@geekmidas/cli 10.0.0-alpha.64 → 10.0.0-alpha.66

package/dist/index.cjs

@@ -1,24 +1,28 @@
 #!/usr/bin/env -S npx tsx
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_sniffer = require("./sniffer-ByhbEW5A.cjs");
-const require_local = require("./local-C7wnrcYK.cjs");
-const require_discover = require("./discover-DHdECueV.cjs");
+const require_local = require("./local-BdH4XN0E.cjs");
+const require_credentials = require("./credentials-Bzbg23n8.cjs");
+const require_discover = require("./discover-OEfZ9OkA.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-BwgWJK7h.cjs");
+const require_workspace = require("./workspace-ON-bqiJz.cjs");
 const require_config = require("./config.cjs");
-const require_storage = require("./storage-CSGoC3bK.cjs");
-const require_store = require("./store-D_2ByRtW.cjs");
-const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BWuDRHe9.cjs");
+const require_state = require("./state-Y6ATakMX.cjs");
+const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-B2zrdyP4.cjs");
+const require_sniffer = require("./sniffer-5xmrkh2a.cjs");
 const require_openapi = require("./openapi.cjs");
-const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
-const require_ready = require("./ready-brEhh68f.cjs");
+const require_ready = require("./ready-B6uHr4sm.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
-const require_LocalStateStore = require("./LocalStateStore-DiJqKyPy.cjs");
+const require_deploy = require("./deploy-B7aJi_Ah.cjs");
+const require_compose = require("./compose-jrLy7KGO.cjs");
+const require_LocalStateStore = require("./LocalStateStore-BVUexSvu.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
 let node_path = require("node:path");
 let commander = require("commander");
+let node_process = require("node:process");
+let node_readline_promises = require("node:readline/promises");
+node_readline_promises = require_rolldown_runtime.__toESM(node_readline_promises, 1);
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
@@ -33,8 +37,6 @@ let chokidar = require("chokidar");
 chokidar = require_rolldown_runtime.__toESM(chokidar, 1);
 let node_net = require("node:net");
 let node_crypto = require("node:crypto");
-let pg = require("pg");
-pg = require_rolldown_runtime.__toESM(pg, 1);
 let yaml = require("yaml");
 let prompts = require("prompts");
 prompts = require_rolldown_runtime.__toESM(prompts, 1);
@@ -50,7 +52,192 @@ let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions")
 let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.64";
+var version = "10.0.0-alpha.66";
+//#endregion
+//#region src/prompt.ts
+/**
+* Asking the person at the terminal.
+*
+* CLI layer only: a command's action may prompt, nothing it calls may. A
+* library call (`deploy()`) that needs something it was not given raises a
+* named error instead, and the command decides whether to ask.
+*/
+/** A prompt was needed with no terminal to ask at. */
+var PromptNeedsTerminal = class extends Error {
+	question;
+	instead;
+	constructor(question, instead) {
+		super(`Interactive input required. ${instead}`);
+		this.question = question;
+		this.instead = instead;
+		this.name = "PromptNeedsTerminal";
+	}
+};
+/** Whether there is a person at a terminal to ask. */
+function canPrompt() {
+	return process.stdin.isTTY === true;
+}
+/**
+* Ask `message` and resolve with the line typed — without echoing it when
+* `hidden`. Ctrl+C at a hidden prompt exits, as it would anywhere else in a
+* terminal program: raw mode has taken the signal away from the shell.
+*/
+async function prompt(message, options) {
+	if (!canPrompt()) throw new PromptNeedsTerminal(message, options.instead);
+	if (options.hidden) {
+		process.stdout.write(message);
+		return new Promise((resolve, reject) => {
+			let value = "";
+			const cleanup = () => {
+				process.stdin.setRawMode(false);
+				process.stdin.pause();
+				process.stdin.removeListener("data", onData);
+				process.stdin.removeListener("error", onError);
+			};
+			const onError = (err) => {
+				cleanup();
+				reject(err);
+			};
+			const onData = (char) => {
+				const c = char.toString();
+				if (c === "\n" || c === "\r") {
+					cleanup();
+					process.stdout.write("\n");
+					resolve(value);
+				} else if (c === "") {
+					cleanup();
+					process.stdout.write("\n");
+					process.exit(1);
+				} else if (c === "" || c === "\b") {
+					if (value.length > 0) value = value.slice(0, -1);
+				} else value += c;
+			};
+			process.stdin.setRawMode(true);
+			process.stdin.resume();
+			process.stdin.on("data", onData);
+			process.stdin.on("error", onError);
+		});
+	}
+	const rl = node_readline_promises.createInterface({
+		input: node_process.stdin,
+		output: node_process.stdout
+	});
+	try {
+		return await rl.question(message);
+	} finally {
+		rl.close();
+	}
+}
+//#endregion
+//#region src/auth/index.ts
+const logger$8 = console;
+/**
+* Validate Dokploy token by making a test API call
+*/
+async function validateDokployToken(endpoint, token) {
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-5xmrkh2a.cjs")).then((n) => n.dokploy_api_exports);
+	return new DokployApi({
+		baseUrl: endpoint,
+		token
+	}).validateToken();
+}
+/** What answers a login prompt without a terminal. */
+const LOGIN_INSTEAD = "Please provide --token option.";
+/**
+* Login to a service
+*/
+async function loginCommand(options) {
+	const { provider, token: providedToken, endpoint: providedEndpoint } = options;
+	if (provider === "dokploy") {
+		logger$8.log("\n🔐 Logging in to Dokploy...\n");
+		let endpoint = providedEndpoint;
+		if (!endpoint) endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: LOGIN_INSTEAD });
+		endpoint = endpoint.replace(/\/$/, "");
+		try {
+			new URL(endpoint);
+		} catch {
+			logger$8.error("Invalid URL format");
+			process.exit(1);
+		}
+		let token = providedToken;
+		if (!token) {
+			logger$8.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			token = await prompt("API Token: ", {
+				hidden: true,
+				instead: LOGIN_INSTEAD
+			});
+		}
+		if (!token) {
+			logger$8.error("Token is required");
+			process.exit(1);
+		}
+		logger$8.log("\nValidating credentials...");
+		if (!await validateDokployToken(endpoint, token)) {
+			logger$8.error("\n✗ Invalid credentials. Please check your token and try again.");
+			process.exit(1);
+		}
+		await require_credentials.storeDokployCredentials(token, endpoint);
+		logger$8.log("\n✓ Successfully logged in to Dokploy!");
+		logger$8.log(`  Endpoint: ${endpoint}`);
+		logger$8.log(`  Credentials stored in: ${require_credentials.getCredentialsPath()}`);
+		logger$8.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
+	}
+	if (provider === "hostinger") {
+		logger$8.log("\n🔐 Logging in to Hostinger...\n");
+		let token = providedToken;
+		if (!token) {
+			logger$8.log("\nGenerate a token at: https://hpanel.hostinger.com/profile/api\n");
+			token = await prompt("API Token: ", {
+				hidden: true,
+				instead: LOGIN_INSTEAD
+			});
+		}
+		if (!token) {
+			logger$8.error("Token is required");
+			process.exit(1);
+		}
+		await require_credentials.storeHostingerToken(token);
+		logger$8.log("\n✓ Hostinger token stored.");
+		logger$8.log(`  Credentials stored in: ${require_credentials.getCredentialsPath()}`);
+		logger$8.log("  Not validated here: every DNS endpoint is scoped to a domain, so the\n  first deploy that touches DNS is where a bad token reports itself.");
+		logger$8.log("\nYou can now use it as a DNS provider without setting HOSTINGER_API_TOKEN.");
+	}
+}
+/**
+* Logout from a service
+*/
+async function logoutCommand(options) {
+	const { provider = "dokploy" } = options;
+	if (provider === "all") {
+		if (await require_credentials.removeDokployCredentials()) logger$8.log("\n✓ Logged out from all services");
+		else logger$8.log("\nNo stored credentials found");
+		return;
+	}
+	if (provider === "dokploy") {
+		if (await require_credentials.removeDokployCredentials()) logger$8.log("\n✓ Logged out from Dokploy");
+		else logger$8.log("\nNo Dokploy credentials found");
+	}
+}
+/**
+* Show current login status
+*/
+async function whoamiCommand() {
+	logger$8.log("\n📋 Current credentials:\n");
+	const dokploy = await require_credentials.getDokployCredentials();
+	if (dokploy) {
+		logger$8.log("  Dokploy:");
+		logger$8.log(`    Endpoint: ${dokploy.endpoint}`);
+		logger$8.log(`    Token: ${maskToken(dokploy.token)}`);
+	} else logger$8.log("  Dokploy: Not logged in");
+	logger$8.log(`\n  Credentials file: ${require_credentials.getCredentialsPath()}`);
+}
+/**
+* Mask a token for display
+*/
+function maskToken(token) {
+	if (token.length <= 8) return "****";
+	return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
 //#endregion
 //#region src/trust/index.ts
 /**
@@ -67,7 +254,7 @@ var version = "10.0.0-alpha.64";
 * worse trade than one that tells you what to type. Caddy's own `caddy trust`
 * draws the line in the same place.
 */
-const logger$8 = console;
+const logger$7 = console;
 const run = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * How each platform is told about a new authority.
@@ -116,18 +303,18 @@ function installation(platform, certificate) {
 */
 async function trustCommand(options = {}) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	const certificate = (0, node_path.join)(workspace.root, require_sniffer.LOCAL_CA_PATH);
+	const certificate = (0, node_path.join)(workspace.root, require_state.LOCAL_CA_PATH);
 	if (!(0, node_fs.existsSync)(certificate)) throw new NoLocalAuthority(certificate);
 	const { describe, asks, steps } = installation(process.platform, certificate);
-	logger$8.log(`\n🔐 Trusting the local authority in ${describe}`);
-	logger$8.log(`   ${certificate}\n`);
+	logger$7.log(`\n🔐 Trusting the local authority in ${describe}`);
+	logger$7.log(`   ${certificate}\n`);
 	if (options.dryRun) {
-		for (const [command, args] of steps) logger$8.log(`   ${command} ${args.join(" ")}`);
+		for (const [command, args] of steps) logger$7.log(`   ${command} ${args.join(" ")}`);
 		return;
 	}
-	logger$8.log(`   ${asks}\n`);
+	logger$7.log(`   ${asks}\n`);
 	for (const [command, args] of steps) await run(command, args, { stdio: "inherit" });
-	logger$8.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
+	logger$7.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
 }
 /**
 * Trust the authority if this machine lacks it and its owner agrees.
@@ -144,7 +331,7 @@ async function ensureTrusted(root, url, options = {}) {
 	if (await isTrusted(url)) return;
 	if (!options.assumeYes) {
 		if (!process.stdin.isTTY) {
-			logger$8.log("   Local https addresses are not trusted here. Run \"gkm trust\", or \"gkm setup --yes\".");
+			logger$7.log("   Local https addresses are not trusted here. Run \"gkm trust\", or \"gkm setup --yes\".");
 			return;
 		}
 		if (await declined(root)) return;
@@ -156,7 +343,7 @@ async function ensureTrusted(root, url, options = {}) {
 		});
 		if (!install) {
 			await recordDeclined(root);
-			logger$8.log("   Skipped. Run \"gkm trust\" later.");
+			logger$7.log("   Skipped. Run \"gkm trust\" later.");
 			return;
 		}
 	}
@@ -1300,7 +1487,7 @@ async function serveFakes(fakes, ports) {
 	const served = [];
 	for (const [id, local] of Object.entries(fakes)) {
 		if (local.image) continue;
-		const port = ports[require_sniffer.fakeKey(id)];
+		const port = ports[require_state.fakeKey(id)];
 		if (port === void 0) continue;
 		const { handler } = (await import((0, node_url.pathToFileURL)(local.file).href)).default;
 		const server = serve({
@@ -1321,7 +1508,7 @@ function closeFakes(served) {
 }
 //#endregion
 //#region src/exec/index.ts
-const logger$7 = console;
+const logger$6 = console;
 /** `gkm exec` was given nothing to run. */
 var NoCommandSpecified = class extends Error {
 	constructor() {
@@ -1343,18 +1530,18 @@ var NoCommandSpecified = class extends Error {
 async function execCommand(commandArgs, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
-	const defaultEnv = require_sniffer.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$7.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = await require_sniffer.prepareEntryCredentials({ cwd });
-	if (appName) logger$7.log(`📦 App: ${appName}`);
+	const defaultEnv = require_state.loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const { credentials, secretsJsonPath, appName } = await require_state.prepareEntryCredentials({ cwd });
+	if (appName) logger$6.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0) logger$7.log(`🔐 Loaded ${secretCount} secret(s)`);
+	if (secretCount > 0) logger$6.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const preloadDir = (0, node_path.join)(cwd, ".gkm");
 	await (0, node_fs_promises.mkdir)(preloadDir, { recursive: true });
 	const preloadPath = (0, node_path.join)(preloadDir, "credentials-preload.mjs");
-	await require_sniffer.createCredentialsPreload(preloadPath, secretsJsonPath);
+	await require_state.createCredentialsPreload(preloadPath, secretsJsonPath);
 	const [cmd, ...args] = commandArgs;
-	logger$7.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
+	logger$6.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const nodeOptions = [(process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim(), `--import=${preloadPath}`].filter(Boolean).join(" ");
 	const child = (0, node_child_process.spawn)(cmd, args, {
 		cwd,
@@ -1368,7 +1555,7 @@ async function execCommand(commandArgs, options = {}) {
 	const exitCode = await new Promise((resolve) => {
 		child.on("close", (code) => resolve(code ?? 0));
 		child.on("error", (error) => {
-			logger$7.error(`Failed to run command: ${error.message}`);
+			logger$6.error(`Failed to run command: ${error.message}`);
 			resolve(1);
 		});
 	});
@@ -1376,7 +1563,7 @@ async function execCommand(commandArgs, options = {}) {
 }
 //#endregion
 //#region src/dev/index.ts
-const logger$6 = console;
+const logger$5 = console;
 /**
 * Normalize telescope configuration
 * @internal Exported for testing
@@ -1445,14 +1632,14 @@ const SUBSCRIBERS_ENV = "GKM_SUBSCRIBERS";
 async function devCommand(options) {
 	if (options.subscribers === false) process.env[SUBSCRIBERS_ENV] = "off";
 	if (options.entry) return entryDevCommand(options);
-	const defaultEnv = require_sniffer.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const defaultEnv = require_state.loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$5.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const appConfig = await require_config.loadAppConfig().catch((error) => {
 		if (error instanceof require_config.NotInAnApp || error instanceof require_config.NotABackendApp) return;
 		throw error;
 	});
 	if (!appConfig) {
-		logger$6.log("🔎 Reading gkm.config.ts and the constructs");
+		logger$5.log("🔎 Reading gkm.config.ts and the constructs");
 		const { workspace: everything } = await require_config.loadWorkspaceConfig();
 		return workspaceDevCommand(everything, options);
 	}
@@ -1461,16 +1648,16 @@ async function devCommand(options) {
 	const secretsRoot = appConfig.workspaceRoot;
 	const workspaceAppName = appConfig.appName;
 	const assigned = await require_appPorts.assignAppPorts(appConfig.workspace, [workspaceAppName], {
-		free: require_sniffer.isPortAvailable,
+		free: require_state.isPortAvailable,
 		holder: require_appPorts.holderOf
