@geekmidas/cli 10.0.0-alpha.74 → 10.0.0-alpha.76

package/dist/{state-DCwRWyh-.cjs → state-C2qi0iQw.cjs}

@@ -2,10 +2,10 @@ const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-vdrcRI-m.cjs");
+const require_workspace = require("./workspace-DOm81oUo.cjs");
 const require_config = require("./config.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-CP6sBvQV.cjs");
-const require_resolve = require("./resolve-D_BU-wKA.cjs");
+const require_resolve = require("./resolve-Fa1Ii0BK.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-CajwOa5W.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -276,7 +276,7 @@ function applicationName(identity, app) {
 * old file stays, so an older CLI on the same machine keeps working.
 */
 /** Key length for AES-256 encryption */
-const KEY_LENGTH$1 = 32;
+const KEY_LENGTH = 32;
 /** A keystore project key that is not `<namespace>/<project>`. */
 var KeystoreProjectInvalid = class extends Error {
 	key;
@@ -369,7 +369,7 @@ async function generateKey(stage, project, flag = "w") {
 		recursive: true,
 		mode: 448
 	});
-	const key = (0, node_crypto.randomBytes)(KEY_LENGTH$1).toString("hex");
+	const key = (0, node_crypto.randomBytes)(KEY_LENGTH).toString("hex");
 	await (0, node_fs_promises.writeFile)(keyPath, key, {
 		mode: 384,
 		encoding: "utf-8",
@@ -438,8 +438,8 @@ async function getOrCreateKey(stage, project) {
 /** Where the files live, relative to the project root. */
 const SECRETS_DIR = ".gkm/secrets";
 /** AES-256-GCM configuration */
-const ALGORITHM$1 = "aes-256-gcm";
-const IV_LENGTH$1 = 12;
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
 /**
 * A stage's secrets as an encrypted file on this machine:
 * `.gkm/secrets/<stage>.json`, with its key in the CLI's home at
@@ -507,8 +507,8 @@ function packageName$1(root) {
 }
 function encrypt(secrets, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
-	const iv = (0, node_crypto.randomBytes)(IV_LENGTH$1);
-	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM$1, key, iv);
+	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
+	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, key, iv);
 	const ciphertext = Buffer.concat([cipher.update(JSON.stringify(secrets), "utf-8"), cipher.final()]);
 	return {
 		version: 1,
@@ -519,7 +519,7 @@ function encrypt(secrets, keyHex) {
 function decrypt(data, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
 	const combined = Buffer.from(data.encrypted, "base64");
-	const decipher = (0, node_crypto.createDecipheriv)(ALGORITHM$1, key, Buffer.from(data.iv, "hex"));
+	const decipher = (0, node_crypto.createDecipheriv)(ALGORITHM, key, Buffer.from(data.iv, "hex"));
 	decipher.setAuthTag(combined.subarray(-16));
 	const plaintext = Buffer.concat([decipher.update(combined.subarray(0, -16)), decipher.final()]);
 	return JSON.parse(plaintext.toString("utf-8"));
@@ -529,7 +529,8 @@ function decrypt(data, keyHex) {
 var store_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	FileSecretsStore: () => FileSecretsStore,
 	isRemoteStore: () => isRemoteStore,
-	secretsStoreFor: () => secretsStoreFor
+	secretsStoreFor: () => secretsStoreFor,
+	storeFromConfig: () => storeFromConfig
 });
 /**
 * The store a stage's secrets are kept in — what every command reads and
@@ -541,13 +542,41 @@ var store_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 async function secretsStoreFor(workspace, stage, options = {}) {
 	const configured = workspace.secrets.store ?? "file";
 	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
-	if (configured.provider !== "ssm") return configured.provider;
-	const { AwsSecretsStore } = await Promise.resolve().then(() => require("./aws-DkHdTV-p.cjs"));
-	return new AwsSecretsStore({
-		project: workspace.name,
-		region: configured.region,
-		...options.profile ? { profile: options.profile } : {}
-	});
+	return storeFromConfig(workspace, configured, options);
+}
+/**
+* The store a `secrets.store` value describes, for any stage — what
+* {@link secretsStoreFor} answers for a deployed stage, and what
+* `gkm secrets:migrate` builds for the store it copies to.
+*/
+async function storeFromConfig(workspace, config, options = {}) {
+	if (config === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
+	const profile = options.profile ? { profile: options.profile } : {};
+	switch (config.provider) {
+		case "ssm": {
+			const { AwsSecretsStore } = await Promise.resolve().then(() => require("./aws-CQAuluiu.cjs"));
+			return new AwsSecretsStore({
