@geekmidas/cli 10.0.0-alpha.57 → 10.0.0-alpha.59

package/dist/index.mjs

@@ -1,29 +1,31 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as ConstructGenerator, t as discover } from "./discover-Cf2jAcgF.mjs";
-import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, p as derivedApps, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-20V08LZp.mjs";
-import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-C2mFV53i.mjs";
+import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, p as derivedApps, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-EuzFEkcH.mjs";
+import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-Bp1xVaOz.mjs";
 import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
 import { a as getKeyPath, i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
-import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as fakeKey, a as reconcileWorkspace, b as createEntryWrapper, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as describeServices, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as primaryPortKey, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-CgWcE_Yr.mjs";
-import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-NThANByQ.mjs";
+import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as fakeKey, a as reconcileWorkspace, b as createEntryWrapper, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as describeServices, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as primaryPortKey, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-BRZ14o-o.mjs";
+import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-BRWD1Wit.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-BSpUZnNo.mjs";
-import { i as storageBackendFor, n as eventsBackendFor, r as providerOf, t as cacheBackendFor } from "./backends-BcHL7Gy_.mjs";
+import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-DbDHneLR.mjs";
+import { i as storageBackendFor, n as eventsBackendFor, r as providerOf, t as cacheBackendFor } from "./backends-CjuCiE8h.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
+import { c as createStateStore, i as StateStoreBusy, o as StateVersionConflict, r as StateLocked, s as contentVersion, t as DocumentStateStore } from "./StateStore-CYUfGYcx.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { stdin, stdout } from "node:process";
 import * as readline from "node:readline/promises";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { homedir, hostname, tmpdir, userInfo } from "node:os";
+import { copyFileSync, existsSync, linkSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmod, mkdir, mkdtemp, open, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
 import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, externalApiUrl, kebabCase, migrationFolder, mobileOrigins, provideKey, provisionOrder, schemeBase, scopedName, serviceKey } from "@geekmidas/manifest";
 import fg from "fast-glob";
 import { execFile, execFileSync, execSync, spawn } from "node:child_process";
 import chokidar from "chokidar";
-import { createCipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import { connect } from "node:net";
+import { createCipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
@@ -32,9 +34,11 @@ import { parse as parse$1, parseDocument } from "yaml";
 import { promisify } from "node:util";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import prompts from "prompts";
-import { createServer } from "http";
+import { createServer as createServer$1 } from "node:http";
+import { Readable } from "node:stream";
+import { createServer as createServer$2 } from "http";
 import { Http2ServerRequest } from "http2";
-import { Readable } from "stream";
+import { Readable as Readable$1 } from "stream";
 import crypto from "crypto";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Function } from "@geekmidas/constructs/functions";
@@ -42,7 +46,7 @@ import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.57";
+var version = "10.0.0-alpha.59";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -136,15 +140,6 @@ async function getDokployToken(options) {
 	return null;
 }
 /**
-* Store Dokploy registry ID
-*/
-async function storeDokployRegistryId(registryId, options) {
-	const credentials = await readCredentials(options);
-	if (!credentials.dokploy) throw new Error("Dokploy credentials not found. Run \"gkm login --service dokploy\" first.");
-	credentials.dokploy.registryId = registryId;
-	await writeCredentials(credentials, options);
-}
-/**
 * Get Dokploy registry ID from stored credentials
 */
 async function getDokployRegistryId(options) {
@@ -765,6 +760,621 @@ async function assignAppPorts(workspace, names, deps) {
 		running
 	};
 }
+/** Overrides `dev.discoveryPort` — `0` serves on a port of its own. */
+const DISCOVERY_PORT_ENV = "GKM_DISCOVERY_PORT";
+/**
+* Set by a workspace's `gkm dev` for the app sessions turbo starts under it:
+* the workspace has printed the connect URL, so they do not repeat it.
+*/
+const DISCOVERY_QUIET_ENV = "GKM_DISCOVERY_QUIET";
+/** The route everything is served under. */
+const BASE = "/__gkm";
+/** `GKM_DISCOVERY_PORT` is set to something that is not a port. */
+var InvalidDiscoveryPort = class extends Error {
+	value;
+	constructor(value) {
+		super(`${DISCOVERY_PORT_ENV}=${value} is not a port. Set it to a number from 0 to 65535 (0 serves discovery on a free port of its own), or unset it to use dev.discoveryPort.`);
+		this.value = value;
+		this.name = "InvalidDiscoveryPort";
+	}
+};
+/** The port the endpoint uses: the env, then `dev.discoveryPort`, then 4983. */
+function discoveryPort(config, env = process.env) {
+	const raw = env[DISCOVERY_PORT_ENV];
+	if (raw !== void 0 && raw !== "") {
+		const port = Number(raw);
+		if (!Number.isInteger(port) || port < 0 || port > 65535) throw new InvalidDiscoveryPort(raw);
+		return port;
+	}
+	return config?.discoveryPort ?? 4983;
+}
+/** The machine's registry, shared by every `gkm dev`. */
+function discoveryRegistry(env = process.env) {
+	return env["GKM_DEV_REGISTRY"] || join(homedir(), ".gkm", "dev");
+}
+function sessionsDir(registry) {
+	return join(registry, "sessions");
+}
+/** Whether a process is alive. `EPERM` is someone else's — alive. */
+function alive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
+/**
+* Every live session, pruning the ones whose process is gone — a `gkm dev`
+* killed outright never got to remove its own.
+*/
+function liveSessions(registry) {
+	const dir = sessionsDir(registry);
+	let files;
+	try {
+		files = readdirSync(dir).filter((file) => file.endsWith(".json"));
+	} catch {
+		return [];
+	}
+	const records = [];
+	for (const file of files) {
+		const path = join(dir, file);
+		let record;
+		try {
+			record = JSON.parse(readFileSync(path, "utf8"));
+		} catch {
+			continue;
+		}
+		if (alive(record.pid)) {
+			records.push(record);
+			continue;
+		}
+		try {
+			unlinkSync(path);
+		} catch {}
+	}
+	return records;
+}
+/** Written whole, then renamed into place, so a reader never sees half. */
+function writeRecord(registry, record) {
+	const path = join(sessionsDir(registry), `${record.id}.json`);
+	const partial = `${path}.${process.pid}.tmp`;
+	writeFileSync(partial, JSON.stringify(record), { mode: 384 });
+	renameSync(partial, path);
+}
+function removeRecord(registry, id) {
+	try {
+		unlinkSync(join(sessionsDir(registry), `${id}.json`));
+	} catch {}
+}
+/**
+* The token every session prints and every host checks.
+*
+* Shared through the registry, so a URL printed by one session still works
+* after another has taken over hosting. It lives as long as some session does:
+* a session that finds none but itself starts a new one, so a token printed
+* yesterday stops working once everything it was printed by has stopped.
+*/
+function sessionToken(registry, self) {
+	const path = join(registry, "token");
+	if (liveSessions(registry).filter((r) => r.id !== self).length === 0) {
+		const stale = `${path}.${self}.stale`;
+		try {
+			renameSync(path, stale);
+			unlinkSync(stale);
+		} catch {}
+	}
+	const fresh = `${path}.${self}.new`;
+	writeFileSync(fresh, randomBytes(32).toString("base64url"), { mode: 384 });
+	try {
+		linkSync(fresh, path);
+	} catch {}
+	unlinkSync(fresh);
+	return readFileSync(path, "utf8").trim();
+}
+/** `<name>-<8 hex>`: readable, and two checkouts of a project stay apart. */
+function workspaceId(name, root) {
+	return `${name.toLowerCase().replace(/^@/, "").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "workspace"}-${createHash("sha256").update(root).digest("hex").slice(0, 8)}`;
+}
+/** Whether anything accepts connections on a local port. */
+function listening(port) {
+	return new Promise((resolve) => {
+		const socket = connect({
+			port,
+			host: "localhost"
+		});
+		const done = (open) => {
+			socket.destroy();
+			resolve(open);
+		};
+		socket.setTimeout(300, () => done(false));
+		socket.once("connect", () => done(true));
+		socket.once("error", () => done(false));
+	});
+}
+/** Which data APIs the forwarder matches by prefix, rather than exactly. */
+const PREFIXED = /* @__PURE__ */ new Set(["telescope", "database"]);
+/** Whether `path` on an app is one of its data APIs. */
+function servesData(app, path) {
+	return app.dataApis.some((api) => PREFIXED.has(api.kind) ? path === api.path || path.startsWith(`${api.path}/`) : path === api.path);
+}
+/**
+* Every workspace the sessions describe, one entry per root.
+*
+* An app listed only by its workspace's session — a web app turbo started, an
+* API whose own `gkm dev` has not registered yet — is `ready` when its port
+* answers and `starting` until then.
+*/
+async function collect(records) {
+	const byRoot = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const group = byRoot.get(record.workspace.root) ?? [];
+		group.push(record);
+		byRoot.set(record.workspace.root, group);
+	}
+	const views = [];
+	for (const [root, group] of byRoot) {
+		group.sort((a, b) => Number(b.role === "workspace") - Number(a.role === "workspace") || a.startedAt.localeCompare(b.startedAt));
+		const lead = group[0];
+		const id = workspaceId(lead.workspace.name, root);
+		const apps = /* @__PURE__ */ new Map();
+		for (const record of group) for (const app of record.apps) {
+			const own = record.role === "app";
+			if (!own && apps.has(app.name)) continue;
+			apps.set(app.name, {
+				app,
+				pid: own ? record.pid : null
+			});
+		}
+		const discovered = await Promise.all([...apps.values()].map(async ({ app, pid }) => {
+			const url = `http://localhost:${app.port}`;
+			const status = pid === null ? await listening(app.port) ? "ready" : "starting" : app.status;
+			return {
+				name: app.name,
+				type: app.type,
+				port: app.port,
+				url,
+				publicUrl: app.publicUrl ?? null,
+				status,
+				reloads: app.reloads,
+				pid,
+				dataApis: app.dataApis.map((api) => ({
+					kind: api.kind,
+					path: api.path,
+					url: `${url}${api.path}`,
+					proxy: `${BASE}/workspaces/${id}/apps/${encodeURIComponent(app.name)}${api.path}`
+				}))
+			};
+		}));
+		discovered.sort((a, b) => a.name.localeCompare(b.name));
+		views.push({
+			id,
+			name: lead.workspace.name,
+			root,
+			stage: lead.workspace.stage,
+			manifest: group.find((r) => r.manifest)?.manifest ?? null,
+			apps: discovered,
+			allowedOrigins: [...new Set(group.flatMap((r) => r.allowedOrigins))]
+		});
+	}
+	return views.sort((a, b) => a.name.localeCompare(b.name) || a.root.localeCompare(b.root));
+}
+/** What changed between two views, as events. */
+function changes(before, after) {
+	const out = [];
+	const previous = new Map(before.map((w) => [w.id, w]));
+	const next = new Map(after.map((w) => [w.id, w]));
+	for (const workspace of after) {
+		const was = previous.get(workspace.id);
+		if (!was) out.push({
+			workspace,
+			event: {
+				type: "workspace.started",
+				workspace: workspace.id
+			}
+		});
+		const wasApps = new Map((was?.apps ?? []).map((a) => [a.name, a]));
+		for (const app of workspace.apps) {
+			const old = wasApps.get(app.name);
+			const type = !old ? "app.started" : app.reloads > old.reloads ? "app.reloaded" : app.status !== old.status || app.port !== old.port || app.dataApis.length !== old.dataApis.length ? "app.status" : void 0;
+			if (type) out.push({
+				workspace,
+				event: {
+					type,
+					workspace: workspace.id,
+					app
+				}
+			});
+		}
+		for (const old of was?.apps ?? []) if (!workspace.apps.some((a) => a.name === old.name)) out.push({
+			workspace,
+			event: {
+				type: "app.stopped",
+				workspace: workspace.id,
+				app: old
+			}
+		});
+	}
+	for (const workspace of before) {
+		if (next.has(workspace.id)) continue;
+		for (const app of workspace.apps) out.push({
+			workspace,
+			event: {
+				type: "app.stopped",
+				workspace: workspace.id,
+				app
+			}
+		});
+		out.push({
+			workspace,
+			event: {
+				type: "workspace.stopped",
+				workspace: workspace.id
+			}
+		});
+	}
+	return out;
+}
+/** A browser with no `Origin` — curl, a local process — sees everything. */
+function visibleTo(workspace, origin) {
+	return origin === void 0 || workspace.allowedOrigins.includes(origin);
+}
+function publicView({ allowedOrigins: _, ...workspace }) {
+	return workspace;
+}
+/** Headers an app's response is passed on with; nothing that sets state. */
+const FORWARDED_RESPONSE_HEADERS = [
+	"content-type",
+	"cache-control",
+	"etag",
+	"last-modified"
+];
+/**
+* The HTTP side: serves the registry it reads, checking every request.