 	});
 	if (assigned.running.length > 0) throw new WorkspacePortsInUse(assigned.running);
-	for (const { app, from, to, holder } of assigned.moved) logger$6.log(`↪️  ${app}: ${from} is held by ${require_appPorts.describeHolder(holder)}, which is not this workspace's — using ${to}`);
+	for (const { app, from, to, holder } of assigned.moved) logger$5.log(`↪️  ${app}: ${from} is held by ${require_appPorts.describeHolder(holder)}, which is not this workspace's — using ${to}`);
 	const workspace = require_appPorts.withAppPorts(appConfig.workspace, assigned.ports);
 	const workspaceAppPort = assigned.ports[workspaceAppName] ?? appConfig.app.port;
 	process.env[require_appPorts.APP_TAG_ENV] = require_appPorts.appTag(appConfig.workspaceRoot, workspaceAppName);
 	if (appConfig.app.entry) {
-		logger$6.log(`📄 Using entry point: ${appConfig.app.entry}`);
+		logger$5.log(`📄 Using entry point: ${appConfig.app.entry}`);
 		return entryDevCommand({
 			...options,
 			entry: appConfig.app.entry,
@@ -1479,9 +1666,9 @@ async function devCommand(options) {
 		});
 	}
 	if (config.env) {
-		const { loaded, missing } = require_sniffer.loadEnvFiles(config.env, appRoot);
-		if (loaded.length > 0) logger$6.log(`📦 Loaded env: ${loaded.join(", ")}`);
-		if (missing.length > 0) logger$6.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
+		const { loaded, missing } = require_state.loadEnvFiles(config.env, appRoot);
+		if (loaded.length > 0) logger$5.log(`📦 Loaded env: ${loaded.join(", ")}`);
+		if (missing.length > 0) logger$5.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
 	const telescope = normalizeTelescopeConfig(config.telescope);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
@@ -1492,7 +1679,7 @@ async function devCommand(options) {
 		appRoot,
 		target: "server",
 		enableOpenApi,
-		cacheBackend: require_sniffer.cacheBackendFor(require_sniffer.providerOf(workspace ?? config)),
+		cacheBackend: require_state.cacheBackendFor(require_state.providerOf(workspace ?? config)),
 		telescope,
 		databaseApi: true,
 		hooks,
@@ -1500,22 +1687,22 @@ async function devCommand(options) {
 		bustCache,
 		serveEmpty: true
 	}));
-	logger$6.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
+	logger$5.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
 	const initial = await build();
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
 	let publicUrl;
 	let manifest;
-	const appSecrets = await require_sniffer.loadSecretsForApp(workspace ? await require_store.secretsStoreFor(workspace, config.stages.local) : new require_store.FileSecretsStore(secretsRoot), config.stages.local, workspaceAppName);
+	const appSecrets = await require_state.loadSecretsForApp(workspace ? await require_state.secretsStoreFor(workspace, config.stages.local) : new require_state.FileSecretsStore(secretsRoot), config.stages.local, workspaceAppName);
 	if (workspace) {
-		const reconciled = await require_sniffer.reconcileWorkspace(workspace, {
+		const reconciled = await require_state.reconcileWorkspace(workspace, {
 			stage: workspace.stages.local,
 			...options.fake ? { fake: true } : {},
-			progress: (message) => logger$6.log(message)
+			progress: (message) => logger$5.log(message)
 		});
 		if (reconciled.services.length > 0) {
-			logger$6.log("🐳 Services");
-			for (const line of require_sniffer.describeServices(reconciled.services)) logger$6.log(line);
+			logger$5.log("🐳 Services");
+			for (const line of require_state.describeServices(reconciled.services)) logger$5.log(line);
 		}
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_derive.appKey(r.id) === workspaceAppName);
@@ -1582,11 +1769,11 @@ async function devCommand(options) {
 		cwd: appRoot
 	});
 	watcher.on("error", (error) => {
-		logger$6.error("❌ Watcher error:", error);
+		logger$5.error("❌ Watcher error:", error);
 	});
 	let rebuildTimeout = null;
 	watcher.on("change", async (path) => {
-		logger$6.log(`🔄 ${path} changed — rebuilding`);
+		logger$5.log(`🔄 ${path} changed — rebuilding`);
 		if (rebuildTimeout) clearTimeout(rebuildTimeout);
 		rebuildTimeout = setTimeout(async () => {
 			try {
@@ -1595,8 +1782,8 @@ async function devCommand(options) {
 				await devServer.restart();
 			} catch (error) {
 				const err = error;
-				logger$6.error(`❌ Rebuild failed: ${err.message}`);
-				if (err.stack) logger$6.error(err.stack);
+				logger$5.error(`❌ Rebuild failed: ${err.message}`);
+				if (err.stack) logger$5.error(err.stack);
 			}
 		}, 300);
 	});
@@ -1604,13 +1791,13 @@ async function devCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$6.log("\n🛑 Shutting down...");
+		logger$5.log("\n🛑 Shutting down...");
 		Promise.all([
 			watcher.close(),
 			devServer.stop(),
 			discovery.leave()
 		]).catch((err) => {
-			logger$6.error("Error during shutdown:", err);
+			logger$5.error("Error during shutdown:", err);
 		}).finally(() => {
 			process.exit(0);
 		});
@@ -1794,8 +1981,8 @@ async function validateFrontendApps(workspace) {
 async function loadDevSecrets(workspace) {
 	if (!workspace.secrets.enabled) return {};
 	const stage = workspace.stages.local;
-	const secrets = await (await require_store.secretsStoreFor(workspace, stage)).read(stage);
-	if (secrets) return require_storage.toEmbeddableSecrets(secrets);
+	const secrets = await (await require_state.secretsStoreFor(workspace, stage)).read(stage);
+	if (secrets) return require_state.toEmbeddableSecrets(secrets);
 	return {};
 }
 /**
@@ -1810,17 +1997,17 @@ async function loadDevSecrets(workspace) {
 async function workspaceDevCommand(configured, options) {
 	const scoped = options.app ? [options.app] : options.filter ? [] : Object.keys(configured.apps);
 	const assigned = await require_appPorts.assignAppPorts(configured, scoped, {
-		free: require_sniffer.isPortAvailable,
+		free: require_state.isPortAvailable,
 		holder: require_appPorts.holderOf
 	});
 	if (assigned.running.length > 0) throw new WorkspacePortsInUse(assigned.running);
-	for (const { app, from, to, holder } of assigned.moved) logger$6.log(`↪️  ${app}: ${from} is held by ${require_appPorts.describeHolder(holder)}, which is not this workspace's — using ${to}`);
+	for (const { app, from, to, holder } of assigned.moved) logger$5.log(`↪️  ${app}: ${from} is held by ${require_appPorts.describeHolder(holder)}, which is not this workspace's — using ${to}`);
 	const workspace = require_appPorts.withAppPorts(configured, assigned.ports);
 	const appCount = Object.keys(workspace.apps).length;
 	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "web");
 	const conflicts = checkPortConflicts(workspace);
 	if (conflicts.length > 0) {
-		for (const conflict of conflicts) logger$6.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
+		for (const conflict of conflicts) logger$5.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
 		throw new Error("Port conflicts detected. Please assign unique ports to each app.");
 	}
 	if (frontendApps.length > 0) {
@@ -1829,35 +2016,35 @@ async function workspaceDevCommand(configured, options) {
 		for (const result of validationResults) {
 			if (!result.valid) {
 				hasErrors = true;
-				logger$6.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
-				for (const error of result.errors) logger$6.error(`   • ${error}`);
+				logger$5.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
+				for (const error of result.errors) logger$5.error(`   • ${error}`);
 			}
-			for (const warning of result.warnings) logger$6.warn(`   ⚠️  ${result.appName}: ${warning}`);
+			for (const warning of result.warnings) logger$5.warn(`   ⚠️  ${result.appName}: ${warning}`);
 		}
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
 	}
 	const rawSecrets = await loadDevSecrets(workspace);
-	const reconciled = await require_sniffer.reconcileWorkspace(workspace, {
+	const reconciled = await require_state.reconcileWorkspace(workspace, {
 		stage: workspace.stages.local,
 		...options.fake ? { fake: true } : {},
-		progress: (message) => logger$6.log(message)
+		progress: (message) => logger$5.log(message)
 	});
 	if (reconciled.services.length > 0) {
-		logger$6.log("🐳 Services");
-		for (const line of require_sniffer.describeServices(reconciled.services)) logger$6.log(line);
+		logger$5.log("🐳 Services");
+		for (const line of require_state.describeServices(reconciled.services)) logger$5.log(line);
 	}
 	const secretsEnv = {
 		...rawSecrets,
 		...reconciled.env
 	};
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
-	for (const { id, port } of fakes) logger$6.log(`🎭 ${id} fake: http://localhost:${port}`);
-	logger$6.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
+	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
+	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-CF4J4GQS.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
-		logger$6.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
+	} else await Promise.resolve().then(() => require("./migrate-CF4J4GQS.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
 	for (const resource of reconciled.plan.resources) {
@@ -1878,11 +2065,11 @@ async function workspaceDevCommand(configured, options) {
 	else {
 		const { filters, unpackaged } = turboFilters(workspace);
 		turboFilter = filters.flatMap((name) => ["--filter", name]);
-		if (unpackaged.length > 0) logger$6.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
+		if (unpackaged.length > 0) logger$5.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
 	}
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
 	const width = Math.max(...buildOrder.map((name) => name.length));
-	logger$6.log(`\n${workspace.name}: ${appCount} app(s)`);
+	logger$5.log(`\n${workspace.name}: ${appCount} app(s)`);
 	for (const appName of buildOrder) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
@@ -1890,14 +2077,14 @@ async function workspaceDevCommand(configured, options) {
 			const own = reconciled.plan.resources.find((r) => r.kind === "mobile-app" && require_derive.appKey(r.id) === appName);
 			const scheme = own ? reconciled.env[own.envKey] : void 0;
 			const device = Object.entries(reconciled.env).find(([key]) => key.endsWith("_DEVICE_URL"))?.[1];
-			logger$6.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
+			logger$5.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
 			continue;
 		}
 		const local = `http://localhost:${app.port}`;
 		const url = Object.entries(appUrls).find(([id]) => require_derive.appKey(id) === appName)?.[1];
-		logger$6.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
+		logger$5.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
 	}
-	logger$6.log("");
+	logger$5.log("");
 	const configFiles = [
 		"gkm.config.ts",
 		"gkm.config.js",
@@ -1942,10 +2129,10 @@ async function workspaceDevCommand(configured, options) {
 		...secretsEnv,
 		NODE_ENV: "development",
 		...configPath ? { GKM_CONFIG_PATH: configPath } : {},
-		...options.fake ? { [require_sniffer.FAKE_ENV]: "1" } : {},
+		...options.fake ? { [require_state.FAKE_ENV]: "1" } : {},
 		[DISCOVERY_QUIET_ENV]: "1"
 	};
-	logger$6.log(`🚀 Starting ${appCount} app(s) — each builds before it answers, and says so when it is ready`);
+	logger$5.log(`🚀 Starting ${appCount} app(s) — each builds before it answers, and says so when it is ready`);
 	const turboProcess = (0, node_child_process.spawn)("pnpm", [
 		"turbo",
 		"run",
@@ -1961,7 +2148,7 @@ async function workspaceDevCommand(configured, options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$6.log("\n🛑 Shutting down workspace...");
+		logger$5.log("\n🛑 Shutting down workspace...");
 		closeFakes(fakes);
 		discovery.leave();
 		const pid = turboProcess.pid;
@@ -1987,7 +2174,7 @@ async function workspaceDevCommand(configured, options) {
 	process.on("SIGTERM", shutdown);
 	return new Promise((resolve, reject) => {
 		turboProcess.on("error", (error) => {
-			logger$6.error("❌ Turbo error:", error);
+			logger$5.error("❌ Turbo error:", error);
 			reject(error);
 		});
 		turboProcess.on("exit", (code) => {
@@ -2005,23 +2192,23 @@ async function entryDevCommand(options) {
 	if (!entry) throw new Error("--entry requires a file path");
 	const entryPath = (0, node_path.resolve)(process.cwd(), entry);
 	if (!(0, node_fs.existsSync)(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
-	const defaultEnv = require_sniffer.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_sniffer.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
-	if (appName) logger$6.log(`📦 App: ${appName} (port ${resolvedPort})`);
-	logger$6.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
-	if (Object.keys(credentials).length > 1) logger$6.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
+	const defaultEnv = require_state.loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$5.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_state.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
+	if (appName) logger$5.log(`📦 App: ${appName} (port ${resolvedPort})`);
+	logger$5.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
+	if (Object.keys(credentials).length > 1) logger$5.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
 	const wrapperDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(wrapperDir, { recursive: true });
 	const wrapperPath = (0, node_path.join)(wrapperDir, "entry-wrapper.ts");
-	await require_sniffer.createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
+	await require_state.createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
 	const runner = new EntryRunner(wrapperPath, entryPath, watch, resolvedPort);
 	await runner.start();
 	let isShuttingDown = false;
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$6.log("\n🛑 Shutting down...");
+		logger$5.log("\n🛑 Shutting down...");
 		runner.stop();
 		process.exit(0);
 	};
@@ -2057,14 +2244,14 @@ var EntryRunner = class {
 			});
 			let restartTimeout = null;
 			this.watcher.on("change", (path) => {
-				logger$6.log(`📝 File changed: ${path}`);
+				logger$5.log(`📝 File changed: ${path}`);
 				if (restartTimeout) clearTimeout(restartTimeout);
 				restartTimeout = setTimeout(async () => {
-					logger$6.log("🔄 Restarting...");
+					logger$5.log("🔄 Restarting...");
 					await this.restart();
 				}, 300);
 			});
-			logger$6.log(`👀 Watching for changes in: ${watchDir}`);
+			logger$5.log(`👀 Watching for changes in: ${watchDir}`);
 		}
 	}
 	async runProcess() {
@@ -2080,17 +2267,17 @@ var EntryRunner = class {
 		});
 		this.isRunning = true;
 		this.childProcess.on("error", (error) => {
-			logger$6.error("❌ Process error:", error);
+			logger$5.error("❌ Process error:", error);
 		});
 		this.childProcess.on("exit", (code) => {
-			if (code !== null && code !== 0 && code !== 143) logger$6.error(`❌ Process exited with code ${code}`);
+			if (code !== null && code !== 0 && code !== 143) logger$5.error(`❌ Process exited with code ${code}`);
 			this.isRunning = false;
 		});
 		await new Promise((resolve) => setTimeout(resolve, 500));
 		if (this.isRunning) {
-			logger$6.log("");
-			logger$6.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
-			logger$6.log("");
+			logger$5.log("");
+			logger$5.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
+			logger$5.log("");
 		}
 	}
 	async restart() {
@@ -2209,7 +2396,7 @@ start({
 * lets a console read what this machine is running.
