@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.67

package/dist/index.cjs

@@ -1,27 +1,28 @@
 #!/usr/bin/env -S npx tsx
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_sniffer = require("./sniffer-BSwaL-dX.cjs");
-const require_local = require("./local-BdH4XN0E.cjs");
-const require_credentials = require("./credentials-Bzbg23n8.cjs");
-const require_discover = require("./discover-DHdECueV.cjs");
+const require_run = require("./run-fVZ-rLnc.cjs");
+const require_credentials = require("./credentials-BVs7mrtw.cjs");
+const require_discover = require("./discover-OEfZ9OkA.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-BewAHZIo.cjs");
+const require_workspace = require("./workspace-ON-bqiJz.cjs");
 const require_config = require("./config.cjs");
-const require_storage = require("./storage-CSGoC3bK.cjs");
-const require_store = require("./store-CJF1Tqkq.cjs");
-const require_state = require("./state-DF26e_lo.cjs");
-const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BWuDRHe9.cjs");
+const require_state = require("./state-DgmM4EKq.cjs");
+const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-B2zrdyP4.cjs");
+const require_sniffer = require("./sniffer-D66HIvi9.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
-const require_ready = require("./ready-brEhh68f.cjs");
+const require_ready = require("./ready-B6uHr4sm.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
-const require_deploy = require("./deploy-B80idPUZ.cjs");
-const require_compose = require("./compose-391oEKj1.cjs");
-const require_LocalStateStore = require("./LocalStateStore-93urXyQe.cjs");
+const require_deploy = require("./deploy-BucRfbvX.cjs");
+const require_compose = require("./compose-5oNHAKNT.cjs");
+const require_LocalStateStore = require("./LocalStateStore-DHVsZLyF.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
 let node_path = require("node:path");
 let commander = require("commander");
+let node_process = require("node:process");
+let node_readline_promises = require("node:readline/promises");
+node_readline_promises = require_rolldown_runtime.__toESM(node_readline_promises, 1);
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
@@ -51,7 +52,192 @@ let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions")
 let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.65";
+var version = "10.0.0-alpha.67";
+//#endregion
+//#region src/prompt.ts
+/**
+* Asking the person at the terminal.
+*
+* CLI layer only: a command's action may prompt, nothing it calls may. A
+* library call (`deploy()`) that needs something it was not given raises a
+* named error instead, and the command decides whether to ask.
+*/
+/** A prompt was needed with no terminal to ask at. */
+var PromptNeedsTerminal = class extends Error {
+	question;
+	instead;
+	constructor(question, instead) {
+		super(`Interactive input required. ${instead}`);
+		this.question = question;
+		this.instead = instead;
+		this.name = "PromptNeedsTerminal";
+	}
+};
+/** Whether there is a person at a terminal to ask. */
+function canPrompt() {
+	return process.stdin.isTTY === true;
+}
+/**
+* Ask `message` and resolve with the line typed — without echoing it when
+* `hidden`. Ctrl+C at a hidden prompt exits, as it would anywhere else in a
+* terminal program: raw mode has taken the signal away from the shell.