+				project: workspace.name,
+				region: config.region,
+				...profile
+			});
+		}
+		case "secrets-manager": {
+			const { kmsKeyId } = config;
+			const { SecretsManagerSecretsStore } = await Promise.resolve().then(() => require("./secretsManager-DUXW3fQt.cjs"));
+			return new SecretsManagerSecretsStore({
+				project: workspace.name,
+				region: config.region,
+				...kmsKeyId ? { kmsKeyId } : {},
+				...profile
+			});
+		}
+		default: {
+			const provider = config.provider;
+			if (typeof provider === "object" && provider !== null) return provider;
+			throw new require_workspace.UnknownSecretsStoreProvider(provider);
+		}
+	}
 }
 /** Whether a stage's secrets live somewhere other than this machine. */
 function isRemoteStore(workspace, stage) {
@@ -556,7 +585,7 @@ function isRemoteStore(workspace, stage) {
 }
 //#endregion
 //#region src/credentials/index.ts
-const logger$2 = console;
+const logger$1 = console;
 /**
 * Load environment files
 * @internal Exported for testing
@@ -607,7 +636,7 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	for (let i = 0; i < maxAttempts; i++) {
 		const port = preferredPort + i;
 		if (await isPortAvailable(port)) return port;
-		logger$2.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+		logger$1.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
@@ -642,7 +671,7 @@ async function loadSecretsForApp(store, stage, appName) {
 	let secrets = {};
 	const stageSecrets = await store.read(stage);
 	if (stageSecrets) {
-		logger$2.log(`🔐 Loading secrets from stage: ${stage}`);
+		logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
 		secrets = toEmbeddableSecrets(stageSecrets);
 	}
 	if (Object.keys(secrets).length === 0) return {};
@@ -748,7 +777,7 @@ async function prepareEntryCredentials(options) {
 			free: isPortAvailable,
 			holder: holderOf
 		});
-		for (const { app, from, to, holder } of assigned.moved) logger$2.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+		for (const { app, from, to, holder } of assigned.moved) logger$1.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
 		workspace = withAppPorts(workspace, assigned.ports);
 		workspaceAppPort = assigned.ports[appName] ?? workspaceAppPort;
 	}
@@ -772,7 +801,7 @@ async function prepareEntryCredentials(options) {
 		});
 		Object.assign(credentials, reconciled.env);
 		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger$2.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+		if (Object.keys(reconciled.env).length > 0) logger$1.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
 	}
 	const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
 	await (0, node_fs_promises.mkdir)(secretsDir, { recursive: true });
@@ -1024,6 +1053,36 @@ function eventsBackendFor(on) {
 	return require_SubscriberGenerator.DEFAULT_EVENTS[on];
 }
 //#endregion
+//#region src/exec/imageBuild.ts
+/**
+* Set by a site's Dockerfile in its builder stage: this process is building
+* an image.
+*
+* Inside an image there is no stage to load secrets for and no local
+* container to resolve an address from — the public URLs the bundle inlines
+* arrived as the Dockerfile's build args, already in the environment. So
+* `gkm exec -- next build` there injects exactly those, and never the
+* `localhost` addresses a workspace resolves on a developer's machine.
+*/
+const IMAGE_BUILD_ENV = "GKM_IMAGE_BUILD";
+/** Whether this process is building an image. */
+function isImageBuild(env = process.env) {
+	return env[IMAGE_BUILD_ENV] === "1";
+}
+/**
+* What `gkm exec` injects inside an image build: the public values its build
+* args set — every `NEXT_PUBLIC_*`, `VITE_*` and `EXPO_PUBLIC_*` — and
+* nothing read from a secrets store, a file or a container.
+*/
+function imageBuildCredentials(env = process.env) {
+	const credentials = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (value === void 0) continue;
+		if (require_workspace.PUBLIC_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) credentials[key] = value;
+	}
+	return credentials;
+}
+//#endregion
 //#region src/docker/templates.ts
 /**
 * The turbo every image prunes and builds with when the build root resolves
@@ -1281,23 +1340,22 @@ RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
 *
 * Nothing built on the host reaches the image — `.dockerignore` keeps every
 * `dist` out — so a workspace package (a CLI that is a sibling package) is
-* built here: the root's `build` script if it has one, then turbo's build of
-* the app's dependencies (`^build`).
