@geekmidas/cli 10.0.0-alpha.58 → 10.0.0-alpha.59

package/dist/index.cjs

@@ -2,16 +2,17 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_discover = require("./discover-DXNviAh-.cjs");
-const require_config = require("./config-DdIu1O_I.cjs");
-const require_workspace = require("./workspace-Bah36xSG.cjs");
+const require_config = require("./config-WMOB9bLL.cjs");
+const require_workspace = require("./workspace-B64Xk1Mb.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-DQgxT_WR.cjs");
-const require_workspace$1 = require("./workspace-B14L2TrY.cjs");
+const require_workspace$1 = require("./workspace-Dbn07ILl.cjs");
 const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BCWPRZwD.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_ready = require("./ready-mR96orkJ.cjs");
 const require_backends = require("./backends-v3xDuhO0.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
+const require_StateStore = require("./StateStore-B4u0wx2t.cjs");
 let commander = require("commander");
 let node_process = require("node:process");
 let node_readline_promises = require("node:readline/promises");
@@ -27,6 +28,7 @@ let node_child_process = require("node:child_process");
 let node_module = require("node:module");
 let chokidar = require("chokidar");
 chokidar = require_rolldown_runtime.__toESM(chokidar, 1);
+let node_net = require("node:net");
 let node_crypto = require("node:crypto");
 let node_url = require("node:url");
 let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
@@ -37,6 +39,8 @@ let node_util = require("node:util");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
 let prompts = require("prompts");
 prompts = require_rolldown_runtime.__toESM(prompts, 1);
+let node_http = require("node:http");
+let node_stream = require("node:stream");
 let http = require("http");
 let http2 = require("http2");
 let stream = require("stream");
@@ -48,7 +52,7 @@ let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
 //#region package.json
-var version = "10.0.0-alpha.58";
+var version = "10.0.0-alpha.59";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -762,6 +766,621 @@ async function assignAppPorts(workspace, names, deps) {
 		running
 	};
 }
+/** Overrides `dev.discoveryPort` — `0` serves on a port of its own. */
+const DISCOVERY_PORT_ENV = "GKM_DISCOVERY_PORT";
+/**
+* Set by a workspace's `gkm dev` for the app sessions turbo starts under it:
+* the workspace has printed the connect URL, so they do not repeat it.
+*/
+const DISCOVERY_QUIET_ENV = "GKM_DISCOVERY_QUIET";
+/** The route everything is served under. */
+const BASE = "/__gkm";
+/** `GKM_DISCOVERY_PORT` is set to something that is not a port. */
+var InvalidDiscoveryPort = class extends Error {
+	value;
+	constructor(value) {
+		super(`${DISCOVERY_PORT_ENV}=${value} is not a port. Set it to a number from 0 to 65535 (0 serves discovery on a free port of its own), or unset it to use dev.discoveryPort.`);
+		this.value = value;
+		this.name = "InvalidDiscoveryPort";
+	}
+};
+/** The port the endpoint uses: the env, then `dev.discoveryPort`, then 4983. */
+function discoveryPort(config, env = process.env) {
+	const raw = env[DISCOVERY_PORT_ENV];
+	if (raw !== void 0 && raw !== "") {
+		const port = Number(raw);
+		if (!Number.isInteger(port) || port < 0 || port > 65535) throw new InvalidDiscoveryPort(raw);
+		return port;
+	}
+	return config?.discoveryPort ?? 4983;
+}
+/** The machine's registry, shared by every `gkm dev`. */
+function discoveryRegistry(env = process.env) {
+	return env["GKM_DEV_REGISTRY"] || (0, node_path.join)((0, node_os.homedir)(), ".gkm", "dev");
+}
+function sessionsDir(registry) {
+	return (0, node_path.join)(registry, "sessions");
+}
+/** Whether a process is alive. `EPERM` is someone else's — alive. */
+function alive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
+/**
+* Every live session, pruning the ones whose process is gone — a `gkm dev`
+* killed outright never got to remove its own.
+*/
+function liveSessions(registry) {
+	const dir = sessionsDir(registry);
+	let files;
+	try {
+		files = (0, node_fs.readdirSync)(dir).filter((file) => file.endsWith(".json"));
+	} catch {
+		return [];
+	}
+	const records = [];
+	for (const file of files) {
+		const path = (0, node_path.join)(dir, file);
+		let record;
+		try {
+			record = JSON.parse((0, node_fs.readFileSync)(path, "utf8"));
+		} catch {
+			continue;
+		}
+		if (alive(record.pid)) {
+			records.push(record);
+			continue;
+		}
+		try {
+			(0, node_fs.unlinkSync)(path);
+		} catch {}
+	}
+	return records;
+}
+/** Written whole, then renamed into place, so a reader never sees half. */
+function writeRecord(registry, record) {
+	const path = (0, node_path.join)(sessionsDir(registry), `${record.id}.json`);
+	const partial = `${path}.${process.pid}.tmp`;
+	(0, node_fs.writeFileSync)(partial, JSON.stringify(record), { mode: 384 });
+	(0, node_fs.renameSync)(partial, path);
+}
+function removeRecord(registry, id) {
+	try {
+		(0, node_fs.unlinkSync)((0, node_path.join)(sessionsDir(registry), `${id}.json`));
+	} catch {}
+}
+/**
+* The token every session prints and every host checks.
+*
+* Shared through the registry, so a URL printed by one session still works
+* after another has taken over hosting. It lives as long as some session does:
+* a session that finds none but itself starts a new one, so a token printed
+* yesterday stops working once everything it was printed by has stopped.
+*/
+function sessionToken(registry, self) {
+	const path = (0, node_path.join)(registry, "token");
+	if (liveSessions(registry).filter((r) => r.id !== self).length === 0) {
+		const stale = `${path}.${self}.stale`;
+		try {
+			(0, node_fs.renameSync)(path, stale);
+			(0, node_fs.unlinkSync)(stale);
+		} catch {}
+	}
+	const fresh = `${path}.${self}.new`;
+	(0, node_fs.writeFileSync)(fresh, (0, node_crypto.randomBytes)(32).toString("base64url"), { mode: 384 });
+	try {
+		(0, node_fs.linkSync)(fresh, path);
+	} catch {}
+	(0, node_fs.unlinkSync)(fresh);
+	return (0, node_fs.readFileSync)(path, "utf8").trim();
+}
+/** `<name>-<8 hex>`: readable, and two checkouts of a project stay apart. */
+function workspaceId(name, root) {
+	return `${name.toLowerCase().replace(/^@/, "").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "workspace"}-${(0, node_crypto.createHash)("sha256").update(root).digest("hex").slice(0, 8)}`;
+}
+/** Whether anything accepts connections on a local port. */
+function listening(port) {
+	return new Promise((resolve) => {
+		const socket = (0, node_net.connect)({
+			port,
+			host: "localhost"
+		});
+		const done = (open) => {
+			socket.destroy();
+			resolve(open);
+		};
+		socket.setTimeout(300, () => done(false));
+		socket.once("connect", () => done(true));
+		socket.once("error", () => done(false));
+	});
+}
+/** Which data APIs the forwarder matches by prefix, rather than exactly. */
+const PREFIXED = /* @__PURE__ */ new Set(["telescope", "database"]);
+/** Whether `path` on an app is one of its data APIs. */
+function servesData(app, path) {
+	return app.dataApis.some((api) => PREFIXED.has(api.kind) ? path === api.path || path.startsWith(`${api.path}/`) : path === api.path);
+}
+/**
+* Every workspace the sessions describe, one entry per root.
+*
+* An app listed only by its workspace's session — a web app turbo started, an
+* API whose own `gkm dev` has not registered yet — is `ready` when its port
+* answers and `starting` until then.
+*/
+async function collect(records) {
+	const byRoot = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const group = byRoot.get(record.workspace.root) ?? [];
+		group.push(record);
+		byRoot.set(record.workspace.root, group);
+	}
+	const views = [];
+	for (const [root, group] of byRoot) {
+		group.sort((a, b) => Number(b.role === "workspace") - Number(a.role === "workspace") || a.startedAt.localeCompare(b.startedAt));
+		const lead = group[0];
+		const id = workspaceId(lead.workspace.name, root);
+		const apps = /* @__PURE__ */ new Map();
+		for (const record of group) for (const app of record.apps) {
+			const own = record.role === "app";
+			if (!own && apps.has(app.name)) continue;
+			apps.set(app.name, {
+				app,
+				pid: own ? record.pid : null
+			});
+		}
+		const discovered = await Promise.all([...apps.values()].map(async ({ app, pid }) => {
+			const url = `http://localhost:${app.port}`;
+			const status = pid === null ? await listening(app.port) ? "ready" : "starting" : app.status;
+			return {
+				name: app.name,
+				type: app.type,
+				port: app.port,
+				url,
+				publicUrl: app.publicUrl ?? null,
+				status,
+				reloads: app.reloads,
+				pid,
+				dataApis: app.dataApis.map((api) => ({
+					kind: api.kind,
+					path: api.path,
+					url: `${url}${api.path}`,
+					proxy: `${BASE}/workspaces/${id}/apps/${encodeURIComponent(app.name)}${api.path}`
+				}))
+			};
+		}));
+		discovered.sort((a, b) => a.name.localeCompare(b.name));
+		views.push({
+			id,
+			name: lead.workspace.name,
+			root,
+			stage: lead.workspace.stage,
+			manifest: group.find((r) => r.manifest)?.manifest ?? null,
+			apps: discovered,
+			allowedOrigins: [...new Set(group.flatMap((r) => r.allowedOrigins))]
+		});
+	}
+	return views.sort((a, b) => a.name.localeCompare(b.name) || a.root.localeCompare(b.root));
+}
+/** What changed between two views, as events. */
+function changes(before, after) {
+	const out = [];
+	const previous = new Map(before.map((w) => [w.id, w]));
+	const next = new Map(after.map((w) => [w.id, w]));
+	for (const workspace of after) {
+		const was = previous.get(workspace.id);
+		if (!was) out.push({
+			workspace,
+			event: {
+				type: "workspace.started",
+				workspace: workspace.id
+			}
+		});
+		const wasApps = new Map((was?.apps ?? []).map((a) => [a.name, a]));
+		for (const app of workspace.apps) {
+			const old = wasApps.get(app.name);
+			const type = !old ? "app.started" : app.reloads > old.reloads ? "app.reloaded" : app.status !== old.status || app.port !== old.port || app.dataApis.length !== old.dataApis.length ? "app.status" : void 0;
+			if (type) out.push({
+				workspace,
+				event: {
+					type,
+					workspace: workspace.id,
+					app
+				}
+			});
+		}
+		for (const old of was?.apps ?? []) if (!workspace.apps.some((a) => a.name === old.name)) out.push({
+			workspace,
+			event: {
+				type: "app.stopped",
+				workspace: workspace.id,
+				app: old
+			}
+		});
+	}
+	for (const workspace of before) {
+		if (next.has(workspace.id)) continue;
+		for (const app of workspace.apps) out.push({
+			workspace,
+			event: {
+				type: "app.stopped",
+				workspace: workspace.id,
+				app
+			}
+		});
+		out.push({
+			workspace,
+			event: {
+				type: "workspace.stopped",
+				workspace: workspace.id
+			}
+		});
+	}
+	return out;
+}
+/** A browser with no `Origin` — curl, a local process — sees everything. */
+function visibleTo(workspace, origin) {
+	return origin === void 0 || workspace.allowedOrigins.includes(origin);
+}
+function publicView({ allowedOrigins: _, ...workspace }) {
+	return workspace;
+}
+/** Headers an app's response is passed on with; nothing that sets state. */
+const FORWARDED_RESPONSE_HEADERS = [
+	"content-type",
+	"cache-control",
+	"etag",
+	"last-modified"
+];
+/**
+* The HTTP side: serves the registry it reads, checking every request.
