@geekmidas/cli 10.0.0-alpha.62 → 10.0.0-alpha.64

package/dist/index.mjs

@@ -1,20 +1,23 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { $ as quoteIdentifier, At as getDokployCredentials, B as run$1, Ct as loadEnvFiles, Dt as logoutCommand, Et as loginCommand, G as derivedContainers, H as FAKE_ENV, I as withGeneratedSecrets, J as LOCAL_CA_PATH, K as reconcileWorkspace, Mt as getDokployToken, P as createStateStore, Q as postgresStatements, St as isPortAvailable, Tt as prepareEntryCredentials, U as backendsOf$1, V as runOutput, W as constructGlobs, X as applyPostgres, Y as forgetState, Z as postgresDatabaseNames, _t as primaryPortKey, at as localRolePassword, bt as createEntryWrapper, c as dockerCommand, ct as hostFor, d as generateDockerignore, dt as providerOf, et as composeFor, f as generateSlimDockerfile, g as createEmptyState, gt as portKeys, h as resolveHost, ht as fakeKey, it as envFor, jt as getDokployRegistryId, kt as whoamiCommand, l as siteDockerfile, lt as cacheBackendFor, m as isMainFrontendApp, mt as describeServices, n as sniffAppEnvironment, nt as appEnvKeys, ot as planFor, p as validateImageRef, pt as DEFAULT_IMAGES, r as DokployApi, rt as networkEnv, s as appPackageName$1, tt as pgClient, u as detectPackageManager$2, vt as withOwningTsconfigJsx, wt as loadSecretsForApp, xt as findAvailablePort, yt as createCredentialsPreload, z as keyFingerprint } from "./sniffer-DHE2Nafd.mjs";
-import { i as ConstructGenerator, t as discover } from "./discover-FrYvzkeC.mjs";
-import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-Bf4-bROQ.mjs";
-import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, k as stageProblems, o as getAppGkmConfig, t as allConstructGlobs } from "./workspace-BFe57es7.mjs";
+import { $ as pgClient, B as FAKE_ENV, Ct as loginCommand, Et as whoamiCommand, H as constructGlobs, I as withGeneratedSecrets, J as applyPostgres, K as LOCAL_CA_PATH, P as createStateStore, Q as composeFor, St as prepareEntryCredentials, U as derivedContainers, V as backendsOf$1, W as reconcileWorkspace, X as postgresStatements, Y as postgresDatabaseNames, Z as quoteIdentifier, _t as createEntryWrapper, bt as loadEnvFiles, c as dockerCommand, d as generateDockerignore, dt as DEFAULT_IMAGES, et as appEnvKeys, f as generateSlimDockerfile, ft as describeServices, g as createEmptyState, gt as createCredentialsPreload, h as resolveHost, ht as primaryPortKey, it as planFor, l as siteDockerfile, lt as providerOf, m as isMainFrontendApp, mt as portKeys, n as sniffAppEnvironment, nt as envFor, ot as hostFor, p as validateImageRef, pt as fakeKey, q as forgetState, r as DokployApi, rt as localRolePassword, s as appPackageName$1, st as cacheBackendFor, tt as networkEnv, u as detectPackageManager$1, vt as findAvailablePort, wt as logoutCommand, xt as loadSecretsForApp, yt as isPortAvailable, z as keyFingerprint } from "./sniffer-49KPbDgq.mjs";
+import { c as runOutput, d as getDokployRegistryId, f as getDokployToken, i as CommandFailed, o as DEFAULT_TIMEOUT_MS, s as run$1, t as LocalSandbox, u as getDokployCredentials } from "./local-Cd8ZYQG3.mjs";
+import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-LMrqsWSU.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, k as stageProblems, o as getAppGkmConfig, t as allConstructGlobs } from "./workspace-Bwit4q9O.mjs";
+import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
 import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
-import { a as getKeyPath, f as imageRef, i as FileSecretsStore, n as secretsStoreFor, s as projectKey, u as deployIdentity } from "./store-BS8A7NcA.mjs";
-import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-q5B0z8Xg.mjs";
