.mts → index-DYh5TrsZ.d.mts}

@@ -1,4 +1,4 @@
-import { C as WorkspaceInput, E as Framework, S as WorkspaceConfig, a as Routes, g as LoadedConfig, h as InferredWorkspaceConfig, l as AppsRecord, r as GkmConfig, y as NormalizedWorkspace } from "./types-BbrNu83u.mjs";
+import { C as WorkspaceInput, E as Framework, S as WorkspaceConfig, a as Routes, g as LoadedConfig, h as InferredWorkspaceConfig, l as AppsRecord, r as GkmConfig, y as NormalizedWorkspace } from "./types-CT0ymlBk.mjs";
 //#region src/workspace/publicEnv.d.ts
 /**
  * All public env-var prefixes the toolbox understands.
@@ -153,4 +153,4 @@ declare function getEndpointForStage(dokployConfig: {
 } | undefined, stage: string): string | undefined;
 //#endregion
 export { getAppBuildOrder as a, normalizeWorkspace as c, wrapSingleAppAsWorkspace as d, PUBLIC_ENV_PREFIXES as f, defineWorkspace as i, processConfig as l, stripPublicPrefix as m, appConstructGlobs as n, getAppGkmConfig as o, getPublicEnvPrefix as p, constructPatterns as r, getEndpointForStage as s, allConstructGlobs as t, workspaceConstructGlobs as u };
-//# sourceMappingURL=index-BQhJXpaQ.d.mts.map
+//# sourceMappingURL=index-DYh5TrsZ.d.mts.map

package/dist/{index-BQhJXpaQ.d.mts.map → index-DYh5TrsZ.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"index-BQhJXpaQ.d.mts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"mappings":";;;;;;;;;cASa;;;;;;;;;;;;;;;iBAoBG,mBAAmB,YAAY;;;;;iBAoB/B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBC2ElB,sBAAsB,cAAc,YACnD,QAAQ,eAAe,SACrB,wBAAwB;;;;iBA8BX,mBACf,QAAQ,iBACR,cACE;;;;;iBA+Ca,yBACf,QAAQ,WACR,cACE;;;;;iBAuDa,cACf,QAAQ,YAAY,iBACpB,cACE;;;;;;;iBA6Ba,wBACf,WAAW;;;;;;;;;;;;iBAkBI,kBACf,WAAW,qBACX;;;;;;;iBAsBe,kBAAkB,WAAW;;iBAa7B,kBAAkB,QAAQ;;;;;iBAS1B,gBACf,WAAW,qBACX,kBACE;;;;;iBAiCa,iBAAiB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoD5B,oBACf;EACK;EAAmB,YAAY;eAEpC"}
+{"version":3,"file":"index-DYh5TrsZ.d.mts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"mappings":";;;;;;;;;cASa;;;;;;;;;;;;;;;iBAoBG,mBAAmB,YAAY;;;;;iBAoB/B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBC2ElB,sBAAsB,cAAc,YACnD,QAAQ,eAAe,SACrB,wBAAwB;;;;iBA8BX,mBACf,QAAQ,iBACR,cACE;;;;;iBA+Ca,yBACf,QAAQ,WACR,cACE;;;;;iBAuDa,cACf,QAAQ,YAAY,iBACpB,cACE;;;;;;;iBA6Ba,wBACf,WAAW;;;;;;;;;;;;iBAkBI,kBACf,WAAW,qBACX;;;;;;;iBAsBe,kBAAkB,WAAW;;iBAa7B,kBAAkB,QAAQ;;;;;iBAS1B,gBACf,WAAW,qBACX,kBACE;;;;;iBAiCa,iBAAiB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoD5B,oBACf;EACK;EAAmB,YAAY;eAEpC"}

