@geekmidas/cli 10.0.0-alpha.56 → 10.0.0-alpha.58

package/dist/index.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as ConstructGenerator, t as discover } from "./discover-Cf2jAcgF.mjs";
-import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, p as derivedApps, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-20V08LZp.mjs";
-import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-C2mFV53i.mjs";
+import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, p as derivedApps, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-CSOK73pY.mjs";
+import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-BvNXAXQI.mjs";
 import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
 import { a as getKeyPath, i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
-import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as fakeKey, a as reconcileWorkspace, b as createEntryWrapper, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as describeServices, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as primaryPortKey, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-CgWcE_Yr.mjs";
-import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-NThANByQ.mjs";
+import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as fakeKey, a as reconcileWorkspace, b as createEntryWrapper, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as describeServices, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as primaryPortKey, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-D-f58jsP.mjs";
+import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-BRWD1Wit.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-BSpUZnNo.mjs";
-import { i as storageBackendFor, n as eventsBackendFor, r as providerOf, t as cacheBackendFor } from "./backends-BcHL7Gy_.mjs";
+import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-DbDHneLR.mjs";
+import { i as storageBackendFor, n as eventsBackendFor, r as providerOf, t as cacheBackendFor } from "./backends-CjuCiE8h.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
@@ -42,7 +42,7 @@ import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.56";
+var version = "10.0.0-alpha.58";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -136,15 +136,6 @@ async function getDokployToken(options) {
 	return null;
 }
 /**
-* Store Dokploy registry ID
-*/
-async function storeDokployRegistryId(registryId, options) {
-	const credentials = await readCredentials(options);
-	if (!credentials.dokploy) throw new Error("Dokploy credentials not found. Run \"gkm login --service dokploy\" first.");
-	credentials.dokploy.registryId = registryId;
-	await writeCredentials(credentials, options);
-}
-/**
 * Get Dokploy registry ID from stored credentials
 */
 async function getDokployRegistryId(options) {
@@ -1740,9 +1731,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$9.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-CS3DkO6y.mjs");
+		const { prepareDevDatabases } = await import("./migrate-CXVnh1J3.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-CS3DkO6y.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-CXVnh1J3.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2768,14 +2759,34 @@ var CommandTimedOut = class extends Error {
 * once `timeoutMs` passes (after the child is gone), and with the spawn error
 * itself when the program cannot be started at all — `ENOENT` already names it.
 */
-function run(command, args, options = {}) {
+async function run(command, args, options = {}) {
+	await spawnChild(command, args, options, false);
+}
+/**
+* {@link run}, resolving with what the program wrote to stdout — for a value
+* the CLI reads back, such as the digest `docker inspect` reports. stderr still
+* reaches the terminal, so a failure explains itself the same way.
+*/
+function runOutput(command, args, options = {}) {
+	return spawnChild(command, args, options, true);
+}
+function spawnChild(command, args, options, capture) {
 	const { timeoutMs = DEFAULT_TIMEOUT_MS, ...spawnOptions } = options;
 	return new Promise((resolve, reject) => {
 		const child = spawn(command, [...args], {
 			stdio: "inherit",
 			...spawnOptions,
+			...capture ? { stdio: [
+				"ignore",
+				"pipe",
+				"inherit"
+			] } : {},
 			shell: false
 		});
+		let stdout = "";
+		child.stdout?.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
 		let timedOut = false;
 		let killer;
 		const timer = setTimeout(() => {
@@ -2796,7 +2807,7 @@ function run(command, args, options = {}) {
 		child.on("close", (code, signal) => {
 			settle();
 			if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));
-			else if (code === 0) resolve();
+			else if (code === 0) resolve(stdout);
