@geekmidas/cli 10.0.0-alpha.62 → 10.0.0-alpha.64

package/dist/index.cjs

@@ -1,19 +1,22 @@
 #!/usr/bin/env -S npx tsx
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_sniffer = require("./sniffer-BsfPa-GA.cjs");
-const require_discover = require("./discover-Bc-4eA_p.cjs");
-const require_config = require("./config-BYh9S0cZ.cjs");
-const require_workspace = require("./workspace-B6zQO6RY.cjs");
+const require_sniffer = require("./sniffer-ByhbEW5A.cjs");
+const require_local = require("./local-C7wnrcYK.cjs");
+const require_discover = require("./discover-DHdECueV.cjs");
+const require_derive = require("./derive-DAbo49sm.cjs");
+const require_workspace = require("./workspace-BwgWJK7h.cjs");
+const require_config = require("./config.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
-const require_store = require("./store-KvNQwYaB.cjs");
-const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BSrgw7B0.cjs");
+const require_store = require("./store-D_2ByRtW.cjs");
+const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BWuDRHe9.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
-const require_ready = require("./ready-XlNx-Gbo.cjs");
+const require_ready = require("./ready-brEhh68f.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
-const require_LocalStateStore = require("./LocalStateStore-COW3Ldwa.cjs");
+const require_LocalStateStore = require("./LocalStateStore-DiJqKyPy.cjs");
+const require_utils = require("./utils-D2Nk1Nv2.cjs");
 let node_path = require("node:path");
 let commander = require("commander");
 let node_fs = require("node:fs");
@@ -23,13 +26,13 @@ let node_util = require("node:util");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let fast_glob = require("fast-glob");
 fast_glob = require_rolldown_runtime.__toESM(fast_glob, 1);
-let node_child_process = require("node:child_process");
 let node_module = require("node:module");
+let node_url = require("node:url");
+let node_child_process = require("node:child_process");
 let chokidar = require("chokidar");
 chokidar = require_rolldown_runtime.__toESM(chokidar, 1);
 let node_net = require("node:net");
 let node_crypto = require("node:crypto");
-let node_url = require("node:url");
 let pg = require("pg");
 pg = require_rolldown_runtime.__toESM(pg, 1);
 let yaml = require("yaml");
@@ -47,7 +50,7 @@ let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions")
 let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.62";
+var version = "10.0.0-alpha.64";
 //#endregion
 //#region src/trust/index.ts
 /**
@@ -1515,7 +1518,7 @@ async function devCommand(options) {
 			for (const line of require_sniffer.describeServices(reconciled.services)) logger$6.log(line);
 		}
 		Object.assign(appSecrets, reconciled.env);
-		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_config.appKey(r.id) === workspaceAppName);
+		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_derive.appKey(r.id) === workspaceAppName);
 		publicUrl = own ? reconciled.env[own.envKey] : void 0;
 		manifest = reconciled.manifest;
 	}
@@ -1851,9 +1854,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$6.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$6.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-dnaFMvOm.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-dnaFMvOm.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$6.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -1884,14 +1887,14 @@ async function workspaceDevCommand(configured, options) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
 		if (app.type === "mobile") {
-			const own = reconciled.plan.resources.find((r) => r.kind === "mobile-app" && require_config.appKey(r.id) === appName);
+			const own = reconciled.plan.resources.find((r) => r.kind === "mobile-app" && require_derive.appKey(r.id) === appName);
