@geekmidas/cli 10.0.0-alpha.53 → 10.0.0-alpha.55

package/dist/index.cjs

@@ -2,15 +2,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_discover = require("./discover-DXNviAh-.cjs");
-const require_config = require("./config-Cvr5fCbn.cjs");
-const require_workspace = require("./workspace-BcCiLzTO.cjs");
+const require_config = require("./config-C7NZG2tr.cjs");
+const require_workspace = require("./workspace-DL_99LJC.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-DQgxT_WR.cjs");
-const require_workspace$1 = require("./workspace-P_V5t4Uk.cjs");
-const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BN0PIZxd.cjs");
+const require_workspace$1 = require("./workspace-CXvYabDJ.cjs");
+const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-WlUHjimW.cjs");
 const require_openapi = require("./openapi.cjs");
-const require_ready = require("./ready-VkNwfJu7.cjs");
-const require_backends = require("./backends-D5aDWxuA.cjs");
+const require_ready = require("./ready-BefA4mM0.cjs");
+const require_backends = require("./backends-nBauiBkt.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
 let commander = require("commander");
 let node_process = require("node:process");
@@ -20,10 +20,10 @@ let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 let node_path = require("node:path");
-let node_child_process = require("node:child_process");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let fast_glob = require("fast-glob");
 fast_glob = require_rolldown_runtime.__toESM(fast_glob, 1);
+let node_child_process = require("node:child_process");
 let node_module = require("node:module");
 let chokidar = require("chokidar");
 chokidar = require_rolldown_runtime.__toESM(chokidar, 1);
@@ -48,7 +48,7 @@ let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
 //#region package.json
-var version = "10.0.0-alpha.53";
+var version = "10.0.0-alpha.55";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -394,12 +394,12 @@ function withOwningTsconfigJsx(nodeOptions = "") {
 * unhelpful.
 *
 * A separate command rather than part of `gkm setup`, for one reason: this
-* needs `sudo`, and a setup that silently escalates on every run is a worse
-* trade than one that tells you what to type. Caddy's own `caddy trust` draws
-* the line in the same place.
+* asks for a password, and a setup that silently escalates on every run is a
+* worse trade than one that tells you what to type. Caddy's own `caddy trust`
+* draws the line in the same place.
 */
 const logger$11 = console;
-const run = (0, node_util.promisify)(node_child_process.execFile);
+const run$1 = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * How each platform is told about a new authority.
 *
@@ -410,15 +410,14 @@ const run = (0, node_util.promisify)(node_child_process.execFile);
 */
 function installation(platform, certificate) {
 	if (platform === "darwin") return {
-		describe: "the System keychain",
-		steps: [["sudo", [
-			"security",
+		describe: "your login keychain",
+		asks: "macOS asks once — your password or Touch ID — to change trust settings.",
+		steps: [["security", [
 			"add-trusted-cert",
-			"-d",
 			"-r",
 			"trustRoot",
 			"-k",
-			"/Library/Keychains/System.keychain",
+			(0, node_path.join)((0, node_os.homedir)(), "Library/Keychains/login.keychain-db"),
 			certificate
 		]]]
 	};
@@ -426,6 +425,7 @@ function installation(platform, certificate) {
 		const debian = (0, node_fs.existsSync)("/usr/local/share/ca-certificates");
 		return {
 			describe: debian ? "the system CA bundle" : "the system trust anchors",
+			asks: "This needs sudo: the system trust store is the only one.",
 			steps: debian ? [["sudo", [
 				"cp",
 				certificate,
@@ -449,15 +449,15 @@ async function trustCommand(options = {}) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
 	const certificate = (0, node_path.join)(workspace.root, require_workspace$1.LOCAL_CA_PATH);
 	if (!(0, node_fs.existsSync)(certificate)) throw new NoLocalAuthority(certificate);
-	const { describe, steps } = installation(process.platform, certificate);
+	const { describe, asks, steps } = installation(process.platform, certificate);
 	logger$11.log(`\n🔐 Trusting the local authority in ${describe}`);
 	logger$11.log(`   ${certificate}\n`);
 	if (options.dryRun) {
 		for (const [command, args] of steps) logger$11.log(`   ${command} ${args.join(" ")}`);
 		return;
 	}
-	logger$11.log("   This needs an admin password.\n");
-	for (const [command, args] of steps) await run(command, args, { stdio: "inherit" });
+	logger$11.log(`   ${asks}\n`);
+	for (const [command, args] of steps) await run$1(command, args, { stdio: "inherit" });
 	logger$11.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
 }
 /**
@@ -465,7 +465,7 @@ async function trustCommand(options = {}) {
 *
 * A machine's answer, not the project's: whether a laptop installs a root
 * certificate is its owner's call, so the decision is `--yes`, then what this
-* machine previously answered, then a prompt. Never a silent `sudo` — that is
+* machine previously answered, then a prompt. Never a silent escalation — that is
 * the one thing a setup command should not do on somebody's behalf.
 *
 * Silent and free when the machine already trusts it, which is what makes it
@@ -482,7 +482,7 @@ async function ensureTrusted(root, url, options = {}) {
 		const { install } = await (0, prompts.default)({
 			type: "confirm",
 			name: "install",
-			message: "Trust this project's local certificate authority, so a browser accepts its https addresses? (needs sudo)",
+			message: "Trust this project's local certificate authority, so a browser accepts its https addresses? (asks for your password)",
 			initial: false
 		});
 		if (!install) {
@@ -523,7 +523,7 @@ async function recordDeclined(root) {
 async function isTrusted(url) {
 	const { NODE_EXTRA_CA_CERTS: _ignored, ...env } = process.env;
 	try {
-		await run(process.execPath, [
+		await run$1(process.execPath, [
 			"--use-system-ca",
 			"-e",
 			`fetch(${JSON.stringify(url)}).then(()=>0,()=>process.exit(1))`
@@ -1374,10 +1374,10 @@ function normalizeHooksConfig(config, cwd = process.cwd()) {
 /**
 * What a `--production` build is.
 *
-* A server runs its worker's background work itself — queues polled, crons
-* scheduled, subscribers drained — so the production entry wires all three.
-* The build writes their files on every server build, empty when there is
-* nothing, so including them costs an app without any nothing.
+* Background work — queues polled, crons scheduled, subscribers drained — is
+* included here, and `buildApp` takes it back out when the app serves a
+* RestApi: an API's image answers HTTP and nothing else, and that work belongs
+* to a Worker. The build still writes their files on every server build.
 *
 * @internal Exported for testing
 */
@@ -1771,9 +1771,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$9.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-SDIRUyY5.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-DHMRgnP6.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-SDIRUyY5.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-DHMRgnP6.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2744,6 +2744,147 @@ var TopicGenerator = class extends require_discover.ConstructGenerator {
 	}
 };
 //#endregion
+//#region src/run.ts
+/**
+* Start a program with an argument array, never a shell string.
+*
+* `gkm build`, `gkm docker` and `gkm deploy` pass values that come from the
+* workspace — image refs, tags, build args, package names — to `docker` and
+* `turbo`. Joined into a string and handed to a shell, a package named
+* `x;curl …|sh` or a tag holding `$(…)` became part of the command line, which
+* matters most where the CLI builds a repository it didn't write: a CI job for a
+* fork, a shared build runner. Here every value reaches the program as one
+* `argv` element, whatever it contains.
