@geekmidas/cli 10.0.0-alpha.75 → 10.0.0-alpha.77

package/dist/index.cjs

@@ -5,20 +5,20 @@ const require_run = require("./run-fVZ-rLnc.cjs");
 const require_credentials = require("./credentials-BVs7mrtw.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-vdrcRI-m.cjs");
+const require_workspace = require("./workspace-DOm81oUo.cjs");
 const require_config = require("./config.cjs");
-const require_state = require("./state-kA4Fkufx.cjs");
+const require_stale = require("./stale-yu2FkH3G.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-CP6sBvQV.cjs");
-const require_sniffer = require("./sniffer-bMzrX4cO.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-CajwOa5W.cjs");
 const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
 const require_drivers = require("./drivers-BdvtCKc7.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
-const require_deploy = require("./deploy-XUZoA1us.cjs");
-const require_compose = require("./compose-UKyv_1yU.cjs");
+const require_sniffer = require("./sniffer-Y6GQOCXB.cjs");
+const require_deploy = require("./deploy-XHXi-_tL.cjs");
+const require_compose = require("./compose-CePlrbUw.cjs");
 const require_credentialSchemas = require("./credentialSchemas-DCR4Wd1W.cjs");
-const require_LocalStateStore = require("./LocalStateStore-zQGZ9b4J.cjs");
+const require_LocalStateStore = require("./LocalStateStore-B0NCde8Z.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
 const require_ready = require("./ready-BB9xS4S9.cjs");
 let node_path = require("node:path");
@@ -53,7 +53,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.75";
+var version = "10.0.0-alpha.77";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -136,7 +136,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-bMzrX4cO.cjs")).then((n) => n.dokploy_api_exports);
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-Y6GQOCXB.cjs")).then((n) => n.dokploy_api_exports);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -304,7 +304,7 @@ function installation(platform, certificate) {
 */
 async function trustCommand(options = {}) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	const certificate = (0, node_path.join)(workspace.root, require_state.LOCAL_CA_PATH);
+	const certificate = (0, node_path.join)(workspace.root, require_stale.LOCAL_CA_PATH);
 	if (!(0, node_fs.existsSync)(certificate)) throw new NoLocalAuthority(certificate);
 	const { describe, asks, steps } = installation(process.platform, certificate);
 	logger$7.log(`\n🔐 Trusting the local authority in ${describe}`);
@@ -1488,7 +1488,7 @@ async function serveFakes(fakes, ports) {
 	const served = [];
 	for (const [id, local] of Object.entries(fakes)) {
 		if (local.image) continue;
-		const port = ports[require_state.fakeKey(id)];
+		const port = ports[require_stale.fakeKey(id)];
 		if (port === void 0) continue;
 		const { handler } = (await import((0, node_url.pathToFileURL)(local.file).href)).default;
 		const server = serve({
@@ -1531,16 +1531,16 @@ var NoCommandSpecified = class extends Error {
 async function execCommand(commandArgs, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
-	const defaultEnv = require_state.loadEnvFiles(".env");
+	const defaultEnv = require_stale.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = await require_state.prepareEntryCredentials({ cwd });
+	const { credentials, secretsJsonPath, appName } = require_stale.isImageBuild() ? await imageBuildEntry(cwd) : await require_stale.prepareEntryCredentials({ cwd });
 	if (appName) logger$6.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0) logger$6.log(`🔐 Loaded ${secretCount} secret(s)`);
+	if (secretCount > 0 && !require_stale.isImageBuild()) logger$6.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const preloadDir = (0, node_path.join)(cwd, ".gkm");
 	await (0, node_fs_promises.mkdir)(preloadDir, { recursive: true });
 	const preloadPath = (0, node_path.join)(preloadDir, "credentials-preload.mjs");
-	await require_state.createCredentialsPreload(preloadPath, secretsJsonPath);
+	await require_stale.createCredentialsPreload(preloadPath, secretsJsonPath);
 	const [cmd, ...args] = commandArgs;
 	logger$6.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const nodeOptions = [(process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim(), `--import=${preloadPath}`].filter(Boolean).join(" ");
@@ -1562,6 +1562,23 @@ async function execCommand(commandArgs, options = {}) {
 	});
 	if (exitCode !== 0) process.exit(exitCode);
 }
+/**
+* `gkm exec` inside an image build: the public values the Dockerfile's build
+* args set, written where the preload reads them. No workspace is loaded, no
+* secret read and no address resolved.
