@geekmidas/cli 10.0.0-alpha.73 → 10.0.0-alpha.75

package/dist/{state-DtS2HEfi.mjs → state-BrWIOce_.mjs}

@@ -1,16 +1,16 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { a as runOutput, i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
+import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-C7NqCsQF.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { n as runtimeFor, r as generateTelemetryModule } from "./EndpointGenerator-DftalLYg.mjs";
-import { c as runtimeOf } from "./resolve-CV4eQkDa.mjs";
-import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-DZk_pKDh.mjs";
+import { c as runtimeOf } from "./resolve-DZNx7rLy.mjs";
+import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-5looQ3gB.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
-import { appendFile, chmod, copyFile, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { homedir, networkInterfaces, tmpdir } from "node:os";
+import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { homedir, networkInterfaces } from "node:os";
 import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Queue } from "@geekmidas/constructs/queue";
@@ -274,7 +274,7 @@ function applicationName(identity, app) {
 * old file stays, so an older CLI on the same machine keeps working.
 */
 /** Key length for AES-256 encryption */
-const KEY_LENGTH$1 = 32;
+const KEY_LENGTH = 32;
 /** A keystore project key that is not `<namespace>/<project>`. */
 var KeystoreProjectInvalid = class extends Error {
 	key;
@@ -367,7 +367,7 @@ async function generateKey(stage, project, flag = "w") {
 		recursive: true,
 		mode: 448
 	});
-	const key = randomBytes(KEY_LENGTH$1).toString("hex");
+	const key = randomBytes(KEY_LENGTH).toString("hex");
 	await writeFile(keyPath, key, {
 		mode: 384,
 		encoding: "utf-8",
@@ -436,8 +436,8 @@ async function getOrCreateKey(stage, project) {
 /** Where the files live, relative to the project root. */
 const SECRETS_DIR = ".gkm/secrets";
 /** AES-256-GCM configuration */
-const ALGORITHM$1 = "aes-256-gcm";
-const IV_LENGTH$1 = 12;
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
 /**
 * A stage's secrets as an encrypted file on this machine:
 * `.gkm/secrets/<stage>.json`, with its key in the CLI's home at
@@ -505,8 +505,8 @@ function packageName$1(root) {
 }
 function encrypt(secrets, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
-	const iv = randomBytes(IV_LENGTH$1);
-	const cipher = createCipheriv(ALGORITHM$1, key, iv);
+	const iv = randomBytes(IV_LENGTH);
+	const cipher = createCipheriv(ALGORITHM, key, iv);
 	const ciphertext = Buffer.concat([cipher.update(JSON.stringify(secrets), "utf-8"), cipher.final()]);
 	return {
 		version: 1,
@@ -517,7 +517,7 @@ function encrypt(secrets, keyHex) {
 function decrypt(data, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
 	const combined = Buffer.from(data.encrypted, "base64");
-	const decipher = createDecipheriv(ALGORITHM$1, key, Buffer.from(data.iv, "hex"));
+	const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(data.iv, "hex"));
 	decipher.setAuthTag(combined.subarray(-16));
 	const plaintext = Buffer.concat([decipher.update(combined.subarray(0, -16)), decipher.final()]);
 	return JSON.parse(plaintext.toString("utf-8"));
@@ -554,7 +554,7 @@ function isRemoteStore(workspace, stage) {
 }
 //#endregion
 //#region src/credentials/index.ts
-const logger$2 = console;
+const logger$1 = console;
 /**
 * Load environment files
 * @internal Exported for testing
@@ -605,7 +605,7 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	for (let i = 0; i < maxAttempts; i++) {
 		const port = preferredPort + i;
 		if (await isPortAvailable(port)) return port;
-		logger$2.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+		logger$1.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
@@ -640,7 +640,7 @@ async function loadSecretsForApp(store, stage, appName) {
 	let secrets = {};
 	const stageSecrets = await store.read(stage);
 	if (stageSecrets) {
-		logger$2.log(`🔐 Loading secrets from stage: ${stage}`);
+		logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
 		secrets = toEmbeddableSecrets(stageSecrets);
 	}
 	if (Object.keys(secrets).length === 0) return {};
@@ -746,7 +746,7 @@ async function prepareEntryCredentials(options) {
 			free: isPortAvailable,
 			holder: holderOf
 		});
-		for (const { app, from, to, holder } of assigned.moved) logger$2.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+		for (const { app, from, to, holder } of assigned.moved) logger$1.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
 		workspace = withAppPorts(workspace, assigned.ports);
 		workspaceAppPort = assigned.ports[appName] ?? workspaceAppPort;
 	}
@@ -770,7 +770,7 @@ async function prepareEntryCredentials(options) {
 		});
 		Object.assign(credentials, reconciled.env);
 		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger$2.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+		if (Object.keys(reconciled.env).length > 0) logger$1.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
 	}
 	const secretsDir = join(secretsRoot, ".gkm");
 	await mkdir(secretsDir, { recursive: true });
@@ -1279,23 +1279,22 @@ RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
 *
 * Nothing built on the host reaches the image — `.dockerignore` keeps every
 * `dist` out — so a workspace package (a CLI that is a sibling package) is
-* built here: the root's `build` script if it has one, then turbo's build of
-* the app's dependencies (`^build`).
