@geekmidas/cli 10.0.0-alpha.74 → 10.0.0-alpha.76

package/dist/{state-DpkxSwzI.mjs → state-CUecOCNJ.mjs}

@@ -1,16 +1,16 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { a as runOutput, i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
+import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-C7NqCsQF.mjs";
+import { F as UnknownSecretsStoreProvider, O as TEST_STAGE, h as getPublicEnvPrefix, m as PUBLIC_ENV_PREFIXES, n as allConstructGlobs } from "./workspace-QUTqYmVy.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { n as runtimeFor, r as generateTelemetryModule } from "./EndpointGenerator-DftalLYg.mjs";
-import { c as runtimeOf } from "./resolve-DSAXj_47.mjs";
+import { c as runtimeOf } from "./resolve-C1muFos5.mjs";
 import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-5looQ3gB.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
-import { appendFile, chmod, copyFile, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { homedir, networkInterfaces, tmpdir } from "node:os";
+import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { homedir, networkInterfaces } from "node:os";
 import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Queue } from "@geekmidas/constructs/queue";
@@ -274,7 +274,7 @@ function applicationName(identity, app) {
 * old file stays, so an older CLI on the same machine keeps working.
 */
 /** Key length for AES-256 encryption */
-const KEY_LENGTH$1 = 32;
+const KEY_LENGTH = 32;
 /** A keystore project key that is not `<namespace>/<project>`. */
 var KeystoreProjectInvalid = class extends Error {
 	key;
@@ -367,7 +367,7 @@ async function generateKey(stage, project, flag = "w") {
 		recursive: true,
 		mode: 448
 	});
-	const key = randomBytes(KEY_LENGTH$1).toString("hex");
+	const key = randomBytes(KEY_LENGTH).toString("hex");
 	await writeFile(keyPath, key, {
 		mode: 384,
 		encoding: "utf-8",
@@ -436,8 +436,8 @@ async function getOrCreateKey(stage, project) {
 /** Where the files live, relative to the project root. */
 const SECRETS_DIR = ".gkm/secrets";
 /** AES-256-GCM configuration */
-const ALGORITHM$1 = "aes-256-gcm";
-const IV_LENGTH$1 = 12;
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
 /**
 * A stage's secrets as an encrypted file on this machine:
 * `.gkm/secrets/<stage>.json`, with its key in the CLI's home at
@@ -505,8 +505,8 @@ function packageName$1(root) {
 }
 function encrypt(secrets, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
-	const iv = randomBytes(IV_LENGTH$1);
-	const cipher = createCipheriv(ALGORITHM$1, key, iv);
+	const iv = randomBytes(IV_LENGTH);
+	const cipher = createCipheriv(ALGORITHM, key, iv);
 	const ciphertext = Buffer.concat([cipher.update(JSON.stringify(secrets), "utf-8"), cipher.final()]);
 	return {
 		version: 1,
@@ -517,7 +517,7 @@ function encrypt(secrets, keyHex) {
 function decrypt(data, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
 	const combined = Buffer.from(data.encrypted, "base64");
-	const decipher = createDecipheriv(ALGORITHM$1, key, Buffer.from(data.iv, "hex"));
+	const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(data.iv, "hex"));
 	decipher.setAuthTag(combined.subarray(-16));
 	const plaintext = Buffer.concat([decipher.update(combined.subarray(0, -16)), decipher.final()]);
 	return JSON.parse(plaintext.toString("utf-8"));
@@ -527,7 +527,8 @@ function decrypt(data, keyHex) {
 var store_exports = /* @__PURE__ */ __exportAll({
 	FileSecretsStore: () => FileSecretsStore,
 	isRemoteStore: () => isRemoteStore,
-	secretsStoreFor: () => secretsStoreFor
+	secretsStoreFor: () => secretsStoreFor,
+	storeFromConfig: () => storeFromConfig
 });
 /**
 * The store a stage's secrets are kept in — what every command reads and
@@ -539,13 +540,41 @@ var store_exports = /* @__PURE__ */ __exportAll({
 async function secretsStoreFor(workspace, stage, options = {}) {
 	const configured = workspace.secrets.store ?? "file";
 	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
-	if (configured.provider !== "ssm") return configured.provider;
-	const { AwsSecretsStore } = await import("./aws-DojzQnLd.mjs");
-	return new AwsSecretsStore({
-		project: workspace.name,
-		region: configured.region,
-		...options.profile ? { profile: options.profile } : {}
-	});
+	return storeFromConfig(workspace, configured, options);
+}
+/**
+* The store a `secrets.store` value describes, for any stage — what
+* {@link secretsStoreFor} answers for a deployed stage, and what
+* `gkm secrets:migrate` builds for the store it copies to.
+*/
+async function storeFromConfig(workspace, config, options = {}) {