 			const scheme = own ? reconciled.env[own.envKey] : void 0;
 			const device = Object.entries(reconciled.env).find(([key]) => key.endsWith("_DEVICE_URL"))?.[1];
 			logger$6.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
 			continue;
 		}
 		const local = `http://localhost:${app.port}`;
-		const url = Object.entries(appUrls).find(([id]) => require_config.appKey(id) === appName)?.[1];
+		const url = Object.entries(appUrls).find(([id]) => require_derive.appKey(id) === appName)?.[1];
 		logger$6.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
 	}
 	logger$6.log("");
@@ -1921,7 +1924,7 @@ async function workspaceDevCommand(configured, options) {
 		apps: buildOrder.flatMap((name) => {
 			const app = workspace.apps[name];
 			if (!app) return [];
-			const publicUrl = Object.entries(appUrls).find(([id]) => require_config.appKey(id) === name)?.[1];
+			const publicUrl = Object.entries(appUrls).find(([id]) => require_derive.appKey(id) === name)?.[1];
 			return [{
 				name,
 				type: app.type,
@@ -2068,7 +2071,7 @@ var EntryRunner = class {
 		const env = {
 			...process.env,
 			PORT: String(this.port),
-			NODE_OPTIONS: require_sniffer.withOwningTsconfigJsx(process.env.NODE_OPTIONS)
+			NODE_OPTIONS: require_discover.withOwningTsconfigJsx(process.env.NODE_OPTIONS)
 		};
 		this.childProcess = (0, node_child_process.spawn)(...tsxCommand((0, node_path.dirname)(this.wrapperPath), [this.wrapperPath]), {
 			stdio: "inherit",
@@ -2338,7 +2341,7 @@ var DevServer = class {
 				...process.env,
 				NODE_ENV: "development",
 				GKM_DEV_PID: String(process.pid),
-				NODE_OPTIONS: require_sniffer.withOwningTsconfigJsx(process.env.NODE_OPTIONS)
+				NODE_OPTIONS: require_discover.withOwningTsconfigJsx(process.env.NODE_OPTIONS)
 			},
 			detached: true
 		});
@@ -3233,7 +3236,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = (0, node_path.join)(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CfH9frOS.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C8uJf324.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3371,7 +3374,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$5.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CfH9frOS.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C8uJf324.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3411,7 +3414,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 * Detect available package manager.
 * @internal Exported for testing
 */
-function detectPackageManager$1() {
+function detectPackageManager() {
 	if ((0, node_fs.existsSync)("pnpm-lock.yaml")) return "pnpm";
 	if ((0, node_fs.existsSync)("yarn.lock")) return "yarn";
 	return "npm";
@@ -3530,18 +3533,25 @@ async function workspaceBuildCommand(workspace, options) {
 		});
 		const { filters, unpackaged } = turboFilters(workspace, { exclude: "backend" });
 		if (unpackaged.length > 0) throw new Error(`No package.json for workspace app(s): ${unpackaged.join(", ")}. Each app needs one — turbo builds packages, and gkm reads the name back to know which app it is building.`);
-		const pm = detectPackageManager$1();
+		const pm = detectPackageManager();
 		const [turboBin, turboArgs] = getTurboArgs(pm, filters, { only: true });
 		if (filters.length > 0) {
 			logger$5.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
 			logger$5.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
-			await require_sniffer.run(turboBin, turboArgs, {
+			const sandbox = options.sandbox ?? new require_local.LocalSandbox({
+				root: workspace.root,
+				passEnv: ["TURBO_TOKEN"]
+			});
+			const built = await sandbox.exec(turboBin, turboArgs, {
 				cwd: workspace.root,
 				env: {
-					...process.env,
+					...sandbox.env,