 */
 function announce(discovery) {
-	logger$6.log(`🧭 Discovery: ${discovery.connectUrl}`);
+	logger$5.log(`🧭 Discovery: ${discovery.connectUrl}`);
 }
 /** Run `fn` with `console.log` muted — warnings and errors still print. */
 async function quietly(fn) {
@@ -2323,11 +2510,11 @@ var DevServer = class {
 		this.startTime = Date.now();
 		if (this.isRunning) await this.stop();
 		if (this.portExplicit) {
-			if (!await require_sniffer.isPortAvailable(this.requestedPort)) throw new DevPortInUse(this.requestedPort, listenerOn(this.requestedPort));
+			if (!await require_state.isPortAvailable(this.requestedPort)) throw new DevPortInUse(this.requestedPort, listenerOn(this.requestedPort));
 			this.actualPort = this.requestedPort;
 		} else {
-			this.actualPort = await require_sniffer.findAvailablePort(this.requestedPort);
-			if (this.actualPort !== this.requestedPort) logger$6.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
+			this.actualPort = await require_state.findAvailablePort(this.requestedPort);
+			if (this.actualPort !== this.requestedPort) logger$5.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
 		const serverEntryPath = (0, node_path.join)(this.appRoot, ".gkm", "server", "server.ts");
 		await this.createServerEntry();
@@ -2347,11 +2534,11 @@ var DevServer = class {
 		});
 		this.isRunning = true;
 		this.serverProcess.on("error", (error) => {
-			logger$6.error("❌ Server error:", error);
+			logger$5.error("❌ Server error:", error);
 		});
 		const child = this.serverProcess;
 		child.on("exit", (code, signal) => {
-			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$6.error(`❌ Server exited with code ${code}`);
+			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$5.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 			if (this.serverProcess === child) this.onStatus?.("stopped");
 		});
@@ -2360,13 +2547,13 @@ var DevServer = class {
 			const local = `http://localhost:${this.actualPort}`;
 			const address = this.publicUrl ? `${this.publicUrl} -> ${local}` : local;
 			const seconds = ((Date.now() - this.startTime) / 1e3).toFixed(1);
-			logger$6.log(`\x1b[32m✓\x1b[0m ${this.label} ready in ${seconds}s  ${address}`);
+			logger$5.log(`\x1b[32m✓\x1b[0m ${this.label} ready in ${seconds}s  ${address}`);
 			const tools = this.selfServing ? [] : [
 				...this.enableOpenApi ? ["docs /__docs"] : [],
 				...this.telescope ? [`telescope ${this.telescope.path}`] : [],
 				...this.databaseApi ? [`db ${this.databaseApi}`] : []
 			];
-			if (tools.length > 0) logger$6.log(`  ${tools.join(" · ")}`);
+			if (tools.length > 0) logger$5.log(`  ${tools.join(" · ")}`);
 			this.onStatus?.("ready");
 		}
 	}
@@ -2397,7 +2584,7 @@ var DevServer = class {
 		await this.stop();
 		let attempts = 0;
 		while (attempts < 30) {
-			if (await require_sniffer.isPortAvailable(portToReuse)) break;
+			if (await require_state.isPortAvailable(portToReuse)) break;
 			await new Promise((resolve) => setTimeout(resolve, 100));
 			attempts++;
 		}
@@ -3062,7 +3249,7 @@ ${shutdown}`);
 }
 //#endregion
 //#region src/build/index.ts
-const logger$5 = console;
+const logger$4 = console;
 /**
 * Where `gkm build --stage` leaves the key its bundle's secrets were encrypted
 * with, beside the bundle in `.gkm/server/` and readable by its owner alone.
@@ -3110,12 +3297,12 @@ async function buildCommand(options) {
 		const isAtWorkspaceRoot = cwd === workspaceRoot;
 		const someAppIsElsewhere = Object.values(loadedConfig.workspace.apps).some((app) => (0, node_path.resolve)(workspaceRoot, app.path) !== workspaceRoot);
 		if (isAtWorkspaceRoot && someAppIsElsewhere) {
-			logger$5.log("📦 Detected workspace configuration");
+			logger$4.log("📦 Detected workspace configuration");
 			return workspaceBuildCommand(loadedConfig.workspace, options);
 		}
 	}
 	const config = loadedConfig.type !== "workspace" ? await require_config.loadConfig() : (0, node_path.resolve)(process.cwd()) === (0, node_path.resolve)(loadedConfig.workspace.root) ? rootGkmConfig(loadedConfig.workspace) : (await require_config.loadAppConfig()).gkmConfig;
-	const target = options.provider ?? require_sniffer.providerOf(loadedConfig.workspace);
+	const target = options.provider ?? require_state.providerOf(loadedConfig.workspace);
 	const workspaceRoot = loadedConfig.workspace.root;
 	const appRoot = process.cwd();
 	const output = await buildOneApp({
@@ -3147,22 +3334,22 @@ async function declaredIn(config, cwd) {
 */
 function backendsOf(workspace) {
 	return {
-		cache: require_sniffer.cacheBackendFor(require_sniffer.providerOf(workspace)),
+		cache: require_state.cacheBackendFor(require_state.providerOf(workspace)),
 		email: "ses"
 	};
 }
 /** One app's build, from its config and the command's options. */
 async function buildOneApp(input) {
 	const { config, options, workspace, appRoot, target } = input;
-	const cacheBackend = require_sniffer.cacheBackendFor(require_sniffer.providerOf(workspace));
+	const cacheBackend = require_state.cacheBackendFor(require_state.providerOf(workspace));
 	const production = normalizeProductionConfig(options.production ?? false);
-	if (production) logger$5.log(`🏭 Building for PRODUCTION`);
-	logger$5.log(`Building for ${target}`);
-	logger$5.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
+	if (production) logger$4.log(`🏭 Building for PRODUCTION`);
+	logger$4.log(`Building for ${target}`);
+	logger$4.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
 	const telescope = production ? void 0 : normalizeTelescopeConfig(config.telescope);
-	if (telescope) logger$5.log(`🔭 Telescope enabled at ${telescope.path}`);
+	if (telescope) logger$4.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
-	if (hooks) logger$5.log(`🪝 Server hooks enabled`);
+	if (hooks) logger$4.log(`🪝 Server hooks enabled`);
 	return buildApp({
 		config,
 		workspaceRoot: workspace.root,
@@ -3204,7 +3391,7 @@ async function writeManifest(input) {
 	});
 	const path = (0, node_path.join)(manifestDir, `${target}.ts`);
 	await (0, node_fs_promises.writeFile)(path, require_emit.manifestModule(folded, backends));
-	logger$5.log(`Manifest: ${(0, node_path.relative)(process.cwd(), path)}`);
+	logger$4.log(`Manifest: ${(0, node_path.relative)(process.cwd(), path)}`);
 }
 /**
 * Turn one app's constructs into its generated entry.
@@ -3232,11 +3419,11 @@ async function buildApp(input) {
 	});
 	if (selfServing) {
 		await writeSurfaceEntry((0, node_path.join)(appRoot, ".gkm", "server"), selfServing.source);
-		logger$5.log(`Generated a server for ${selfServing.id} from its own declaration`);
+		logger$4.log(`Generated a server for ${selfServing.id} from its own declaration`);
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = (0, node_path.join)(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C8uJf324.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-orRqUJNZ.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3245,7 +3432,7 @@ async function buildApp(input) {
 				external: production.external,
 				...input.stage ? { stage: input.stage } : {}
 			});
-			logger$5.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
+			logger$4.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
 		}
 		return { selfServing: selfServing.id };
 	}
@@ -3291,14 +3478,14 @@ async function buildApp(input) {
 		topicGenerator.load(code, appRoot, bustCache)
 	]);
 	const allEndpoints = servedBy(loadedEndpoints, derived.surface);
-	logger$5.log(`Found ${allEndpoints.length} endpoints`);
-	logger$5.log(`Found ${allFunctions.length} functions`);
-	logger$5.log(`Found ${allCrons.length} crons`);
-	logger$5.log(`Found ${allSubscribers.length} subscribers`);
-	logger$5.log(`Found ${allQueues.length} queues`);
-	logger$5.log(`Found ${allTopics.length} topics`);
+	logger$4.log(`Found ${allEndpoints.length} endpoints`);
+	logger$4.log(`Found ${allFunctions.length} functions`);
+	logger$4.log(`Found ${allCrons.length} crons`);
+	logger$4.log(`Found ${allSubscribers.length} subscribers`);
+	logger$4.log(`Found ${allQueues.length} queues`);
+	logger$4.log(`Found ${allTopics.length} topics`);
 	if (!input.serveEmpty && allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0 && allQueues.length === 0 && allTopics.length === 0) {
-		logger$5.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
+		logger$4.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
 	if (production?.subscribers === "include" && derived.surface) {
@@ -3311,7 +3498,7 @@ async function buildApp(input) {
 			[allQueues.length, "queue consumer"],
 			[allSubscribers.length, "subscriber"]
 		].filter(([n]) => n > 0).map(([n, what]) => `${n} ${what}${n === 1 ? "" : "s"}`);
-		if (left.length > 0) logger$5.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
+		if (left.length > 0) logger$4.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
 	}
 	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
 	await require_openapi.generateOpenApi(allEndpoints.map(({ construct }) => construct), {
@@ -3334,7 +3521,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		force: true
 	});
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
-	logger$5.log(`\nGenerating handlers for ${target}`);
+	logger$4.log(`\nGenerating handlers for ${target}`);
 	const options = {
 		target,
 		root: workspaceRoot
@@ -3350,7 +3537,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		queueGenerator.build(context, queues, outputDir, options),
 		topicGenerator.build(context, topics, outputDir, options)
 	]);
-	logger$5.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${target}`);
+	logger$4.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${target}`);
 	const fields = {
 		...context.surface ? { surface: context.surface.id } : {},
 		functions: functionInfos,
@@ -3373,8 +3560,8 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		};
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
-			logger$5.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C8uJf324.cjs"));
+			logger$4.log(`\n📦 Bundling production server...`);
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-orRqUJNZ.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3391,13 +3578,13 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 				stage,
 				constructs: allConstructs
 			})).masterKey;
-			logger$5.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
+			logger$4.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
 			if (masterKey) {
 				const keyPath = (0, node_path.join)(outputDir, MASTER_KEY_FILE);
 				await (0, node_fs_promises.writeFile)(keyPath, `${masterKey}\n`, { mode: 384 });
 				await (0, node_fs_promises.chmod)(keyPath, 384);
-				logger$5.log(`\n🔐 Secrets encrypted for deployment`);
-				logger$5.log(`   Run with GKM_MASTER_KEY set to the key in ${(0, node_path.relative)(appRoot, keyPath)} (fingerprint ${require_sniffer.keyFingerprint(masterKey)})`);
+				logger$4.log(`\n🔐 Secrets encrypted for deployment`);
+				logger$4.log(`   Run with GKM_MASTER_KEY set to the key in ${(0, node_path.relative)(appRoot, keyPath)} (fingerprint ${require_sniffer.keyFingerprint(masterKey)})`);
 			}
 		}
 		return {
@@ -3498,20 +3685,20 @@ async function workspaceBuildCommand(workspace, options) {
 	const apps = Object.entries(workspace.apps);
 	const backendApps = apps.filter(([, app]) => app.type === "backend");
 	const frontendApps = apps.filter(([, app]) => app.type === "web");
-	logger$5.log(`\n🏗️  Building workspace: ${workspace.name}`);
-	logger$5.log(`   Backend apps: ${backendApps.map(([name]) => name).join(", ") || "none"}`);
-	logger$5.log(`   Frontend apps: ${frontendApps.map(([name]) => name).join(", ") || "none"}`);
-	if (options.production) logger$5.log(`   🏭 Production mode enabled`);
+	logger$4.log(`\n🏗️  Building workspace: ${workspace.name}`);
+	logger$4.log(`   Backend apps: ${backendApps.map(([name]) => name).join(", ") || "none"}`);
+	logger$4.log(`   Frontend apps: ${frontendApps.map(([name]) => name).join(", ") || "none"}`);
+	if (options.production) logger$4.log(`   🏭 Production mode enabled`);
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
-	logger$5.log(`   Build order: ${buildOrder.join(" → ")}`);
+	logger$4.log(`   Build order: ${buildOrder.join(" → ")}`);
 	try {
-		const target = options.provider ?? require_sniffer.providerOf(workspace);
+		const target = options.provider ?? require_state.providerOf(workspace);
 		const builds = [];
 		for (const appName of buildOrder) {
 			const app = workspace.apps[appName];
 			const config = require_workspace.getAppGkmConfig(workspace, appName);
 			if (!app || app.type !== "backend" || !config) continue;
-			logger$5.log(`\n⚙️  ${appName}`);
+			logger$4.log(`\n⚙️  ${appName}`);
 			const output = await buildOneApp({
 				config,
 				options,
@@ -3536,8 +3723,8 @@ async function workspaceBuildCommand(workspace, options) {
 		const pm = detectPackageManager();
 		const [turboBin, turboArgs] = getTurboArgs(pm, filters, { only: true });
 		if (filters.length > 0) {
-			logger$5.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
-			logger$5.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
+			logger$4.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
+			logger$4.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
 			const sandbox = options.sandbox ?? new require_local.LocalSandbox({
 				root: workspace.root,
 				passEnv: ["TURBO_TOKEN"]
@@ -3562,15 +3749,15 @@ async function workspaceBuildCommand(workspace, options) {
 				outputPath
 			});
 		}
-		logger$5.log(`\n✅ Workspace build complete!`);
-		logger$5.log(`\n📋 Build Summary:`);
+		logger$4.log(`\n✅ Workspace build complete!`);
+		logger$4.log(`\n📋 Build Summary:`);
 		for (const result of results) {
 			const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-			logger$5.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
+			logger$4.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
 		}
 	} catch (error) {
 		const errorMessage = error instanceof Error ? error.message : "Build failed";
-		logger$5.log(`\n❌ Build failed: ${errorMessage}`);
+		logger$4.log(`\n❌ Build failed: ${errorMessage}`);
 		for (const [appName, app] of apps) results.push({
 			appName,
 			type: app.type,
@@ -3600,1169 +3787,17 @@ function formatRoutes(routes) {
 	return Array.isArray(routes) ? routes.join(", ") : routes;
 }
 //#endregion
-//#region src/migrate/provider.ts
-/**
-* One construct's migrations and seeds, read from its folders.
-*
-* Two kinds of file, told apart by extension rather than by configuration: a
-* script exports `up` (and may export `down`) — or `seed(db, { stage })`, in
-* `seeds/` — and a
-* `.sql` file is run whole. The second is what makes a folder independent of
-* the client the app uses — Better Auth's schema is SQL whatever the
-* application queries with.