+* built here: turbo's build of the app's dependencies (`^build`) and nothing
+* else. The root's own `build` script is never run: the slice holds one app,
+* and a root `build` that is `gkm build` (what `gkm init` scaffolds) builds
+* every app the workspace declares, most of which are not in it. The app
+* itself is built after this, by `gkm build` or its framework.
 */
 function builderStage(options, extra = {}) {
-	const { pm, turbo, monorepo } = layout(options);
+	const { turbo, monorepo } = layout(options);
 	const args = extra.args ?? [];
 	const argLines = args.length ? `\n# Build-time args: public values the bundler inlines\n${args.map((a) => `ARG ${a}=""`).join("\n")}\n${args.map((a) => `ENV ${a}=$${a}`).join("\n")}\n` : "";
 	const scopes = [options.turboPackage, ...options.prunePackages ?? []];
-	const dependencies = monorepo ? `\nRUN ${turbo} run build ${scopes.map((s) => `--filter='${s}^...'`).join(" ")}` : "";
 	return `# Stage 3: Build
 FROM deps AS builder
 WORKDIR /app
 ${argLines}
-COPY --from=pruner /app/out/full/ ./
-
-# The workspace packages the app depends on, built from source.
-RUN ${pm.run} --if-present build${dependencies}`;
+COPY --from=pruner /app/out/full/ ./${monorepo ? `\n# The workspace packages the app depends on, built from source.\nRUN ${turbo} run build ${scopes.map((s) => `--filter='${s}^...'`).join(" ")}` : ""}`;
 }
 /**
 * The PATH a command in the app's directory runs with: the app's binaries,
@@ -1322,7 +1380,48 @@ function binPath(options) {
 * were installed.
 */
 function gkmCommand(args) {
-	return `GKM_BIN="$(node -e 'let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}')" && node "$GKM_BIN" ${args}`;
+	return `GKM_BIN="$(node -e '${FIND_GKM_BIN}')" && node "$GKM_BIN" ${args}`;
+}
+/** Prints the `bin/gkm.mjs` Node resolves from the cwd, or fails saying so. */
+const FIND_GKM_BIN = `let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}`;
+/**
+* What a site's builder does with the gkm workspace it carries, before its
+* framework builds it — all of it inside the image, nothing from the host:
+*
+* - `gkm` on the PATH: the CLI the workspace installs, so a build script that
+*   is `gkm exec -- next build` runs. Resolved from the gkm root rather than
+*   through `node_modules/.bin`, where a CLI that is a workspace package has
+*   no bin linked.
+* - `GKM_IMAGE_BUILD`, which has `gkm exec` inject the build args above — the
+*   stage's public URLs — and never load a secret or resolve a local address.
+* - each backend's typed client, generated from its endpoints at the
+*   workspace root's `.gkm/client/`, where the site's tsconfig paths point.
+*/
+function siteWorkspaceSteps(options) {
+	const { gkmRoot } = layout(options);
+	const root = `/app/${gkmRoot}`.replace(/\/\.$/, "");
+	const clients = options.clients ?? [];
+	const generate = clients.length ? `
+
+# The typed client of each API this site calls, generated from its endpoints
+# into ${gkmRoot === "." ? "" : `${gkmRoot}/`}.gkm/client/ — offline, with no secret and no container.
+RUN ${clients.map(({ app, path }) => `cd /app/${path} && gkm openapi --app ${app}`).join(" && \\\n    ")}` : "";
+	return `# The gkm CLI the workspace installs, as \`gkm\`
+RUN cd ${root} && GKM_BIN="$(node -e '${FIND_GKM_BIN}')" && \\
+    { echo '#!/bin/sh'; echo "exec node \\"$GKM_BIN\\" \\"\\$@\\""; } > /usr/local/bin/gkm && \\
+    chmod +x /usr/local/bin/gkm
+
+# \`gkm exec\` in this build injects the build args, never a stage's secrets
+ENV ${IMAGE_BUILD_ENV}=1${generate}`;
+}
+/**
+* Build the site with turbo. Loose env mode, so the task sees what the
+* Dockerfile set — the build args and `GKM_IMAGE_BUILD` — whatever the
+* project's turbo.json declares: the image's environment holds nothing else.
+*/
+function siteBuild(options) {
+	const { turbo } = layout(options);
+	return `RUN ${turbo} run build --filter='${options.turboPackage}' --env-mode=loose`;
 }
 /**
 * The encrypted credentials, from a build secret — never an ARG, which is
@@ -1476,8 +1575,7 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
 * @internal Exported for testing
 */
 function generateNextjsDockerfile(options) {
-	const { port, appPath, turboPackage, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
-	const { turbo } = layout(options);
+	const { port, appPath, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
 	return `# syntax=docker/dockerfile:1
 # Next.js standalone Dockerfile, built from a turbo-pruned slice
 