package/dist/{index-DHJePE0y.d.cts → index-fU3qHy7c.d.cts}

@@ -1,4 +1,4 @@
-import { C as WorkspaceInput, E as Framework, S as WorkspaceConfig, a as Routes, g as LoadedConfig, h as InferredWorkspaceConfig, l as AppsRecord, r as GkmConfig, y as NormalizedWorkspace } from "./types-DNqEsctD.cjs";
+import { C as WorkspaceInput, E as Framework, S as WorkspaceConfig, a as Routes, g as LoadedConfig, h as InferredWorkspaceConfig, l as AppsRecord, r as GkmConfig, y as NormalizedWorkspace } from "./types-DYDT4FfE.cjs";
 //#region src/workspace/publicEnv.d.ts
 /**
  * All public env-var prefixes the toolbox understands.
@@ -153,4 +153,4 @@ declare function getEndpointForStage(dokployConfig: {
 } | undefined, stage: string): string | undefined;
 //#endregion
 export { getAppBuildOrder as a, normalizeWorkspace as c, wrapSingleAppAsWorkspace as d, PUBLIC_ENV_PREFIXES as f, defineWorkspace as i, processConfig as l, stripPublicPrefix as m, appConstructGlobs as n, getAppGkmConfig as o, getPublicEnvPrefix as p, constructPatterns as r, getEndpointForStage as s, allConstructGlobs as t, workspaceConstructGlobs as u };
-//# sourceMappingURL=index-DHJePE0y.d.cts.map
+//# sourceMappingURL=index-fU3qHy7c.d.cts.map

package/dist/{index-DHJePE0y.d.cts.map → index-fU3qHy7c.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"index-DHJePE0y.d.cts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"mappings":";;;;;;;;;cASa;;;;;;;;;;;;;;;iBAoBG,mBAAmB,YAAY;;;;;iBAoB/B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBC2ElB,sBAAsB,cAAc,YACnD,QAAQ,eAAe,SACrB,wBAAwB;;;;iBA8BX,mBACf,QAAQ,iBACR,cACE;;;;;iBA+Ca,yBACf,QAAQ,WACR,cACE;;;;;iBAuDa,cACf,QAAQ,YAAY,iBACpB,cACE;;;;;;;iBA6Ba,wBACf,WAAW;;;;;;;;;;;;iBAkBI,kBACf,WAAW,qBACX;;;;;;;iBAsBe,kBAAkB,WAAW;;iBAa7B,kBAAkB,QAAQ;;;;;iBAS1B,gBACf,WAAW,qBACX,kBACE;;;;;iBAiCa,iBAAiB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoD5B,oBACf;EACK;EAAmB,YAAY;eAEpC"}
+{"version":3,"file":"index-fU3qHy7c.d.cts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"mappings":";;;;;;;;;cASa;;;;;;;;;;;;;;;iBAoBG,mBAAmB,YAAY;;;;;iBAoB/B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBC2ElB,sBAAsB,cAAc,YACnD,QAAQ,eAAe,SACrB,wBAAwB;;;;iBA8BX,mBACf,QAAQ,iBACR,cACE;;;;;iBA+Ca,yBACf,QAAQ,WACR,cACE;;;;;iBAuDa,cACf,QAAQ,YAAY,iBACpB,cACE;;;;;;;iBA6Ba,wBACf,WAAW;;;;;;;;;;;;iBAkBI,kBACf,WAAW,qBACX;;;;;;;iBAsBe,kBAAkB,WAAW;;iBAa7B,kBAAkB,QAAQ;;;;;iBAS1B,gBACf,WAAW,qBACX,kBACE;;;;;iBAiCa,iBAAiB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoD5B,oBACf;EACK;EAAmB,YAAY;eAEpC"}

package/dist/index.cjs

@@ -2,15 +2,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_discover = require("./discover-DXNviAh-.cjs");
-const require_config = require("./config-CsYSyUya.cjs");
-const require_workspace = require("./workspace-DEibcoBe.cjs");
+const require_config = require("./config-Cvr5fCbn.cjs");
+const require_workspace = require("./workspace-BcCiLzTO.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-DQgxT_WR.cjs");
-const require_workspace$1 = require("./workspace-j6ZxvJqq.cjs");
+const require_workspace$1 = require("./workspace-BEGUDNwK.cjs");
 const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BN0PIZxd.cjs");
 const require_openapi = require("./openapi.cjs");
-const require_ready = require("./ready-lr2Fm-ep.cjs");
-const require_backends = require("./backends-B9V2XD2M.cjs");
+const require_ready = require("./ready-ClUpTxoL.cjs");
+const require_backends = require("./backends-BXcwhb7p.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
 let commander = require("commander");
 let node_process = require("node:process");
@@ -48,7 +48,7 @@ let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
 //#region package.json
-var version = "10.0.0-alpha.50";
+var version = "10.0.0-alpha.52";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1731,9 +1731,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$9.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-CNlew9Ek.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-DCxK1NRd.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-CNlew9Ek.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-DCxK1NRd.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2316,7 +2316,7 @@ var CronGenerator = class extends require_discover.ConstructGenerator {
  */
 import type { EnvironmentParser } from '@geekmidas/envkit';
 import type { Logger } from '@geekmidas/logger';
-import { toCronExpression } from '@geekmidas/constructs/crons';
+import { runCron, scheduleInProcess, toCronExpression } from '@geekmidas/constructs/crons';
 import { ServiceDiscovery } from '@geekmidas/services';
 ${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
 