 					NODE_ENV: options.production ? "production" : "development"
-				}
+				},
+				timeoutMs: require_local.DEFAULT_TIMEOUT_MS,
+				output: "inherit"
 			});
+			if (built.exitCode !== 0) throw new require_local.CommandFailed(turboBin, turboArgs, built.exitCode, built.signal);
 		}
 		for (const [appName, app] of apps) {
 			const outputPath = getAppOutputPath(workspace, appName, app);
@@ -4164,7 +4174,7 @@ const dockerCompose = {
 		};
 	},
 	async build(stack, services) {
-		await require_sniffer.run("docker", compose(stack, ["build", ...services]), {
+		await require_local.run("docker", compose(stack, ["build", ...services]), {
 			cwd: stack.cwd,
 			env: {
 				...process.env,
@@ -4173,10 +4183,10 @@ const dockerCompose = {
 		});
 	},
 	async pull(stack, services) {
-		await require_sniffer.run("docker", compose(stack, ["pull", ...services]), { cwd: stack.cwd });
+		await require_local.run("docker", compose(stack, ["pull", ...services]), { cwd: stack.cwd });
 	},
 	async up(stack, services) {
-		await require_sniffer.run("docker", compose(stack, [
+		await require_local.run("docker", compose(stack, [
 			"up",
 			"-d",
 			"--wait",
@@ -4186,10 +4196,10 @@ const dockerCompose = {
 		]), { cwd: stack.cwd });
 	},
 	async down(stack) {
-		await require_sniffer.run("docker", compose(stack, ["down"]), { cwd: stack.cwd });
+		await require_local.run("docker", compose(stack, ["down"]), { cwd: stack.cwd });
 	},
 	async port(stack, service, inside) {
-		const output = await require_sniffer.runOutput("docker", compose(stack, [
+		const output = await require_local.runOutput("docker", compose(stack, [
 			"port",
 			service,
 			String(inside)
@@ -4200,7 +4210,7 @@ const dockerCompose = {
 	},
 	async copyOut(stack, service, from, to) {
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
-		await require_sniffer.run("docker", compose(stack, [
+		await require_local.run("docker", compose(stack, [
 			"cp",
 			`${service}:${from}`,
 			to
@@ -4619,7 +4629,7 @@ function stackApps(workspace, manifest, plan, options) {
 	const resources = new Map(plan.resources.map((r) => [r.id, r]));
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
-		const name = require_config.appKey(id);
+		const name = require_derive.appKey(id);
 		const app = workspace.apps[name];
 		const resource = resources.get(id);
 		if (!app || !resource || !app.port) continue;
@@ -4784,7 +4794,7 @@ var EdgePortInvalid = class extends Error {
 async function gitRevision(root) {
 	let sha;
 	try {
-		sha = (await require_sniffer.runOutput("git", [
+		sha = (await require_local.runOutput("git", [
 			"rev-parse",
 			"--short",
 			"HEAD"
@@ -4793,7 +4803,7 @@ async function gitRevision(root) {
 		throw new NoGitRevision(root);
 	}
 	if (!sha) throw new NoGitRevision(root);
-	return (await require_sniffer.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+	return (await require_local.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
 }
 /**
 * Bundle a backend with the gkm that is running — the same build a deploy
@@ -4802,7 +4812,7 @@ async function gitRevision(root) {
 async function bundleWithThisCli(appRoot) {
 	const entry = process.argv[1];
 	if (!entry) return;
-	await require_sniffer.run(process.execPath, [
+	await require_local.run(process.execPath, [
 		...process.execArgv,
 		entry,
 		"build",
@@ -5098,7 +5108,7 @@ const logger$3 = console;
 * Get the Dokploy API token from stored credentials or environment
 */
 async function getApiToken() {
-	const token = await require_sniffer.getDokployToken();
+	const token = await require_local.getDokployToken();
 	if (!token) throw new Error("Dokploy credentials not found.\nRun \"gkm login --service dokploy\" to authenticate, or set DOKPLOY_API_TOKEN.");
 	return token;