+* built here: turbo's build of the app's dependencies (`^build`) and nothing
+* else. The root's own `build` script is never run: the slice holds one app,
+* and a root `build` that is `gkm build` (what `gkm init` scaffolds) builds
+* every app the workspace declares, most of which are not in it. The app
+* itself is built after this, by `gkm build` or its framework.
 */
 function builderStage(options, extra = {}) {
-	const { pm, turbo, monorepo } = layout(options);
+	const { turbo, monorepo } = layout(options);
 	const args = extra.args ?? [];
 	const argLines = args.length ? `\n# Build-time args: public values the bundler inlines\n${args.map((a) => `ARG ${a}=""`).join("\n")}\n${args.map((a) => `ENV ${a}=$${a}`).join("\n")}\n` : "";
 	const scopes = [options.turboPackage, ...options.prunePackages ?? []];
-	const dependencies = monorepo ? `\nRUN ${turbo} run build ${scopes.map((s) => `--filter='${s}^...'`).join(" ")}` : "";
 	return `# Stage 3: Build
 FROM deps AS builder
 WORKDIR /app
 ${argLines}
-COPY --from=pruner /app/out/full/ ./
-
-# The workspace packages the app depends on, built from source.
-RUN ${pm.run} --if-present build${dependencies}`;
+COPY --from=pruner /app/out/full/ ./${monorepo ? `\n# The workspace packages the app depends on, built from source.\nRUN ${turbo} run build ${scopes.map((s) => `--filter='${s}^...'`).join(" ")}` : ""}`;
 }
 /**
 * The PATH a command in the app's directory runs with: the app's binaries,
@@ -1578,7 +1577,7 @@ ${depsStage(options)}
 ${builderStage(options)}
 
 # Bundle the production server, with the encrypted credentials embedded
-${credentialsStep(app, `cd ${app} && ${gkmCommand("build --provider server --production")}`)}
+${credentialsStep(app, `cd ${app} && ${gkmCommand(`build --provider server --production${options.cache ? ` --cache ${options.cache}` : ""}`)}`)}
 ${externals.stage}
 # Production
 FROM ${options.baseImage} AS runner
@@ -2180,7 +2179,8 @@ const CONTAINERS = {
 */
 const CACHE_CONTAINERS = {
 	upstash: "redis-http",
-	elasticache: "redis"
+	elasticache: "redis",
+	redis: "redis"
 };
 /**
 * Kinds that resolve a value without anything running.