@@ -1487,13 +1585,15 @@ ${depsStage(options)}
 
 ${builderStage(options, { args: publicUrlArgs })}
 
+${siteWorkspaceSteps(options)}
+
 # Ensure public directory exists (may be empty for scaffolded projects)
 RUN mkdir -p ${appPath}/public
 
 ENV NEXT_TELEMETRY_DISABLED=1
 
 # Build the application
-RUN ${turbo} run build --filter='${turboPackage}'
+${siteBuild(options)}
 
 # The runner needs the standalone server; without it there is nothing to run.
 RUN if [ ! -d ${appPath}/.next/standalone ]; then \\
@@ -1681,8 +1781,7 @@ CMD ["node", "index.mjs"]
 * @internal Exported for testing
 */
 function generateNodeWebDockerfile(options) {
-	const { port, appPath, turboPackage } = options;
-	const { turbo } = layout(options);
+	const { port, appPath } = options;
 	return `# syntax=docker/dockerfile:1
 # Node SSR web Dockerfile (TanStack Start / Remix), from a turbo-pruned slice
 
@@ -1691,7 +1790,10 @@ ${prunerStage(options)}
 ${depsStage(options)}
 
 ${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-RUN ${turbo} run build --filter='${turboPackage}'
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
 
 FROM ${options.baseImage} AS runner
 WORKDIR /app
@@ -1725,8 +1827,7 @@ CMD ["sh", "-c", "cd ${appPath} && npm start"]
 * @internal Exported for testing
 */
 function generateViteStaticDockerfile(options) {
-	const { port, appPath, turboPackage } = options;
-	const { turbo } = layout(options);
+	const { port, appPath } = options;
 	return `# syntax=docker/dockerfile:1
 # Vite SPA Dockerfile — a turbo-pruned slice built to static files, served by Caddy
 
@@ -1735,7 +1836,10 @@ ${prunerStage(options)}
 ${depsStage(options)}
 
 ${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-RUN ${turbo} run build --filter='${turboPackage}'
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
 