 }
@@ -5107,7 +5117,7 @@ async function getApiToken() {
 */
 async function getEndpoint(providedEndpoint) {
 	if (providedEndpoint) return providedEndpoint;
-	const stored = await require_sniffer.getDokployCredentials();
+	const stored = await require_local.getDokployCredentials();
 	if (stored) return stored.endpoint;
 	throw new Error("Dokploy endpoint not specified.\nEither run \"gkm login --service dokploy\" first, or provide --endpoint.");
 }
@@ -5210,7 +5220,7 @@ async function deployListCommand(options) {
 			logger$3.log("   Run \"gkm registry:setup\" to configure a registry");
 			return;
 		}
-		const storedRegistryId = await require_sniffer.getDokployRegistryId();
+		const storedRegistryId = await require_local.getDokployRegistryId();
 		for (const registry of registries) {
 			const marker = registry.registryId === storedRegistryId ? " (default)" : "";
 			logger$3.log(`\n   ${registry.registryName}${marker} (${registry.registryId})`);
@@ -6479,25 +6489,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.62",
-	"@geekmidas/auth": "~10.0.0-alpha.62",
-	"@geekmidas/cache": "~10.0.0-alpha.62",
-	"@geekmidas/client": "~10.0.0-alpha.62",
-	"@geekmidas/cloud": "~10.0.0-alpha.62",
-	"@geekmidas/constructs": "~10.0.0-alpha.62",
-	"@geekmidas/db": "~10.0.0-alpha.62",
-	"@geekmidas/emailkit": "~10.0.0-alpha.62",
-	"@geekmidas/envkit": "~10.0.0-alpha.62",
-	"@geekmidas/errors": "~10.0.0-alpha.62",
-	"@geekmidas/events": "~10.0.0-alpha.62",
-	"@geekmidas/logger": "~10.0.0-alpha.62",
-	"@geekmidas/manifest": "~10.0.0-alpha.62",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.62",
-	"@geekmidas/schema": "~10.0.0-alpha.62",
-	"@geekmidas/services": "~10.0.0-alpha.62",
-	"@geekmidas/storage": "~10.0.0-alpha.62",
-	"@geekmidas/telescope": "~10.0.0-alpha.62",
-	"@geekmidas/testkit": "~10.0.0-alpha.62",
+	"@geekmidas/audit": "~10.0.0-alpha.64",
+	"@geekmidas/auth": "~10.0.0-alpha.64",
+	"@geekmidas/cache": "~10.0.0-alpha.64",
+	"@geekmidas/client": "~10.0.0-alpha.64",
+	"@geekmidas/cloud": "~10.0.0-alpha.64",
+	"@geekmidas/constructs": "~10.0.0-alpha.64",
+	"@geekmidas/db": "~10.0.0-alpha.64",
+	"@geekmidas/emailkit": "~10.0.0-alpha.64",
+	"@geekmidas/envkit": "~10.0.0-alpha.64",
+	"@geekmidas/errors": "~10.0.0-alpha.64",
+	"@geekmidas/events": "~10.0.0-alpha.64",
+	"@geekmidas/logger": "~10.0.0-alpha.64",
+	"@geekmidas/manifest": "~10.0.0-alpha.64",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.64",
+	"@geekmidas/schema": "~10.0.0-alpha.64",
+	"@geekmidas/services": "~10.0.0-alpha.64",
+	"@geekmidas/storage": "~10.0.0-alpha.64",
+	"@geekmidas/telescope": "~10.0.0-alpha.64",
+	"@geekmidas/testkit": "~10.0.0-alpha.64",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7180,8 +7190,10 @@ ${pm.setup}
       - name: Install
         run: ${pm.install}
 ${stageSecrets}
+      # Builds, releases and health-checks the stage through deploy.default
+      # in gkm.config.ts, and fails the job if any of it fails.
       - name: Deploy
-        run: ${pm.run} "deploy:$STAGE"
+        run: ${pm.exec} gkm deploy --stage "$STAGE"
         env:
           STAGE: \${{ matrix.stage }}${deployEnv}
 `;
@@ -8034,7 +8046,7 @@ function deployPackage(options) {
 		case "sst": {
 			const v = GEEKMIDAS_VERSIONS;
 			return {
-				scripts: perStage(options, (stage) => `gkm build && sst deploy --stage ${stage}`),
+				scripts: perStage(options, (stage) => `gkm deploy --stage ${stage}`),
 				dependencies: {
 					"@geekmidas/cloud": v["@geekmidas/cloud"],
 					"@geekmidas/db": v["@geekmidas/db"],
@@ -8077,7 +8089,7 @@ function generateDeployFiles(options) {
  * constructs the application declares, through \`fromManifest\`. What is here
  * is what varies by stage, and the inputs a declaration cannot carry.