+* @internal Exported for testing
+*/
+var DiscoveryHost = class {
+	registry;
+	token;
+	pollMs;
+	server;
+	view = [];
+	streams = /* @__PURE__ */ new Set();
+	scanning;
+	timers = [];
+	sequence = 0;
+	constructor(registry, token, pollMs) {
+		this.registry = registry;
+		this.token = token;
+		this.pollMs = pollMs;
+	}
+	/** The port it is bound to, once it is. */
+	get port() {
+		return (this.server?.address())?.port;
+	}
+	/** Binds the port; `false` when another process already has it. */
+	async listen(port) {
+		const server = (0, node_http.createServer)((request, response) => {
+			this.handle(request, response).catch(() => {
+				if (!response.headersSent) reply(response, 500, { error: "DiscoveryFailed" });
+				else response.destroy();
+			});
+		});
+		if (!await new Promise((resolve) => {
+			server.once("error", () => resolve(false));
+			server.listen(port, "127.0.0.1", () => resolve(true));
+		})) return false;
+		server.unref();
+		this.server = server;
+		this.view = await this.scan();
+		this.timers.push(setInterval(() => void this.scan(), this.pollMs).unref(), setInterval(() => {
+			for (const { response } of this.streams) response.write(": ping\n\n");
+		}, 15e3).unref());
+		return true;
+	}
+	async close() {
+		for (const timer of this.timers) clearInterval(timer);
+		this.timers = [];
+		for (const { response } of this.streams) response.end();
+		this.streams.clear();
+		const server = this.server;
+		this.server = void 0;
+		if (!server) return;
+		await new Promise((resolve) => {
+			server.close(() => resolve());
+			server.closeAllConnections();
+		});
+	}
+	/** Reads the registry, and tells every stream what changed. One at a time. */
+	scan() {
+		const run = (this.scanning ?? Promise.resolve()).then(async () => {
+			const next = await collect(liveSessions(this.registry));
+			for (const { workspace, event } of changes(this.view, next)) this.broadcast(workspace, event);
+			this.view = next;
+			return next;
+		});
+		this.scanning = run.catch(() => this.view);
+		return run;
+	}
+	broadcast(workspace, event) {
+		this.sequence += 1;
+		for (const stream of this.streams) {
+			if (!visibleTo(workspace, stream.origin)) continue;
+			send(stream.response, event, this.sequence);
+		}
+	}
+	snapshot(origin) {
+		return {
+			version: 1,
+			host: {
+				pid: process.pid,
+				port: this.port ?? 0
+			},
+			events: `${BASE}/events`,
+			workspaces: this.view.filter((w) => visibleTo(w, origin)).map(publicView)
+		};
+	}
+	async handle(request, response) {
+		const port = this.port;
+		const host = request.headers.host;
+		if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) {
+			reply(response, 403, {
+				error: "HostNotAllowed",
+				message: `Reach discovery at http://127.0.0.1:${port}.`
+			});
+			return;
+		}
+		const origin = request.headers.origin;
+		const allowed = this.view.flatMap((w) => w.allowedOrigins);
+		if (origin !== void 0 && !allowed.includes(origin)) {
+			reply(response, 403, {
+				error: "OriginNotAllowed",
+				message: `Add ${origin} to dev.allowedOrigins in gkm.config.ts to let it read gkm dev.`
+			});
+			return;
+		}
+		if (origin !== void 0) {
+			response.setHeader("access-control-allow-origin", origin);
+			response.setHeader("vary", "Origin");
+		}
+		if (request.method === "OPTIONS") {
+			response.setHeader("access-control-allow-methods", "GET, HEAD");
+			response.setHeader("access-control-allow-headers", "Authorization");
+			response.setHeader("access-control-max-age", "600");
+			if (request.headers["access-control-request-private-network"]) response.setHeader("access-control-allow-private-network", "true");
+			response.writeHead(204).end();
+			return;
+		}
+		const url = new URL(request.url ?? "/", `http://${host}`);
+		if (!this.authorized(request, url)) {
+			reply(response, 401, {
+				error: "TokenRequired",
+				message: "Use the connect URL gkm dev printed, or send its token as `Authorization: Bearer <token>`."
+			});
+			return;
+		}
+		if (request.method !== "GET" && request.method !== "HEAD") {
+			response.setHeader("allow", "GET, HEAD, OPTIONS");
+			reply(response, 405, {
+				error: "ReadOnly",
+				message: "Discovery is read-only: GET and HEAD."
+			});
+			return;
+		}
+		const path = url.pathname.replace(/\/+$/, "") || "/";
+		if (path === BASE) {
+			await this.scan();
+			reply(response, 200, this.snapshot(origin));
+			return;
+		}
+		if (path === `${BASE}/events`) {
+			await this.scan();
+			this.stream(response, origin);
+			response.once("close", () => {
+				for (const stream of this.streams) if (stream.response === response) this.streams.delete(stream);
+			});
+			return;
+		}
+		const forwarded = path.match(/^\/__gkm\/workspaces\/([^/]+)\/apps\/([^/]+)(\/.*)$/);
+		if (forwarded) {
+			const [, id, name, rest] = forwarded;
+			await this.forward(request, response, origin, id, decodeURIComponent(name), rest, url);
+			return;
+		}
+		reply(response, 404, { error: "NotFound" });
+	}
+	authorized(request, url) {
+		const header = request.headers.authorization;
+		const given = header?.startsWith("Bearer ") ? header.slice(7).trim() : url.searchParams.get("token");
+		if (!given) return false;
+		const a = Buffer.from(given);
+		const b = Buffer.from(this.token);
+		return a.length === b.length && (0, node_crypto.timingSafeEqual)(a, b);
+	}
+	stream(response, origin) {
+		response.writeHead(200, {
+			"content-type": "text/event-stream",
+			"cache-control": "no-cache",
+			connection: "keep-alive"
+		});
+		response.write("retry: 1000\n\n");
+		send(response, {
+			type: "snapshot",
+			snapshot: this.snapshot(origin)
+		});
+		this.streams.add({
+			origin,
+			response
+		});
+	}
+	/** Passes a read of one data API on to the app that serves it. */
+	async forward(request, response, origin, id, name, path, url) {
+		const app = this.view.find((w) => w.id === id && visibleTo(w, origin))?.apps.find((a) => a.name === name);
+		if (!app) {
+			reply(response, 404, { error: "AppNotFound" });
+			return;
+		}
+		if (!servesData(app, path)) {
+			reply(response, 404, {
+				error: "NotADataApi",
+				message: `Only ${name}'s data APIs are forwarded: ${app.dataApis.map((a) => a.path).join(", ") || "it has none"}.`
+			});
+			return;
+		}
+		const search = new URLSearchParams(url.searchParams);
+		search.delete("token");
+		const query = search.size > 0 ? `?${search}` : "";
+		const abort = new AbortController();
+		response.once("close", () => abort.abort());
+		let upstream;
+		try {
+			upstream = await fetch(`http://localhost:${app.port}${path}${query}`, {
+				method: request.method,
+				headers: { accept: request.headers.accept ?? "*/*" },
+				signal: abort.signal
+			});
+		} catch {
+			reply(response, 502, {
+				error: "AppUnavailable",
+				message: `${name} is not answering on port ${app.port}.`
+			});
+			return;
+		}
+		const headers = {};
+		for (const key of FORWARDED_RESPONSE_HEADERS) {
+			const value = upstream.headers.get(key);
+			if (value) headers[key] = value;
+		}
+		response.writeHead(upstream.status, headers);
+		if (!upstream.body || request.method === "HEAD") {
+			response.end();
+			return;
+		}
+		node_stream.Readable.fromWeb(upstream.body).on("error", () => response.destroy()).pipe(response);
+	}
+};
+function reply(response, status, body) {
+	response.writeHead(status, { "content-type": "application/json" });
+	response.end(JSON.stringify(body));
+}
+function send(response, event, id) {
+	response.write(`${id === void 0 ? "" : `id: ${id}\n`}event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`);
+}
+/**
+* One `gkm dev`'s membership: its record in the registry, and — while it holds
+* the port — the endpoint itself.