 			else reject(new CommandFailed(command, args, code, signal));
 		});
 	});
@@ -3103,7 +3114,8 @@ async function buildOneApp(input) {
 		hooks,
 		markOptional: options.markOptional ?? false,
 		skipBundle: options.skipBundle ?? false,
-		stage: options.stage
+		stage: options.stage,
+		workspaceName: workspace.name
 	});
 }
 /**
@@ -3181,7 +3193,12 @@ async function buildApp(input) {
 			appRoot,
 			cache: cacheBackendsIn(declared, cacheBackend)
 		}),
-		markOptional: input.markOptional ?? false
+		markOptional: input.markOptional ?? false,
+		...production && { telemetry: telemetryFor({
+			appRoot,
+			surfaceId: derived.surface?.id,
+			workspaceName: input.workspaceName
+		}) }
 	};
 	const endpointGenerator = new EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
@@ -3590,7 +3607,7 @@ const PROVISIONERS = {
 		const name = resourceName(declaration.id, declaration.kind, context.stage);
 		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
 			stage: context.stage,
-			app: context.project
+			app: context.scope ?? context.project
 		}, declaration.id), context.projectId, context.environmentId, {
 			databaseName: name,
 			databasePassword: derivedPassword(context, `${name}:master`)
@@ -3724,7 +3741,7 @@ const PROVISIONERS = {
 		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
 		const service = serviceName({
 			stage: context.stage,
-			app: context.project
+			app: context.scope ?? context.project
 		}, declaration.id);
 		const bucket = resourceName(declaration.id, declaration.kind, context.stage);
 		const user = `${bucket}-root`;
@@ -4185,6 +4202,7 @@ async function provisionDeclared(options) {
 		environmentId: options.environmentId,
 		stage: options.stage,
 		project: workspace.name,
+		scope: options.scope ?? workspace.name,
 		cache: cacheBackendFor(providerOf(workspace)),
 		events: eventsBackendFor(providerOf(workspace)),
 		storage: storageBackendFor(providerOf(workspace)),
@@ -4295,6 +4313,15 @@ function setApplicationId(state, appName, applicationId) {
 	state.applications[appName] = applicationId;
 }
 /**
+* Record the image an app was deployed with (mutates state)
+*/
+function setDeployedImage(state, appName, image) {
+	state.images = {
+		...state.images,
+		[appName]: image
+	};
+}
+/**
 * Get a generated secret for an app
 */
 function getGeneratedSecret(state, appName, secretName) {
@@ -6072,6 +6099,33 @@ async function pushImage(imageRef) {
 	}
 }
 /**
+* The digest the registry gave a pushed image, `sha256:…`.
+*
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
+*/
+async function pushedDigest(imageRef) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], { cwd: process.cwd() });
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
+/**
 * Deploy using Docker (build and optionally push image)
 */
 async function deployDocker(options) {
@@ -6079,9 +6133,13 @@ async function deployDocker(options) {
 	const imageName = config.imageName;
 	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
 	await buildImage(imageRef, buildArgs, credentials);
+	let digest;
 	if (!skipPush) {
 		if (!config.registry) logger$5.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else await pushImage(imageRef);
+		else {
+			await pushImage(imageRef);
+			digest = await pushedDigest(imageRef);
+		}
 	}
 	logger$5.log("\n✅ Docker deployment ready!");
 	logger$5.log(`\n📋 Deployment details:`);
@@ -6090,25 +6148,10 @@ async function deployDocker(options) {
 	if (masterKey) logger$5.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
 	return {
 		imageRef,
+		...digest ? { digest } : {},
 		masterKey
 	};
 }
-/**
-* What one application is called on a provider.
-*
-* The same rule the constructs use, through the same `scopedName`: the
-* application beside `production-kitchen-sink-database` is
-* `production-kitchen-sink-api`, not `api`. Both deploy paths call this — the
-* workspace one named its applications by the bare app key, so a project held
-* an `api` and a `web` that every stage would collide on.
-*
-* The app id is dropped when it repeats the project, so a project named for its
-* one application is `production-kitchen-sink` rather than
-* `production-kitchen-sink-kitchen-sink`.
-*/
-function applicationName(stage, project, app) {
-	return app === project ? `${stage}-${project}`.toLowerCase() : scopedName([stage, project], app);
-}
 //#endregion
 //#region src/deploy/dokploy-api.ts
 var dokploy_api_exports = /* @__PURE__ */ __exportAll({
@@ -6325,6 +6368,18 @@ var DokployApi = class {
 		});
 	}
 	/**
+	* Change a project's name or description.
+	*
+	* The name is sent with the description because `project.update` validates
+	* the whole project on some Dokploy versions, and a missing name fails it.