  *
- * Deploy with \`pnpm run deploy:<stage>\`, which builds the manifest first.
+ * Deploy with \`gkm deploy --stage <stage>\`, which builds the manifest first.
  */
 const region = '${options.region}';
 
@@ -8111,7 +8123,7 @@ ${hasDatabase ? "    const vpc = new sst.aws.Vpc('Vpc', { nat: 'ec2' });\n\n" :
       hostedZoneId: '',
     });
 
-    return fromManifest(
+    const provisioned = fromManifest(
       new Stack(app, '${(0, _geekmidas_manifest.canonicalId)(options.name)}'),
       constructs,
       {
@@ -8119,6 +8131,15 @@ ${inputs.join("\n")}
       },
       backends,
     );
+
+    // Each surface's URL, by its id: SST prints these and writes them to
+    // .sst/outputs.json, where \`gkm deploy\` reads them to health-check
+    // what it released.
+    return Object.fromEntries(
+      Object.entries(constructs)
+        .filter(([, c]) => c.kind === 'rest-api' || c.kind === 'site')
+        .map(([id]) => [id, provisioned[id]!.provides().url]),
+    );
   },
 });
 `
@@ -8529,7 +8550,7 @@ ${workspaceConstructsGlobs(options.routesStructure, (0, node_path.dirname)(optio
 function deployBlock(options) {
 	if (options.deployTarget !== "sst") return "";
 	return `
-  // Deployed with \`sst deploy\`, from the manifest \`gkm build\` writes to
+  // \`gkm deploy\` runs \`sst deploy\` on the manifest \`gkm build\` writes to
   // \`.gkm/manifest/aws.ts\`. Each construct becomes a managed AWS resource.
   deploy: { default: 'sst' },
 `;
@@ -11158,155 +11179,6 @@ function isFullstackTemplate(name) {
 	return name === "fullstack";
 }
 //#endregion
-//#region src/init/utils.ts
-/**
-* Detect the package manager being used based on lockfiles or npm_config_user_agent
-*/
-function detectPackageManager(cwd = process.cwd()) {
-	if ((0, node_fs.existsSync)((0, node_path.join)(cwd, "pnpm-lock.yaml"))) return "pnpm";
-	if ((0, node_fs.existsSync)((0, node_path.join)(cwd, "yarn.lock"))) return "yarn";
-	if ((0, node_fs.existsSync)((0, node_path.join)(cwd, "bun.lockb"))) return "bun";
-	if ((0, node_fs.existsSync)((0, node_path.join)(cwd, "package-lock.json"))) return "npm";
-	const userAgent = process.env.npm_config_user_agent || "";
-	if (userAgent.includes("pnpm")) return "pnpm";
-	if (userAgent.includes("yarn")) return "yarn";
-	if (userAgent.includes("bun")) return "bun";
-	return "npm";
-}
-/** `gkm init`'s flags, which a name can swallow when a space goes missing. */
-const INIT_FLAGS = [
-	"yes",
-	"name",
-	"template",
-	"monorepo",
-	"api-path",
-	"pm",
-	"skip-install"
-];
-/**
-* Validate project name for npm package naming conventions
-*/
-function validateProjectName(name) {
-	if (!name) return "Project name is required";
-	if (!/^[a-z0-9-_@/.]+$/i.test(name)) return "Project name can only contain letters, numbers, hyphens, underscores, @, /, and .";
-	const flag = name.match(/--(\w[\w-]*)$/)?.[1];
-	if (flag && INIT_FLAGS.includes(flag)) return `"${name}" ends in the --${flag} flag. Did you mean \`${name.slice(0, -(flag.length + 2))} --${flag}\`?`;
-	if ([
-		"node_modules",
-		".git",
-		"package.json",
-		"src"
-	].includes(name.toLowerCase())) return `"${name}" is a reserved name`;
-	return true;
-}
-/**
-* Check if a directory already exists at the target path
-*/
-function checkDirectoryExists(name, cwd = process.cwd()) {
-	const targetPath = (0, node_path.join)(cwd, name);
-	if ((0, node_fs.existsSync)(targetPath)) return `Directory "${name}" already exists`;
-	return true;
-}
-/**
-* Get the install command for a package manager
-*/
-function getInstallCommand(pkgManager) {
-	switch (pkgManager) {
-		case "pnpm": return "pnpm install";
-		case "yarn": return "yarn";
-		case "bun": return "bun install";
-		default: return "npm install";
-	}
-}
-/**
-* Get the dev command for a package manager
-*/
-function getRunCommand(pkgManager, script) {
-	switch (pkgManager) {
-		case "pnpm": return `pnpm ${script}`;
-		case "yarn": return `yarn ${script}`;
-		case "bun": return `bun run ${script}`;
-		default: return `npm run ${script}`;
-	}
-}
-/**
-* Run a binary the project installed, through its package manager — so it is
-* the project's own version, not whatever \`npx\` would fetch.