+*/
+var DiscoverySession = class DiscoverySession {
+	registry;
+	port;
+	record;
+	token;
+	pollMs;
+	host;
+	election;
+	left = false;
+	cleanup = () => removeRecord(this.registry, this.record.id);
+	constructor(registry, port, record, token, pollMs) {
+		this.registry = registry;
+		this.port = port;
+		this.record = record;
+		this.token = token;
+		this.pollMs = pollMs;
+	}
+	static async join(options) {
+		const registry = options.registry ?? discoveryRegistry();
+		(0, node_fs.mkdirSync)(sessionsDir(registry), {
+			recursive: true,
+			mode: 448
+		});
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const record = {
+			id: `${process.pid}-${(0, node_crypto.randomBytes)(4).toString("hex")}`,
+			pid: process.pid,
+			role: options.role,
+			startedAt: now,
+			updatedAt: now,
+			workspace: options.workspace,
+			allowedOrigins: [...options.allowedOrigins ?? []],
+			...options.manifest ? { manifest: options.manifest } : {},
+			apps: options.apps
+		};
+		writeRecord(registry, record);
+		const token = sessionToken(registry, record.id);
+		const session = new DiscoverySession(registry, options.port ?? 4983, record, token, options.pollMs ?? 500);
+		process.once("exit", session.cleanup);
+		await session.elect();
+		if (!session.host && session.port !== 0) session.election = setInterval(() => void session.elect(), options.electionMs ?? 1e3).unref();
+		return session;
+	}
+	/** Whether this session is the one serving the endpoint. */
+	get hosting() {
+		return this.host !== void 0;
+	}
+	/** The port clients reach — this host's own, when it chose one. */
+	get endpointPort() {
+		return this.host?.port ?? this.port;
+	}
+	/** Jupyter-style: the endpoint, with the token that opens it. */
+	get connectUrl() {
+		return `http://127.0.0.1:${this.endpointPort}${BASE}?token=${this.token}`;
+	}
+	/** Changes one of this session's apps, and tells the endpoint. */
+	updateApp(name, change) {
+		if (this.left) return;
+		this.record.apps = this.record.apps.map((app) => app.name === name ? change(app) : app);
+		this.record.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		writeRecord(this.registry, this.record);
+		this.host?.scan();
+	}
+	/** Leaves the registry, and the port to whichever session takes it next. */
+	async leave() {
+		if (this.left) return;
+		this.left = true;
+		if (this.election) clearInterval(this.election);
+		process.removeListener("exit", this.cleanup);
+		this.cleanup();
+		await this.host?.close();
+		this.host = void 0;
+		if (liveSessions(this.registry).length === 0) try {
+			(0, node_fs.unlinkSync)((0, node_path.join)(this.registry, "token"));
+		} catch {}
+	}
+	async elect() {
+		if (this.host || this.left) return;
+		const host = new DiscoveryHost(this.registry, this.token, this.pollMs);
+		if (!await host.listen(this.port)) return;
+		if (this.left) {
+			await host.close();
+			return;
+		}
+		this.host = host;
+		if (this.election) clearInterval(this.election);
+		this.election = void 0;
+	}
+};
+/** Joins the machine's discovery; see {@link DiscoverySession}. */
+function joinDiscovery(options) {
+	return DiscoverySession.join(options);
+}
+/** The data APIs a generated dev app mounts, from what `gkm dev` built. */
+function dataApisOf(options) {
+	if (options.selfServing) return [];
+	return [
+		...options.telescopePath ? [{
+			kind: "telescope",
+			path: `${options.telescopePath}/api`
+		}] : [],
+		...options.databaseApi ? [{
+			kind: "database",
+			path: options.databaseApi
+		}] : [],
+		...options.openApi ? [{
+			kind: "openapi",
+			path: "/__docs"
+		}] : []
+	];
+}
 //#endregion
 //#region ../../node_modules/.pnpm/@hono+node-server@1.19.5_hono@4.13.8/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
@@ -1427,6 +2046,7 @@ async function devCommand(options) {
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
 	let publicUrl;
+	let manifest;
 	const appSecrets = await require_workspace$1.loadSecretsForApp(workspace ? await require_store.secretsStoreFor(workspace, config.stages.local) : new require_store.FileSecretsStore(secretsRoot), config.stages.local, workspaceAppName);
 	if (workspace) {
 		const reconciled = await require_workspace$1.reconcileWorkspace(workspace, {
@@ -1441,6 +2061,7 @@ async function devCommand(options) {
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_config.appKey(r.id) === workspaceAppName);
 		publicUrl = own ? reconciled.env[own.envKey] : void 0;
+		manifest = reconciled.manifest;
 	}
 	if (Object.keys(appSecrets).length > 0) {
 		const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
@@ -1453,6 +2074,38 @@ async function devCommand(options) {
 	devServer.label = workspaceAppName ?? "server";
 	devServer.publicUrl = publicUrl;
 	await devServer.start();
+	const discovery = await joinDiscovery({
+		role: "app",
+		port: discoveryPort(workspace.dev),
+		workspace: {
+			name: workspace.name,
+			root: workspace.root,
+			stage: workspace.stages.local
+		},
+		allowedOrigins: workspace.dev?.allowedOrigins ?? [],
+		...manifest ? { manifest } : {},
+		apps: [{
+			name: workspaceAppName,
+			type: "backend",
+			port: devServer.port,
+			...publicUrl ? { publicUrl } : {},
+			status: "ready",
+			reloads: 0,
+			dataApis: dataApisOf({
+				selfServing: devServer.selfServing,
+				telescopePath: telescope?.path,
+				databaseApi: initial.databaseApi,
+				openApi: enableOpenApi
+			})
+		}]
+	});
+	if (!process.env["GKM_DISCOVERY_QUIET"]) announce(discovery);
+	devServer.onStatus = (status) => discovery.updateApp(workspaceAppName, (app) => ({
+		...app,
+		status,
+		port: devServer.port,
+		reloads: app.status === "reloading" && status === "ready" ? app.reloads + 1 : app.reloads
+	}));
 	const hooksFile = (config.hooks?.server?.split("#"))?.[0];
 	const normalizedPatterns = [config.constructs, ...hooksFile ? [hooksFile.endsWith(".ts") ? hooksFile : `${hooksFile}.ts`] : []].flat().filter((p) => typeof p === "string").map((p) => (0, node_path.isAbsolute)(p) ? (0, node_path.relative)(appRoot, p) : p.replace(/^\.\//, ""));
 	const resolvedFiles = await (0, fast_glob.default)(normalizedPatterns, {
@@ -1493,7 +2146,11 @@ async function devCommand(options) {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
 		logger$9.log("\n🛑 Shutting down...");
-		Promise.all([watcher.close(), devServer.stop()]).catch((err) => {
+		Promise.all([
+			watcher.close(),
+			devServer.stop(),
+			discovery.leave()
+		]).catch((err) => {
 			logger$9.error("Error during shutdown:", err);
 		}).finally(() => {
 			process.exit(0);
@@ -1737,9 +2394,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$9.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-DzYqA-e3.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-CThJfVHR.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-DzYqA-e3.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-CThJfVHR.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -1794,12 +2451,39 @@ async function workspaceDevCommand(configured, options) {
 			break;
 		}
 	}
+	const discovery = await joinDiscovery({
+		role: "workspace",
+		port: discoveryPort(workspace.dev),
+		workspace: {
+			name: workspace.name,
+			root: workspace.root,
+			stage: workspace.stages.local
+		},
+		allowedOrigins: workspace.dev?.allowedOrigins ?? [],
+		...reconciled.manifest ? { manifest: reconciled.manifest } : {},
+		apps: buildOrder.flatMap((name) => {
+			const app = workspace.apps[name];
+			if (!app) return [];
+			const publicUrl = Object.entries(appUrls).find(([id]) => require_config.appKey(id) === name)?.[1];
+			return [{
+				name,
+				type: app.type,
+				port: app.port,
+				...publicUrl ? { publicUrl } : {},
+				status: "starting",
+				reloads: 0,
+				dataApis: []
+			}];
+		})
+	});
+	announce(discovery);
 	const turboEnv = {
 		...process.env,
 		...secretsEnv,
 		NODE_ENV: "development",
 		...configPath ? { GKM_CONFIG_PATH: configPath } : {},
-		...options.fake ? { [require_workspace$1.FAKE_ENV]: "1" } : {}
+		...options.fake ? { [require_workspace$1.FAKE_ENV]: "1" } : {},
+		[DISCOVERY_QUIET_ENV]: "1"
 	};
 	logger$9.log(`🚀 Starting ${appCount} app(s) — each builds before it answers, and says so when it is ready`);
 	const turboProcess = (0, node_child_process.spawn)("pnpm", [
@@ -1819,6 +2503,7 @@ async function workspaceDevCommand(configured, options) {
 		isShuttingDown = true;
 		logger$9.log("\n🛑 Shutting down workspace...");
 		closeFakes(fakes);
+		discovery.leave();
 		const pid = turboProcess.pid;
 		if (pid) try {
 			process.kill(-pid, "SIGTERM");
@@ -2059,6 +2744,13 @@ start({
 });
 `;
 }
+/**
+* The discovery endpoint's connect URL, Jupyter-style: the token in it is what
+* lets a console read what this machine is running.
+*/
+function announce(discovery) {
+	logger$9.log(`🧭 Discovery: ${discovery.connectUrl}`);
+}
 /** Run `fn` with `console.log` muted — warnings and errors still print. */
 async function quietly(fn) {
 	const log = console.log;
@@ -2156,6 +2848,12 @@ var DevServer = class {
 	}
 	/** What the ready line calls this app. */
 	label = "server";
+	/** Told when the server is ready, reloading, or exits on its own. */
+	onStatus;
+	/** The port it is serving on. */
+	get port() {
+		return this.actualPort;
+	}
 	/**
 	* Where the app is reached — its HTTPS address behind the edge, when it has
 	* one. The local port is only what the edge forwards to.
@@ -2191,9 +2889,11 @@ var DevServer = class {
 		this.serverProcess.on("error", (error) => {
 			logger$9.error("❌ Server error:", error);
 		});
-		this.serverProcess.on("exit", (code, signal) => {
+		const child = this.serverProcess;
+		child.on("exit", (code, signal) => {
 			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$9.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
+			if (this.serverProcess === child) this.onStatus?.("stopped");
 		});
 		await new Promise((resolve) => setTimeout(resolve, 1e3));
 		if (this.isRunning) {
@@ -2207,6 +2907,7 @@ var DevServer = class {
 				...this.databaseApi ? [`db ${this.databaseApi}`] : []
 			];
 			if (tools.length > 0) logger$9.log(`  ${tools.join(" · ")}`);
+			this.onStatus?.("ready");
 		}
 	}
 	async stop() {
@@ -2232,6 +2933,7 @@ var DevServer = class {
 	}
 	async restart() {
 		const portToReuse = this.actualPort;
+		this.onStatus?.("reloading");
 		await this.stop();
 		let attempts = 0;
 		while (attempts < 30) {
@@ -4313,12 +5015,6 @@ function createEmptyState(stage, projectId, environmentId) {
 	};
 }
 /**
-* Get application ID from state
-*/
-function getApplicationId(state, appName) {
-	return state?.applications[appName];
-}
-/**
 * Set application ID in state (mutates state)
 */
 function setApplicationId(state, appName, applicationId) {
@@ -7201,6 +7897,113 @@ function applicationName(identity, app) {
 	return slug$1(app) === identity.project ? `${identity.stage}-${identity.scope}` : (0, _geekmidas_manifest.scopedName)([identity.stage, identity.scope], app);
 }
 //#endregion
+//#region src/deploy/journal.ts
+var DeployJournal = class DeployJournal {
+	store;
+	stage;
+	state;
+	resources;
+	version;
+	existed;
+	constructor(store, stage, state, resources, version, existed) {
+		this.store = store;
+		this.stage = stage;
+		this.state = state;
+		this.resources = resources;
+		this.version = version;
+		this.existed = existed;
+	}
+	/**
+	* The stage's journal — its stored state, or `initial` written as the
+	* stage's first state, so there is somewhere to record the very first
+	* resource before it is created.
+	*/
+	static async open(store, stage, initial) {
+		const stored = await store.read(stage);
+		if (stored) return new DeployJournal(store, stage, stored.state, stored.resources, stored.version, true);
+		const state = initial();
+		const version = await store.write(stage, state, { expectedVersion: null });
+		return new DeployJournal(store, stage, state, {}, version, false);
+	}
+	record(key) {
+		return this.resources[key];
+	}
+	/** The keys a previous run marked `pending` and never saw created. */
+	unfinished() {
+		return Object.values(this.resources).filter((record) => record.status === "pending").map((record) => record.key);
+	}
+	/** Records that `entry` is about to be created. */
+	async pending(entry) {
+		await this.put({
+			...entry,
+			status: "pending"
+		});
+	}
+	/** Records `entry` as existing with `id`; a no-op if it already is. */
+	async ready(entry, id) {
+		const current = this.resources[entry.key];
+		if (current?.status === "ready" && current.id === id) return;
+		await this.put({
+			...entry,
+			status: "ready",
+			id
+		});
+	}
+	/**
+	* The resource `entry` names: by its recorded id, else by looking it up,
+	* else created — with `pending` written before the create and `ready`
+	* after, so a run that dies in between leaves a record the next run
+	* resolves by looking the resource up rather than creating another.