+* @internal Exported for testing
+*/
+var DiscoveryHost = class {
+	registry;
+	token;
+	pollMs;
+	server;
+	view = [];
+	streams = /* @__PURE__ */ new Set();
+	scanning;
+	timers = [];
+	sequence = 0;
+	constructor(registry, token, pollMs) {
+		this.registry = registry;
+		this.token = token;
+		this.pollMs = pollMs;
+	}
+	/** The port it is bound to, once it is. */
+	get port() {
+		return (this.server?.address())?.port;
+	}
+	/** Binds the port; `false` when another process already has it. */
+	async listen(port) {
+		const server = createServer$1((request, response) => {
+			this.handle(request, response).catch(() => {
+				if (!response.headersSent) reply(response, 500, { error: "DiscoveryFailed" });
+				else response.destroy();
+			});
+		});
+		if (!await new Promise((resolve) => {
+			server.once("error", () => resolve(false));
+			server.listen(port, "127.0.0.1", () => resolve(true));
+		})) return false;
+		server.unref();
+		this.server = server;
+		this.view = await this.scan();
+		this.timers.push(setInterval(() => void this.scan(), this.pollMs).unref(), setInterval(() => {
+			for (const { response } of this.streams) response.write(": ping\n\n");
+		}, 15e3).unref());
+		return true;
+	}
+	async close() {
+		for (const timer of this.timers) clearInterval(timer);
+		this.timers = [];
+		for (const { response } of this.streams) response.end();
+		this.streams.clear();
+		const server = this.server;
+		this.server = void 0;
+		if (!server) return;
+		await new Promise((resolve) => {
+			server.close(() => resolve());
+			server.closeAllConnections();
+		});
+	}
+	/** Reads the registry, and tells every stream what changed. One at a time. */
+	scan() {
+		const run = (this.scanning ?? Promise.resolve()).then(async () => {
+			const next = await collect(liveSessions(this.registry));
+			for (const { workspace, event } of changes(this.view, next)) this.broadcast(workspace, event);
+			this.view = next;
+			return next;
+		});
+		this.scanning = run.catch(() => this.view);
+		return run;
+	}
+	broadcast(workspace, event) {
+		this.sequence += 1;
+		for (const stream of this.streams) {
+			if (!visibleTo(workspace, stream.origin)) continue;
+			send(stream.response, event, this.sequence);
+		}
+	}
+	snapshot(origin) {
+		return {
+			version: 1,
+			host: {
+				pid: process.pid,
+				port: this.port ?? 0
+			},
+			events: `${BASE}/events`,
+			workspaces: this.view.filter((w) => visibleTo(w, origin)).map(publicView)
+		};
+	}
+	async handle(request, response) {
+		const port = this.port;
+		const host = request.headers.host;
+		if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) {
+			reply(response, 403, {
+				error: "HostNotAllowed",
+				message: `Reach discovery at http://127.0.0.1:${port}.`
+			});
+			return;
+		}
+		const origin = request.headers.origin;
+		const allowed = this.view.flatMap((w) => w.allowedOrigins);
+		if (origin !== void 0 && !allowed.includes(origin)) {
+			reply(response, 403, {
+				error: "OriginNotAllowed",
+				message: `Add ${origin} to dev.allowedOrigins in gkm.config.ts to let it read gkm dev.`
+			});
+			return;
+		}
+		if (origin !== void 0) {
+			response.setHeader("access-control-allow-origin", origin);
+			response.setHeader("vary", "Origin");
+		}
+		if (request.method === "OPTIONS") {
+			response.setHeader("access-control-allow-methods", "GET, HEAD");
+			response.setHeader("access-control-allow-headers", "Authorization");
+			response.setHeader("access-control-max-age", "600");
+			if (request.headers["access-control-request-private-network"]) response.setHeader("access-control-allow-private-network", "true");
+			response.writeHead(204).end();
+			return;
+		}
+		const url = new URL(request.url ?? "/", `http://${host}`);
+		if (!this.authorized(request, url)) {
+			reply(response, 401, {
+				error: "TokenRequired",
+				message: "Use the connect URL gkm dev printed, or send its token as `Authorization: Bearer <token>`."
+			});
+			return;
+		}
+		if (request.method !== "GET" && request.method !== "HEAD") {
+			response.setHeader("allow", "GET, HEAD, OPTIONS");
+			reply(response, 405, {
+				error: "ReadOnly",
+				message: "Discovery is read-only: GET and HEAD."
+			});
+			return;
+		}
+		const path = url.pathname.replace(/\/+$/, "") || "/";
+		if (path === BASE) {
+			await this.scan();
+			reply(response, 200, this.snapshot(origin));
+			return;
+		}
+		if (path === `${BASE}/events`) {
+			await this.scan();
+			this.stream(response, origin);
+			response.once("close", () => {
+				for (const stream of this.streams) if (stream.response === response) this.streams.delete(stream);
+			});
+			return;
+		}
+		const forwarded = path.match(/^\/__gkm\/workspaces\/([^/]+)\/apps\/([^/]+)(\/.*)$/);
+		if (forwarded) {
+			const [, id, name, rest] = forwarded;
+			await this.forward(request, response, origin, id, decodeURIComponent(name), rest, url);
+			return;
+		}
+		reply(response, 404, { error: "NotFound" });
+	}
+	authorized(request, url) {
+		const header = request.headers.authorization;
+		const given = header?.startsWith("Bearer ") ? header.slice(7).trim() : url.searchParams.get("token");
+		if (!given) return false;
+		const a = Buffer.from(given);
+		const b = Buffer.from(this.token);
+		return a.length === b.length && timingSafeEqual(a, b);
+	}
+	stream(response, origin) {
+		response.writeHead(200, {
+			"content-type": "text/event-stream",
+			"cache-control": "no-cache",
+			connection: "keep-alive"
+		});
+		response.write("retry: 1000\n\n");
+		send(response, {
+			type: "snapshot",
+			snapshot: this.snapshot(origin)
+		});
+		this.streams.add({
+			origin,
+			response
+		});
+	}
+	/** Passes a read of one data API on to the app that serves it. */
+	async forward(request, response, origin, id, name, path, url) {
+		const app = this.view.find((w) => w.id === id && visibleTo(w, origin))?.apps.find((a) => a.name === name);
+		if (!app) {
+			reply(response, 404, { error: "AppNotFound" });
+			return;
+		}
+		if (!servesData(app, path)) {
+			reply(response, 404, {
+				error: "NotADataApi",
+				message: `Only ${name}'s data APIs are forwarded: ${app.dataApis.map((a) => a.path).join(", ") || "it has none"}.`
+			});
+			return;
+		}
+		const search = new URLSearchParams(url.searchParams);
+		search.delete("token");
+		const query = search.size > 0 ? `?${search}` : "";
+		const abort = new AbortController();
+		response.once("close", () => abort.abort());
+		let upstream;
+		try {
+			upstream = await fetch(`http://localhost:${app.port}${path}${query}`, {
+				method: request.method,
+				headers: { accept: request.headers.accept ?? "*/*" },
+				signal: abort.signal
+			});
+		} catch {
+			reply(response, 502, {
+				error: "AppUnavailable",
+				message: `${name} is not answering on port ${app.port}.`
+			});
+			return;
+		}
+		const headers = {};
+		for (const key of FORWARDED_RESPONSE_HEADERS) {
+			const value = upstream.headers.get(key);
+			if (value) headers[key] = value;
+		}
+		response.writeHead(upstream.status, headers);
+		if (!upstream.body || request.method === "HEAD") {
+			response.end();
+			return;
+		}
+		Readable.fromWeb(upstream.body).on("error", () => response.destroy()).pipe(response);
+	}
+};
+function reply(response, status, body) {
+	response.writeHead(status, { "content-type": "application/json" });
+	response.end(JSON.stringify(body));
+}
+function send(response, event, id) {
+	response.write(`${id === void 0 ? "" : `id: ${id}\n`}event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`);
+}
+/**
+* One `gkm dev`'s membership: its record in the registry, and — while it holds
+* the port — the endpoint itself.
+*/
+var DiscoverySession = class DiscoverySession {
+	registry;
+	port;
+	record;
+	token;
+	pollMs;
+	host;
+	election;
+	left = false;
+	cleanup = () => removeRecord(this.registry, this.record.id);
+	constructor(registry, port, record, token, pollMs) {
+		this.registry = registry;
+		this.port = port;
+		this.record = record;
+		this.token = token;
+		this.pollMs = pollMs;
+	}
+	static async join(options) {
+		const registry = options.registry ?? discoveryRegistry();
+		mkdirSync(sessionsDir(registry), {
+			recursive: true,
+			mode: 448
+		});
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const record = {
+			id: `${process.pid}-${randomBytes(4).toString("hex")}`,
+			pid: process.pid,
+			role: options.role,
+			startedAt: now,
+			updatedAt: now,
+			workspace: options.workspace,
+			allowedOrigins: [...options.allowedOrigins ?? []],
+			...options.manifest ? { manifest: options.manifest } : {},
+			apps: options.apps
+		};
+		writeRecord(registry, record);
+		const token = sessionToken(registry, record.id);
+		const session = new DiscoverySession(registry, options.port ?? 4983, record, token, options.pollMs ?? 500);
+		process.once("exit", session.cleanup);
+		await session.elect();
+		if (!session.host && session.port !== 0) session.election = setInterval(() => void session.elect(), options.electionMs ?? 1e3).unref();
+		return session;
+	}
+	/** Whether this session is the one serving the endpoint. */
+	get hosting() {
+		return this.host !== void 0;
+	}
+	/** The port clients reach — this host's own, when it chose one. */
+	get endpointPort() {
+		return this.host?.port ?? this.port;
+	}
+	/** Jupyter-style: the endpoint, with the token that opens it. */
+	get connectUrl() {
+		return `http://127.0.0.1:${this.endpointPort}${BASE}?token=${this.token}`;
+	}
+	/** Changes one of this session's apps, and tells the endpoint. */
+	updateApp(name, change) {
+		if (this.left) return;
+		this.record.apps = this.record.apps.map((app) => app.name === name ? change(app) : app);
+		this.record.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		writeRecord(this.registry, this.record);
+		this.host?.scan();
+	}
+	/** Leaves the registry, and the port to whichever session takes it next. */
+	async leave() {
+		if (this.left) return;
+		this.left = true;
+		if (this.election) clearInterval(this.election);
+		process.removeListener("exit", this.cleanup);
+		this.cleanup();
+		await this.host?.close();
+		this.host = void 0;
+		if (liveSessions(this.registry).length === 0) try {
+			unlinkSync(join(this.registry, "token"));
+		} catch {}
+	}
+	async elect() {
+		if (this.host || this.left) return;
+		const host = new DiscoveryHost(this.registry, this.token, this.pollMs);
+		if (!await host.listen(this.port)) return;
+		if (this.left) {
+			await host.close();
+			return;
+		}
+		this.host = host;
+		if (this.election) clearInterval(this.election);
+		this.election = void 0;
+	}
+};
+/** Joins the machine's discovery; see {@link DiscoverySession}. */
+function joinDiscovery(options) {
+	return DiscoverySession.join(options);
+}
+/** The data APIs a generated dev app mounts, from what `gkm dev` built. */
+function dataApisOf(options) {
+	if (options.selfServing) return [];
+	return [
+		...options.telescopePath ? [{
+			kind: "telescope",
+			path: `${options.telescopePath}/api`
+		}] : [],
+		...options.databaseApi ? [{
+			kind: "database",
+			path: options.databaseApi
+		}] : [],
+		...options.openApi ? [{
+			kind: "openapi",
+			path: "/__docs"
+		}] : []
+	];
+}
 //#endregion
 //#region ../../node_modules/.pnpm/@hono+node-server@1.19.5_hono@4.13.8/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
@@ -818,7 +1428,7 @@ var newRequestFromIncoming = (method, url, headers, incoming, abortController) =
 			let reader;
 			init.body = new ReadableStream({ async pull(controller) {
 				try {
-					reader ||= Readable.toWeb(incoming).getReader();
+					reader ||= Readable$1.toWeb(incoming).getReader();
 					const { done, value } = await reader.read();
 					if (done) controller.close();
 					else controller.enqueue(value);
@@ -826,7 +1436,7 @@ var newRequestFromIncoming = (method, url, headers, incoming, abortController) =
 					controller.error(error);
 				}
 			} });
-		} else init.body = Readable.toWeb(incoming);
+		} else init.body = Readable$1.toWeb(incoming);
 	}
 	return new Request(url, init);
 };
@@ -1197,7 +1807,7 @@ var createAdaptorServer = (options) => {
 		overrideGlobalObjects: options.overrideGlobalObjects,
 		autoCleanupIncoming: options.autoCleanupIncoming
 	});
-	return (options.createServer || createServer)(options.serverOptions || {}, requestListener);
+	return (options.createServer || createServer$2)(options.serverOptions || {}, requestListener);
 };
 var serve = (options, listeningListener) => {
 	const server = createAdaptorServer(options);
@@ -1430,6 +2040,7 @@ async function devCommand(options) {
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
 	let publicUrl;
+	let manifest;
 	const appSecrets = await loadSecretsForApp(workspace ? await secretsStoreFor(workspace, config.stages.local) : new FileSecretsStore(secretsRoot), config.stages.local, workspaceAppName);
 	if (workspace) {
 		const reconciled = await reconcileWorkspace(workspace, {
@@ -1444,6 +2055,7 @@ async function devCommand(options) {
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && appKey(r.id) === workspaceAppName);
 		publicUrl = own ? reconciled.env[own.envKey] : void 0;
+		manifest = reconciled.manifest;
 	}
 	if (Object.keys(appSecrets).length > 0) {
 		const secretsDir = join(secretsRoot, ".gkm");
@@ -1456,6 +2068,38 @@ async function devCommand(options) {
 	devServer.label = workspaceAppName ?? "server";
 	devServer.publicUrl = publicUrl;
 	await devServer.start();
+	const discovery = await joinDiscovery({
+		role: "app",
+		port: discoveryPort(workspace.dev),
+		workspace: {
+			name: workspace.name,
+			root: workspace.root,
+			stage: workspace.stages.local
+		},
+		allowedOrigins: workspace.dev?.allowedOrigins ?? [],
+		...manifest ? { manifest } : {},
+		apps: [{
+			name: workspaceAppName,
+			type: "backend",
+			port: devServer.port,
+			...publicUrl ? { publicUrl } : {},
+			status: "ready",
+			reloads: 0,
+			dataApis: dataApisOf({
+				selfServing: devServer.selfServing,
+				telescopePath: telescope?.path,
+				databaseApi: initial.databaseApi,
+				openApi: enableOpenApi
+			})
+		}]
+	});
+	if (!process.env["GKM_DISCOVERY_QUIET"]) announce(discovery);
+	devServer.onStatus = (status) => discovery.updateApp(workspaceAppName, (app) => ({
+		...app,
+		status,
+		port: devServer.port,
+		reloads: app.status === "reloading" && status === "ready" ? app.reloads + 1 : app.reloads
+	}));
 	const hooksFile = (config.hooks?.server?.split("#"))?.[0];
 	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => isAbsolute(p) ? relative(appRoot, p) : p.replace(/^\.\//, ""));
 	const resolvedFiles = await fg(normalizedPatterns, {
@@ -1496,7 +2140,11 @@ async function devCommand(options) {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
 		logger$9.log("\n🛑 Shutting down...");
-		Promise.all([watcher.close(), devServer.stop()]).catch((err) => {
+		Promise.all([
+			watcher.close(),
+			devServer.stop(),
+			discovery.leave()
+		]).catch((err) => {
 			logger$9.error("Error during shutdown:", err);
 		}).finally(() => {
 			process.exit(0);
@@ -1740,9 +2388,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$9.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-CS3DkO6y.mjs");
+		const { prepareDevDatabases } = await import("./migrate-BrFREmgQ.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-CS3DkO6y.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-BrFREmgQ.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -1797,12 +2445,39 @@ async function workspaceDevCommand(configured, options) {
 			break;
 		}
 	}
+	const discovery = await joinDiscovery({
+		role: "workspace",
+		port: discoveryPort(workspace.dev),
+		workspace: {
+			name: workspace.name,
+			root: workspace.root,
+			stage: workspace.stages.local
+		},
+		allowedOrigins: workspace.dev?.allowedOrigins ?? [],
+		...reconciled.manifest ? { manifest: reconciled.manifest } : {},
+		apps: buildOrder.flatMap((name) => {
+			const app = workspace.apps[name];
+			if (!app) return [];
+			const publicUrl = Object.entries(appUrls).find(([id]) => appKey(id) === name)?.[1];
+			return [{
+				name,
+				type: app.type,
+				port: app.port,
+				...publicUrl ? { publicUrl } : {},
+				status: "starting",
+				reloads: 0,
+				dataApis: []
+			}];
+		})
+	});
+	announce(discovery);
 	const turboEnv = {
 		...process.env,
 		...secretsEnv,
 		NODE_ENV: "development",
 		...configPath ? { GKM_CONFIG_PATH: configPath } : {},
-		...options.fake ? { [FAKE_ENV]: "1" } : {}
+		...options.fake ? { [FAKE_ENV]: "1" } : {},
+		[DISCOVERY_QUIET_ENV]: "1"
 	};
 	logger$9.log(`🚀 Starting ${appCount} app(s) — each builds before it answers, and says so when it is ready`);
 	const turboProcess = spawn("pnpm", [
@@ -1822,6 +2497,7 @@ async function workspaceDevCommand(configured, options) {
 		isShuttingDown = true;
 		logger$9.log("\n🛑 Shutting down workspace...");
 		closeFakes(fakes);
+		discovery.leave();
 		const pid = turboProcess.pid;
 		if (pid) try {
 			process.kill(-pid, "SIGTERM");
@@ -2062,6 +2738,13 @@ start({
 });
 `;
 }
+/**
+* The discovery endpoint's connect URL, Jupyter-style: the token in it is what
+* lets a console read what this machine is running.