+	*/
+	async updateProject(projectId, updates) {
+		await this.post("project.update", {
+			projectId,
+			...updates
+		});
+	}
+	/**
 	* Delete a project and all its resources
 	*/
 	async deleteProject(projectId) {
@@ -7024,6 +7079,309 @@ function random() {
 	return randomBytes(32).toString("base64url");
 }
 //#endregion
+//#region src/deploy/identity.ts
+/**
+* Who a deploy is, on a target it shares with other workspaces.
+*
+* A Dokploy server is one flat namespace of projects, images and Docker
+* service names. Deploys used to identify everything they made by the
+* workspace name alone, so two workspaces called `shop` — or `Shop` and
+* `shop` — deploying to one server landed in the same project, pushed over
+* each other's images and redeployed each other's applications. A
+* `DeployIdentity` is what a deploy names and claims its resources by instead.
+*/
+/** A namespace that cannot be part of a Dokploy name or an image path. */
+var DeployNamespaceInvalid = class extends Error {
+	namespace;
+	constructor(namespace) {
+		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
+		this.namespace = namespace;
+		this.name = "DeployNamespaceInvalid";
+	}
+};
+/** A workspace name with nothing a target can name a resource by. */
+var DeployProjectNameInvalid = class extends Error {
+	workspaceName;
+	constructor(workspaceName) {
+		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
+		this.workspaceName = workspaceName;
+		this.name = "DeployProjectNameInvalid";
+	}
+};
+const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* Lowercase `[a-z0-9-]`, runs of anything else collapsed to one `-`: valid as
+* a Docker image path component, a Docker service name and a Dokploy name.
+*/
+function slug$1(value) {
+	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+/** The namespace a workspace is in when it does not name one. */
+function defaultNamespace(workspaceName) {
+	return slug$1(kebabCase(workspaceName));
+}
+function deployIdentity(workspace, stage) {
+	const project = slug$1(workspace.name);
+	if (!project) throw new DeployProjectNameInvalid(workspace.name);
+	const fallback = defaultNamespace(workspace.name);
+	const namespace = workspace.deploy?.namespace ?? fallback;
+	if (!NAME.test(namespace)) throw new DeployNamespaceInvalid(namespace);
+	return {
+		namespace,
+		project,
+		stage,
+		key: `${namespace}/${project}`,
+		scope: namespace === fallback ? project : `${namespace}-${project}`
+	};
+}
+/**
+* The token a Dokploy project's description carries to say which identity
+* created it. A project with the right name and no marker belongs to someone
+* else, and a deploy never adopts it.
+*/
+function ownershipMarker(identity) {
+	return `gkm:${identity.key}`;
+}
+/** Whether a project description carries `identity`'s marker. */
+function isOwnedBy(description, identity) {
+	const marker = ownershipMarker(identity);
+	return (description ?? "").split(/\s+/).includes(marker);
+}
+/** Any `gkm:` marker a description carries — whoever's it is. */
+function markerOf(description) {
+	return (description ?? "").split(/\s+/).find((t) => t.startsWith("gkm:"));
+}
+/** What the Dokploy project is called. */
+function projectName(identity) {
+	return identity.scope;
+}
+/**
+* The repository an app's image is pushed to, below the registry:
+* `<namespace>/<project>-<app>`.
+*
+* The namespace is a path segment of its own so that a registry that maps
+* paths to owners (an organisation's packages, a Harbor project) can grant it
+* as one; the app is joined to the project so the two read as one name.
+*/
+function imageName(identity, app) {
+	return `${identity.namespace}/${identity.project}-${slug$1(kebabCase(app))}`;
+}
+/** The full image ref an app is built, pushed and deployed as. */
+function imageRef(identity, app, registry, tag) {
+	const name = imageName(identity, app);
+	return registry ? `${registry.replace(/\/+$/, "")}/${name}:${tag}` : `${name}:${tag}`;
+}
+/**
+* What one application is called on the target.