-*/
-const SCRIPTS = /* @__PURE__ */ new Set([
-	".ts",
-	".mts",
-	".js",
-	".mjs"
-]);
-/** Two files in one folder that would be one migration. */
-var DuplicateMigration = class extends Error {
-	folder;
-	migration;
-	constructor(folder, migration) {
-		super(`${folder} has two migrations named '${migration}' — a script and a .sql file with the same name. A migration is recorded by name, so only one of them could ever run; rename or remove the other.`);
-		this.folder = folder;
-		this.migration = migration;
-		this.name = "DuplicateMigration";
-	}
-};
-/** A script in a migrations folder that exports no `up`. */
-var MigrationHasNoUp = class extends Error {
-	file;
-	constructor(file) {
-		super(`${file} is in a migrations folder but exports no \`up\` function. Export \`async function up(db: Kysely<unknown>)\`, or move the file out of the folder if it is not a migration.`);
-		this.file = file;
-		this.name = "MigrationHasNoUp";
-	}
-};
-/** A script in a seeds folder that exports no `seed`. */
-var SeedHasNoSeed = class extends Error {
-	file;
-	constructor(file) {
-		super(`${file} is in a seeds folder but exports no \`seed\` function. Export \`async function seed(db, { stage })\`, or move the file out of the folder if it is not a seed.`);
-		this.file = file;
-		this.name = "SeedHasNoSeed";
-	}
-};
-/**
-* The migration files in a folder, by name, without reading them.
-*
-* Also what `gkm dev` compares against a construct's history to report what
-* is pending, which is why it is separate from loading them.
-*/
-async function migrationFiles(folder) {
-	const entries = await (0, node_fs_promises.readdir)(folder, { withFileTypes: true }).catch((error) => {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	});
-	const files = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		if (!entry.isFile() || !isMigration(entry.name)) continue;
-		const name = entry.name.slice(0, -(0, node_path.extname)(entry.name).length);
-		if (files.has(name)) throw new DuplicateMigration(folder, name);
-		files.set(name, (0, node_path.join)(folder, entry.name));
-	}
-	return files;
-}
-/** A Kysely provider over one construct's folder. */
-function folderProvider(folder, raw) {
-	return { async getMigrations() {
-		const migrations = {};
-		for (const [name, file] of await migrationFiles(folder)) migrations[name] = (0, node_path.extname)(file) === ".sql" ? await sqlMigration(file, raw) : await scriptMigration(file);
-		return migrations;
-	} };
-}
-/**
-* The seeds in a folder, loaded, in name order.
-*
-* Every one runs on every pass — there is no history to consult — so the order
-* is the only thing between two seeds where one reads what another writes.
-* Name them to sort that way.
-*/
-async function loadSeeds(folder, raw) {
-	const files = [...await migrationFiles(folder)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-	const seeds = [];
-	for (const [name, file] of files) seeds.push({
-		name,
-		run: (0, node_path.extname)(file) === ".sql" ? (await sqlMigration(file, raw)).up : await scriptSeed(file)
-	});
-	return seeds;
-}
-/**
-* A seed script, imported as it is on disk now.
-*
-* Keyed by its modification time: a seed is run again after it is edited, and
-* a process that has imported it once would otherwise run the old one.
-*/
-async function scriptSeed(file) {
-	const url = (0, node_url.pathToFileURL)(file);
-	url.searchParams.set("mtime", String((await (0, node_fs_promises.stat)(file)).mtimeMs));
-	const module = await import(url.href);
-	if (typeof module.seed !== "function") throw new SeedHasNoSeed(file);
-	return module.seed;
-}
-function isMigration(file) {
-	if (file.endsWith(".d.ts")) return false;
-	if (/\.(spec|test)\.[cm]?[jt]s$/.test(file)) return false;
-	const extension = (0, node_path.extname)(file);
-	return extension === ".sql" || SCRIPTS.has(extension);
-}
-async function scriptMigration(file) {
-	const module = await import((0, node_url.pathToFileURL)(file).href);
-	if (typeof module.up !== "function") throw new MigrationHasNoUp(file);
-	return {
-		up: module.up,
-		...typeof module.down === "function" ? { down: module.down } : {}
-	};
-}
-/**
-* A `.sql` file, run whole.
-*
-* One query rather than split on `;`: with no parameters, Postgres takes
-* several statements in one message, and splitting by hand breaks on the first
-* `;` inside a string or a function body. There is no `down` — a generated
-* schema is rolled back by a migration that says how, not by guessing.
-*/
-async function sqlMigration(file, raw) {
-	const statements = await (0, node_fs_promises.readFile)(file, "utf-8");
-	return { up: async (db) => {
-		await raw.raw(statements).execute(db);
-	} };
-}
-//#endregion
-//#region src/migrate/databases.ts
-/**
-* Bring each construct's schema up to its migrations folder.
-*
-* Which constructs, in what order, from which folder, is `migrationTargets`'
-* answer and nobody else's. What is decided here is only how one target is
-* run: as its owner, in its own schema, with a history of its own.
-*/
-/** A folder under `db/` that names no construct. */
-var UnknownMigrationFolder = class extends Error {
-	folder;
-	known;
-	constructor(folder, known) {
-		super(`${folder} names no database construct, so its migrations would never run. ${known.length > 0 ? `The folders that do: ${known.join(", ")}.` : "This project declares no database."} Rename the folder after the construct it belongs to.`);
-		this.folder = folder;
-		this.known = known;
-		this.name = "UnknownMigrationFolder";
-	}
-};
-/** A construct was asked for by a name that takes no migrations. */
-var NoSuchMigrationTarget = class extends Error {
-	construct;
-	known;
-	constructor(construct, known) {
-		super(`'${construct}' is not a database construct. ` + (known.length > 0 ? `The ones with migrations: ${known.join(", ")}.` : "This project declares no database."));
-		this.construct = construct;
-		this.known = known;
-		this.name = "NoSuchMigrationTarget";
-	}
-};
-/**
-* A migration left directly in a construct's folder, where nothing reads it.
-*
-* Migrations moved into `migrations/` so seeds could sit beside them. A file
-* still at the old level would otherwise never run, and nothing would say so.
-*/
-var MigrationsOutsideFolder = class extends Error {
-	folder;
-	files;
-	constructor(folder, files) {
-		super(`${folder} has ${files.join(", ")} directly inside it, where nothing runs them. Migrations live in ${folder}/migrations/ and seeds in ${folder}/seeds/ — move ${files.length === 1 ? "it" : "them"} there.`);
-		this.folder = folder;
-		this.files = files;
-		this.name = "MigrationsOutsideFolder";
-	}
-};
-/** A folder inside a construct's folder that is neither `migrations` nor `seeds`. */
-var UnknownDatabaseFolder = class extends Error {
-	folder;
-	constructor(folder) {
-		super(`${folder} is neither migrations/ nor seeds/, so nothing in it would ever run. A construct's folder holds those two; rename or remove it.`);
-		this.folder = folder;
-		this.name = "UnknownDatabaseFolder";
-	}
-};
-/** A seed failed; its own writes are rolled back, the ones before it stay. */
-var SeedFailed = class extends Error {
-	construct;
-	seed;
-	cause;
-	constructor(construct, seed, cause) {
-		super(`${construct}: seed '${seed}' failed — ${cause instanceof Error ? cause.message : String(cause)}. Its writes were rolled back; fix it and run it again.`);
-		this.construct = construct;
-		this.seed = seed;
-		this.cause = cause;
-		this.name = "SeedFailed";
-	}
-};
-/** A construct with roles has no owner URL to migrate with. */
-var NoOwnerCredential = class extends Error {
-	construct;
-	key;
-	constructor(construct, key) {
-		super(`${construct} has no ${key} to migrate with. Migrations run as the owner role — the runtime one cannot create a table — and nothing resolved its URL. Is the stage reconciled?`);
-		this.construct = construct;
-		this.key = key;
-		this.name = "NoOwnerCredential";
-	}
-};
-/** A migration failed; the ones before it in the run stay applied. */
-var MigrationFailed = class extends Error {
-	construct;
-	migration;
-	cause;
-	constructor(construct, migration, cause) {
-		super(`${construct}: migration ${migration ? `'${migration}' ` : ""}failed — ${cause instanceof Error ? cause.message : String(cause)}`);
-		this.construct = construct;
-		this.migration = migration;
-		this.cause = cause;
-		this.name = "MigrationFailed";
-	}
-};
-/** The project's Kysely could not be found from where a database is declared. */
-var KyselyNotFound = class extends Error {
-	from;
-	constructor(from) {
-		super(`Could not resolve 'kysely' from ${from}. Migrations run with the project's own Kysely — install it where the database is declared.`);
-		this.from = from;
-		this.name = "KyselyNotFound";
-	}
-};
-/** Apply every pending migration, construct by construct, parents first. */
-async function migrateDatabases(options) {
-	const runs = [];
-	for (const target of await targetsFor(options)) {
-		if ((await migrationFiles((0, node_path.join)(options.root, target.migrations))).size === 0) {
-			runs.push({
-				target,
-				applied: []
-			});
-			continue;
-		}
-		const applied = await withMigrator(options, target, async (migrator) => {
-			const { error, results = [] } = await migrator.migrateToLatest();
-			if (error) {
-				const failed = results.find((result) => result.status === "Error");
-				throw new MigrationFailed(target.id, failed?.migrationName, error);
-			}
-			return results.filter((result) => result.status === "Success").map((result) => result.migrationName);
-		});
-		runs.push({
-			target,
-			applied
-		});
-	}
-	return runs;
-}
-/**
-* Run every construct's seeds, parents first — each one, every time, on every
-* stage, production included. Each is handed the stage, so a seed decides
-* what belongs where.
-*
-* Seeds are reference data kept up to date by being run again, so there is no
-* history: a seed is an upsert, and a changed one is applied by the next run.
-* Each runs in its own transaction, as the construct's owner, so a failure
-* leaves nothing half-written. Assumes the schema is migrated —
-* {@link migrateAndSeed} is what makes that true.
-*/
-async function seedDatabases(options) {
-	const runs = [];
-	for (const target of await targetsFor(options)) {
-		const folder = (0, node_path.join)(options.root, target.seeds);
-		if ((await migrationFiles(folder)).size === 0) {
-			runs.push({
-				target,
-				seeded: []
-			});
-			continue;
-		}
-		const seeded = await withOwner(options, target, async (db, kysely) => {
-			const names = [];
-			for (const seed of await loadSeeds(folder, kysely.sql)) {
-				try {
-					await db.transaction().execute((trx) => seed.run(trx, { stage: options.stage }));
-				} catch (error) {
-					throw new SeedFailed(target.id, seed.name, error);
-				}
-				names.push(seed.name);
-			}
-			return names;
-		});
-		runs.push({
-			target,
-			seeded
-		});
-	}
-	return runs;
-}
-/**
-* Migrate, then seed: a seed only ever runs against the schema it was written
-* for.
-*
-* With `only`, the constructs it lives in are migrated too — a tenant's seed
-* cannot run before the database that owns its schema exists — and only it is
-* seeded.
-*/
-async function migrateAndSeed(options) {
-	const migrations = [];
-	for (const target of await withParents(options)) migrations.push(...await migrateDatabases({
-		...options,
-		only: target.id
-	}));
-	return {
-		migrations,
-		seeds: await seedDatabases(options)
-	};
-}
-/** The targets `only` names, after the ones it lives in; all without it. */
-async function withParents(options) {
-	const chosen = await targetsFor(options);
-	if (!options.only) return chosen;
-	const all = (0, _geekmidas_manifest.migrationTargets)(options.manifest);
-	const ids = /* @__PURE__ */ new Set();
-	for (const target of chosen) {
-		let current = target;
-		while (current) {
-			ids.add(current.id);
-			const parent = current.of;
-			current = parent ? all.find((t) => t.id === parent) : void 0;
-		}
-	}
-	return all.filter((target) => ids.has(target.id));
-}
-/**
-* What each construct's folder has that its history does not — without
-* applying any of it. What `gkm dev` reports.
-*/
-async function pendingMigrations(options) {
-	const found = [];
-	for (const target of await targetsFor(options)) {
-		if ((await migrationFiles((0, node_path.join)(options.root, target.migrations))).size === 0) continue;
-		const pending = await withMigrator(options, target, async (migrator) => (await migrator.getMigrations()).filter((migration) => migration.executedAt === void 0).map((migration) => migration.name));
-		if (pending.length > 0) found.push({
-			target,
-			pending
-		});
-	}
-	return found;
-}
-/**
-* The targets this run covers, with every folder under `db/` accounted for.
-*
-* A folder that names no construct is an error rather than something to skip:
-* a typo in its name is otherwise a migration that silently never runs.
-*/
-async function targetsFor(options) {
-	const targets = (0, _geekmidas_manifest.migrationTargets)(options.manifest);
-	const folders = targets.map((target) => target.folder);
-	for (const folder of await foldersIn((0, node_path.join)(options.root, _geekmidas_manifest.MIGRATIONS_ROOT))) {
-		const relative = `${_geekmidas_manifest.MIGRATIONS_ROOT}/${folder}`;
-		if (!folders.includes(relative)) throw new UnknownMigrationFolder(relative, folders);
-		await checkLayout(options.root, relative);
-	}
-	if (!options.only) return targets;
-	const id = (0, _geekmidas_manifest.canonicalId)(options.only);
-	const chosen = targets.filter((target) => target.id === id);
-	if (chosen.length === 0) throw new NoSuchMigrationTarget(options.only, targets.map((target) => target.id));
-	return chosen;
-}
-/**
-* A construct's folder holds `migrations/` and `seeds/`, and nothing else —
-* anything beside them is a file or folder nothing would ever run.
-*/
-async function checkLayout(root, folder) {
-	const entries = await (0, node_fs_promises.readdir)((0, node_path.join)(root, folder), { withFileTypes: true });
-	const loose = entries.filter((entry) => entry.isFile() && !entry.name.startsWith(".")).map((entry) => entry.name);
-	if (loose.length > 0) throw new MigrationsOutsideFolder(folder, loose);
-	for (const entry of entries) if (entry.isDirectory() && !_geekmidas_manifest.DATABASE_FOLDERS.includes(entry.name)) throw new UnknownDatabaseFolder(`${folder}/${entry.name}`);
-}
-async function foldersIn(dir) {
-	return (await (0, node_fs_promises.readdir)(dir, { withFileTypes: true }).catch((error) => {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-}
-/**
-* A migrator for one target, connected as its owner.
-*
-* No `migrationTableSchema`: the owner role's `search_path` is pinned to the
-* construct's schema, so the history lands there — `app.kysely_migration` for
-* the database, `auth_database.kysely_migration` for its tenant — and two
-* constructs in one Postgres never share one.
-*
-* Unordered migrations are allowed. Files are timestamped, so a branch merged
-* after another's migration ran carries an older one; refusing it would make
-* every such merge a manual repair.
-*/
-async function withMigrator(options, target, run) {
-	return withOwner(options, target, (db, { Migrator, sql }) => run(new Migrator({
-		db,
-		provider: folderProvider((0, node_path.join)(options.root, target.migrations), sql),
-		allowUnorderedMigrations: true
-	})));
-}
-/**
-* One target's database, connected as its owner and closed afterwards — what
-* migrations and seeds both run as.
