@geekmidas/cli 10.0.0-alpha.73 → 10.0.0-alpha.75

package/dist/{state-DMjFPOhf.cjs → state-kA4Fkufx.cjs}

@@ -5,8 +5,8 @@ const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-vdrcRI-m.cjs");
 const require_config = require("./config.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-CP6sBvQV.cjs");
-const require_resolve = require("./resolve-E5RfY0bm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-Bixm28fN.cjs");
+const require_resolve = require("./resolve-fevXn-wZ.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-CajwOa5W.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -276,7 +276,7 @@ function applicationName(identity, app) {
 * old file stays, so an older CLI on the same machine keeps working.
 */
 /** Key length for AES-256 encryption */
-const KEY_LENGTH$1 = 32;
+const KEY_LENGTH = 32;
 /** A keystore project key that is not `<namespace>/<project>`. */
 var KeystoreProjectInvalid = class extends Error {
 	key;
@@ -369,7 +369,7 @@ async function generateKey(stage, project, flag = "w") {
 		recursive: true,
 		mode: 448
 	});
-	const key = (0, node_crypto.randomBytes)(KEY_LENGTH$1).toString("hex");
+	const key = (0, node_crypto.randomBytes)(KEY_LENGTH).toString("hex");
 	await (0, node_fs_promises.writeFile)(keyPath, key, {
 		mode: 384,
 		encoding: "utf-8",
@@ -438,8 +438,8 @@ async function getOrCreateKey(stage, project) {
 /** Where the files live, relative to the project root. */
 const SECRETS_DIR = ".gkm/secrets";
 /** AES-256-GCM configuration */
-const ALGORITHM$1 = "aes-256-gcm";
-const IV_LENGTH$1 = 12;
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
 /**
 * A stage's secrets as an encrypted file on this machine:
 * `.gkm/secrets/<stage>.json`, with its key in the CLI's home at
@@ -507,8 +507,8 @@ function packageName$1(root) {
 }
 function encrypt(secrets, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
-	const iv = (0, node_crypto.randomBytes)(IV_LENGTH$1);
-	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM$1, key, iv);
+	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
+	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, key, iv);
 	const ciphertext = Buffer.concat([cipher.update(JSON.stringify(secrets), "utf-8"), cipher.final()]);
 	return {
 		version: 1,
@@ -519,7 +519,7 @@ function encrypt(secrets, keyHex) {
 function decrypt(data, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
 	const combined = Buffer.from(data.encrypted, "base64");
-	const decipher = (0, node_crypto.createDecipheriv)(ALGORITHM$1, key, Buffer.from(data.iv, "hex"));
+	const decipher = (0, node_crypto.createDecipheriv)(ALGORITHM, key, Buffer.from(data.iv, "hex"));
 	decipher.setAuthTag(combined.subarray(-16));
 	const plaintext = Buffer.concat([decipher.update(combined.subarray(0, -16)), decipher.final()]);
 	return JSON.parse(plaintext.toString("utf-8"));
@@ -556,7 +556,7 @@ function isRemoteStore(workspace, stage) {
 }
 //#endregion
 //#region src/credentials/index.ts
-const logger$2 = console;
+const logger$1 = console;
 /**
 * Load environment files
 * @internal Exported for testing
@@ -607,7 +607,7 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	for (let i = 0; i < maxAttempts; i++) {
 		const port = preferredPort + i;
 		if (await isPortAvailable(port)) return port;
-		logger$2.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+		logger$1.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
@@ -642,7 +642,7 @@ async function loadSecretsForApp(store, stage, appName) {
 	let secrets = {};
 	const stageSecrets = await store.read(stage);
 	if (stageSecrets) {
-		logger$2.log(`🔐 Loading secrets from stage: ${stage}`);
+		logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
 		secrets = toEmbeddableSecrets(stageSecrets);
 	}
 	if (Object.keys(secrets).length === 0) return {};
@@ -748,7 +748,7 @@ async function prepareEntryCredentials(options) {
 			free: isPortAvailable,
 			holder: holderOf
 		});
-		for (const { app, from, to, holder } of assigned.moved) logger$2.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+		for (const { app, from, to, holder } of assigned.moved) logger$1.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
 		workspace = withAppPorts(workspace, assigned.ports);
 		workspaceAppPort = assigned.ports[appName] ?? workspaceAppPort;
 	}
@@ -772,7 +772,7 @@ async function prepareEntryCredentials(options) {
 		});
 		Object.assign(credentials, reconciled.env);
 		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger$2.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+		if (Object.keys(reconciled.env).length > 0) logger$1.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
 	}
 	const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
 	await (0, node_fs_promises.mkdir)(secretsDir, { recursive: true });
@@ -1281,23 +1281,22 @@ RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
 *
 * Nothing built on the host reaches the image — `.dockerignore` keeps every
 * `dist` out — so a workspace package (a CLI that is a sibling package) is
-* built here: the root's `build` script if it has one, then turbo's build of
-* the app's dependencies (`^build`).