@@ -2293,7 +2293,7 @@ function containerFor(kind, events = DEFAULT_EVENTS, cache = DEFAULT_CACHE.aws,
 	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
 	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
 	if (kind === "cache") {
-		if (derived) return CONTAINERS.database;
+		if (derived && !holdsEveryCache(cache)) return CONTAINERS.database;
 		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
 	}
 	return CONTAINERS[kind];
@@ -2326,6 +2326,7 @@ function planFor(manifest, stage, order, options = {}) {
 				port: fake.port
 			} : {}
 		};
+		const detached = declaration.kind === "cache" && holdsEveryCache(cache);
 		const container = fake?.image ? fake.key : containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
 		if (!container && !CONTAINERLESS[declaration.kind]) continue;
 		if (container) {
@@ -2352,11 +2353,11 @@ function planFor(manifest, stage, order, options = {}) {
 				credentials: fake.credentials
 			} } : {},
 			...declaration.kind === "external-api" && !fake ? { url: declaration.url } : {},
-			..."of" in declaration ? { of: declaration.of } : {},
+			..."of" in declaration && !detached ? { of: declaration.of } : {},
 			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
 			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
 			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
-			..."table" in declaration && declaration.table ? { table: declaration.table } : {}
+			..."table" in declaration && declaration.table && !detached ? { table: declaration.table } : {}
 		});
 	}
 	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
@@ -2718,7 +2719,8 @@ function urlFor(resource, plan, ports, project, addresses = {}, credential = { m
 				return url ? withTable(url, resource.table ?? cacheTable(resource.id)) : void 0;
 			}
 			switch (plan.cache) {
-				case "elasticache": return `redis://${LOCAL_HOST}:${port}`;
+				case "elasticache":
+				case "redis": return `redis://${LOCAL_HOST}:${port}`;
 				default: return `http://:${LOCAL_TOKEN$1}@${LOCAL_HOST}:${port}`;
 			}
 		case "queue":
@@ -5288,58 +5290,6 @@ logger.info({ port }, 'Worker started');
 `;
 }
 //#endregion
-//#region src/secrets/encryption.ts
-var encryption_exports = /* @__PURE__ */ __exportAll({
-	encryptSecrets: () => encryptSecrets,
-	generateDefineOptions: () => generateDefineOptions,
-	keyFingerprint: () => keyFingerprint
-});
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const KEY_LENGTH = 32;
-const IV_LENGTH = 12;
-/**
-* Encrypt secrets for embedding in a bundle.
-* Uses AES-256-GCM with a randomly generated ephemeral key.
-*
-* @param secrets - Key-value pairs to encrypt
-* @returns Encrypted payload with ephemeral master key
-*/
-function encryptSecrets(secrets) {
-	const masterKey = randomBytes(KEY_LENGTH);
-	const iv = randomBytes(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = createCipheriv(ALGORITHM, masterKey, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
-		iv: iv.toString("hex"),
-		masterKey: masterKey.toString("hex")
-	};
-}
-/**
-* Generate the define options for tsdown/esbuild.
-* These will be injected at build time.
-*/
-function generateDefineOptions(payload) {
-	return {
-		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
-		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
-	};
-}
-/**
-* A short, one-way name for a master key: the first 8 hex characters of its
-* SHA-256.
-*
-* Printed where the key itself used to be, so a person can tell which key a
-* build used — and match it against the one they hold — without the output
-* carrying a value that decrypts every secret of the stage.
-*/
-function keyFingerprint(masterKey) {
-	return createHash("sha256").update(masterKey).digest("hex").slice(0, 8);
-}
-//#endregion
 //#region src/build/workers.ts
 /** A worker with background work and no backend app to build it from. */
 var WorkerHasNoApp = class extends Error {
@@ -5827,7 +5777,7 @@ function validateImageRef(ref) {
 }
 //#endregion
 //#region src/docker/index.ts
-const logger$1 = output;
+const logger = output;
 /** `docker build` failed; what docker printed above says why. */
 var DockerBuildFailed = class extends Error {
 	imageRef;
@@ -5878,7 +5828,7 @@ async function buildDockerImage(app, buildRoot, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
 	const fullImageName = validateImageRef(registry ? `${registry}/${app.imageName}:${tag}` : `${app.imageName}:${tag}`);
-	logger$1.log(`\n🐳 Building Docker image: ${fullImageName}`);
+	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	try {
 		await run$1("docker", [
 			"build",
@@ -5892,7 +5842,7 @@ async function buildDockerImage(app, buildRoot, options) {
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger$1.log(`✅ Docker image built: ${fullImageName}`);
+		logger.log(`✅ Docker image built: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerBuildFailed(fullImageName, error);
 	}
@@ -5905,10 +5855,10 @@ async function pushDockerImage(imageName, options, cwd) {
 	const registry = options.registry;
 	if (!registry) throw new PushNeedsRegistry(imageName);