 FROM ${STATIC_SITE_IMAGE} AS runner
 
@@ -1844,7 +1948,7 @@ function fromBuildRoot(layout, path) {
 	return joined === "" ? "." : joined;
 }
 /** Everything a template needs about one app, relative to the build root. */
-function appImageOptions(layout, appName, app, workspaceRoot) {
+function appImageOptions(layout, appName, app, workspaceRoot, apps = {}) {
 	const turboPackage = packageName((0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspaceRoot, app.path)) ?? appName;
 	return {
 		imageName: appName,
@@ -1860,10 +1964,49 @@ function appImageOptions(layout, appName, app, workspaceRoot) {
 		...app.type === "backend" ? {
 			gkmPaths: layout.gkmPaths,
 			...layout.workspacePackage && layout.workspacePackage !== turboPackage ? { prunePackages: [layout.workspacePackage] } : {}
-		} : {}
+		} : app.type === "web" ? siteWorkspace(layout, app, apps, workspaceRoot, turboPackage) : {}
 	};
 }
 /**
+* What a site's image carries of the gkm workspace: its config and construct
+* directories, the workspace's own package where it is nested in a monorepo
+* (it holds the CLI), and each backend the site calls — whose endpoints its
+* client is generated from, and whose package their imports resolve in.
+*/
+function siteWorkspace(layout, site, apps, workspaceRoot, turboPackage) {
+	const clients = siteClients(site, apps);
+	const packages = /* @__PURE__ */ new Set();
+	if (layout.workspacePackage) packages.add(layout.workspacePackage);
+	for (const { app } of clients) {
+		const backend = apps[app];
+		const name = packageName((0, node_path.isAbsolute)(backend.path) ? backend.path : (0, node_path.join)(workspaceRoot, backend.path));
+		if (name) packages.add(name);
+	}
+	packages.delete(turboPackage);
+	return {
+		gkmPaths: layout.gkmPaths,
+		...packages.size > 0 ? { prunePackages: [...packages].sort() } : {},
+		...clients.length > 0 ? { clients: clients.map(({ app }) => ({
+			app,
+			path: fromBuildRoot(layout, apps[app].path)
+		})) } : {}
+	};
+}
+/**
+* The backends whose clients a site imports: each it depends on that gkm
+* builds from endpoints — not one with an entry of its own, and not one that
+* turned OpenAPI off.
+*/
+function siteClients(site, apps) {
+	return site.dependencies.filter((name) => {
+		const app = apps[name];
+		if (!app || app.type !== "backend" || app.entry) return false;
+		if (app.openapi === false) return false;
+		if (typeof app.openapi === "object" && app.openapi.enabled === false) return false;
+		return true;
+	}).sort().map((app) => ({ app }));
+}
+/**
 * The directories the workspace's construct globs start in, relative to its
 * root: `./constructs/**\/*.ts` reads from `constructs`.
 */
@@ -5293,58 +5436,6 @@ logger.info({ port }, 'Worker started');
 `;
 }
 //#endregion
-//#region src/secrets/encryption.ts
-var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
-	encryptSecrets: () => encryptSecrets,
-	generateDefineOptions: () => generateDefineOptions,
-	keyFingerprint: () => keyFingerprint
-});
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const KEY_LENGTH = 32;
-const IV_LENGTH = 12;
-/**
-* Encrypt secrets for embedding in a bundle.
-* Uses AES-256-GCM with a randomly generated ephemeral key.
-*
-* @param secrets - Key-value pairs to encrypt
-* @returns Encrypted payload with ephemeral master key
-*/
-function encryptSecrets(secrets) {
-	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
-	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
-		iv: iv.toString("hex"),
-		masterKey: masterKey.toString("hex")
-	};
-}
-/**
-* Generate the define options for tsdown/esbuild.
-* These will be injected at build time.
-*/
-function generateDefineOptions(payload) {
-	return {
-		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
-		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
-	};
-}
-/**
-* A short, one-way name for a master key: the first 8 hex characters of its
-* SHA-256.
-*
-* Printed where the key itself used to be, so a person can tell which key a
-* build used — and match it against the one they hold — without the output
-* carrying a value that decrypts every secret of the stage.
-*/
-function keyFingerprint(masterKey) {
-	return (0, node_crypto.createHash)("sha256").update(masterKey).digest("hex").slice(0, 8);
-}
-//#endregion
 //#region src/build/workers.ts
 /** A worker with background work and no backend app to build it from. */
 var WorkerHasNoApp = class extends Error {
@@ -5832,7 +5923,7 @@ function validateImageRef(ref) {
 }
 //#endregion
 //#region src/docker/index.ts
-const logger$1 = require_discover.output;
+const logger = require_discover.output;
 /** `docker build` failed; what docker printed above says why. */
 var DockerBuildFailed = class extends Error {
 	imageRef;
@@ -5883,7 +5974,7 @@ async function buildDockerImage(app, buildRoot, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
 	const fullImageName = validateImageRef(registry ? `${registry}/${app.imageName}:${tag}` : `${app.imageName}:${tag}`);