+* built here: turbo's build of the app's dependencies (`^build`) and nothing
+* else. The root's own `build` script is never run: the slice holds one app,
+* and a root `build` that is `gkm build` (what `gkm init` scaffolds) builds
+* every app the workspace declares, most of which are not in it. The app
+* itself is built after this, by `gkm build` or its framework.
 */
 function builderStage(options, extra = {}) {
-	const { pm, turbo, monorepo } = layout(options);
+	const { turbo, monorepo } = layout(options);
 	const args = extra.args ?? [];
 	const argLines = args.length ? `\n# Build-time args: public values the bundler inlines\n${args.map((a) => `ARG ${a}=""`).join("\n")}\n${args.map((a) => `ENV ${a}=$${a}`).join("\n")}\n` : "";
 	const scopes = [options.turboPackage, ...options.prunePackages ?? []];
-	const dependencies = monorepo ? `\nRUN ${turbo} run build ${scopes.map((s) => `--filter='${s}^...'`).join(" ")}` : "";
 	return `# Stage 3: Build
 FROM deps AS builder
 WORKDIR /app
 ${argLines}
-COPY --from=pruner /app/out/full/ ./
-
-# The workspace packages the app depends on, built from source.
-RUN ${pm.run} --if-present build${dependencies}`;
+COPY --from=pruner /app/out/full/ ./${monorepo ? `\n# The workspace packages the app depends on, built from source.\nRUN ${turbo} run build ${scopes.map((s) => `--filter='${s}^...'`).join(" ")}` : ""}`;
 }
 /**
 * The PATH a command in the app's directory runs with: the app's binaries,
@@ -1580,7 +1579,7 @@ ${depsStage(options)}
 ${builderStage(options)}
 
 # Bundle the production server, with the encrypted credentials embedded
-${credentialsStep(app, `cd ${app} && ${gkmCommand("build --provider server --production")}`)}
+${credentialsStep(app, `cd ${app} && ${gkmCommand(`build --provider server --production${options.cache ? ` --cache ${options.cache}` : ""}`)}`)}
 ${externals.stage}
 # Production
 FROM ${options.baseImage} AS runner
@@ -2182,7 +2181,8 @@ const CONTAINERS = {
 */
 const CACHE_CONTAINERS = {
 	upstash: "redis-http",
-	elasticache: "redis"
+	elasticache: "redis",
+	redis: "redis"
 };
 /**
 * Kinds that resolve a value without anything running.