+*/
+function announce(discovery) {
+	logger$9.log(`🧭 Discovery: ${discovery.connectUrl}`);
+}
 /** Run `fn` with `console.log` muted — warnings and errors still print. */
 async function quietly(fn) {
 	const log = console.log;
@@ -2159,6 +2842,12 @@ var DevServer = class {
 	}
 	/** What the ready line calls this app. */
 	label = "server";
+	/** Told when the server is ready, reloading, or exits on its own. */
+	onStatus;
+	/** The port it is serving on. */
+	get port() {
+		return this.actualPort;
+	}
 	/**
 	* Where the app is reached — its HTTPS address behind the edge, when it has
 	* one. The local port is only what the edge forwards to.
@@ -2194,9 +2883,11 @@ var DevServer = class {
 		this.serverProcess.on("error", (error) => {
 			logger$9.error("❌ Server error:", error);
 		});
-		this.serverProcess.on("exit", (code, signal) => {
+		const child = this.serverProcess;
+		child.on("exit", (code, signal) => {
 			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$9.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
+			if (this.serverProcess === child) this.onStatus?.("stopped");
 		});
 		await new Promise((resolve) => setTimeout(resolve, 1e3));
 		if (this.isRunning) {
@@ -2210,6 +2901,7 @@ var DevServer = class {
 				...this.databaseApi ? [`db ${this.databaseApi}`] : []
 			];
 			if (tools.length > 0) logger$9.log(`  ${tools.join(" · ")}`);
+			this.onStatus?.("ready");
 		}
 	}
 	async stop() {
@@ -2235,6 +2927,7 @@ var DevServer = class {
 	}
 	async restart() {
 		const portToReuse = this.actualPort;
+		this.onStatus?.("reloading");
 		await this.stop();
 		let attempts = 0;
 		while (attempts < 30) {
@@ -2768,14 +3461,34 @@ var CommandTimedOut = class extends Error {
 * once `timeoutMs` passes (after the child is gone), and with the spawn error
 * itself when the program cannot be started at all — `ENOENT` already names it.
 */
-function run(command, args, options = {}) {
+async function run(command, args, options = {}) {
+	await spawnChild(command, args, options, false);
+}
+/**
+* {@link run}, resolving with what the program wrote to stdout — for a value
+* the CLI reads back, such as the digest `docker inspect` reports. stderr still
+* reaches the terminal, so a failure explains itself the same way.
+*/
+function runOutput(command, args, options = {}) {
+	return spawnChild(command, args, options, true);
+}
+function spawnChild(command, args, options, capture) {
 	const { timeoutMs = DEFAULT_TIMEOUT_MS, ...spawnOptions } = options;
 	return new Promise((resolve, reject) => {
 		const child = spawn(command, [...args], {
 			stdio: "inherit",
 			...spawnOptions,
+			...capture ? { stdio: [
+				"ignore",
+				"pipe",
+				"inherit"
+			] } : {},
 			shell: false
 		});
+		let stdout = "";
+		child.stdout?.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
 		let timedOut = false;
 		let killer;
 		const timer = setTimeout(() => {
@@ -2796,7 +3509,7 @@ function run(command, args, options = {}) {
 		child.on("close", (code, signal) => {
 			settle();
 			if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));
-			else if (code === 0) resolve();
+			else if (code === 0) resolve(stdout);
 			else reject(new CommandFailed(command, args, code, signal));
 		});
 	});
@@ -3103,7 +3816,8 @@ async function buildOneApp(input) {
 		hooks,
 		markOptional: options.markOptional ?? false,
 		skipBundle: options.skipBundle ?? false,
-		stage: options.stage
+		stage: options.stage,
+		workspaceName: workspace.name
 	});
 }
 /**
@@ -3181,7 +3895,12 @@ async function buildApp(input) {
 			appRoot,
 			cache: cacheBackendsIn(declared, cacheBackend)
 		}),
-		markOptional: input.markOptional ?? false
+		markOptional: input.markOptional ?? false,
+		...production && { telemetry: telemetryFor({
+			appRoot,
+			surfaceId: derived.surface?.id,
+			workspaceName: input.workspaceName
+		}) }
 	};
 	const endpointGenerator = new EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
@@ -3282,7 +4001,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$8.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-URImKj-A.mjs");
+			const { bundleServer } = await import("./bundler-ouDdNvk9.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3590,7 +4309,7 @@ const PROVISIONERS = {
 		const name = resourceName(declaration.id, declaration.kind, context.stage);
 		const { postgres } = await context.api.findOrCreatePostgres(serviceName({
 			stage: context.stage,
-			app: context.project
+			app: context.scope ?? context.project
 		}, declaration.id), context.projectId, context.environmentId, {
 			databaseName: name,
 			databasePassword: derivedPassword(context, `${name}:master`)
@@ -3724,7 +4443,7 @@ const PROVISIONERS = {
 		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
 		const service = serviceName({
 			stage: context.stage,
-			app: context.project
+			app: context.scope ?? context.project
 		}, declaration.id);
 		const bucket = resourceName(declaration.id, declaration.kind, context.stage);
 		const user = `${bucket}-root`;
@@ -4185,6 +4904,7 @@ async function provisionDeclared(options) {
 		environmentId: options.environmentId,
 		stage: options.stage,
 		project: workspace.name,
+		scope: options.scope ?? workspace.name,
 		cache: cacheBackendFor(providerOf(workspace)),
 		events: eventsBackendFor(providerOf(workspace)),
 		storage: storageBackendFor(providerOf(workspace)),
@@ -4283,18 +5003,21 @@ function createEmptyState(stage, projectId, environmentId) {
 	};
 }
 /**
-* Get application ID from state
-*/
-function getApplicationId(state, appName) {
-	return state?.applications[appName];
-}
-/**
 * Set application ID in state (mutates state)
 */
 function setApplicationId(state, appName, applicationId) {
 	state.applications[appName] = applicationId;
 }
 /**
+* Record the image an app was deployed with (mutates state)
+*/
+function setDeployedImage(state, appName, image) {
+	state.images = {
+		...state.images,
+		[appName]: image
+	};
+}
+/**
 * Get a generated secret for an app
 */
 function getGeneratedSecret(state, appName, secretName) {
@@ -4381,7 +5104,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-cL-6oQ5r.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-YQY3rMpV.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -6072,6 +6795,33 @@ async function pushImage(imageRef) {
 	}
 }
 /**
+* The digest the registry gave a pushed image, `sha256:…`.
+*
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
+*/
+async function pushedDigest(imageRef) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], { cwd: process.cwd() });
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
+/**
 * Deploy using Docker (build and optionally push image)
 */
 async function deployDocker(options) {
@@ -6079,9 +6829,13 @@ async function deployDocker(options) {
 	const imageName = config.imageName;
 	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
 	await buildImage(imageRef, buildArgs, credentials);
+	let digest;
 	if (!skipPush) {
 		if (!config.registry) logger$5.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else await pushImage(imageRef);
+		else {
+			await pushImage(imageRef);
+			digest = await pushedDigest(imageRef);
+		}
 	}
 	logger$5.log("\n✅ Docker deployment ready!");
 	logger$5.log(`\n📋 Deployment details:`);
@@ -6090,25 +6844,10 @@ async function deployDocker(options) {
 	if (masterKey) logger$5.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
 	return {
 		imageRef,
+		...digest ? { digest } : {},
 		masterKey
 	};
 }
-/**
-* What one application is called on a provider.
-*
-* The same rule the constructs use, through the same `scopedName`: the
-* application beside `production-kitchen-sink-database` is
-* `production-kitchen-sink-api`, not `api`. Both deploy paths call this — the
-* workspace one named its applications by the bare app key, so a project held
-* an `api` and a `web` that every stage would collide on.
-*
-* The app id is dropped when it repeats the project, so a project named for its
-* one application is `production-kitchen-sink` rather than
-* `production-kitchen-sink-kitchen-sink`.
-*/
-function applicationName(stage, project, app) {
-	return app === project ? `${stage}-${project}`.toLowerCase() : scopedName([stage, project], app);
-}
 //#endregion
 //#region src/deploy/dokploy-api.ts
 var dokploy_api_exports = /* @__PURE__ */ __exportAll({
@@ -6325,6 +7064,18 @@ var DokployApi = class {
 		});
 	}
 	/**
+	* Change a project's name or description.
+	*
+	* The name is sent with the description because `project.update` validates
+	* the whole project on some Dokploy versions, and a missing name fails it.
+	*/
+	async updateProject(projectId, updates) {
+		await this.post("project.update", {
+			projectId,
+			...updates
+		});
+	}
+	/**
 	* Delete a project and all its resources
 	*/
 	async deleteProject(projectId) {
@@ -7024,71 +7775,423 @@ function random() {
 	return randomBytes(32).toString("base64url");
 }
 //#endregion
-//#region src/deploy/StateProvider.ts
+//#region src/deploy/identity.ts
+/**
+* Who a deploy is, on a target it shares with other workspaces.
+*
+* A Dokploy server is one flat namespace of projects, images and Docker
+* service names. Deploys used to identify everything they made by the
+* workspace name alone, so two workspaces called `shop` — or `Shop` and
+* `shop` — deploying to one server landed in the same project, pushed over
+* each other's images and redeployed each other's applications. A
+* `DeployIdentity` is what a deploy names and claims its resources by instead.
+*/
+/** A namespace that cannot be part of a Dokploy name or an image path. */
+var DeployNamespaceInvalid = class extends Error {
+	namespace;
+	constructor(namespace) {
+		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
+		this.namespace = namespace;
+		this.name = "DeployNamespaceInvalid";
+	}
+};
+/** A workspace name with nothing a target can name a resource by. */
+var DeployProjectNameInvalid = class extends Error {
+	workspaceName;
+	constructor(workspaceName) {
+		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
+		this.workspaceName = workspaceName;
+		this.name = "DeployProjectNameInvalid";
+	}
+};
+const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 /**
-* Check if value is a StateProvider implementation.
+* Lowercase `[a-z0-9-]`, runs of anything else collapsed to one `-`: valid as
+* a Docker image path component, a Docker service name and a Dokploy name.
 */
-function isStateProvider(value) {
-	return typeof value === "object" && value !== null && typeof value.read === "function" && typeof value.write === "function";
+function slug$1(value) {
+	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+/** The namespace a workspace is in when it does not name one. */
+function defaultNamespace(workspaceName) {
+	return slug$1(kebabCase(workspaceName));
+}
+function deployIdentity(workspace, stage) {
+	const project = slug$1(workspace.name);
+	if (!project) throw new DeployProjectNameInvalid(workspace.name);
+	const fallback = defaultNamespace(workspace.name);
+	const namespace = workspace.deploy?.namespace ?? fallback;
+	if (!NAME.test(namespace)) throw new DeployNamespaceInvalid(namespace);
+	return {
+		namespace,
+		project,
+		stage,
+		key: `${namespace}/${project}`,
+		scope: namespace === fallback ? project : `${namespace}-${project}`
+	};
 }
 /**
-* Create a state provider based on configuration.