-	logger$1.log(`\n🐳 Building Docker image: ${fullImageName}`);
+	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	try {
 		await require_run.run("docker", [
 			"build",
@@ -5897,7 +5988,7 @@ async function buildDockerImage(app, buildRoot, options) {
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger$1.log(`✅ Docker image built: ${fullImageName}`);
+		logger.log(`✅ Docker image built: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerBuildFailed(fullImageName, error);
 	}
@@ -5910,10 +6001,10 @@ async function pushDockerImage(imageName, options, cwd) {
 	const registry = options.registry;
 	if (!registry) throw new PushNeedsRegistry(imageName);
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
-	logger$1.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
 		await require_run.run("docker", ["push", fullImageName], { cwd });
-		logger$1.log(`✅ Docker image pushed: ${fullImageName}`);
+		logger.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
 	}
@@ -5925,26 +6016,27 @@ async function pushDockerImage(imageName, options, cwd) {
 async function workspaceDockerCommand(workspace, manifest, imageNames = {}, background = {}) {
 	const results = [];
 	const layout = imageLayout(workspace);
-	logger$1.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
-	logger$1.log(`   Build root: ${layout.buildRoot}`);
-	logger$1.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
+	logger.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
+	logger.log(`   Build root: ${layout.buildRoot}`);
+	logger.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
 	for (const [appName, app] of Object.entries(workspace.apps)) {
 		if (app.type === "mobile") {
-			logger$1.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
+			logger.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
 			continue;
 		}
 		const buildType = app.entry ? "entry" : app.type;
-		logger$1.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
+		logger.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
 		const dockerfile = appDockerfile(appName, app, {
 			layout,
 			workspaceRoot: workspace.root,
+			apps: workspace.apps,
 			...manifest ? { manifest } : {}
 		});
 		const path = dockerfileOf(appName, app.path);
 		const dockerfilePath = (0, node_path.join)(workspace.root, path);
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(dockerfilePath), { recursive: true });
 		await (0, node_fs_promises.writeFile)(dockerfilePath, dockerfile);
-		logger$1.log(`      Generated: ${path}`);
+		logger.log(`      Generated: ${path}`);
 		results.push({
 			appName,
 			type: app.type,
@@ -5953,7 +6045,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		});
 	}
 	for (const worker of manifest ? workerUnits(workspace, manifest, background) : []) {
-		logger$1.log(`\n   📄 Generating Dockerfile for ${worker.name} (worker ${worker.id}, built from ${worker.app})`);
+		logger.log(`\n   📄 Generating Dockerfile for ${worker.name} (worker ${worker.id}, built from ${worker.app})`);
 		const dockerfile = workerDockerfile(worker, workspace.apps[worker.app], {
 			layout,
 			workspaceRoot: workspace.root
@@ -5962,7 +6054,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		const dockerfilePath = (0, node_path.join)(workspace.root, path);
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(dockerfilePath), { recursive: true });
 		await (0, node_fs_promises.writeFile)(dockerfilePath, dockerfile);
-		logger$1.log(`      Generated: ${path}`);
+		logger.log(`      Generated: ${path}`);
 		results.push({
 			appName: worker.name,
 			type: "backend",
@@ -5971,13 +6063,13 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		});
 	}
 	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
-	logger$1.log(`\n   Ensured: ${dockerignorePath}`);
+	logger.log(`\n   Ensured: ${dockerignorePath}`);
 	const composePath = await writeConstructsCompose(workspace);
-	logger$1.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
-	logger$1.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
+	logger.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
+	logger.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
 	for (const result of results) {
 		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-		logger$1.log(`   ${icon} docker build -f ${(0, node_path.relative)(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
+		logger.log(`   ${icon} docker build -f ${(0, node_path.relative)(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
 	}
 	printRunInstructions(workspace);
 	return {
@@ -5993,7 +6085,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 * framework. The one choice every builder of images makes.
 */
 function appDockerfile(appName, app, options) {
-	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot);
+	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot, options.apps);
 	if (app.type === "web") return siteDockerfile(appName, app, {
 		image,
 		...options.manifest ? { manifest: options.manifest } : {},
@@ -6096,199 +6188,14 @@ async function writeConstructsCompose(workspace) {