+*
+* The same rule the constructs use, through the same `scopedName`, scoped by
+* the stage and the identity: the application beside
+* `production-kitchen-sink-database` is `production-kitchen-sink-api`. A
+* Dokploy application's name is also its Docker service name, which is unique
+* on the whole server, so the namespace has to be in it too — `acme`'s and
+* `globex`'s `shop` would otherwise both run `production-shop-api`.
+*
+* The app id is dropped when it repeats the project, so a project named for its
+* one application is `production-kitchen-sink` rather than
+* `production-kitchen-sink-kitchen-sink`.
+*/
+function applicationName(identity, app) {
+	return slug$1(app) === identity.project ? `${identity.stage}-${identity.scope}` : scopedName([identity.stage, identity.scope], app);
+}
+//#endregion
+//#region src/deploy/ownership.ts
+/**
+* Which Dokploy project a deploy is allowed to deploy into.
+*
+* Deploy used to take any project whose name matched the workspace's, in any
+* case — so a second workspace called `shop` (or `Shop`) on the same server
+* deployed into the first one's project, over its images and applications. A
+* project is now claimed by an ownership marker in its description, and a
+* project with the right name and no marker is somebody else's.
+*/
+/**
+* A Dokploy project with the name this deploy would use exists, and nothing
+* says this workspace created it.
+*/
+var ProjectNotOwned = class extends Error {
+	projectName;
+	projectId;
+	identity;
+	ownedBy;
+	constructor(projectName, projectId, identity, ownedBy) {
+		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
+		this.projectName = projectName;
+		this.projectId = projectId;
+		this.identity = identity;
+		this.ownedBy = ownedBy;
+		this.name = "ProjectNotOwned";
+	}
+};
+/** A description with the marker added, keeping what was there. */
+function withMarker(description, marker) {
+	const existing = (description ?? "").trim();
+	return existing ? `${existing}\n${marker}` : marker;
+}
+/** `project.one`, or `null` when Dokploy no longer has the project. */
+async function projectById(api, projectId) {
+	try {
+		return await api.getProject(projectId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The project this deploy deploys into:
+*
+* 1. The one the stage's state names, if Dokploy still has it. State written
+*    before markers existed is trusted — it holds an id this workspace was
+*    given when it created the project — and the marker is written now, so
+*    the project is claimed for the next deploy that has no state.
+* 2. One with this name *and* this identity's marker.
+* 3. A new one, marked.
+*
+* A project that matches by name (in any case) but carries no marker, or
+* another identity's, raises `ProjectNotOwned` — it is never adopted.
+*/
+async function resolveProject(api, identity, stateProjectId, log = () => {}) {
+	const name = projectName(identity);
+	const marker = ownershipMarker(identity);
+	if (stateProjectId) {
+		const known = await projectById(api, stateProjectId);
+		if (known) {
+			const claimed = markerOf(known.description);
+			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
+			if (!claimed) {
+				await api.updateProject(known.projectId, {
+					name: known.name,
+					description: withMarker(known.description, marker)
+				});
+				log(`   Claimed project ${known.name} for ${identity.key}`);
+			}
+			return {
+				projectId: known.projectId,
+				name: known.name,
+				environments: known.environments ?? [],
+				via: "state"
+			};
+		}
+	}
+	const projects = await api.listProjects();
+	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && isOwnedBy(p.description, identity));
+	if (owned) {
+		const details = await api.getProject(owned.projectId);
+		return {
+			projectId: owned.projectId,
+			name: owned.name,
+			environments: details.environments ?? [],
+			via: "marker"
+		};
+	}
+	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
+	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, markerOf(clash.description));
+	const created = await api.createProject(name, withMarker("Deployed by gkm.", marker));
+	return {
+		projectId: created.project.projectId,
+		name: created.project.name,
+		environments: [created.environment],
+		via: "created"
+	};
+}
+//#endregion
+//#region src/deploy/registry.ts
+/**
+* Which Dokploy registry a stage's images are pulled through.
+*
+* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
+* when that was empty, the first registry Dokploy listed — so an image could be
+* deployed with credentials for a registry nobody chose, and two workspaces
+* deployed from one machine shared whichever was stored last. The id is now
+* kept in the stage's state, and found only from what the workspace
+* configured.