-*
-* - 'local': LocalStateProvider (default)
-* - 'ssm': CachedStateProvider with SSM as source of truth
-* - 's3': S3StateStore behind the provider interface
-* - Custom: Use provided StateProvider implementation
-*
-* Deploy moves to `createStateStore` (locks, versions, per-resource records);
-* this stays for the call sites that read and write whole states.
+* The token a Dokploy project's description carries to say which identity
+* created it. A project with the right name and no marker belongs to someone
+* else, and a deploy never adopts it.
 */
-async function createStateProvider(options) {
-	const { config, workspaceRoot, workspaceName } = options;
-	if (!config) {
-		const { LocalStateProvider } = await import("./LocalStateProvider-D7QyJoLM.mjs");
-		return new LocalStateProvider(workspaceRoot);
-	}
-	const { isStateStore } = await Promise.resolve().then(() => StateStore_exports);
-	if (isStateStore(config.provider)) {
-		const { StateStoreProvider } = await Promise.resolve().then(() => StateStore_exports);
-		return new StateStoreProvider(config.provider);
-	}
-	if (isStateProvider(config.provider)) return config.provider;
-	const provider = config.provider;
-	if (provider === "local") {
-		const { LocalStateProvider } = await import("./LocalStateProvider-D7QyJoLM.mjs");
-		return new LocalStateProvider(workspaceRoot);
-	}
-	if (provider === "ssm") {
-		if (!workspaceName) {
-			const { StateStoreNeedsWorkspaceName } = await Promise.resolve().then(() => StateStore_exports);
-			throw new StateStoreNeedsWorkspaceName("ssm");
-		}
-		const { LocalStateProvider } = await import("./LocalStateProvider-D7QyJoLM.mjs");
-		const { SSMStateProvider } = await import("./SSMStateProvider-B0Hu1MKZ.mjs");
-		const { CachedStateProvider } = await Promise.resolve().then(() => CachedStateProvider_exports);
-		const ssmConfig = config;
-		const local = new LocalStateProvider(workspaceRoot);
-		return new CachedStateProvider(SSMStateProvider.create({
-			workspaceName,
-			region: ssmConfig.region,
-			profile: ssmConfig.profile
-		}), local);
-	}
-	if (provider === "s3") {
-		const { createStateStore, StateStoreProvider } = await Promise.resolve().then(() => StateStore_exports);
-		return new StateStoreProvider(await createStateStore(options));
-	}
-	const { UnknownStateProvider } = await Promise.resolve().then(() => StateStore_exports);
-	throw new UnknownStateProvider(config);
+function ownershipMarker(identity) {
+	return `gkm:${identity.key}`;
+}
+/** Whether a project description carries `identity`'s marker. */
+function isOwnedBy(description, identity) {
+	const marker = ownershipMarker(identity);
+	return (description ?? "").split(/\s+/).includes(marker);
+}
+/** Any `gkm:` marker a description carries — whoever's it is. */
+function markerOf(description) {
+	return (description ?? "").split(/\s+/).find((t) => t.startsWith("gkm:"));
+}
+/** What the Dokploy project is called. */
+function projectName(identity) {
+	return identity.scope;
 }
-//#endregion
-//#region src/deploy/secrets.ts
 /**
-* Filter secrets to only include the env vars that an app requires.
+* The repository an app's image is pushed to, below the registry:
+* `<namespace>/<project>-<app>`.
 *
-* @param stageSecrets - All secrets for the stage
-* @param sniffedEnv - The sniffed environment requirements for the app
+* The namespace is a path segment of its own so that a registry that maps
+* paths to owners (an organisation's packages, a Harbor project) can grant it
+* as one; the app is joined to the project so the two read as one name.
+*/
+function imageName(identity, app) {
+	return `${identity.namespace}/${identity.project}-${slug$1(kebabCase(app))}`;
+}
+/** The full image ref an app is built, pushed and deployed as. */
+function imageRef(identity, app, registry, tag) {
+	const name = imageName(identity, app);
+	return registry ? `${registry.replace(/\/+$/, "")}/${name}:${tag}` : `${name}:${tag}`;
+}
+/**
+* What one application is called on the target.
+*
+* The same rule the constructs use, through the same `scopedName`, scoped by
+* the stage and the identity: the application beside
+* `production-kitchen-sink-database` is `production-kitchen-sink-api`. A
+* Dokploy application's name is also its Docker service name, which is unique
+* on the whole server, so the namespace has to be in it too — `acme`'s and
+* `globex`'s `shop` would otherwise both run `production-shop-api`.
+*
+* The app id is dropped when it repeats the project, so a project named for its
+* one application is `production-kitchen-sink` rather than
+* `production-kitchen-sink-kitchen-sink`.
+*/
+function applicationName(identity, app) {
+	return slug$1(app) === identity.project ? `${identity.stage}-${identity.scope}` : scopedName([identity.stage, identity.scope], app);
+}
+//#endregion
+//#region src/deploy/journal.ts
+var DeployJournal = class DeployJournal {
+	store;
+	stage;
+	state;
+	resources;
+	version;
+	existed;
+	constructor(store, stage, state, resources, version, existed) {
+		this.store = store;
+		this.stage = stage;
+		this.state = state;
+		this.resources = resources;
+		this.version = version;
+		this.existed = existed;
+	}
+	/**
+	* The stage's journal — its stored state, or `initial` written as the
+	* stage's first state, so there is somewhere to record the very first
+	* resource before it is created.
+	*/
+	static async open(store, stage, initial) {
+		const stored = await store.read(stage);
+		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
+		const state = initial();
+		const version = await store.write(stage, state, { expectedVersion: null });
+		return new DeployJournal(store, stage, state, {}, version, false);
+	}
+	record(key) {
+		return this.resources[key];
+	}
+	/** The keys a previous run marked `pending` and never saw created. */
+	unfinished() {
+		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
+	}
+	/** Records that `entry` is about to be created. */
+	async pending(entry) {
+		await this.put({
+			...entry,
+			status: "pending"
+		});
+	}
+	/** Records `entry` as existing with `id`; a no-op if it already is. */
+	async ready(entry, id) {
+		const current = this.resources[entry.key];
+		if (current?.status === "ready" && current.id === id) return;
+		await this.put({
+			...entry,
+			status: "ready",
+			id
+		});
+	}
+	/**
+	* The resource `entry` names: by its recorded id, else by looking it up,
+	* else created — with `pending` written before the create and `ready`
+	* after, so a run that dies in between leaves a record the next run
+	* resolves by looking the resource up rather than creating another.
+	*/
+	async ensure(entry, steps) {
+		const record = this.resources[entry.key];
+		let staleId;
+		if (record?.status === "ready" && record.id && steps.get) {
+			const known = await steps.get(record.id);
+			if (known) {
+				await this.ready(entry, steps.id(known));
+				return {
+					resource: known,
+					via: "recorded"
+				};
+			}
+			staleId = record.id;
+		}
+		const existing = await steps.find();
+		if (existing) {
+			await this.ready(entry, steps.id(existing));
+			return {
+				resource: existing,
+				via: record?.status === "pending" ? "resumed" : "found",
+				...staleId ? { staleId } : {}
+			};
+		}
+		await this.pending(entry);
+		const created = await steps.create();
+		await this.ready(entry, steps.id(created));
+		return {
+			resource: created,
+			via: "created",
+			...staleId ? { staleId } : {}
+		};
+	}
+	/** Writes the stage's state, keeping its resource records. */
+	async save() {
+		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
+	}
+	async put(record) {
+		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
+		this.resources = {
+			...this.resources,
+			[record.key]: {
+				...record,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		};
+	}
+};
+//#endregion
+//#region src/deploy/ownership.ts
+/**
+* Which Dokploy project a deploy is allowed to deploy into.
+*
+* Deploy used to take any project whose name matched the workspace's, in any
+* case — so a second workspace called `shop` (or `Shop`) on the same server
+* deployed into the first one's project, over its images and applications. A
+* project is now claimed by an ownership marker in its description, and a
+* project with the right name and no marker is somebody else's.
+*/
+/**
+* A Dokploy project with the name this deploy would use exists, and nothing
+* says this workspace created it.
+*/
+var ProjectNotOwned = class extends Error {
+	projectName;
+	projectId;
+	identity;
+	ownedBy;
+	constructor(projectName, projectId, identity, ownedBy) {
+		super(`The Dokploy project '${projectName}' (${projectId}) was not created by this workspace (${identity})${ownedBy ? ` — it is marked '${ownedBy}'` : ""}, so deploy will not use it. Set deploy.namespace in gkm.config.ts to deploy under a name of your own, or, if this project really is this workspace's, add 'gkm:${identity}' to its description in Dokploy.`);
+		this.projectName = projectName;
+		this.projectId = projectId;
+		this.identity = identity;
+		this.ownedBy = ownedBy;
+		this.name = "ProjectNotOwned";
+	}
+};
+/** A description with the marker added, keeping what was there. */
+function withMarker(description, marker) {
+	const existing = (description ?? "").trim();
+	return existing ? `${existing}\n${marker}` : marker;
+}
+/** `project.one`, or `null` when Dokploy no longer has the project. */
+async function projectById(api, projectId) {
+	try {
+		return await api.getProject(projectId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The project this deploy deploys into:
+*
+* 1. The one the stage's state names, if Dokploy still has it. State written
+*    before markers existed is trusted — it holds an id this workspace was
+*    given when it created the project — and the marker is written now, so
+*    the project is claimed for the next deploy that has no state.
+* 2. One with this name *and* this identity's marker.
+* 3. A new one, marked.
+*
+* A project that matches by name (in any case) but carries no marker, or
+* another identity's, raises `ProjectNotOwned` — it is never adopted.
+*/
+async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
+	const name = projectName(identity);
+	const marker = ownershipMarker(identity);
+	if (stateProjectId) {
+		const known = await projectById(api, stateProjectId);
+		if (known) {
+			const claimed = markerOf(known.description);
+			if (claimed && claimed !== marker) throw new ProjectNotOwned(known.name, known.projectId, identity.key, claimed);
+			if (!claimed) {
+				await api.updateProject(known.projectId, {
+					name: known.name,
+					description: withMarker(known.description, marker)
+				});
+				log(`   Claimed project ${known.name} for ${identity.key}`);
+			}
+			return {
+				projectId: known.projectId,
+				name: known.name,
+				environments: known.environments ?? [],
+				via: "state"
+			};
+		}
+	}
+	const projects = await api.listProjects();
+	const owned = projects.find((p) => p.name.toLowerCase() === name.toLowerCase() && isOwnedBy(p.description, identity));
+	if (owned) {
+		const details = await api.getProject(owned.projectId);
+		return {
+			projectId: owned.projectId,
+			name: owned.name,
+			environments: details.environments ?? [],
+			via: "marker"
+		};
+	}
+	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
+	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, markerOf(clash.description));
+	await hooks.beforeCreate?.();
+	const created = await api.createProject(name, withMarker("Deployed by gkm.", marker));
+	return {
+		projectId: created.project.projectId,
+		name: created.project.name,
+		environments: [created.environment],
+		via: "created"
+	};
+}
+//#endregion
+//#region src/deploy/registry.ts
+/**
+* Which Dokploy registry a stage's images are pulled through.
+*
+* It used to be one id stored per machine (`~/.gkm/credentials.json`), and
+* when that was empty, the first registry Dokploy listed — so an image could be
+* deployed with credentials for a registry nobody chose, and two workspaces
+* deployed from one machine shared whichever was stored last. The id is now
+* kept in the stage's state, and found only from what the workspace
+* configured.
+*/
+/** There is nowhere to push images to, so Dokploy has nothing to pull. */
+var RegistryNotConfigured = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`Deploying '${stage}' needs a container registry: Dokploy pulls each app's image from one. Set deploy.dokploy.registry in gkm.config.ts (e.g. 'ghcr.io/acme'), and deploy.dokploy.registryId if Dokploy already holds that registry's credentials.`);
+		this.stage = stage;
+		this.name = "RegistryNotConfigured";
+	}
+};
+/** `deploy.dokploy.registryId` names a registry Dokploy does not have. */
+var RegistryNotFound = class extends Error {
+	registryId;
+	constructor(registryId) {
+		super(`deploy.dokploy.registryId '${registryId}' is not a registry on this Dokploy server. Find the right id under Settings → Docker Registry in Dokploy and set it in gkm.config.ts, or remove it to have deploy find the registry by its URL.`);
+		this.registryId = registryId;
+		this.name = "RegistryNotFound";
+	}
+};
+/** More than one Dokploy registry serves the configured registry. */
+var RegistryAmbiguous = class extends Error {
+	registry;
+	registryIds;
+	constructor(registry, registryIds) {
+		super(`Dokploy has ${registryIds.length} registries for '${registry}' (${registryIds.join(", ")}). Set deploy.dokploy.registryId in gkm.config.ts to the one this workspace pushes with.`);
+		this.registry = registry;
+		this.registryIds = registryIds;
+		this.name = "RegistryAmbiguous";
+	}
+};
+/** `https://ghcr.io/acme/` → `{ host: 'ghcr.io', path: 'acme' }`. */
+function parts(url) {
+	const [host = "", ...path] = url.replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").toLowerCase().split("/");
+	return {
+		host,
+		path: path.join("/")
+	};
+}
+/**
+* The Dokploy registries that serve `registry`: the same host, and — where
+* Dokploy's own entry names one — the same path.
