@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.67

package/dist/index.mjs

@@ -1,27 +1,27 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { C as loginCommand, E as whoamiCommand, S as keyFingerprint, g as createStateStore, n as sniffAppEnvironment, r as DokployApi, w as logoutCommand } from "./sniffer-BZ-OJO4Y.mjs";
-import { i as CommandFailed, o as DEFAULT_TIMEOUT_MS, t as LocalSandbox } from "./local-CWR4Y_kW.mjs";
-import { a as getDokployCredentials, o as getDokployRegistryId, s as getDokployToken } from "./credentials-Dq1MnWQf.mjs";
-import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-LMrqsWSU.mjs";
+import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs";
+import { c as getDokployCredentials, f as removeDokployCredentials, i as LocalSandbox, l as getDokployRegistryId, m as storeHostingerToken, p as storeDokployCredentials, s as getCredentialsPath, u as getDokployToken } from "./credentials-pAtB70k3.mjs";
+import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-BFoJWKGD.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { A as deployedProblems, D as InvalidStages, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-C06_pW4g.mjs";
+import { A as deployedProblems, D as InvalidStages, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-Be6uBhlF.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword } from "./storage-BzaUxmqe.mjs";
-import { a as getKeyPath, i as FileSecretsStore, n as secretsStoreFor, s as projectKey, u as deployIdentity } from "./store-CLiHnqOY.mjs";
-import { D as constructGlobs, E as backendsOf$1, I as quoteIdentifier, J as providerOf, K as cacheBackendFor, M as forgetState, O as derivedContainers, P as postgresDatabaseNames, Q as fakeKey, R as pgClient, T as FAKE_ENV, Z as describeServices, _ as dockerCommand, at as loadEnvFiles, et as primaryPortKey, it as isPortAvailable, j as LOCAL_CA_PATH, k as reconcileWorkspace, nt as createEntryWrapper, ot as loadSecretsForApp, rt as findAvailablePort, st as prepareEntryCredentials, tt as createCredentialsPreload } from "./state-B8YwmUZU.mjs";
-import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-C6v-IeHt.mjs";
+import { $ as cacheBackendFor, A as derivedContainers, B as pgClient, D as FAKE_ENV, E as keyFingerprint, Ft as withCustomSecret, I as postgresDatabaseNames, Mt as maskPassword, N as LOCAL_CA_PATH, O as backendsOf$1, P as forgetState, Pt as toEmbeddableSecrets, R as quoteIdentifier, at as fakeKey, ct as createCredentialsPreload, dt as isPortAvailable, ft as loadEnvFiles, gt as secretsStoreFor, it as describeServices, j as reconcileWorkspace, k as constructGlobs, lt as createEntryWrapper, mt as prepareEntryCredentials, pt as loadSecretsForApp, st as primaryPortKey, tt as providerOf, ut as findAvailablePort, vt as FileSecretsStore, wt as deployIdentity, xt as projectKey, y as dockerCommand, yt as getKeyPath } from "./state-DkUStoqJ.mjs";
+import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-BmUAcR7d.mjs";
+import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-BdFeLSmA.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-bQfu9GES.mjs";
+import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-2s3-CndS.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { t as deploy$1 } from "./deploy-9MBG_QLd.mjs";
-import { b as dockerCompose, t as composeTarget, v as composeProject, y as stackDir } from "./compose-DprE3ASm.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-BRhMQRuy.mjs";
+import { t as deploy$1 } from "./deploy-DRAwTG72.mjs";
+import { a as dockerCompose, i as stackDir, r as composeProject, t as composeTarget } from "./compose-BjToENzG.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-Dk3Wbvzk.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Command } from "commander";
+import { stdin, stdout } from "node:process";
+import * as readline from "node:readline/promises";
 import { existsSync, linkSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -46,7 +46,192 @@ import { Function } from "@geekmidas/constructs/functions";
 import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.65";
+var version = "10.0.0-alpha.67";
+//#endregion
+//#region src/prompt.ts
+/**
+* Asking the person at the terminal.
+*
+* CLI layer only: a command's action may prompt, nothing it calls may. A
+* library call (`deploy()`) that needs something it was not given raises a
+* named error instead, and the command decides whether to ask.
+*/
+/** A prompt was needed with no terminal to ask at. */
+var PromptNeedsTerminal = class extends Error {
+	question;
+	instead;
+	constructor(question, instead) {
+		super(`Interactive input required. ${instead}`);
+		this.question = question;
+		this.instead = instead;
+		this.name = "PromptNeedsTerminal";
+	}
+};
+/** Whether there is a person at a terminal to ask. */
+function canPrompt() {
+	return process.stdin.isTTY === true;
+}
+/**
+* Ask `message` and resolve with the line typed — without echoing it when
+* `hidden`. Ctrl+C at a hidden prompt exits, as it would anywhere else in a
+* terminal program: raw mode has taken the signal away from the shell.