+*/
+/** Long enough for a cold image build; short enough that a hung one ends. */
+const DEFAULT_TIMEOUT_MS = 18e5;
+/** How long a timed-out child has to exit on SIGTERM before it is killed. */
+const KILL_GRACE_MS = 5e3;
+/** The command line as a person would read it — for messages, never to run. */
+function display(command, args) {
+	return [command, ...args].join(" ");
+}
+/** The program ran and exited unsuccessfully; its own output said why. */
+var CommandFailed = class extends Error {
+	command;
+	args;
+	exitCode;
+	signal;
+	constructor(command, args, exitCode, signal) {
+		super(`\`${display(command, args)}\` ${exitCode === null ? `was stopped by ${signal ?? "a signal"}` : `exited with code ${exitCode}`}. Its output above says why; run it by hand to see it again.`);
+		this.command = command;
+		this.args = args;
+		this.exitCode = exitCode;
+		this.signal = signal;
+		this.name = "CommandFailed";
+	}
+};
+/** The program ran past its timeout and was killed. */
+var CommandTimedOut = class extends Error {
+	command;
+	args;
+	timeoutMs;
+	constructor(command, args, timeoutMs) {
+		super(`\`${display(command, args)}\` was still running after ${Math.round(timeoutMs / 1e3)}s and was stopped. Check what it was waiting on — a registry, the Docker daemon, a prompt — and run it again.`);
+		this.command = command;
+		this.args = args;
+		this.timeoutMs = timeoutMs;
+		this.name = "CommandTimedOut";
+	}
+};
+/**
+* Run `command` with `args`, resolving when it exits 0.
+*
+* Rejects with {@link CommandFailed} on any other exit, {@link CommandTimedOut}
+* once `timeoutMs` passes (after the child is gone), and with the spawn error
+* itself when the program cannot be started at all — `ENOENT` already names it.
+*/
+function run(command, args, options = {}) {
+	const { timeoutMs = DEFAULT_TIMEOUT_MS, ...spawnOptions } = options;
+	return new Promise((resolve, reject) => {
+		const child = (0, node_child_process.spawn)(command, [...args], {
+			stdio: "inherit",
+			...spawnOptions,
+			shell: false
+		});
+		let timedOut = false;
+		let killer;
+		const timer = setTimeout(() => {
+			timedOut = true;
+			child.kill("SIGTERM");
+			killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS);
+			killer.unref?.();
+		}, timeoutMs);
+		timer.unref?.();
+		const settle = () => {
+			clearTimeout(timer);
+			if (killer) clearTimeout(killer);
+		};
+		child.on("error", (error) => {
+			settle();
+			reject(error);
+		});
+		child.on("close", (code, signal) => {
+			settle();
+			if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));
+			else if (code === 0) resolve();
+			else reject(new CommandFailed(command, args, code, signal));
+		});
+	});
+}
+//#endregion
+//#region src/secrets/encryption.ts
+var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	encryptSecrets: () => encryptSecrets,
+	generateDefineOptions: () => generateDefineOptions,
+	keyFingerprint: () => keyFingerprint
+});
+/** AES-256-GCM configuration */
+const ALGORITHM = "aes-256-gcm";
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+/**
+* Encrypt secrets for embedding in a bundle.
+* Uses AES-256-GCM with a randomly generated ephemeral key.
+*
+* @param secrets - Key-value pairs to encrypt
+* @returns Encrypted payload with ephemeral master key
+*/
+function encryptSecrets(secrets) {
+	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
+	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
+	const plaintext = JSON.stringify(secrets);
+	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+	const authTag = cipher.getAuthTag();
+	return {
+		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
+		iv: iv.toString("hex"),
+		masterKey: masterKey.toString("hex")
+	};
+}
+/**
+* Generate the define options for tsdown/esbuild.
+* These will be injected at build time.
+*/
+function generateDefineOptions(payload) {
+	return {
+		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
+		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
+	};
+}
+/**
+* A short, one-way name for a master key: the first 8 hex characters of its
+* SHA-256.
+*
+* Printed where the key itself used to be, so a person can tell which key a
+* build used — and match it against the one they hold — without the output
+* carrying a value that decrypts every secret of the stage.
+*/
+function keyFingerprint(masterKey) {
+	return (0, node_crypto.createHash)("sha256").update(masterKey).digest("hex").slice(0, 8);
+}
+//#endregion
 //#region src/build/owners.ts
 /**
 * What a generated entry imports its runtime from, read off the discovered
@@ -2874,6 +3015,11 @@ export default app;
 //#region src/build/index.ts
 const logger$8 = console;
 /**
+* Where `gkm build --stage` leaves the key its bundle's secrets were encrypted
+* with, beside the bundle in `.gkm/server/` and readable by its owner alone.
+*/
+const MASTER_KEY_FILE = "master.key";
+/**
 * What a build run at the workspace root reads.
 *
 * One backend app there, and it is that app's config, so its own `openapi`
@@ -3089,6 +3235,18 @@ async function buildApp(input) {
 		logger$8.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
+	if (production?.subscribers === "include" && derived.surface) {
+		buildContext.production = {
+			...production,
+			subscribers: "exclude"
+		};
+		const left = [
+			[allCrons.length, "cron"],
+			[allQueues.length, "queue consumer"],
+			[allSubscribers.length, "subscriber"]
+		].filter(([n]) => n > 0).map(([n, what]) => `${n} ${what}${n === 1 ? "" : "s"}`);
+		if (left.length > 0) logger$8.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
+	}
 	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
 	await require_openapi.generateOpenApi(allEndpoints.map(({ construct }) => construct), {
 		openapi: config.openapi,
@@ -3166,8 +3324,11 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 			})).masterKey;
 			logger$8.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
 			if (masterKey) {
+				const keyPath = (0, node_path.join)(outputDir, MASTER_KEY_FILE);
+				await (0, node_fs_promises.writeFile)(keyPath, `${masterKey}\n`, { mode: 384 });
+				await (0, node_fs_promises.chmod)(keyPath, 384);
 				logger$8.log(`\n🔐 Secrets encrypted for deployment`);
-				logger$8.log(`   Deploy with: GKM_MASTER_KEY=${masterKey}`);
+				logger$8.log(`   Run with GKM_MASTER_KEY set to the key in ${(0, node_path.relative)(appRoot, keyPath)} (fingerprint ${keyFingerprint(masterKey)})`);
 			}
 		}
 		return {
@@ -3190,7 +3351,7 @@ function detectPackageManager$2() {
 	return "npm";
 }
 /**
-* Get the turbo command for running builds.
+* The program and argv that run turbo's build.
 *
 * `filters` names the packages to build. Passing none lets turbo infer its own
 * scope from the working directory, which for a workspace root means the
@@ -3198,14 +3359,24 @@ function detectPackageManager$2() {
 * `gkm build`, inferring is how you get a build that runs itself forever.
 * `workspaceBuildCommand` always names the apps.
 *
+* An array, not a command string: the filters are package names read from the
+* workspace, and each must reach turbo as one argument whatever it holds. Each
+* is `--filter=<name>`, so even a name starting with `-` stays a filter value.