-*/
-function getExecCommand(pkgManager, command) {
-	switch (pkgManager) {
-		case "pnpm": return `pnpm exec ${command}`;
-		case "yarn": return `yarn ${command}`;
-		case "bun": return `bunx ${command}`;
-		default: return `npx --no-install ${command}`;
-	}
-}
-const lockfileByPm = {
-	pnpm: "pnpm-lock.yaml",
-	yarn: "yarn.lock",
-	npm: "package-lock.json",
-	bun: "bun.lockb"
-};
-/**
-* Find the workspace/project root by walking up from cwd.
-* Checks for PM-specific workspace config, package.json#workspaces,
-* and lockfiles.
-*/
-function findWorkspaceRoot(cwd, pm) {
-	let dir = cwd;
-	const root = (0, node_path.parse)(dir).root;
-	const lockfile = lockfileByPm[pm];
-	while (dir !== root) {
-		if (pm === "pnpm" && (0, node_fs.existsSync)((0, node_path.join)(dir, "pnpm-workspace.yaml"))) return dir;
-		const pkgJsonPath = (0, node_path.join)(dir, "package.json");
-		if ((0, node_fs.existsSync)(pkgJsonPath)) try {
-			if (JSON.parse((0, node_fs.readFileSync)(pkgJsonPath, "utf-8")).workspaces) return dir;
-		} catch {}
-		if ((0, node_fs.existsSync)((0, node_path.join)(dir, lockfile))) return dir;
-		dir = (0, node_path.dirname)(dir);
-	}
-	return cwd;
-}
-/**
-* Get workspace package glob patterns from pnpm-workspace.yaml
-* or package.json#workspaces.
-*/
-function getWorkspaceGlobs(root) {
-	const pnpmWorkspacePath = (0, node_path.join)(root, "pnpm-workspace.yaml");
-	if ((0, node_fs.existsSync)(pnpmWorkspacePath)) {
-		const content = (0, node_fs.readFileSync)(pnpmWorkspacePath, "utf-8");
-		return (0, yaml.parse)(content)?.packages ?? [];
-	}
-	const rootPkgJsonPath = (0, node_path.join)(root, "package.json");
-	if ((0, node_fs.existsSync)(rootPkgJsonPath)) {
-		const pkg = JSON.parse((0, node_fs.readFileSync)(rootPkgJsonPath, "utf-8"));
-		if (Array.isArray(pkg.workspaces)) return pkg.workspaces;
-		if (pkg.workspaces?.packages) return pkg.workspaces.packages;
-	}
-	return [];
-}
-/**
-* Find all package.json files across a workspace.
-* Returns the root package.json plus all workspace member package.json paths.