+*/
+async function prompt(message, options) {
+	if (!canPrompt()) throw new PromptNeedsTerminal(message, options.instead);
+	if (options.hidden) {
+		process.stdout.write(message);
+		return new Promise((resolve, reject) => {
+			let value = "";
+			const cleanup = () => {
+				process.stdin.setRawMode(false);
+				process.stdin.pause();
+				process.stdin.removeListener("data", onData);
+				process.stdin.removeListener("error", onError);
+			};
+			const onError = (err) => {
+				cleanup();
+				reject(err);
+			};
+			const onData = (char) => {
+				const c = char.toString();
+				if (c === "\n" || c === "\r") {
+					cleanup();
+					process.stdout.write("\n");
+					resolve(value);
+				} else if (c === "") {
+					cleanup();
+					process.stdout.write("\n");
+					process.exit(1);
+				} else if (c === "" || c === "\b") {
+					if (value.length > 0) value = value.slice(0, -1);
+				} else value += c;
+			};
+			process.stdin.setRawMode(true);
+			process.stdin.resume();
+			process.stdin.on("data", onData);
+			process.stdin.on("error", onError);
+		});
+	}
+	const rl = readline.createInterface({
+		input: stdin,
+		output: stdout
+	});
+	try {
+		return await rl.question(message);
+	} finally {
+		rl.close();
+	}
+}
+//#endregion
+//#region src/auth/index.ts
+const logger$8 = console;
+/**
+* Validate Dokploy token by making a test API call
+*/
+async function validateDokployToken(endpoint, token) {
+	const { DokployApi } = await import("./sniffer-BdFeLSmA.mjs").then((n) => n.c);
+	return new DokployApi({
+		baseUrl: endpoint,
+		token
+	}).validateToken();
+}
+/** What answers a login prompt without a terminal. */
+const LOGIN_INSTEAD = "Please provide --token option.";
+/**
+* Login to a service
+*/
+async function loginCommand(options) {
+	const { provider, token: providedToken, endpoint: providedEndpoint } = options;
+	if (provider === "dokploy") {
+		logger$8.log("\n🔐 Logging in to Dokploy...\n");
+		let endpoint = providedEndpoint;
+		if (!endpoint) endpoint = await prompt("Dokploy URL (e.g., https://dokploy.example.com): ", { instead: LOGIN_INSTEAD });
+		endpoint = endpoint.replace(/\/$/, "");
+		try {
+			new URL(endpoint);
+		} catch {
+			logger$8.error("Invalid URL format");
+			process.exit(1);
+		}
+		let token = providedToken;
+		if (!token) {
+			logger$8.log(`\nGenerate a token at: ${endpoint}/settings/profile\n`);
+			token = await prompt("API Token: ", {
+				hidden: true,
+				instead: LOGIN_INSTEAD
+			});
+		}
+		if (!token) {
+			logger$8.error("Token is required");
+			process.exit(1);
+		}
+		logger$8.log("\nValidating credentials...");
+		if (!await validateDokployToken(endpoint, token)) {
+			logger$8.error("\n✗ Invalid credentials. Please check your token and try again.");
+			process.exit(1);
+		}
+		await storeDokployCredentials(token, endpoint);
+		logger$8.log("\n✓ Successfully logged in to Dokploy!");
+		logger$8.log(`  Endpoint: ${endpoint}`);
+		logger$8.log(`  Credentials stored in: ${getCredentialsPath()}`);
+		logger$8.log("\nYou can now use deploy commands without setting DOKPLOY_API_TOKEN.");
+	}
+	if (provider === "hostinger") {
+		logger$8.log("\n🔐 Logging in to Hostinger...\n");
+		let token = providedToken;
+		if (!token) {
+			logger$8.log("\nGenerate a token at: https://hpanel.hostinger.com/profile/api\n");
+			token = await prompt("API Token: ", {
+				hidden: true,
+				instead: LOGIN_INSTEAD
+			});
+		}
+		if (!token) {
+			logger$8.error("Token is required");
+			process.exit(1);
+		}
+		await storeHostingerToken(token);
+		logger$8.log("\n✓ Hostinger token stored.");
+		logger$8.log(`  Credentials stored in: ${getCredentialsPath()}`);
+		logger$8.log("  Not validated here: every DNS endpoint is scoped to a domain, so the\n  first deploy that touches DNS is where a bad token reports itself.");
+		logger$8.log("\nYou can now use it as a DNS provider without setting HOSTINGER_API_TOKEN.");
+	}
+}
+/**
+* Logout from a service
+*/
+async function logoutCommand(options) {
+	const { provider = "dokploy" } = options;
+	if (provider === "all") {
+		if (await removeDokployCredentials()) logger$8.log("\n✓ Logged out from all services");
+		else logger$8.log("\nNo stored credentials found");
+		return;
+	}
+	if (provider === "dokploy") {
+		if (await removeDokployCredentials()) logger$8.log("\n✓ Logged out from Dokploy");
+		else logger$8.log("\nNo Dokploy credentials found");
+	}
+}
+/**
+* Show current login status
+*/
+async function whoamiCommand() {
+	logger$8.log("\n📋 Current credentials:\n");
+	const dokploy = await getDokployCredentials();
+	if (dokploy) {
+		logger$8.log("  Dokploy:");