+	if (config === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
+	const profile = options.profile ? { profile: options.profile } : {};
+	switch (config.provider) {
+		case "ssm": {
+			const { AwsSecretsStore } = await import("./aws-Bja4zGSs.mjs");
+			return new AwsSecretsStore({
+				project: workspace.name,
+				region: config.region,
+				...profile
+			});
+		}
+		case "secrets-manager": {
+			const { kmsKeyId } = config;
+			const { SecretsManagerSecretsStore } = await import("./secretsManager-Ti0oZwsS.mjs");
+			return new SecretsManagerSecretsStore({
+				project: workspace.name,
+				region: config.region,
+				...kmsKeyId ? { kmsKeyId } : {},
+				...profile
+			});
+		}
+		default: {
+			const provider = config.provider;
+			if (typeof provider === "object" && provider !== null) return provider;
+			throw new UnknownSecretsStoreProvider(provider);
+		}
+	}
 }
 /** Whether a stage's secrets live somewhere other than this machine. */
 function isRemoteStore(workspace, stage) {
@@ -554,7 +583,7 @@ function isRemoteStore(workspace, stage) {
 }
 //#endregion
 //#region src/credentials/index.ts
-const logger$2 = console;
+const logger$1 = console;
 /**
 * Load environment files
 * @internal Exported for testing
@@ -605,7 +634,7 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	for (let i = 0; i < maxAttempts; i++) {
 		const port = preferredPort + i;
 		if (await isPortAvailable(port)) return port;
-		logger$2.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+		logger$1.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
@@ -640,7 +669,7 @@ async function loadSecretsForApp(store, stage, appName) {
 	let secrets = {};
 	const stageSecrets = await store.read(stage);
 	if (stageSecrets) {
-		logger$2.log(`🔐 Loading secrets from stage: ${stage}`);
+		logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
 		secrets = toEmbeddableSecrets(stageSecrets);
 	}
 	if (Object.keys(secrets).length === 0) return {};
@@ -746,7 +775,7 @@ async function prepareEntryCredentials(options) {
 			free: isPortAvailable,
 			holder: holderOf
 		});
-		for (const { app, from, to, holder } of assigned.moved) logger$2.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+		for (const { app, from, to, holder } of assigned.moved) logger$1.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
 		workspace = withAppPorts(workspace, assigned.ports);
 		workspaceAppPort = assigned.ports[appName] ?? workspaceAppPort;
 	}
@@ -770,7 +799,7 @@ async function prepareEntryCredentials(options) {
 		});
 		Object.assign(credentials, reconciled.env);
 		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger$2.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+		if (Object.keys(reconciled.env).length > 0) logger$1.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
 	}
 	const secretsDir = join(secretsRoot, ".gkm");
 	await mkdir(secretsDir, { recursive: true });
@@ -1022,6 +1051,36 @@ function eventsBackendFor(on) {
 	return DEFAULT_EVENTS$1[on];
 }
 //#endregion
+//#region src/exec/imageBuild.ts
+/**
+* Set by a site's Dockerfile in its builder stage: this process is building
+* an image.
+*
+* Inside an image there is no stage to load secrets for and no local
+* container to resolve an address from — the public URLs the bundle inlines
+* arrived as the Dockerfile's build args, already in the environment. So
+* `gkm exec -- next build` there injects exactly those, and never the
+* `localhost` addresses a workspace resolves on a developer's machine.
+*/
+const IMAGE_BUILD_ENV = "GKM_IMAGE_BUILD";
+/** Whether this process is building an image. */
+function isImageBuild(env = process.env) {
+	return env[IMAGE_BUILD_ENV] === "1";
+}
+/**
+* What `gkm exec` injects inside an image build: the public values its build
+* args set — every `NEXT_PUBLIC_*`, `VITE_*` and `EXPO_PUBLIC_*` — and
+* nothing read from a secrets store, a file or a container.
+*/
+function imageBuildCredentials(env = process.env) {
+	const credentials = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (value === void 0) continue;
+		if (PUBLIC_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) credentials[key] = value;
+	}
+	return credentials;
+}
+//#endregion
 //#region src/docker/templates.ts
 /**
 * The turbo every image prunes and builds with when the build root resolves
@@ -1279,23 +1338,22 @@ RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
 *
 * Nothing built on the host reaches the image — `.dockerignore` keeps every
 * `dist` out — so a workspace package (a CLI that is a sibling package) is