+*/
+async function prompt(message, options) {
+	if (!canPrompt()) throw new PromptNeedsTerminal(message, options.instead);
+	if (options.hidden) {
+		process.stdout.write(message);
+		return new Promise((resolve, reject) => {
+			let value = "";
+			const cleanup = () => {
+				process.stdin.setRawMode(false);
+				process.stdin.pause();
+				process.stdin.removeListener("data", onData);
+				process.stdin.removeListener("error", onError);
+			};
+			const onError = (err) => {
+				cleanup();
+				reject(err);
+			};
+			const onData = (char) => {
+				const c = char.toString();
+				if (c === "\n" || c === "\r") {
+					cleanup();
+					process.stdout.write("\n");
+					resolve(value);
+				} else if (c === "") {
+					cleanup();
+					process.stdout.write("\n");
+					process.exit(1);
+				} else if (c === "" || c === "\b") {
+					if (value.length > 0) value = value.slice(0, -1);
+				} else value += c;
+			};
+			process.stdin.setRawMode(true);
+			process.stdin.resume();
+			process.stdin.on("data", onData);
+			process.stdin.on("error", onError);
+		});
+	}
+	const rl = node_readline_promises.createInterface({
+		input: node_process.stdin,
+		output: node_process.stdout
+	});
+	try {
+		return await rl.question(message);
+	} finally {
+		rl.close();
+	}
+}
+//#endregion
+//#region src/auth/index.ts
+const logger$8 = console;
+/**
+* Validate Dokploy token by making a test API call
+*/
+async function validateDokployToken(endpoint, token) {
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-D66HIvi9.cjs")).then((n) => n.dokploy_api_exports);
+	return new DokployApi({
+		baseUrl: endpoint,
+		token
+	}).validateToken();
+}
+/** What answers a login prompt without a terminal. */
+const LOGIN_INSTEAD = "Please provide --token option.";
+/**
+* Login to a service
+*/
+async function loginCommand(options) {
+	const { provider, token: providedToken, endpoint: providedEndpoint } = options;
+	if (provider === "dokploy") {
+		logger$8.log("\n🔐 Logging in to Dokploy...\n");
+		let endpoint = providedEndpoint;
+		if (!endpoint) endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: LOGIN_INSTEAD });
+		endpoint = endpoint.replace(/\/$/, "");
+		try {
+			new URL(endpoint);
+		} catch {
+			logger$8.error("Invalid URL format");
+			process.exit(1);
+		}
+		let token = providedToken;
+		if (!token) {
+			logger$8.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			token = await prompt("API Token: ", {
+				hidden: true,
+				instead: LOGIN_INSTEAD
+			});
+		}
+		if (!token) {
+			logger$8.error("Token is required");
+			process.exit(1);
+		}
+		logger$8.log("\nValidating credentials...");
+		if (!await validateDokployToken(endpoint, token)) {
+			logger$8.error("\n✗ Invalid credentials. Please check your token and try again.");
+			process.exit(1);
+		}
+		await require_credentials.storeDokployCredentials(token, endpoint);
+		logger$8.log("\n✓ Successfully logged in to Dokploy!");
+		logger$8.log(`  Endpoint: ${endpoint}`);
+		logger$8.log(`  Credentials stored in: ${require_credentials.getCredentialsPath()}`);
+		logger$8.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
+	}
+	if (provider === "hostinger") {
+		logger$8.log("\n🔐 Logging in to Hostinger...\n");
+		let token = providedToken;
+		if (!token) {
+			logger$8.log("\nGenerate a token at: https://hpanel.hostinger.com/profile/api\n");
+			token = await prompt("API Token: ", {
+				hidden: true,
+				instead: LOGIN_INSTEAD
+			});
+		}
+		if (!token) {
+			logger$8.error("Token is required");
+			process.exit(1);
+		}
+		await require_credentials.storeHostingerToken(token);
+		logger$8.log("\n✓ Hostinger token stored.");
+		logger$8.log(`  Credentials stored in: ${require_credentials.getCredentialsPath()}`);
+		logger$8.log("  Not validated here: every DNS endpoint is scoped to a domain, so the\n  first deploy that touches DNS is where a bad token reports itself.");
+		logger$8.log("\nYou can now use it as a DNS provider without setting HOSTINGER_API_TOKEN.");
+	}
+}
+/**
+* Logout from a service
+*/
+async function logoutCommand(options) {
+	const { provider = "dokploy" } = options;
+	if (provider === "all") {
+		if (await require_credentials.removeDokployCredentials()) logger$8.log("\n✓ Logged out from all services");
+		else logger$8.log("\nNo stored credentials found");
+		return;
+	}
+	if (provider === "dokploy") {
+		if (await require_credentials.removeDokployCredentials()) logger$8.log("\n✓ Logged out from Dokploy");
+		else logger$8.log("\nNo Dokploy credentials found");
+	}
+}
+/**
+* Show current login status
+*/
+async function whoamiCommand() {
+	logger$8.log("\n📋 Current credentials:\n");
+	const dokploy = await require_credentials.getDokployCredentials();
+	if (dokploy) {