+		logger$8.log(`    Endpoint: ${dokploy.endpoint}`);
+		logger$8.log(`    Token: ${maskToken(dokploy.token)}`);
+	} else logger$8.log("  Dokploy: Not logged in");
+	logger$8.log(`\n  Credentials file: ${getCredentialsPath()}`);
+}
+/**
+* Mask a token for display
+*/
+function maskToken(token) {
+	if (token.length <= 8) return "****";
+	return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
 //#endregion
 //#region src/trust/index.ts
 /**
@@ -1850,9 +2035,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-B2qL5wj4.mjs");
+		const { prepareDevDatabases } = await import("./migrate-DCVo5gLS.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-B2qL5wj4.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-DCVo5gLS.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3232,7 +3417,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = join(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await import("./bundler-D_14JLZF.mjs");
+			const { bundleServer } = await import("./bundler-Bq3HaLOZ.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3370,7 +3555,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-D_14JLZF.mjs");
+			const { bundleServer } = await import("./bundler-Bq3HaLOZ.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5065,25 +5250,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.65",
-	"@geekmidas/auth": "~10.0.0-alpha.65",
-	"@geekmidas/cache": "~10.0.0-alpha.65",
-	"@geekmidas/client": "~10.0.0-alpha.65",
-	"@geekmidas/cloud": "~10.0.0-alpha.65",
-	"@geekmidas/constructs": "~10.0.0-alpha.65",
-	"@geekmidas/db": "~10.0.0-alpha.65",
-	"@geekmidas/emailkit": "~10.0.0-alpha.65",
-	"@geekmidas/envkit": "~10.0.0-alpha.65",
-	"@geekmidas/errors": "~10.0.0-alpha.65",
-	"@geekmidas/events": "~10.0.0-alpha.65",
-	"@geekmidas/logger": "~10.0.0-alpha.65",
-	"@geekmidas/manifest": "~10.0.0-alpha.65",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.65",
-	"@geekmidas/schema": "~10.0.0-alpha.65",
-	"@geekmidas/services": "~10.0.0-alpha.65",
-	"@geekmidas/storage": "~10.0.0-alpha.65",
-	"@geekmidas/telescope": "~10.0.0-alpha.65",
-	"@geekmidas/testkit": "~10.0.0-alpha.65",
+	"@geekmidas/audit": "~10.0.0-alpha.67",
+	"@geekmidas/auth": "~10.0.0-alpha.67",
+	"@geekmidas/cache": "~10.0.0-alpha.67",
+	"@geekmidas/client": "~10.0.0-alpha.67",
+	"@geekmidas/cloud": "~10.0.0-alpha.67",
+	"@geekmidas/constructs": "~10.0.0-alpha.67",
+	"@geekmidas/db": "~10.0.0-alpha.67",
+	"@geekmidas/emailkit": "~10.0.0-alpha.67",
+	"@geekmidas/envkit": "~10.0.0-alpha.67",
+	"@geekmidas/errors": "~10.0.0-alpha.67",
+	"@geekmidas/events": "~10.0.0-alpha.67",
+	"@geekmidas/logger": "~10.0.0-alpha.67",
+	"@geekmidas/manifest": "~10.0.0-alpha.67",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.67",
+	"@geekmidas/schema": "~10.0.0-alpha.67",
+	"@geekmidas/services": "~10.0.0-alpha.67",
+	"@geekmidas/storage": "~10.0.0-alpha.67",
+	"@geekmidas/telescope": "~10.0.0-alpha.67",
+	"@geekmidas/testkit": "~10.0.0-alpha.67",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10846,8 +11031,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-B2qL5wj4.mjs");
-	const { discover } = await import("./discover-LMrqsWSU.mjs").then((n) => n.i);
+	const { migrateAndSeed } = await import("./migrate-DCVo5gLS.mjs");
+	const { discover } = await import("./discover-BFoJWKGD.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
 		patterns: constructGlobs(workspace),
@@ -11277,7 +11462,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-B2qL5wj4.mjs");
+		const { migrateCommand } = await import("./migrate-DCVo5gLS.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11291,7 +11476,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-B2qL5wj4.mjs");
+		const { seedCommand } = await import("./migrate-DCVo5gLS.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11305,7 +11490,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-B2qL5wj4.mjs");
+		const { migrationCommand } = await import("./migrate-DCVo5gLS.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11340,7 +11525,7 @@ program.command("openapi").description("Generate OpenAPI specification from endp
 		process.exit(1);
 	}
 });
-program.command("docker").description("Generate Docker deployment files").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").option("--slim", "Use slim Dockerfile (assumes pre-built bundle exists)").option("--turbo", "Use turbo prune for monorepo optimization").option("--turbo-package <name>", "Package name for turbo prune").action(async (options) => {
+program.command("docker").description("Generate Docker deployment files").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -11360,30 +11545,16 @@ program.command("compose").description("Run the workspace's APIs and sites for a