+*/
+function serving(registries, registry) {
+	const wanted = parts(registry);
+	const sameHost = registries.filter((r) => parts(r.registryUrl ?? "").host === wanted.host);
+	if (sameHost.length <= 1) return sameHost;
+	return sameHost.filter((r) => {
+		return (parts(r.registryUrl ?? "").path || (r.imagePrefix ?? "").toLowerCase()) === wanted.path;
+	});
+}
+/** `registry.one`, or `null` when Dokploy says it has no such registry. */
+async function registryById(api, registryId) {
+	try {
+		return await api.getRegistry(registryId) ?? null;
+	} catch (error) {
+		if (error instanceof DokployApiError) return null;
+		throw error;
+	}
+}
+/**
+* The registry id for a stage, in order: the configured id, the one in the
+* stage's state, the one Dokploy has for the configured registry URL, and
+* otherwise a new one. Never a registry the workspace did not point at.
+*/
+async function resolveRegistry(api, options) {
+	const { stage, registry, configuredId, stateId, log = () => {} } = options;
+	if (!registry) throw new RegistryNotConfigured(stage);
+	if (configuredId) {
+		const configured = await registryById(api, configuredId);
+		if (!configured) throw new RegistryNotFound(configuredId);
+		return configured;
+	}
+	if (stateId) {
+		const known = await registryById(api, stateId);
+		if (known) return known;
+		log(`   ⚠ The stage's registry ${stateId} no longer exists in Dokploy`);
+	}
+	const matches = serving(await api.listRegistries(), registry);
+	if (matches.length > 1) throw new RegistryAmbiguous(registry, matches.map((r) => r.registryId));
+	if (matches[0]) return matches[0];
+	return options.create(registry);
+}
+//#endregion
+//#region src/deploy/secrets.ts
+/**
+* Filter secrets to only include the env vars that an app requires.
+*
+* @param stageSecrets - All secrets for the stage
+* @param sniffedEnv - The sniffed environment requirements for the app
 * @returns Filtered secrets with found/missing tracking
 */
 function filterSecretsForApp(stageSecrets, sniffedEnv) {
@@ -7796,6 +8899,7 @@ async function workspaceDeployCommand(configured, options) {
 		apps: units
 	} : configured;
 	if (provider !== "dokploy") throw new Error(`Workspace deployment only supports Dokploy. Got: ${provider}`);
+	const identity = deployIdentity(workspace, stage);
 	logger$4.log(`\n🚀 Deploying workspace "${workspace.name}" to Dokploy...`);
 	logger$4.log(`   Stage: ${stage}`);
 	const imageTag = tag ?? generateTag(stage);
@@ -7822,6 +8926,28 @@ async function workspaceDeployCommand(configured, options) {
 	});
 	if (dokployApps.length === 0) throw new Error("No apps to deploy. All selected apps have unsupported deploy targets.");
 	appsToDeployNames = dokployApps;
+	const store = await createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	});
+	const lock = await store.lock(stage, { operation: "deploy" });
+	try {
+		return await deployLocked({
+			workspace,
+			manifest,
+			stage,
+			imageTag,
+			appsToDeployNames,
+			identity,
+			store
+		});
+	} finally {
+		await lock.release();
+	}
+}
+/** Everything a deploy does while it holds the stage's lock. */
+async function deployLocked({ workspace, manifest, stage, imageTag, appsToDeployNames, identity, store }) {
 	logger$4.log("\n🔐 Loading secrets and analyzing environment requirements...");
 	const secretsStore = await secretsStoreFor(workspace, stage);
 	const stored = await secretsStore.read(stage);
@@ -7862,79 +8988,71 @@ async function workspaceDeployCommand(configured, options) {
 		baseUrl: creds.endpoint,
 		token: creds.token
 	});
+	logger$4.log("\n📋 Loading deploy state...");
+	const journal = await DeployJournal.open(store, stage, () => createEmptyState(stage, "", ""));
+	const state = journal.state;
+	if (journal.existed) logger$4.log(`   Found existing state for stage "${stage}"`);
+	else logger$4.log(`   Creating new state for stage "${stage}"`);
+	const unfinished = journal.unfinished();
+	if (unfinished.length > 0) logger$4.log(`   ⚠ A previous run stopped while creating: ${unfinished.join(", ")} — looking for them before creating anything`);
 	logger$4.log("\n📁 Setting up Dokploy project...");
-	const projectName = workspace.name;
-	let project = (await api.listProjects()).find((p) => p.name.toLowerCase() === projectName.toLowerCase());
-	let environmentId;
-	if (project) {
-		logger$4.log(`   Found existing project: ${project.name}`);
-		const matchingEnv = ((await api.getProject(project.projectId)).environments ?? []).find((e) => e.name.toLowerCase() === stage.toLowerCase());
-		if (matchingEnv) {
-			environmentId = matchingEnv.environmentId;
-			logger$4.log(`   Using environment: ${matchingEnv.name}`);
-		} else {
-			logger$4.log(`   Creating "${stage}" environment...`);
-			environmentId = (await api.createEnvironment(project.projectId, stage)).environmentId;
-			logger$4.log(`   ✓ Created environment: ${stage}`);
+	logger$4.log(`   Identity: ${identity.key}`);
+	const projectEntry = {
+		key: "project",
+		type: "project",
+		data: {
+			name: projectName(identity),
+			identity: identity.key
 		}
-	} else {
-		logger$4.log(`   Creating project: ${projectName}`);
-		const result = await api.createProject(projectName);
-		project = result.project;
-		if (result.environment.name.toLowerCase() !== stage.toLowerCase()) {
+	};
+	const project = await resolveProject(api, identity, state.projectId || void 0, (message) => logger$4.log(message), { beforeCreate: () => journal.pending(projectEntry) });
+	await journal.ready(projectEntry, project.projectId);
+	if (project.via === "created") logger$4.log(`   ✓ Created project: ${project.projectId}`);
+	else logger$4.log(`   Found existing project: ${project.name}`);
+	const environmentEntry = {
+		key: "environment",
+		type: "environment",
+		data: { name: stage }
+	};
+	const environment = await journal.ensure(environmentEntry, {
+		find: async () => project.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase()),
+		create: () => {
 			logger$4.log(`   Creating "${stage}" environment...`);
-			environmentId = (await api.createEnvironment(project.projectId, stage)).environmentId;
-		} else environmentId = result.environment.environmentId;
-		logger$4.log(`   ✓ Created project: ${project.projectId}`);
-	}
-	logger$4.log("\n📋 Loading deploy state...");
-	const stateProvider = await createStateProvider({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
+			return api.createEnvironment(project.projectId, stage);
+		},
+		id: (e) => e.environmentId
 	});
-	let state = await stateProvider.read(stage);
-	if (state) {
-		logger$4.log(`   Found existing state for stage "${stage}"`);
-		if (state.projectId !== project.projectId) {
-			logger$4.log(`   ⚠ Project ID changed, updating state`);
-			state.projectId = project.projectId;
-		}
-		if (state.environmentId !== environmentId) {
-			logger$4.log(`   ⚠ Environment ID changed, updating state`);
-			state.environmentId = environmentId;
-		}
-	} else {
-		logger$4.log(`   Creating new state for stage "${stage}"`);
-		state = createEmptyState(stage, project.projectId, environmentId);
-	}
+	const environmentId = environment.resource.environmentId;
+	if (environment.via === "created") logger$4.log(`   ✓ Created environment: ${stage}`);
+	else logger$4.log(`   Using environment: ${environment.resource.name}`);
+	if (journal.existed) {
+		if (state.projectId && state.projectId !== project.projectId) logger$4.log(`   ⚠ Project ID changed, updating state`);
+		if (state.environmentId && state.environmentId !== environmentId) logger$4.log(`   ⚠ Environment ID changed, updating state`);
+	}
+	state.projectId = project.projectId;
+	state.environmentId = environmentId;
+	state.identity = identity.key;
 	logger$4.log("\n🐳 Checking registry...");
-	let registryId = await getDokployRegistryId();
 	const registry = workspace.deploy.dokploy?.registry;
-	if (registryId) try {
-		const reg = await api.getRegistry(registryId);
-		logger$4.log(`   Using registry: ${reg.registryName}`);
-	} catch {
-		logger$4.log("   ⚠ Stored registry not found, clearing...");
-		registryId = void 0;
-		await storeDokployRegistryId("");
-	}
-	if (!registryId) {
-		const registries = await api.listRegistries();
-		if (registries.length > 0) {
-			registryId = registries[0].registryId;
-			await storeDokployRegistryId(registryId);
-			logger$4.log(`   Using registry: ${registries[0].registryName}`);
-		} else if (registry) {
-			logger$4.log("   No registries found in Dokploy. Let's create one.");
-			logger$4.log(`   Registry URL: ${registry}`);
+	const dokployRegistry = await resolveRegistry(api, {
+		stage,
+		registry,
+		configuredId: workspace.deploy.dokploy?.registryId,
+		stateId: state.registryId,
+		log: (message) => logger$4.log(message),
+		create: async (url) => {
+			logger$4.log(`   Dokploy has no registry for ${url}. Let's create one.`);
 			const username = await prompt("Registry username: ");
 			const password = await prompt("Registry password/token: ", true);
-			registryId = (await api.createRegistry("Default Registry", registry, username, password)).registryId;
-			await storeDokployRegistryId(registryId);
-			logger$4.log(`   ✓ Registry created: ${registryId}`);
-		} else logger$4.log("   ⚠ No registry configured. Set deploy.dokploy.registry in workspace config");
-	}
+			const created = await api.createRegistry("Default Registry", url, username, password);
+			logger$4.log(`   ✓ Registry created: ${created.registryId}`);
+			return created;
+		}
+	});
+	const registryId = dokployRegistry.registryId;
+	state.registryId = registryId;
+	logger$4.log(`   Using registry: ${dokployRegistry.registryName}`);
+	await journal.save();
 	const skippedMobileApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "mobile");
 	if (skippedMobileApps.length > 0) logger$4.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
@@ -7955,6 +9073,7 @@ async function workspaceDeployCommand(configured, options) {
 			projectId: project.projectId,
 			environmentId,
 			stage,
+			scope: identity.scope,
 			appUrls,
 			supplied: stageSecrets.custom,
 			seed: stageSecrets.seed,
@@ -7980,7 +9099,7 @@ async function workspaceDeployCommand(configured, options) {
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
-			projectName: workspace.name,
+			projectName: identity.scope,
 			stage,
 			config: workspace.deploy.backups,
 			existingState: getBackupState(state),
@@ -7991,7 +9110,7 @@ async function workspaceDeployCommand(configured, options) {
 			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
 			const backupRetention = workspace.deploy.backups.retention ?? 30;
 			logger$4.log("   Creating postgres backup schedule...");
-			const backup = await api.createPostgresBackup({
+			setPostgresBackupId(state, (await api.createPostgresBackup({
 				schedule: backupSchedule,
 				prefix: `${stage}/postgres`,
 				destinationId: backupState.destinationId,
@@ -7999,8 +9118,7 @@ async function workspaceDeployCommand(configured, options) {
 				postgresId: backupCluster.postgresId,
 				enabled: true,
 				keepLatestCount: backupRetention
-			});
-			setPostgresBackupId(state, backup.backupId);
+			})).backupId);
 			logger$4.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
 		} else logger$4.log("   ✓ Using existing postgres backup schedule");
 	}
@@ -8021,42 +9139,31 @@ async function workspaceDeployCommand(configured, options) {
 			const app = workspace.apps[appName];
 			logger$4.log(`\n   ⚙️  Deploying ${appName}...`);
 			try {
-				const dokployAppName = applicationName(stage, workspace.name, appName);
-				let application = null;
-				const cachedAppId = getApplicationId(state, appName);
-				if (cachedAppId) {
-					logger$4.log(`      Using cached ID: ${cachedAppId}`);
-					application = await api.getApplication(cachedAppId);
-					if (application) logger$4.log(`      ✓ Application found: ${application.applicationId}`);
-					else logger$4.log(`      ⚠ Cached ID invalid, will create new`);
-				}
-				if (!application) {
-					const result = await api.findOrCreateApplication(dokployAppName, project.projectId, environmentId);
-					application = result.application;
-					if (result.created) logger$4.log(`      Created application: ${application.applicationId}`);
-					else logger$4.log(`      Found existing application: ${application.applicationId}`);
-				}
-				setApplicationId(state, appName, application.applicationId);
+				const application = await ensureApplication(api, journal, appName, applicationName(identity, appName), project.projectId, environmentId);
 				const appSecrets = encryptedSecrets.get(appName);
 				const credentials = appSecrets && appSecrets.secretCount > 0 ? {
 					encrypted: appSecrets.payload.encrypted,
 					iv: appSecrets.payload.iv
 				} : void 0;
 				if (appSecrets && credentials) logger$4.log(`      Encrypted ${appSecrets.secretCount} secrets`);
-				const imageName = `${workspace.name}-${appName}`;
-				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
-				logger$4.log(`      Building Docker image: ${imageRef}`);
-				await deployDocker({
+				const imageRef$1 = imageRef(identity, appName, registry, imageTag);
+				logger$4.log(`      Building Docker image: ${imageRef$1}`);
+				const built = await deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
 					config: {
 						registry,
-						imageName,
+						imageName: imageName(identity, appName),
 						appName
 					},
 					credentials
 				});
+				setDeployedImage(state, appName, {
+					ref: built.imageRef ?? imageRef$1,
+					...built.digest ? { digest: built.digest } : {}
+				});
+				await journal.save();