-*/
-function findWorkspacePackages(cwd, pm) {
-	const workspaceRoot = findWorkspaceRoot(cwd, pm);
-	const results = [];
-	const rootPkgJson = (0, node_path.join)(workspaceRoot, "package.json");
-	if ((0, node_fs.existsSync)(rootPkgJson)) results.push(rootPkgJson);
-	const globs = getWorkspaceGlobs(workspaceRoot);
-	for (const glob of globs) {
-		const pattern = `${glob}/package.json`;
-		const matches = fast_glob.default.sync(pattern, {
-			cwd: workspaceRoot,
-			absolute: true,
-			ignore: ["**/node_modules/**"]
-		});
-		results.push(...matches);
-	}
-	return [...new Set(results)];
-}
-//#endregion
 //#region src/init/index.ts
 /** `' staging, prod '` → `['staging', 'prod']`. */
 const stageList = (value) => value.split(",").map((name) => name.trim()).filter(Boolean);
@@ -11317,7 +11189,7 @@ const AWS_REGION = /^[a-z]{2}(-gov)?-[a-z]+-\d$/;
 */
 async function initCommand(projectName, options = {}) {
 	const cwd = process.cwd();
-	const detectedPkgManager = detectPackageManager(cwd);
+	const detectedPkgManager = require_utils.detectPackageManager(cwd);
 	if (options.deploy && !deployTargetChoices.some((choice) => choice.value === options.deploy)) throw new UnknownDeployTarget(options.deploy, deployTargetChoices.map((c) => c.value));
 	if (options.region && !AWS_REGION.test(options.region)) throw new NotAnAwsRegion(options.region);
 	if (options.stages || options.localStage || options.protectedStage) {
@@ -11344,9 +11216,9 @@ async function initCommand(projectName, options = {}) {
 			message: "Project name:",
 			initial: "my-app",
 			validate: (value) => {
-				const nameValid = validateProjectName(value);
+				const nameValid = require_utils.validateProjectName(value);
 				if (nameValid !== true) return nameValid;
-				const dirValid = checkDirectoryExists(value, cwd);
+				const dirValid = require_utils.checkDirectoryExists(value, cwd);
 				if (dirValid !== true) return dirValid;
 				return true;
 			}
@@ -11454,12 +11326,12 @@ async function initCommand(projectName, options = {}) {
 	}
 	if (projectName || options.name) {
 		const nameToValidate = projectName || options.name;
-		const nameValid = validateProjectName(nameToValidate);
+		const nameValid = require_utils.validateProjectName(nameToValidate);
 		if (nameValid !== true) {
 			console.error(nameValid);
 			process.exit(1);
 		}
-		const dirValid = checkDirectoryExists(nameToValidate, cwd);
+		const dirValid = require_utils.checkDirectoryExists(nameToValidate, cwd);
 		if (dirValid !== true) {
 			console.error(dirValid);
 			process.exit(1);
@@ -11565,7 +11437,7 @@ async function initCommand(projectName, options = {}) {
 	if (!options.skipInstall) {
 		console.log("\n📦 Installing dependencies...\n");
 		try {
-			(0, node_child_process.execSync)(getInstallCommand(pkgManager), {
+			(0, node_child_process.execSync)(require_utils.getInstallCommand(pkgManager), {
 				cwd: targetDir,
 				stdio: "inherit"
 			});
@@ -11573,12 +11445,12 @@ async function initCommand(projectName, options = {}) {
 			console.error("Failed to install dependencies");
 		}
 		try {
-			(0, node_child_process.execSync)(getExecCommand(pkgManager, "biome check --write ."), {
+			(0, node_child_process.execSync)(require_utils.getExecCommand(pkgManager, "biome check --write ."), {
 				cwd: targetDir,
 				stdio: "inherit"
 			});
 		} catch {
-			console.warn(`\n⚠️  Formatting did not finish cleanly. Run ${getRunCommand(pkgManager, "fmt")} to see why.`);
+			console.warn(`\n⚠️  Formatting did not finish cleanly. Run ${require_utils.getRunCommand(pkgManager, "fmt")} to see why.`);
 		}
 	}
 	console.log("\n📦 Initializing git repository...\n");
@@ -11609,7 +11481,7 @@ async function initCommand(projectName, options = {}) {
 * Print success message with next steps
 */
 function printNextSteps(projectName, options, pkgManager) {
-	const devCommand = getRunCommand(pkgManager, "dev");
+	const devCommand = require_utils.getRunCommand(pkgManager, "dev");
 	const cdCommand = `cd ${projectName}`;
 	console.log(`\n${"─".repeat(50)}`);
 	console.log("\n✅ Project created successfully!\n");
@@ -11658,12 +11530,12 @@ function printNextSteps(projectName, options, pkgManager) {
 	console.log("");
 	if (options.deployTarget === "dokploy") {