+*/
+/** There is nowhere to push images to, so Dokploy has nothing to pull. */
+var RegistryNotConfigured = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.dokploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
+		this.stage = stage;
+		this.name = "RegistryNotConfigured";
+	}
+};
+/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
+var RegistryNotFound = class extends Error {
+	registryId;
+	constructor(registryId) {
+		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
+		this.registryId = registryId;
+		this.name = "RegistryNotFound";
+	}
+};
+/** More than one Dokploy registry serves the configured registry. */
+var RegistryAmbiguous = class extends Error {
+	registry;
+	registryIds;
+	constructor(registry, registryIds) {
+		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
+		this.registry = registry;
+		this.registryIds = registryIds;
+		this.name = "RegistryAmbiguous";
+	}
+};
+/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
+function parts(url) {
+	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
+	return {
+		host,
+		path: path.join("/")
+	};
+}
+/**
+* The Dokploy registries that serve `registry`: the same host, and — where
+* Dokploy's own entry names one — the same path.
+*/
+function serving(registries, registry) {
+	const wanted = parts(registry);
+	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
+	if (sameHost.length <= 1) return sameHost;
+	return sameHost.filter((r) => {
+		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
+	});
+}
+/** `registry.one`, or `null` when Dokploy says it has no such registry. */
+async function registryById(api, registryId) {
+	try {
+		return await api.getRegistry(registryId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The registry id for a stage, in order: the configured id, the one in the
+* stage's state, the one Dokploy has for the configured registry URL, and
+* otherwise a new one. Never a registry the workspace did not point at.
+*/
+async function resolveRegistry(api, options) {
+	const { stage, registry, configuredId, stateId, log = () => {} } = options;
+	if (!registry) throw new RegistryNotConfigured(stage);
+	if (configuredId) {
+		const configured = await registryById(api, configuredId);
+		if (!configured) throw new RegistryNotFound(configuredId);
+		return configured;
+	}
+	if (stateId) {
+		const known = await registryById(api, stateId);
+		if (known) return known;
+		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
+	}
+	const matches = serving(await api.listRegistries(), registry);
+	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
+	if (matches[0]) return matches[0];
+	return options.create(registry);
+}
+//#endregion
 //#region src/deploy/StateProvider.ts
 /**
 * Check if value is a StateProvider implementation.
@@ -7796,6 +8154,7 @@ async function workspaceDeployCommand(configured, options) {
 		apps: units
 	} : configured;
 	if (provider !== "dokploy") throw new Error(`Workspace deployment only supports Dokploy. Got: ${provider}`);
+	const identity = deployIdentity(workspace, stage);
 	logger$4.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
 	logger$4.log(`   Stage: ${stage}`);
 	const imageTag = tag ?? generateTag(stage);
@@ -7862,38 +8221,29 @@ async function workspaceDeployCommand(configured, options) {
 		baseUrl: creds.endpoint,
 		token: creds.token
 	});
-	logger$4.log("\n📁 Setting up Dokploy project...");
-	const projectName = workspace.name;
-	let project = (await api.listProjects()).find((p) => p.name.toLowerCase() === projectName.toLowerCase());
-	let environmentId;
-	if (project) {
-		logger$4.log(`   Found existing project: ${project.name}`);
-		const matchingEnv = ((await api.getProject(project.projectId)).environments ?? []).find((e) => e.name.toLowerCase() === stage.toLowerCase());
-		if (matchingEnv) {
-			environmentId = matchingEnv.environmentId;
-			logger$4.log(`   Using environment: ${matchingEnv.name}`);
-		} else {
-			logger$4.log(`   Creating "${stage}" environment...`);
-			environmentId = (await api.createEnvironment(project.projectId, stage)).environmentId;
-			logger$4.log(`   ✓ Created environment: ${stage}`);
-		}
-	} else {
-		logger$4.log(`   Creating project: ${projectName}`);
-		const result = await api.createProject(projectName);
-		project = result.project;