 		stage: workspace.stages.local,
 		start: false
 	});
-	logger$1.log(`   Generated: ${COMPOSE_PATH} (project root)`);
+	logger.log(`   Generated: ${COMPOSE_PATH} (project root)`);
 	return (0, node_path.join)(workspace.root, COMPOSE_PATH);
 }
 function printRunInstructions(workspace) {
 	const project = (0, node_fs.existsSync)((0, node_path.join)(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
-	logger$1.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
-	logger$1.log("   gkm setup   # starts the containers and creates what they hold");
-	logger$1.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
-}
-//#endregion
-//#region src/deploy/docker.ts
-const logger = require_discover.output;
-/**
-* The id the Dockerfile templates mount the encrypted credentials under:
-* `RUN --mount=type=secret,id=gkm_credentials`.
-*/
-const CREDENTIALS_SECRET_ID = "gkm_credentials";
-/**
-* Get the full image reference
-*/
-function getImageRef(registry, imageName, tag) {
-	if (registry) return `${registry}/${imageName}:${tag}`;
-	return `${imageName}:${tag}`;
-}
-/**
-* The `docker build` argv for an image.
-*
-* One element per value, so nothing in a ref or a build arg is read by a
-* shell, and `--opt=value` rather than `--opt value`, so a value that starts
-* with `-` cannot be taken for one of docker's own flags.
-*
-* @internal Exported for testing
-*/
-function dockerBuildArgs(options) {
-	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
-	return [
-		"build",
-		"--platform=linux/amd64",
-		`--file=${dockerfilePath}`,
-		`--tag=${imageRef}`,
-		...buildArgs.map((arg) => `--build-arg=${arg}`),
-		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
-		"."
-	];
-}
-/**
-* The build arg that names which credentials an image embeds: a hash of the
-* ciphertext, which is not a secret. A BuildKit secret is no part of the
-* build cache's key, so without it a rebuild with credentials encrypted under
-* a new key would reuse the layer that embedded the old ones.
-*/
-function credentialsBuildArg(credentials) {
-	return `GKM_CIPHERTEXT_HASH=${(0, node_crypto.createHash)("sha256").update(`${credentials.encrypted}\n${credentials.iv}`).digest("hex").slice(0, 16)}`;
-}
-/** The secret file's content: ciphertext, then IV, one per line. */
-function credentialsFileContent(credentials) {
-	return `${credentials.encrypted}\n${credentials.iv}\n`;
-}
-/**
-* Write the encrypted credentials where `docker build --secret` reads them.
-*
-* Two lines — ciphertext, then IV — so a template can split them with `sed`
-* in any base image. Owner-only, in a directory of its own, and the returned
-* cleanup removes both whatever the build did.
-*
-* @internal Exported for testing
-*/
-async function writeCredentialsFile(credentials) {
-	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-credentials-"));
-	const path = (0, node_path.join)(dir, CREDENTIALS_SECRET_ID);
-	await (0, node_fs_promises.writeFile)(path, credentialsFileContent(credentials), { mode: 384 });
-	await (0, node_fs_promises.chmod)(path, 384);
-	return {
-		path,
-		cleanup: () => (0, node_fs_promises.rm)(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-}
-/**
-* Build Docker image
-* @param imageRef - Full image reference (registry/name:tag)
-* @param buildArgs - Build arguments to pass to docker build
-* @param credentials - Encrypted credentials, passed as a build secret
-*/
-async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
-	logger.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger.log("   Generating Dockerfile...");
-	const { buildRoot } = await dockerCommand({ cwd });
-	const dockerfilePath = (0, node_path.relative)(buildRoot, dockerfile);
-	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
-	try {
-		await require_run.run("docker", dockerBuildArgs({
-			dockerfilePath,
-			imageRef,
-			buildArgs: [...buildArgs ?? [], ...credentials ? [credentialsBuildArg(credentials)] : []],
-			credentialsFile: secret?.path
-		}), {
-			cwd: buildRoot,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			},
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger.log(`✅ Image built: ${imageRef}`);
-	} catch (error) {
-		throw new DockerBuildFailed(imageRef, error);
-	} finally {
-		await secret?.cleanup();
-	}
-}
-/**
-* Push Docker image to registry
-*/
-async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger.log(`\n☁️  Pushing image: ${imageRef}`);
-	try {
-		await require_run.run("docker", ["push", imageRef], {
-			cwd,
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger.log(`✅ Image pushed: ${imageRef}`);
-	} catch (error) {
-		throw new DockerPushFailed(imageRef, error);
-	}
-}
-/**
-* The digest the registry gave a pushed image, `sha256:…`.
-*
-* A tag can be pushed over — by the next deploy, or by anything else that
-* shares the repository — and the digest is what says which image a stage
-* actually ran. `RepoDigests` has one entry per repository the image was