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
-	logger$1.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
 		await run$1("docker", ["push", fullImageName], { cwd });
-		logger$1.log(`✅ Docker image pushed: ${fullImageName}`);
+		logger.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
 	}
@@ -5920,16 +5870,16 @@ async function pushDockerImage(imageName, options, cwd) {
 async function workspaceDockerCommand(workspace, manifest, imageNames = {}, background = {}) {
 	const results = [];
 	const layout = imageLayout(workspace);
-	logger$1.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
-	logger$1.log(`   Build root: ${layout.buildRoot}`);
-	logger$1.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
+	logger.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
+	logger.log(`   Build root: ${layout.buildRoot}`);
+	logger.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
 	for (const [appName, app] of Object.entries(workspace.apps)) {
 		if (app.type === "mobile") {
-			logger$1.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
+			logger.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
 			continue;
 		}
 		const buildType = app.entry ? "entry" : app.type;
-		logger$1.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
+		logger.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
 		const dockerfile = appDockerfile(appName, app, {
 			layout,
 			workspaceRoot: workspace.root,
@@ -5939,7 +5889,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		const dockerfilePath = join(workspace.root, path);
 		await mkdir(dirname(dockerfilePath), { recursive: true });
 		await writeFile(dockerfilePath, dockerfile);
-		logger$1.log(`      Generated: ${path}`);
+		logger.log(`      Generated: ${path}`);
 		results.push({
 			appName,
 			type: app.type,
@@ -5948,7 +5898,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		});
 	}
 	for (const worker of manifest ? workerUnits(workspace, manifest, background) : []) {
-		logger$1.log(`\n   📄 Generating Dockerfile for ${worker.name} (worker ${worker.id}, built from ${worker.app})`);
+		logger.log(`\n   📄 Generating Dockerfile for ${worker.name} (worker ${worker.id}, built from ${worker.app})`);
 		const dockerfile = workerDockerfile(worker, workspace.apps[worker.app], {
 			layout,
 			workspaceRoot: workspace.root
@@ -5957,7 +5907,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		const dockerfilePath = join(workspace.root, path);
 		await mkdir(dirname(dockerfilePath), { recursive: true });
 		await writeFile(dockerfilePath, dockerfile);
-		logger$1.log(`      Generated: ${path}`);
+		logger.log(`      Generated: ${path}`);
 		results.push({
 			appName: worker.name,
 			type: "backend",
@@ -5966,13 +5916,13 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		});
 	}
 	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
-	logger$1.log(`\n   Ensured: ${dockerignorePath}`);
+	logger.log(`\n   Ensured: ${dockerignorePath}`);
 	const composePath = await writeConstructsCompose(workspace);
-	logger$1.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
-	logger$1.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
+	logger.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
+	logger.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
 	for (const result of results) {
 		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-		logger$1.log(`   ${icon} docker build -f ${relative(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
+		logger.log(`   ${icon} docker build -f ${relative(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
 	}
 	printRunInstructions(workspace);
 	return {
@@ -6001,7 +5951,8 @@ function appDockerfile(appName, app, options) {
 	});
 	return generateBackendDockerfile({
 		...image,
-		healthCheckPath: "/health"
+		healthCheckPath: "/health",
+		...options.cache ? { cache: options.cache } : {}
 	});
 }
 /** Where `gkm docker` writes a worker's Dockerfile. */
@@ -6019,7 +5970,8 @@ function workerDockerfile(worker, host, options) {
 		port: WORKER_PORT,
 		worker: worker.id,
 		bundle: workerBundleName(worker.id),
-		healthCheckPath: "/health"
+		healthCheckPath: "/health",
+		...options.cache ? { cache: options.cache } : {}
 	});
 }
 /**
@@ -6089,199 +6041,14 @@ async function writeConstructsCompose(workspace) {
 		stage: workspace.stages.local,
 		start: false
 	});
-	logger$1.log(`   Generated: ${COMPOSE_PATH} (project root)`);
+	logger.log(`   Generated: ${COMPOSE_PATH} (project root)`);
 	return join(workspace.root, COMPOSE_PATH);
 }
 function printRunInstructions(workspace) {
 	const project = existsSync(join(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
-	logger$1.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
-	logger$1.log("   gkm setup   # starts the containers and creates what they hold");
-	logger$1.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
-}
-//#endregion
-//#region src/deploy/docker.ts
-const logger = output;
-/**
-* The id the Dockerfile templates mount the encrypted credentials under:
-* `RUN --mount=type=secret,id=gkm_credentials`.