-		if (result.environment.name.toLowerCase() !== stage.toLowerCase()) {
-			logger$4.log(`   Creating "${stage}" environment...`);
-			environmentId = (await api.createEnvironment(project.projectId, stage)).environmentId;
-		} else environmentId = result.environment.environmentId;
-		logger$4.log(`   ✓ Created project: ${project.projectId}`);
-	}
 	logger$4.log("\n📋 Loading deploy state...");
 	const stateProvider = await createStateProvider({
 		config: workspace.state,
 		workspaceRoot: workspace.root,
 		workspaceName: workspace.name
 	});
-	let state = await stateProvider.read(stage);
+	const previous = await stateProvider.read(stage);
+	logger$4.log("\n📁 Setting up Dokploy project...");
+	logger$4.log(`   Identity: ${identity.key}`);
+	const project = await resolveProject(api, identity, previous?.projectId, (message) => logger$4.log(message));
+	if (project.via === "created") logger$4.log(`   ✓ Created project: ${project.projectId}`);
+	else logger$4.log(`   Found existing project: ${project.name}`);
+	let environmentId;
+	const matchingEnv = project.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
+	if (matchingEnv) {
+		environmentId = matchingEnv.environmentId;
+		logger$4.log(`   Using environment: ${matchingEnv.name}`);
+	} else {
+		logger$4.log(`   Creating "${stage}" environment...`);
+		environmentId = (await api.createEnvironment(project.projectId, stage)).environmentId;
+		logger$4.log(`   ✓ Created environment: ${stage}`);
+	}
+	let state = previous;
 	if (state) {
 		logger$4.log(`   Found existing state for stage "${stage}"`);
 		if (state.projectId !== project.projectId) {
@@ -7908,33 +8258,27 @@ async function workspaceDeployCommand(configured, options) {
 		logger$4.log(`   Creating new state for stage "${stage}"`);
 		state = createEmptyState(stage, project.projectId, environmentId);
 	}
+	state.identity = identity.key;
 	logger$4.log("\n🐳 Checking registry...");
-	let registryId = await getDokployRegistryId();
 	const registry = workspace.deploy.dokploy?.registry;
-	if (registryId) try {
-		const reg = await api.getRegistry(registryId);
-		logger$4.log(`   Using registry: ${reg.registryName}`);
-	} catch {
-		logger$4.log("   ⚠ Stored registry not found, clearing...");
-		registryId = void 0;
-		await storeDokployRegistryId("");
-	}
-	if (!registryId) {
-		const registries = await api.listRegistries();
-		if (registries.length > 0) {
-			registryId = registries[0].registryId;
-			await storeDokployRegistryId(registryId);
-			logger$4.log(`   Using registry: ${registries[0].registryName}`);
-		} else if (registry) {
-			logger$4.log("   No registries found in Dokploy. Let's create one.");
-			logger$4.log(`   Registry URL: ${registry}`);
+	const dokployRegistry = await resolveRegistry(api, {
+		stage,
+		registry,
+		configuredId: workspace.deploy.dokploy?.registryId,
+		stateId: state.registryId,
+		log: (message) => logger$4.log(message),
+		create: async (url) => {
+			logger$4.log(`   Dokploy has no registry for ${url}. Let's create one.`);
 			const username = await prompt("Registry username: ");
 			const password = await prompt("Registry password/token: ", true);
-			registryId = (await api.createRegistry("Default Registry", registry, username, password)).registryId;
-			await storeDokployRegistryId(registryId);
-			logger$4.log(`   ✓ Registry created: ${registryId}`);
-		} else logger$4.log("   ⚠ No registry configured. Set deploy.dokploy.registry in workspace config");
-	}
+			const created = await api.createRegistry("Default Registry", url, username, password);
+			logger$4.log(`   ✓ Registry created: ${created.registryId}`);
+			return created;
+		}
+	});
+	const registryId = dokployRegistry.registryId;
+	state.registryId = registryId;
+	logger$4.log(`   Using registry: ${dokployRegistry.registryName}`);
 	const skippedMobileApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "mobile");
 	if (skippedMobileApps.length > 0) logger$4.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
@@ -7955,6 +8299,7 @@ async function workspaceDeployCommand(configured, options) {
 			projectId: project.projectId,
 			environmentId,
 			stage,
+			scope: identity.scope,
 			appUrls,
 			supplied: stageSecrets.custom,
 			seed: stageSecrets.seed,
@@ -7980,7 +8325,7 @@ async function workspaceDeployCommand(configured, options) {