+*/
+async function imageBuildEntry(cwd) {
+	const credentials = require_stale.imageBuildCredentials();
+	logger$6.log(`🐳 Image build: ${Object.keys(credentials).length} public value(s) from the build args`);
+	const dir = (0, node_path.join)(cwd, ".gkm");
+	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+	const secretsJsonPath = (0, node_path.join)(dir, "image-build-env.json");
+	await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(credentials, null, 2));
+	return {
+		credentials,
+		secretsJsonPath
+	};
+}
 //#endregion
 //#region src/dev/index.ts
 const logger$5 = console;
@@ -1632,7 +1649,7 @@ const SUBSCRIBERS_ENV = "GKM_SUBSCRIBERS";
 async function devCommand(options) {
 	if (options.subscribers === false) process.env[SUBSCRIBERS_ENV] = "off";
 	if (options.entry) return entryDevCommand(options);
-	const defaultEnv = require_state.loadEnvFiles(".env");
+	const defaultEnv = require_stale.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$5.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const appConfig = await require_config.loadAppConfig().catch((error) => {
 		if (error instanceof require_config.NotInAnApp || error instanceof require_config.NotABackendApp) return;
@@ -1648,7 +1665,7 @@ async function devCommand(options) {
 	const secretsRoot = appConfig.workspaceRoot;
 	const workspaceAppName = appConfig.appName;
 	const assigned = await require_appPorts.assignAppPorts(appConfig.workspace, [workspaceAppName], {
-		free: require_state.isPortAvailable,
+		free: require_stale.isPortAvailable,
 		holder: require_appPorts.holderOf
 	});
 	if (assigned.running.length > 0) throw new WorkspacePortsInUse(assigned.running);
@@ -1666,7 +1683,7 @@ async function devCommand(options) {
 		});
 	}
 	if (config.env) {
-		const { loaded, missing } = require_state.loadEnvFiles(config.env, appRoot);
+		const { loaded, missing } = require_stale.loadEnvFiles(config.env, appRoot);
 		if (loaded.length > 0) logger$5.log(`📦 Loaded env: ${loaded.join(", ")}`);
 		if (missing.length > 0) logger$5.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
@@ -1679,8 +1696,8 @@ async function devCommand(options) {
 		appRoot,
 		target: "server",
 		enableOpenApi,
-		cacheBackend: require_state.cacheBackendFor(require_state.providerOf(workspace ?? config)),
-		eventsBackend: require_state.eventsBackendFor(require_state.providerOf(workspace ?? config)),
+		cacheBackend: require_stale.cacheBackendFor(require_stale.providerOf(workspace ?? config)),
+		eventsBackend: require_stale.eventsBackendFor(require_stale.providerOf(workspace ?? config)),
 		telescope,
 		databaseApi: true,
 		hooks,
@@ -1694,16 +1711,16 @@ async function devCommand(options) {
 	let secretsJsonPath;
 	let publicUrl;
 	let manifest;
-	const appSecrets = await require_state.loadSecretsForApp(workspace ? await require_state.secretsStoreFor(workspace, config.stages.local) : new require_state.FileSecretsStore(secretsRoot), config.stages.local, workspaceAppName);
+	const appSecrets = await require_stale.loadSecretsForApp(workspace ? await require_stale.secretsStoreFor(workspace, config.stages.local) : new require_stale.FileSecretsStore(secretsRoot), config.stages.local);
 	if (workspace) {
-		const reconciled = await require_state.reconcileWorkspace(workspace, {
+		const reconciled = await require_stale.reconcileWorkspace(workspace, {
 			stage: workspace.stages.local,
 			...options.fake ? { fake: true } : {},
 			progress: (message) => logger$5.log(message)
 		});
 		if (reconciled.services.length > 0) {
 			logger$5.log("🐳 Services");
-			for (const line of require_state.describeServices(reconciled.services)) logger$5.log(line);
+			for (const line of require_stale.describeServices(reconciled.services)) logger$5.log(line);
 		}
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_derive.appKey(r.id) === workspaceAppName);
@@ -1982,8 +1999,8 @@ async function validateFrontendApps(workspace) {
 async function loadDevSecrets(workspace) {
 	if (!workspace.secrets.enabled) return {};
 	const stage = workspace.stages.local;
-	const secrets = await (await require_state.secretsStoreFor(workspace, stage)).read(stage);
-	if (secrets) return require_state.toEmbeddableSecrets(secrets);
+	const secrets = await (await require_stale.secretsStoreFor(workspace, stage)).read(stage);
+	if (secrets) return require_stale.toEmbeddableSecrets(secrets);
 	return {};
 }
 /**
@@ -1998,7 +2015,7 @@ async function loadDevSecrets(workspace) {
 async function workspaceDevCommand(configured, options) {
 	const scoped = options.app ? [options.app] : options.filter ? [] : Object.keys(configured.apps);
 	const assigned = await require_appPorts.assignAppPorts(configured, scoped, {
-		free: require_state.isPortAvailable,
+		free: require_stale.isPortAvailable,
 		holder: require_appPorts.holderOf
 	});
 	if (assigned.running.length > 0) throw new WorkspacePortsInUse(assigned.running);
@@ -2025,14 +2042,14 @@ async function workspaceDevCommand(configured, options) {
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
 	}
 	const rawSecrets = await loadDevSecrets(workspace);
-	const reconciled = await require_state.reconcileWorkspace(workspace, {
+	const reconciled = await require_stale.reconcileWorkspace(workspace, {
 		stage: workspace.stages.local,
 		...options.fake ? { fake: true } : {},
 		progress: (message) => logger$5.log(message)
 	});
 	if (reconciled.services.length > 0) {
 		logger$5.log("🐳 Services");
-		for (const line of require_state.describeServices(reconciled.services)) logger$5.log(line);
+		for (const line of require_stale.describeServices(reconciled.services)) logger$5.log(line);
 	}
 	const secretsEnv = {
 		...rawSecrets,
@@ -2042,9 +2059,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-CgjlYeun.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-sny0NjKe.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-CgjlYeun.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-sny0NjKe.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2130,7 +2147,7 @@ async function workspaceDevCommand(configured, options) {
 		...secretsEnv,
 		NODE_ENV: "development",
 		...configPath ? { GKM_CONFIG_PATH: configPath } : {},