+*
 * @internal Exported for testing
 */
-function getTurboCommand(pm, filters = [], { only = false } = {}) {
-	const filterArgs = (typeof filters === "string" ? [filters] : filters).map((f) => ` --filter=${f}`).join("") + (only ? " --only" : "");
+function getTurboArgs(pm, filters = [], { only = false } = {}) {
+	const turbo = [
+		"turbo",
+		"run",
+		"build",
+		...(typeof filters === "string" ? [filters] : filters).map((f) => `--filter=${f}`),
+		...only ? ["--only"] : []
+	];
 	switch (pm) {
-		case "pnpm": return `pnpm exec turbo run build${filterArgs}`;
-		case "yarn": return `yarn turbo run build${filterArgs}`;
-		case "npm": return `npx turbo run build${filterArgs}`;
+		case "pnpm": return ["pnpm", ["exec", ...turbo]];
+		case "yarn": return ["yarn", turbo];
+		case "npm": return ["npx", turbo];
 	}
 }
 /**
@@ -3294,27 +3465,16 @@ async function workspaceBuildCommand(workspace, options) {
 		const { filters, unpackaged } = turboFilters(workspace, { exclude: "backend" });
 		if (unpackaged.length > 0) throw new Error(`No package.json for workspace app(s): ${unpackaged.join(", ")}. Each app needs one — turbo builds packages, and gkm reads the name back to know which app it is building.`);
 		const pm = detectPackageManager$2();
-		const turboCommand = getTurboCommand(pm, filters, { only: true });
+		const [turboBin, turboArgs] = getTurboArgs(pm, filters, { only: true });
 		if (filters.length > 0) {
 			logger$8.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
-			logger$8.log(`Running: ${turboCommand}`);
-			await new Promise((resolve, reject) => {
-				const child = (0, node_child_process.spawn)(turboCommand, {
-					shell: true,
-					cwd: workspace.root,
-					stdio: "inherit",
-					env: {
-						...process.env,
-						NODE_ENV: options.production ? "production" : "development"
-					}
-				});
-				child.on("close", (code) => {
-					if (code === 0) resolve();
-					else reject(/* @__PURE__ */ new Error(`Turbo build failed with exit code ${code}`));
-				});
-				child.on("error", (err) => {
-					reject(err);
-				});
+			logger$8.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
+			await run(turboBin, turboArgs, {
+				cwd: workspace.root,
+				env: {
+					...process.env,
+					NODE_ENV: options.production ? "production" : "development"
+				}
 			});
 		}
 		for (const [appName, app] of apps) {
@@ -4667,6 +4827,39 @@ function getPublicUrlArgNames(app) {
 	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
 }
 //#endregion
+//#region src/docker/imageRef.ts
+/**
+* An image reference, checked before it reaches `docker`.
+*
+* The parts come from the workspace — a registry in `gkm.config.ts`, an image
+* name from the project, a tag from `--tag` — and an argument array already
+* keeps them out of a shell. What it cannot do is stop `docker` reading a value
+* that starts with `-` as one of its own flags, so a ref is held to Docker's
+* own grammar (distribution/reference) and anything else is refused by name
+* before a build starts.
+*/
+const DOMAIN_COMPONENT = "(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])";
+const DOMAIN = `${DOMAIN_COMPONENT}(?:\\.${DOMAIN_COMPONENT})*(?::[0-9]+)?`;
+const PATH_COMPONENT = "[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*";
+const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPONENT})*(?::[\\w][\\w.-]{0,127})?(?:@[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*:[0-9a-fA-F]{32,})?$`);
+/** Docker refuses a repository name longer than this. */
+const MAX_NAME_LENGTH = 255;
+/** A value that is not an image reference was about to be built or pushed. */
+var ImageRefInvalid = class extends Error {
+	ref;
+	constructor(ref) {
+		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
+		this.ref = ref;
+		this.name = "ImageRefInvalid";
+	}
+};
+/** Throw {@link ImageRefInvalid} unless `ref` is a Docker image reference. */
+function validateImageRef(ref) {
+	const name = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	if (!REFERENCE.test(ref) || name.length > MAX_NAME_LENGTH) throw new ImageRefInvalid(ref);
+	return ref;
+}
+//#endregion
 //#region src/docker/templates.ts
 const LOCKFILES = [
 	["pnpm-lock.yaml", "pnpm"],
@@ -5020,6 +5213,10 @@ node_modules
 .gkm/server/*.ts
 !.gkm/server/dist
 
+# The key gkm build --stage encrypted secrets with: runtime env only, never
+# the build context
+.gkm/server/master.key
+
 # IDE and editor
 .idea
 .vscode
@@ -5234,10 +5431,6 @@ FROM deps AS builder
 
 WORKDIR /app
 
-# Build-time args for encrypted secrets
-ARG GKM_ENCRYPTED_CREDENTIALS=""
-ARG GKM_CREDENTIALS_IV=""
-
 # Copy pruned source
 COPY --from=pruner /app/out/full/ ./
 
@@ -5246,11 +5439,15 @@ COPY --from=pruner /app/out/full/ ./
 COPY --from=pruner /app/gkm.config.* ./
 COPY --from=pruner /app/tsconfig.* ./
 
-# Write encrypted credentials for gkm build to embed
-RUN if [ -n "$GKM_ENCRYPTED_CREDENTIALS" ]; then \
+# Write encrypted credentials for gkm build to embed.
+# A build secret (\`docker build --secret id=gkm_credentials,src=…\`), not an
+# ARG: an ARG is recorded in the image history. Two lines, ciphertext then IV;
+# absent when the app has no secrets.
+RUN --mount=type=secret,id=gkm_credentials,required=false \
+    if [ -s /run/secrets/gkm_credentials ]; then \
       mkdir -p ${appPath}/.gkm && \
-      echo "$GKM_ENCRYPTED_CREDENTIALS" > ${appPath}/.gkm/credentials.enc && \
-      echo "$GKM_CREDENTIALS_IV" > ${appPath}/.gkm/credentials.iv; \
+      sed -n 1p /run/secrets/gkm_credentials > ${appPath}/.gkm/credentials.enc && \
+      sed -n 2p /run/secrets/gkm_credentials > ${appPath}/.gkm/credentials.iv; \
     fi
 
 # Build any workspace packages the app depends on.
@@ -5337,10 +5534,6 @@ FROM deps AS builder
 
 WORKDIR /app
 
-# Build-time args for encrypted secrets
-ARG GKM_ENCRYPTED_CREDENTIALS=""
-ARG GKM_CREDENTIALS_IV=""
-
 # Copy pruned source
 COPY --from=pruner /app/out/full/ ./
 
@@ -5348,20 +5541,17 @@ COPY --from=pruner /app/out/full/ ./
 # Using wildcard to make it optional for single-app projects
 COPY --from=pruner /app/tsconfig.* ./
 
-# Write encrypted credentials for tsdown to embed via define
-RUN if [ -n "$GKM_ENCRYPTED_CREDENTIALS" ]; then \
-      mkdir -p ${appPath}/.gkm && \
-      echo "$GKM_ENCRYPTED_CREDENTIALS" > ${appPath}/.gkm/credentials.enc && \
-      echo "$GKM_CREDENTIALS_IV" > ${appPath}/.gkm/credentials.iv; \
-    fi
-
 # Bundle entry point with esbuild (outputs to dist/index.mjs)
 # Creates a fully standalone bundle with all dependencies included
-# Use define to embed credentials if present
-RUN cd ${appPath} && \
-    if [ -f .gkm/credentials.enc ]; then \
-      CREDS=$(cat .gkm/credentials.enc) && \
-      IV=$(cat .gkm/credentials.iv) && \
+# Use define to embed credentials if present.
+# They arrive as a build secret (\`docker build --secret id=gkm_credentials,src=…\`),
+# not an ARG: an ARG is recorded in the image history. Two lines, ciphertext
+# then IV; absent when the app has no secrets.