 		console.log("🚀 Deployment:");
-		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}`);
+		for (const stage of deployed) console.log(`  ${require_utils.getRunCommand(pkgManager, `deploy:${stage}`)}`);
 		console.log("");
 	}
 	if (options.deployTarget === "sst") {
 		console.log("🚀 Deployment (AWS, through SST):");
-		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}  # gkm build, then sst deploy`);
+		for (const stage of deployed) console.log(`  ${require_utils.getRunCommand(pkgManager, `deploy:${stage}`)}  # gkm deploy: build, sst deploy, health checks`);
 		console.log(`  Uses your AWS credentials, in ${options.region}.`);
 		if (options.constructs.mail) console.log("  Set MAIL_FROM to a sender verified in SES first.");
 		console.log("");
@@ -12398,8 +12270,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-dnaFMvOm.cjs"));
-	const { discover } = await Promise.resolve().then(() => require("./discover-Bc-4eA_p.cjs")).then((n) => n.discover_exports);
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs"));
+	const { discover } = await Promise.resolve().then(() => require("./discover-DHdECueV.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
 		patterns: require_sniffer.constructGlobs(workspace),
@@ -12557,11 +12429,11 @@ function withVersion(range, version) {
 }
 async function upgradeCommand(options = {}) {
 	const cwd = process.cwd();
-	const pm = detectPackageManager(cwd);
-	const root = findWorkspaceRoot(cwd, pm);
+	const pm = require_utils.detectPackageManager(cwd);
+	const root = require_utils.findWorkspaceRoot(cwd, pm);
 	logger.log("\n📦 Scanning workspace for @geekmidas packages...\n");
 	logger.log(`  Package manager: ${pm}`);
-	const packageJsons = findWorkspacePackages(cwd, pm);
+	const packageJsons = require_utils.findWorkspacePackages(cwd, pm);
 	const occurrences = [...packageOccurrences(packageJsons), ...catalogOccurrences(root)];
 	logger.log(`  Found ${packageJsons.length} package(s) in workspace\n`);
 	const ours = occurrences.filter((o) => o.name.startsWith(SCOPE) && !isIndirect(o.range));
@@ -12672,7 +12544,7 @@ function applyChanges(changes) {
 	}
 }
 function install(pm, cwd) {
-	const command = getInstallCommand(pm);
+	const command = require_utils.getInstallCommand(pm);
 	logger.log(`\n  Running: ${command}\n`);
 	try {
 		(0, node_child_process.execSync)(command, {
@@ -12829,7 +12701,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-dnaFMvOm.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12843,7 +12715,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-dnaFMvOm.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12857,7 +12729,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-dnaFMvOm.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -12965,7 +12837,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-ChBk3hTj.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-C9X98u2F.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12976,7 +12848,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-ChBk3hTj.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-C9X98u2F.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -13019,7 +12891,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./store-KvNQwYaB.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./store-D_2ByRtW.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -13028,7 +12900,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./sniffer-BsfPa-GA.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./sniffer-ByhbEW5A.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -13042,8 +12914,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		process.exit(1);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp)").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-DOAUp80L.cjs"));
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp)").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").action(async (options) => {
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-D3jofJ6j.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -13076,7 +12948,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-OUgPDlqg.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-Dd3tMa1u.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));