-*/
-async function withOwner(options, target, run) {
-	const kysely = await kyselyFrom(options.sources?.[target.id]?.file ?? (target.of ? options.sources?.[target.of]?.file : void 0) ?? (0, node_path.join)(options.root, "package.json"));
-	const db = new kysely.Kysely({ dialect: new kysely.PostgresDialect({ pool: new pg.default.Pool(poolConfig(ownerUrl(options, target))) }) });
-	try {
-		return await run(db, kysely);
-	} finally {
-		await db.destroy();
-	}
-}
-/**
-* The owner's URL, with no fallback to the runtime one.
-*
-* The runtime role can create nothing, so falling back would only move the
-* failure to the first `CREATE TABLE` and make it read like a permissions
-* bug. The one exception is a database declared `roles: false`, where there is
-* no owner — both URLs are the master credential by design.
-*/
-function ownerUrl(options, target) {
-	const key = (0, _geekmidas_manifest.provideKey)(target.id, "ownerUrl");
-	const owner = options.env[key];
-	if (owner) return owner;
-	const database = options.manifest[target.of ?? target.id];
-	if (database?.kind === "database" && database.roles === false) {
-		const url = options.env[(0, _geekmidas_manifest.provideKey)(target.id, "url")];
-		if (url) return url;
-	}
-	throw new NoOwnerCredential(target.id, key);
-}
-/**
-* Pool settings for a URL, with `?search_path=` as the startup option Postgres
-* reads. Only a `roles: false` URL carries it — a role pins its own.
-*/
-function poolConfig(url) {
-	const parsed = new URL(url);
-	const searchPath = parsed.searchParams.get("search_path");
-	if (!searchPath) return { connectionString: url };
-	parsed.searchParams.delete("search_path");
-	return {
-		connectionString: parsed.toString(),
-		options: `-c search_path=${searchPath}`
-	};
-}
-/** Kysely as the project resolves it from `from`. */
-async function kyselyFrom(from) {
-	const require$2 = (0, node_module.createRequire)(from);
-	try {
-		const [main, migration] = await Promise.all([import((0, node_url.pathToFileURL)(require$2.resolve("kysely")).href), import((0, node_url.pathToFileURL)(require$2.resolve("kysely/migration")).href)]);
-		return {
-			Kysely: main.Kysely,
-			PostgresDialect: main.PostgresDialect,
-			sql: main.sql,
-			Migrator: migration.Migrator
-		};
-	} catch {
-		throw new KyselyNotFound(from);
-	}
-}
-//#endregion
-//#region src/compose/docker.ts
-/**
-* The Docker operations `gkm compose` needs, behind an interface.
-*
-* Small on purpose, like reconcile's: the rules about *when* each runs — the
-* registry is asked before anything is pulled, nothing is started for a tag
-* that is missing — are asserted against a fake, and this file is only the
-* wiring to the real CLI.
-*
-* Every call is an argument array. Image refs, tags and paths come from the
-* workspace, and none of them reaches a shell.
-*/
-/** How long a stack has to pass its health checks. */
-const WAIT_TIMEOUT_S = 180;
-/** `docker compose port` printed nothing a port can be read from. */
-var ServicePortUnknown = class extends Error {
-	service;
-	inside;
-	output;
-	constructor(service, inside, output) {
-		super(`'${service}' publishes no host port for ${inside} (docker said: ${output.trim() || "nothing"}). Is it running? \`docker compose ps\` shows the stack.`);
-		this.service = service;
-		this.inside = inside;
-		this.output = output;
-		this.name = "ServicePortUnknown";
-	}
-};
-function compose(stack, args) {
-	return [
-		"compose",
-		"-p",
-		stack.project,
-		"-f",
-		stack.file,
-		...args
-	];
-}
-/** Run a program and keep everything it said, whatever it exits with. */
-function capture(command, args, timeoutMs = 6e4) {
-	return new Promise((resolve, reject) => {
-		const child = (0, node_child_process.spawn)(command, [...args], {
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			shell: false
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.on("data", (chunk) => {
-			stdout += chunk.toString();
-		});
-		child.stderr.on("data", (chunk) => {
-			stderr += chunk.toString();
-		});
-		const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
-		timer.unref?.();
-		child.on("error", (error) => {
-			clearTimeout(timer);
-			reject(error);
-		});
-		child.on("close", (code) => {
-			clearTimeout(timer);
-			resolve({
-				code,
-				stdout,
-				stderr
-			});
-		});
-	});
-}
-/**
-* Whether a failed `docker manifest inspect` means the tag is not there, as
-* opposed to the registry not answering.
-*
-* Read off the message because that is all the CLI gives. Anything not
-* recognisably "no such tag" is treated as the registry being unreachable:
-* a registry that refused credentials must not be reported as a tag that was
-* never pushed, or the fix offered would be the wrong one.
-*/
-function isMissingManifest(output) {
-	return /no such manifest|manifest unknown|manifest for .* not found|not found: manifest/i.test(output);
-}
-const dockerCompose = {
-	async lookup(ref) {
-		const { code, stdout, stderr } = await capture("docker", [
-			"manifest",
-			"inspect",
-			ref
-		]);
-		if (code === 0) return {
-			ref,
-			status: "found"
-		};
-		const output = `${stderr}\n${stdout}`.trim();
-		return isMissingManifest(output) ? {
-			ref,
-			status: "missing"
-		} : {
-			ref,
-			status: "unreachable",
-			detail: output
-		};
-	},
-	async build(stack, services) {
-		await require_local.run("docker", compose(stack, ["build", ...services]), {
-			cwd: stack.cwd,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			}
-		});
-	},
-	async pull(stack, services) {
-		await require_local.run("docker", compose(stack, ["pull", ...services]), { cwd: stack.cwd });
-	},
-	async up(stack, services) {
-		await require_local.run("docker", compose(stack, [
-			"up",
-			"-d",
-			"--wait",
-			`--wait-timeout=${WAIT_TIMEOUT_S}`,
-			...services ? [] : ["--remove-orphans"],
-			...services ?? []
-		]), { cwd: stack.cwd });
-	},
-	async down(stack) {
-		await require_local.run("docker", compose(stack, ["down"]), { cwd: stack.cwd });
-	},
-	async port(stack, service, inside) {
-		const output = await require_local.runOutput("docker", compose(stack, [
-			"port",
-			service,
-			String(inside)
-		]), { cwd: stack.cwd });
-		const port = Number(output.trim().split(":").pop());
-		if (!Number.isInteger(port) || port <= 0) throw new ServicePortUnknown(service, inside, output);
-		return port;
-	},
-	async copyOut(stack, service, from, to) {
-		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
-		await require_local.run("docker", compose(stack, [
-			"cp",
-			`${service}:${from}`,
-			to
-		]), { cwd: stack.cwd });
-	},
-	async digest(ref) {
-		const { code, stdout } = await capture("docker", [
-			"image",
-			"inspect",
-			"--format={{json .RepoDigests}} {{.Id}}",
-			ref
-		]);
-		if (code !== 0) return void 0;
-		const [json = "[]", id] = stdout.trim().split(" ");
-		const repository = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-		try {
-			const digests = JSON.parse(json);
-			const match = Array.isArray(digests) ? digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`)) : void 0;
-			if (match) return match.slice(repository.length + 1);
-		} catch {}
-		return id || void 0;
-	}
-};
-//#endregion
-//#region src/compose/images.ts
-/**
-* The tag a site's image carries for a release.
-*
-* A site's public URLs are inlined when it is built, so one bundle serves one
-* stage: `v1.4.0-production` and `v1.4.0-staging` are two images of the same
-* commit. A backend reads its URLs at runtime, so one image serves every stage
-* and its tag is the release's alone.
-*/
-function siteTag(tag, stage) {
-	return `${tag}-${stage}`;
-}
-/** Images a tag names that the registry does not have. */
-var ImageTagNotFound = class extends Error {
-	tag;
-	refs;
-	constructor(tag, refs) {
-		super(`The registry has no image for ${refs.length === 1 ? "this app" : `${refs.length} apps`} at '${tag}':\n` + refs.map((ref) => `  - ${ref}`).join("\n") + `\nNothing was pulled or started. Push '${tag}' for every app from CI, pick a tag that exists, or run without --tag to build from this checkout.`);
-		this.tag = tag;
-		this.refs = refs;
-		this.name = "ImageTagNotFound";
-	}
-};
-/** The registry did not answer, or did not let this machine in. */
-var RegistryUnreachable = class extends Error {
-	ref;
-	detail;
-	constructor(ref, detail) {
-		super(`Could not ask the registry about ${ref}: ${detail || "no answer"}\nNothing was pulled or started. Check the registry is reachable and that this machine is logged in to it (\`docker login <registry>\`).`);
-		this.ref = ref;
-		this.detail = detail;
-		this.name = "RegistryUnreachable";
-	}
-};
-/**
-* Assert every image exists, before anything else happens.
-*
-* Asked all at once and reported all at once: a release missing two images is
-* one problem with two names, and finding the second only after fixing the
-* first is a slower way to learn the same thing.
-*
-* @throws {RegistryUnreachable} when the registry cannot say
-* @throws {ImageTagNotFound} listing every missing image
-*/
-async function assertImagesExist(docker, tag, images) {
-	const lookups = await Promise.all(images.map((image) => docker.lookup(image.ref)));
-	const unreachable = lookups.find((lookup) => lookup.status === "unreachable");
-	if (unreachable?.status === "unreachable") throw new RegistryUnreachable(unreachable.ref, unreachable.detail);
-	const missing = lookups.filter((lookup) => lookup.status === "missing").map((lookup) => lookup.ref);
-	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
-}
-//#endregion
-//#region src/compose/caddyfile.ts
-/** The Caddyfile for a stack's edge. */
-function edgeCaddyfile(sites, options) {
-	const global = options.local ? `{
-	# No ACME and no public DNS: the CA is Caddy's own and the names resolve
-	# to this machine.
-	local_certs
-	auto_https disable_redirects
-}` : options.email ? `{
-	email ${options.email}
-}` : "";
-	const blocks = sites.map(({ host, upstream }) => `https://${host} {${options.local ? `
-	tls internal
-` : ""}
-	# Host and X-Forwarded-* are passed through as Caddy does by default, so
-	# an app builds redirects, cookies and links on the address a caller used.
-	reverse_proxy ${upstream} {
-		# Never buffer: a streamed response — server-sent events, a Next.js
-		# RSC payload — reaches the client as each chunk is written.
-		flush_interval -1
-	}
-}`);
-	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
-}
-const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
-#
-# One host per API and site, each in front of its own container.
-`;
-//#endregion
-//#region src/compose/stack.ts
-/**
-* The stack a workspace runs as for one stage — pure.
-*
-* Everything `gkm compose` writes is decided here, as data: the compose file,
-* the Caddyfile, one env file per backend, and the image each app runs. The
-* command around it reads the workspace, asks the registry, writes the files
-* and starts Docker; none of those decide anything, so all of it can be
-* asserted without a daemon.
-*
-* The values come from the same derivations every other target uses. The
-* plan is reconcile's `planFor`, the keys an app reads are `appEnvKeys`, and
-* every URL is `envFor`'s — asked twice, once with each app at its public
-* address and once on the compose network, because a browser and a sibling
-* service reach the same API by different names.
-*/
-/** Where a stack's files are written, relative to the workspace root. */
-function stackDir(stage) {
-	return `.gkm/compose/${stage}`;
-}
-/**
-* The compose project a stage's stack runs as.
-*
-* The deploy identity's scope, so two workspaces with one name in different
-* namespaces never share containers or volumes — and the stage, so a
-* machine can run two stages side by side.
-*/
-function composeProject(identity) {
-	return `${identity.scope}-${identity.stage}`;
-}
-/** The ports the edge is published on, and the variables that move them. */
-const EDGE_PORT_ENV = {
-	https: "GKM_COMPOSE_HTTPS_PORT",
-	http: "GKM_COMPOSE_HTTP_PORT"
-};
-/**
-* Containers this target does not run.
-*
-* Object storage is the stage's own — an externally hosted bucket whose URL
-* the stage's secrets hold — and so is a deployed stage's mail. The AWS
-* emulator never applies: a stack is a server target, whose events are
-* pg-boss.
-*/
-const NOT_RUN = {
-	minio: true,
-	localstack: true,
-	caddy: true
-};
-/** Kinds whose `<ID>_URL` a stage must be given, because nothing here runs them. */
-const EXTERNAL_KINDS = {
-	objects: true,
-	"file-server": true
-};
-/** The S3 client's credentials, read beside a bucket's URL when it has them. */
-const STORAGE_KEYS = [
-	"AWS_ACCESS_KEY_ID",
-	"AWS_SECRET_ACCESS_KEY",
-	"AWS_REGION"
-];
-/** A bucket the stack needs and the stage was not given. */
-var BucketNotConfigured = class extends Error {
-	app;
-	id;
-	key;
-	stage;
-	constructor(app, id, key, stage) {
-		super(`'${app}' uses the bucket '${id}', and gkm compose runs no object storage: the stage needs an externally hosted bucket. Set its URL in the stage's secrets: gkm secrets:set ${key} 's3://…' --stage ${stage}`);
-		this.app = app;
-		this.id = id;
-		this.key = key;
-		this.stage = stage;
-		this.name = "BucketNotConfigured";
-	}
-};
-/** A value only the stage's secrets can hold, and they do not. */
-var StageSecretMissing = class extends Error {
-	app;
-	key;
-	stage;
-	constructor(app, key, stage) {
-		super(`'${app}' reads ${key}, and the stage '${stage}' has none. Nothing in the stack can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
-		this.app = app;
-		this.key = key;
-		this.stage = stage;
-		this.name = "StageSecretMissing";
-	}
-};
-/** A deployed stage's secrets with no seed to derive its passwords from. */
-var StageSeedMissing = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose without --dry-run once, or gkm deploy, to generate it.`);
-		this.stage = stage;
-		this.name = "StageSeedMissing";
-	}
-};
-/** A workspace with no API and no site to run. */
-var NothingToCompose = class extends Error {
-	root;
-	constructor(root) {
-		super(`${root} declares no RestApi and no site, so a stack would run nothing. Workers and mobile apps are not run by gkm compose yet.`);
-		this.root = root;
-		this.name = "NothingToCompose";
-	}
-};
-/** A value that cannot be written to an env file a line at a time. */
-var EnvValueMultiline = class extends Error {
-	app;
-	key;
-	constructor(app, key) {
-		super(`${key} for '${app}' spans more than one line, and an env file holds one value per line. Store it on one line — base64, or JSON — and decode it where it is read.`);
-		this.app = app;
-		this.key = key;
-		this.name = "EnvValueMultiline";
-	}
-};
-/** The services a stack's apps wait on and the edge waits on in turn. */
-const HEALTHY = { condition: "service_healthy" };
-/**
-* An app's health check: its own server, asked on 127.0.0.1 — not
-* `localhost`, which resolves to `::1` first in an Alpine container while a
-* server may listen on IPv4 alone.