@@ -2295,7 +2295,7 @@ function containerFor(kind, events = DEFAULT_EVENTS, cache = require_SubscriberG
 	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
 	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
 	if (kind === "cache") {
-		if (derived) return CONTAINERS.database;
+		if (derived && !require_SubscriberGenerator.holdsEveryCache(cache)) return CONTAINERS.database;
 		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
 	}
 	return CONTAINERS[kind];
@@ -2328,6 +2328,7 @@ function planFor(manifest, stage, order, options = {}) {
 				port: fake.port
 			} : {}
 		};
+		const detached = declaration.kind === "cache" && require_SubscriberGenerator.holdsEveryCache(cache);
 		const container = fake?.image ? fake.key : containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
 		if (!container && !CONTAINERLESS[declaration.kind]) continue;
 		if (container) {
@@ -2354,11 +2355,11 @@ function planFor(manifest, stage, order, options = {}) {
 				credentials: fake.credentials
 			} } : {},
 			...declaration.kind === "external-api" && !fake ? { url: declaration.url } : {},
-			..."of" in declaration ? { of: declaration.of } : {},
+			..."of" in declaration && !detached ? { of: declaration.of } : {},
 			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
 			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
 			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
-			..."table" in declaration && declaration.table ? { table: declaration.table } : {}
+			..."table" in declaration && declaration.table && !detached ? { table: declaration.table } : {}
 		});
 	}
 	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
@@ -2720,7 +2721,8 @@ function urlFor(resource, plan, ports, project, addresses = {}, credential = { m
 				return url ? withTable(url, resource.table ?? (0, _geekmidas_manifest.cacheTable)(resource.id)) : void 0;
 			}
 			switch (plan.cache) {
-				case "elasticache": return `redis://${LOCAL_HOST}:${port}`;
+				case "elasticache":
+				case "redis": return `redis://${LOCAL_HOST}:${port}`;
 				default: return `http://:${LOCAL_TOKEN$1}@${LOCAL_HOST}:${port}`;
 			}
 		case "queue":
@@ -5290,58 +5292,6 @@ logger.info({ port }, 'Worker started');
 `;
 }
 //#endregion
-//#region src/secrets/encryption.ts
-var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
-	encryptSecrets: () => encryptSecrets,
-	generateDefineOptions: () => generateDefineOptions,
-	keyFingerprint: () => keyFingerprint
-});
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const KEY_LENGTH = 32;
-const IV_LENGTH = 12;
-/**
-* Encrypt secrets for embedding in a bundle.
-* Uses AES-256-GCM with a randomly generated ephemeral key.
-*
-* @param secrets - Key-value pairs to encrypt
-* @returns Encrypted payload with ephemeral master key
-*/
-function encryptSecrets(secrets) {
-	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
-	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
-		iv: iv.toString("hex"),
-		masterKey: masterKey.toString("hex")
-	};
-}
-/**
-* Generate the define options for tsdown/esbuild.
-* These will be injected at build time.
-*/
-function generateDefineOptions(payload) {
-	return {
-		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
-		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
-	};
-}
-/**
-* A short, one-way name for a master key: the first 8 hex characters of its
-* SHA-256.
-*
-* Printed where the key itself used to be, so a person can tell which key a
-* build used — and match it against the one they hold — without the output
-* carrying a value that decrypts every secret of the stage.
-*/
-function keyFingerprint(masterKey) {
-	return (0, node_crypto.createHash)("sha256").update(masterKey).digest("hex").slice(0, 8);
-}
-//#endregion
 //#region src/build/workers.ts
 /** A worker with background work and no backend app to build it from. */
 var WorkerHasNoApp = class extends Error {
@@ -5829,7 +5779,7 @@ function validateImageRef(ref) {
 }
 //#endregion
 //#region src/docker/index.ts
-const logger$1 = require_discover.output;
+const logger = require_discover.output;
 /** `docker build` failed; what docker printed above says why. */
 var DockerBuildFailed = class extends Error {
 	imageRef;
@@ -5880,7 +5830,7 @@ async function buildDockerImage(app, buildRoot, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
 	const fullImageName = validateImageRef(registry ? `${registry}/${app.imageName}:${tag}` : `${app.imageName}:${tag}`);
-	logger$1.log(`\n🐳 Building Docker image: ${fullImageName}`);
+	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	try {
 		await require_run.run("docker", [
 			"build",
@@ -5894,7 +5844,7 @@ async function buildDockerImage(app, buildRoot, options) {
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger$1.log(`✅ Docker image built: ${fullImageName}`);
+		logger.log(`✅ Docker image built: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerBuildFailed(fullImageName, error);
 	}
@@ -5907,10 +5857,10 @@ async function pushDockerImage(imageName, options, cwd) {
 	const registry = options.registry;
 	if (!registry) throw new PushNeedsRegistry(imageName);
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
-	logger$1.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
