@geekmidas/cli 10.0.0-alpha.73 → 10.0.0-alpha.75

package/dist/index.mjs

@@ -6,22 +6,23 @@ import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } fr
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { A as deployedProblems, D as InvalidStages, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-C7NqCsQF.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { $ as constructGlobs, At as eventsBackendFor, Bt as findAvailablePort, Ft as fakeKey, G as keyFingerprint, H as workerUnits, Ht as loadEnvFiles, J as workerEntryDir, Jt as FileSecretsStore, K as WorkerGenerator, Kt as secretsStoreFor, Lt as primaryPortKey, Pt as describeServices, Q as backendsOf$1, R as parseDevServices, Rt as createCredentialsPreload, Ut as loadSecretsForApp, Vt as isPortAvailable, Wt as prepareEntryCredentials, X as CronGenerator, Y as QueueGenerator, Yt as getKeyPath, Z as FAKE_ENV, Zt as projectKey, cn as maskPassword, dn as withCustomSecret, dt as quoteIdentifier, en as deployIdentity, et as derivedContainers, it as forgetState, jt as providerOf, kt as cacheBackendFor, lt as postgresDatabaseNames, mt as pgClient, q as workerBundleName, rt as LOCAL_CA_PATH, tt as reconcileWorkspace, un as toEmbeddableSecrets, y as dockerCommand, zt as createEntryWrapper } from "./state-DtS2HEfi.mjs";
+import { $ as LOCAL_CA_PATH, Bt as loadSecretsForApp, Dt as eventsBackendFor, Et as cacheBackendFor, Ft as createCredentialsPreload, G as QueueGenerator, Gt as FileSecretsStore, H as WorkerGenerator, It as createEntryWrapper, J as backendsOf$1, Jt as projectKey, K as CronGenerator, Kt as getKeyPath, L as parseDevServices, Lt as findAvailablePort, Mt as fakeKey, Ot as providerOf, Pt as primaryPortKey, Rt as isPortAvailable, U as workerBundleName, Ut as secretsStoreFor, V as workerUnits, Vt as prepareEntryCredentials, W as workerEntryDir, X as derivedContainers, Y as constructGlobs, Z as reconcileWorkspace, Zt as deployIdentity, an as maskPassword, at as postgresDatabaseNames, cn as withCustomSecret, et as forgetState, jt as describeServices, q as FAKE_ENV, sn as toEmbeddableSecrets, st as quoteIdentifier, ut as pgClient, v as dockerCommand, zt as loadEnvFiles } from "./state-BrWIOce_.mjs";
 import { i as telemetryFor, n as runtimeFor, t as EndpointGenerator } from "./EndpointGenerator-DftalLYg.mjs";
-import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-BFmdZpZ2.mjs";
+import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi, x as keyFingerprint } from "./sniffer-BmCvVyhq.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { t as SubscriberGenerator } from "./SubscriberGenerator-DZk_pKDh.mjs";
+import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-5looQ3gB.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { a as writeTestHarness, c as eventsBackendsIn, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as cacheBackendsIn, s as driversFor, t as TEST_READY_ENV } from "./ready-C0U0NYfB.mjs";
+import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-Ch1rJitn.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { t as deploy$1 } from "./deploy-nmov4j0B.mjs";
-import { a as stackDir, i as composeProject, o as dockerCompose, r as stackOverrideFile, t as composeTarget } from "./compose-9II-0IsK.mjs";
+import { t as deploy$1 } from "./deploy-CuSsiFIc.mjs";
+import { a as stackOverrideFile, c as parseDigests, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as dockerCompose } from "./compose-DdH2JQJD.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJqRJNK4.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-CNjgkRk4.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-RH9F2ZEy.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-ZZoNskrr.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { Command } from "commander";
+import { Command, Option } from "commander";
 import { stdin, stdout } from "node:process";
 import * as readline from "node:readline/promises";
 import { existsSync, linkSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
@@ -46,7 +47,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.73";
+var version = "10.0.0-alpha.75";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -129,7 +130,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-BFmdZpZ2.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-BmCvVyhq.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2035,9 +2036,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-CFFC3esE.mjs");
+		const { prepareDevDatabases } = await import("./migrate-BLL1RTAj.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-CFFC3esE.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-BLL1RTAj.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2897,6 +2898,15 @@ var UnknownBuildProvider = class extends Error {
 		this.name = "UnknownBuildProvider";
 	}
 };
+/** `--cache` named something that is not a cache backend. */
+var UnknownCacheBackend = class extends Error {
+	backend;
+	constructor(backend) {
+		super(`'${backend}' is not a cache backend. Pass --cache upstash, elasticache, db or redis, or leave it out to register the deploy target's.`);
+		this.backend = backend;
+		this.name = "UnknownCacheBackend";
+	}
+};
 async function buildCommand(options) {