-*/
-function probe(port, path) {
-	return {
-		test: [
-			"CMD",
-			"wget",
-			"-q",
-			"-O",
-			"/dev/null",
-			`http://127.0.0.1:${port}${path}`
-		],
-		interval: "5s",
-		timeout: "3s",
-		retries: 20,
-		start_period: "10s"
-	};
-}
-/** The stack for one stage. */
-function composeStack(input) {
-	const { workspace, manifest, stage, identity } = input;
-	const local = stage === workspace.stages.local;
-	const project = composeProject(identity);
-	const custom = input.secrets?.custom ?? {};
-	const https = input.ports?.https ?? 443;
-	const http = input.ports?.http ?? 80;
-	const plan = require_sniffer.planFor(manifest, stage, (0, _geekmidas_manifest.provisionOrder)(manifest), {
-		localStage: workspace.stages.local,
-		events: require_fakes.DEFAULT_EVENTS.server,
-		cache: require_fakes.DEFAULT_CACHE.server,
-		edge: false
-	});
-	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	const seed = local ? void 0 : input.secrets?.seed;
-	if (!local && !seed) throw new StageSeedMissing(stage);
-	const credential = {
-		master: local ? "geekmidas" : require_sniffer.localRolePassword(workspace.name, plan, "master", seed),
-		...seed ? { seed } : {}
-	};
-	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => local || c !== "mailpit").sort();
-	const apps = stackApps(workspace, manifest, plan, {
-		local,
-		stage,
-		https,
-		identity,
-		images: input.images
-	});
-	if (apps.length === 0) throw new NothingToCompose(workspace.root);
-	const derivation = {
-		project: workspace.name,
-		master: credential.master,
-		...credential.seed ? { seed: credential.seed } : {}
-	};
-	const outside = require_sniffer.networkEnv(plan, {
-		...derivation,
-		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
-	});
-	const inside = require_sniffer.networkEnv(plan, {
-		...derivation,
-		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
-	});
-	const owners = /* @__PURE__ */ new Map();
-	for (const resource of plan.resources) {
-		owners.set(resource.envKey, resource);
-		if (resource.kind === "email") {
-			owners.set((0, _geekmidas_manifest.provideKey)(resource.id, "from"), resource);
-			owners.set((0, _geekmidas_manifest.provideKey)(resource.id, "inboxUrl"), resource);
-		}
-		if (resource.kind === "external-api") owners.set((0, _geekmidas_manifest.provideKey)(resource.id, "credentials"), resource);
-	}
-	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
-	const appById = new Map(apps.map((app) => [app.id, app]));
-	/**
-	* What a key resolves to for one app, from the stage's secrets where only
-	* they can hold it, and the derivations otherwise.
-	*/
-	const valueFor = (app, key, owner) => {
-		if (owner && EXTERNAL_KINDS[owner.kind] && key === owner.envKey) {
-			const value = custom[key];
-			if (value === void 0) throw new BucketNotConfigured(app.name, owner.id, key, stage);
-			return value;
-		}
-		if (owner && suppliedBy(owner, key, local)) {
-			const value = custom[key];
-			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
-			return value;
-		}
-		if (custom[key] !== void 0) return custom[key];
-		const surface = surfaceUrls.get(key);
-		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
-		return outside[key];
-	};
-	for (const app of apps) {
-		if (app.kind === "site") {
-			const site = manifest[app.id];
-			if (site?.kind !== "site") continue;
-			const args = {};
-			for (const [key, source] of Object.entries((0, _geekmidas_manifest.publicEnvFor)(site, manifest))) {
-				const value = valueFor(app, source, owners.get(source));
-				if (value !== void 0) args[key] = value;
-			}
-			if (app.build && Object.keys(args).length > 0) app.build.args = args;
-			continue;
-		}
-		const keys = require_sniffer.appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
-		const values = {};
-		for (const key of [...keys].sort()) {
-			const owner = owners.get(key) ?? storageOwner(key, plan);
-			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
-			if (STORAGE_KEYS.includes(key)) {
-				if (custom[key] !== void 0) values[key] = custom[key];
-				continue;
-			}
-			const value = valueFor(app, key, owner);
-			if (value !== void 0) values[key] = value;
-		}
-		const trusted = (0, _geekmidas_manifest.provideKey)(app.id, "trustedOrigins");
-		if (keys.has(trusted)) {
-			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${caller.name}:${caller.port}`);
-			const origins = [...(values[trusted] ?? "").split(",").filter(Boolean), ...internal];
-			values[trusted] = [...new Set(origins)].join(",");
-		}
-		app.env = {
-			...values,
-			NODE_ENV: "production",
-			PORT: String(app.port),
-			STAGE: stage
-		};
-		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
-	}
-	const compose = stackFile({
-		project,
-		plan,
-		infra,
-		apps,
-		master: credential.master,
-		https,
-		http
-	});
-	const caddyfile = edgeCaddyfile(apps.map((app) => ({
-		host: app.host,
-		upstream: `${app.name}:${app.port}`
-	})), { local });
-	const dockerfiles = {};
-	for (const app of apps) {
-		if (!app.build) continue;
-		dockerfiles[app.build.dockerfile] = app.kind === "site" ? require_sniffer.siteDockerfile(app.name, workspace.apps[app.name], {
-			turboPackage: input.packages?.[app.name] ?? app.name,
-			packageManager: input.packageManager ?? "pnpm",
-			manifest
-		}) : require_sniffer.generateSlimDockerfile({
-			imageName: app.name,
-			baseImage: "node:22-alpine",
-			port: app.port,
-			healthCheckPath: "/health",
-			prebuilt: true,
-			packageManager: input.packageManager ?? "pnpm",
-			bundle: `${app.path}/.gkm/server/dist/server.mjs`
-		});
-	}
-	return {
-		project,
-		stage,
-		local,
-		apps,
-		infra,
-		compose,
-		caddyfile,
-		dockerfiles,
-		plan,
-		credential
-	};
-	/** Whether only the stage's secrets can supply `key` to `owner`. */
-	function suppliedBy(owner, key, isLocal) {
-		if (owner.kind === "credential") return true;
-		if (owner.kind === "external-api") return key === (0, _geekmidas_manifest.provideKey)(owner.id, "credentials");
-		if (isLocal) return false;
-		if (owner.kind === "secret" || owner.kind === "encryption") return true;
-		return owner.kind === "email" && !key.endsWith("_INBOX_URL");
-	}
-}
-/** Which bucket an S3 credential key belongs to — the first one declared. */
-function storageOwner(key, plan) {
-	if (!STORAGE_KEYS.includes(key)) return void 0;
-	return plan.resources.find((r) => r.kind === "objects");
-}
-/** The apps a stack runs: every API and every site, at its stage address. */
-function stackApps(workspace, manifest, plan, options) {
-	const apps = [];
-	const resources = new Map(plan.resources.map((r) => [r.id, r]));
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
-		const name = require_derive.appKey(id);
-		const app = workspace.apps[name];
-		const resource = resources.get(id);
-		if (!app || !resource || !app.port) continue;
-		const host = hostOf(name, app, workspace, resource, options);
-		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
-		const ref = require_sniffer.validateImageRef(require_store.imageRef(options.identity, name, options.images.registry, tag));
-		apps.push({
-			app: name,
-			name,
-			id,
-			kind: declaration.kind,
-			path: app.path,
-			port: app.port,
-			host,
-			url: `https://${host}${options.local && options.https !== 443 ? `:${options.https}` : ""}`,
-			ref,
-			tag,
-			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${name}` } } : {}
-		});
-	}
-	return apps.sort((a, b) => a.name.localeCompare(b.name));
-}
-/**
-* The host an app answers on for a stage: the `gkm dev` edge's
-* `*.localhost` names for the local stage, and the stage's domain — by the
-* same rule a deploy follows — for any other.
-*/
-function hostOf(name, app, workspace, resource, options) {
-	if (options.local) return require_sniffer.hostFor(resource, workspace.name);
-	return require_sniffer.resolveHost(name, app, options.stage, workspace.deploy?.domains, require_sniffer.isMainFrontendApp(name, app, workspace.apps));
-}
-/** The compose document: the infrastructure, the apps, and the edge. */
-function stackFile(options) {
-	const { project, plan, infra, apps } = options;
-	const derived = require_sniffer.composeFor({
-		...plan,
-		containers: [...infra]
-	}, {
-		project,
-		ports: Object.fromEntries(require_sniffer.portKeys(infra, plan.fakes).map((key) => [key, 0]))
-	});
-	const services = {};
-	const volumes = {
-		...derived.volumes,
-		"caddy-data": {},
-		"caddy-config": {}
-	};
-	for (const name of infra) {
-		const { ports: _ports, depends_on, profiles: _profiles, ...service } = derived.services[name];
-		services[name] = {
-			...service,
-			...depends_on?.length ? { depends_on: Object.fromEntries(depends_on.map((dep) => [dep, HEALTHY])) } : {}
-		};
-	}
-	const postgres = services.postgres;
-	if (postgres) {
-		postgres.environment = {
-			...postgres.environment,
-			POSTGRES_PASSWORD: options.master
-		};
-		postgres.ports = ["127.0.0.1::5432"];
-	}
-	for (const app of apps) services[app.name] = {
-		image: app.ref,
-		...app.build ? { build: {
-			context: "../../..",
-			dockerfile: app.build.dockerfile,
-			...app.build.args ? { args: app.build.args } : {}
-		} } : {},
-		restart: "unless-stopped",
-		...app.kind === "rest-api" ? {
-			env_file: [{
-				path: `./${app.name}.env`,
-				format: "raw"
-			}],
-			...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {}
-		} : {},
-		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
-	};
-	services.caddy = {
-		image: require_sniffer.DEFAULT_IMAGES.caddy,
-		restart: "unless-stopped",
-		ports: [`${options.https}:443`, `${options.http}:80`],
-		volumes: [
-			"./Caddyfile:/etc/caddy/Caddyfile:ro",
-			"caddy-data:/data",
-			"caddy-config:/config"
-		],
-		depends_on: Object.fromEntries(apps.map((app) => [app.name, HEALTHY])),
-		healthcheck: {
-			test: [
-				"CMD",
-				"caddy",
-				"version"
-			],
-			interval: "10s",
-			timeout: "5s",
-			retries: 5
-		}
-	};
-	return {
-		name: project,
-		services,
-		volumes
-	};
-}
-/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
-function envFile(env) {
-	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
-}
-//#endregion
 //#region src/compose/index.ts
 /**
 * `gkm compose` — a workspace's APIs and sites for one stage, as one Docker
 * Compose stack behind Caddy.
 *
-* The order is the point of this file, and the rules it keeps are these:
-*
-* - A tag is checked before anything happens. Every app's image is asked of
-*   the registry first; one missing image stops the run naming them all, and
-*   nothing is written, pulled or started.
-* - The databases exist before the apps do. Postgres comes up alone, its
-*   databases, roles and grants are created and its migrations applied from
-*   this machine, and only then do the apps start — so an app never boots
-*   against a schema that is not there yet.
-* - What a stage runs is recorded. Each app's tag and the digest it resolved
-*   to are written to the stage's state, so "what is this stage running" has
-*   an exact answer.
-*
-* Docker, the registry, the build and the clock are injected, so the rules are
-* asserted without a daemon; the defaults are the real ones.
+* A convenience over `gkm deploy --target compose`: the stage defaults to the
+* local one, `--build`/`--pull` choose the images whatever `--tag` says, and
+* `--down` stops the stack. Everything else — the order, the image check, the
+* state, the health checks — is the compose target's, run through the same
+* `deploy()` as any other target, so there is one way a stack comes up.
 */
-const logger$4 = console;
 /** `--build` and `--pull` together ask for two different things. */
 var ComposeModeConflict = class extends Error {
 	constructor() {
@@ -4770,319 +3805,51 @@ var ComposeModeConflict = class extends Error {
 		this.name = "ComposeModeConflict";
 	}
 };
-/** A build with no commit to tag its images with. */
-var NoGitRevision = class extends Error {
-	root;
-	constructor(root) {
-		super(`Images built here are tagged with the commit they were built from, and ${root} is not in a git repository with a commit. Commit, or pass --tag to name the images yourself.`);
-		this.root = root;
-		this.name = "NoGitRevision";
-	}
-};
-/** A port variable that does not hold a port. */
-var EdgePortInvalid = class extends Error {
-	variable;
-	value;
-	constructor(variable, value) {
-		super(`${variable}=${value} is not a port. Set it to a number between 1 and 65535, or unset it for the default.`);
-		this.variable = variable;
-		this.value = value;
-		this.name = "EdgePortInvalid";
-	}
-};
-/** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
-async function gitRevision(root) {
-	let sha;
-	try {
-		sha = (await require_local.runOutput("git", [
-			"rev-parse",
-			"--short",
-			"HEAD"
-		], { cwd: root })).trim();
-	} catch {
-		throw new NoGitRevision(root);
-	}
-	if (!sha) throw new NoGitRevision(root);
-	return (await require_local.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
-}
-/**
-* Bundle a backend with the gkm that is running — the same build a deploy
-* makes, so the image holds one file and no dependencies.