-		...options.fake ? { [require_state.FAKE_ENV]: "1" } : {},
+		...options.fake ? { [require_stale.FAKE_ENV]: "1" } : {},
 		[DISCOVERY_QUIET_ENV]: "1"
 	};
 	logger$5.log(`🚀 Starting ${appCount} app(s) — each builds before it answers, and says so when it is ready`);
@@ -2193,16 +2210,16 @@ async function entryDevCommand(options) {
 	if (!entry) throw new Error("--entry requires a file path");
 	const entryPath = (0, node_path.resolve)(process.cwd(), entry);
 	if (!(0, node_fs.existsSync)(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
-	const defaultEnv = require_state.loadEnvFiles(".env");
+	const defaultEnv = require_stale.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$5.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_state.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
+	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_stale.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
 	if (appName) logger$5.log(`📦 App: ${appName} (port ${resolvedPort})`);
 	logger$5.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
 	if (Object.keys(credentials).length > 1) logger$5.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
 	const wrapperDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(wrapperDir, { recursive: true });
 	const wrapperPath = (0, node_path.join)(wrapperDir, "entry-wrapper.ts");
-	await require_state.createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
+	await require_stale.createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
 	const runner = new EntryRunner(wrapperPath, entryPath, watch, resolvedPort);
 	await runner.start();
 	let isShuttingDown = false;
@@ -2511,10 +2528,10 @@ var DevServer = class {
 		this.startTime = Date.now();
 		if (this.isRunning) await this.stop();
 		if (this.portExplicit) {
-			if (!await require_state.isPortAvailable(this.requestedPort)) throw new DevPortInUse(this.requestedPort, listenerOn(this.requestedPort));
+			if (!await require_stale.isPortAvailable(this.requestedPort)) throw new DevPortInUse(this.requestedPort, listenerOn(this.requestedPort));
 			this.actualPort = this.requestedPort;
 		} else {
-			this.actualPort = await require_state.findAvailablePort(this.requestedPort);
+			this.actualPort = await require_stale.findAvailablePort(this.requestedPort);
 			if (this.actualPort !== this.requestedPort) logger$5.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
 		const serverEntryPath = (0, node_path.join)(this.appRoot, ".gkm", "server", "server.ts");
@@ -2585,7 +2602,7 @@ var DevServer = class {
 		await this.stop();
 		let attempts = 0;
 		while (attempts < 30) {
-			if (await require_state.isPortAvailable(portToReuse)) break;
+			if (await require_stale.isPortAvailable(portToReuse)) break;
 			await new Promise((resolve) => setTimeout(resolve, 100));
 			attempts++;
 		}
@@ -2926,7 +2943,7 @@ async function buildCommand(options) {
 		}
 	}
 	const config = loadedConfig.type !== "workspace" ? await require_config.loadConfig() : (0, node_path.resolve)(process.cwd()) === (0, node_path.resolve)(loadedConfig.workspace.root) ? rootGkmConfig(loadedConfig.workspace) : (await require_config.loadAppConfig()).gkmConfig;
-	const target = options.provider ?? require_state.providerOf(loadedConfig.workspace);
+	const target = options.provider ?? require_stale.providerOf(loadedConfig.workspace);
 	const workspaceRoot = loadedConfig.workspace.root;
 	const appRoot = process.cwd();
 	const output = await buildOneApp({
@@ -2958,15 +2975,15 @@ async function declaredIn(config, cwd) {
 */
 function backendsOf(workspace) {
 	return {
-		cache: require_state.cacheBackendFor(require_state.providerOf(workspace)),
+		cache: require_stale.cacheBackendFor(require_stale.providerOf(workspace)),
 		email: "ses"
 	};
 }
 /** One app's build, from its config and the command's options. */
 async function buildOneApp(input) {
 	const { config, options, workspace, appRoot, target } = input;
-	const cacheBackend = options.cache ?? require_state.cacheBackendFor(require_state.providerOf(workspace));
-	const eventsBackend = require_state.eventsBackendFor(require_state.providerOf(workspace));
+	const cacheBackend = options.cache ?? require_stale.cacheBackendFor(require_stale.providerOf(workspace));
+	const eventsBackend = require_stale.eventsBackendFor(require_stale.providerOf(workspace));
 	const production = normalizeProductionConfig(options.production ?? false);
 	if (production) logger$4.log(`🏭 Building for PRODUCTION`);
 	logger$4.log(`Building for ${target}`);
@@ -3052,7 +3069,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = (0, node_path.join)(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-_8AEZhrs.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-5spPyduN.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3096,9 +3113,9 @@ async function buildApp(input) {
 	};
 	const endpointGenerator = new require_EndpointGenerator.EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
-	const cronGenerator = new require_state.CronGenerator();
+	const cronGenerator = new require_stale.CronGenerator();
 	const subscriberGenerator = new require_SubscriberGenerator.SubscriberGenerator();
-	const queueGenerator = new require_state.QueueGenerator();
+	const queueGenerator = new require_stale.QueueGenerator();
 	const topicGenerator = new TopicGenerator();
 	const code = constructGlobs;
 	const [loadedEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics] = await Promise.all([
@@ -3137,7 +3154,7 @@ async function buildApp(input) {
 		const appName = Object.entries(input.workspace.apps).find(([, app]) => (0, node_path.resolve)(input.workspace.root, app.path) === (0, node_path.resolve)(appRoot))?.[0];
 		await buildWorkers({
 			context: buildContext,
-			workers: require_state.workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName),
+			workers: require_stale.workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName),
 			serverDir: (0, node_path.join)(appRoot, ".gkm", "server"),
 			crons: allCrons,
 			queues: allQueues,
@@ -3160,7 +3177,7 @@ async function buildApp(input) {
 * runnables built from that worker, and nothing built from another.