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
-			projectName: workspace.name,
+			projectName: identity.scope,
 			stage,
 			config: workspace.deploy.backups,
 			existingState: getBackupState(state),
@@ -8021,7 +8366,7 @@ async function workspaceDeployCommand(configured, options) {
 			const app = workspace.apps[appName];
 			logger$4.log(`\n   ⚙️  Deploying ${appName}...`);
 			try {
-				const dokployAppName = applicationName(stage, workspace.name, appName);
+				const dokployAppName = applicationName(identity, appName);
 				let application = null;
 				const cachedAppId = getApplicationId(state, appName);
 				if (cachedAppId) {
@@ -8043,20 +8388,23 @@ async function workspaceDeployCommand(configured, options) {
 					iv: appSecrets.payload.iv
 				} : void 0;
 				if (appSecrets && credentials) logger$4.log(`      Encrypted ${appSecrets.secretCount} secrets`);
-				const imageName = `${workspace.name}-${appName}`;
-				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
-				logger$4.log(`      Building Docker image: ${imageRef}`);
-				await deployDocker({
+				const imageRef$1 = imageRef(identity, appName, registry, imageTag);
+				logger$4.log(`      Building Docker image: ${imageRef$1}`);
+				const built = await deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
 					config: {
 						registry,
-						imageName,
+						imageName: imageName(identity, appName),
 						appName
 					},
 					credentials
 				});
+				setDeployedImage(state, appName, {
+					ref: built.imageRef ?? imageRef$1,
+					...built.digest ? { digest: built.digest } : {}
+				});
 				const backendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, false);
 				const dependencyUrls = {};
 				if (app.dependencies) {
@@ -8087,7 +8435,7 @@ async function workspaceDeployCommand(configured, options) {
 				};
 				const envVars = Object.entries(withDeclared).map(([key, value]) => `${key}=${value}`);
 				if (Object.keys(withDeclared).length > 0) logger$4.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
-				await api.saveDockerProvider(application.applicationId, imageRef, { registryId });
+				await api.saveDockerProvider(application.applicationId, imageRef$1, { registryId });
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
 				logger$4.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
@@ -8120,7 +8468,8 @@ async function workspaceDeployCommand(configured, options) {
 					type: app.type,
 					success: true,
 					applicationId: application.applicationId,
-					imageRef
+					imageRef: imageRef$1,
+					...built.digest ? { digest: built.digest } : {}
 				});
 				logger$4.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
@@ -8142,7 +8491,7 @@ async function workspaceDeployCommand(configured, options) {
 			const app = workspace.apps[appName];
 			logger$4.log(`\n   🌐 Deploying ${appName}...`);
 			try {
-				const dokployAppName = applicationName(stage, workspace.name, appName);
+				const dokployAppName = applicationName(identity, appName);
 				let application = null;
 				const cachedAppId = getApplicationId(state, appName);
 				if (cachedAppId) {
@@ -8187,28 +8536,31 @@ async function workspaceDeployCommand(configured, options) {
 					}
 				}
 				if (buildArgs.length > 0) logger$4.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
-				const imageName = `${workspace.name}-${appName}`;
-				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
-				logger$4.log(`      Building Docker image: ${imageRef}`);
-				await deployDocker({
+				const imageRef$2 = imageRef(identity, appName, registry, imageTag);
+				logger$4.log(`      Building Docker image: ${imageRef$2}`);
+				const built = await deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
 					config: {
 						registry,
-						imageName,
+						imageName: imageName(identity, appName),
 						appName
 					},
 					buildArgs,
 					publicUrlArgs: publicUrlArgNames
 				});
+				setDeployedImage(state, appName, {
+					ref: built.imageRef ?? imageRef$2,
+					...built.digest ? { digest: built.digest } : {}
+				});
 				const envVars = [
 					`NODE_ENV=production`,
 					`PORT=${app.port}`,
 					`STAGE=${stage}`
 				];
 				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
-				await api.saveDockerProvider(application.applicationId, imageRef, { registryId });