 	const loadedConfig = await loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
@@ -2949,7 +2959,7 @@ function backendsOf(workspace) {
 /** One app's build, from its config and the command's options. */
 async function buildOneApp(input) {
 	const { config, options, workspace, appRoot, target } = input;
-	const cacheBackend = cacheBackendFor(providerOf(workspace));
+	const cacheBackend = options.cache ?? cacheBackendFor(providerOf(workspace));
 	const eventsBackend = eventsBackendFor(providerOf(workspace));
 	const production = normalizeProductionConfig(options.production ?? false);
 	if (production) logger$4.log(`🏭 Building for PRODUCTION`);
@@ -3036,7 +3046,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = join(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await import("./bundler-C2LZoLdP.mjs");
+			const { bundleServer } = await import("./bundler-xjp5RwRS.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3160,7 +3170,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-C2LZoLdP.mjs");
+		const { bundleServer } = await import("./bundler-xjp5RwRS.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3230,7 +3240,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-C2LZoLdP.mjs");
+			const { bundleServer } = await import("./bundler-xjp5RwRS.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3474,9 +3484,16 @@ var ComposeModeConflict = class extends Error {
 		this.name = "ComposeModeConflict";
 	}
 };
+/** Each pushed image as `<ref>@sha256:…`, by app. */
+function pushedDigests(run) {
+	return Object.fromEntries(Object.entries(run.images).filter(([, image]) => image.digest).sort(([a], [b]) => a.localeCompare(b)).map(([app, image]) => [app, pinnedRef(image.ref, image.digest)]));
+}
 /** `gkm compose`. */
 async function composeCommand(options, deps = {}) {
 	if (options.build && options.pull) throw new ComposeModeConflict();
+	if (options.push && !options.build) throw new ComposePushNeedsBuild();
+	const pulls = !options.build && (options.pull || options.tag !== void 0);
+	if (options.digestsFile && !options.push && !pulls) throw new ComposePinNeedsPull();
 	const allowDevServices = parseDevServices(options.allowDevServices);
 	const cwd = resolve(options.cwd ?? process.cwd());
 	const { workspace } = await loadWorkspaceConfig(cwd);
@@ -3496,6 +3513,10 @@ async function composeCommand(options, deps = {}) {
 	let finished;
 	const mode = options.build ? "build" : options.pull ? "pull" : void 0;
 	const tag = options.tag ?? (options.pull ? "latest" : void 0);
+	const pin = options.digestsFile && pulls ? {
+		file: options.digestsFile,
+		digests: parseDigests(options.digestsFile, await readFile(resolve(cwd, options.digestsFile), "utf-8"))
+	} : void 0;
 	const result = await deploy$1({
 		cwd,
 		stage,
@@ -3503,12 +3524,15 @@ async function composeCommand(options, deps = {}) {
 		targets: { compose: composeTarget({
 			...deps,
 			...mode ? { mode } : {},
+			...options.push ? { push: true } : {},
+			...pin ? { pin } : {},
 			report: (done) => {
 				finished = done;
 			}
 		}) },
 		...tag ? { tag } : {},
 		...options.dryRun ? { dryRun: true } : {},
+		...options.push ? { buildOnly: true } : {},
 		...allowDevServices.length > 0 ? { allowDevServices } : {},
 		logger: {
 			info: (message) => console.log(message),
@@ -3517,6 +3541,17 @@ async function composeCommand(options, deps = {}) {
 		}
 	}).result;
 	if (!finished) return void 0;
+	if (options.push && !options.dryRun) {
+		const digests = pushedDigests(finished);
+		console.log(`\n✅ Pushed ${Object.keys(digests).length} image(s):`);
+		for (const [app, ref] of Object.entries(digests)) console.log(`   ${app.padEnd(12)} ${ref}`);
+		if (options.digestsFile) {
+			const file = resolve(cwd, options.digestsFile);
+			await mkdir(dirname(file), { recursive: true });
+			await writeFile(file, `${JSON.stringify(digests, null, 2)}\n`);
+			console.log(`\n📝 Wrote the digests to ${options.digestsFile}`);
+		}
+	}
 	return {
 		stack: finished.stack,
 		files: finished.files,
@@ -4929,25 +4964,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.73",
-	"@geekmidas/auth": "~10.0.0-alpha.73",
-	"@geekmidas/cache": "~10.0.0-alpha.73",
-	"@geekmidas/client": "~10.0.0-alpha.73",
-	"@geekmidas/cloud": "~10.0.0-alpha.73",
-	"@geekmidas/constructs": "~10.0.0-alpha.73",
-	"@geekmidas/db": "~10.0.0-alpha.73",
-	"@geekmidas/emailkit": "~10.0.0-alpha.73",
-	"@geekmidas/envkit": "~10.0.0-alpha.73",
-	"@geekmidas/errors": "~10.0.0-alpha.73",
-	"@geekmidas/events": "~10.0.0-alpha.73",
-	"@geekmidas/logger": "~10.0.0-alpha.73",
-	"@geekmidas/manifest": "~10.0.0-alpha.73",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.73",
-	"@geekmidas/schema": "~10.0.0-alpha.73",
-	"@geekmidas/services": "~10.0.0-alpha.73",
-	"@geekmidas/storage": "~10.0.0-alpha.73",
-	"@geekmidas/telescope": "~10.0.0-alpha.73",
-	"@geekmidas/testkit": "~10.0.0-alpha.73",
+	"@geekmidas/audit": "~10.0.0-alpha.75",
+	"@geekmidas/auth": "~10.0.0-alpha.75",
+	"@geekmidas/cache": "~10.0.0-alpha.75",
+	"@geekmidas/client": "~10.0.0-alpha.75",
+	"@geekmidas/cloud": "~10.0.0-alpha.75",
+	"@geekmidas/constructs": "~10.0.0-alpha.75",
+	"@geekmidas/db": "~10.0.0-alpha.75",
+	"@geekmidas/emailkit": "~10.0.0-alpha.75",