 */
 async function buildWorkers(input) {
-	const generator = new require_state.WorkerGenerator();
+	const generator = new require_stale.WorkerGenerator();
 	for (const worker of input.workers) {
 		const owned = (list) => list.filter(({ construct }) => construct.owner === worker.id);
 		const crons = owned(input.crons);
@@ -3169,15 +3186,15 @@ async function buildWorkers(input) {
 		const entryPoint = await generator.build({
 			context: input.context,
 			workerId: worker.id,
-			outputDir: require_state.workerEntryDir(input.serverDir, worker.id),
+			outputDir: require_stale.workerEntryDir(input.serverDir, worker.id),
 			crons,
 			queues,
 			subscribers
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-_8AEZhrs.cjs"));
-		const outfile = require_state.workerBundleName(worker.id);
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-5spPyduN.cjs"));
+		const outfile = require_stale.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
 			outputDir: (0, node_path.join)(input.serverDir, "dist"),
@@ -3246,7 +3263,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-_8AEZhrs.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-5spPyduN.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3377,7 +3394,7 @@ async function workspaceBuildCommand(workspace, options) {
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
 	logger$4.log(`   Build order: ${buildOrder.join(" → ")}`);
 	try {
-		const target = options.provider ?? require_state.providerOf(workspace);
+		const target = options.provider ?? require_stale.providerOf(workspace);
 		const builds = [];
 		for (const appName of buildOrder) {
 			const app = workspace.apps[appName];
@@ -3500,14 +3517,14 @@ async function composeCommand(options, deps = {}) {
 	if (options.push && !options.build) throw new require_compose.ComposePushNeedsBuild();
 	const pulls = !options.build && (options.pull || options.tag !== void 0);
 	if (options.digestsFile && !options.push && !pulls) throw new require_compose.ComposePinNeedsPull();
-	const allowDevServices = require_state.parseDevServices(options.allowDevServices);
+	const allowDevServices = require_stale.parseDevServices(options.allowDevServices);
 	const cwd = (0, node_path.resolve)(options.cwd ?? process.cwd());
 	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
 	const { stage } = options;
 	if (options.down) {
 		const override = require_compose.stackOverrideFile(workspace.root, stage);
 		const ref = {
-			project: require_compose.composeProject(require_state.deployIdentity(workspace, stage)),
+			project: require_compose.composeProject(require_stale.deployIdentity(workspace, stage)),
 			file: (0, node_path.join)(workspace.root, require_compose.stackDir(stage), "docker-compose.yml"),
 			...(0, node_fs.existsSync)(override) ? { overrides: [override] } : {},
 			cwd: workspace.root
@@ -4016,13 +4033,6 @@ const SERVICE_DEFAULTS = {
 		region: "us-east-1"
 	}
 };
-/** Default credentials for pgboss (not a Docker service, reuses postgres) */
-const PGBOSS_DEFAULTS = {
-	host: "localhost",
-	port: 5432,
-	username: "pgboss",
-	database: "app"
-};
 /**
 * Generate credentials for a specific service.
 */
@@ -4062,14 +4072,6 @@ function generateMinioEndpoint(creds) {
 	return `http://${host}:${port}`;
 }
 /**
-* Generate connection URL for pg-boss (uses PostgreSQL protocol).
-* Format: pgboss://user:pass@host:port/db?schema=pgboss
-*/
-function generatePgBossUrl(creds) {
-	const { username, password, host, port, database } = creds;
-	return `pgboss://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}?schema=pgboss`;
-}
-/**
 * Generate connection URLs from service credentials.
 */
 function generateConnectionUrls(services) {
@@ -4077,7 +4079,6 @@ function generateConnectionUrls(services) {
 	if (services.postgres) urls.DATABASE_URL = generatePostgresUrl(services.postgres);
 	if (services.redis) urls.REDIS_URL = generateRedisUrl(services.redis);
 	if (services.minio) urls.STORAGE_ENDPOINT = generateMinioEndpoint(services.minio);
-	if (services.pgboss) urls.EVENT_PUBLISHER_CONNECTION_STRING = generatePgBossUrl(services.pgboss);
 	if (services.mailpit) {
 		urls.SMTP_HOST = services.mailpit.host;
 		urls.SMTP_PORT = String(services.mailpit.port);
@@ -4101,13 +4102,6 @@ function createStageSecrets(stage, services, options) {
 			serviceCredentials.minio.username = options.projectName;
 		}
 	}
-	if (serviceCredentials.postgres && !serviceCredentials.pgboss) serviceCredentials.pgboss = {
-		...PGBOSS_DEFAULTS,
-		password: generateSecurePassword(),
-		host: serviceCredentials.postgres.host,
-		port: serviceCredentials.postgres.port,
-		database: serviceCredentials.postgres.database
-	};
 	return {
 		stage,
 		createdAt: now,
@@ -4970,25 +4964,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.75",
-	"@geekmidas/auth": "~10.0.0-alpha.75",
-	"@geekmidas/cache": "~10.0.0-alpha.75",
-	"@geekmidas/client": "~10.0.0-alpha.75",
-	"@geekmidas/cloud": "~10.0.0-alpha.75",
-	"@geekmidas/constructs": "~10.0.0-alpha.75",
-	"@geekmidas/db": "~10.0.0-alpha.75",
-	"@geekmidas/emailkit": "~10.0.0-alpha.75",
-	"@geekmidas/envkit": "~10.0.0-alpha.75",
-	"@geekmidas/errors": "~10.0.0-alpha.75",
-	"@geekmidas/events": "~10.0.0-alpha.75",
-	"@geekmidas/logger": "~10.0.0-alpha.75",
-	"@geekmidas/manifest": "~10.0.0-alpha.75",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.75",
-	"@geekmidas/schema": "~10.0.0-alpha.75",
-	"@geekmidas/services": "~10.0.0-alpha.75",
-	"@geekmidas/storage": "~10.0.0-alpha.75",
-	"@geekmidas/telescope": "~10.0.0-alpha.75",
-	"@geekmidas/testkit": "~10.0.0-alpha.75",
+	"@geekmidas/audit": "~10.0.0-alpha.77",
+	"@geekmidas/auth": "~10.0.0-alpha.77",
+	"@geekmidas/cache": "~10.0.0-alpha.77",
+	"@geekmidas/client": "~10.0.0-alpha.77",
+	"@geekmidas/cloud": "~10.0.0-alpha.77",
+	"@geekmidas/constructs": "~10.0.0-alpha.77",
+	"@geekmidas/db": "~10.0.0-alpha.77",
+	"@geekmidas/emailkit": "~10.0.0-alpha.77",
+	"@geekmidas/envkit": "~10.0.0-alpha.77",
+	"@geekmidas/errors": "~10.0.0-alpha.77",
+	"@geekmidas/events": "~10.0.0-alpha.77",
+	"@geekmidas/logger": "~10.0.0-alpha.77",
+	"@geekmidas/manifest": "~10.0.0-alpha.77",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.77",
+	"@geekmidas/schema": "~10.0.0-alpha.77",
+	"@geekmidas/services": "~10.0.0-alpha.77",
+	"@geekmidas/storage": "~10.0.0-alpha.77",
+	"@geekmidas/telescope": "~10.0.0-alpha.77",
+	"@geekmidas/testkit": "~10.0.0-alpha.77",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5571,7 +5565,7 @@ function deploy(options) {
           role-to-assume: \${{ vars.AWS_ROLE_ARN }}
           aws-region: ${options.region}
 ` : "";
-	const keyDir = `~/.gkm/keys/${require_state.projectKey({ name: options.name })}`;
+	const keyDir = `~/.gkm/keys/${require_stale.projectKey({ name: options.name })}`;
 	const stageSecrets = sst ? credentials : `
       # The stage's secrets are kept in the encrypted .gkm/secrets/<stage>.json,
       # and each environment holds its key as GKM_SECRETS_KEY. .gkm/ is
@@ -6833,7 +6827,6 @@ docker-compose.constructs.yml
 .env
 .env.local
 .env.*.local
-docker/.env
 
 # IDE
 .idea/
@@ -7046,6 +7039,7 @@ function secretsStore(options) {
 	return `
     // Deployed stages keep their secrets in SSM, in the account each stage
     // deploys to: \`gkm secrets:set <KEY> '…' --stage <stage>\` writes there.