 				const backendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, false);
 				const dependencyUrls = {};
 				if (app.dependencies) {
@@ -8087,40 +9194,21 @@ async function workspaceDeployCommand(configured, options) {
 				};
 				const envVars = Object.entries(withDeclared).map(([key, value]) => `${key}=${value}`);
 				if (Object.keys(withDeclared).length > 0) logger$4.log(`      Resolved ${Object.keys(withDeclared).length} env vars: ${Object.keys(withDeclared).sort().join(", ")}`);
-				await api.saveDockerProvider(application.applicationId, imageRef, { registryId });
+				await api.saveDockerProvider(application.applicationId, imageRef$1, { registryId });
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
 				logger$4.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
-				const existingDomain = (await api.getDomainsByApplicationId(application.applicationId)).find((d) => d.host === backendHost);
-				if (existingDomain) {
-					appHostnames.set(appName, backendHost);
-					appDomainIds.set(appName, existingDomain.domainId);
-					publicUrls[appName] = `https://${backendHost}`;
-					logger$4.log(`      ✓ Domain: https://${backendHost} (existing)`);
-				} else try {
-					const domain = await api.createDomain({
-						host: backendHost,
-						port: app.port,
-						https: true,
-						certificateType: "letsencrypt",
-						applicationId: application.applicationId
-					});
-					appHostnames.set(appName, backendHost);
-					appDomainIds.set(appName, domain.domainId);
-					publicUrls[appName] = `https://${backendHost}`;
-					logger$4.log(`      ✓ Domain: https://${backendHost} (created)`);
-				} catch (domainError) {
-					const message = domainError instanceof Error ? domainError.message : "Unknown error";
-					logger$4.log(`      ⚠ Domain creation failed: ${message}`);
-					appHostnames.set(appName, backendHost);
-					publicUrls[appName] = `https://${backendHost}`;
-				}
+				const domainId = await ensureDomain(api, journal, backendHost, app.port, application.applicationId);
+				appHostnames.set(appName, backendHost);
+				if (domainId) appDomainIds.set(appName, domainId);
+				publicUrls[appName] = `https://${backendHost}`;
 				results.push({
 					appName,
 					type: app.type,
 					success: true,
 					applicationId: application.applicationId,
-					imageRef
+					imageRef: imageRef$1,
+					...built.digest ? { digest: built.digest } : {}
 				});
 				logger$4.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
@@ -8142,22 +9230,7 @@ async function workspaceDeployCommand(configured, options) {
 			const app = workspace.apps[appName];
 			logger$4.log(`\n   🌐 Deploying ${appName}...`);
 			try {
-				const dokployAppName = applicationName(stage, workspace.name, appName);
-				let application = null;
-				const cachedAppId = getApplicationId(state, appName);
-				if (cachedAppId) {
-					logger$4.log(`      Using cached ID: ${cachedAppId}`);
-					application = await api.getApplication(cachedAppId);
-					if (application) logger$4.log(`      ✓ Application found: ${application.applicationId}`);
-					else logger$4.log(`      ⚠ Cached ID invalid, will create new`);
-				}
-				if (!application) {
-					const result = await api.findOrCreateApplication(dokployAppName, project.projectId, environmentId);
-					application = result.application;
-					if (result.created) logger$4.log(`      Created application: ${application.applicationId}`);
-					else logger$4.log(`      Found existing application: ${application.applicationId}`);
-				}
-				setApplicationId(state, appName, application.applicationId);
+				const application = await ensureApplication(api, journal, appName, applicationName(identity, appName), project.projectId, environmentId);
 				const dependencyUrls = {};
 				if (app.dependencies) {
 					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
@@ -8187,61 +9260,46 @@ async function workspaceDeployCommand(configured, options) {
 					}
 				}
 				if (buildArgs.length > 0) logger$4.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
-				const imageName = `${workspace.name}-${appName}`;
-				const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
-				logger$4.log(`      Building Docker image: ${imageRef}`);
-				await deployDocker({
+				const imageRef$2 = imageRef(identity, appName, registry, imageTag);
+				logger$4.log(`      Building Docker image: ${imageRef$2}`);
+				const built = await deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
 					config: {
 						registry,
-						imageName,
+						imageName: imageName(identity, appName),
 						appName
 					},
 					buildArgs,
 					publicUrlArgs: publicUrlArgNames
 				});
+				setDeployedImage(state, appName, {
+					ref: built.imageRef ?? imageRef$2,
+					...built.digest ? { digest: built.digest } : {}
+				});
+				await journal.save();
 				const envVars = [
 					`NODE_ENV=production`,
 					`PORT=${app.port}`,
 					`STAGE=${stage}`
 				];
 				for (const [key, value] of Object.entries(resolved)) envVars.push(`${key}=${value}`);
-				await api.saveDockerProvider(application.applicationId, imageRef, { registryId });
+				await api.saveDockerProvider(application.applicationId, imageRef$2, { registryId });
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
 				logger$4.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
-				const existingFrontendDomain = (await api.getDomainsByApplicationId(application.applicationId)).find((d) => d.host === frontendHost);
-				if (existingFrontendDomain) {
-					appHostnames.set(appName, frontendHost);
-					appDomainIds.set(appName, existingFrontendDomain.domainId);
-					publicUrls[appName] = `https://${frontendHost}`;
-					logger$4.log(`      ✓ Domain: https://${frontendHost} (existing)`);
-				} else try {
-					const domain = await api.createDomain({
-						host: frontendHost,
-						port: app.port,
-						https: true,
-						certificateType: "letsencrypt",
-						applicationId: application.applicationId
-					});
-					appHostnames.set(appName, frontendHost);
-					appDomainIds.set(appName, domain.domainId);
-					publicUrls[appName] = `https://${frontendHost}`;
-					logger$4.log(`      ✓ Domain: https://${frontendHost} (created)`);
-				} catch (domainError) {
-					const message = domainError instanceof Error ? domainError.message : "Unknown error";
-					logger$4.log(`      ⚠ Domain creation failed: ${message}`);
-					appHostnames.set(appName, frontendHost);
-					publicUrls[appName] = `https://${frontendHost}`;
-				}
+				const domainId = await ensureDomain(api, journal, frontendHost, app.port, application.applicationId);
+				appHostnames.set(appName, frontendHost);
+				if (domainId) appDomainIds.set(appName, domainId);
+				publicUrls[appName] = `https://${frontendHost}`;
 				results.push({
 					appName,
 					type: app.type,
 					success: true,
 					applicationId: application.applicationId,
-					imageRef
+					imageRef: imageRef$2,
+					...built.digest ? { digest: built.digest } : {}
 				});
 				logger$4.log(`      ✓ ${appName} deployed successfully`);
 			} catch (error) {
@@ -8257,14 +9315,14 @@ async function workspaceDeployCommand(configured, options) {
 		}
 	}
 	logger$4.log("\n📋 Saving deploy state...");
-	await stateProvider.write(stage, state);
+	await journal.save();
 	logger$4.log("   ✓ State saved");
 	const dnsConfig = workspace.deploy.dns;
 	if (dnsConfig && appHostnames.size > 0) {
 		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, creds.endpoint);
 		if (dnsResult?.serverIp && appHostnames.size > 0) {
 			await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
-			await stateProvider.write(stage, state);
+			await journal.save();
 		}
 		if (dnsResult?.success && appHostnames.size > 0) {
 			logger$4.log("\n🔒 Validating domains for SSL certificates...");
@@ -8297,6 +9355,71 @@ async function workspaceDeployCommand(configured, options) {
 	};
 }
 /**
+* An app's Dokploy application, through the journal: by the id recorded for
+* it, else by its name in the stage's environment, else created. Its id goes
+* into `state.applications` too, which the env resolver and `state:show` read.
+*/
+async function ensureApplication(api, journal, appName, dokployAppName, projectId, environmentId) {
+	const recorded = journal.record(`application:${appName}`);
+	if (recorded?.status === "ready" && recorded.id) logger$4.log(`      Using cached ID: ${recorded.id}`);
+	const { resource, via, staleId } = await journal.ensure({
+		key: `application:${appName}`,
+		type: "application",
+		data: { name: dokployAppName }
+	}, {
+		get: (id) => api.getApplication(id),
+		find: () => api.findApplicationByName(projectId, dokployAppName, environmentId),
+		create: () => api.createApplication(dokployAppName, projectId, environmentId),
+		id: (application) => application.applicationId
+	});
+	if (staleId) logger$4.log(`      ⚠ Cached ID invalid, will create new`);
+	logger$4.log(`      ${{
+		recorded: "✓ Application found",
+		resumed: "Resumed application a stopped run created",
+		found: "Found existing application",
+		created: "Created application"
+	}[via]}: ${resource.applicationId}`);
+	setApplicationId(journal.state, appName, resource.applicationId);
+	return resource;
+}
+/**
+* The domain `host` routes to an application, through the journal — found on
+* the application before it is created, so a re-run never adds a second.
+*
+* A domain that cannot be created is reported and skipped rather than
+* failing the app: the application is deployed and reachable on Dokploy's
+* own address, and DNS is fixed by hand more easily than a half deploy.
+*/
+async function ensureDomain(api, journal, host, port, applicationId) {
+	try {
+		const { resource, via } = await journal.ensure({
+			key: `domain:${host}`,
+			type: "domain",
+			data: {
+				host,
+				applicationId
+			}
+		}, {
+			find: async () => (await api.getDomainsByApplicationId(applicationId)).find((d) => d.host === host),
+			create: () => api.createDomain({
+				host,
+				port,
+				https: true,
+				certificateType: "letsencrypt",
+				applicationId
+			}),
+			id: (domain) => domain.domainId
+		});
+		logger$4.log(`      ✓ Domain: https://${host} (${via === "created" ? "created" : "existing"})`);
+		return resource.domainId;
+	} catch (domainError) {
+		if (domainError instanceof StateVersionConflict || domainError instanceof StateStoreBusy) throw domainError;
+		const message = domainError instanceof Error ? domainError.message : "Unknown error";
+		logger$4.log(`      ⚠ Domain creation failed: ${message}`);
+		return;
+	}
+}
+/**
 * Main deploy command
 */
 async function deployCommand(options) {
@@ -8433,453 +9556,160 @@ async function deployListCommand(options) {
 	}
 }
 //#endregion
-//#region src/deploy/CachedStateProvider.ts
-var CachedStateProvider_exports = /* @__PURE__ */ __exportAll({ CachedStateProvider: () => CachedStateProvider });
-/**
-* Cached state provider that wraps a remote provider with local cache.
-*
-* @deprecated for deploys: a read prefers the local copy, so a stale one wins
-* over the remote without warning, and a write overwrites the remote blindly.
-* Deploy uses `createStateStore`, which reads SSM directly and writes
-* conditionally. Kept for `gkm state:pull | push | diff`.
-*/
-var CachedStateProvider = class {
-	remote;
-	local;
-	constructor(remote, local) {
-		this.remote = remote;
-		this.local = local;
-	}
-	async read(stage) {
-		const localState = await this.local.read(stage);
-		if (localState) return localState;
-		const remoteState = await this.remote.read(stage);
-		if (remoteState) await this.local.write(stage, remoteState);
-		return remoteState;
-	}
-	async write(stage, state) {
-		await this.remote.write(stage, state);
-		await this.local.write(stage, state);
-	}
-	/**
-	* Force pull from remote to local.
-	* Used by `gkm state pull` command.
-	*/
-	async pull(stage) {
-		const remoteState = await this.remote.read(stage);
-		if (remoteState) await this.local.write(stage, remoteState);
-		return remoteState;
-	}
-	/**
-	* Force push from local to remote.
-	* Used by `gkm state push` command.
-	*/
-	async push(stage) {
-		const localState = await this.local.read(stage);
-		if (localState) await this.remote.write(stage, localState);
-		return localState;
-	}
-	/**
-	* Get both local and remote state for comparison.
-	* Used by `gkm state diff` command.
-	*/
-	async diff(stage) {
-		const [local, remote] = await Promise.all([this.local.read(stage), this.remote.read(stage)]);
-		return {
-			local,
-			remote
-		};
-	}
-};
-//#endregion
-//#region src/deploy/StateStore.ts
+//#region src/deploy/LocalStateStore.ts
 /**
-* Deploy state store.
-*
-* `StateProvider` reads and writes a whole stage at once, with nothing to stop
-* two runs of the same stage from overwriting each other and nowhere to record
-* a resource the moment it exists. A `StateStore` adds the three things a
-* deploy needs to be safe against crashes and concurrent runs:
-*
-* - `lock(stage)`: one run per stage. A second gets `StateLocked`, naming the
-*   holder, instead of racing the first.
-* - Versioned `read` and conditional `write`: a write names the version it was
-*   based on, and raises `StateVersionConflict` when the stored state moved on
-*   underneath it, so nothing is lost silently even without the lock.
-* - Per-resource records: `putResource` journals one resource at a time, so a
-*   run that dies half way leaves behind the ids of everything it created.
+* Local filesystem state store.
 *
-* Built-in stores: `LocalStateStore`, `SSMStateStore`, `S3StateStore`. A
-* custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
-* working but cannot lock.