+import { a as getKeyPath, f as imageRef, i as FileSecretsStore, n as secretsStoreFor, s as projectKey, u as deployIdentity } from "./store-BaaonhkJ.mjs";
+import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-C6v-IeHt.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { n as DEFAULT_CACHE, r as DEFAULT_EVENTS } from "./fakes-C9RiT6XG.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-DQIy21W5.mjs";
+import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-bQfu9GES.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-B51rnfgn.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-Cy1ZBW7U.mjs";
+import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$2, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
 import { createRequire } from "node:module";
-import { basename, dirname, extname, isAbsolute, join, parse, relative, resolve } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { Command } from "commander";
 import { existsSync, linkSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { appendFile, chmod, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -22,13 +25,13 @@ import { homedir } from "node:os";
 import { promisify } from "node:util";
 import { DATABASE_FOLDERS, MIGRATIONS_ROOT, canonicalId, kebabCase, migrationFolder, migrationTargets, provideKey, provisionOrder, publicEnvFor, schemeBase, serviceKey } from "@geekmidas/manifest";
 import fg from "fast-glob";
+import { pathToFileURL } from "node:url";
 import { execFile, execSync, spawn } from "node:child_process";
 import chokidar from "chokidar";
 import { connect } from "node:net";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { pathToFileURL } from "node:url";
 import pg from "pg";
-import { parse as parse$1, parseDocument, stringify } from "yaml";
+import { parseDocument, stringify } from "yaml";
 import prompts from "prompts";
 import { createServer as createServer$1 } from "node:http";
 import { Readable } from "node:stream";
@@ -41,7 +44,7 @@ import { Function } from "@geekmidas/constructs/functions";
 import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.62";
+var version = "10.0.0-alpha.64";
 //#endregion
 //#region src/trust/index.ts
 /**
@@ -1845,9 +1848,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$6.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$6.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-BoHMqdCu.mjs");
+		const { prepareDevDatabases } = await import("./migrate-B4gngTLe.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-BoHMqdCu.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-B4gngTLe.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$6.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3227,7 +3230,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = join(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await import("./bundler-DN5r4x5b.mjs");
+			const { bundleServer } = await import("./bundler-DYgm9xsd.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3365,7 +3368,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$5.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-DN5r4x5b.mjs");
+			const { bundleServer } = await import("./bundler-DYgm9xsd.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3405,7 +3408,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 * Detect available package manager.
 * @internal Exported for testing
 */
-function detectPackageManager$1() {
+function detectPackageManager() {
 	if (existsSync("pnpm-lock.yaml")) return "pnpm";
 	if (existsSync("yarn.lock")) return "yarn";
 	return "npm";
@@ -3524,18 +3527,25 @@ async function workspaceBuildCommand(workspace, options) {
 		});
 		const { filters, unpackaged } = turboFilters(workspace, { exclude: "backend" });