+	*/
+	async ensure(entry, steps) {
+		const record = this.resources[entry.key];
+		let staleId;
+		if (record?.status === "ready" && record.id && steps.get) {
+			const known = await steps.get(record.id);
+			if (known) {
+				await this.ready(entry, steps.id(known));
+				return {
+					resource: known,
+					via: "recorded"
+				};
+			}
+			staleId = record.id;
+		}
+		const existing = await steps.find();
+		if (existing) {
+			await this.ready(entry, steps.id(existing));
+			return {
+				resource: existing,
+				via: record?.status === "pending" ? "resumed" : "found",
+				...staleId ? { staleId } : {}
+			};
+		}
+		await this.pending(entry);
+		const created = await steps.create();
+		await this.ready(entry, steps.id(created));
+		return {
+			resource: created,
+			via: "created",
+			...staleId ? { staleId } : {}
+		};
+	}
+	/** Writes the stage's state, keeping its resource records. */
+	async save() {
+		this.state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.version = await this.store.write(this.stage, this.state, { expectedVersion: this.version });
+	}
+	async put(record) {
+		this.version = await this.store.putResource(this.stage, record, { expectedVersion: this.version });
+		this.resources = {
+			...this.resources,
+			[record.key]: {
+				...record,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		};
+	}
+};
+//#endregion
 //#region src/deploy/ownership.ts
 /**
 * Which Dokploy project a deploy is allowed to deploy into.
@@ -7256,7 +8059,7 @@ async function projectById(api, projectId) {
 * A project that matches by name (in any case) but carries no marker, or
 * another identity's, raises `ProjectNotOwned` — it is never adopted.
 */
-async function resolveProject(api, identity, stateProjectId, log = () => {}) {
+async function resolveProject(api, identity, stateProjectId, log = () => {}, hooks = {}) {
 	const name = projectName(identity);
 	const marker = ownershipMarker(identity);
 	if (stateProjectId) {
@@ -7292,6 +8095,7 @@ async function resolveProject(api, identity, stateProjectId, log = () => {}) {
 	}
 	const clash = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
 	if (clash) throw new ProjectNotOwned(clash.name, clash.projectId, identity.key, markerOf(clash.description));
+	await hooks.beforeCreate?.();
 	const created = await api.createProject(name, withMarker("Deployed by gkm.", marker));
 	return {
 		projectId: created.project.projectId,
@@ -7394,65 +8198,6 @@ async function resolveRegistry(api, options) {
 	return options.create(registry);
 }
 //#endregion
-//#region src/deploy/StateProvider.ts
-/**
-* Check if value is a StateProvider implementation.
-*/
-function isStateProvider(value) {
-	return typeof value === "object" && value !== null && typeof value.read === "function" && typeof value.write === "function";
-}
-/**
-* Create a state provider based on configuration.
-*
-* - 'local': LocalStateProvider (default)
-* - 'ssm': CachedStateProvider with SSM as source of truth
-* - 's3': S3StateStore behind the provider interface
-* - Custom: Use provided StateProvider implementation
-*
-* Deploy moves to `createStateStore` (locks, versions, per-resource records);
-* this stays for the call sites that read and write whole states.
-*/
-async function createStateProvider(options) {
-	const { config, workspaceRoot, workspaceName } = options;
-	if (!config) {
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-7HR6SS2t.cjs"));
-		return new LocalStateProvider(workspaceRoot);
-	}
-	const { isStateStore } = await Promise.resolve().then(() => StateStore_exports);
-	if (isStateStore(config.provider)) {
-		const { StateStoreProvider } = await Promise.resolve().then(() => StateStore_exports);
-		return new StateStoreProvider(config.provider);
-	}
-	if (isStateProvider(config.provider)) return config.provider;
-	const provider = config.provider;
-	if (provider === "local") {
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-7HR6SS2t.cjs"));
-		return new LocalStateProvider(workspaceRoot);
-	}
-	if (provider === "ssm") {
-		if (!workspaceName) {
-			const { StateStoreNeedsWorkspaceName } = await Promise.resolve().then(() => StateStore_exports);
-			throw new StateStoreNeedsWorkspaceName("ssm");
-		}
-		const { LocalStateProvider } = await Promise.resolve().then(() => require("./LocalStateProvider-7HR6SS2t.cjs"));
-		const { SSMStateProvider } = await Promise.resolve().then(() => require("./SSMStateProvider-VrQ-yeqd.cjs"));
-		const { CachedStateProvider } = await Promise.resolve().then(() => CachedStateProvider_exports);
-		const ssmConfig = config;
-		const local = new LocalStateProvider(workspaceRoot);
-		return new CachedStateProvider(SSMStateProvider.create({
-			workspaceName,
-			region: ssmConfig.region,
-			profile: ssmConfig.profile
-		}), local);
-	}
-	if (provider === "s3") {
-		const { createStateStore, StateStoreProvider } = await Promise.resolve().then(() => StateStore_exports);
-		return new StateStoreProvider(await createStateStore(options));
-	}
-	const { UnknownStateProvider } = await Promise.resolve().then(() => StateStore_exports);
-	throw new UnknownStateProvider(config);
-}
-//#endregion
 //#region src/deploy/secrets.ts
 /**
 * Filter secrets to only include the env vars that an app requires.
@@ -8193,6 +8938,28 @@ async function workspaceDeployCommand(configured, options) {
 	});
 	if (dokployApps.length === 0) throw new Error("No apps to deploy. All selected apps have unsupported deploy targets.");
 	appsToDeployNames = dokployApps;
+	const store = await require_StateStore.createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	});
+	const lock = await store.lock(stage, { operation: "deploy" });
+	try {
+		return await deployLocked({
+			workspace,
+			manifest,
+			stage,
+			imageTag,
+			appsToDeployNames,
+			identity,
+			store
+		});
+	} finally {
+		await lock.release();
+	}
+}
+/** Everything a deploy does while it holds the stage's lock. */
+async function deployLocked({ workspace, manifest, stage, imageTag, appsToDeployNames, identity, store }) {
 	logger$4.log("\n🔐 Loading secrets and analyzing environment requirements...");
 	const secretsStore = await require_store.secretsStoreFor(workspace, stage);
 	const stored = await secretsStore.read(stage);
@@ -8234,42 +9001,48 @@ async function workspaceDeployCommand(configured, options) {
 		token: creds.token
 	});
 	logger$4.log("\n📋 Loading deploy state...");
-	const stateProvider = await createStateProvider({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	const previous = await stateProvider.read(stage);
+	const journal = await DeployJournal.open(store, stage, () => createEmptyState(stage, "", ""));
+	const state = journal.state;
+	if (journal.existed) logger$4.log(`   Found existing state for stage "${stage}"`);
+	else logger$4.log(`   Creating new state for stage "${stage}"`);
+	const unfinished = journal.unfinished();
+	if (unfinished.length > 0) logger$4.log(`   ⚠ A previous run stopped while creating: ${unfinished.join(", ")} — looking for them before creating anything`);
 	logger$4.log("\n📁 Setting up Dokploy project...");
 	logger$4.log(`   Identity: ${identity.key}`);
-	const project = await resolveProject(api, identity, previous?.projectId, (message) => logger$4.log(message));
+	const projectEntry = {
+		key: "project",
+		type: "project",
+		data: {
+			name: projectName(identity),
+			identity: identity.key
+		}
+	};
+	const project = await resolveProject(api, identity, state.projectId || void 0, (message) => logger$4.log(message), { beforeCreate: () => journal.pending(projectEntry) });
+	await journal.ready(projectEntry, project.projectId);
 	if (project.via === "created") logger$4.log(`   ✓ Created project: ${project.projectId}`);
 	else logger$4.log(`   Found existing project: ${project.name}`);
-	let environmentId;
-	const matchingEnv = project.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase());
-	if (matchingEnv) {
-		environmentId = matchingEnv.environmentId;
-		logger$4.log(`   Using environment: ${matchingEnv.name}`);
-	} else {
-		logger$4.log(`   Creating "${stage}" environment...`);
-		environmentId = (await api.createEnvironment(project.projectId, stage)).environmentId;
-		logger$4.log(`   ✓ Created environment: ${stage}`);
-	}
-	let state = previous;
-	if (state) {
-		logger$4.log(`   Found existing state for stage "${stage}"`);
-		if (state.projectId !== project.projectId) {
-			logger$4.log(`   ⚠ Project ID changed, updating state`);
-			state.projectId = project.projectId;
-		}
-		if (state.environmentId !== environmentId) {
-			logger$4.log(`   ⚠ Environment ID changed, updating state`);
-			state.environmentId = environmentId;
-		}
-	} else {
-		logger$4.log(`   Creating new state for stage "${stage}"`);
-		state = createEmptyState(stage, project.projectId, environmentId);
-	}
+	const environmentEntry = {
+		key: "environment",
+		type: "environment",
+		data: { name: stage }
+	};
+	const environment = await journal.ensure(environmentEntry, {
+		find: async () => project.environments.find((e) => e.name.toLowerCase() === stage.toLowerCase()),
+		create: () => {
+			logger$4.log(`   Creating "${stage}" environment...`);
+			return api.createEnvironment(project.projectId, stage);
+		},
+		id: (e) => e.environmentId
+	});
+	const environmentId = environment.resource.environmentId;
+	if (environment.via === "created") logger$4.log(`   ✓ Created environment: ${stage}`);
+	else logger$4.log(`   Using environment: ${environment.resource.name}`);
+	if (journal.existed) {
+		if (state.projectId && state.projectId !== project.projectId) logger$4.log(`   ⚠ Project ID changed, updating state`);
+		if (state.environmentId && state.environmentId !== environmentId) logger$4.log(`   ⚠ Environment ID changed, updating state`);
+	}
+	state.projectId = project.projectId;
+	state.environmentId = environmentId;
 	state.identity = identity.key;
 	logger$4.log("\n🐳 Checking registry...");
 	const registry = workspace.deploy.dokploy?.registry;
@@ -8291,6 +9064,7 @@ async function workspaceDeployCommand(configured, options) {
 	const registryId = dokployRegistry.registryId;
 	state.registryId = registryId;
 	logger$4.log(`   Using registry: ${dokployRegistry.registryName}`);
+	await journal.save();
 	const skippedMobileApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "mobile");
 	if (skippedMobileApps.length > 0) logger$4.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
@@ -8348,7 +9122,7 @@ async function workspaceDeployCommand(configured, options) {
 			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
 			const backupRetention = workspace.deploy.backups.retention ?? 30;
 			logger$4.log("   Creating postgres backup schedule...");
-			const backup = await api.createPostgresBackup({
+			setPostgresBackupId(state, (await api.createPostgresBackup({
 				schedule: backupSchedule,
 				prefix: `${stage}/postgres`,
 				destinationId: backupState.destinationId,
@@ -8356,8 +9130,7 @@ async function workspaceDeployCommand(configured, options) {
 				postgresId: backupCluster.postgresId,