-*/
-async function bundleWithThisCli(appRoot) {
-	const entry = process.argv[1];
-	if (!entry) return;
-	await require_local.run(process.execPath, [
-		...process.execArgv,
-		entry,
-		"build",
-		"--provider",
-		"server",
-		"--production"
-	], { cwd: appRoot });
-}
-const defaultDeps = {
-	docker: dockerCompose,
-	bundle: bundleWithThisCli,
-	revision: gitRevision
-};
-/** The edge's ports, from the environment — 443 and 80 when unset. */
-function edgePorts(env = process.env) {
-	const read = (variable, fallback) => {
-		const value = env[variable];
-		if (value === void 0 || value === "") return fallback;
-		const port = Number(value);
-		if (!Number.isInteger(port) || port < 1 || port > 65535) throw new EdgePortInvalid(variable, value);
-		return port;
-	};
-	return {
-		https: read(EDGE_PORT_ENV.https, 443),
-		http: read(EDGE_PORT_ENV.http, 80)
-	};
-}
 /** `gkm compose`. */
 async function composeCommand(options = {}, deps = {}) {
-	const { docker, bundle, revision } = {
-		...defaultDeps,
-		...deps
-	};
-	const env = deps.env ?? process.env;
 	if (options.build && options.pull) throw new ComposeModeConflict();
-	const { workspace } = await require_config.loadWorkspaceConfig(options.cwd);
-	const root = workspace.root;
+	const cwd = (0, node_path.resolve)(options.cwd ?? process.cwd());
+	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
 	const stage = options.stage ?? workspace.stages.local;
-	if (!(stage === workspace.stages.local)) require_workspace.assertDeployedStage(workspace.stages, stage);
-	const identity = require_store.deployIdentity(workspace, stage);
-	const dir = (0, node_path.join)(root, stackDir(stage));
-	const file = (0, node_path.join)(dir, "docker-compose.yml");
-	const ref = {
-		project: composeProject(identity),
-		file,
-		cwd: root
-	};
 	if (options.down) {
-		await docker.down(ref);
-		logger$4.log(`🛑 Stopped ${ref.project}. Its volumes are kept.`);
+		const ref = {
+			project: require_compose.composeProject(require_state.deployIdentity(workspace, stage)),
+			file: (0, node_path.join)(workspace.root, require_compose.stackDir(stage), "docker-compose.yml"),
+			cwd: workspace.root
+		};
+		await (deps.docker ?? require_compose.dockerCompose).down(ref);
+		console.log(`🛑 Stopped ${ref.project}. Its volumes are kept.`);
 		return;
 	}
-	const sources = {};
-	const runnables = {};
-	const manifest = await require_discover.discover({
-		patterns: require_sniffer.constructGlobs(workspace),
-		cwd: root,
-		sources,
-		runnables
-	});
-	const mode = options.build || !options.pull && !options.tag ? "build" : "pull";
-	const tag = options.tag ?? (mode === "pull" ? "latest" : await revision(root));
-	const { secrets, keep } = await stageSecrets(workspace, manifest, stage);
-	const packageManager = require_sniffer.detectPackageManager(root);
-	const stack = composeStack({
-		workspace,
-		manifest,
-		runnables,
+	let finished;
+	const mode = options.build ? "build" : options.pull ? "pull" : void 0;
+	const tag = options.tag ?? (options.pull ? "latest" : void 0);
+	const result = await require_deploy.deploy({
+		cwd,
 		stage,
-		identity,
-		images: {
-			mode,
-			tag,
-			...workspace.deploy?.dokploy?.registry ? { registry: workspace.deploy.dokploy.registry } : {}
-		},
-		secrets,
-		ports: edgePorts(env),
-		packageManager,
-		packages: Object.fromEntries(Object.entries(workspace.apps).map(([name, app]) => [name, require_sniffer.appPackageName(root, name, app.path)]))
-	});
-	if (mode === "pull" && !options.dryRun) await assertImagesExist(docker, tag, stack.apps);
-	if (options.dryRun) keep.skip();
-	else await keep.write();
-	const files = await writeStack(root, dir, stack);
-	printPlan(stack, mode, files);
-	if (options.dryRun) return {
-		stack,
-		files
-	};
-	const store = deps.state ? await deps.state(workspace) : await require_sniffer.createStateStore({
-		config: workspace.state,
-		workspaceRoot: root,
-		workspaceName: workspace.name
-	});
-	const lock = await store.lock(stage, { operation: "compose" });
-	try {
-		const apps = stack.apps.map((app) => app.name);
-		if (mode === "build") {
-			for (const app of stack.apps.filter((a) => a.kind === "rest-api")) {
-				logger$4.log(`\n📦 Bundling ${app.name}…`);
-				await bundle((0, node_path.join)(root, app.path));
+		target: "compose",
+		targets: { compose: require_compose.composeTarget({
+			...deps,
+			...mode ? { mode } : {},
+			report: (done) => {
+				finished = done;
 			}
-			logger$4.log("\n🐳 Building images…");
-			await docker.build(ref, apps);
-		} else {
-			logger$4.log(`\n🐳 Pulling ${tag}…`);
-			await docker.pull(ref, apps);
-		}
-		if (stack.infra.length > 0) {
-			logger$4.log(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
-			await docker.up(ref, stack.infra);
+		}) },
+		...tag ? { tag } : {},
+		...options.dryRun ? { dryRun: true } : {},
+		logger: {
+			info: (message) => console.log(message),
+			warn: (message) => console.warn(message),
+			error: (message) => console.error(message)
 		}
-		if (stack.infra.includes("postgres")) await prepareDatabases(stack, workspace, manifest, sources, {
-			docker,
-			ref,
-			sql: deps.sql ?? require_sniffer.pgClient,
-			migrate: deps.migrate ?? migrateDatabases
-		});
-		logger$4.log("\n🚀 Starting the stack…");
-		await docker.up(ref);
-		if (stack.local) await docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", (0, node_path.join)(dir, "caddy-root.crt")).catch(() => {});
-		const images = await recordImages(store, stack, docker, mode);
-		logger$4.log(`\n✅ ${ref.project} is running:`);
-		for (const app of stack.apps) logger$4.log(`   ${app.name.padEnd(12)} ${app.url}`);
-		if (stack.local) logger$4.log(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${(0, node_path.join)(stackDir(stage), "caddy-root.crt")}`);
-		return {
-			stack,
-			files,
-			images
-		};
-	} finally {
-		await lock.release();
-	}
-}
-/**
-* The stage's secrets — and, for a deployed stage, everything it generates
-* once: its seed, and each declared secret and keyring. Written back before
-* anything is derived from them, so the next run derives the same passwords.
-*/
-async function stageSecrets(workspace, manifest, stage) {
-	const store = await require_store.secretsStoreFor(workspace, stage);
-	const stored = await store.read(stage);
-	const nothing = {
-		write: async () => {},
-		skip: () => {}
-	};
-	if (stage === workspace.stages.local) return {
-		secrets: stored,
-		keep: nothing
-	};
-	const { secrets, generated } = require_sniffer.withGeneratedSecrets(stored ?? require_storage.initStageSecrets(stage), manifest);
-	if (generated.length === 0) return {
-		secrets,
-		keep: nothing
-	};
+	}).result;
+	if (!finished) return void 0;
 	return {
-		secrets,
-		keep: {
-			async write() {
-				await store.write(stage, secrets);
-				logger$4.log(`🔑 Generated for "${stage}" (${store.name}): ${generated.join(", ")}`);
-			},
-			skip() {
-				logger$4.log(`🔑 "${stage}" has no ${generated.join(", ")} yet; this dry run used values it did not keep.`);
-			}
-		}
-	};
-}
-/** Write the stack's files: owner-only, since the env files hold secrets. */
-async function writeStack(root, dir, stack) {
-	await (0, node_fs_promises.mkdir)(dir, {
-		recursive: true,
-		mode: 448
-	});
-	await (0, node_fs_promises.chmod)(dir, 448);
-	const files = [];
-	const write = async (path, content, mode = 420) => {
-		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), { recursive: true });
-		await (0, node_fs_promises.writeFile)(path, content, { mode });
-		await (0, node_fs_promises.chmod)(path, mode);
-		files.push(path);
+		stack: finished.stack,
+		files: finished.files,
+		...options.dryRun ? {} : { images: finished.images },
+		deploy: result
 	};
-	await write((0, node_path.join)(dir, "docker-compose.yml"), composeYaml(stack));
-	await write((0, node_path.join)(dir, "Caddyfile"), stack.caddyfile);
-	for (const app of stack.apps) if (app.env) await write((0, node_path.join)(dir, `${app.name}.env`), envFile(app.env), 384);
-	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
-	await ignoreStacks(root);
-	return files;
-}
-/** Make sure the build context leaves `.gkm/compose` out. */
-async function ignoreStacks(root) {
-	const path = (0, node_path.join)(root, ".dockerignore");
-	if (!(0, node_fs.existsSync)(path)) {
-		await (0, node_fs_promises.writeFile)(path, require_sniffer.generateDockerignore());
-		return;
-	}
-	const current = await (0, node_fs_promises.readFile)(path, "utf-8");
-	if (/^\/?\.gkm\/compose\/?$|^\/?\.gkm\/?$/m.test(current)) return;
-	await (0, node_fs_promises.appendFile)(path, `${current.endsWith("\n") ? "" : "\n"}\n# gkm compose's stacks: each app's env file holds its stage's secrets\n.gkm/compose\n`);
-}
-function composeYaml(stack) {
-	return `# Generated by gkm compose from the construct manifest — do not edit.
-# The ${stack.stage} stage's APIs and sites behind one Caddy. Each backend
-# reads exactly the keys in its own env file beside this one.
-#
-#   gkm compose${stack.local ? "" : ` --stage ${stack.stage}`}          start or update it
-#   gkm compose${stack.local ? "" : ` --stage ${stack.stage}`} --down   stop it
-${(0, yaml.stringify)(stack.compose, {
-		lineWidth: 0,
-		aliasDuplicateObjects: false
-	})}`;
-}
-/** Create what the plan names in the stack's Postgres, then migrate it. */
-async function prepareDatabases(stack, workspace, manifest, sources, deps) {
-	const port = await deps.docker.port(deps.ref, "postgres", 5432);
-	const statements = require_sniffer.postgresStatements(stack.plan, workspace.name, stack.credential.seed);
-	if (statements.length > 0) {
-		logger$4.log("🗄️  Creating databases, roles and grants…");
-		await require_sniffer.applyPostgres(deps.sql(port, stack.credential.master), statements);
-	}
-	const env = require_sniffer.envFor(stack.plan, {
-		ports: { [require_sniffer.primaryPortKey("postgres")]: port },
-		project: workspace.name,
-		master: stack.credential.master,
-		...stack.credential.seed ? { seed: stack.credential.seed } : {}
-	});
-	const runs = await deps.migrate({
-		root: workspace.root,
-		manifest,
-		sources,
-		env
-	});
-	for (const { target, applied } of runs) if (applied.length > 0) logger$4.log(`🗄️  ${target.migrations}: applied ${applied.length}`);
-}
-/**
-* Record each app's image in the stage's state: the tag it ran and the digest
-* the tag resolved to — or, for an image built here and never pushed, its
-* content id.
-*/
-async function recordImages(store, stack, docker, mode) {
-	if (!await store.read(stack.stage)) await store.write(stack.stage, require_sniffer.createEmptyState(stack.stage, "", ""), { expectedVersion: null });
-	const images = {};
-	for (const app of stack.apps) {
-		const digest = await docker.digest(app.ref);
-		images[app.name] = {
-			ref: app.ref,
-			tag: app.tag,
-			...digest ? { digest } : {}
-		};
-		await store.putResource(stack.stage, {
-			key: `compose:${app.name}`,
-			type: "compose-image",
-			status: "ready",
-			...digest ? { id: digest } : {},
-			data: {
-				project: stack.project,
-				ref: app.ref,
-				tag: app.tag,
-				source: mode,
-				...digest ? { digest } : {}
-			}
-		});
-	}
-	return images;
-}
-function printPlan(stack, mode, files) {
-	logger$4.log(`\n🧱 ${stack.project} — stage ${stack.stage}`);
-	for (const app of stack.apps) logger$4.log(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode === "build" ? "build" : "pull"} ${app.ref}`);
-	if (stack.infra.length > 0) logger$4.log(`   infrastructure: ${stack.infra.join(", ")}`);
-	logger$4.log(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
 }
 /**
 * Format a fatal error for display.
@@ -5108,7 +3875,7 @@ const logger$3 = console;
 * Get the Dokploy API token from stored credentials or environment
 */
 async function getApiToken() {
-	const token = await require_local.getDokployToken();
+	const token = await require_credentials.getDokployToken();
 	if (!token) throw new Error("Dokploy credentials not found.\nRun \"gkm login --service dokploy\" to authenticate, or set DOKPLOY_API_TOKEN.");
 	return token;
 }
@@ -5117,7 +3884,7 @@ async function getApiToken() {
 */
 async function getEndpoint(providedEndpoint) {
 	if (providedEndpoint) return providedEndpoint;
-	const stored = await require_local.getDokployCredentials();
+	const stored = await require_credentials.getDokployCredentials();
 	if (stored) return stored.endpoint;
 	throw new Error("Dokploy endpoint not specified.\nEither run \"gkm login --service dokploy\" first, or provide --endpoint.");
 }
@@ -5220,7 +3987,7 @@ async function deployListCommand(options) {
 			logger$3.log("   Run \"gkm registry:setup\" to configure a registry");
 			return;
 		}
-		const storedRegistryId = await require_local.getDokployRegistryId();
+		const storedRegistryId = await require_credentials.getDokployRegistryId();
 		for (const registry of registries) {
 			const marker = registry.registryId === storedRegistryId ? " (default)" : "";
 			logger$3.log(`\n   ${registry.registryName}${marker} (${registry.registryId})`);
@@ -6489,25 +5256,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.64",
-	"@geekmidas/auth": "~10.0.0-alpha.64",
-	"@geekmidas/cache": "~10.0.0-alpha.64",
-	"@geekmidas/client": "~10.0.0-alpha.64",
-	"@geekmidas/cloud": "~10.0.0-alpha.64",
-	"@geekmidas/constructs": "~10.0.0-alpha.64",
-	"@geekmidas/db": "~10.0.0-alpha.64",
-	"@geekmidas/emailkit": "~10.0.0-alpha.64",
-	"@geekmidas/envkit": "~10.0.0-alpha.64",
-	"@geekmidas/errors": "~10.0.0-alpha.64",
-	"@geekmidas/events": "~10.0.0-alpha.64",
-	"@geekmidas/logger": "~10.0.0-alpha.64",
-	"@geekmidas/manifest": "~10.0.0-alpha.64",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.64",
-	"@geekmidas/schema": "~10.0.0-alpha.64",
-	"@geekmidas/services": "~10.0.0-alpha.64",
-	"@geekmidas/storage": "~10.0.0-alpha.64",
-	"@geekmidas/telescope": "~10.0.0-alpha.64",
-	"@geekmidas/testkit": "~10.0.0-alpha.64",
+	"@geekmidas/audit": "~10.0.0-alpha.66",
+	"@geekmidas/auth": "~10.0.0-alpha.66",
+	"@geekmidas/cache": "~10.0.0-alpha.66",
+	"@geekmidas/client": "~10.0.0-alpha.66",
+	"@geekmidas/cloud": "~10.0.0-alpha.66",
+	"@geekmidas/constructs": "~10.0.0-alpha.66",
+	"@geekmidas/db": "~10.0.0-alpha.66",
+	"@geekmidas/emailkit": "~10.0.0-alpha.66",
+	"@geekmidas/envkit": "~10.0.0-alpha.66",
+	"@geekmidas/errors": "~10.0.0-alpha.66",
+	"@geekmidas/events": "~10.0.0-alpha.66",
+	"@geekmidas/logger": "~10.0.0-alpha.66",
+	"@geekmidas/manifest": "~10.0.0-alpha.66",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.66",
+	"@geekmidas/schema": "~10.0.0-alpha.66",
+	"@geekmidas/services": "~10.0.0-alpha.66",
+	"@geekmidas/storage": "~10.0.0-alpha.66",
+	"@geekmidas/telescope": "~10.0.0-alpha.66",
+	"@geekmidas/testkit": "~10.0.0-alpha.66",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7090,7 +5857,7 @@ function deploy(options) {
           role-to-assume: \${{ vars.AWS_ROLE_ARN }}
           aws-region: ${options.region}
 ` : "";
-	const keyDir = `~/.gkm/keys/${require_store.projectKey({ name: options.name })}`;
+	const keyDir = `~/.gkm/keys/${require_state.projectKey({ name: options.name })}`;
 	const stageSecrets = sst ? credentials : `
       # The stage's secrets are kept in the encrypted .gkm/secrets/<stage>.json,
       # and each environment holds its key as GKM_SECRETS_KEY. .gkm/ is
@@ -11427,11 +10194,11 @@ async function initCommand(projectName, options = {}) {
 	}
 	devSecrets.custom = customSecrets;
 	const keys = {
-		key: require_store.projectKey({ name }),
+		key: require_state.projectKey({ name }),
 		legacy: [(0, node_path.basename)(targetDir)]
 	};
-	await new require_store.FileSecretsStore(targetDir, keys).write(local, devSecrets);
-	const keyPath = require_store.getKeyPath(local, keys);
+	await new require_state.FileSecretsStore(targetDir, keys).write(local, devSecrets);
+	const keyPath = require_state.getKeyPath(local, keys);
 	console.log(`  Secrets: .gkm/secrets/${local}.json (encrypted)`);
 	console.log(`  Key: ${keyPath}\n`);
 	if (!options.skipInstall) {
@@ -11666,9 +10433,9 @@ const logger$2 = console;
 */
 async function storeFor(stage) {
 	try {
-		return await require_store.secretsStoreFor(await require_config.loadWorkspaceSettings(), stage);
+		return await require_state.secretsStoreFor(await require_config.loadWorkspaceSettings(), stage);
 	} catch (error) {
-		if (error instanceof require_config.ConfigNotFound) return new require_store.FileSecretsStore(process.cwd());
+		if (error instanceof require_config.ConfigNotFound) return new require_state.FileSecretsStore(process.cwd());
 		throw error;
 	}
 }
@@ -11738,7 +10505,7 @@ async function secretsSetCommand(key, value, options) {
 		logger$2.error(`Secrets not found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
-	await store.write(stage, require_storage.withCustomSecret(secrets, key, secretValue));
+	await store.write(stage, require_state.withCustomSecret(secrets, key, secretValue));
 	logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}" (${store.name})`);
 }
 /**
@@ -11760,7 +10527,7 @@ async function secretsShowCommand(options) {
 		logger$2.log(`    host: ${creds.host}`);
 		logger$2.log(`    port: ${creds.port}`);
 		logger$2.log(`    username: ${creds.username}`);
-		logger$2.log(`    password: ${reveal ? creds.password : require_storage.maskPassword(creds.password)}`);
+		logger$2.log(`    password: ${reveal ? creds.password : require_state.maskPassword(creds.password)}`);
 		if (creds.database) logger$2.log(`    database: ${creds.database}`);
 		if (creds.bucket) logger$2.log(`    bucket: ${creds.bucket}`);
 	}
@@ -11770,7 +10537,7 @@ async function secretsShowCommand(options) {
 	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
 	if (Object.keys(secrets.custom).length > 0) {
 		logger$2.log("\nCustom Secrets:");
-		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : require_storage.maskPassword(value)}`);
+		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : require_state.maskPassword(value)}`);
 	}
 	if (!reveal) logger$2.log("\nUse --reveal to show actual values");
 }
@@ -11850,7 +10617,7 @@ async function secretsImportCommand(file, options) {
 function maskUrl(url) {
 	try {
 		const parsed = new URL(url);
-		if (parsed.password) parsed.password = require_storage.maskPassword(parsed.password);
+		if (parsed.password) parsed.password = require_state.maskPassword(parsed.password);
 		return parsed.toString();
 	} catch {
 		return url;
@@ -11894,7 +10661,7 @@ async function setupCommand(options = {}) {
 		logger$1.error("❌ Failed to resolve secrets. Exiting.");
 		process.exit(1);
 	}
-	const containers = await require_sniffer.derivedContainers(workspace, stage);
+	const containers = await require_state.derivedContainers(workspace, stage);
 	if (isMultiApp && containers.includes("postgres")) {
 		await writeDockerEnvFromSecrets(secrets, workspace.root);
 		logger$1.log("📄 Generated docker/.env with database passwords");
@@ -11913,7 +10680,7 @@ async function setupCommand(options = {}) {
 * free and quiet.