-*/
-var StateStore_exports = /* @__PURE__ */ __exportAll({
-	DocumentStateStore: () => DocumentStateStore,
-	STATE_SCHEMA_VERSION: () => 2,
-	StageStateMissing: () => StageStateMissing,
-	StateLocked: () => StateLocked,
-	StateSchemaTooNew: () => StateSchemaTooNew,
-	StateStoreBusy: () => StateStoreBusy,
-	StateStoreNeedsWorkspaceName: () => StateStoreNeedsWorkspaceName,
-	StateStoreProvider: () => StateStoreProvider,
-	StateStoreWithoutLocking: () => StateStoreWithoutLocking,
-	StateUnreadable: () => StateUnreadable,
-	StateVersionConflict: () => StateVersionConflict,
-	UnknownStateProvider: () => UnknownStateProvider,
-	contentVersion: () => contentVersion,
-	createStateStore: () => createStateStore,
-	decodeDocument: () => decodeDocument,
-	encodeDocument: () => encodeDocument,
-	isStateStore: () => isStateStore,
-	migrateV1: () => migrateV1,
-	newLockHolder: () => newLockHolder
-});
-var StateLocked = class extends Error {
-	stage;
-	holder;
-	location;
-	constructor(stage, holder, location) {
-		const by = holder ? `${holder.owner}@${holder.host} (pid ${holder.pid}) since ${holder.acquiredAt}${holder.operation ? ` for '${holder.operation}'` : ""}` : "a run that did not record who it was";
-		super(`Deploy state for stage '${stage}' is locked by ${by} (${location}). Wait for that run to finish; if it crashed, release the lock with \`gkm state:unlock --stage ${stage}\`.`);
-		this.stage = stage;
-		this.holder = holder;
-		this.location = location;
-		this.name = "StateLocked";
-	}
-};
-var StateVersionConflict = class extends Error {
-	stage;
-	expectedVersion;
-	actualVersion;
-	constructor(stage, expectedVersion, actualVersion) {
-		super(`Deploy state for stage '${stage}' changed since it was read (expected ${expectedVersion ? `version ${expectedVersion}` : "no state"}, found ${actualVersion ? `version ${actualVersion}` : "no state"}). Another run wrote it: read the state again and re-apply the change, and hold the stage's lock so runs take turns.`);
-		this.stage = stage;
-		this.expectedVersion = expectedVersion;
-		this.actualVersion = actualVersion;
-		this.name = "StateVersionConflict";
-	}
-};
-var StageStateMissing = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
-		this.stage = stage;
-		this.name = "StageStateMissing";
-	}
-};
-var StateUnreadable = class extends Error {
-	stage;
-	location;
-	constructor(stage, location, cause) {
-		super(`Deploy state for stage '${stage}' at ${location} is not valid JSON. Restore it from a backup (or the provider's history) rather than deploying without it — a deploy without state recreates every resource.`, { cause });
-		this.stage = stage;
-		this.location = location;
-		this.name = "StateUnreadable";
-	}
-};
-var StateSchemaTooNew = class extends Error {
-	stage;
-	schemaVersion;
-	constructor(stage, schemaVersion) {
-		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (2). Upgrade @geekmidas/cli to the version that wrote it.`);
-		this.stage = stage;
-		this.schemaVersion = schemaVersion;
-		this.name = "StateSchemaTooNew";
-	}
-};
+* `.gkm/deploy-<stage>.json` holds the state, `.gkm/deploy-<stage>.lock` the
+* lock. Every file is mode 0600: state holds database passwords and IAM keys.
+*/
+var LocalStateStore_exports = /* @__PURE__ */ __exportAll({ LocalStateStore: () => LocalStateStore });
+const FILE_MODE = 384;
+/** How long a write waits for another process's write to finish. */
+const MUTEX_TIMEOUT_MS = 5e3;
 /**
-* Not thrown: emitted (once per store) when a custom `StateProvider` stands
-* in for a store, so a deploy that cannot be protected from a concurrent one
-* says so.
+* A write holds the mutex for milliseconds, so one this old was left by a
+* process that died mid-write and is safe to take over.
 */
-var StateStoreWithoutLocking = class extends Error {
-	provider;
-	constructor(provider) {
-		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
-		this.provider = provider;
-		this.name = "StateStoreWithoutLocking";
+const MUTEX_STALE_MS = 3e4;
+function isCode(error, code) {
+	return error?.code === code;
+}
+var LocalStateStore = class extends DocumentStateStore {
+	workspaceRoot;
+	constructor(workspaceRoot) {
+		super();
+		this.workspaceRoot = workspaceRoot;
 	}
-};
-var StateStoreNeedsWorkspaceName = class extends Error {
-	provider;
-	constructor(provider) {
-		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
-		this.provider = provider;
-		this.name = "StateStoreNeedsWorkspaceName";
+	get dir() {
+		return join(this.workspaceRoot, ".gkm");
 	}
-};
-var UnknownStateProvider = class extends Error {
-	config;
-	constructor(config) {
-		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
-		this.config = config;
-		this.name = "UnknownStateProvider";
+	statePath(stage) {
+		return join(this.dir, `deploy-${stage}.json`);
 	}
-};
-/** A lock or write that could not get at the state backend in time. */
-var StateStoreBusy = class extends Error {
-	stage;
-	location;
-	constructor(stage, location) {
-		super(`Timed out waiting to write deploy state for stage '${stage}' (${location}). If no other gkm process is running, remove ${location}.`);
-		this.stage = stage;
-		this.location = location;
-		this.name = "StateStoreBusy";
+	lockPath(stage) {
+		return join(this.dir, `deploy-${stage}.lock`);
 	}
-};
-function decodeDocument(stage, body, location) {
-	let parsed;
-	try {
-		parsed = JSON.parse(body);
-	} catch (error) {
-		throw new StateUnreadable(stage, location, error);
+	backupPath(stage) {
+		return join(this.dir, `deploy-${stage}.v1.json`);
 	}
-	if (typeof parsed !== "object" || parsed === null) throw new StateUnreadable(stage, location, parsed);
-	const schemaVersion = parsed.schemaVersion;
-	if (schemaVersion === void 0) return {
-		schemaVersion: 1,
-		state: parsed
-	};
-	if (schemaVersion === 2) return {
-		schemaVersion: 2,
-		document: parsed
-	};
-	throw new StateSchemaTooNew(stage, schemaVersion);
-}
-function encodeDocument(document) {
-	return JSON.stringify(document, null, 2);
-}
-/**
-* v1 state as a v2 document. The ids v1 kept are seeded as `ready` records,
-* so the first journaled deploy after an upgrade adopts them rather than
-* treating them as unknown.
-*/
-function migrateV1(stage, state) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const resources = {};
-	const seed = (type, name, id) => {
-		if (!id) return;
-		const key = name ? `${type}:${name}` : type;
-		resources[key] = {
-			key,
-			type,
-			id,
-			status: "ready",
-			updatedAt: now
-		};
-	};
-	seed("project", null, state.projectId);
-	seed("environment", null, state.environmentId);
-	for (const [app, id] of Object.entries(state.applications ?? {})) seed("application", app, id);
-	seed("postgres", null, state.services?.postgresId);
-	seed("redis", null, state.services?.redisId);
-	seed("backup-destination", null, state.backups?.destinationId);
-	return {
-		schemaVersion: 2,
-		stage,
-		serial: 1,
-		state,
-		resources,
-		updatedAt: now
-	};
-}
-function newLockHolder(options) {
-	let owner = "unknown";
-	try {
-		owner = userInfo().username;
-	} catch {}
-	return {
-		id: randomUUID(),
-		owner,
-		host: hostname(),
-		pid: process.pid,
-		acquiredAt: (/* @__PURE__ */ new Date()).toISOString(),
-		operation: options?.operation
-	};
-}
-function contentVersion(body) {
-	return createHash("sha256").update(body).digest("hex").slice(0, 16);
-}
-/**
-* A store over a backend that can read and conditionally write one blob per
-* stage, and create a lock object only if it does not exist. Migration and
-* resource records are the same for every such backend, so they live here.
-*/
-var DocumentStateStore = class {
-	async lock(stage, options) {
-		const holder = newLockHolder(options);
-		await this.createLock(stage, holder);
-		let released = false;
-		return {
-			stage,
-			holder,
-			release: async () => {
-				if (released) return;
-				released = true;
-				await this.removeLock(stage, holder);
-			}
-		};
+	mutexPath(stage) {
+		return join(this.dir, `deploy-${stage}.json.mutex`);
 	}
-	async forceUnlock(stage) {
-		const holder = await this.readLock(stage);
-		await this.removeLock(stage, null);
-		return holder;
+	location(stage) {
+		return this.statePath(stage);
 	}
-	async read(stage) {
-		const current = await this.readDocument(stage);
-		if (!current) return null;
-		return {
-			state: current.document.state,
-			resources: current.document.resources,
-			version: current.version
-		};
-	}
-	async write(stage, state, options) {
-		if (options.expectedVersion === null) {
-			const document = {
-				schemaVersion: 2,
-				stage,
-				serial: 1,
-				state,
-				resources: {},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	async readRaw(stage) {
+		try {
+			const body = await readFile(this.statePath(stage), "utf-8");
+			return {
+				body,
+				version: contentVersion(body)
 			};
-			return this.writeRaw(stage, encodeDocument(document), null);
+		} catch (error) {
+			if (isCode(error, "ENOENT")) return null;
+			throw error;
 		}
-		return this.mutate(stage, options.expectedVersion, (document) => ({
-			...document,
-			state
-		}));
 	}
-	async putResource(stage, record, options) {
-		return this.mutate(stage, options?.expectedVersion, (document) => ({
-			...document,
-			resources: {
-				...document.resources,
-				[record.key]: {
-					...record,
-					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	async writeRaw(stage, body, expectedVersion) {
+		await this.ensureDir();
+		return this.withMutex(stage, async () => {
+			const actual = (await this.readRaw(stage))?.version ?? null;
+			if (actual !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, actual);
+			const target = this.statePath(stage);
+			const temp = `${target}.${randomUUID()}.tmp`;
+			try {
+				const handle = await open(temp, "wx", FILE_MODE);
+				try {
+					await handle.writeFile(body);
+					await handle.sync();
+				} finally {
+					await handle.close();
 				}
+				await rename(temp, target);
+			} catch (error) {
+				await rm(temp, { force: true });
+				throw error;
 			}
-		}));
-	}
-	async deleteResource(stage, key, options) {
-		return this.mutate(stage, options?.expectedVersion, (document) => {
-			const { [key]: _removed, ...resources } = document.resources;
-			return {
-				...document,
-				resources
-			};
+			return contentVersion(body);
 		});
 	}
-	async mutate(stage, expectedVersion, change) {
-		const current = await this.readDocument(stage);
-		if (!current) {
-			if (expectedVersion !== void 0) throw new StateVersionConflict(stage, expectedVersion, null);
-			throw new StageStateMissing(stage);
+	async writeV1Backup(stage, body) {
+		try {
+			await writeFile(this.backupPath(stage), body, {
+				flag: "wx",
+				mode: FILE_MODE
+			});
+		} catch (error) {
+			if (!isCode(error, "EEXIST")) throw error;
 		}
-		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
-		const next = change(current.document);
-		next.serial = current.document.serial + 1;
-		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		return this.writeRaw(stage, encodeDocument(next), current.version);
 	}
-	/**
-	* Reads the stage's document, migrating v1 in place on the way. The
-	* migration is itself a conditional write: if another run migrated (or
-	* wrote) first, its result is read instead.
-	*/
-	async readDocument(stage, attempt = 0) {
-		const raw = await this.readRaw(stage);
-		if (!raw) return null;
-		const decoded = decodeDocument(stage, raw.body, this.location(stage));
-		if (decoded.schemaVersion === 2) return {
-			document: decoded.document,
-			version: raw.version
-		};
-		await this.writeV1Backup(stage, raw.body);
-		const document = migrateV1(stage, decoded.state);
+	async createLock(stage, holder) {
+		await this.ensureDir();
+		let handle;
 		try {
-			return {
-				document,
-				version: await this.writeRaw(stage, encodeDocument(document), raw.version)
-			};
+			handle = await open(this.lockPath(stage), "wx", FILE_MODE);
 		} catch (error) {
-			if (error instanceof StateVersionConflict && attempt < 2) return this.readDocument(stage, attempt + 1);
+			if (isCode(error, "EEXIST")) throw new StateLocked(stage, await this.readLock(stage), this.lockPath(stage));
 			throw error;
 		}
+		try {
+			await handle.writeFile(JSON.stringify(holder, null, 2));
+		} finally {
+			await handle.close();
+		}
 	}
-};
-function isStateStore(value) {
-	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
-}
-/**
-* The store for a workspace's `state` config — the same config
-* `createStateProvider` reads:
-*
-* - none / `'local'`: `LocalStateStore` under `.gkm/`
-* - `'ssm'`: `SSMStateStore`, with no local cache — SSM is read directly, so
-*   a stale local copy can never win over it
-* - `'s3'`: `S3StateStore`
-* - a `StateStore` object: used as is
-* - a `StateProvider` object: wrapped by `LegacyStateStore`
-*/
-async function createStateStore(options) {
-	const { config, workspaceRoot, workspaceName } = options;
-	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await import("./LocalStateStore-BupdV-VN.mjs");
-		return new LocalStateStore(workspaceRoot);
-	}
-	if (isStateStore(config.provider)) return config.provider;
-	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await import("./LegacyStateStore-ByRWQ9s1.mjs");
-		return new LegacyStateStore(config.provider, { warn: options.warn });
-	}
-	if (config.provider === "ssm") {
-		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await import("./SSMStateStore-7hPWW7v7.mjs");
-		const ssm = config;
-		return SSMStateStore.create({
-			workspaceName,
-			region: ssm.region,
-			profile: ssm.profile
-		});
+	async readLock(stage) {
+		try {
+			return JSON.parse(await readFile(this.lockPath(stage), "utf-8"));
+		} catch {
+			return null;
+		}
 	}
-	if (config.provider === "s3") {
-		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await import("./S3StateStore-FhzyENrN.mjs");
-		const s3 = config;
-		return S3StateStore.create({
-			workspaceName,
-			bucket: s3.bucket,
-			prefix: s3.prefix,
-			region: s3.region,
-			profile: s3.profile
-		});
+	async removeLock(stage, holder) {
+		if (holder) {
+			if ((await this.readLock(stage))?.id !== holder.id) return;
+		}
+		await rm(this.lockPath(stage), { force: true });
 	}
-	throw new UnknownStateProvider(config);
-}
-/**
-* A store behind the `StateProvider` interface, for the call sites that still
-* read and write whole states (deploy, until it journals). A write is still
-* conditional on the version this provider last read.