 		await require_run.run("docker", ["push", fullImageName], { cwd });
-		logger$1.log(`✅ Docker image pushed: ${fullImageName}`);
+		logger.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
 	}
@@ -5922,16 +5872,16 @@ async function pushDockerImage(imageName, options, cwd) {
 async function workspaceDockerCommand(workspace, manifest, imageNames = {}, background = {}) {
 	const results = [];
 	const layout = imageLayout(workspace);
-	logger$1.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
-	logger$1.log(`   Build root: ${layout.buildRoot}`);
-	logger$1.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
+	logger.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
+	logger.log(`   Build root: ${layout.buildRoot}`);
+	logger.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
 	for (const [appName, app] of Object.entries(workspace.apps)) {
 		if (app.type === "mobile") {
-			logger$1.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
+			logger.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
 			continue;
 		}
 		const buildType = app.entry ? "entry" : app.type;
-		logger$1.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
+		logger.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
 		const dockerfile = appDockerfile(appName, app, {
 			layout,
 			workspaceRoot: workspace.root,
@@ -5941,7 +5891,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		const dockerfilePath = (0, node_path.join)(workspace.root, path);
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(dockerfilePath), { recursive: true });
 		await (0, node_fs_promises.writeFile)(dockerfilePath, dockerfile);
-		logger$1.log(`      Generated: ${path}`);
+		logger.log(`      Generated: ${path}`);
 		results.push({
 			appName,
 			type: app.type,
@@ -5950,7 +5900,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		});
 	}
 	for (const worker of manifest ? workerUnits(workspace, manifest, background) : []) {
-		logger$1.log(`\n   📄 Generating Dockerfile for ${worker.name} (worker ${worker.id}, built from ${worker.app})`);
+		logger.log(`\n   📄 Generating Dockerfile for ${worker.name} (worker ${worker.id}, built from ${worker.app})`);
 		const dockerfile = workerDockerfile(worker, workspace.apps[worker.app], {
 			layout,
 			workspaceRoot: workspace.root
@@ -5959,7 +5909,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		const dockerfilePath = (0, node_path.join)(workspace.root, path);
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(dockerfilePath), { recursive: true });
 		await (0, node_fs_promises.writeFile)(dockerfilePath, dockerfile);
-		logger$1.log(`      Generated: ${path}`);
+		logger.log(`      Generated: ${path}`);
 		results.push({
 			appName: worker.name,
 			type: "backend",
@@ -5968,13 +5918,13 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		});
 	}
 	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
-	logger$1.log(`\n   Ensured: ${dockerignorePath}`);
+	logger.log(`\n   Ensured: ${dockerignorePath}`);
 	const composePath = await writeConstructsCompose(workspace);
-	logger$1.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
-	logger$1.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
+	logger.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
+	logger.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
 	for (const result of results) {
 		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-		logger$1.log(`   ${icon} docker build -f ${(0, node_path.relative)(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
+		logger.log(`   ${icon} docker build -f ${(0, node_path.relative)(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
 	}
 	printRunInstructions(workspace);
 	return {
@@ -6003,7 +5953,8 @@ function appDockerfile(appName, app, options) {
 	});
 	return generateBackendDockerfile({
 		...image,
-		healthCheckPath: "/health"
+		healthCheckPath: "/health",
+		...options.cache ? { cache: options.cache } : {}
 	});
 }
 /** Where `gkm docker` writes a worker's Dockerfile. */
@@ -6021,7 +5972,8 @@ function workerDockerfile(worker, host, options) {
 		port: WORKER_PORT,
 		worker: worker.id,
 		bundle: workerBundleName(worker.id),
-		healthCheckPath: "/health"
+		healthCheckPath: "/health",
+		...options.cache ? { cache: options.cache } : {}
 	});
 }
 /**
@@ -6091,199 +6043,14 @@ async function writeConstructsCompose(workspace) {
 		stage: workspace.stages.local,
 		start: false
 	});
-	logger$1.log(`   Generated: ${COMPOSE_PATH} (project root)`);
+	logger.log(`   Generated: ${COMPOSE_PATH} (project root)`);
 	return (0, node_path.join)(workspace.root, COMPOSE_PATH);
 }
 function printRunInstructions(workspace) {
 	const project = (0, node_fs.existsSync)((0, node_path.join)(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
-	logger$1.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
-	logger$1.log("   gkm setup   # starts the containers and creates what they hold");
-	logger$1.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
-}
-//#endregion
-//#region src/deploy/docker.ts
-const logger = require_discover.output;
-/**
-* The id the Dockerfile templates mount the encrypted credentials under:
-* `RUN --mount=type=secret,id=gkm_credentials`.