-* pushed to, so the one for this ref's repository is picked by name.
-*
-* @internal Exported for testing
-*/
-async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
-	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await require_run.runOutput("docker", [
-		"image",
-		"inspect",
-		"--format={{json .RepoDigests}}",
-		imageRef
-	], {
-		cwd,
-		...signal ? { signal } : {}
-	});
-	let digests;
-	try {
-		digests = JSON.parse(output.trim() || "[]");
-	} catch {
-		return;
-	}
-	if (!Array.isArray(digests)) return void 0;
-	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
-}
-/**
-* Deploy using Docker (build and optionally push image)
-*/
-async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
-	const imageName = config.imageName;
-	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
-	const cwd = options.cwd ?? process.cwd();
-	const docker = {
-		cwd,
-		dockerfile: (0, node_path.join)(cwd, options.dockerfile ?? dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
-		...options.signal ? { signal: options.signal } : {},
-		...options.stdio ? { stdio: options.stdio } : {}
-	};
-	await buildImage(imageRef, buildArgs, credentials, docker);
-	let digest;
-	if (!skipPush) {
-		if (!config.registry) logger.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else {
-			await pushImage(imageRef, docker);
-			digest = await pushedDigest(imageRef, docker);
-		}
-	}
-	logger.log("\n✅ Docker deployment ready!");
-	logger.log(`\n📋 Deployment details:`);
-	logger.log(`   Image: ${imageRef}`);
-	logger.log(`   Stage: ${stage}`);
-	if (masterKey) logger.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
-	return {
-		imageRef,
-		...digest ? { digest } : {},
-		masterKey
-	};
+	logger.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
+	logger.log("   gkm setup   # starts the containers and creates what they hold");
+	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
 }
 //#endregion
 //#region src/deploy/generated.ts
@@ -6628,6 +6535,18 @@ Object.defineProperty(exports, "DevServicesNeedServerTarget", {
 		return DevServicesNeedServerTarget;
 	}
 });
+Object.defineProperty(exports, "DockerBuildFailed", {
+	enumerable: true,
+	get: function() {
+		return DockerBuildFailed;
+	}
+});
+Object.defineProperty(exports, "DockerPushFailed", {
+	enumerable: true,
+	get: function() {
+		return DockerPushFailed;
+	}
+});
 Object.defineProperty(exports, "ExternalServicesNotConfigured", {
 	enumerable: true,
 	get: function() {
@@ -6796,24 +6715,6 @@ Object.defineProperty(exports, "createEntryWrapper", {
 		return createEntryWrapper;
 	}
 });
-Object.defineProperty(exports, "credentialsBuildArg", {
-	enumerable: true,
-	get: function() {
-		return credentialsBuildArg;
-	}
-});
-Object.defineProperty(exports, "credentialsFileContent", {
-	enumerable: true,
-	get: function() {
-		return credentialsFileContent;
-	}
-});
-Object.defineProperty(exports, "deployDocker", {
-	enumerable: true,
-	get: function() {
-		return deployDocker;
-	}
-});
 Object.defineProperty(exports, "deployIdentity", {
 	enumerable: true,
 	get: function() {
@@ -6850,16 +6751,10 @@ Object.defineProperty(exports, "dockerCommand", {
 		return dockerCommand;
 	}
 });
-Object.defineProperty(exports, "encryptSecrets", {
-	enumerable: true,
-	get: function() {
-		return encryptSecrets;
-	}
-});
-Object.defineProperty(exports, "encryption_exports", {
+Object.defineProperty(exports, "dockerfileOf", {
 	enumerable: true,
 	get: function() {
-		return encryption_exports;
+		return dockerfileOf;
 	}
 });
 Object.defineProperty(exports, "ensureDockerignore", {
@@ -6934,6 +6829,12 @@ Object.defineProperty(exports, "hostFor", {
 		return hostFor;
 	}
 });
+Object.defineProperty(exports, "imageBuildCredentials", {
+	enumerable: true,
+	get: function() {
+		return imageBuildCredentials;
+	}
+});
 Object.defineProperty(exports, "imageLayout", {
 	enumerable: true,
 	get: function() {
@@ -6964,6 +6865,12 @@ Object.defineProperty(exports, "isDnsVerified", {
 		return isDnsVerified;
 	}
 });
+Object.defineProperty(exports, "isImageBuild", {
+	enumerable: true,
+	get: function() {
+		return isImageBuild;
+	}
+});
 Object.defineProperty(exports, "isMainFrontendApp", {
 	enumerable: true,
 	get: function() {
@@ -6994,12 +6901,6 @@ Object.defineProperty(exports, "isRemoteStore", {
 		return isRemoteStore;
 	}
 });
-Object.defineProperty(exports, "keyFingerprint", {
-	enumerable: true,
-	get: function() {
-		return keyFingerprint;
-	}
-});
 Object.defineProperty(exports, "keystoreProject", {
 	enumerable: true,
 	get: function() {
@@ -7234,6 +7135,12 @@ Object.defineProperty(exports, "storage_exports", {
 		return storage_exports;
 	}
 });
+Object.defineProperty(exports, "storeFromConfig", {
+	enumerable: true,
+	get: function() {
+		return storeFromConfig;
+	}
+});
 Object.defineProperty(exports, "store_exports", {
 	enumerable: true,
 	get: function() {
@@ -7313,4 +7220,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=state-DCwRWyh-.cjs.map
+//# sourceMappingURL=state-C2qi0iQw.cjs.map