+		logger$8.log("  Dokploy:");
+		logger$8.log(`    Endpoint: ${dokploy.endpoint}`);
+		logger$8.log(`    Token: ${maskToken(dokploy.token)}`);
+	} else logger$8.log("  Dokploy: Not logged in");
+	logger$8.log(`\n  Credentials file: ${require_credentials.getCredentialsPath()}`);
+}
+/**
+* Mask a token for display
+*/
+function maskToken(token) {
+	if (token.length <= 8) return "****";
+	return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
 //#endregion
 //#region src/trust/index.ts
 /**
@@ -1507,7 +1693,7 @@ async function devCommand(options) {
 	let secretsJsonPath;
 	let publicUrl;
 	let manifest;
-	const appSecrets = await require_state.loadSecretsForApp(workspace ? await require_store.secretsStoreFor(workspace, config.stages.local) : new require_store.FileSecretsStore(secretsRoot), config.stages.local, workspaceAppName);
+	const appSecrets = await require_state.loadSecretsForApp(workspace ? await require_state.secretsStoreFor(workspace, config.stages.local) : new require_state.FileSecretsStore(secretsRoot), config.stages.local, workspaceAppName);
 	if (workspace) {
 		const reconciled = await require_state.reconcileWorkspace(workspace, {
 			stage: workspace.stages.local,
@@ -1795,8 +1981,8 @@ async function validateFrontendApps(workspace) {
 async function loadDevSecrets(workspace) {
 	if (!workspace.secrets.enabled) return {};
 	const stage = workspace.stages.local;
-	const secrets = await (await require_store.secretsStoreFor(workspace, stage)).read(stage);
-	if (secrets) return require_storage.toEmbeddableSecrets(secrets);
+	const secrets = await (await require_state.secretsStoreFor(workspace, stage)).read(stage);
+	if (secrets) return require_state.toEmbeddableSecrets(secrets);
 	return {};
 }
 /**
@@ -1855,9 +2041,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-q4pPAXtO.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-CQdSpttI.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-q4pPAXtO.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-CQdSpttI.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3237,7 +3423,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = (0, node_path.join)(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-D6MlIfBT.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-pyLj-gS0.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3375,7 +3561,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-D6MlIfBT.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-pyLj-gS0.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3398,7 +3584,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 				await (0, node_fs_promises.writeFile)(keyPath, `${masterKey}\n`, { mode: 384 });
 				await (0, node_fs_promises.chmod)(keyPath, 384);
 				logger$4.log(`\n🔐 Secrets encrypted for deployment`);
-				logger$4.log(`   Run with GKM_MASTER_KEY set to the key in ${(0, node_path.relative)(appRoot, keyPath)} (fingerprint ${require_sniffer.keyFingerprint(masterKey)})`);
+				logger$4.log(`   Run with GKM_MASTER_KEY set to the key in ${(0, node_path.relative)(appRoot, keyPath)} (fingerprint ${require_state.keyFingerprint(masterKey)})`);
 			}
 		}
 		return {
@@ -3539,7 +3725,7 @@ async function workspaceBuildCommand(workspace, options) {
 		if (filters.length > 0) {
 			logger$4.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
 			logger$4.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
-			const sandbox = options.sandbox ?? new require_local.LocalSandbox({
+			const sandbox = options.sandbox ?? new require_credentials.LocalSandbox({
 				root: workspace.root,
 				passEnv: ["TURBO_TOKEN"]
 			});
@@ -3549,10 +3735,10 @@ async function workspaceBuildCommand(workspace, options) {
 					...sandbox.env,
 					NODE_ENV: options.production ? "production" : "development"
 				},
-				timeoutMs: require_local.DEFAULT_TIMEOUT_MS,
+				timeoutMs: require_run.DEFAULT_TIMEOUT_MS,
 				output: "inherit"
 			});
-			if (built.exitCode !== 0) throw new require_local.CommandFailed(turboBin, turboArgs, built.exitCode, built.signal);
+			if (built.exitCode !== 0) throw new require_run.CommandFailed(turboBin, turboArgs, built.exitCode, built.signal);
 		}
 		for (const [appName, app] of apps) {
 			const outputPath = getAppOutputPath(workspace, appName, app);
@@ -3627,7 +3813,7 @@ async function composeCommand(options = {}, deps = {}) {
 	const stage = options.stage ?? workspace.stages.local;
 	if (options.down) {
 		const ref = {
-			project: require_compose.composeProject(require_store.deployIdentity(workspace, stage)),
+			project: require_compose.composeProject(require_state.deployIdentity(workspace, stage)),
 			file: (0, node_path.join)(workspace.root, require_compose.stackDir(stage), "docker-compose.yml"),