+RUN --mount=type=secret,id=gkm_credentials,required=false \
+    cd ${appPath} && \
+    if [ -s /run/secrets/gkm_credentials ]; then \
+      CREDS=$(sed -n 1p /run/secrets/gkm_credentials) && \
+      IV=$(sed -n 2p /run/secrets/gkm_credentials) && \
       npx esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \
         --outfile=dist/index.mjs --packages=bundle \
         --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);' \
@@ -5512,6 +5702,33 @@ CMD ["nginx", "-g", "daemon off;"]
 //#endregion
 //#region src/docker/index.ts
 const logger$6 = console;
+/** `docker build` failed; what docker printed above says why. */
+var DockerBuildFailed = class extends Error {
+	imageRef;
+	constructor(imageRef, cause) {
+		super(`Failed to build Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.imageRef = imageRef;
+		this.name = "DockerBuildFailed";
+	}
+};
+/** `docker push` failed — usually the registry login or its permissions. */
+var DockerPushFailed = class extends Error {
+	imageRef;
+	constructor(imageRef, cause) {
+		super(`Failed to push Docker image: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		this.imageRef = imageRef;
+		this.name = "DockerPushFailed";
+	}
+};
+/** `gkm docker --push` was asked for with nowhere to push to. */
+var PushNeedsRegistry = class extends Error {
+	imageName;
+	constructor(imageName) {
+		super(`Registry is required to push Docker image '${imageName}'. Use --registry or configure docker.registry in gkm.config.ts`);
+		this.imageName = imageName;
+		this.name = "PushNeedsRegistry";
+	}
+};
 /**
 * Docker command implementation
 * Generates Dockerfile, docker-compose.yml, and related files
@@ -5615,14 +5832,18 @@ function ensureLockfile(cwd) {
 async function buildDockerImage(imageName, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
-	const fullImageName = registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`;
+	const fullImageName = validateImageRef(registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`);
 	logger$6.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	const cwd = process.cwd();
 	const cleanup = ensureLockfile(cwd);
 	try {
-		(0, node_child_process.execSync)(`DOCKER_BUILDKIT=1 docker build -f .gkm/docker/Dockerfile -t ${fullImageName} .`, {
+		await run("docker", [
+			"build",
+			"--file=.gkm/docker/Dockerfile",
+			`--tag=${fullImageName}`,
+			"."
+		], {
 			cwd,
-			stdio: "inherit",
 			env: {
 				...process.env,
 				DOCKER_BUILDKIT: "1"
@@ -5630,7 +5851,7 @@ async function buildDockerImage(imageName, options) {
 		});
 		logger$6.log(`✅ Docker image built: ${fullImageName}`);
 	} catch (error) {
-		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+		throw new DockerBuildFailed(fullImageName, error);
 	} finally {
 		cleanup?.();
 	}
@@ -5641,17 +5862,14 @@ async function buildDockerImage(imageName, options) {
 async function pushDockerImage(imageName, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
-	if (!registry) throw new Error("Registry is required to push Docker image. Use --registry or configure docker.registry in gkm.config.ts");
-	const fullImageName = `${registry}/${imageName}:${tag}`;
+	if (!registry) throw new PushNeedsRegistry(imageName);
+	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
 	logger$6.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
-		(0, node_child_process.execSync)(`docker push ${fullImageName}`, {
-			cwd: process.cwd(),
-			stdio: "inherit"
-		});
+		await run("docker", ["push", fullImageName], { cwd: process.cwd() });
 		logger$6.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
-		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+		throw new DockerPushFailed(fullImageName, error);
 	}
 }
 /**
@@ -5783,6 +6001,11 @@ function printRunInstructions(workspace) {
 //#region src/deploy/docker.ts
 const logger$5 = console;
 /**
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
 * Get the full image reference
 */
 function getImageRef(registry, imageName, tag) {
@@ -5790,31 +6013,69 @@ function getImageRef(registry, imageName, tag) {
 	return `${imageName}:${tag}`;
 }
 /**
+* The `docker build` argv for an image.
+*
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
+*
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
+*
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
+*
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-credentials-"));
+	const path = (0, node_path.join)(dir, CREDENTIALS_SECRET_ID);
+	await (0, node_fs_promises.writeFile)(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
+	await (0, node_fs_promises.chmod)(path, 384);
+	return {
+		path,
+		cleanup: () => (0, node_fs_promises.rm)(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
 * Build Docker image
 * @param imageRef - Full image reference (registry/name:tag)
-* @param appName - Name of the app (used for Dockerfile.{appName} in workspaces)
 * @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
 */
-async function buildImage(imageRef, _appName, buildArgs) {
+async function buildImage(imageRef, buildArgs, credentials) {
 	logger$5.log(`\n🔨 Building Docker image: ${imageRef}`);
 	const cwd = process.cwd();
 	logger$5.log("   Generating Dockerfile for the pre-built bundle...");
 	await dockerCommand({ slim: true });
 	const dockerfilePath = (0, node_path.join)(cwd, ".gkm", "docker", "Dockerfile");
-	const buildCwd = cwd;
-	const buildArgsString = buildArgs && buildArgs.length > 0 ? buildArgs.map((arg) => `--build-arg "${arg}"`).join(" ") : "";
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
 	try {
-		const cmd = [
-			"DOCKER_BUILDKIT=1 docker build",
-			"--platform linux/amd64",
-			`-f ${dockerfilePath}`,
-			`-t ${imageRef}`,
-			buildArgsString,
-			"."
-		].filter(Boolean).join(" ");
-		(0, node_child_process.execSync)(cmd, {
-			cwd: buildCwd,
-			stdio: "inherit",
+		await run("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs,
+			credentialsFile: secret?.path
+		}), {
+			cwd,
 			env: {
 				...process.env,
 				DOCKER_BUILDKIT: "1"
@@ -5822,7 +6083,9 @@ async function buildImage(imageRef, _appName, buildArgs) {
 		});
 		logger$5.log(`✅ Image built: ${imageRef}`);
 	} catch (error) {
-		throw new Error(`Failed to build Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+		throw new DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
 	}
 }
 /**
@@ -5831,23 +6094,20 @@ async function buildImage(imageRef, _appName, buildArgs) {
 async function pushImage(imageRef) {
 	logger$5.log(`\n☁️  Pushing image: ${imageRef}`);
 	try {
-		(0, node_child_process.execSync)(`docker push ${imageRef}`, {
-			cwd: process.cwd(),
-			stdio: "inherit"
-		});
+		await run("docker", ["push", imageRef], { cwd: process.cwd() });
 		logger$5.log(`✅ Image pushed: ${imageRef}`);
 	} catch (error) {
-		throw new Error(`Failed to push Docker image: ${error instanceof Error ? error.message : "Unknown error"}`);
+		throw new DockerPushFailed(imageRef, error);
 	}
 }
 /**
 * Deploy using Docker (build and optionally push image)
 */
 async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs } = options;
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
 	const imageName = config.imageName;
-	const imageRef = getImageRef(config.registry, imageName, tag);
-	await buildImage(imageRef, config.appName, buildArgs);
+	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
+	await buildImage(imageRef, buildArgs, credentials);
 	if (!skipPush) {
 		if (!config.registry) logger$5.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
 		else await pushImage(imageRef);
@@ -5856,12 +6116,7 @@ async function deployDocker(options) {
 	logger$5.log(`\n📋 Deployment details:`);
 	logger$5.log(`   Image: ${imageRef}`);
 	logger$5.log(`   Stage: ${stage}`);
-	if (masterKey) {
-		logger$5.log(`\n🔐 Deploy with this environment variable:`);
-		logger$5.log(`   GKM_MASTER_KEY=${masterKey}`);
-		logger$5.log("\n   Example docker run:");
-		logger$5.log(`   docker run -e GKM_MASTER_KEY=${masterKey} ${imageRef}`);
-	}
+	if (masterKey) logger$5.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
 	return {
 		imageRef,
 		masterKey
@@ -5886,9 +6141,53 @@ function applicationName(stage, project, app) {
 //#endregion
 //#region src/deploy/dokploy-api.ts
 var dokploy_api_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	DEFAULT_DOKPLOY_TIMEOUT_MS: () => DEFAULT_DOKPLOY_TIMEOUT_MS,
 	DokployApi: () => DokployApi,
-	DokployApiError: () => DokployApiError
+	DokployApiError: () => DokployApiError,
+	DokployRequestTimedOut: () => DokployRequestTimedOut
 });
+/** Per request, so a stalled server fails the deploy, not the CI job. */
+const DEFAULT_DOKPLOY_TIMEOUT_MS = 3e4;
+/**
+* Dokploy accepted the connection but did not answer in time.