-* built here: the root's `build` script if it has one, then turbo's build of
-* the app's dependencies (`^build`).
+* built here: turbo's build of the app's dependencies (`^build`) and nothing
+* else. The root's own `build` script is never run: the slice holds one app,
+* and a root `build` that is `gkm build` (what `gkm init` scaffolds) builds
+* every app the workspace declares, most of which are not in it. The app
+* itself is built after this, by `gkm build` or its framework.
 */
 function builderStage(options, extra = {}) {
-	const { pm, turbo, monorepo } = layout(options);
+	const { turbo, monorepo } = layout(options);
 	const args = extra.args ?? [];
 	const argLines = args.length ? `\n# Build-time args: public values the bundler inlines\n${args.map((a) => `ARG ${a}=""`).join("\n")}\n${args.map((a) => `ENV ${a}=$${a}`).join("\n")}\n` : "";
 	const scopes = [options.turboPackage, ...options.prunePackages ?? []];
-	const dependencies = monorepo ? `\nRUN ${turbo} run build ${scopes.map((s) => `--filter='${s}^...'`).join(" ")}` : "";
 	return `# Stage 3: Build
 FROM deps AS builder
 WORKDIR /app
 ${argLines}
-COPY --from=pruner /app/out/full/ ./
-
-# The workspace packages the app depends on, built from source.
-RUN ${pm.run} --if-present build${dependencies}`;
+COPY --from=pruner /app/out/full/ ./${monorepo ? `\n# The workspace packages the app depends on, built from source.\nRUN ${turbo} run build ${scopes.map((s) => `--filter='${s}^...'`).join(" ")}` : ""}`;
 }
 /**
 * The PATH a command in the app's directory runs with: the app's binaries,
@@ -1320,7 +1378,48 @@ function binPath(options) {
 * were installed.
 */
 function gkmCommand(args) {
-	return `GKM_BIN="$(node -e 'let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}')" && node "$GKM_BIN" ${args}`;
+	return `GKM_BIN="$(node -e '${FIND_GKM_BIN}')" && node "$GKM_BIN" ${args}`;
+}
+/** Prints the `bin/gkm.mjs` Node resolves from the cwd, or fails saying so. */
+const FIND_GKM_BIN = `let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}`;
+/**
+* What a site's builder does with the gkm workspace it carries, before its
+* framework builds it — all of it inside the image, nothing from the host:
+*
+* - `gkm` on the PATH: the CLI the workspace installs, so a build script that
+*   is `gkm exec -- next build` runs. Resolved from the gkm root rather than
+*   through `node_modules/.bin`, where a CLI that is a workspace package has
+*   no bin linked.
+* - `GKM_IMAGE_BUILD`, which has `gkm exec` inject the build args above — the
+*   stage's public URLs — and never load a secret or resolve a local address.
+* - each backend's typed client, generated from its endpoints at the
+*   workspace root's `.gkm/client/`, where the site's tsconfig paths point.
+*/
+function siteWorkspaceSteps(options) {
+	const { gkmRoot } = layout(options);
+	const root = `/app/${gkmRoot}`.replace(/\/\.$/, "");
+	const clients = options.clients ?? [];
+	const generate = clients.length ? `
+
+# The typed client of each API this site calls, generated from its endpoints
+# into ${gkmRoot === "." ? "" : `${gkmRoot}/`}.gkm/client/ — offline, with no secret and no container.
+RUN ${clients.map(({ app, path }) => `cd /app/${path} && gkm openapi --app ${app}`).join(" && \\\n    ")}` : "";
+	return `# The gkm CLI the workspace installs, as \`gkm\`
+RUN cd ${root} && GKM_BIN="$(node -e '${FIND_GKM_BIN}')" && \\
+    { echo '#!/bin/sh'; echo "exec node \\"$GKM_BIN\\" \\"\\$@\\""; } > /usr/local/bin/gkm && \\
+    chmod +x /usr/local/bin/gkm
+
+# \`gkm exec\` in this build injects the build args, never a stage's secrets
+ENV ${IMAGE_BUILD_ENV}=1${generate}`;
+}
+/**
+* Build the site with turbo. Loose env mode, so the task sees what the
+* Dockerfile set — the build args and `GKM_IMAGE_BUILD` — whatever the
+* project's turbo.json declares: the image's environment holds nothing else.
+*/
+function siteBuild(options) {
+	const { turbo } = layout(options);
+	return `RUN ${turbo} run build --filter='${options.turboPackage}' --env-mode=loose`;
 }
 /**
 * The encrypted credentials, from a build secret — never an ARG, which is
@@ -1474,8 +1573,7 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
 * @internal Exported for testing
 */
 function generateNextjsDockerfile(options) {
-	const { port, appPath, turboPackage, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
-	const { turbo } = layout(options);
+	const { port, appPath, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
 	return `# syntax=docker/dockerfile:1
 # Next.js standalone Dockerfile, built from a turbo-pruned slice
 