 				enabled: true,
 				keepLatestCount: backupRetention
-			});
-			setPostgresBackupId(state, backup.backupId);
+			})).backupId);
 			logger$4.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
 		} else logger$4.log("   ✓ Using existing postgres backup schedule");
 	}
@@ -8378,22 +9151,7 @@ async function workspaceDeployCommand(configured, options) {
 			const app = workspace.apps[appName];
 			logger$4.log(`\n   ⚙️  Deploying ${appName}...`);
 			try {
-				const dokployAppName = applicationName(identity, appName);
-				let application = null;
-				const cachedAppId = getApplicationId(state, appName);
-				if (cachedAppId) {
-					logger$4.log(`      Using cached ID: ${cachedAppId}`);
-					application = await api.getApplication(cachedAppId);
-					if (application) logger$4.log(`      ✓ Application found: ${application.applicationId}`);
-					else logger$4.log(`      ⚠ Cached ID invalid, will create new`);
-				}
-				if (!application) {
-					const result = await api.findOrCreateApplication(dokployAppName, project.projectId, environmentId);
-					application = result.application;
-					if (result.created) logger$4.log(`      Created application: ${application.applicationId}`);
-					else logger$4.log(`      Found existing application: ${application.applicationId}`);
-				}
-				setApplicationId(state, appName, application.applicationId);
+				const application = await ensureApplication(api, journal, appName, applicationName(identity, appName), project.projectId, environmentId);
 				const appSecrets = encryptedSecrets.get(appName);
 				const credentials = appSecrets && appSecrets.secretCount > 0 ? {
 					encrypted: appSecrets.payload.encrypted,
@@ -8417,6 +9175,7 @@ async function workspaceDeployCommand(configured, options) {
 					ref: built.imageRef ?? imageRef$1,
 					...built.digest ? { digest: built.digest } : {}
 				});
+				await journal.save();
 				const backendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, false);
 				const dependencyUrls = {};
 				if (app.dependencies) {
@@ -8451,30 +9210,10 @@ async function workspaceDeployCommand(configured, options) {
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
 				logger$4.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
-				const existingDomain = (await api.getDomainsByApplicationId(application.applicationId)).find((d) => d.host === backendHost);
-				if (existingDomain) {
-					appHostnames.set(appName, backendHost);
-					appDomainIds.set(appName, existingDomain.domainId);
-					publicUrls[appName] = `https://${backendHost}`;
-					logger$4.log(`      ✓ Domain: https://${backendHost} (existing)`);
-				} else try {
-					const domain = await api.createDomain({
-						host: backendHost,
-						port: app.port,
-						https: true,
-						certificateType: "letsencrypt",
-						applicationId: application.applicationId
-					});
-					appHostnames.set(appName, backendHost);
-					appDomainIds.set(appName, domain.domainId);
-					publicUrls[appName] = `https://${backendHost}`;
-					logger$4.log(`      ✓ Domain: https://${backendHost} (created)`);
-				} catch (domainError) {
-					const message = domainError instanceof Error ? domainError.message : "Unknown error";
-					logger$4.log(`      ⚠ Domain creation failed: ${message}`);
-					appHostnames.set(appName, backendHost);
-					publicUrls[appName] = `https://${backendHost}`;
-				}
+				const domainId = await ensureDomain(api, journal, backendHost, app.port, application.applicationId);
+				appHostnames.set(appName, backendHost);
+				if (domainId) appDomainIds.set(appName, domainId);
+				publicUrls[appName] = `https://${backendHost}`;
 				results.push({
 					appName,
 					type: app.type,
@@ -8503,22 +9242,7 @@ async function workspaceDeployCommand(configured, options) {
 			const app = workspace.apps[appName];
 			logger$4.log(`\n   🌐 Deploying ${appName}...`);
 			try {
-				const dokployAppName = applicationName(identity, appName);
-				let application = null;
-				const cachedAppId = getApplicationId(state, appName);
-				if (cachedAppId) {
-					logger$4.log(`      Using cached ID: ${cachedAppId}`);
-					application = await api.getApplication(cachedAppId);
-					if (application) logger$4.log(`      ✓ Application found: ${application.applicationId}`);
-					else logger$4.log(`      ⚠ Cached ID invalid, will create new`);
-				}
-				if (!application) {
-					const result = await api.findOrCreateApplication(dokployAppName, project.projectId, environmentId);
-					application = result.application;
-					if (result.created) logger$4.log(`      Created application: ${application.applicationId}`);
-					else logger$4.log(`      Found existing application: ${application.applicationId}`);
-				}
-				setApplicationId(state, appName, application.applicationId);
+				const application = await ensureApplication(api, journal, appName, applicationName(identity, appName), project.projectId, environmentId);
 				const dependencyUrls = {};
 				if (app.dependencies) {
 					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
@@ -8566,6 +9290,7 @@ async function workspaceDeployCommand(configured, options) {
 					ref: built.imageRef ?? imageRef$2,
 					...built.digest ? { digest: built.digest } : {}
 				});
+				await journal.save();
 				const envVars = [
 					`NODE_ENV=production`,
 					`PORT=${app.port}`,
@@ -8576,30 +9301,10 @@ async function workspaceDeployCommand(configured, options) {
 				await api.saveApplicationEnv(application.applicationId, envVars.join("\n"));
 				logger$4.log(`      Deploying to Dokploy...`);
 				await api.deployApplication(application.applicationId);
-				const existingFrontendDomain = (await api.getDomainsByApplicationId(application.applicationId)).find((d) => d.host === frontendHost);
-				if (existingFrontendDomain) {
-					appHostnames.set(appName, frontendHost);
-					appDomainIds.set(appName, existingFrontendDomain.domainId);
-					publicUrls[appName] = `https://${frontendHost}`;
-					logger$4.log(`      ✓ Domain: https://${frontendHost} (existing)`);
-				} else try {
-					const domain = await api.createDomain({
-						host: frontendHost,
-						port: app.port,
-						https: true,
-						certificateType: "letsencrypt",
-						applicationId: application.applicationId
-					});
-					appHostnames.set(appName, frontendHost);
-					appDomainIds.set(appName, domain.domainId);
-					publicUrls[appName] = `https://${frontendHost}`;
-					logger$4.log(`      ✓ Domain: https://${frontendHost} (created)`);
-				} catch (domainError) {
-					const message = domainError instanceof Error ? domainError.message : "Unknown error";
-					logger$4.log(`      ⚠ Domain creation failed: ${message}`);
-					appHostnames.set(appName, frontendHost);
-					publicUrls[appName] = `https://${frontendHost}`;
-				}
+				const domainId = await ensureDomain(api, journal, frontendHost, app.port, application.applicationId);
+				appHostnames.set(appName, frontendHost);
+				if (domainId) appDomainIds.set(appName, domainId);
+				publicUrls[appName] = `https://${frontendHost}`;
 				results.push({
 					appName,
 					type: app.type,
@@ -8622,14 +9327,14 @@ async function workspaceDeployCommand(configured, options) {
 		}
 	}
 	logger$4.log("\n📋 Saving deploy state...");
-	await stateProvider.write(stage, state);
+	await journal.save();
 	logger$4.log("   ✓ State saved");
 	const dnsConfig = workspace.deploy.dns;
 	if (dnsConfig && appHostnames.size > 0) {
 		const dnsResult = await orchestrateDns(appHostnames, dnsConfig, creds.endpoint);
 		if (dnsResult?.serverIp && appHostnames.size > 0) {
 			await verifyDnsRecords(appHostnames, dnsResult.serverIp, state);
-			await stateProvider.write(stage, state);
+			await journal.save();
 		}
 		if (dnsResult?.success && appHostnames.size > 0) {
 			logger$4.log("\n🔒 Validating domains for SSL certificates...");
@@ -8662,6 +9367,71 @@ async function workspaceDeployCommand(configured, options) {
 	};
 }
 /**
+* An app's Dokploy application, through the journal: by the id recorded for
+* it, else by its name in the stage's environment, else created. Its id goes
+* into `state.applications` too, which the env resolver and `state:show` read.
+*/
+async function ensureApplication(api, journal, appName, dokployAppName, projectId, environmentId) {
+	const recorded = journal.record(`application:${appName}`);
+	if (recorded?.status === "ready" && recorded.id) logger$4.log(`      Using cached ID: ${recorded.id}`);
+	const { resource, via, staleId } = await journal.ensure({
+		key: `application:${appName}`,
+		type: "application",
+		data: { name: dokployAppName }
+	}, {
+		get: (id) => api.getApplication(id),
+		find: () => api.findApplicationByName(projectId, dokployAppName, environmentId),
+		create: () => api.createApplication(dokployAppName, projectId, environmentId),
+		id: (application) => application.applicationId
+	});
+	if (staleId) logger$4.log(`      ⚠ Cached ID invalid, will create new`);
+	logger$4.log(`      ${{
+		recorded: "✓ Application found",
+		resumed: "Resumed application a stopped run created",
+		found: "Found existing application",
+		created: "Created application"
+	}[via]}: ${resource.applicationId}`);
+	setApplicationId(journal.state, appName, resource.applicationId);
+	return resource;
+}
+/**
+* The domain `host` routes to an application, through the journal — found on
+* the application before it is created, so a re-run never adds a second.
+*
+* A domain that cannot be created is reported and skipped rather than
+* failing the app: the application is deployed and reachable on Dokploy's
+* own address, and DNS is fixed by hand more easily than a half deploy.
+*/
+async function ensureDomain(api, journal, host, port, applicationId) {
+	try {
+		const { resource, via } = await journal.ensure({
+			key: `domain:${host}`,
+			type: "domain",
+			data: {
+				host,
+				applicationId
+			}
+		}, {
+			find: async () => (await api.getDomainsByApplicationId(applicationId)).find((d) => d.host === host),
+			create: () => api.createDomain({
+				host,
+				port,
+				https: true,
+				certificateType: "letsencrypt",
+				applicationId
+			}),
+			id: (domain) => domain.domainId
+		});
+		logger$4.log(`      ✓ Domain: https://${host} (${via === "created" ? "created" : "existing"})`);
+		return resource.domainId;
+	} catch (domainError) {
+		if (domainError instanceof require_StateStore.StateVersionConflict || domainError instanceof require_StateStore.StateStoreBusy) throw domainError;
+		const message = domainError instanceof Error ? domainError.message : "Unknown error";
+		logger$4.log(`      ⚠ Domain creation failed: ${message}`);
+		return;
+	}
+}
+/**
 * Main deploy command
 */
 async function deployCommand(options) {
@@ -8798,453 +9568,160 @@ async function deployListCommand(options) {
 	}
 }
 //#endregion
-//#region src/deploy/CachedStateProvider.ts
-var CachedStateProvider_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ CachedStateProvider: () => CachedStateProvider });
-/**
-* Cached state provider that wraps a remote provider with local cache.