-*/
-const CREDENTIALS_SECRET_ID = "gkm_credentials";
-/**
-* Get the full image reference
-*/
-function getImageRef(registry, imageName, tag) {
-	if (registry) return `${registry}/${imageName}:${tag}`;
-	return `${imageName}:${tag}`;
-}
-/**
-* The `docker build` argv for an image.
-*
-* One element per value, so nothing in a ref or a build arg is read by a
-* shell, and `--opt=value` rather than `--opt value`, so a value that starts
-* with `-` cannot be taken for one of docker's own flags.
-*
-* @internal Exported for testing
-*/
-function dockerBuildArgs(options) {
-	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
-	return [
-		"build",
-		"--platform=linux/amd64",
-		`--file=${dockerfilePath}`,
-		`--tag=${imageRef}`,
-		...buildArgs.map((arg) => `--build-arg=${arg}`),
-		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
-		"."
-	];
-}
-/**
-* The build arg that names which credentials an image embeds: a hash of the
-* ciphertext, which is not a secret. A BuildKit secret is no part of the
-* build cache's key, so without it a rebuild with credentials encrypted under
-* a new key would reuse the layer that embedded the old ones.
-*/
-function credentialsBuildArg(credentials) {
-	return `GKM_CIPHERTEXT_HASH=${createHash("sha256").update(`${credentials.encrypted}\n${credentials.iv}`).digest("hex").slice(0, 16)}`;
-}
-/** The secret file's content: ciphertext, then IV, one per line. */
-function credentialsFileContent(credentials) {
-	return `${credentials.encrypted}\n${credentials.iv}\n`;
-}
-/**
-* Write the encrypted credentials where `docker build --secret` reads them.
-*
-* Two lines — ciphertext, then IV — so a template can split them with `sed`
-* in any base image. Owner-only, in a directory of its own, and the returned
-* cleanup removes both whatever the build did.
-*
-* @internal Exported for testing
-*/
-async function writeCredentialsFile(credentials) {
-	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
-	const path = join(dir, CREDENTIALS_SECRET_ID);
-	await writeFile(path, credentialsFileContent(credentials), { mode: 384 });
-	await chmod(path, 384);
-	return {
-		path,
-		cleanup: () => rm(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-}
-/**
-* Build Docker image
-* @param imageRef - Full image reference (registry/name:tag)
-* @param buildArgs - Build arguments to pass to docker build
-* @param credentials - Encrypted credentials, passed as a build secret
-*/
-async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
-	logger.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger.log("   Generating Dockerfile...");
-	const { buildRoot } = await dockerCommand({ cwd });
-	const dockerfilePath = relative(buildRoot, dockerfile);
-	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
-	try {
-		await run$1("docker", dockerBuildArgs({
-			dockerfilePath,
-			imageRef,
-			buildArgs: [...buildArgs ?? [], ...credentials ? [credentialsBuildArg(credentials)] : []],
-			credentialsFile: secret?.path
-		}), {
-			cwd: buildRoot,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			},
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger.log(`✅ Image built: ${imageRef}`);
-	} catch (error) {
-		throw new DockerBuildFailed(imageRef, error);
-	} finally {
-		await secret?.cleanup();
-	}
-}
-/**
-* Push Docker image to registry
-*/
-async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger.log(`\n☁️  Pushing image: ${imageRef}`);
-	try {
-		await run$1("docker", ["push", imageRef], {
-			cwd,
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger.log(`✅ Image pushed: ${imageRef}`);
-	} catch (error) {
-		throw new DockerPushFailed(imageRef, error);
-	}
-}
-/**
-* The digest the registry gave a pushed image, `sha256:…`.