@@ -1485,13 +1583,15 @@ ${depsStage(options)}
 
 ${builderStage(options, { args: publicUrlArgs })}
 
+${siteWorkspaceSteps(options)}
+
 # Ensure public directory exists (may be empty for scaffolded projects)
 RUN mkdir -p ${appPath}/public
 
 ENV NEXT_TELEMETRY_DISABLED=1
 
 # Build the application
-RUN ${turbo} run build --filter='${turboPackage}'
+${siteBuild(options)}
 
 # The runner needs the standalone server; without it there is nothing to run.
 RUN if [ ! -d ${appPath}/.next/standalone ]; then \\
@@ -1679,8 +1779,7 @@ CMD ["node", "index.mjs"]
 * @internal Exported for testing
 */
 function generateNodeWebDockerfile(options) {
-	const { port, appPath, turboPackage } = options;
-	const { turbo } = layout(options);
+	const { port, appPath } = options;
 	return `# syntax=docker/dockerfile:1
 # Node SSR web Dockerfile (TanStack Start / Remix), from a turbo-pruned slice
 
@@ -1689,7 +1788,10 @@ ${prunerStage(options)}
 ${depsStage(options)}
 
 ${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-RUN ${turbo} run build --filter='${turboPackage}'
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
 
 FROM ${options.baseImage} AS runner
 WORKDIR /app
@@ -1723,8 +1825,7 @@ CMD ["sh", "-c", "cd ${appPath} && npm start"]
 * @internal Exported for testing
 */
 function generateViteStaticDockerfile(options) {
-	const { port, appPath, turboPackage } = options;
-	const { turbo } = layout(options);
+	const { port, appPath } = options;
 	return `# syntax=docker/dockerfile:1
 # Vite SPA Dockerfile — a turbo-pruned slice built to static files, served by Caddy
 
@@ -1733,7 +1834,10 @@ ${prunerStage(options)}
 ${depsStage(options)}
 
 ${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-RUN ${turbo} run build --filter='${turboPackage}'
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
 