 		if (unpackaged.length > 0) throw new Error(`No package.json for workspace app(s): ${unpackaged.join(", ")}. Each app needs one — turbo builds packages, and gkm reads the name back to know which app it is building.`);
-		const pm = detectPackageManager$1();
+		const pm = detectPackageManager();
 		const [turboBin, turboArgs] = getTurboArgs(pm, filters, { only: true });
 		if (filters.length > 0) {
 			logger$5.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
 			logger$5.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
-			await run$1(turboBin, turboArgs, {
+			const sandbox = options.sandbox ?? new LocalSandbox({
+				root: workspace.root,
+				passEnv: ["TURBO_TOKEN"]
+			});
+			const built = await sandbox.exec(turboBin, turboArgs, {
 				cwd: workspace.root,
 				env: {
-					...process.env,
+					...sandbox.env,
 					NODE_ENV: options.production ? "production" : "development"
-				}
+				},
+				timeoutMs: DEFAULT_TIMEOUT_MS,
+				output: "inherit"
 			});
+			if (built.exitCode !== 0) throw new CommandFailed(turboBin, turboArgs, built.exitCode, built.signal);
 		}
 		for (const [appName, app] of apps) {
 			const outputPath = getAppOutputPath(workspace, appName, app);
@@ -4860,7 +4870,7 @@ async function composeCommand(options = {}, deps = {}) {
 	const mode = options.build || !options.pull && !options.tag ? "build" : "pull";
 	const tag = options.tag ?? (mode === "pull" ? "latest" : await revision(root));
 	const { secrets, keep } = await stageSecrets(workspace, manifest, stage);
-	const packageManager = detectPackageManager$2(root);
+	const packageManager = detectPackageManager$1(root);
 	const stack = composeStack({
 		workspace,
 		manifest,
@@ -6473,25 +6483,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.62",
-	"@geekmidas/auth": "~10.0.0-alpha.62",
-	"@geekmidas/cache": "~10.0.0-alpha.62",
-	"@geekmidas/client": "~10.0.0-alpha.62",
-	"@geekmidas/cloud": "~10.0.0-alpha.62",
-	"@geekmidas/constructs": "~10.0.0-alpha.62",
-	"@geekmidas/db": "~10.0.0-alpha.62",
-	"@geekmidas/emailkit": "~10.0.0-alpha.62",
-	"@geekmidas/envkit": "~10.0.0-alpha.62",
-	"@geekmidas/errors": "~10.0.0-alpha.62",
-	"@geekmidas/events": "~10.0.0-alpha.62",
-	"@geekmidas/logger": "~10.0.0-alpha.62",
-	"@geekmidas/manifest": "~10.0.0-alpha.62",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.62",
-	"@geekmidas/schema": "~10.0.0-alpha.62",
-	"@geekmidas/services": "~10.0.0-alpha.62",
-	"@geekmidas/storage": "~10.0.0-alpha.62",
-	"@geekmidas/telescope": "~10.0.0-alpha.62",
-	"@geekmidas/testkit": "~10.0.0-alpha.62",
+	"@geekmidas/audit": "~10.0.0-alpha.64",
+	"@geekmidas/auth": "~10.0.0-alpha.64",
+	"@geekmidas/cache": "~10.0.0-alpha.64",
+	"@geekmidas/client": "~10.0.0-alpha.64",
+	"@geekmidas/cloud": "~10.0.0-alpha.64",
+	"@geekmidas/constructs": "~10.0.0-alpha.64",
+	"@geekmidas/db": "~10.0.0-alpha.64",
+	"@geekmidas/emailkit": "~10.0.0-alpha.64",
+	"@geekmidas/envkit": "~10.0.0-alpha.64",
+	"@geekmidas/errors": "~10.0.0-alpha.64",
+	"@geekmidas/events": "~10.0.0-alpha.64",
+	"@geekmidas/logger": "~10.0.0-alpha.64",
+	"@geekmidas/manifest": "~10.0.0-alpha.64",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.64",
+	"@geekmidas/schema": "~10.0.0-alpha.64",
+	"@geekmidas/services": "~10.0.0-alpha.64",
+	"@geekmidas/storage": "~10.0.0-alpha.64",
+	"@geekmidas/telescope": "~10.0.0-alpha.64",
+	"@geekmidas/testkit": "~10.0.0-alpha.64",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7174,8 +7184,10 @@ ${pm.setup}
       - name: Install
         run: ${pm.install}
 ${stageSecrets}
+      # Builds, releases and health-checks the stage through deploy.default
+      # in gkm.config.ts, and fails the job if any of it fails.