@@ -2357,11 +2357,10 @@ export async function setupCrons(
 
   const run = async (entry: (typeof prepared)[number]) => {
     try {
-      await entry.cron.handler({
-        input: undefined,
-        services: entry.services,
-        logger: entry.cron.logger,
-      });
+      // The cron's own function, the way its Lambda would run it — services,
+      // the worker's database as \`db\`, its events. It used to call a
+      // \`handler\` a Cron does not have, so every firing logged a failure.
+      await runCron(entry.cron, serviceDiscovery);
     } catch (error) {
       logger.error({ error, cron: entry.name }, 'Cron failed');
     }
@@ -2372,13 +2371,28 @@ export async function setupCrons(
   // memory fires each job once per replica — so the schedule lives in
   // Postgres. It used to be a second pg-boss on the worker's database, as the
   // runtime role, which can neither create a schema nor use the broker's.
-  const { url } = envParser
+  const { url, devPid } = envParser
     .create((get) => ({
       url: get('EVENT_PUBLISHER_CONNECTION_STRING').string().optional(),
+      // Set by \`gkm dev\` on the server it starts, and by nothing deployed.
+      devPid: get('GKM_DEV_PID').string().optional(),
     }))
     .parse();
 
   if (!url?.startsWith('pgboss://')) {
+    // \`gkm dev\` on a target whose crons are infrastructure once deployed —
+    // EventBridge rules on AWS — has no broker to keep a schedule in. It is one
+    // process, so a timer fires each job once, which is all pg-boss is for
+    // here. Only there: a deployed server firing by timer fires once per
+    // replica, so outside dev this stays the error below.
+    if (devPid) {
+      for (const entry of prepared) {
+        running.push(scheduleInProcess(entry.schedule, () => run(entry)));
+        logger.info({ cron: entry.name, schedule: entry.schedule }, 'Cron scheduled in this process');
+      }
+      return;
+    }
+
     logger.error(
       { crons: prepared.map(({ name }) => name) },
       'These crons have nowhere to keep their schedule. On a server they are ' +
@@ -3997,7 +4011,7 @@ async function provisionDeclared(options) {
 		cache: require_backends.cacheBackendFor(require_backends.providerOf(workspace)),
 		events: require_backends.eventsBackendFor(require_backends.providerOf(workspace)),
 		storage: require_backends.storageBackendFor(require_backends.providerOf(workspace)),
-		addresses: surfaceAddresses(workspace, manifest, options.appUrls),
+		addresses: surfaceAddresses(manifest, options.appUrls),
 		seed: options.seed,
 		...options.supplied ? { supplied: options.supplied } : {},
 		deferred: [],
@@ -4059,25 +4073,20 @@ function carriersLast(ordered, manifest) {
 	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
 }
 /**
-* Where each declared surface answers.
-*
-* Every `rest-api` in a process answers on that process's address, so an app
-* serving both its own API and an auth server publishes one address twice —
-* which is exactly what it does at runtime, and the same rule the local target
-* applies.
+* Where each declared surface answers: its own app's address.
 *
-* A workspace with two backends is the case this does not answer, and the
-* manifest cannot yet: which surface belongs to which app is what §2's endpoint
-* merge would record. Until then the first backend's address is used, and a
-* second backend's surfaces would be wrong rather than missing — worth knowing
-* before relying on it.
+* Every surface is an app of its own, keyed by its id the way the derivation
+* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
+* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
+* address, so a workspace with two APIs pointed both at the same one.
 */
-function surfaceAddresses(workspace, manifest, appUrls) {
+function surfaceAddresses(manifest, appUrls) {
 	const addresses = {};
-	const backend = Object.entries(workspace.apps).find(([, app]) => app.type === "backend");
-	const url = backend ? appUrls[backend[0]] : void 0;
-	if (!url) return addresses;
-	for (const [id, declaration] of Object.entries(manifest)) if (declaration.kind === "rest-api") addresses[id] = url;
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api") continue;
+		const url = appUrls[require_config.appKey(id)];