 FROM ${STATIC_SITE_IMAGE} AS runner
 
@@ -1842,7 +1946,7 @@ function fromBuildRoot(layout, path) {
 	return joined === "" ? "." : joined;
 }
 /** Everything a template needs about one app, relative to the build root. */
-function appImageOptions(layout, appName, app, workspaceRoot) {
+function appImageOptions(layout, appName, app, workspaceRoot, apps = {}) {
 	const turboPackage = packageName(isAbsolute(app.path) ? app.path : join(workspaceRoot, app.path)) ?? appName;
 	return {
 		imageName: appName,
@@ -1858,10 +1962,49 @@ function appImageOptions(layout, appName, app, workspaceRoot) {
 		...app.type === "backend" ? {
 			gkmPaths: layout.gkmPaths,
 			...layout.workspacePackage && layout.workspacePackage !== turboPackage ? { prunePackages: [layout.workspacePackage] } : {}
-		} : {}
+		} : app.type === "web" ? siteWorkspace(layout, app, apps, workspaceRoot, turboPackage) : {}
 	};
 }
 /**
+* What a site's image carries of the gkm workspace: its config and construct
+* directories, the workspace's own package where it is nested in a monorepo
+* (it holds the CLI), and each backend the site calls — whose endpoints its
+* client is generated from, and whose package their imports resolve in.
+*/
+function siteWorkspace(layout, site, apps, workspaceRoot, turboPackage) {
+	const clients = siteClients(site, apps);
+	const packages = /* @__PURE__ */ new Set();
+	if (layout.workspacePackage) packages.add(layout.workspacePackage);
+	for (const { app } of clients) {
+		const backend = apps[app];
+		const name = packageName(isAbsolute(backend.path) ? backend.path : join(workspaceRoot, backend.path));
+		if (name) packages.add(name);
+	}
+	packages.delete(turboPackage);
+	return {
+		gkmPaths: layout.gkmPaths,
+		...packages.size > 0 ? { prunePackages: [...packages].sort() } : {},
+		...clients.length > 0 ? { clients: clients.map(({ app }) => ({
+			app,
+			path: fromBuildRoot(layout, apps[app].path)
+		})) } : {}
+	};
+}
+/**
+* The backends whose clients a site imports: each it depends on that gkm
+* builds from endpoints — not one with an entry of its own, and not one that
+* turned OpenAPI off.
+*/
+function siteClients(site, apps) {
+	return site.dependencies.filter((name) => {
+		const app = apps[name];
+		if (!app || app.type !== "backend" || app.entry) return false;
+		if (app.openapi === false) return false;
+		if (typeof app.openapi === "object" && app.openapi.enabled === false) return false;
+		return true;
+	}).sort().map((app) => ({ app }));
+}
+/**
 * The directories the workspace's construct globs start in, relative to its
 * root: `./constructs/**\/*.ts` reads from `constructs`.
 */
@@ -5291,58 +5434,6 @@ logger.info({ port }, 'Worker started');
 `;
 }
 //#endregion
-//#region src/secrets/encryption.ts
-var encryption_exports = /* @__PURE__ */ __exportAll({
-	encryptSecrets: () => encryptSecrets,
-	generateDefineOptions: () => generateDefineOptions,
-	keyFingerprint: () => keyFingerprint
-});
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const KEY_LENGTH = 32;
-const IV_LENGTH = 12;
-/**
-* Encrypt secrets for embedding in a bundle.
-* Uses AES-256-GCM with a randomly generated ephemeral key.
-*
-* @param secrets - Key-value pairs to encrypt
-* @returns Encrypted payload with ephemeral master key
-*/
-function encryptSecrets(secrets) {
-	const masterKey = randomBytes(KEY_LENGTH);
-	const iv = randomBytes(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = createCipheriv(ALGORITHM, masterKey, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
-		iv: iv.toString("hex"),
-		masterKey: masterKey.toString("hex")
-	};
-}
-/**
-* Generate the define options for tsdown/esbuild.
-* These will be injected at build time.
-*/
-function generateDefineOptions(payload) {
-	return {
-		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
-		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
-	};
-}
-/**
-* A short, one-way name for a master key: the first 8 hex characters of its
-* SHA-256.
-*
-* Printed where the key itself used to be, so a person can tell which key a
-* build used — and match it against the one they hold — without the output
-* carrying a value that decrypts every secret of the stage.
-*/
-function keyFingerprint(masterKey) {
-	return createHash("sha256").update(masterKey).digest("hex").slice(0, 8);
-}
-//#endregion
 //#region src/build/workers.ts
 /** A worker with background work and no backend app to build it from. */
 var WorkerHasNoApp = class extends Error {
@@ -5830,7 +5921,7 @@ function validateImageRef(ref) {
 }
 //#endregion
 //#region src/docker/index.ts
-const logger$1 = output;
+const logger = output;
 /** `docker build` failed; what docker printed above says why. */
 var DockerBuildFailed = class extends Error {
 	imageRef;
@@ -5881,7 +5972,7 @@ async function buildDockerImage(app, buildRoot, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
 	const fullImageName = validateImageRef(registry ? `${registry}/${app.imageName}:${tag}` : `${app.imageName}:${tag}`);
-	logger$1.log(`\n🐳 Building Docker image: ${fullImageName}`);
+	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	try {
 		await run$1("docker", [
 			"build",
@@ -5895,7 +5986,7 @@ async function buildDockerImage(app, buildRoot, options) {
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger$1.log(`✅ Docker image built: ${fullImageName}`);
+		logger.log(`✅ Docker image built: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerBuildFailed(fullImageName, error);
 	}