-*
-* @deprecated for deploys: a read prefers the local copy, so a stale one wins
-* over the remote without warning, and a write overwrites the remote blindly.
-* Deploy uses `createStateStore`, which reads SSM directly and writes
-* conditionally. Kept for `gkm state:pull | push | diff`.
-*/
-var CachedStateProvider = class {
-	remote;
-	local;
-	constructor(remote, local) {
-		this.remote = remote;
-		this.local = local;
-	}
-	async read(stage) {
-		const localState = await this.local.read(stage);
-		if (localState) return localState;
-		const remoteState = await this.remote.read(stage);
-		if (remoteState) await this.local.write(stage, remoteState);
-		return remoteState;
-	}
-	async write(stage, state) {
-		await this.remote.write(stage, state);
-		await this.local.write(stage, state);
-	}
-	/**
-	* Force pull from remote to local.
-	* Used by `gkm state pull` command.
-	*/
-	async pull(stage) {
-		const remoteState = await this.remote.read(stage);
-		if (remoteState) await this.local.write(stage, remoteState);
-		return remoteState;
-	}
-	/**
-	* Force push from local to remote.
-	* Used by `gkm state push` command.
-	*/
-	async push(stage) {
-		const localState = await this.local.read(stage);
-		if (localState) await this.remote.write(stage, localState);
-		return localState;
-	}
-	/**
-	* Get both local and remote state for comparison.
-	* Used by `gkm state diff` command.
-	*/
-	async diff(stage) {
-		const [local, remote] = await Promise.all([this.local.read(stage), this.remote.read(stage)]);
-		return {
-			local,
-			remote
-		};
-	}
-};
-//#endregion
-//#region src/deploy/StateStore.ts
+//#region src/deploy/LocalStateStore.ts
 /**
-* Deploy state store.
+* Local filesystem state store.
 *
-* `StateProvider` reads and writes a whole stage at once, with nothing to stop
-* two runs of the same stage from overwriting each other and nowhere to record
-* a resource the moment it exists. A `StateStore` adds the three things a
-* deploy needs to be safe against crashes and concurrent runs:
-*
-* - `lock(stage)`: one run per stage. A second gets `StateLocked`, naming the
-*   holder, instead of racing the first.
-* - Versioned `read` and conditional `write`: a write names the version it was
-*   based on, and raises `StateVersionConflict` when the stored state moved on
-*   underneath it, so nothing is lost silently even without the lock.
-* - Per-resource records: `putResource` journals one resource at a time, so a
-*   run that dies half way leaves behind the ids of everything it created.
-*
-* Built-in stores: `LocalStateStore`, `SSMStateStore`, `S3StateStore`. A
-* custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
-* working but cannot lock.
-*/
-var StateStore_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
-	DocumentStateStore: () => DocumentStateStore,
-	STATE_SCHEMA_VERSION: () => 2,
-	StageStateMissing: () => StageStateMissing,
-	StateLocked: () => StateLocked,
-	StateSchemaTooNew: () => StateSchemaTooNew,
-	StateStoreBusy: () => StateStoreBusy,
-	StateStoreNeedsWorkspaceName: () => StateStoreNeedsWorkspaceName,
-	StateStoreProvider: () => StateStoreProvider,
-	StateStoreWithoutLocking: () => StateStoreWithoutLocking,
-	StateUnreadable: () => StateUnreadable,
-	StateVersionConflict: () => StateVersionConflict,
-	UnknownStateProvider: () => UnknownStateProvider,
-	contentVersion: () => contentVersion,
-	createStateStore: () => createStateStore,
-	decodeDocument: () => decodeDocument,
-	encodeDocument: () => encodeDocument,
-	isStateStore: () => isStateStore,
-	migrateV1: () => migrateV1,
-	newLockHolder: () => newLockHolder
-});
-var StateLocked = class extends Error {
-	stage;
-	holder;
-	location;
-	constructor(stage, holder, location) {
-		const by = holder ? `${holder.owner}@${holder.host} (pid ${holder.pid}) since ${holder.acquiredAt}${holder.operation ? ` for '${holder.operation}'` : ""}` : "a run that did not record who it was";
-		super(`Deploy state for stage '${stage}' is locked by ${by} (${location}). Wait for that run to finish; if it crashed, release the lock with \`gkm state:unlock --stage ${stage}\`.`);
-		this.stage = stage;
-		this.holder = holder;
-		this.location = location;
-		this.name = "StateLocked";
-	}
-};
-var StateVersionConflict = class extends Error {
-	stage;
-	expectedVersion;
-	actualVersion;
-	constructor(stage, expectedVersion, actualVersion) {
-		super(`Deploy state for stage '${stage}' changed since it was read (expected ${expectedVersion ? `version ${expectedVersion}` : "no state"}, found ${actualVersion ? `version ${actualVersion}` : "no state"}). Another run wrote it: read the state again and re-apply the change, and hold the stage's lock so runs take turns.`);
-		this.stage = stage;
-		this.expectedVersion = expectedVersion;
-		this.actualVersion = actualVersion;
-		this.name = "StateVersionConflict";
-	}
-};
-var StageStateMissing = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
-		this.stage = stage;
-		this.name = "StageStateMissing";
-	}
-};
-var StateUnreadable = class extends Error {
-	stage;
-	location;
-	constructor(stage, location, cause) {
-		super(`Deploy state for stage '${stage}' at ${location} is not valid JSON. Restore it from a backup (or the provider's history) rather than deploying without it — a deploy without state recreates every resource.`, { cause });
-		this.stage = stage;
-		this.location = location;
-		this.name = "StateUnreadable";
-	}
-};
-var StateSchemaTooNew = class extends Error {
-	stage;
-	schemaVersion;
-	constructor(stage, schemaVersion) {
-		super(`Deploy state for stage '${stage}' has schema version ${String(schemaVersion)}, newer than this @geekmidas/cli understands (2). Upgrade @geekmidas/cli to the version that wrote it.`);
-		this.stage = stage;
-		this.schemaVersion = schemaVersion;
-		this.name = "StateSchemaTooNew";
-	}
-};
+* `.gkm/deploy-<stage>.json` holds the state, `.gkm/deploy-<stage>.lock` the
+* lock. Every file is mode 0600: state holds database passwords and IAM keys.
+*/
+var LocalStateStore_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ LocalStateStore: () => LocalStateStore });
+const FILE_MODE = 384;
+/** How long a write waits for another process's write to finish. */
+const MUTEX_TIMEOUT_MS = 5e3;
 /**
-* Not thrown: emitted (once per store) when a custom `StateProvider` stands
-* in for a store, so a deploy that cannot be protected from a concurrent one
-* says so.
+* A write holds the mutex for milliseconds, so one this old was left by a
+* process that died mid-write and is safe to take over.
 */
-var StateStoreWithoutLocking = class extends Error {
-	provider;
-	constructor(provider) {
-		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
-		this.provider = provider;
-		this.name = "StateStoreWithoutLocking";
+const MUTEX_STALE_MS = 3e4;
+function isCode(error, code) {
+	return error?.code === code;
+}
+var LocalStateStore = class extends require_StateStore.DocumentStateStore {
+	workspaceRoot;
+	constructor(workspaceRoot) {
+		super();
+		this.workspaceRoot = workspaceRoot;
 	}
-};
-var StateStoreNeedsWorkspaceName = class extends Error {
-	provider;
-	constructor(provider) {
-		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
-		this.provider = provider;
-		this.name = "StateStoreNeedsWorkspaceName";
+	get dir() {
+		return (0, node_path.join)(this.workspaceRoot, ".gkm");
 	}
-};
-var UnknownStateProvider = class extends Error {
-	config;
-	constructor(config) {
-		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
-		this.config = config;
-		this.name = "UnknownStateProvider";
+	statePath(stage) {
+		return (0, node_path.join)(this.dir, `deploy-${stage}.json`);
 	}
-};
-/** A lock or write that could not get at the state backend in time. */
-var StateStoreBusy = class extends Error {
-	stage;
-	location;
-	constructor(stage, location) {
-		super(`Timed out waiting to write deploy state for stage '${stage}' (${location}). If no other gkm process is running, remove ${location}.`);
-		this.stage = stage;
-		this.location = location;
-		this.name = "StateStoreBusy";
+	lockPath(stage) {
+		return (0, node_path.join)(this.dir, `deploy-${stage}.lock`);
 	}
-};
-function decodeDocument(stage, body, location) {
-	let parsed;
-	try {
-		parsed = JSON.parse(body);
-	} catch (error) {
-		throw new StateUnreadable(stage, location, error);
+	backupPath(stage) {
+		return (0, node_path.join)(this.dir, `deploy-${stage}.v1.json`);
 	}
-	if (typeof parsed !== "object" || parsed === null) throw new StateUnreadable(stage, location, parsed);
-	const schemaVersion = parsed.schemaVersion;
-	if (schemaVersion === void 0) return {
-		schemaVersion: 1,
-		state: parsed
-	};
-	if (schemaVersion === 2) return {
-		schemaVersion: 2,
-		document: parsed
-	};
-	throw new StateSchemaTooNew(stage, schemaVersion);
-}
-function encodeDocument(document) {
-	return JSON.stringify(document, null, 2);
-}
-/**
-* v1 state as a v2 document. The ids v1 kept are seeded as `ready` records,
-* so the first journaled deploy after an upgrade adopts them rather than
-* treating them as unknown.
-*/
-function migrateV1(stage, state) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const resources = {};
-	const seed = (type, name, id) => {
-		if (!id) return;
-		const key = name ? `${type}:${name}` : type;
-		resources[key] = {
-			key,
-			type,
-			id,
-			status: "ready",
-			updatedAt: now
-		};
-	};
-	seed("project", null, state.projectId);
-	seed("environment", null, state.environmentId);
-	for (const [app, id] of Object.entries(state.applications ?? {})) seed("application", app, id);
-	seed("postgres", null, state.services?.postgresId);
-	seed("redis", null, state.services?.redisId);
-	seed("backup-destination", null, state.backups?.destinationId);
-	return {
-		schemaVersion: 2,
-		stage,
-		serial: 1,
-		state,
-		resources,
-		updatedAt: now
-	};
-}
-function newLockHolder(options) {
-	let owner = "unknown";
-	try {
-		owner = (0, node_os.userInfo)().username;
-	} catch {}
-	return {
-		id: (0, node_crypto.randomUUID)(),
-		owner,
-		host: (0, node_os.hostname)(),
-		pid: process.pid,
-		acquiredAt: (/* @__PURE__ */ new Date()).toISOString(),
-		operation: options?.operation
-	};
-}
-function contentVersion(body) {
-	return (0, node_crypto.createHash)("sha256").update(body).digest("hex").slice(0, 16);
-}
-/**
-* A store over a backend that can read and conditionally write one blob per
-* stage, and create a lock object only if it does not exist. Migration and
-* resource records are the same for every such backend, so they live here.