+*
+* Not retried: a request that arrived and stalled may still be acted on, and
+* sending it again could repeat a deploy or a create the server is already
+* doing.
+*/
+var DokployRequestTimedOut = class extends Error {
+	baseUrl;
+	endpoint;
+	timeoutMs;
+	constructor(baseUrl, endpoint, timeoutMs) {
+		super(`Dokploy at ${baseUrl} did not answer ${endpoint} within ${timeoutMs}ms. Check that the Dokploy server is healthy, or raise \`timeoutMs\` if this call is known to be slow.`);
+		this.baseUrl = baseUrl;
+		this.endpoint = endpoint;
+		this.timeoutMs = timeoutMs;
+		this.name = "DokployRequestTimedOut";
+	}
+};
+/**
+* Waits `ms` between retries, or rejects with the signal's reason the moment
+* it aborts — a caller who gave up should not sit through the backoff.
+*/
+function pause(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
 var DokployApiError = class extends Error {
 	status;
 	statusText;
@@ -5907,9 +6206,13 @@ var DokployApiError = class extends Error {
 var DokployApi = class {
 	baseUrl;
 	token;
+	timeoutMs;
+	signal;
 	constructor(options) {
 		this.baseUrl = options.baseUrl.replace(/\/$/, "");
 		this.token = options.token;
+		this.timeoutMs = options.timeoutMs ?? 3e4;
+		this.signal = options.signal;
 	}
 	/**
 	* Make a GET request to the Dokploy API
@@ -5929,26 +6232,51 @@ var DokployApi = class {
 	async request(method, endpoint, body) {
 		const url = `${this.baseUrl}/api/${endpoint}`;
 		let response;
+		let timeout;
 		let lastError;
-		for (let attempt = 1; attempt <= 3; attempt++) try {
-			response = await fetch(url, {
-				method,
-				headers: {
-					"Content-Type": "application/json",
-					"x-api-key": this.token
-				},
-				body: body ? JSON.stringify(body) : void 0
-			});
-			break;
-		} catch (error) {
-			lastError = error;
-			if (attempt === 3) break;
-			await new Promise((resolve) => setTimeout(resolve, attempt * 750));
+		for (let attempt = 1; attempt <= 3; attempt++) {
+			this.signal?.throwIfAborted();
+			timeout = AbortSignal.timeout(this.timeoutMs);
+			try {
+				response = await fetch(url, {
+					method,
+					headers: {
+						"Content-Type": "application/json",
+						"x-api-key": this.token
+					},
+					body: body ? JSON.stringify(body) : void 0,
+					signal: this.signal ? AbortSignal.any([this.signal, timeout]) : timeout
+				});
+				break;
+			} catch (error) {
+				const stopped = this.stopped(timeout, endpoint);
+				if (stopped) throw stopped;
+				lastError = error;
+				if (attempt === 3) break;
+				await pause(attempt * 750, this.signal);
+			}
 		}
-		if (!response) {
+		if (!response || !timeout) {
 			const detail = lastError instanceof Error ? lastError.message : String(lastError);
 			throw new DokployApiError(`Could not reach Dokploy at ${this.baseUrl} (${endpoint}): ${detail}`, 0, "Network error");
 		}
+		try {
+			return await this.read(response);
+		} catch (error) {
+			throw this.stopped(timeout, endpoint) ?? error;
+		}
+	}
+	/**
+	* What a request cut short should reject with: the caller's own reason
+	* when they aborted, `DokployRequestTimedOut` when the deadline passed,
+	* nothing when it was neither.
+	*/
+	stopped(timeout, endpoint) {
+		if (this.signal?.aborted) return this.signal.reason;
+		if (timeout.aborted) return new DokployRequestTimedOut(this.baseUrl, endpoint, this.timeoutMs);
+	}
+	/** Turns a response into its JSON body, or a `DokployApiError`. */
+	async read(response) {
 		if (!response.ok) {
 			let errorMessage = `Dokploy API error: ${response.status} ${response.statusText}`;
 			let issues;
@@ -6737,7 +7065,11 @@ function isStateProvider(value) {
 *
 * - 'local': LocalStateProvider (default)
 * - 'ssm': CachedStateProvider with SSM as source of truth
+* - 's3': S3StateStore behind the provider interface
 * - Custom: Use provided StateProvider implementation
+*
+* Deploy moves to `createStateStore` (locks, versions, per-resource records);
+* this stays for the call sites that read and write whole states.
 */
 async function createStateProvider(options) {
 	const { config, workspaceRoot, workspaceName } = options;
@@ -6745,6 +7077,11 @@ async function createStateProvider(options) {
 		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-7HR6SS2t.cjs"));
 		return new LocalStateProvider(workspaceRoot);
 	}
+	const { isStateStore } = await Promise.resolve().then(() => StateStore_exports);
+	if (isStateStore(config.provider)) {
+		const { StateStoreProvider } = await Promise.resolve().then(() => StateStore_exports);
+		return new StateStoreProvider(config.provider);
+	}
 	if (isStateProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "local") {
@@ -6752,7 +7089,10 @@ async function createStateProvider(options) {
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
-		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
+		if (!workspaceName) {
+			const { StateStoreNeedsWorkspaceName } = await Promise.resolve().then(() => StateStore_exports);
+			throw new StateStoreNeedsWorkspaceName("ssm");
+		}
 		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-7HR6SS2t.cjs"));
 		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-VrQ-yeqd.cjs"));
 		const { CachedStateProvider } = await Promise.resolve().then(() => CachedStateProvider_exports);
@@ -6764,47 +7104,12 @@ async function createStateProvider(options) {
 			profile: ssmConfig.profile
 		}), local);
 	}
-	throw new Error(`Unknown state provider: ${JSON.stringify(config)}`);
-}
-//#endregion
-//#region src/secrets/encryption.ts
-var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
-	encryptSecrets: () => encryptSecrets,
-	generateDefineOptions: () => generateDefineOptions
-});
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const KEY_LENGTH = 32;
-const IV_LENGTH = 12;
-/**
-* Encrypt secrets for embedding in a bundle.
-* Uses AES-256-GCM with a randomly generated ephemeral key.
-*
-* @param secrets - Key-value pairs to encrypt
-* @returns Encrypted payload with ephemeral master key
-*/
-function encryptSecrets(secrets) {
-	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
-	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
-		iv: iv.toString("hex"),
-		masterKey: masterKey.toString("hex")
-	};
-}
-/**
-* Generate the define options for tsdown/esbuild.
-* These will be injected at build time.