 */
 async function reconcileLocal(workspace, stage, options) {
-	const result = await require_sniffer.reconcileWorkspace(workspace, { stage });
+	const result = await require_state.reconcileWorkspace(workspace, { stage });
 	if (result.plan.containers.length === 0) {
 		logger$1.log("🐳 No containers declared");
 		return;
@@ -11923,7 +10690,7 @@ async function reconcileLocal(workspace, stage, options) {
 		return;
 	}
 	logger$1.log("🐳 Services");
-	for (const line of require_sniffer.describeServices(result.services)) logger$1.log(line);
+	for (const line of require_state.describeServices(result.services)) logger$1.log(line);
 	const url = result.plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site" || r.kind === "file-server").map((r) => result.env[r.envKey]).find((address) => address?.startsWith("https://"));
 	if (url) await ensureTrusted(workspace.root, url, { ...options.yes ? { assumeYes: true } : {} });
 }
@@ -11940,11 +10707,11 @@ async function resolveSecrets(stage, workspace, options) {
 		logger$1.log("🔐 Generating fresh secrets (--force)...");
 		return generateFreshSecrets(stage, workspace);
 	}
-	const store = await require_store.secretsStoreFor(workspace, stage);
+	const store = await require_state.secretsStoreFor(workspace, stage);
 	const secrets = await store.read(stage);
 	if (secrets) {
 		logger$1.log("🔐 Using existing secrets");
-		const reconciled = reconcileSecrets(secrets, workspace, await require_sniffer.derivedContainers(workspace, stage));
+		const reconciled = reconcileSecrets(secrets, workspace, await require_state.derivedContainers(workspace, stage));
 		if (reconciled) await store.write(stage, reconciled);
 		return reconciled ?? secrets;
 	}
@@ -12064,9 +10831,9 @@ function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
 */
 async function ensureStageSecrets(stage, cwd = process.cwd()) {
 	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
-	const store = await require_store.secretsStoreFor(workspace, stage);
+	const store = await require_state.secretsStoreFor(workspace, stage);
 	if (await store.read(stage)) return false;
-	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_sniffer.derivedContainers(workspace, stage));
+	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_state.derivedContainers(workspace, stage));
 	await store.write(stage, secrets);
 	return true;
 }
@@ -12074,8 +10841,8 @@ async function ensureStageSecrets(stage, cwd = process.cwd()) {
 * Generate fresh secrets for the workspace.
 */
 async function generateFreshSecrets(stage, workspace) {
-	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_sniffer.derivedContainers(workspace, stage));
-	const store = await require_store.secretsStoreFor(workspace, stage);
+	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_state.derivedContainers(workspace, stage));
+	const store = await require_state.secretsStoreFor(workspace, stage);
 	await store.write(stage, secrets);
 	logger$1.log(`   Secrets written to the "${stage}" store (${store.name})`);
 	return secrets;
@@ -12115,7 +10882,7 @@ function printSummary(workspace, stage) {
 * A no-op when nothing is recorded — no run yet, or one already torn down —
 * so running it twice, or before a setup, is harmless.
 */
-async function dropTestDatabases(cwd, root, sql = require_sniffer.pgClient) {
+async function dropTestDatabases(cwd, root, sql = require_state.pgClient) {
 	const readyPath = (0, node_path.join)(cwd, require_ready.TEST_READY_FILE);
 	const ready = await readReady(readyPath);
 	const recorded = ready?.databases;
@@ -12123,9 +10890,9 @@ async function dropTestDatabases(cwd, root, sql = require_sniffer.pgClient) {
 	const client = sql(recorded.port);
 	for (const name of recorded.names) {
 		if (!name.endsWith(`_test`)) throw new NotATestDatabase(name);
-		await client.query(void 0, `DROP DATABASE IF EXISTS ${require_sniffer.quoteIdentifier(name)} WITH (FORCE)`);
+		await client.query(void 0, `DROP DATABASE IF EXISTS ${require_state.quoteIdentifier(name)} WITH (FORCE)`);
 	}
-	await require_sniffer.forgetState(root, require_workspace.TEST_STAGE);
+	await require_state.forgetState(root, require_workspace.TEST_STAGE);
 	const { databases: _dropped, ...rest } = ready;
 	await (0, node_fs_promises.writeFile)(readyPath, JSON.stringify(rest, null, 2));
 	return recorded.names;
@@ -12165,10 +10932,10 @@ async function testCommand(options = {}) {
 		const { ensureStageSecrets } = await Promise.resolve().then(() => setup_exports);
 		if (await ensureStageSecrets(stage, cwd)) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
 	}
-	const defaultEnv = require_sniffer.loadEnvFiles(".env");
+	const defaultEnv = require_state.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	if (!options.prepare) await teardown(cwd);
-	const result = await require_sniffer.prepareEntryCredentials({
+	const result = await require_state.prepareEntryCredentials({
 		stage,
 		startDocker: !options.prepare,
 		secretsFileName: "test-secrets.json",
@@ -12189,13 +10956,13 @@ async function testCommand(options = {}) {
 	await (0, node_fs_promises.writeFile)(result.secretsJsonPath, JSON.stringify(finalCredentials, null, 2));
 	const gkmDir = (0, node_path.join)(cwd, ".gkm");
 	const preloadPath = (0, node_path.join)(gkmDir, "test-credentials-preload.ts");
-	await require_sniffer.createCredentialsPreload(preloadPath, result.secretsJsonPath);
+	await require_state.createCredentialsPreload(preloadPath, result.secretsJsonPath);
 	const workspace = await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
 	const manifestPath = workspace ? await require_ready.writeTestHarness({
 		root: workspace.root,
 		targets: [workspace.root, ...Object.values(workspace.apps).map((app) => (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path))],
-		patterns: require_sniffer.constructGlobs(workspace),
-		cacheBackend: require_sniffer.backendsOf(workspace).cache,
+		patterns: require_state.constructGlobs(workspace),
+		cacheBackend: require_state.backendsOf(workspace).cache,
 		stage: require_workspace.TEST_STAGE,
 		env: finalCredentials,
 		factories: (0, node_path.join)(workspace.root, workspace.test.factories ?? "test/factories")
@@ -12258,8 +11025,8 @@ async function teardown(cwd) {
 * the plan provisions, on the port the shared container answers.
 */
 function testDatabases(reconciled) {
-	const port = reconciled?.ports[require_sniffer.primaryPortKey("postgres")];
-	const names = reconciled ? require_sniffer.postgresDatabaseNames(reconciled.plan) : [];
+	const port = reconciled?.ports[require_state.primaryPortKey("postgres")];
+	const names = reconciled ? require_state.postgresDatabaseNames(reconciled.plan) : [];
 	return port !== void 0 && names.length > 0 ? { databases: {
 		port,
 		names
@@ -12270,11 +11037,11 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs"));
-	const { discover } = await Promise.resolve().then(() => require("./discover-DHdECueV.cjs")).then((n) => n.discover_exports);
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-CF4J4GQS.cjs"));
+	const { discover } = await Promise.resolve().then(() => require("./discover-OEfZ9OkA.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
-		patterns: require_sniffer.constructGlobs(workspace),
+		patterns: require_state.constructGlobs(workspace),
 		cwd: workspace.root,
 		sources
 	});
@@ -12701,7 +11468,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-CF4J4GQS.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12715,7 +11482,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-CF4J4GQS.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12729,7 +11496,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-tx9-P9uz.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-CF4J4GQS.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -12768,7 +11535,7 @@ program.command("docker").description("Generate Docker deployment files").option
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await require_sniffer.dockerCommand(options);
+		await require_state.dockerCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -12793,7 +11560,7 @@ program.command("prepack").description("Generate Docker files for production dep
 			production: true,
 			skipBundle: options.skipBundle
 		});
-		await require_sniffer.dockerCommand({
+		await require_state.dockerCommand({
 			build: options.build,
 			push: options.push,
 			tag: options.tag,
@@ -12837,7 +11604,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-C9X98u2F.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-3KlGS1sl.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12848,7 +11615,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-C9X98u2F.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-3KlGS1sl.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12891,7 +11658,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./store-D_2ByRtW.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./state-Y6ATakMX.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12900,7 +11667,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./sniffer-ByhbEW5A.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./state-Y6ATakMX.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12914,8 +11681,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		process.exit(1);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp)").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-D3jofJ6j.cjs"));
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").action(async (options) => {
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-D1JkkOwg.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -12924,10 +11691,29 @@ program.command("deploy").description("Deploy a stage through its target").optio
 		stage: options.stage,
 		...options.tag ? { tag: options.tag } : {},
 		...options.json ? { json: true } : {},
-		...options.dryRun ? { dryRun: true } : {}
+		...options.dryRun ? { dryRun: true } : {},
+		...options.atomic ? { atomic: true } : {}
 	});
 	if (code !== 0) process.exit(code);
 });
+program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
+	try {
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-DxJK84hy.cjs")).then((n) => n.rollback_exports);
+		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-CHy_MdjG.cjs"));
+		const globalOptions = program.opts();
+		await rollbackStage({
+			cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
+			stage: options.stage,
+			...options.app ? { app: options.app } : {},
+			...options.atomic ? { atomic: true } : {},
+			credentials: terminalCredentials(),
+			log: (line) => console.log(line)
+		});
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("deploy:init").description("Initialize Dokploy deployment (create project and application)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").requiredOption("--project <name>", "Project name (creates if not exists)").requiredOption("--app <name>", "Application name").option("--project-id <id>", "Use existing project ID instead of creating").option("--registry-id <id>", "Configure registry for the application").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -12948,7 +11734,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-Dd3tMa1u.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BJ5gh9bw.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12991,7 +11777,7 @@ program.command("login").description("Authenticate with a deployment or DNS prov
 			console.error(`Unknown provider: ${provider}. Supported: dokploy, hostinger`);
 			process.exit(1);
 		}
-		await require_sniffer.loginCommand({
+		await loginCommand({
 			provider,
 			token: options.token,
 			endpoint: options.endpoint
@@ -13005,7 +11791,7 @@ program.command("logout").description("Remove stored credentials").option("--pro
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await require_sniffer.logoutCommand({ provider: options.service ?? options.provider });
+		await logoutCommand({ provider: options.service ?? options.provider });
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -13015,7 +11801,7 @@ program.command("whoami").description("Show current authentication status").acti
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await require_sniffer.whoamiCommand();
+		await whoamiCommand();
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -13083,24 +11869,12 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 });
 program.parse();
 //#endregion
-exports.DuplicateMigration = DuplicateMigration;
-exports.KyselyNotFound = KyselyNotFound;
-exports.MigrationFailed = MigrationFailed;
-exports.MigrationHasNoUp = MigrationHasNoUp;
-exports.MigrationsOutsideFolder = MigrationsOutsideFolder;
-exports.NoOwnerCredential = NoOwnerCredential;
-exports.NoSuchMigrationTarget = NoSuchMigrationTarget;
-exports.SeedFailed = SeedFailed;
-exports.SeedHasNoSeed = SeedHasNoSeed;
-exports.UnknownDatabaseFolder = UnknownDatabaseFolder;
-exports.UnknownMigrationFolder = UnknownMigrationFolder;
+exports.canPrompt = canPrompt;
 exports.formatError = formatError;
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
-exports.migrateAndSeed = migrateAndSeed;
-exports.migrateDatabases = migrateDatabases;
-exports.pendingMigrations = pendingMigrations;
-exports.seedDatabases = seedDatabases;
+exports.prompt = prompt;
 exports.slug = slug;
 exports.stamp = stamp;
+exports.validateDokployToken = validateDokployToken;
 
 //# sourceMappingURL=index.cjs.map