       - name: Deploy
-        run: ${pm.run} "deploy:$STAGE"
+        run: ${pm.exec} gkm deploy --stage "$STAGE"
         env:
           STAGE: \${{ matrix.stage }}${deployEnv}
 `;
@@ -8028,7 +8040,7 @@ function deployPackage(options) {
 		case "sst": {
 			const v = GEEKMIDAS_VERSIONS;
 			return {
-				scripts: perStage(options, (stage) => `gkm build && sst deploy --stage ${stage}`),
+				scripts: perStage(options, (stage) => `gkm deploy --stage ${stage}`),
 				dependencies: {
 					"@geekmidas/cloud": v["@geekmidas/cloud"],
 					"@geekmidas/db": v["@geekmidas/db"],
@@ -8071,7 +8083,7 @@ function generateDeployFiles(options) {
  * constructs the application declares, through \`fromManifest\`. What is here
  * is what varies by stage, and the inputs a declaration cannot carry.
  *
- * Deploy with \`pnpm run deploy:<stage>\`, which builds the manifest first.
+ * Deploy with \`gkm deploy --stage <stage>\`, which builds the manifest first.
  */
 const region = '${options.region}';
 
@@ -8105,7 +8117,7 @@ ${hasDatabase ? "    const vpc = new sst.aws.Vpc('Vpc', { nat: 'ec2' });\n\n" :
       hostedZoneId: '',
     });
 
-    return fromManifest(
+    const provisioned = fromManifest(
       new Stack(app, '${canonicalId(options.name)}'),
       constructs,
       {
@@ -8113,6 +8125,15 @@ ${inputs.join("\n")}
       },
       backends,
     );
+
+    // Each surface's URL, by its id: SST prints these and writes them to
+    // .sst/outputs.json, where \`gkm deploy\` reads them to health-check
+    // what it released.
+    return Object.fromEntries(
+      Object.entries(constructs)
+        .filter(([, c]) => c.kind === 'rest-api' || c.kind === 'site')
+        .map(([id]) => [id, provisioned[id]!.provides().url]),
+    );
   },
 });
 `
@@ -8523,7 +8544,7 @@ ${workspaceConstructsGlobs(options.routesStructure, dirname(options.apiPath)).ma
 function deployBlock(options) {
 	if (options.deployTarget !== "sst") return "";
 	return `
-  // Deployed with \`sst deploy\`, from the manifest \`gkm build\` writes to
+  // \`gkm deploy\` runs \`sst deploy\` on the manifest \`gkm build\` writes to
   // \`.gkm/manifest/aws.ts\`. Each construct becomes a managed AWS resource.
   deploy: { default: 'sst' },
 `;
@@ -11152,155 +11173,6 @@ function isFullstackTemplate(name) {
 	return name === "fullstack";
 }
 //#endregion
-//#region src/init/utils.ts
-/**
-* Detect the package manager being used based on lockfiles or npm_config_user_agent
-*/
-function detectPackageManager(cwd = process.cwd()) {
-	if (existsSync(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-	if (existsSync(join(cwd, "yarn.lock"))) return "yarn";
-	if (existsSync(join(cwd, "bun.lockb"))) return "bun";
-	if (existsSync(join(cwd, "package-lock.json"))) return "npm";
-	const userAgent = process.env.npm_config_user_agent || "";
-	if (userAgent.includes("pnpm")) return "pnpm";
-	if (userAgent.includes("yarn")) return "yarn";
-	if (userAgent.includes("bun")) return "bun";
-	return "npm";
-}
-/** `gkm init`'s flags, which a name can swallow when a space goes missing. */
-const INIT_FLAGS = [
-	"yes",
-	"name",
-	"template",
-	"monorepo",
-	"api-path",
-	"pm",
-	"skip-install"
-];
-/**
-* Validate project name for npm package naming conventions
-*/
-function validateProjectName(name) {
-	if (!name) return "Project name is required";