-*/
-function generateDefineOptions(payload) {
-	return {
-		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
-		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
-	};
+	if (provider === "s3") {
+		const { createStateStore, StateStoreProvider } = await Promise.resolve().then(() => StateStore_exports);
+		return new StateStoreProvider(await createStateStore(options));
+	}
+	const { UnknownStateProvider } = await Promise.resolve().then(() => StateStore_exports);
+	throw new UnknownStateProvider(config);
 }
 //#endregion
 //#region src/deploy/secrets.ts
@@ -7762,12 +8067,11 @@ async function workspaceDeployCommand(configured, options) {
 				}
 				setApplicationId(state, appName, application.applicationId);
 				const appSecrets = encryptedSecrets.get(appName);
-				const buildArgs = [];
-				if (appSecrets && appSecrets.secretCount > 0) {
-					buildArgs.push(`GKM_ENCRYPTED_CREDENTIALS=${appSecrets.payload.encrypted}`);
-					buildArgs.push(`GKM_CREDENTIALS_IV=${appSecrets.payload.iv}`);
-					logger$4.log(`      Encrypted ${appSecrets.secretCount} secrets`);
-				}
+				const credentials = appSecrets && appSecrets.secretCount > 0 ? {
+					encrypted: appSecrets.payload.encrypted,
+					iv: appSecrets.payload.iv
+				} : void 0;
+				if (appSecrets && credentials) logger$4.log(`      Encrypted ${appSecrets.secretCount} secrets`);
 				const imageName = `${workspace.name}-${appName}`;
 				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
 				logger$4.log(`      Building Docker image: ${imageRef}`);
@@ -7780,7 +8084,7 @@ async function workspaceDeployCommand(configured, options) {
 						imageName,
 						appName
 					},
-					buildArgs
+					credentials
 				});
 				const backendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, false);
 				const dependencyUrls = {};
@@ -8162,6 +8466,11 @@ async function deployListCommand(options) {
 var CachedStateProvider_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ CachedStateProvider: () => CachedStateProvider });
 /**
 * Cached state provider that wraps a remote provider with local cache.
+*
+* @deprecated for deploys: a read prefers the local copy, so a stale one wins
+* over the remote without warning, and a write overwrites the remote blindly.
+* Deploy uses `createStateStore`, which reads SSM directly and writes
+* conditionally. Kept for `gkm state:pull | push | diff`.
 */
 var CachedStateProvider = class {
 	remote;
@@ -8212,12 +8521,421 @@ var CachedStateProvider = class {
 	}
 };
 //#endregion
+//#region src/deploy/StateStore.ts
+/**
+* Deploy state store.
+*
+* `StateProvider` reads and writes a whole stage at once, with nothing to stop
+* two runs of the same stage from overwriting each other and nowhere to record
+* a resource the moment it exists. A `StateStore` adds the three things a
+* deploy needs to be safe against crashes and concurrent runs:
+*
+* - `lock(stage)`: one run per stage. A second gets `StateLocked`, naming the
+*   holder, instead of racing the first.
+* - Versioned `read` and conditional `write`: a write names the version it was
+*   based on, and raises `StateVersionConflict` when the stored state moved on
+*   underneath it, so nothing is lost silently even without the lock.
+* - Per-resource records: `putResource` journals one resource at a time, so a
+*   run that dies half way leaves behind the ids of everything it created.
+*
+* Built-in stores: `LocalStateStore`, `SSMStateStore`, `S3StateStore`. A
+* custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
+* working but cannot lock.
+*/
+var StateStore_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	DocumentStateStore: () => DocumentStateStore,
+	STATE_SCHEMA_VERSION: () => 2,
+	StageStateMissing: () => StageStateMissing,
+	StateLocked: () => StateLocked,
+	StateSchemaTooNew: () => StateSchemaTooNew,
+	StateStoreBusy: () => StateStoreBusy,
+	StateStoreNeedsWorkspaceName: () => StateStoreNeedsWorkspaceName,
+	StateStoreProvider: () => StateStoreProvider,
+	StateStoreWithoutLocking: () => StateStoreWithoutLocking,
+	StateUnreadable: () => StateUnreadable,
+	StateVersionConflict: () => StateVersionConflict,
+	UnknownStateProvider: () => UnknownStateProvider,
+	contentVersion: () => contentVersion,
+	createStateStore: () => createStateStore,
+	decodeDocument: () => decodeDocument,
+	encodeDocument: () => encodeDocument,
+	isStateStore: () => isStateStore,
+	migrateV1: () => migrateV1,
+	newLockHolder: () => newLockHolder
+});
+var StateLocked = class extends Error {
+	stage;
+	holder;
+	location;
+	constructor(stage, holder, location) {
+		const by = holder ? `${holder.owner}@${holder.host} (pid ${holder.pid}) since ${holder.acquiredAt}${holder.operation ? ` for '${holder.operation}'` : ""}` : "a run that did not record who it was";
+		super(`Deploy state for stage '${stage}' is locked by ${by} (${location}). Wait for that run to finish; if it crashed, release the lock with \`gkm state:unlock --stage ${stage}\`.`);
+		this.stage = stage;
+		this.holder = holder;
+		this.location = location;
+		this.name = "StateLocked";
+	}
+};
+var StateVersionConflict = class extends Error {
+	stage;
+	expectedVersion;
+	actualVersion;
+	constructor(stage, expectedVersion, actualVersion) {
+		super(`Deploy state for stage '${stage}' changed since it was read (expected ${expectedVersion ? `version ${expectedVersion}` : "no state"}, found ${actualVersion ? `version ${actualVersion}` : "no state"}). Another run wrote it: read the state again and re-apply the change, and hold the stage's lock so runs take turns.`);
+		this.stage = stage;
+		this.expectedVersion = expectedVersion;
+		this.actualVersion = actualVersion;
+		this.name = "StateVersionConflict";
+	}
+};
+var StageStateMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
+		this.stage = stage;
+		this.name = "StageStateMissing";
+	}
+};
+var StateUnreadable = class extends Error {
+	stage;
+	location;
+	constructor(stage, location, cause) {
+		super(`Deploy state for stage '${stage}' at ${location} is not valid JSON. Restore it from a backup (or the provider's history) rather than deploying without it — a deploy without state recreates every resource.`, { cause });
+		this.stage = stage;
+		this.location = location;
+		this.name = "StateUnreadable";
+	}
+};
+var StateSchemaTooNew = class extends Error {
+	stage;
+	schemaVersion;
+	constructor(stage, schemaVersion) {
+		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (2). Upgrade @geekmidas/cli to the version that wrote it.`);
+		this.stage = stage;
+		this.schemaVersion = schemaVersion;
+		this.name = "StateSchemaTooNew";
+	}
+};
+/**
+* Not thrown: emitted (once per store) when a custom `StateProvider` stands
+* in for a store, so a deploy that cannot be protected from a concurrent one
+* says so.
+*/
+var StateStoreWithoutLocking = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
+		this.provider = provider;
+		this.name = "StateStoreWithoutLocking";
+	}
+};
+var StateStoreNeedsWorkspaceName = class extends Error {
+	provider;
+	constructor(provider) {
+		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
+		this.provider = provider;
+		this.name = "StateStoreNeedsWorkspaceName";
+	}
+};
+var UnknownStateProvider = class extends Error {
+	config;
+	constructor(config) {
+		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
+		this.config = config;
+		this.name = "UnknownStateProvider";
+	}
+};
+/** A lock or write that could not get at the state backend in time. */
+var StateStoreBusy = class extends Error {
+	stage;
+	location;
+	constructor(stage, location) {
+		super(`Timed out waiting to write deploy state for stage '${stage}' (${location}). If no other gkm process is running, remove ${location}.`);
+		this.stage = stage;
+		this.location = location;
+		this.name = "StateStoreBusy";
+	}
+};
+function decodeDocument(stage, body, location) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch (error) {
+		throw new StateUnreadable(stage, location, error);
+	}
+	if (typeof parsed !== "object" || parsed === null) throw new StateUnreadable(stage, location, parsed);
+	const schemaVersion = parsed.schemaVersion;
+	if (schemaVersion === void 0) return {
+		schemaVersion: 1,
+		state: parsed
+	};
+	if (schemaVersion === 2) return {
+		schemaVersion: 2,
+		document: parsed
+	};
+	throw new StateSchemaTooNew(stage, schemaVersion);
+}
+function encodeDocument(document) {
+	return JSON.stringify(document, null, 2);
+}
+/**
+* v1 state as a v2 document. The ids v1 kept are seeded as `ready` records,
+* so the first journaled deploy after an upgrade adopts them rather than
+* treating them as unknown.