+    // Past 8 KB a stage needs { provider: 'secrets-manager', region } instead.
     store: { provider: 'ssm', region: '${options.region}' },`;
 }
 /**
@@ -9901,18 +9895,17 @@ async function initCommand(projectName, options = {}) {
 	};
 	if (isFullstack) {
 		customSecrets.AUTH_PORT = "3002";
-		customSecrets.AUTH_URL = "http://localhost:3002";
 		customSecrets.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${Math.random().toString(36).slice(2)}`;
 		customSecrets.BETTER_AUTH_URL = "http://localhost:3002";
 		customSecrets.BETTER_AUTH_TRUSTED_ORIGINS = "http://localhost:3000,http://localhost:3001";
 	}
 	devSecrets.custom = customSecrets;
 	const keys = {
-		key: require_state.projectKey({ name }),
+		key: require_stale.projectKey({ name }),
 		legacy: [(0, node_path.basename)(targetDir)]
 	};
-	await new require_state.FileSecretsStore(targetDir, keys).write(local, devSecrets);
-	const keyPath = require_state.getKeyPath(local, keys);
+	await new require_stale.FileSecretsStore(targetDir, keys).write(local, devSecrets);
+	const keyPath = require_stale.getKeyPath(local, keys);
 	console.log(`  Secrets: .gkm/secrets/${local}.json (encrypted)`);
 	console.log(`  Key: ${keyPath}\n`);
 	if (!options.skipInstall) {
@@ -10065,27 +10058,18 @@ var NotAnAwsRegion = class extends Error {
 //#endregion
 //#region src/setup/fullstack-secrets.ts
 /**
-* Generate a secure random password for database users.
-* Uses a combination of timestamp and random bytes for uniqueness.
-*/
-function generateDbPassword() {
-	return `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
-}
-/**
-* Generate database URL for an app.
-* All apps connect to the same database, but use different users/schemas.
-*/
-function generateDbUrl(appName, password, projectName, host = "localhost", port = 5432) {
-	return `postgresql://${appName.replace(/-/g, "_")}:${password}@${host}:${port}/${`${projectName.replace(/-/g, "_")}_dev`}`;
-}
-/**
 * Generate fullstack-aware custom secrets for a workspace.
 *
 * Generates:
 * - Common secrets: PORT, LOG_LEVEL, JWT_SECRET (no `NODE_ENV` — the command
 *   decides that; see `gkm init`)
-* - Per-app database passwords and URLs for backend apps with db service
 * - Better-auth secrets for apps using the better-auth framework
+*
+* No address of anything a construct declares — a database's or a tenant's
+* URL, a surface's or a site's. Those are derived from the construct, with
+* passwords from the stage, and one stored here would be a value set by hand,
+* which wins over the derived one: a `localhost` URL handed to a container,
+* with a password no role has.
 */
 function generateFullstackCustomSecrets(workspace, containers = []) {
 	const hasDb = containers.includes("postgres");
@@ -10095,22 +10079,10 @@ function generateFullstackCustomSecrets(workspace, containers = []) {
 		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
 	};
 	if (!hasDb) return customs;
-	const frontendPorts = [];
-	for (const [appName, appConfig] of Object.entries(workspace.apps)) {
-		if (appConfig.type === "web") {
-			frontendPorts.push(appConfig.port);
-			const upperName = appName.toUpperCase();
-			customs[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;
-			continue;
-		}
-		if (appConfig.type === "mobile") continue;
-		const password = generateDbPassword();
-		const upperName = appName.toUpperCase();
-		customs[`${upperName}_DATABASE_URL`] = generateDbUrl(appName, password, workspace.name);
-		customs[`${upperName}_DB_PASSWORD`] = password;
+	for (const appConfig of Object.values(workspace.apps)) {
+		if (appConfig.type === "web" || appConfig.type === "mobile") continue;
 		if (appConfig.framework === "better-auth") {
 			customs.AUTH_PORT = String(appConfig.port);
-			customs.AUTH_URL = `http://localhost:${appConfig.port}`;
 			customs.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;
 			customs.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;
 		}
@@ -10118,38 +10090,19 @@ function generateFullstackCustomSecrets(workspace, containers = []) {
 	if (customs.BETTER_AUTH_SECRET) customs.BETTER_AUTH_TRUSTED_ORIGINS = Object.values(workspace.apps).map((a) => a.port).map((p) => `http://localhost:${p}`).join(",");
 	return customs;
 }
-/**
-* Extract *_DB_PASSWORD keys from secrets and write docker/.env.
-*
-* The docker/.env file contains database passwords that the PostgreSQL
-* init script reads to create per-app database users.