+		if (url) addresses[id] = url;
+	}
 	return addresses;
 }
 //#endregion
@@ -4562,32 +4571,34 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 }
 //#endregion
 //#region src/deploy/domain.ts
+/** A stage was deployed that `deploy.domains` gives no domain. */
+var NoDomainForStage = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
+		this.stage = stage;
+		this.name = "NoDomainForStage";
+	}
+};
 /**
-* Resolve the hostname for an app based on stage configuration.
+* The hostname an app answers on for a stage.
 *
-* Domain resolution priority:
-* 1. Explicit app.domain override (string or stage-specific)
-* 2. Default pattern based on app type:
-*    - Main frontend app gets base domain (e.g., 'myapp.com')
-*    - Other apps get prefixed domain (e.g., 'api.myapp.com')
+* 1. An explicit `app.domain` — a string, or one per stage — wins.
+* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
+*    answers on the domain itself, and every other app on
+*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
 *
-* @param appName - The name of the app
-* @param app - The normalized app configuration
-* @param stage - The deployment stage (e.g., 'production', 'development')
-* @param dokployConfig - Dokploy workspace configuration with domain mappings
-* @param isMainFrontend - Whether this is the main frontend app
-* @returns The resolved hostname for the app
-* @throws Error if no domain configuration is found for the stage
+* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
 */
-function resolveHost(appName, app, stage, dokployConfig, isMainFrontend) {
+function resolveHost(appName, app, stage, domains, isMainFrontend) {
 	if (app.domain) {
 		if (typeof app.domain === "string") return app.domain;
 		if (app.domain[stage]) return app.domain[stage];
 	}
-	const baseDomain = dokployConfig?.domains?.[stage];
-	if (!baseDomain) throw new Error(`No domain configured for stage "${stage}". Add deploy.dokploy.domains.${stage} to gkm.config.ts`);
+	const baseDomain = domains?.[stage];
+	if (!baseDomain) throw new NoDomainForStage(stage);
 	if (isMainFrontend) return baseDomain;
-	return `${appName}.${baseDomain}`;
+	return `${app.subdomain ?? appName}.${baseDomain}`;
 }
 /**
 * Whether this app is the site the base domain points at — see `rootSite`,
@@ -7612,7 +7623,6 @@ async function workspaceDeployCommand(configured, options) {
 	if (skippedMobileApps.length > 0) logger$4.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
-	const dokployConfig = workspace.deploy.dokploy;
 	let declaredEnv = {};
 	let declaredClusters = {};
 	{
@@ -7621,7 +7631,7 @@ async function workspaceDeployCommand(configured, options) {
 		for (const appName of backendApps) {
 			const app = workspace.apps[appName];
 			if (!app) continue;
-			appUrls[appName] = `https://${resolveHost(appName, app, stage, dokployConfig, false)}`;
+			appUrls[appName] = `https://${resolveHost(appName, app, stage, workspace.deploy?.domains, false)}`;
 		}
 		const declared = await provisionDeclared({
 			api,
@@ -7685,7 +7695,8 @@ async function workspaceDeployCommand(configured, options) {
 	const frontendUrls = [];
 	for (const appName of frontendApps) {
 		const app = workspace.apps[appName];
-		const hostname = resolveHost(appName, app, stage, dokployConfig, isMainFrontendApp(appName, app, workspace.apps));
+		const isMainFrontend = isMainFrontendApp(appName, app, workspace.apps);
+		const hostname = resolveHost(appName, app, stage, workspace.deploy?.domains, isMainFrontend);
 		frontendUrls.push(`https://${hostname}`);
 	}
 	if (backendApps.length > 0) {
@@ -7731,7 +7742,7 @@ async function workspaceDeployCommand(configured, options) {
 					},
 					buildArgs
 				});
-				const backendHost = resolveHost(appName, app, stage, dokployConfig, false);
+				const backendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, false);
 				const dependencyUrls = {};
 				if (app.dependencies) {
 					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
@@ -7836,7 +7847,8 @@ async function workspaceDeployCommand(configured, options) {
 				if (app.dependencies) {
 					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
 				}
-				const frontendHost = resolveHost(appName, app, stage, dokployConfig, isMainFrontendApp(appName, app, workspace.apps));