-	if (!/^[a-z0-9-_@/.]+$/i.test(name)) return "Project name can only contain letters, numbers, hyphens, underscores, @, /, and .";
-	const flag = name.match(/--(\w[\w-]*)$/)?.[1];
-	if (flag && INIT_FLAGS.includes(flag)) return `"${name}" ends in the --${flag} flag. Did you mean \`${name.slice(0, -(flag.length + 2))} --${flag}\`?`;
-	if ([
-		"node_modules",
-		".git",
-		"package.json",
-		"src"
-	].includes(name.toLowerCase())) return `"${name}" is a reserved name`;
-	return true;
-}
-/**
-* Check if a directory already exists at the target path
-*/
-function checkDirectoryExists(name, cwd = process.cwd()) {
-	const targetPath = join(cwd, name);
-	if (existsSync(targetPath)) return `Directory "${name}" already exists`;
-	return true;
-}
-/**
-* Get the install command for a package manager
-*/
-function getInstallCommand(pkgManager) {
-	switch (pkgManager) {
-		case "pnpm": return "pnpm install";
-		case "yarn": return "yarn";
-		case "bun": return "bun install";
-		default: return "npm install";
-	}
-}
-/**
-* Get the dev command for a package manager
-*/
-function getRunCommand(pkgManager, script) {
-	switch (pkgManager) {
-		case "pnpm": return `pnpm ${script}`;
-		case "yarn": return `yarn ${script}`;
-		case "bun": return `bun run ${script}`;
-		default: return `npm run ${script}`;
-	}
-}
-/**
-* Run a binary the project installed, through its package manager — so it is
-* the project's own version, not whatever \`npx\` would fetch.
-*/
-function getExecCommand(pkgManager, command) {
-	switch (pkgManager) {
-		case "pnpm": return `pnpm exec ${command}`;
-		case "yarn": return `yarn ${command}`;
-		case "bun": return `bunx ${command}`;
-		default: return `npx --no-install ${command}`;
-	}
-}
-const lockfileByPm = {
-	pnpm: "pnpm-lock.yaml",
-	yarn: "yarn.lock",
-	npm: "package-lock.json",
-	bun: "bun.lockb"
-};
-/**
-* Find the workspace/project root by walking up from cwd.
-* Checks for PM-specific workspace config, package.json#workspaces,
-* and lockfiles.
-*/
-function findWorkspaceRoot(cwd, pm) {
-	let dir = cwd;
-	const root = parse(dir).root;
-	const lockfile = lockfileByPm[pm];
-	while (dir !== root) {
-		if (pm === "pnpm" && existsSync(join(dir, "pnpm-workspace.yaml"))) return dir;
-		const pkgJsonPath = join(dir, "package.json");
-		if (existsSync(pkgJsonPath)) try {
-			if (JSON.parse(readFileSync(pkgJsonPath, "utf-8")).workspaces) return dir;
-		} catch {}
-		if (existsSync(join(dir, lockfile))) return dir;
-		dir = dirname(dir);
-	}
-	return cwd;
-}
-/**
-* Get workspace package glob patterns from pnpm-workspace.yaml
-* or package.json#workspaces.
-*/
-function getWorkspaceGlobs(root) {
-	const pnpmWorkspacePath = join(root, "pnpm-workspace.yaml");
-	if (existsSync(pnpmWorkspacePath)) {
-		const content = readFileSync(pnpmWorkspacePath, "utf-8");
-		return parse$1(content)?.packages ?? [];
-	}
-	const rootPkgJsonPath = join(root, "package.json");
-	if (existsSync(rootPkgJsonPath)) {
-		const pkg = JSON.parse(readFileSync(rootPkgJsonPath, "utf-8"));
-		if (Array.isArray(pkg.workspaces)) return pkg.workspaces;
-		if (pkg.workspaces?.packages) return pkg.workspaces.packages;
-	}
-	return [];
-}
-/**
-* Find all package.json files across a workspace.
-* Returns the root package.json plus all workspace member package.json paths.