-*/
-var DocumentStateStore = class {
-	async lock(stage, options) {
-		const holder = newLockHolder(options);
-		await this.createLock(stage, holder);
-		let released = false;
-		return {
-			stage,
-			holder,
-			release: async () => {
-				if (released) return;
-				released = true;
-				await this.removeLock(stage, holder);
-			}
-		};
-	}
-	async forceUnlock(stage) {
-		const holder = await this.readLock(stage);
-		await this.removeLock(stage, null);
-		return holder;
+	mutexPath(stage) {
+		return (0, node_path.join)(this.dir, `deploy-${stage}.json.mutex`);
 	}
-	async read(stage) {
-		const current = await this.readDocument(stage);
-		if (!current) return null;
-		return {
-			state: current.document.state,
-			resources: current.document.resources,
-			version: current.version
-		};
+	location(stage) {
+		return this.statePath(stage);
 	}
-	async write(stage, state, options) {
-		if (options.expectedVersion === null) {
-			const document = {
-				schemaVersion: 2,
-				stage,
-				serial: 1,
-				state,
-				resources: {},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	async readRaw(stage) {
+		try {
+			const body = await (0, node_fs_promises.readFile)(this.statePath(stage), "utf-8");
+			return {
+				body,
+				version: require_StateStore.contentVersion(body)
 			};
-			return this.writeRaw(stage, encodeDocument(document), null);
+		} catch (error) {
+			if (isCode(error, "ENOENT")) return null;
+			throw error;
 		}
-		return this.mutate(stage, options.expectedVersion, (document) => ({
-			...document,
-			state
-		}));
 	}
-	async putResource(stage, record, options) {
-		return this.mutate(stage, options?.expectedVersion, (document) => ({
-			...document,
-			resources: {
-				...document.resources,
-				[record.key]: {
-					...record,
-					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	async writeRaw(stage, body, expectedVersion) {
+		await this.ensureDir();
+		return this.withMutex(stage, async () => {
+			const actual = (await this.readRaw(stage))?.version ?? null;
+			if (actual !== expectedVersion) throw new require_StateStore.StateVersionConflict(stage, expectedVersion, actual);
+			const target = this.statePath(stage);
+			const temp = `${target}.${(0, node_crypto.randomUUID)()}.tmp`;
+			try {
+				const handle = await (0, node_fs_promises.open)(temp, "wx", FILE_MODE);
+				try {
+					await handle.writeFile(body);
+					await handle.sync();
+				} finally {
+					await handle.close();
 				}
+				await (0, node_fs_promises.rename)(temp, target);
+			} catch (error) {
+				await (0, node_fs_promises.rm)(temp, { force: true });
+				throw error;
 			}
-		}));
-	}
-	async deleteResource(stage, key, options) {
-		return this.mutate(stage, options?.expectedVersion, (document) => {
-			const { [key]: _removed, ...resources } = document.resources;
-			return {
-				...document,
-				resources
-			};
+			return require_StateStore.contentVersion(body);
 		});
 	}
-	async mutate(stage, expectedVersion, change) {
-		const current = await this.readDocument(stage);
-		if (!current) {
-			if (expectedVersion !== void 0) throw new StateVersionConflict(stage, expectedVersion, null);
-			throw new StageStateMissing(stage);
+	async writeV1Backup(stage, body) {
+		try {
+			await (0, node_fs_promises.writeFile)(this.backupPath(stage), body, {
+				flag: "wx",
+				mode: FILE_MODE
+			});
+		} catch (error) {
+			if (!isCode(error, "EEXIST")) throw error;
 		}
-		if (expectedVersion !== void 0 && current.version !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, current.version);
-		const next = change(current.document);
-		next.serial = current.document.serial + 1;
-		next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		return this.writeRaw(stage, encodeDocument(next), current.version);
 	}
-	/**
-	* Reads the stage's document, migrating v1 in place on the way. The
-	* migration is itself a conditional write: if another run migrated (or
-	* wrote) first, its result is read instead.
-	*/
-	async readDocument(stage, attempt = 0) {
-		const raw = await this.readRaw(stage);
-		if (!raw) return null;
-		const decoded = decodeDocument(stage, raw.body, this.location(stage));
-		if (decoded.schemaVersion === 2) return {
-			document: decoded.document,
-			version: raw.version
-		};
-		await this.writeV1Backup(stage, raw.body);
-		const document = migrateV1(stage, decoded.state);
+	async createLock(stage, holder) {
+		await this.ensureDir();
+		let handle;
 		try {
-			return {
-				document,
-				version: await this.writeRaw(stage, encodeDocument(document), raw.version)
-			};
+			handle = await (0, node_fs_promises.open)(this.lockPath(stage), "wx", FILE_MODE);
 		} catch (error) {
-			if (error instanceof StateVersionConflict && attempt < 2) return this.readDocument(stage, attempt + 1);
+			if (isCode(error, "EEXIST")) throw new require_StateStore.StateLocked(stage, await this.readLock(stage), this.lockPath(stage));
 			throw error;
 		}
+		try {
+			await handle.writeFile(JSON.stringify(holder, null, 2));
+		} finally {
+			await handle.close();
+		}
 	}
-};
-function isStateStore(value) {
-	return typeof value === "object" && value !== null && typeof value.lock === "function" && typeof value.read === "function" && typeof value.write === "function" && typeof value.putResource === "function";
-}
-/**
-* The store for a workspace's `state` config — the same config
-* `createStateProvider` reads:
-*
-* - none / `'local'`: `LocalStateStore` under `.gkm/`
-* - `'ssm'`: `SSMStateStore`, with no local cache — SSM is read directly, so
-*   a stale local copy can never win over it
-* - `'s3'`: `S3StateStore`
-* - a `StateStore` object: used as is
-* - a `StateProvider` object: wrapped by `LegacyStateStore`
-*/
-async function createStateStore(options) {
-	const { config, workspaceRoot, workspaceName } = options;
-	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-DDDU0HkI.cjs"));
-		return new LocalStateStore(workspaceRoot);
-	}
-	if (isStateStore(config.provider)) return config.provider;
-	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-C_OFs1gN.cjs"));
-		return new LegacyStateStore(config.provider, { warn: options.warn });
-	}
-	if (config.provider === "ssm") {
-		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-DC43R7zG.cjs"));
-		const ssm = config;
-		return SSMStateStore.create({
-			workspaceName,
-			region: ssm.region,
-			profile: ssm.profile
-		});
+	async readLock(stage) {
+		try {
+			return JSON.parse(await (0, node_fs_promises.readFile)(this.lockPath(stage), "utf-8"));
+		} catch {
+			return null;
+		}
 	}
-	if (config.provider === "s3") {
-		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-C7eBae0G.cjs"));
-		const s3 = config;
-		return S3StateStore.create({
-			workspaceName,
-			bucket: s3.bucket,
-			prefix: s3.prefix,
-			region: s3.region,
-			profile: s3.profile
-		});
+	async removeLock(stage, holder) {
+		if (holder) {
+			if ((await this.readLock(stage))?.id !== holder.id) return;
+		}
+		await (0, node_fs_promises.rm)(this.lockPath(stage), { force: true });
 	}
-	throw new UnknownStateProvider(config);
-}
-/**
-* A store behind the `StateProvider` interface, for the call sites that still
-* read and write whole states (deploy, until it journals). A write is still
-* conditional on the version this provider last read.
-*/
-var StateStoreProvider = class {
-	store;
-	versions = /* @__PURE__ */ new Map();
-	constructor(store) {
-		this.store = store;
+	async ensureDir() {
+		await (0, node_fs_promises.mkdir)(this.dir, {
+			recursive: true,
+			mode: 448
+		});
 	}
-	async read(stage) {
-		const stored = await this.store.read(stage);
-		this.versions.set(stage, stored?.version ?? null);
-		return stored?.state ?? null;
+	/**
+	* Serialises the check-then-rename of a conditional write across
+	* processes. The stage lock is for whole runs; this is for the instant of
+	* a single write, so even writers that skip the lock never interleave.
+	*/
+	async withMutex(stage, fn) {
+		const path = this.mutexPath(stage);
+		const deadline = Date.now() + MUTEX_TIMEOUT_MS;
+		for (;;) try {
+			await (await (0, node_fs_promises.open)(path, "wx", FILE_MODE)).close();
+			break;
+		} catch (error) {
+			if (!isCode(error, "EEXIST")) throw error;
+			if (await this.isStale(path)) {
+				await (0, node_fs_promises.unlink)(path).catch(() => {});
+				continue;
+			}
+			if (Date.now() > deadline) throw new require_StateStore.StateStoreBusy(stage, path);
+			await new Promise((resolve) => setTimeout(resolve, 10));
+		}
+		try {
+			return await fn();
+		} finally {
+			await (0, node_fs_promises.rm)(path, { force: true });
+		}
 	}
-	async write(stage, state) {
-		const expectedVersion = this.versions.has(stage) ? this.versions.get(stage) ?? null : (await this.store.read(stage))?.version ?? null;
-		state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		const version = await this.store.write(stage, state, { expectedVersion });
-		this.versions.set(stage, version);
+	async isStale(path) {
+		try {
+			return Date.now() - (await (0, node_fs_promises.stat)(path)).mtimeMs > MUTEX_STALE_MS;
+		} catch {
+			return false;
+		}
 	}
 };
 //#endregion
@@ -9252,7 +9729,12 @@ var StateStoreProvider = class {
 /**
 * State Management CLI Commands
 *
-* Commands for managing deployment state across local and remote providers.
+* Commands for managing deployment state across local and remote stores.
+*
+* Every command goes through a `StateStore`, the same one deploy writes
+* through: a v1 state is migrated on the way, resource records travel with
+* the state, and a copy is a conditional write — so `state:push` cannot
+* silently replace what a deploy wrote a moment earlier.