 			cwd: workspace.root
 		};
@@ -5070,25 +5256,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.65",
-	"@geekmidas/auth": "~10.0.0-alpha.65",
-	"@geekmidas/cache": "~10.0.0-alpha.65",
-	"@geekmidas/client": "~10.0.0-alpha.65",
-	"@geekmidas/cloud": "~10.0.0-alpha.65",
-	"@geekmidas/constructs": "~10.0.0-alpha.65",
-	"@geekmidas/db": "~10.0.0-alpha.65",
-	"@geekmidas/emailkit": "~10.0.0-alpha.65",
-	"@geekmidas/envkit": "~10.0.0-alpha.65",
-	"@geekmidas/errors": "~10.0.0-alpha.65",
-	"@geekmidas/events": "~10.0.0-alpha.65",
-	"@geekmidas/logger": "~10.0.0-alpha.65",
-	"@geekmidas/manifest": "~10.0.0-alpha.65",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.65",
-	"@geekmidas/schema": "~10.0.0-alpha.65",
-	"@geekmidas/services": "~10.0.0-alpha.65",
-	"@geekmidas/storage": "~10.0.0-alpha.65",
-	"@geekmidas/telescope": "~10.0.0-alpha.65",
-	"@geekmidas/testkit": "~10.0.0-alpha.65",
+	"@geekmidas/audit": "~10.0.0-alpha.67",
+	"@geekmidas/auth": "~10.0.0-alpha.67",
+	"@geekmidas/cache": "~10.0.0-alpha.67",
+	"@geekmidas/client": "~10.0.0-alpha.67",
+	"@geekmidas/cloud": "~10.0.0-alpha.67",
+	"@geekmidas/constructs": "~10.0.0-alpha.67",
+	"@geekmidas/db": "~10.0.0-alpha.67",
+	"@geekmidas/emailkit": "~10.0.0-alpha.67",
+	"@geekmidas/envkit": "~10.0.0-alpha.67",
+	"@geekmidas/errors": "~10.0.0-alpha.67",
+	"@geekmidas/events": "~10.0.0-alpha.67",
+	"@geekmidas/logger": "~10.0.0-alpha.67",
+	"@geekmidas/manifest": "~10.0.0-alpha.67",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.67",
+	"@geekmidas/schema": "~10.0.0-alpha.67",
+	"@geekmidas/services": "~10.0.0-alpha.67",
+	"@geekmidas/storage": "~10.0.0-alpha.67",
+	"@geekmidas/telescope": "~10.0.0-alpha.67",
+	"@geekmidas/testkit": "~10.0.0-alpha.67",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5671,7 +5857,7 @@ function deploy(options) {
           role-to-assume: \${{ vars.AWS_ROLE_ARN }}
           aws-region: ${options.region}
 ` : "";
-	const keyDir = `~/.gkm/keys/${require_store.projectKey({ name: options.name })}`;
+	const keyDir = `~/.gkm/keys/${require_state.projectKey({ name: options.name })}`;
 	const stageSecrets = sst ? credentials : `
       # The stage's secrets are kept in the encrypted .gkm/secrets/<stage>.json,
       # and each environment holds its key as GKM_SECRETS_KEY. .gkm/ is
@@ -10008,11 +10194,11 @@ async function initCommand(projectName, options = {}) {
 	}
 	devSecrets.custom = customSecrets;
 	const keys = {
-		key: require_store.projectKey({ name }),
+		key: require_state.projectKey({ name }),
 		legacy: [(0, node_path.basename)(targetDir)]
 	};
-	await new require_store.FileSecretsStore(targetDir, keys).write(local, devSecrets);
-	const keyPath = require_store.getKeyPath(local, keys);
+	await new require_state.FileSecretsStore(targetDir, keys).write(local, devSecrets);
+	const keyPath = require_state.getKeyPath(local, keys);
 	console.log(`  Secrets: .gkm/secrets/${local}.json (encrypted)`);
 	console.log(`  Key: ${keyPath}\n`);
 	if (!options.skipInstall) {
@@ -10247,9 +10433,9 @@ const logger$2 = console;
 */
 async function storeFor(stage) {
 	try {
-		return await require_store.secretsStoreFor(await require_config.loadWorkspaceSettings(), stage);
+		return await require_state.secretsStoreFor(await require_config.loadWorkspaceSettings(), stage);
 	} catch (error) {
-		if (error instanceof require_config.ConfigNotFound) return new require_store.FileSecretsStore(process.cwd());
+		if (error instanceof require_config.ConfigNotFound) return new require_state.FileSecretsStore(process.cwd());
 		throw error;
 	}
 }
@@ -10319,7 +10505,7 @@ async function secretsSetCommand(key, value, options) {
 		logger$2.error(`Secrets not found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
-	await store.write(stage, require_storage.withCustomSecret(secrets, key, secretValue));
+	await store.write(stage, require_state.withCustomSecret(secrets, key, secretValue));
 	logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}" (${store.name})`);
 }
 /**
@@ -10341,7 +10527,7 @@ async function secretsShowCommand(options) {
 		logger$2.log(`    host: ${creds.host}`);
 		logger$2.log(`    port: ${creds.port}`);
 		logger$2.log(`    username: ${creds.username}`);
-		logger$2.log(`    password: ${reveal ? creds.password : require_storage.maskPassword(creds.password)}`);
+		logger$2.log(`    password: ${reveal ? creds.password : require_state.maskPassword(creds.password)}`);
 		if (creds.database) logger$2.log(`    database: ${creds.database}`);
 		if (creds.bucket) logger$2.log(`    bucket: ${creds.bucket}`);
 	}
@@ -10351,7 +10537,7 @@ async function secretsShowCommand(options) {
 	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
 	if (Object.keys(secrets.custom).length > 0) {