@@ -5908,10 +5999,10 @@ async function pushDockerImage(imageName, options, cwd) {
 	const registry = options.registry;
 	if (!registry) throw new PushNeedsRegistry(imageName);
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
-	logger$1.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
 		await run$1("docker", ["push", fullImageName], { cwd });
-		logger$1.log(`✅ Docker image pushed: ${fullImageName}`);
+		logger.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
 	}
@@ -5923,26 +6014,27 @@ async function pushDockerImage(imageName, options, cwd) {
 async function workspaceDockerCommand(workspace, manifest, imageNames = {}, background = {}) {
 	const results = [];
 	const layout = imageLayout(workspace);
-	logger$1.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
-	logger$1.log(`   Build root: ${layout.buildRoot}`);
-	logger$1.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
+	logger.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
+	logger.log(`   Build root: ${layout.buildRoot}`);
+	logger.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
 	for (const [appName, app] of Object.entries(workspace.apps)) {
 		if (app.type === "mobile") {
-			logger$1.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
+			logger.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
 			continue;
 		}
 		const buildType = app.entry ? "entry" : app.type;
-		logger$1.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
+		logger.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
 		const dockerfile = appDockerfile(appName, app, {
 			layout,
 			workspaceRoot: workspace.root,
+			apps: workspace.apps,
 			...manifest ? { manifest } : {}
 		});
 		const path = dockerfileOf(appName, app.path);
 		const dockerfilePath = join(workspace.root, path);
 		await mkdir(dirname(dockerfilePath), { recursive: true });
 		await writeFile(dockerfilePath, dockerfile);
-		logger$1.log(`      Generated: ${path}`);
+		logger.log(`      Generated: ${path}`);
 		results.push({
 			appName,
 			type: app.type,
@@ -5951,7 +6043,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		});
 	}
 	for (const worker of manifest ? workerUnits(workspace, manifest, background) : []) {
-		logger$1.log(`\n   📄 Generating Dockerfile for ${worker.name} (worker ${worker.id}, built from ${worker.app})`);
+		logger.log(`\n   📄 Generating Dockerfile for ${worker.name} (worker ${worker.id}, built from ${worker.app})`);
 		const dockerfile = workerDockerfile(worker, workspace.apps[worker.app], {
 			layout,
 			workspaceRoot: workspace.root
@@ -5960,7 +6052,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		const dockerfilePath = join(workspace.root, path);
 		await mkdir(dirname(dockerfilePath), { recursive: true });
 		await writeFile(dockerfilePath, dockerfile);
-		logger$1.log(`      Generated: ${path}`);
+		logger.log(`      Generated: ${path}`);
 		results.push({
 			appName: worker.name,
 			type: "backend",
@@ -5969,13 +6061,13 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		});
 	}
 	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
-	logger$1.log(`\n   Ensured: ${dockerignorePath}`);
+	logger.log(`\n   Ensured: ${dockerignorePath}`);
 	const composePath = await writeConstructsCompose(workspace);
-	logger$1.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
-	logger$1.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
+	logger.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
+	logger.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
 	for (const result of results) {
 		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-		logger$1.log(`   ${icon} docker build -f ${relative(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
+		logger.log(`   ${icon} docker build -f ${relative(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
 	}
 	printRunInstructions(workspace);
 	return {
@@ -5991,7 +6083,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 * framework. The one choice every builder of images makes.
 */
 function appDockerfile(appName, app, options) {
-	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot);
+	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot, options.apps);
 	if (app.type === "web") return siteDockerfile(appName, app, {
 		image,
 		...options.manifest ? { manifest: options.manifest } : {},
@@ -6094,199 +6186,14 @@ async function writeConstructsCompose(workspace) {
 		stage: workspace.stages.local,
 		start: false
 	});
-	logger$1.log(`   Generated: ${COMPOSE_PATH} (project root)`);
+	logger.log(`   Generated: ${COMPOSE_PATH} (project root)`);
 	return join(workspace.root, COMPOSE_PATH);
 }
 function printRunInstructions(workspace) {
 	const project = existsSync(join(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
-	logger$1.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
-	logger$1.log("   gkm setup   # starts the containers and creates what they hold");
-	logger$1.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
-}
-//#endregion
-//#region src/deploy/docker.ts
-const logger = output;
-/**
-* The id the Dockerfile templates mount the encrypted credentials under:
-* `RUN --mount=type=secret,id=gkm_credentials`.
-*/
-const CREDENTIALS_SECRET_ID = "gkm_credentials";
-/**
-* Get the full image reference
-*/
-function getImageRef(registry, imageName, tag) {
-	if (registry) return `${registry}/${imageName}:${tag}`;
-	return `${imageName}:${tag}`;
-}
-/**
-* The `docker build` argv for an image.
-*
-* One element per value, so nothing in a ref or a build arg is read by a