+				const isMainFrontend = isMainFrontendApp(appName, app, workspace.apps);
+				const frontendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, isMainFrontend);
 				const envContext = {
 					app,
 					appName,
@@ -9328,26 +9340,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.50",
-	"@geekmidas/auth": "~10.0.0-alpha.50",
-	"@geekmidas/cache": "~10.0.0-alpha.50",
-	"@geekmidas/client": "~10.0.0-alpha.50",
-	"@geekmidas/cloud": "~10.0.0-alpha.50",
-	"@geekmidas/constructs": "~10.0.0-alpha.50",
-	"@geekmidas/db": "~10.0.0-alpha.50",
-	"@geekmidas/emailkit": "~10.0.0-alpha.50",
-	"@geekmidas/envkit": "~10.0.0-alpha.50",
-	"@geekmidas/errors": "~10.0.0-alpha.50",
-	"@geekmidas/events": "~10.0.0-alpha.50",
-	"@geekmidas/logger": "~10.0.0-alpha.50",
-	"@geekmidas/manifest": "~10.0.0-alpha.50",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.50",
-	"@geekmidas/schema": "~10.0.0-alpha.50",
-	"@geekmidas/services": "~10.0.0-alpha.50",
-	"@geekmidas/storage": "~10.0.0-alpha.50",
-	"@geekmidas/studio": "~10.0.0-alpha.50",
-	"@geekmidas/telescope": "~10.0.0-alpha.50",
-	"@geekmidas/testkit": "~10.0.0-alpha.50",
+	"@geekmidas/audit": "~10.0.0-alpha.52",
+	"@geekmidas/auth": "~10.0.0-alpha.52",
+	"@geekmidas/cache": "~10.0.0-alpha.52",
+	"@geekmidas/client": "~10.0.0-alpha.52",
+	"@geekmidas/cloud": "~10.0.0-alpha.52",
+	"@geekmidas/constructs": "~10.0.0-alpha.52",
+	"@geekmidas/db": "~10.0.0-alpha.52",
+	"@geekmidas/emailkit": "~10.0.0-alpha.52",
+	"@geekmidas/envkit": "~10.0.0-alpha.52",
+	"@geekmidas/errors": "~10.0.0-alpha.52",
+	"@geekmidas/events": "~10.0.0-alpha.52",
+	"@geekmidas/logger": "~10.0.0-alpha.52",
+	"@geekmidas/manifest": "~10.0.0-alpha.52",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.52",
+	"@geekmidas/schema": "~10.0.0-alpha.52",
+	"@geekmidas/services": "~10.0.0-alpha.52",
+	"@geekmidas/storage": "~10.0.0-alpha.52",
+	"@geekmidas/studio": "~10.0.0-alpha.52",
+	"@geekmidas/telescope": "~10.0.0-alpha.52",
+	"@geekmidas/testkit": "~10.0.0-alpha.52",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10902,7 +10914,7 @@ function generateDeployFiles(options) {
         // VPC with NAT is a monthly cost in an account that may already
         // have one — replace it with \`sst.aws.Vpc.get(…)\` if so.
         ${db.id}: { vpc },`] : [], ...options.constructs.mail ? [`        // Every provider rejects an unverified sender, so there is no
-        // default; the synth stops with \`EmailNeedsSender\` until it is set.
+        // default — \`fromManifest\` requires it, by the manifest's types.
         ${mail.id}: { from: process.env.MAIL_FROM as string },`] : []];
 	return [{
 		path: "sst.config.ts",
@@ -16090,7 +16102,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-CNlew9Ek.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-DCxK1NRd.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-DXNviAh-.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -16521,7 +16533,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-CNlew9Ek.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-DCxK1NRd.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16535,7 +16547,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-CNlew9Ek.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-DCxK1NRd.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16549,7 +16561,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-CNlew9Ek.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-DCxK1NRd.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16647,7 +16659,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-C7OGMve_.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-DCsdx4Po.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16658,7 +16670,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-C7OGMve_.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-DCsdx4Po.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16710,7 +16722,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-j6ZxvJqq.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-BEGUDNwK.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16769,7 +16781,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BrI1tv6u.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BGx4U61b.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));