-*/
-async function writeDockerEnvFromSecrets(secrets, workspaceRoot) {
-	const dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) => key.endsWith("_DB_PASSWORD"));
-	if (secrets.services.pgboss && !dbPasswordEntries.some(([key]) => key === "PGBOSS_DB_PASSWORD")) dbPasswordEntries.push(["PGBOSS_DB_PASSWORD", secrets.services.pgboss.password]);
-	if (dbPasswordEntries.length === 0) return;
-	const envContent = `# Auto-generated docker environment file
-# Contains database passwords for docker-compose postgres init
-# This file is gitignored - do not commit to version control
-${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join("\n")}
-`;
-	const envPath = (0, node_path.join)(workspaceRoot, "docker", ".env");
-	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(envPath), { recursive: true });
-	await (0, node_fs_promises.writeFile)(envPath, envContent);
-}
 //#endregion
 //#region src/secrets/index.ts
 const logger$2 = console;
 /**
-* The store the stage named on the command line keeps its secrets in — SSM in
-* its account, for a deployed stage kept there. Outside any workspace nothing
+* The store the stage named on the command line keeps its secrets in — SSM or
+* Secrets Manager in its account, for a deployed stage kept there. Outside any workspace nothing
 * names a store, so it is the file.
 */
 async function storeFor(stage) {
 	try {
-		return await require_state.secretsStoreFor(await require_config.loadWorkspaceSettings(), stage);
+		return await require_stale.secretsStoreFor(await require_config.loadWorkspaceSettings(), stage);
 	} catch (error) {
-		if (error instanceof require_config.ConfigNotFound) return new require_state.FileSecretsStore(process.cwd());
+		if (error instanceof require_config.ConfigNotFound) return new require_stale.FileSecretsStore(process.cwd());
 		throw error;
 	}
 }
@@ -10220,9 +10173,50 @@ async function secretsSetCommand(key, value, options) {
 		process.exit(1);
 	}
 	await assertCredentialValue(key, secretValue, stage);
-	await store.write(stage, require_state.withCustomSecret(secrets, key, secretValue));
+	await store.write(stage, require_stale.withCustomSecret(secrets, key, secretValue));
 	logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}" (${store.name})`);
 }
+/** `gkm secrets:unset` for a key the stage does not hold. */
+var SecretNotSet = class extends Error {
+	key;
+	stage;
+	constructor(key, stage) {
+		super(`The stage '${stage}' holds no secret '${key}'. List what it holds with gkm secrets:show --stage ${stage}.`);
+		this.key = key;
+		this.stage = stage;
+		this.name = "SecretNotSet";
+	}
+};
+/** `gkm secrets:unset` on a stage that has no secrets at all. */
+var StageSecretsNotFound = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' has no secrets, so there is nothing to remove.`);
+		this.stage = stage;
+		this.name = "StageSecretsNotFound";
+	}
+};
+/**
+* Remove a custom secret from a stage, in the stage's own store — the file,
+* SSM or Secrets Manager. The rest of the stage is written back as it was.
+*
+* @throws {StageSecretsNotFound} when the stage holds no secrets
+* @throws {SecretNotSet} when it holds none by that key
+*/
+async function secretsUnsetCommand(key, options) {
+	const { stage } = options;
+	const store = await storeFor(stage);
+	const secrets = await store.read(stage);
+	if (!secrets) throw new StageSecretsNotFound(stage);
+	if (!(key in secrets.custom)) throw new SecretNotSet(key, stage);
+	const { [key]: _removed, ...custom } = secrets.custom;
+	await store.write(stage, {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		custom
+	});
+	logger$2.log(`\n✓ Secret "${key}" removed from stage "${stage}" (${store.name})`);
+}
 /**
 * A third party's credentials, checked against the schema of the construct
 * that reads them before they are stored — what the app would otherwise
@@ -10242,7 +10236,7 @@ async function assertCredentialValue(key, value, stage) {
 	}
 	const check = await (await require_credentialSchemas.loadCredentialSchemas({
 		root: workspace.root,
-		patterns: require_state.constructGlobs(workspace)
+		patterns: require_stale.constructGlobs(workspace)
 	})).check(key, value);
 	if (!check.ok) throw new require_credentialSchemas.CredentialsInvalid(stage, [{
 		key,
@@ -10268,7 +10262,7 @@ async function secretsShowCommand(options) {
 		logger$2.log(`    host: ${creds.host}`);
 		logger$2.log(`    port: ${creds.port}`);
 		logger$2.log(`    username: ${creds.username}`);
-		logger$2.log(`    password: ${reveal ? creds.password : require_state.maskPassword(creds.password)}`);
+		logger$2.log(`    password: ${reveal ? creds.password : require_stale.maskPassword(creds.password)}`);
 		if (creds.database) logger$2.log(`    database: ${creds.database}`);
 		if (creds.bucket) logger$2.log(`    bucket: ${creds.bucket}`);
 	}
@@ -10278,7 +10272,7 @@ async function secretsShowCommand(options) {
 	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
 	if (Object.keys(secrets.custom).length > 0) {
 		logger$2.log("\nCustom Secrets:");
-		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : require_state.maskPassword(value)}`);
+		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : require_stale.maskPassword(value)}`);
 	}
 	if (!reveal) logger$2.log("\nUse --reveal to show actual values");
 }
@@ -10358,7 +10352,7 @@ async function secretsImportCommand(file, options) {
 function maskUrl(url) {
 	try {
 		const parsed = new URL(url);
-		if (parsed.password) parsed.password = require_state.maskPassword(parsed.password);
+		if (parsed.password) parsed.password = require_stale.maskPassword(parsed.password);
 		return parsed.toString();
 	} catch {
 		return url;
@@ -10378,9 +10372,8 @@ const logger$1 = console;
 *
 * Orchestrates:
 * 1. Load workspace config
-* 2. Resolve secrets (local → SSM → generate fresh)
-* 3. Write docker/.env from secrets
-* 4. Start Docker services
+* 2. Resolve secrets (local → the stage's store → generate fresh)
+* 3. Start Docker services
 */
 async function setupCommand(options = {}) {
 	logger$1.log("\n🔧 Setting up the local environment...\n");
@@ -10393,20 +10386,13 @@ async function setupCommand(options = {}) {
 	}
 	const stage = options.stage ?? loadedConfig.workspace.stages.local;
 	const { workspace } = loadedConfig;
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
 	logger$1.log(`📦 Workspace: ${workspace.name}`);
 	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
 	logger$1.log(`🔑 Stage: ${stage}\n`);
-	const secrets = await resolveSecrets(stage, workspace, options);
-	if (!secrets) {
+	if (!await resolveSecrets(stage, workspace, options)) {
 		logger$1.error("❌ Failed to resolve secrets. Exiting.");
 		process.exit(1);
 	}
-	const containers = await require_state.derivedContainers(workspace, stage);
-	if (isMultiApp && containers.includes("postgres")) {
-		await writeDockerEnvFromSecrets(secrets, workspace.root);
-		logger$1.log("📄 Generated docker/.env with database passwords");
-	}
 	if (!options.skipDocker) {
 		logger$1.log("");
 		await reconcileLocal(workspace, stage, options);
@@ -10421,7 +10407,7 @@ async function setupCommand(options = {}) {
 * free and quiet.