-* shell, and `--opt=value` rather than `--opt value`, so a value that starts
-* with `-` cannot be taken for one of docker's own flags.
-*
-* @internal Exported for testing
-*/
-function dockerBuildArgs(options) {
-	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
-	return [
-		"build",
-		"--platform=linux/amd64",
-		`--file=${dockerfilePath}`,
-		`--tag=${imageRef}`,
-		...buildArgs.map((arg) => `--build-arg=${arg}`),
-		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
-		"."
-	];
-}
-/**
-* The build arg that names which credentials an image embeds: a hash of the
-* ciphertext, which is not a secret. A BuildKit secret is no part of the
-* build cache's key, so without it a rebuild with credentials encrypted under
-* a new key would reuse the layer that embedded the old ones.
-*/
-function credentialsBuildArg(credentials) {
-	return `GKM_CIPHERTEXT_HASH=${createHash("sha256").update(`${credentials.encrypted}\n${credentials.iv}`).digest("hex").slice(0, 16)}`;
-}
-/** The secret file's content: ciphertext, then IV, one per line. */
-function credentialsFileContent(credentials) {
-	return `${credentials.encrypted}\n${credentials.iv}\n`;
-}
-/**
-* Write the encrypted credentials where `docker build --secret` reads them.
-*
-* Two lines — ciphertext, then IV — so a template can split them with `sed`
-* in any base image. Owner-only, in a directory of its own, and the returned
-* cleanup removes both whatever the build did.
-*
-* @internal Exported for testing
-*/
-async function writeCredentialsFile(credentials) {
-	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
-	const path = join(dir, CREDENTIALS_SECRET_ID);
-	await writeFile(path, credentialsFileContent(credentials), { mode: 384 });
-	await chmod(path, 384);
-	return {
-		path,
-		cleanup: () => rm(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-}
-/**
-* Build Docker image
-* @param imageRef - Full image reference (registry/name:tag)
-* @param buildArgs - Build arguments to pass to docker build
-* @param credentials - Encrypted credentials, passed as a build secret
-*/
-async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
-	logger.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger.log("   Generating Dockerfile...");
-	const { buildRoot } = await dockerCommand({ cwd });
-	const dockerfilePath = relative(buildRoot, dockerfile);
-	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
-	try {
-		await run$1("docker", dockerBuildArgs({
-			dockerfilePath,
-			imageRef,
-			buildArgs: [...buildArgs ?? [], ...credentials ? [credentialsBuildArg(credentials)] : []],
-			credentialsFile: secret?.path
-		}), {
-			cwd: buildRoot,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			},
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger.log(`✅ Image built: ${imageRef}`);
-	} catch (error) {
-		throw new DockerBuildFailed(imageRef, error);
-	} finally {
-		await secret?.cleanup();
-	}
-}
-/**
-* Push Docker image to registry
-*/
-async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger.log(`\n☁️  Pushing image: ${imageRef}`);
-	try {
-		await run$1("docker", ["push", imageRef], {
-			cwd,
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger.log(`✅ Image pushed: ${imageRef}`);
-	} catch (error) {
-		throw new DockerPushFailed(imageRef, error);
-	}
-}
-/**
-* The digest the registry gave a pushed image, `sha256:…`.
-*
-* A tag can be pushed over — by the next deploy, or by anything else that
-* shares the repository — and the digest is what says which image a stage
-* actually ran. `RepoDigests` has one entry per repository the image was
-* pushed to, so the one for this ref's repository is picked by name.
-*
-* @internal Exported for testing
-*/
-async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
-	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await runOutput("docker", [
-		"image",
-		"inspect",
-		"--format={{json .RepoDigests}}",
-		imageRef
-	], {
-		cwd,
-		...signal ? { signal } : {}
-	});
-	let digests;
-	try {
-		digests = JSON.parse(output.trim() || "[]");
-	} catch {
-		return;
-	}
-	if (!Array.isArray(digests)) return void 0;
-	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
-}
-/**
-* Deploy using Docker (build and optionally push image)
-*/
-async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
-	const imageName = config.imageName;
-	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
-	const cwd = options.cwd ?? process.cwd();
-	const docker = {
-		cwd,
-		dockerfile: join(cwd, options.dockerfile ?? dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
-		...options.signal ? { signal: options.signal } : {},
-		...options.stdio ? { stdio: options.stdio } : {}
-	};
-	await buildImage(imageRef, buildArgs, credentials, docker);
-	let digest;
-	if (!skipPush) {
-		if (!config.registry) logger.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else {
-			await pushImage(imageRef, docker);
-			digest = await pushedDigest(imageRef, docker);
-		}
-	}
-	logger.log("\n✅ Docker deployment ready!");
-	logger.log(`\n📋 Deployment details:`);
-	logger.log(`   Image: ${imageRef}`);
-	logger.log(`   Stage: ${stage}`);
-	if (masterKey) logger.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
-	return {
-		imageRef,
-		...digest ? { digest } : {},
-		masterKey
-	};
+	logger.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
+	logger.log("   gkm setup   # starts the containers and creates what they hold");
+	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