-*/
-var StateStoreProvider = class {
-	store;
-	versions = /* @__PURE__ */ new Map();
-	constructor(store) {
-		this.store = store;
+	async ensureDir() {
+		await mkdir(this.dir, {
+			recursive: true,
+			mode: 448
+		});
 	}
-	async read(stage) {
-		const stored = await this.store.read(stage);
-		this.versions.set(stage, stored?.version ?? null);
-		return stored?.state ?? null;
+	/**
+	* Serialises the check-then-rename of a conditional write across
+	* processes. The stage lock is for whole runs; this is for the instant of
+	* a single write, so even writers that skip the lock never interleave.
+	*/
+	async withMutex(stage, fn) {
+		const path = this.mutexPath(stage);
+		const deadline = Date.now() + MUTEX_TIMEOUT_MS;
+		for (;;) try {
+			await (await open(path, "wx", FILE_MODE)).close();
+			break;
+		} catch (error) {
+			if (!isCode(error, "EEXIST")) throw error;
+			if (await this.isStale(path)) {
+				await unlink(path).catch(() => {});
+				continue;
+			}
+			if (Date.now() > deadline) throw new StateStoreBusy(stage, path);
+			await new Promise((resolve) => setTimeout(resolve, 10));
+		}
+		try {
+			return await fn();
+		} finally {
+			await rm(path, { force: true });
+		}
 	}
-	async write(stage, state) {
-		const expectedVersion = this.versions.has(stage) ? this.versions.get(stage) ?? null : (await this.store.read(stage))?.version ?? null;
-		state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		const version = await this.store.write(stage, state, { expectedVersion });
-		this.versions.set(stage, version);
+	async isStale(path) {
+		try {
+			return Date.now() - (await stat(path)).mtimeMs > MUTEX_STALE_MS;
+		} catch {
+			return false;
+		}
 	}
 };
 //#endregion
@@ -8887,7 +9717,12 @@ var StateStoreProvider = class {
 /**
 * State Management CLI Commands
 *
-* Commands for managing deployment state across local and remote providers.
+* Commands for managing deployment state across local and remote stores.
+*
+* Every command goes through a `StateStore`, the same one deploy writes
+* through: a v1 state is migrated on the way, resource records travel with
+* the state, and a copy is a conditional write — so `state:push` cannot
+* silently replace what a deploy wrote a moment earlier.
 */
 /** What `state:show` prints in place of a secret. */
 const MASKED = "********";
@@ -8913,26 +9748,12 @@ function maskStateSecrets(state) {
 */
 async function statePullCommand(options) {
 	const { workspace } = await loadWorkspaceConfig();
-	if (!workspace.state || workspace.state.provider === "local") {
-		console.error("No remote state provider configured.");
-		console.error("Add a remote provider in gkm.config.ts:");
-		console.error("  state: { provider: \"ssm\", region: \"us-east-1\" }");
-		process.exit(1);
-	}
-	const provider = await createStateProvider({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	if (!(provider instanceof CachedStateProvider)) {
-		console.error("State provider does not support pull operation.");
-		process.exit(1);
-	}
+	const { local, remote } = await remoteAndLocal(workspace);
 	console.log(`Pulling state for stage: ${options.stage}...`);
-	const state = await provider.pull(options.stage);
-	if (state) {
+	const pulled = await copyUnderLock(remote, local, local, options.stage, "state:pull");
+	if (pulled) {
 		console.log("State pulled successfully.");
-		printStateSummary(state);
+		printStateSummary(pulled.state);
 	} else console.log("No remote state found for this stage.");
 }
 /**
@@ -8941,26 +9762,12 @@ async function statePullCommand(options) {
 */
 async function statePushCommand(options) {
 	const { workspace } = await loadWorkspaceConfig();
-	if (!workspace.state || workspace.state.provider === "local") {
-		console.error("No remote state provider configured.");
-		console.error("Add a remote provider in gkm.config.ts:");
-		console.error("  state: { provider: \"ssm\", region: \"us-east-1\" }");
-		process.exit(1);
-	}
-	const provider = await createStateProvider({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	if (!(provider instanceof CachedStateProvider)) {
-		console.error("State provider does not support push operation.");
-		process.exit(1);
-	}
+	const { local, remote } = await remoteAndLocal(workspace);
 	console.log(`Pushing state for stage: ${options.stage}...`);
-	const state = await provider.push(options.stage);
-	if (state) {
+	const pushed = await copyUnderLock(local, remote, remote, options.stage, "state:push");
+	if (pushed) {
 		console.log("State pushed successfully.");
-		printStateSummary(state);
+		printStateSummary(pushed.state);
 	} else console.log("No local state found for this stage.");
 }
 /**
@@ -8969,7 +9776,7 @@ async function statePushCommand(options) {
 */
 async function stateShowCommand(options) {
 	const { workspace } = await loadWorkspaceConfig();
-	const stored = await (await createStateProvider({
+	const stored = await (await createStateStore({
 		config: workspace.state,
 		workspaceRoot: workspace.root,
 		workspaceName: workspace.name
@@ -8978,9 +9785,12 @@ async function stateShowCommand(options) {
 		console.log(`No state found for stage: ${options.stage}`);
 		return;
 	}
-	const state = maskStateSecrets(stored);
+	const state = maskStateSecrets(stored.state);
 	if (options.json) console.log(JSON.stringify(state, null, 2));
-	else printStateDetails(state);
+	else {
+		printStateDetails(state);
+		printUnfinished(stored.resources);
+	}
 }
 /**
 * Release a stage's deploy lock, whoever holds it.
@@ -9009,22 +9819,11 @@ async function stateUnlockCommand(options) {
 */
 async function stateDiffCommand(options) {
 	const { workspace } = await loadWorkspaceConfig();
-	if (!workspace.state || workspace.state.provider === "local") {
-		console.error("No remote state provider configured.");
-		console.error("Diff requires a remote provider to compare against.");
-		process.exit(1);
-	}
-	const provider = await createStateProvider({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	if (!(provider instanceof CachedStateProvider)) {
-		console.error("State provider does not support diff operation.");
-		process.exit(1);
-	}
+	const stores = await remoteAndLocal(workspace, ["Diff requires a remote provider to compare against."]);
 	console.log(`Comparing state for stage: ${options.stage}...\n`);
-	const { local, remote } = await provider.diff(options.stage);
+	const [localStored, remoteStored] = await Promise.all([stores.local.read(options.stage), stores.remote.read(options.stage)]);
+	const local = localStored?.state ?? null;
+	const remote = remoteStored?.state ?? null;
 	if (!local && !remote) {
 		console.log("No state found (local or remote).");
 		return;
@@ -9060,6 +9859,71 @@ async function stateDiffCommand(options) {
 			else console.log(`  ${key}: ${localVal ?? "(none)"} (local) != ${remoteVal ?? "(none)"} (remote)`);
 		}
 	}
+	const localRecords = localStored?.resources ?? {};
+	const remoteRecords = remoteStored?.resources ?? {};
+	const differing = [.../* @__PURE__ */ new Set([...Object.keys(localRecords), ...Object.keys(remoteRecords)])].filter((key) => describeRecord(localRecords[key]) !== describeRecord(remoteRecords[key]));
+	if (differing.length > 0) {
+		console.log("\nResources:");
+		for (const key of differing) console.log(`  ${key}: ${describeRecord(localRecords[key])} (local) != ${describeRecord(remoteRecords[key])} (remote)`);
+	}
+}
+/**
+* The stage's local store and its remote one — or, for a workspace that keeps
+* state only locally, the reason there is nothing to move it between.
+*/
+async function remoteAndLocal(workspace, hint = ["Add a remote provider in gkm.config.ts:", "  state: { provider: \"ssm\", region: \"us-east-1\" }"]) {
+	if (!workspace.state || workspace.state.provider === "local") {
+		console.error("No remote state provider configured.");
+		for (const line of hint) console.error(line);
+		process.exit(1);
+	}
+	return {
+		local: new LocalStateStore(workspace.root),
+		remote: await createStateStore({
+			config: workspace.state,
+			workspaceRoot: workspace.root,
+			workspaceName: workspace.name
+		})
+	};
+}
+/**
+* Makes `to` hold exactly what `from` holds for `stage` — its state and its
+* resource records — while holding `locked`'s lock for the stage. Every
+* write is conditional on the version just read, so anything that changes
+* `to` mid-copy raises `StateVersionConflict` rather than being overwritten.
+*/
+async function copyUnderLock(from, to, locked, stage, operation) {
+	const lock = await locked.lock(stage, { operation });
+	try {
+		return await copyStage(from, to, stage);
+	} finally {
+		await lock.release();
+	}
+}
+/** @internal Exported for testing */
+async function copyStage(from, to, stage) {
+	const source = await from.read(stage);
+	if (!source) return null;
+	const target = await to.read(stage);
+	let version = await to.write(stage, source.state, { expectedVersion: target?.version ?? null });
+	for (const key of Object.keys(target?.resources ?? {})) {
+		if (key in source.resources) continue;
+		version = await to.deleteResource(stage, key, { expectedVersion: version });
+	}
+	for (const { updatedAt: _stamped, ...record } of Object.values(source.resources)) version = await to.putResource(stage, record, { expectedVersion: version });
+	return source;
+}
+function describeRecord(record) {
+	if (!record) return "(none)";
+	return record.id ? `${record.status} ${record.id}` : record.status;
+}
+/** Resources a run marked `pending` and never saw created. */
+function printUnfinished(resources) {
+	const pending = Object.values(resources).filter((record) => record.status === "pending");
+	if (pending.length === 0) return;
+	console.log("");
+	console.log("Unfinished (a deploy stopped while creating these):");
+	for (const record of pending) console.log(`  ${record.key}`);
 }
 function printStateSummary(state) {
 	const appCount = Object.keys(state.applications).length;
@@ -10107,25 +10971,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.57",
-	"@geekmidas/auth": "~10.0.0-alpha.57",
-	"@geekmidas/cache": "~10.0.0-alpha.57",
-	"@geekmidas/client": "~10.0.0-alpha.57",
-	"@geekmidas/cloud": "~10.0.0-alpha.57",
-	"@geekmidas/constructs": "~10.0.0-alpha.57",
-	"@geekmidas/db": "~10.0.0-alpha.57",
-	"@geekmidas/emailkit": "~10.0.0-alpha.57",
-	"@geekmidas/envkit": "~10.0.0-alpha.57",
-	"@geekmidas/errors": "~10.0.0-alpha.57",
-	"@geekmidas/events": "~10.0.0-alpha.57",
-	"@geekmidas/logger": "~10.0.0-alpha.57",
-	"@geekmidas/manifest": "~10.0.0-alpha.57",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.57",
-	"@geekmidas/schema": "~10.0.0-alpha.57",
-	"@geekmidas/services": "~10.0.0-alpha.57",
-	"@geekmidas/storage": "~10.0.0-alpha.57",
-	"@geekmidas/telescope": "~10.0.0-alpha.57",
-	"@geekmidas/testkit": "~10.0.0-alpha.57",
+	"@geekmidas/audit": "~10.0.0-alpha.59",
+	"@geekmidas/auth": "~10.0.0-alpha.59",
+	"@geekmidas/cache": "~10.0.0-alpha.59",
+	"@geekmidas/client": "~10.0.0-alpha.59",
+	"@geekmidas/cloud": "~10.0.0-alpha.59",
+	"@geekmidas/constructs": "~10.0.0-alpha.59",
+	"@geekmidas/db": "~10.0.0-alpha.59",
+	"@geekmidas/emailkit": "~10.0.0-alpha.59",
+	"@geekmidas/envkit": "~10.0.0-alpha.59",
+	"@geekmidas/errors": "~10.0.0-alpha.59",
+	"@geekmidas/events": "~10.0.0-alpha.59",
+	"@geekmidas/logger": "~10.0.0-alpha.59",
+	"@geekmidas/manifest": "~10.0.0-alpha.59",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.59",
+	"@geekmidas/schema": "~10.0.0-alpha.59",
+	"@geekmidas/services": "~10.0.0-alpha.59",
+	"@geekmidas/storage": "~10.0.0-alpha.59",
+	"@geekmidas/telescope": "~10.0.0-alpha.59",
+	"@geekmidas/testkit": "~10.0.0-alpha.59",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -16007,7 +16871,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-CS3DkO6y.mjs");
+	const { migrateAndSeed } = await import("./migrate-BrFREmgQ.mjs");
 	const { discover } = await import("./discover-Cf2jAcgF.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -16438,7 +17302,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-CS3DkO6y.mjs");
+		const { migrateCommand } = await import("./migrate-BrFREmgQ.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16452,7 +17316,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-CS3DkO6y.mjs");
+		const { seedCommand } = await import("./migrate-BrFREmgQ.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16466,7 +17330,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-CS3DkO6y.mjs");
+		const { migrationCommand } = await import("./migrate-BrFREmgQ.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16564,7 +17428,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-KQTYFEzU.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-BW7Gh51G.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16575,7 +17439,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-KQTYFEzU.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-BW7Gh51G.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16627,7 +17491,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-CgWcE_Yr.mjs").then((n) => n.o);
+		const { derivedContainers } = await import("./workspace-BRZ14o-o.mjs").then((n) => n.o);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16686,7 +17550,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-y7OEj59M.mjs");
+		const { deployGithubCommand } = await import("./github-T_6sK3Rz.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16821,6 +17685,6 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 });
 program.parse();
 //#endregion
-export { StageStateMissing as a, StateStoreWithoutLocking as c, newLockHolder as d, encryption_exports as f, DocumentStateStore as i, StateVersionConflict as l, getHostingerToken as m, slug as n, StateLocked as o, appPorts_exports as p, stamp as r, StateStoreBusy as s, generateFullstackCustomSecrets as t, contentVersion as u };
+export { encryption_exports as a, LocalStateStore_exports as i, slug as n, appPorts_exports as o, stamp as r, getHostingerToken as s, generateFullstackCustomSecrets as t };
 
 //# sourceMappingURL=index.mjs.map