 */
 async function reconcileLocal(workspace, stage, options) {
-	const result = await require_state.reconcileWorkspace(workspace, { stage });
+	const result = await require_stale.reconcileWorkspace(workspace, { stage });
 	if (result.plan.containers.length === 0) {
 		logger$1.log("🐳 No containers declared");
 		return;
@@ -10431,7 +10417,7 @@ async function reconcileLocal(workspace, stage, options) {
 		return;
 	}
 	logger$1.log("🐳 Services");
-	for (const line of require_state.describeServices(result.services)) logger$1.log(line);
+	for (const line of require_stale.describeServices(result.services)) logger$1.log(line);
 	const url = result.plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site" || r.kind === "file-server").map((r) => result.env[r.envKey]).find((address) => address?.startsWith("https://"));
 	if (url) await ensureTrusted(workspace.root, url, { ...options.yes ? { assumeYes: true } : {} });
 }
@@ -10448,11 +10434,11 @@ async function resolveSecrets(stage, workspace, options) {
 		logger$1.log("🔐 Generating fresh secrets (--force)...");
 		return generateFreshSecrets(stage, workspace);
 	}
-	const store = await require_state.secretsStoreFor(workspace, stage);
+	const store = await require_stale.secretsStoreFor(workspace, stage);
 	const secrets = await store.read(stage);
 	if (secrets) {
 		logger$1.log("🔐 Using existing secrets");
-		const reconciled = reconcileSecrets(secrets, workspace, await require_state.derivedContainers(workspace, stage));
+		const reconciled = reconcileSecrets(secrets, workspace, await require_stale.derivedContainers(workspace, stage));
 		if (reconciled) await store.write(stage, reconciled);
 		return reconciled ?? secrets;
 	}
@@ -10503,24 +10489,6 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 		logger$1.log(`   🔄 Adding missing service credentials: ${name}`);
 		changed = true;
 	}
-	if (result.services.postgres && !result.services.pgboss) {
-		result = {
-			...result,
-			services: {
-				...result.services,
-				pgboss: {
-					host: result.services.postgres.host,
-					port: result.services.postgres.port,
-					username: "pgboss",
-					password: generateSecurePassword(),
-					database: result.services.postgres.database ?? "app"
-				}
-			}
-		};
-		result.urls = generateConnectionUrls(result.services);
-		logger$1.log("   🔄 Adding missing service credentials: pgboss");
-		changed = true;
-	}
 	if (Object.keys(workspace.apps).length > 1) {
 		const expected = generateFullstackCustomSecrets(workspace, containers);
 		const missing = {};
@@ -10546,7 +10514,7 @@ function reconcileSecrets(secrets, workspace, containers = []) {
 /**
 * Build a fresh StageSecrets object for a workspace: service credentials,
 * connection URLs, and custom secrets. Pure — does not write to disk or touch
-* SSM. Service passwords are freshly randomized, so the result must be the same
+* any store. Service passwords are freshly randomized, so the result must be the same
 * one used to start the matching Docker containers.
 * @internal Exported for reuse by `gkm test` auto-setup.
 */
@@ -10572,9 +10540,9 @@ function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
 */
 async function ensureStageSecrets(stage, cwd = process.cwd()) {
 	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
-	const store = await require_state.secretsStoreFor(workspace, stage);
+	const store = await require_stale.secretsStoreFor(workspace, stage);
 	if (await store.read(stage)) return false;
-	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_state.derivedContainers(workspace, stage));
+	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_stale.derivedContainers(workspace, stage));
 	await store.write(stage, secrets);
 	return true;
 }
@@ -10582,8 +10550,8 @@ async function ensureStageSecrets(stage, cwd = process.cwd()) {
 * Generate fresh secrets for the workspace.
 */
 async function generateFreshSecrets(stage, workspace) {
-	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_state.derivedContainers(workspace, stage));
-	const store = await require_state.secretsStoreFor(workspace, stage);
+	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_stale.derivedContainers(workspace, stage));
+	const store = await require_stale.secretsStoreFor(workspace, stage);
 	await store.write(stage, secrets);
 	logger$1.log(`   Secrets written to the "${stage}" store (${store.name})`);
 	return secrets;
@@ -10623,7 +10591,7 @@ function printSummary(workspace, stage) {
 * A no-op when nothing is recorded — no run yet, or one already torn down —
 * so running it twice, or before a setup, is harmless.