 		logger$2.log("\nCustom Secrets:");
-		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : require_storage.maskPassword(value)}`);
+		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : require_state.maskPassword(value)}`);
 	}
 	if (!reveal) logger$2.log("\nUse --reveal to show actual values");
 }
@@ -10431,7 +10617,7 @@ async function secretsImportCommand(file, options) {
 function maskUrl(url) {
 	try {
 		const parsed = new URL(url);
-		if (parsed.password) parsed.password = require_storage.maskPassword(parsed.password);
+		if (parsed.password) parsed.password = require_state.maskPassword(parsed.password);
 		return parsed.toString();
 	} catch {
 		return url;
@@ -10521,7 +10707,7 @@ async function resolveSecrets(stage, workspace, options) {
 		logger$1.log("🔐 Generating fresh secrets (--force)...");
 		return generateFreshSecrets(stage, workspace);
 	}
-	const store = await require_store.secretsStoreFor(workspace, stage);
+	const store = await require_state.secretsStoreFor(workspace, stage);
 	const secrets = await store.read(stage);
 	if (secrets) {
 		logger$1.log("🔐 Using existing secrets");
@@ -10645,7 +10831,7 @@ function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
 */
 async function ensureStageSecrets(stage, cwd = process.cwd()) {
 	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
-	const store = await require_store.secretsStoreFor(workspace, stage);
+	const store = await require_state.secretsStoreFor(workspace, stage);
 	if (await store.read(stage)) return false;
 	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_state.derivedContainers(workspace, stage));
 	await store.write(stage, secrets);
@@ -10656,7 +10842,7 @@ async function ensureStageSecrets(stage, cwd = process.cwd()) {
 */
 async function generateFreshSecrets(stage, workspace) {
 	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_state.derivedContainers(workspace, stage));
-	const store = await require_store.secretsStoreFor(workspace, stage);
+	const store = await require_state.secretsStoreFor(workspace, stage);
 	await store.write(stage, secrets);
 	logger$1.log(`   Secrets written to the "${stage}" store (${store.name})`);
 	return secrets;
@@ -10851,8 +11037,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-q4pPAXtO.cjs"));
-	const { discover } = await Promise.resolve().then(() => require("./discover-DHdECueV.cjs")).then((n) => n.discover_exports);
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-CQdSpttI.cjs"));
+	const { discover } = await Promise.resolve().then(() => require("./discover-OEfZ9OkA.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
 		patterns: require_state.constructGlobs(workspace),
@@ -11282,7 +11468,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-q4pPAXtO.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-CQdSpttI.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11296,7 +11482,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-q4pPAXtO.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-CQdSpttI.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11310,7 +11496,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-q4pPAXtO.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-CQdSpttI.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11345,7 +11531,7 @@ program.command("openapi").description("Generate OpenAPI specification from endp
 		process.exit(1);
 	}
 });
-program.command("docker").description("Generate Docker deployment files").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").option("--slim", "Use slim Dockerfile (assumes pre-built bundle exists)").option("--turbo", "Use turbo prune for monorepo optimization").option("--turbo-package <name>", "Package name for turbo prune").action(async (options) => {
+program.command("docker").description("Generate Docker deployment files").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -11365,30 +11551,16 @@ program.command("compose").description("Run the workspace's APIs and sites for a
 		process.exit(1);
 	}
 });
-program.command("prepack").description("Generate Docker files for production deployment").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").option("--slim", "Build locally first, then use slim Dockerfile").option("--skip-bundle", "Skip bundling step (only with --slim)").option("--turbo", "Use turbo prune for monorepo optimization").option("--turbo-package <name>", "Package name for turbo prune").action(async (options) => {
+program.command("prepack").description("Generate Docker files for production deployment").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		if (options.slim) await buildCommand({
-			provider: "server",
-			production: true,
-			skipBundle: options.skipBundle
-		});