+				await api.saveDockerProvider(application.applicationId, imageRef$2, { registryId });
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
 				logger$4.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
@@ -8241,7 +8593,8 @@ async function workspaceDeployCommand(configured, options) {
 					type: app.type,
 					success: true,
 					applicationId: application.applicationId,
-					imageRef
+					imageRef: imageRef$2,
+					...built.digest ? { digest: built.digest } : {}
 				});
 				logger$4.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
@@ -8837,7 +9190,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await import("./SSMStateStore-oda9xOGc.mjs");
+		const { SSMStateStore } = await import("./SSMStateStore-BjZZm-nV.mjs");
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -10107,25 +10460,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.56",
-	"@geekmidas/auth": "~10.0.0-alpha.56",
-	"@geekmidas/cache": "~10.0.0-alpha.56",
-	"@geekmidas/client": "~10.0.0-alpha.56",
-	"@geekmidas/cloud": "~10.0.0-alpha.56",
-	"@geekmidas/constructs": "~10.0.0-alpha.56",
-	"@geekmidas/db": "~10.0.0-alpha.56",
-	"@geekmidas/emailkit": "~10.0.0-alpha.56",
-	"@geekmidas/envkit": "~10.0.0-alpha.56",
-	"@geekmidas/errors": "~10.0.0-alpha.56",
-	"@geekmidas/events": "~10.0.0-alpha.56",
-	"@geekmidas/logger": "~10.0.0-alpha.56",
-	"@geekmidas/manifest": "~10.0.0-alpha.56",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.56",
-	"@geekmidas/schema": "~10.0.0-alpha.56",
-	"@geekmidas/services": "~10.0.0-alpha.56",
-	"@geekmidas/storage": "~10.0.0-alpha.56",
-	"@geekmidas/telescope": "~10.0.0-alpha.56",
-	"@geekmidas/testkit": "~10.0.0-alpha.56",
+	"@geekmidas/audit": "~10.0.0-alpha.58",
+	"@geekmidas/auth": "~10.0.0-alpha.58",
+	"@geekmidas/cache": "~10.0.0-alpha.58",
+	"@geekmidas/client": "~10.0.0-alpha.58",
+	"@geekmidas/cloud": "~10.0.0-alpha.58",
+	"@geekmidas/constructs": "~10.0.0-alpha.58",
+	"@geekmidas/db": "~10.0.0-alpha.58",
+	"@geekmidas/emailkit": "~10.0.0-alpha.58",
+	"@geekmidas/envkit": "~10.0.0-alpha.58",
+	"@geekmidas/errors": "~10.0.0-alpha.58",
+	"@geekmidas/events": "~10.0.0-alpha.58",
+	"@geekmidas/logger": "~10.0.0-alpha.58",
+	"@geekmidas/manifest": "~10.0.0-alpha.58",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.58",
+	"@geekmidas/schema": "~10.0.0-alpha.58",
+	"@geekmidas/services": "~10.0.0-alpha.58",
+	"@geekmidas/storage": "~10.0.0-alpha.58",
+	"@geekmidas/telescope": "~10.0.0-alpha.58",
+	"@geekmidas/testkit": "~10.0.0-alpha.58",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -16007,7 +16360,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-CS3DkO6y.mjs");
+	const { migrateAndSeed } = await import("./migrate-CXVnh1J3.mjs");
 	const { discover } = await import("./discover-Cf2jAcgF.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -16438,7 +16791,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-CS3DkO6y.mjs");
+		const { migrateCommand } = await import("./migrate-CXVnh1J3.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16452,7 +16805,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-CS3DkO6y.mjs");
+		const { seedCommand } = await import("./migrate-CXVnh1J3.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16466,7 +16819,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-CS3DkO6y.mjs");
+		const { migrationCommand } = await import("./migrate-CXVnh1J3.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16564,7 +16917,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-KQTYFEzU.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-Dlnl5XEU.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16575,7 +16928,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-KQTYFEzU.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-Dlnl5XEU.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16627,7 +16980,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-CgWcE_Yr.mjs").then((n) => n.o);
+		const { derivedContainers } = await import("./workspace-D-f58jsP.mjs").then((n) => n.o);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16686,7 +17039,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-y7OEj59M.mjs");
+		const { deployGithubCommand } = await import("./github-BdF9tsvl.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));