 */
-async function dropTestDatabases(cwd, root, sql = require_state.pgClient) {
+async function dropTestDatabases(cwd, root, sql = require_stale.pgClient) {
 	const readyPath = (0, node_path.join)(cwd, require_ready.TEST_READY_FILE);
 	const ready = await readReady(readyPath);
 	const recorded = ready?.databases;
@@ -10631,9 +10599,9 @@ async function dropTestDatabases(cwd, root, sql = require_state.pgClient) {
 	const client = sql(recorded.port);
 	for (const name of recorded.names) {
 		if (!name.endsWith(`_test`)) throw new NotATestDatabase(name);
-		await client.query(void 0, `DROP DATABASE IF EXISTS ${require_state.quoteIdentifier(name)} WITH (FORCE)`);
+		await client.query(void 0, `DROP DATABASE IF EXISTS ${require_stale.quoteIdentifier(name)} WITH (FORCE)`);
 	}
-	await require_state.forgetState(root, require_workspace.TEST_STAGE);
+	await require_stale.forgetState(root, require_workspace.TEST_STAGE);
 	const { databases: _dropped, ...rest } = ready;
 	await (0, node_fs_promises.writeFile)(readyPath, JSON.stringify(rest, null, 2));
 	return recorded.names;
@@ -10673,10 +10641,10 @@ async function testCommand(options = {}) {
 		const { ensureStageSecrets } = await Promise.resolve().then(() => setup_exports);
 		if (await ensureStageSecrets(stage, cwd)) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
 	}
-	const defaultEnv = require_state.loadEnvFiles(".env");
+	const defaultEnv = require_stale.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	if (!options.prepare) await teardown(cwd);
-	const result = await require_state.prepareEntryCredentials({
+	const result = await require_stale.prepareEntryCredentials({
 		stage,
 		startDocker: !options.prepare,
 		secretsFileName: "test-secrets.json",
@@ -10697,14 +10665,14 @@ async function testCommand(options = {}) {
 	await (0, node_fs_promises.writeFile)(result.secretsJsonPath, JSON.stringify(finalCredentials, null, 2));
 	const gkmDir = (0, node_path.join)(cwd, ".gkm");
 	const preloadPath = (0, node_path.join)(gkmDir, "test-credentials-preload.ts");
-	await require_state.createCredentialsPreload(preloadPath, result.secretsJsonPath);
+	await require_stale.createCredentialsPreload(preloadPath, result.secretsJsonPath);
 	const workspace = await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
 	const manifestPath = workspace ? await require_ready.writeTestHarness({
 		root: workspace.root,
 		targets: [workspace.root, ...Object.values(workspace.apps).map((app) => (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path))],
-		patterns: require_state.constructGlobs(workspace),
-		cacheBackend: require_state.backendsOf(workspace).cache,
-		eventsBackend: require_state.backendsOf(workspace).events,
+		patterns: require_stale.constructGlobs(workspace),
+		cacheBackend: require_stale.backendsOf(workspace).cache,
+		eventsBackend: require_stale.backendsOf(workspace).events,
 		stage: require_workspace.TEST_STAGE,
 		env: finalCredentials,
 		factories: (0, node_path.join)(workspace.root, workspace.test.factories ?? "test/factories")
@@ -10767,8 +10735,8 @@ async function teardown(cwd) {
 * the plan provisions, on the port the shared container answers.
 */
 function testDatabases(reconciled) {
-	const port = reconciled?.ports[require_state.primaryPortKey("postgres")];
-	const names = reconciled ? require_state.postgresDatabaseNames(reconciled.plan) : [];
+	const port = reconciled?.ports[require_stale.primaryPortKey("postgres")];
+	const names = reconciled ? require_stale.postgresDatabaseNames(reconciled.plan) : [];
 	return port !== void 0 && names.length > 0 ? { databases: {
 		port,
 		names
@@ -10779,11 +10747,11 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-CgjlYeun.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-sny0NjKe.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-D1It5r_h.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
-		patterns: require_state.constructGlobs(workspace),
+		patterns: require_stale.constructGlobs(workspace),
 		cwd: workspace.root,
 		sources
 	});
@@ -11212,7 +11180,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-CgjlYeun.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-sny0NjKe.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11226,7 +11194,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-CgjlYeun.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-sny0NjKe.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11240,7 +11208,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-CgjlYeun.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-sny0NjKe.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11279,7 +11247,7 @@ program.command("docker").description("Generate Docker deployment files").option
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await require_state.dockerCommand(options);
+		await require_stale.dockerCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -11299,7 +11267,7 @@ program.command("prepack").description("Generate Docker files for production dep
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await require_state.dockerCommand({
+		await require_stale.dockerCommand({
 			build: options.build,
 			push: options.push,
 			tag: options.tag,
@@ -11330,11 +11298,21 @@ program.command("secrets:set").description("Set a custom secret for a stage").ar
 		process.exit(1);
 	}
 });
+program.command("secrets:unset").description("Remove a custom secret from a stage").argument("<key>", "Secret key (e.g., API_KEY)").requiredOption("--stage <stage>", "Stage name").action(async (key, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await secretsUnsetCommand(key, options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("secrets:add").description("Build the keys a stage must be given — buckets, mail, file servers, third parties' credentials — across every app").requiredOption("--stage <stage>", "Stage name").option("--missing", "Only the keys the stage has not set").option("--json", "Print the keys as JSON and ask nothing").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-CHBin8TF.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-DCsgtvDk.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11345,7 +11323,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-w-Ehh9DW.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-DY0na43R.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11356,7 +11334,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-w-Ehh9DW.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-DY0na43R.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11399,7 +11377,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./state-kA4Fkufx.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./stale-yu2FkH3G.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11408,7 +11386,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./state-kA4Fkufx.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./stale-yu2FkH3G.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11422,8 +11400,19 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		process.exit(1);
 	}
 });
+program.command("secrets:migrate").description("Copy a deployed stage's secrets from the configured store to another (file, ssm, secrets-manager)").requiredOption("--stage <stage>", "A deployed stage").requiredOption("--to <provider>", "file, ssm or secrets-manager").option("--region <region>", "The target's AWS region (default: the configured store's)").option("--profile <profile>", "AWS profile for the stage's account").option("--force", "Replace a stage the target already holds").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-31JXUOaG.cjs"));
+		await secretsMigrateCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-B4ktxAsM.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-ZpFTMbGw.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -11440,7 +11429,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-Dw-FW3X2.cjs")).then((n) => n.rollback_exports);
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-CpOWRR9H.cjs")).then((n) => n.rollback_exports);
 		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-BL5E0xbR.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -11476,7 +11465,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BGdJ-Lnm.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-Bmb45xUQ.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));