 		await require_state.dockerCommand({
 			build: options.build,
 			push: options.push,
 			tag: options.tag,
-			registry: options.registry,
-			slim: options.slim,
-			turbo: options.turbo,
-			turboPackage: options.turboPackage
+			registry: options.registry
 		});
-		if (options.slim) {}
-		if (options.build) {
-			const tag = options.tag ?? "latest";
-			const registry = options.registry;
-			registry ? `${registry}${tag}` : `${tag}`;
-		}
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -11418,7 +11590,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-B1wJwgae.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-rZ3BghXy.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11429,7 +11601,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-B1wJwgae.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-rZ3BghXy.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11472,7 +11644,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./store-CJF1Tqkq.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./state-DgmM4EKq.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11481,7 +11653,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./state-DF26e_lo.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./state-DgmM4EKq.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11495,8 +11667,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		process.exit(1);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-BfH1deAT.cjs"));
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").action(async (options) => {
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-DR7B2_fX.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -11505,10 +11677,29 @@ program.command("deploy").description("Deploy a stage through its target").optio
 		stage: options.stage,
 		...options.tag ? { tag: options.tag } : {},
 		...options.json ? { json: true } : {},
-		...options.dryRun ? { dryRun: true } : {}
+		...options.dryRun ? { dryRun: true } : {},
+		...options.atomic ? { atomic: true } : {}
 	});
 	if (code !== 0) process.exit(code);
 });
+program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
+	try {
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-BnY7KuG_.cjs")).then((n) => n.rollback_exports);
+		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-DjzgLu6m.cjs"));
+		const globalOptions = program.opts();
+		await rollbackStage({
+			cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
+			stage: options.stage,
+			...options.app ? { app: options.app } : {},
+			...options.atomic ? { atomic: true } : {},
+			credentials: terminalCredentials(),
+			log: (line) => console.log(line)
+		});
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("deploy:init").description("Initialize Dokploy deployment (create project and application)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").requiredOption("--project <name>", "Project name (creates if not exists)").requiredOption("--app <name>", "Application name").option("--project-id <id>", "Use existing project ID instead of creating").option("--registry-id <id>", "Configure registry for the application").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -11529,7 +11720,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-CYcmTdFs.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-CrcGFkfD.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11572,7 +11763,7 @@ program.command("login").description("Authenticate with a deployment or DNS prov
 			console.error(`Unknown provider: ${provider}. Supported: dokploy, hostinger`);
 			process.exit(1);
 		}
-		await require_sniffer.loginCommand({
+		await loginCommand({
 			provider,
 			token: options.token,
 			endpoint: options.endpoint
@@ -11586,7 +11777,7 @@ program.command("logout").description("Remove stored credentials").option("--pro
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await require_sniffer.logoutCommand({ provider: options.service ?? options.provider });
+		await logoutCommand({ provider: options.service ?? options.provider });
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -11596,7 +11787,7 @@ program.command("whoami").description("Show current authentication status").acti
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await require_sniffer.whoamiCommand();
+		await whoamiCommand();
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -11664,9 +11855,12 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 });
 program.parse();
 //#endregion
+exports.canPrompt = canPrompt;
 exports.formatError = formatError;
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
+exports.prompt = prompt;
 exports.slug = slug;
 exports.stamp = stamp;
+exports.validateDokployToken = validateDokployToken;
 
 //# sourceMappingURL=index.cjs.map