 }
 //#endregion
 //#region src/deploy/generated.ts
@@ -6590,6 +6497,6 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { constructGlobs as $, applicationName as $t, DevServicesNeedServerTarget as A, eventsBackendFor as At, requiredStageKeys as B, findAvailablePort as Bt, validateImageRef as C, composeBuildPaths as Ct, isOtlpDestination as D, detectPackageManager as Dt, resolveHost as E, WORKER_PORT as Et, devServicesUsed as F, fakeKey as Ft, keyFingerprint as G, isRemoteStore as Gt, workerUnits as H, loadEnvFiles as Ht, externalServices as I, portKeys as It, workerEntryDir as J, FileSecretsStore as Jt, WorkerGenerator as K, secretsStoreFor as Kt, manifestServiceDeclarations as L, primaryPortKey as Lt, STORAGE_KEY_PAIR as M, storageBackendFor as Mt, UnknownDevService as N, DEFAULT_IMAGES as Nt, otelEnv as O, findBuildRoot as Ot, assertExternalServices as P, describeServices as Pt, backendsOf as Q, readKey as Qt, parseDevServices as R, createCredentialsPreload as Rt, workerDockerfileOf as S, hostFor as St, isMainFrontendApp as T, TURBO_VERSION as Tt, encryptSecrets as U, loadSecretsForApp as Ut, suppliedOnly as V, isPortAvailable as Vt, encryption_exports as W, prepareEntryCredentials as Wt, CronGenerator as X, keystoreProject as Xt, QueueGenerator as Y, getKeyPath as Yt, FAKE_ENV as Z, projectKey as Zt, deployDocker as _, workerEnvKeys as _t, recordRelease as a, ownershipMarker as an, applyBuckets as at, ensureDockerignore as b, planFor as bt, setBackupState as c, maskPassword as cn, bucketPolicies as ct, setGeneratedSecret as d, withCustomSecret as dn, quoteIdentifier as dt, deployIdentity as en, derivedContainers as et, setPostgresBackupId as f, composeFor as ft, credentialsFileContent as g, networkEnv as gt, credentialsBuildArg as h, appEnvKeys as ht, isDnsVerified as i, markerOf as in, forgetState as it, ExternalServicesNotConfigured as j, providerOf as jt, DEV_SERVICES as k, cacheBackendFor as kt, setDnsRecord as l, storage_exports as ln, postgresDatabaseNames as lt, withGeneratedSecrets as m, pgClient as mt, getBackupState as n, imageRef as nn, workspace_exports as nt, recordRollback as o, projectName as on, applyPolicies as ot, DeployJournal as p, bucketClient as pt, workerBundleName as q, store_exports as qt, getGeneratedSecret as r, isOwnedBy as rn, LOCAL_CA_PATH as rt, setApplicationId as s, initStageSecrets as sn, applyPostgres as st, createEmptyState as t, imageName as tn, reconcileWorkspace as tt, setDnsVerification as u, toEmbeddableSecrets as un, postgresStatements as ut, appDockerfile as v, envFor as vt, NoDomainForStage as w, imageLayout as wt, workerDockerfile as x, resourceName as xt, dockerCommand as y, localRolePassword as yt, reportDevServices as z, createEntryWrapper as zt };
+export { LOCAL_CA_PATH as $, applicationName as $t, ExternalServicesNotConfigured as A, providerOf as At, suppliedOnly as B, isPortAvailable as Bt, NoDomainForStage as C, WORKER_PORT as Ct, otelEnv as D, isImageBuild as Dt, isOtlpDestination as E, imageBuildCredentials as Et, externalServices as F, portKeys as Ft, QueueGenerator as G, secretsStoreFor as Gt, WorkerGenerator as H, loadSecretsForApp as Ht, manifestServiceDeclarations as I, primaryPortKey as It, backendsOf as J, FileSecretsStore as Jt, CronGenerator as K, storeFromConfig as Kt, parseDevServices as L, createCredentialsPreload as Lt, UnknownDevService as M, DEFAULT_IMAGES as Mt, assertExternalServices as N, describeServices as Nt, DEV_SERVICES as O, cacheBackendFor as Ot, devServicesUsed as P, fakeKey as Pt, workspace_exports as Q, readKey as Qt, reportDevServices as R, createEntryWrapper as Rt, validateImageRef as S, TURBO_VERSION as St, resolveHost as T, findBuildRoot as Tt, workerBundleName as U, prepareEntryCredentials as Ut, workerUnits as V, loadEnvFiles as Vt, workerEntryDir as W, isRemoteStore as Wt, derivedContainers as X, keystoreProject as Xt, constructGlobs as Y, getKeyPath as Yt, reconcileWorkspace as Z, projectKey as Zt, appDockerfile as _, planFor as _t, recordRelease as a, ownershipMarker as an, postgresDatabaseNames as at, workerDockerfile as b, composeBuildPaths as bt, setBackupState as c, maskPassword as cn, composeFor as ct, setGeneratedSecret as d, withCustomSecret as dn, appEnvKeys as dt, deployIdentity as en, forgetState as et, setPostgresBackupId as f, dockerfileOf as ft, DockerPushFailed as g, localRolePassword as gt, DockerBuildFailed as h, envFor as ht, isDnsVerified as i, markerOf as in, bucketPolicies as it, STORAGE_KEY_PAIR as j, storageBackendFor as jt, DevServicesNeedServerTarget as k, eventsBackendFor as kt, setDnsRecord as l, storage_exports as ln, bucketClient as lt, withGeneratedSecrets as m, workerEnvKeys as mt, getBackupState as n, imageRef as nn, applyPolicies as nt, recordRollback as o, projectName as on, postgresStatements as ot, DeployJournal as p, networkEnv as pt, FAKE_ENV as q, store_exports as qt, getGeneratedSecret as r, isOwnedBy as rn, applyPostgres as rt, setApplicationId as s, initStageSecrets as sn, quoteIdentifier as st, createEmptyState as t, imageName as tn, applyBuckets as tt, setDnsVerification as u, toEmbeddableSecrets as un, pgClient as ut, dockerCommand as v, resourceName as vt, isMainFrontendApp as w, detectPackageManager as wt, workerDockerfileOf as x, imageLayout as xt, ensureDockerignore as y, hostFor as yt, requiredStageKeys as z, findAvailablePort as zt };
 
-//# sourceMappingURL=state-DpkxSwzI.mjs.map
+//# sourceMappingURL=state-CUecOCNJ.mjs.map