+*/
+function migrateV1(stage, state) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const resources = {};
+	const seed = (type, name, id) => {
+		if (!id) return;
+		const key = name ? `${type}:${name}` : type;
+		resources[key] = {
+			key,
+			type,
+			id,
+			status: "ready",
+			updatedAt: now
+		};
+	};
+	seed("project", null, state.projectId);
+	seed("environment", null, state.environmentId);
+	for (const [app, id] of Object.entries(state.applications ?? {})) seed("application", app, id);
+	seed("postgres", null, state.services?.postgresId);
+	seed("redis", null, state.services?.redisId);
+	seed("backup-destination", null, state.backups?.destinationId);
+	return {
+		schemaVersion: 2,
+		stage,
+		serial: 1,
+		state,
+		resources,
+		updatedAt: now
+	};
+}
+function newLockHolder(options) {
+	let owner = "unknown";
+	try {
+		owner = (0, node_os.userInfo)().username;
+	} catch {}
+	return {
+		id: (0, node_crypto.randomUUID)(),
+		owner,
+		host: (0, node_os.hostname)(),
+		pid: process.pid,
+		acquiredAt: (/* @__PURE__ */ new Date()).toISOString(),
+		operation: options?.operation
+	};
+}
+function contentVersion(body) {
+	return (0, node_crypto.createHash)("sha256").update(body).digest("hex").slice(0, 16);
+}
+/**
+* A store over a backend that can read and conditionally write one blob per
+* stage, and create a lock object only if it does not exist. Migration and
+* resource records are the same for every such backend, so they live here.
+*/
+var DocumentStateStore = class {
+	async lock(stage, options) {
+		const holder = newLockHolder(options);
+		await this.createLock(stage, holder);
+		let released = false;
+		return {
+			stage,
+			holder,
+			release: async () => {
+				if (released) return;
+				released = true;
+				await this.removeLock(stage, holder);
+			}
+		};
+	}
+	async forceUnlock(stage) {
+		const holder = await this.readLock(stage);
+		await this.removeLock(stage, null);
+		return holder;
+	}
+	async read(stage) {
+		const current = await this.readDocument(stage);
+		if (!current) return null;
+		return {
+			state: current.document.state,
+			resources: current.document.resources,
+			version: current.version
+		};
+	}
+	async write(stage, state, options) {
+		if (options.expectedVersion === null) {
+			const document = {
+				schemaVersion: 2,
+				stage,
+				serial: 1,
+				state,
+				resources: {},
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			return this.writeRaw(stage, encodeDocument(document), null);
+		}
+		return this.mutate(stage, options.expectedVersion, (document) => ({
+			...document,
+			state
+		}));
+	}
+	async putResource(stage, record, options) {
+		return this.mutate(stage, options?.expectedVersion, (document) => ({
+			...document,
+			resources: {
+				...document.resources,
+				[record.key]: {
+					...record,
+					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+				}
+			}
+		}));
+	}
+	async deleteResource(stage, key, options) {
+		return this.mutate(stage, options?.expectedVersion, (document) => {
+			const { [key]: _removed, ...resources } = document.resources;
+			return {
+				...document,
+				resources
+			};
+		});
+	}
+	async mutate(stage, expectedVersion, change) {
+		const current = await this.readDocument(stage);
+		if (!current) {
+			if (expectedVersion !== void 0) throw new StateVersionConflict(stage, expectedVersion, null);
+			throw new StageStateMissing(stage);
+		}
+		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
+		const next = change(current.document);
+		next.serial = current.document.serial + 1;
+		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		return this.writeRaw(stage, encodeDocument(next), current.version);
+	}
+	/**
+	* Reads the stage's document, migrating v1 in place on the way. The
+	* migration is itself a conditional write: if another run migrated (or
+	* wrote) first, its result is read instead.
+	*/
+	async readDocument(stage, attempt = 0) {
+		const raw = await this.readRaw(stage);
+		if (!raw) return null;
+		const decoded = decodeDocument(stage, raw.body, this.location(stage));
+		if (decoded.schemaVersion === 2) return {
+			document: decoded.document,
+			version: raw.version
+		};
+		await this.writeV1Backup(stage, raw.body);
+		const document = migrateV1(stage, decoded.state);
+		try {
+			return {
+				document,
+				version: await this.writeRaw(stage, encodeDocument(document), raw.version)
+			};
+		} catch (error) {
+			if (error instanceof StateVersionConflict && attempt < 2) return this.readDocument(stage, attempt + 1);
+			throw error;
+		}
+	}
+};
+function isStateStore(value) {
+	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
+}
+/**
+* The store for a workspace's `state` config — the same config
+* `createStateProvider` reads:
+*
+* - none / `'local'`: `LocalStateStore` under `.gkm/`
+* - `'ssm'`: `SSMStateStore`, with no local cache — SSM is read directly, so
+*   a stale local copy can never win over it
+* - `'s3'`: `S3StateStore`
+* - a `StateStore` object: used as is
+* - a `StateProvider` object: wrapped by `LegacyStateStore`
+*/
+async function createStateStore(options) {
+	const { config, workspaceRoot, workspaceName } = options;
+	if (!config || config.provider === "local") {
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-DDDU0HkI.cjs"));
+		return new LocalStateStore(workspaceRoot);
+	}
+	if (isStateStore(config.provider)) return config.provider;
+	if (isStateProvider(config.provider)) {
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-C_OFs1gN.cjs"));
+		return new LegacyStateStore(config.provider, { warn: options.warn });
+	}
+	if (config.provider === "ssm") {
+		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-DD7jKrCO.cjs"));
+		const ssm = config;
+		return SSMStateStore.create({
+			workspaceName,
+			region: ssm.region,
+			profile: ssm.profile
+		});
+	}
+	if (config.provider === "s3") {
+		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-C7eBae0G.cjs"));
+		const s3 = config;
+		return S3StateStore.create({
+			workspaceName,
+			bucket: s3.bucket,
+			prefix: s3.prefix,
+			region: s3.region,
+			profile: s3.profile
+		});
+	}
+	throw new UnknownStateProvider(config);
+}
+/**
+* A store behind the `StateProvider` interface, for the call sites that still
+* read and write whole states (deploy, until it journals). A write is still
+* conditional on the version this provider last read.
+*/
+var StateStoreProvider = class {
+	store;
+	versions = /* @__PURE__ */ new Map();
+	constructor(store) {
+		this.store = store;
+	}
+	async read(stage) {
+		const stored = await this.store.read(stage);
+		this.versions.set(stage, stored?.version ?? null);
+		return stored?.state ?? null;
+	}
+	async write(stage, state) {
+		const expectedVersion = this.versions.has(stage) ? this.versions.get(stage) ?? null : (await this.store.read(stage))?.version ?? null;
+		state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		const version = await this.store.write(stage, state, { expectedVersion });
+		this.versions.set(stage, version);
+	}
+};
+//#endregion
 //#region src/deploy/state-commands.ts
 /**
 * State Management CLI Commands
 *
 * Commands for managing deployment state across local and remote providers.
 */
+/** What `state:show` prints in place of a secret. */
+const MASKED = "********";
+/**
+* A copy of `state` with every secret replaced by `MASKED`: database
+* passwords, generated secrets and the backup IAM keys. `state:show` is run
+* to look up ids, in terminals and CI logs; nothing it prints should be
+* usable as a credential.
+*/
+function maskStateSecrets(state) {
+	const masked = structuredClone(state);
+	for (const credentials of Object.values(masked.appCredentials ?? {})) credentials.dbPassword = MASKED;
+	for (const secrets of Object.values(masked.generatedSecrets ?? {})) for (const name of Object.keys(secrets)) secrets[name] = MASKED;
+	if (masked.backups) {
+		masked.backups.iamAccessKeyId = MASKED;
+		masked.backups.iamSecretAccessKey = MASKED;
+	}
+	return masked;
+}
 /**
 * Pull state from remote to local.