-*/
-function findWorkspacePackages(cwd, pm) {
-	const workspaceRoot = findWorkspaceRoot(cwd, pm);
-	const results = [];
-	const rootPkgJson = join(workspaceRoot, "package.json");
-	if (existsSync(rootPkgJson)) results.push(rootPkgJson);
-	const globs = getWorkspaceGlobs(workspaceRoot);
-	for (const glob of globs) {
-		const pattern = `${glob}/package.json`;
-		const matches = fg.sync(pattern, {
-			cwd: workspaceRoot,
-			absolute: true,
-			ignore: ["**/node_modules/**"]
-		});
-		results.push(...matches);
-	}
-	return [...new Set(results)];
-}
-//#endregion
 //#region src/init/index.ts
 /** `' staging, prod '` → `['staging', 'prod']`. */
 const stageList = (value) => value.split(",").map((name) => name.trim()).filter(Boolean);
@@ -11311,7 +11183,7 @@ const AWS_REGION = /^[a-z]{2}(-gov)?-[a-z]+-\d$/;
 */
 async function initCommand(projectName, options = {}) {
 	const cwd = process.cwd();
-	const detectedPkgManager = detectPackageManager(cwd);
+	const detectedPkgManager = detectPackageManager$2(cwd);
 	if (options.deploy && !deployTargetChoices.some((choice) => choice.value === options.deploy)) throw new UnknownDeployTarget(options.deploy, deployTargetChoices.map((c) => c.value));
 	if (options.region && !AWS_REGION.test(options.region)) throw new NotAnAwsRegion(options.region);
 	if (options.stages || options.localStage || options.protectedStage) {
@@ -11657,7 +11529,7 @@ function printNextSteps(projectName, options, pkgManager) {
 	}
 	if (options.deployTarget === "sst") {
 		console.log("🚀 Deployment (AWS, through SST):");
-		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}  # gkm build, then sst deploy`);
+		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}  # gkm deploy: build, sst deploy, health checks`);
 		console.log(`  Uses your AWS credentials, in ${options.region}.`);
 		if (options.constructs.mail) console.log("  Set MAIL_FROM to a sender verified in SES first.");
 		console.log("");
@@ -12392,8 +12264,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-BoHMqdCu.mjs");
-	const { discover } = await import("./discover-FrYvzkeC.mjs").then((n) => n.n);
+	const { migrateAndSeed } = await import("./migrate-B4gngTLe.mjs");
+	const { discover } = await import("./discover-LMrqsWSU.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
 		patterns: constructGlobs(workspace),
@@ -12551,7 +12423,7 @@ function withVersion(range, version) {
 }
 async function upgradeCommand(options = {}) {
 	const cwd = process.cwd();
-	const pm = detectPackageManager(cwd);
+	const pm = detectPackageManager$2(cwd);
 	const root = findWorkspaceRoot(cwd, pm);
 	logger.log("\n📦 Scanning workspace for @geekmidas packages...\n");
 	logger.log(`  Package manager: ${pm}`);
@@ -12823,7 +12695,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-BoHMqdCu.mjs");
+		const { migrateCommand } = await import("./migrate-B4gngTLe.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12837,7 +12709,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-BoHMqdCu.mjs");
+		const { seedCommand } = await import("./migrate-B4gngTLe.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12851,7 +12723,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-BoHMqdCu.mjs");
+		const { migrationCommand } = await import("./migrate-B4gngTLe.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -12959,7 +12831,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-CVwvGbsL.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-CKHjMpCr.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12970,7 +12842,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-CVwvGbsL.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-CKHjMpCr.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -13013,7 +12885,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./store-BS8A7NcA.mjs").then((n) => n.r);
+		const { secretsStoreFor } = await import("./store-BaaonhkJ.mjs").then((n) => n.r);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -13022,7 +12894,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./sniffer-DHE2Nafd.mjs").then((n) => n.q);
+		const { derivedContainers } = await import("./sniffer-49KPbDgq.mjs").then((n) => n.G);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -13036,8 +12908,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		process.exit(1);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp)").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").action(async (options) => {
-	const { deployCli } = await import("./cli-DYwxmfsW.mjs");
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp)").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").action(async (options) => {
+	const { deployCli } = await import("./cli-Bogz-zEj.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -13070,7 +12942,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-BCB3_LBX.mjs");
+		const { deployGithubCommand } = await import("./github-D-byNI7T.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));