-*
-* A tag can be pushed over — by the next deploy, or by anything else that
-* shares the repository — and the digest is what says which image a stage
-* actually ran. `RepoDigests` has one entry per repository the image was
-* pushed to, so the one for this ref's repository is picked by name.
-*
-* @internal Exported for testing
-*/
-async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
-	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await runOutput("docker", [
-		"image",
-		"inspect",
-		"--format={{json .RepoDigests}}",
-		imageRef
-	], {
-		cwd,
-		...signal ? { signal } : {}
-	});
-	let digests;
-	try {
-		digests = JSON.parse(output.trim() || "[]");
-	} catch {
-		return;
-	}
-	if (!Array.isArray(digests)) return void 0;
-	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
-}
-/**
-* Deploy using Docker (build and optionally push image)
-*/
-async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
-	const imageName = config.imageName;
-	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
-	const cwd = options.cwd ?? process.cwd();
-	const docker = {
-		cwd,
-		dockerfile: join(cwd, options.dockerfile ?? dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
-		...options.signal ? { signal: options.signal } : {},
-		...options.stdio ? { stdio: options.stdio } : {}
-	};
-	await buildImage(imageRef, buildArgs, credentials, docker);
-	let digest;
-	if (!skipPush) {
-		if (!config.registry) logger.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else {
-			await pushImage(imageRef, docker);
-			digest = await pushedDigest(imageRef, docker);
-		}
-	}
-	logger.log("\n✅ Docker deployment ready!");
-	logger.log(`\n📋 Deployment details:`);
-	logger.log(`   Image: ${imageRef}`);
-	logger.log(`   Stage: ${stage}`);
-	if (masterKey) logger.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
-	return {
-		imageRef,
-		...digest ? { digest } : {},
-		masterKey
-	};
+	logger.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
+	logger.log("   gkm setup   # starts the containers and creates what they hold");
+	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
 }
 //#endregion
 //#region src/deploy/generated.ts
@@ -6585,6 +6352,6 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { constructGlobs as $, applicationName as $t, DevServicesNeedServerTarget as A, eventsBackendFor as At, requiredStageKeys as B, findAvailablePort as Bt, validateImageRef as C, composeBuildPaths as Ct, isOtlpDestination as D, detectPackageManager as Dt, resolveHost as E, WORKER_PORT as Et, devServicesUsed as F, fakeKey as Ft, keyFingerprint as G, isRemoteStore as Gt, workerUnits as H, loadEnvFiles as Ht, externalServices as I, portKeys as It, workerEntryDir as J, FileSecretsStore as Jt, WorkerGenerator as K, secretsStoreFor as Kt, manifestServiceDeclarations as L, primaryPortKey as Lt, STORAGE_KEY_PAIR as M, storageBackendFor as Mt, UnknownDevService as N, DEFAULT_IMAGES as Nt, otelEnv as O, findBuildRoot as Ot, assertExternalServices as P, describeServices as Pt, backendsOf as Q, readKey as Qt, parseDevServices as R, createCredentialsPreload as Rt, workerDockerfileOf as S, hostFor as St, isMainFrontendApp as T, TURBO_VERSION as Tt, encryptSecrets as U, loadSecretsForApp as Ut, suppliedOnly as V, isPortAvailable as Vt, encryption_exports as W, prepareEntryCredentials as Wt, CronGenerator as X, keystoreProject as Xt, QueueGenerator as Y, getKeyPath as Yt, FAKE_ENV as Z, projectKey as Zt, deployDocker as _, workerEnvKeys as _t, recordRelease as a, ownershipMarker as an, applyBuckets as at, ensureDockerignore as b, planFor as bt, setBackupState as c, maskPassword as cn, bucketPolicies as ct, setGeneratedSecret as d, withCustomSecret as dn, quoteIdentifier as dt, deployIdentity as en, derivedContainers