+	"@geekmidas/envkit": "~10.0.0-alpha.75",
+	"@geekmidas/errors": "~10.0.0-alpha.75",
+	"@geekmidas/events": "~10.0.0-alpha.75",
+	"@geekmidas/logger": "~10.0.0-alpha.75",
+	"@geekmidas/manifest": "~10.0.0-alpha.75",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.75",
+	"@geekmidas/schema": "~10.0.0-alpha.75",
+	"@geekmidas/services": "~10.0.0-alpha.75",
+	"@geekmidas/storage": "~10.0.0-alpha.75",
+	"@geekmidas/telescope": "~10.0.0-alpha.75",
+	"@geekmidas/testkit": "~10.0.0-alpha.75",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10738,7 +10773,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-CFFC3esE.mjs");
+	const { migrateAndSeed } = await import("./migrate-BLL1RTAj.mjs");
 	const { discover } = await import("./discover-BPelzeGW.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
@@ -11104,13 +11139,15 @@ program.command("setup").description("Reconcile declared constructs — containe
 		process.exit(1);
 	}
 });
-program.command("build").description("Build handlers and the manifest from declared constructs").option("--provider <provider>", "Build for aws or server (default: where gkm.config.ts deploys)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").option("--mark-optional", "Suffix optional env vars with ? in manifest envVars field (e.g. PORT?)").action(async (options) => {
+program.command("build").description("Build handlers and the manifest from declared constructs").option("--provider <provider>", "Build for aws or server (default: where gkm.config.ts deploys)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").option("--mark-optional", "Suffix optional env vars with ? in manifest envVars field (e.g. PORT?)").addOption(new Option("--cache <backend>", "Register the drivers for this cache backend rather than the target default").hideHelp()).action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		if (options.provider !== void 0 && !isMainProvider(options.provider)) throw new UnknownBuildProvider(options.provider);
+		if (options.cache !== void 0 && !isCacheBackend(options.cache)) throw new UnknownCacheBackend(options.cache);
 		await buildCommand({
 			...options.provider ? { provider: options.provider } : {},
+			...options.cache ? { cache: options.cache } : {},
 			enableOpenApi: options.enableOpenapi || false,
 			production: options.production || false,
 			skipBundle: options.skipBundle || false,
@@ -11169,7 +11206,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-CFFC3esE.mjs");
+		const { migrateCommand } = await import("./migrate-BLL1RTAj.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11183,7 +11220,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-CFFC3esE.mjs");
+		const { seedCommand } = await import("./migrate-BLL1RTAj.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11197,7 +11234,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-CFFC3esE.mjs");
+		const { migrationCommand } = await import("./migrate-BLL1RTAj.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11242,7 +11279,7 @@ program.command("docker").description("Generate Docker deployment files").option
 		process.exit(1);
 	}
 });
-program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services <list>", "Deployed stage: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
+program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services <list>", "Deployed stage: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -11291,7 +11328,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-BiPlBUq3.mjs");
+		const { secretsAddCommand } = await import("./add-Cvzdw8cf.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11302,7 +11339,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-CmfPICSN.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-JkeMPugf.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11313,7 +11350,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-CmfPICSN.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-JkeMPugf.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11356,7 +11393,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./state-DtS2HEfi.mjs").then((n) => n.qt);
+		const { secretsStoreFor } = await import("./state-BrWIOce_.mjs").then((n) => n.Wt);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11365,7 +11402,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./state-DtS2HEfi.mjs").then((n) => n.nt);
+		const { derivedContainers } = await import("./state-BrWIOce_.mjs").then((n) => n.Q);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11380,7 +11417,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await import("./cli-BfdfyTF6.mjs");
+	const { deployCli } = await import("./cli-BTGfA0B7.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11397,7 +11434,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-C-V-Rf4a.mjs").then((n) => n.a);
+		const { rollbackStage } = await import("./rollback-CLi5Pln_.mjs").then((n) => n.a);
 		const { terminalCredentials } = await import("./terminal-BdvrmkaC.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -11433,7 +11470,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-hjHHm7jM.mjs");
+		const { deployGithubCommand } = await import("./github-BNngHoId.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));