 		process.exit(1);
 	}
 });
-program.command("prepack").description("Generate Docker files for production deployment").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").option("--slim", "Build locally first, then use slim Dockerfile").option("--skip-bundle", "Skip bundling step (only with --slim)").option("--turbo", "Use turbo prune for monorepo optimization").option("--turbo-package <name>", "Package name for turbo prune").action(async (options) => {
+program.command("prepack").description("Generate Docker files for production deployment").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		if (options.slim) await buildCommand({
-			provider: "server",
-			production: true,
-			skipBundle: options.skipBundle
-		});
 		await dockerCommand({
 			build: options.build,
 			push: options.push,
 			tag: options.tag,
-			registry: options.registry,
-			slim: options.slim,
-			turbo: options.turbo,
-			turboPackage: options.turboPackage
+			registry: options.registry
 		});
-		if (options.slim) {}
-		if (options.build) {
-			const tag = options.tag ?? "latest";
-			const registry = options.registry;
-			registry ? `${registry}${tag}` : `${tag}`;
-		}
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -11413,7 +11584,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-DF_hgIpl.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-Ccbahik7.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11424,7 +11595,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-DF_hgIpl.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-Ccbahik7.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11467,7 +11638,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./store-CLiHnqOY.mjs").then((n) => n.r);
+		const { secretsStoreFor } = await import("./state-DkUStoqJ.mjs").then((n) => n._t);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11476,7 +11647,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./state-B8YwmUZU.mjs").then((n) => n.A);
+		const { derivedContainers } = await import("./state-DkUStoqJ.mjs").then((n) => n.M);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11490,8 +11661,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		process.exit(1);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").action(async (options) => {
-	const { deployCli } = await import("./cli-P56vvrDQ.mjs");
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").action(async (options) => {
+	const { deployCli } = await import("./cli-C2Tjbn27.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11500,10 +11671,29 @@ program.command("deploy").description("Deploy a stage through its target").optio
 		stage: options.stage,
 		...options.tag ? { tag: options.tag } : {},
 		...options.json ? { json: true } : {},
-		...options.dryRun ? { dryRun: true } : {}
+		...options.dryRun ? { dryRun: true } : {},
+		...options.atomic ? { atomic: true } : {}
 	});
 	if (code !== 0) process.exit(code);
 });
+program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
+	try {
+		const { rollbackStage } = await import("./rollback-m4Yeym5x.mjs").then((n) => n.a);
+		const { terminalCredentials } = await import("./terminal-C3cv-OQu.mjs");
+		const globalOptions = program.opts();
+		await rollbackStage({
+			cwd: resolve(globalOptions.cwd ?? process.cwd()),
+			stage: options.stage,
+			...options.app ? { app: options.app } : {},
+			...options.atomic ? { atomic: true } : {},
+			credentials: terminalCredentials(),
+			log: (line) => console.log(line)
+		});
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("deploy:init").description("Initialize Dokploy deployment (create project and application)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").requiredOption("--project <name>", "Project name (creates if not exists)").requiredOption("--app <name>", "Application name").option("--project-id <id>", "Use existing project ID instead of creating").option("--registry-id <id>", "Configure registry for the application").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -11524,7 +11714,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-B0YYE98x.mjs");
+		const { deployGithubCommand } = await import("./github-CJANTYqi.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11659,6 +11849,6 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 });
 program.parse();
 //#endregion
-export { formatError as i, slug as n, stamp as r, generateFullstackCustomSecrets as t };
+export { validateDokployToken as a, formatError as i, slug as n, canPrompt as o, stamp as r, prompt as s, generateFullstackCustomSecrets as t };
 
 //# sourceMappingURL=index.mjs.map