as et, setPostgresBackupId as f, composeFor as ft, credentialsFileContent as g, networkEnv as gt, credentialsBuildArg as h, appEnvKeys as ht, isDnsVerified as i, markerOf as in, forgetState as it, ExternalServicesNotConfigured as j, providerOf as jt, DEV_SERVICES as k, cacheBackendFor as kt, setDnsRecord as l, storage_exports as ln, postgresDatabaseNames as lt, withGeneratedSecrets as m, pgClient as mt, getBackupState as n, imageRef as nn, workspace_exports as nt, recordRollback as o, projectName as on, applyPolicies as ot, DeployJournal as p, bucketClient as pt, workerBundleName as q, store_exports as qt, getGeneratedSecret as r, isOwnedBy as rn, LOCAL_CA_PATH as rt, setApplicationId as s, initStageSecrets as sn, applyPostgres as st, createEmptyState as t, imageName as tn, reconcileWorkspace as tt, setDnsVerification as u, toEmbeddableSecrets as un, postgresStatements as ut, appDockerfile as v, envFor as vt, NoDomainForStage as w, imageLayout as wt, workerDockerfile as x, resourceName as xt, dockerCommand as y, localRolePassword as yt, reportDevServices as z, createEntryWrapper as zt };
+export { LOCAL_CA_PATH as $, imageRef as $t, ExternalServicesNotConfigured as A, DEFAULT_IMAGES as At, suppliedOnly as B, loadSecretsForApp as Bt, NoDomainForStage as C, WORKER_PORT as Ct, otelEnv as D, eventsBackendFor as Dt, isOtlpDestination as E, cacheBackendFor as Et, externalServices as F, createCredentialsPreload as Ft, QueueGenerator as G, FileSecretsStore as Gt, WorkerGenerator as H, isRemoteStore as Ht, manifestServiceDeclarations as I, createEntryWrapper as It, backendsOf as J, projectKey as Jt, CronGenerator as K, getKeyPath as Kt, parseDevServices as L, findAvailablePort as Lt, UnknownDevService as M, fakeKey as Mt, assertExternalServices as N, portKeys as Nt, DEV_SERVICES as O, providerOf as Ot, devServicesUsed as P, primaryPortKey as Pt, workspace_exports as Q, imageName as Qt, reportDevServices as R, isPortAvailable as Rt, validateImageRef as S, TURBO_VERSION as St, resolveHost as T, findBuildRoot as Tt, workerBundleName as U, secretsStoreFor as Ut, workerUnits as V, prepareEntryCredentials as Vt, workerEntryDir as W, store_exports as Wt, derivedContainers as X, applicationName as Xt, constructGlobs as Y, readKey as Yt, reconcileWorkspace as Z, deployIdentity as Zt, appDockerfile as _, planFor as _t, recordRelease as a, maskPassword as an, postgresDatabaseNames as at, workerDockerfile as b, composeBuildPaths as bt, setBackupState as c, withCustomSecret as cn, composeFor as ct, setGeneratedSecret as d, appEnvKeys as dt, isOwnedBy as en, forgetState as et, setPostgresBackupId as f, dockerfileOf as ft, DockerPushFailed as g, localRolePassword as gt, DockerBuildFailed as h, envFor as ht, isDnsVerified as i, initStageSecrets as in, bucketPolicies as it, STORAGE_KEY_PAIR as j, describeServices as jt, DevServicesNeedServerTarget as k, storageBackendFor as kt, setDnsRecord as l, bucketClient as lt, withGeneratedSecrets as m, workerEnvKeys as mt, getBackupState as n, ownershipMarker as nn, applyPolicies as nt, recordRollback as o, storage_exports as on, postgresStatements as ot, DeployJournal as p, networkEnv as pt, FAKE_ENV as q, keystoreProject as qt, getGeneratedSecret as r, projectName as rn, applyPostgres as rt, setApplicationId as s, toEmbeddableSecrets as sn, quoteIdentifier as st, createEmptyState as t, markerOf as tn, applyBuckets as tt, setDnsVerification as u, pgClient as ut, dockerCommand as v, resourceName as vt, isMainFrontendApp as w, detectPackageManager as wt, workerDockerfileOf as x, imageLayout as xt, ensureDockerignore as y, hostFor as yt, requiredStageKeys as z, loadEnvFiles as zt };
 
-//# sourceMappingURL=state-DtS2HEfi.mjs.map
+//# sourceMappingURL=state-BrWIOce_.mjs.map