-*/
-const CREDENTIALS_SECRET_ID = "gkm_credentials";
-/**
-* Get the full image reference
-*/
-function getImageRef(registry, imageName, tag) {
-	if (registry) return `${registry}/${imageName}:${tag}`;
-	return `${imageName}:${tag}`;
-}
-/**
-* The `docker build` argv for an image.
-*
-* One element per value, so nothing in a ref or a build arg is read by a
-* shell, and `--opt=value` rather than `--opt value`, so a value that starts
-* with `-` cannot be taken for one of docker's own flags.
-*
-* @internal Exported for testing
-*/
-function dockerBuildArgs(options) {
-	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
-	return [
-		"build",
-		"--platform=linux/amd64",
-		`--file=${dockerfilePath}`,
-		`--tag=${imageRef}`,
-		...buildArgs.map((arg) => `--build-arg=${arg}`),
-		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
-		"."
-	];
-}
-/**
-* The build arg that names which credentials an image embeds: a hash of the
-* ciphertext, which is not a secret. A BuildKit secret is no part of the
-* build cache's key, so without it a rebuild with credentials encrypted under
-* a new key would reuse the layer that embedded the old ones.
-*/
-function credentialsBuildArg(credentials) {
-	return `GKM_CIPHERTEXT_HASH=${(0, node_crypto.createHash)("sha256").update(`${credentials.encrypted}\n${credentials.iv}`).digest("hex").slice(0, 16)}`;
-}
-/** The secret file's content: ciphertext, then IV, one per line. */
-function credentialsFileContent(credentials) {
-	return `${credentials.encrypted}\n${credentials.iv}\n`;
-}
-/**
-* Write the encrypted credentials where `docker build --secret` reads them.
-*
-* Two lines — ciphertext, then IV — so a template can split them with `sed`
-* in any base image. Owner-only, in a directory of its own, and the returned
-* cleanup removes both whatever the build did.
-*
-* @internal Exported for testing
-*/
-async function writeCredentialsFile(credentials) {
-	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-credentials-"));
-	const path = (0, node_path.join)(dir, CREDENTIALS_SECRET_ID);
-	await (0, node_fs_promises.writeFile)(path, credentialsFileContent(credentials), { mode: 384 });
-	await (0, node_fs_promises.chmod)(path, 384);
-	return {
-		path,
-		cleanup: () => (0, node_fs_promises.rm)(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-}
-/**
-* Build Docker image
-* @param imageRef - Full image reference (registry/name:tag)
-* @param buildArgs - Build arguments to pass to docker build
-* @param credentials - Encrypted credentials, passed as a build secret
-*/
-async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
-	logger.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger.log("   Generating Dockerfile...");
-	const { buildRoot } = await dockerCommand({ cwd });
-	const dockerfilePath = (0, node_path.relative)(buildRoot, dockerfile);
-	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
-	try {
-		await require_run.run("docker", dockerBuildArgs({
-			dockerfilePath,
-			imageRef,
-			buildArgs: [...buildArgs ?? [], ...credentials ? [credentialsBuildArg(credentials)] : []],
-			credentialsFile: secret?.path
-		}), {
-			cwd: buildRoot,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			},
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger.log(`✅ Image built: ${imageRef}`);
-	} catch (error) {
-		throw new DockerBuildFailed(imageRef, error);
-	} finally {
-		await secret?.cleanup();
-	}
-}
-/**
-* Push Docker image to registry
-*/
-async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger.log(`\n☁️  Pushing image: ${imageRef}`);
-	try {
-		await require_run.run("docker", ["push", imageRef], {
-			cwd,
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger.log(`✅ Image pushed: ${imageRef}`);
-	} catch (error) {
-		throw new DockerPushFailed(imageRef, error);
-	}
-}
-/**
-* The digest the registry gave a pushed image, `sha256:…`.
-*
-* A tag can be pushed over — by the next deploy, or by anything else that
-* shares the repository — and the digest is what says which image a stage
-* actually ran. `RepoDigests` has one entry per repository the image was
-* pushed to, so the one for this ref's repository is picked by name.