 * `gkm state:pull --stage=<stage>`
@@ -8280,19 +8998,41 @@ async function statePushCommand(options) {
 */
 async function stateShowCommand(options) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	const state = await (await createStateProvider({
+	const stored = await (await createStateProvider({
 		config: workspace.state,
 		workspaceRoot: workspace.root,
 		workspaceName: workspace.name
 	})).read(options.stage);
-	if (!state) {
+	if (!stored) {
 		console.log(`No state found for stage: ${options.stage}`);
 		return;
 	}
+	const state = maskStateSecrets(stored);
 	if (options.json) console.log(JSON.stringify(state, null, 2));
 	else printStateDetails(state);
 }
 /**
+* Release a stage's deploy lock, whoever holds it.
+* `gkm state:unlock --stage=<stage>`
+*
+* For a run that crashed with the lock held. Releasing a lock a live run
+* holds lets a second run race it, so the holder is printed for the caller
+* to check.
+*/
+async function stateUnlockCommand(options) {
+	const { workspace } = await require_config.loadWorkspaceConfig();
+	const holder = await (await createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	})).forceUnlock(options.stage);
+	if (!holder) {
+		console.log(`Stage ${options.stage} was not locked.`);
+		return;
+	}
+	console.log(`Released the lock on stage ${options.stage}, held by ${holder.owner}@${holder.host} (pid ${holder.pid}) since ${holder.acquiredAt}.`);
+}
+/**
 * Compare local and remote state.
 * `gkm state:diff --stage=<stage>`
 */
@@ -8376,6 +9116,26 @@ function printStateDetails(state) {
 		if (state.services.postgresId) console.log(`  Postgres: ${state.services.postgresId}`);
 		if (state.services.redisId) console.log(`  Redis: ${state.services.redisId}`);
 	}
+	const credentials = Object.entries(state.appCredentials ?? {});
+	if (credentials.length > 0) {
+		console.log("");
+		console.log("Database Credentials:");
+		for (const [app, { dbUser, dbPassword }] of credentials) console.log(`  ${app}: ${dbUser} / ${dbPassword}`);
+	}
+	const generated = Object.entries(state.generatedSecrets ?? {});
+	if (generated.length > 0) {
+		console.log("");
+		console.log("Generated Secrets:");
+		for (const [app, secrets] of generated) for (const [name, value] of Object.entries(secrets)) console.log(`  ${app}.${name}: ${value}`);
+	}
+	if (state.backups) {
+		console.log("");
+		console.log("Backups:");
+		console.log(`  Bucket: ${state.backups.bucketName}`);
+		console.log(`  IAM User: ${state.backups.iamUserName}`);
+		console.log(`  IAM Access Key: ${state.backups.iamAccessKeyId}`);
+		console.log(`  IAM Secret Key: ${state.backups.iamSecretAccessKey}`);
+	}
 	if (state.dnsVerified && Object.keys(state.dnsVerified).length > 0) {
 		console.log("");
 		console.log("DNS Verified:");
@@ -9380,26 +10140,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.53",
-	"@geekmidas/auth": "~10.0.0-alpha.53",
-	"@geekmidas/cache": "~10.0.0-alpha.53",
-	"@geekmidas/client": "~10.0.0-alpha.53",
-	"@geekmidas/cloud": "~10.0.0-alpha.53",
-	"@geekmidas/constructs": "~10.0.0-alpha.53",
-	"@geekmidas/db": "~10.0.0-alpha.53",
-	"@geekmidas/emailkit": "~10.0.0-alpha.53",
-	"@geekmidas/envkit": "~10.0.0-alpha.53",
-	"@geekmidas/errors": "~10.0.0-alpha.53",
-	"@geekmidas/events": "~10.0.0-alpha.53",
-	"@geekmidas/logger": "~10.0.0-alpha.53",
-	"@geekmidas/manifest": "~10.0.0-alpha.53",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.53",
-	"@geekmidas/schema": "~10.0.0-alpha.53",
-	"@geekmidas/services": "~10.0.0-alpha.53",
-	"@geekmidas/storage": "~10.0.0-alpha.53",
-	"@geekmidas/studio": "~10.0.0-alpha.53",
-	"@geekmidas/telescope": "~10.0.0-alpha.53",
-	"@geekmidas/testkit": "~10.0.0-alpha.53",
+	"@geekmidas/audit": "~10.0.0-alpha.55",
+	"@geekmidas/auth": "~10.0.0-alpha.55",
+	"@geekmidas/cache": "~10.0.0-alpha.55",
+	"@geekmidas/client": "~10.0.0-alpha.55",
+	"@geekmidas/cloud": "~10.0.0-alpha.55",
+	"@geekmidas/constructs": "~10.0.0-alpha.55",
+	"@geekmidas/db": "~10.0.0-alpha.55",
+	"@geekmidas/emailkit": "~10.0.0-alpha.55",
+	"@geekmidas/envkit": "~10.0.0-alpha.55",
+	"@geekmidas/errors": "~10.0.0-alpha.55",
+	"@geekmidas/events": "~10.0.0-alpha.55",
+	"@geekmidas/logger": "~10.0.0-alpha.55",
+	"@geekmidas/manifest": "~10.0.0-alpha.55",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.55",
+	"@geekmidas/schema": "~10.0.0-alpha.55",
+	"@geekmidas/services": "~10.0.0-alpha.55",
+	"@geekmidas/storage": "~10.0.0-alpha.55",
+	"@geekmidas/studio": "~10.0.0-alpha.55",
+	"@geekmidas/telescope": "~10.0.0-alpha.55",
+	"@geekmidas/testkit": "~10.0.0-alpha.55",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -16142,7 +16902,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-SDIRUyY5.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-DHMRgnP6.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-DXNviAh-.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -16573,7 +17333,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-SDIRUyY5.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-DHMRgnP6.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16587,7 +17347,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-SDIRUyY5.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-DHMRgnP6.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16601,7 +17361,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-SDIRUyY5.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-DHMRgnP6.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16699,7 +17459,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-tB4LqLKN.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-DSHYN5ap.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16710,7 +17470,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-tB4LqLKN.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-DSHYN5ap.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16762,7 +17522,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-P_V5t4Uk.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-CXvYabDJ.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16821,7 +17581,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BGx4U61b.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-CWflxaV4.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16924,6 +17684,16 @@ program.command("state:show").description("Show deployment state for a stage").r
 		process.exit(1);
 	}
 });
+program.command("state:unlock").description("Release a stage deploy lock left behind by a run that crashed").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await stateUnlockCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("state:diff").description("Compare local and remote deployment state").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -16946,12 +17716,19 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 });
 program.parse();
 //#endregion
+exports.DocumentStateStore = DocumentStateStore;
+exports.StageStateMissing = StageStateMissing;
+exports.StateLocked = StateLocked;
+exports.StateStoreBusy = StateStoreBusy;
+exports.StateStoreWithoutLocking = StateStoreWithoutLocking;
+exports.StateVersionConflict = StateVersionConflict;
 Object.defineProperty(exports, "appPorts_exports", {
 	enumerable: true,
 	get: function() {
 		return appPorts_exports;
 	}
 });
+exports.contentVersion = contentVersion;
 Object.defineProperty(exports, "encryption_exports", {
 	enumerable: true,
 	get: function() {
@@ -16960,6 +17737,7 @@ Object.defineProperty(exports, "encryption_exports", {
 });
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
 exports.getHostingerToken = getHostingerToken;
+exports.newLockHolder = newLockHolder;
 exports.slug = slug;
 exports.stamp = stamp;