 */
 /** What `state:show` prints in place of a secret. */
 const MASKED = "********";
@@ -9278,26 +9760,12 @@ function maskStateSecrets(state) {
 */
 async function statePullCommand(options) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	if (!workspace.state || workspace.state.provider === "local") {
-		console.error("No remote state provider configured.");
-		console.error("Add a remote provider in gkm.config.ts:");
-		console.error("  state: { provider: \"ssm\", region: \"us-east-1\" }");
-		process.exit(1);
-	}
-	const provider = await createStateProvider({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	if (!(provider instanceof CachedStateProvider)) {
-		console.error("State provider does not support pull operation.");
-		process.exit(1);
-	}
+	const { local, remote } = await remoteAndLocal(workspace);
 	console.log(`Pulling state for stage: ${options.stage}...`);
-	const state = await provider.pull(options.stage);
-	if (state) {
+	const pulled = await copyUnderLock(remote, local, local, options.stage, "state:pull");
+	if (pulled) {
 		console.log("State pulled successfully.");
-		printStateSummary(state);
+		printStateSummary(pulled.state);
 	} else console.log("No remote state found for this stage.");
 }
 /**
@@ -9306,26 +9774,12 @@ async function statePullCommand(options) {
 */
 async function statePushCommand(options) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	if (!workspace.state || workspace.state.provider === "local") {
-		console.error("No remote state provider configured.");
-		console.error("Add a remote provider in gkm.config.ts:");
-		console.error("  state: { provider: \"ssm\", region: \"us-east-1\" }");
-		process.exit(1);
-	}
-	const provider = await createStateProvider({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	if (!(provider instanceof CachedStateProvider)) {
-		console.error("State provider does not support push operation.");
-		process.exit(1);
-	}
+	const { local, remote } = await remoteAndLocal(workspace);
 	console.log(`Pushing state for stage: ${options.stage}...`);
-	const state = await provider.push(options.stage);
-	if (state) {
+	const pushed = await copyUnderLock(local, remote, remote, options.stage, "state:push");
+	if (pushed) {
 		console.log("State pushed successfully.");
-		printStateSummary(state);
+		printStateSummary(pushed.state);
 	} else console.log("No local state found for this stage.");
 }
 /**
@@ -9334,7 +9788,7 @@ async function statePushCommand(options) {
 */
 async function stateShowCommand(options) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	const stored = await (await createStateProvider({
+	const stored = await (await require_StateStore.createStateStore({
 		config: workspace.state,
 		workspaceRoot: workspace.root,
 		workspaceName: workspace.name
@@ -9343,9 +9797,12 @@ async function stateShowCommand(options) {
 		console.log(`No state found for stage: ${options.stage}`);
 		return;
 	}
-	const state = maskStateSecrets(stored);
+	const state = maskStateSecrets(stored.state);
 	if (options.json) console.log(JSON.stringify(state, null, 2));
-	else printStateDetails(state);
+	else {
+		printStateDetails(state);
+		printUnfinished(stored.resources);
+	}
 }
 /**
 * Release a stage's deploy lock, whoever holds it.
@@ -9357,7 +9814,7 @@ async function stateShowCommand(options) {
 */
 async function stateUnlockCommand(options) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	const holder = await (await createStateStore({
+	const holder = await (await require_StateStore.createStateStore({
 		config: workspace.state,
 		workspaceRoot: workspace.root,
 		workspaceName: workspace.name
@@ -9374,22 +9831,11 @@ async function stateUnlockCommand(options) {
 */
 async function stateDiffCommand(options) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	if (!workspace.state || workspace.state.provider === "local") {
-		console.error("No remote state provider configured.");
-		console.error("Diff requires a remote provider to compare against.");
-		process.exit(1);
-	}
-	const provider = await createStateProvider({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	if (!(provider instanceof CachedStateProvider)) {
-		console.error("State provider does not support diff operation.");
-		process.exit(1);
-	}
+	const stores = await remoteAndLocal(workspace, ["Diff requires a remote provider to compare against."]);
 	console.log(`Comparing state for stage: ${options.stage}...\n`);
-	const { local, remote } = await provider.diff(options.stage);
+	const [localStored, remoteStored] = await Promise.all([stores.local.read(options.stage), stores.remote.read(options.stage)]);
+	const local = localStored?.state ?? null;
+	const remote = remoteStored?.state ?? null;
 	if (!local && !remote) {
 		console.log("No state found (local or remote).");
 		return;
@@ -9425,6 +9871,71 @@ async function stateDiffCommand(options) {
 			else console.log(`  ${key}: ${localVal ?? "(none)"} (local) != ${remoteVal ?? "(none)"} (remote)`);
 		}
 	}
+	const localRecords = localStored?.resources ?? {};
+	const remoteRecords = remoteStored?.resources ?? {};
+	const differing = [.../* @__PURE__ */ new Set([...Object.keys(localRecords), ...Object.keys(remoteRecords)])].filter((key) => describeRecord(localRecords[key]) !== describeRecord(remoteRecords[key]));
+	if (differing.length > 0) {
+		console.log("\nResources:");
+		for (const key of differing) console.log(`  ${key}: ${describeRecord(localRecords[key])} (local) != ${describeRecord(remoteRecords[key])} (remote)`);
+	}
+}
+/**
+* The stage's local store and its remote one — or, for a workspace that keeps
+* state only locally, the reason there is nothing to move it between.
+*/
+async function remoteAndLocal(workspace, hint = ["Add a remote provider in gkm.config.ts:", "  state: { provider: \"ssm\", region: \"us-east-1\" }"]) {
+	if (!workspace.state || workspace.state.provider === "local") {
+		console.error("No remote state provider configured.");
+		for (const line of hint) console.error(line);
+		process.exit(1);
+	}
+	return {
+		local: new LocalStateStore(workspace.root),
+		remote: await require_StateStore.createStateStore({
+			config: workspace.state,
+			workspaceRoot: workspace.root,
+			workspaceName: workspace.name
+		})
+	};
+}
+/**
+* Makes `to` hold exactly what `from` holds for `stage` — its state and its
+* resource records — while holding `locked`'s lock for the stage. Every
+* write is conditional on the version just read, so anything that changes
+* `to` mid-copy raises `StateVersionConflict` rather than being overwritten.
+*/
+async function copyUnderLock(from, to, locked, stage, operation) {
+	const lock = await locked.lock(stage, { operation });
+	try {
+		return await copyStage(from, to, stage);
+	} finally {
+		await lock.release();
+	}
+}
+/** @internal Exported for testing */
+async function copyStage(from, to, stage) {
+	const source = await from.read(stage);
+	if (!source) return null;
+	const target = await to.read(stage);
+	let version = await to.write(stage, source.state, { expectedVersion: target?.version ?? null });
+	for (const key of Object.keys(target?.resources ?? {})) {
+		if (key in source.resources) continue;
+		version = await to.deleteResource(stage, key, { expectedVersion: version });
+	}
+	for (const { updatedAt: _stamped, ...record } of Object.values(source.resources)) version = await to.putResource(stage, record, { expectedVersion: version });
+	return source;
+}
+function describeRecord(record) {
+	if (!record) return "(none)";
+	return record.id ? `${record.status} ${record.id}` : record.status;
+}
+/** Resources a run marked `pending` and never saw created. */
+function printUnfinished(resources) {
+	const pending = Object.values(resources).filter((record) => record.status === "pending");
+	if (pending.length === 0) return;
+	console.log("");
+	console.log("Unfinished (a deploy stopped while creating these):");
+	for (const record of pending) console.log(`  ${record.key}`);
 }
 function printStateSummary(state) {
 	const appCount = Object.keys(state.applications).length;
@@ -10472,25 +10983,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.58",
-	"@geekmidas/auth": "~10.0.0-alpha.58",
-	"@geekmidas/cache": "~10.0.0-alpha.58",
-	"@geekmidas/client": "~10.0.0-alpha.58",
-	"@geekmidas/cloud": "~10.0.0-alpha.58",
-	"@geekmidas/constructs": "~10.0.0-alpha.58",
-	"@geekmidas/db": "~10.0.0-alpha.58",
-	"@geekmidas/emailkit": "~10.0.0-alpha.58",
-	"@geekmidas/envkit": "~10.0.0-alpha.58",
-	"@geekmidas/errors": "~10.0.0-alpha.58",
-	"@geekmidas/events": "~10.0.0-alpha.58",
-	"@geekmidas/logger": "~10.0.0-alpha.58",
-	"@geekmidas/manifest": "~10.0.0-alpha.58",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.58",
-	"@geekmidas/schema": "~10.0.0-alpha.58",
-	"@geekmidas/services": "~10.0.0-alpha.58",
-	"@geekmidas/storage": "~10.0.0-alpha.58",
-	"@geekmidas/telescope": "~10.0.0-alpha.58",
-	"@geekmidas/testkit": "~10.0.0-alpha.58",
+	"@geekmidas/audit": "~10.0.0-alpha.59",
+	"@geekmidas/auth": "~10.0.0-alpha.59",
+	"@geekmidas/cache": "~10.0.0-alpha.59",
+	"@geekmidas/client": "~10.0.0-alpha.59",
+	"@geekmidas/cloud": "~10.0.0-alpha.59",
+	"@geekmidas/constructs": "~10.0.0-alpha.59",
+	"@geekmidas/db": "~10.0.0-alpha.59",
+	"@geekmidas/emailkit": "~10.0.0-alpha.59",
+	"@geekmidas/envkit": "~10.0.0-alpha.59",
+	"@geekmidas/errors": "~10.0.0-alpha.59",
+	"@geekmidas/events": "~10.0.0-alpha.59",
+	"@geekmidas/logger": "~10.0.0-alpha.59",
+	"@geekmidas/manifest": "~10.0.0-alpha.59",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.59",
+	"@geekmidas/schema": "~10.0.0-alpha.59",
+	"@geekmidas/services": "~10.0.0-alpha.59",
+	"@geekmidas/storage": "~10.0.0-alpha.59",
+	"@geekmidas/telescope": "~10.0.0-alpha.59",
+	"@geekmidas/testkit": "~10.0.0-alpha.59",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -16372,7 +16883,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-DzYqA-e3.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-CThJfVHR.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-DXNviAh-.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -16803,7 +17314,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-DzYqA-e3.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-CThJfVHR.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16817,7 +17328,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-DzYqA-e3.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-CThJfVHR.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16831,7 +17342,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-DzYqA-e3.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-CThJfVHR.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16929,7 +17440,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-BspqzZIb.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-BP8zfxEJ.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16940,7 +17451,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-BspqzZIb.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-BP8zfxEJ.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16992,7 +17503,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-B14L2TrY.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-Dbn07ILl.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -17051,7 +17562,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-mQorSS36.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-DHpDMBT7.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -17186,19 +17697,18 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 });
 program.parse();
 //#endregion
-exports.DocumentStateStore = DocumentStateStore;
-exports.StageStateMissing = StageStateMissing;
-exports.StateLocked = StateLocked;
-exports.StateStoreBusy = StateStoreBusy;
-exports.StateStoreWithoutLocking = StateStoreWithoutLocking;
-exports.StateVersionConflict = StateVersionConflict;
+Object.defineProperty(exports, "LocalStateStore_exports", {
+	enumerable: true,
+	get: function() {
+		return LocalStateStore_exports;
+	}
+});
 Object.defineProperty(exports, "appPorts_exports", {
 	enumerable: true,
 	get: function() {
 		return appPorts_exports;
 	}
 });
-exports.contentVersion = contentVersion;
 Object.defineProperty(exports, "encryption_exports", {
 	enumerable: true,
 	get: function() {
@@ -17207,7 +17717,6 @@ Object.defineProperty(exports, "encryption_exports", {
 });
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
 exports.getHostingerToken = getHostingerToken;
-exports.newLockHolder = newLockHolder;
 exports.slug = slug;
 exports.stamp = stamp;