-*
-* @internal Exported for testing
-*/
-async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
-	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await require_run.runOutput("docker", [
-		"image",
-		"inspect",
-		"--format={{json .RepoDigests}}",
-		imageRef
-	], {
-		cwd,
-		...signal ? { signal } : {}
-	});
-	let digests;
-	try {
-		digests = JSON.parse(output.trim() || "[]");
-	} catch {
-		return;
-	}
-	if (!Array.isArray(digests)) return void 0;
-	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
-}
-/**
-* Deploy using Docker (build and optionally push image)
-*/
-async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
-	const imageName = config.imageName;
-	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
-	const cwd = options.cwd ?? process.cwd();
-	const docker = {
-		cwd,
-		dockerfile: (0, node_path.join)(cwd, options.dockerfile ?? dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
-		...options.signal ? { signal: options.signal } : {},
-		...options.stdio ? { stdio: options.stdio } : {}
-	};
-	await buildImage(imageRef, buildArgs, credentials, docker);
-	let digest;
-	if (!skipPush) {
-		if (!config.registry) logger.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else {
-			await pushImage(imageRef, docker);
-			digest = await pushedDigest(imageRef, docker);
-		}
-	}
-	logger.log("\n✅ Docker deployment ready!");
-	logger.log(`\n📋 Deployment details:`);
-	logger.log(`   Image: ${imageRef}`);
-	logger.log(`   Stage: ${stage}`);
-	if (masterKey) logger.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
-	return {
-		imageRef,
-		...digest ? { digest } : {},
-		masterKey
-	};
+	logger.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
+	logger.log("   gkm setup   # starts the containers and creates what they hold");
+	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
 }
 //#endregion
 //#region src/deploy/generated.ts
@@ -6623,6 +6390,18 @@ Object.defineProperty(exports, "DevServicesNeedServerTarget", {
 		return DevServicesNeedServerTarget;
 	}
 });
+Object.defineProperty(exports, "DockerBuildFailed", {
+	enumerable: true,
+	get: function() {
+		return DockerBuildFailed;
+	}
+});
+Object.defineProperty(exports, "DockerPushFailed", {
+	enumerable: true,
+	get: function() {
+		return DockerPushFailed;
+	}
+});
 Object.defineProperty(exports, "ExternalServicesNotConfigured", {
 	enumerable: true,
 	get: function() {
@@ -6791,24 +6570,6 @@ Object.defineProperty(exports, "createEntryWrapper", {
 		return createEntryWrapper;
 	}
 });
-Object.defineProperty(exports, "credentialsBuildArg", {
-	enumerable: true,
-	get: function() {
-		return credentialsBuildArg;
-	}
-});
-Object.defineProperty(exports, "credentialsFileContent", {
-	enumerable: true,
-	get: function() {
-		return credentialsFileContent;
-	}
-});
-Object.defineProperty(exports, "deployDocker", {
-	enumerable: true,
-	get: function() {
-		return deployDocker;
-	}
-});
 Object.defineProperty(exports, "deployIdentity", {
 	enumerable: true,
 	get: function() {
@@ -6845,16 +6606,10 @@ Object.defineProperty(exports, "dockerCommand", {
 		return dockerCommand;
 	}
 });
-Object.defineProperty(exports, "encryptSecrets", {
+Object.defineProperty(exports, "dockerfileOf", {
 	enumerable: true,
 	get: function() {
-		return encryptSecrets;
-	}
-});
-Object.defineProperty(exports, "encryption_exports", {
-	enumerable: true,
-	get: function() {
-		return encryption_exports;
+		return dockerfileOf;
 	}
 });
 Object.defineProperty(exports, "ensureDockerignore", {
@@ -6989,12 +6744,6 @@ Object.defineProperty(exports, "isRemoteStore", {
 		return isRemoteStore;
 	}
 });
-Object.defineProperty(exports, "keyFingerprint", {
-	enumerable: true,
-	get: function() {
-		return keyFingerprint;
-	}
-});
 Object.defineProperty(exports, "keystoreProject", {
 	enumerable: true,
 	get: function() {
@@ -7308,4 +7057,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=state-DMjFPOhf.cjs.map
+//# sourceMappingURL=state-kA4Fkufx.cjs.map