@geekmidas/cli 10.0.0-alpha.78 → 10.0.0-alpha.80

package/dist/index.cjs

@@ -7,7 +7,7 @@ const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-Bp8FEkF-.cjs");
 const require_config = require("./config.cjs");
-const require_stale = require("./stale-BsiPJI7Y.cjs");
+const require_seeds = require("./seeds-ZljwYV_p.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-CP6sBvQV.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-CajwOa5W.cjs");
@@ -15,8 +15,8 @@ const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
 const require_drivers = require("./drivers-BdvtCKc7.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
 const require_sniffer = require("./sniffer-BjG-1mlD.cjs");
-const require_deploy = require("./deploy-Dt42xiQA.cjs");
-const require_compose = require("./compose-B7MC19eC.cjs");
+const require_deploy = require("./deploy-Ppnh8MHS.cjs");
+const require_compose = require("./compose-Bn4OJONR.cjs");
 const require_credentialSchemas = require("./credentialSchemas-DCR4Wd1W.cjs");
 const require_LocalStateStore = require("./LocalStateStore-Bocb8dmZ.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
@@ -53,7 +53,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.78";
+var version = "10.0.0-alpha.80";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -304,7 +304,7 @@ function installation(platform, certificate) {
 */
 async function trustCommand(options = {}) {
 	const { workspace } = await require_config.loadWorkspaceConfig();
-	const certificate = (0, node_path.join)(workspace.root, require_stale.LOCAL_CA_PATH);
+	const certificate = (0, node_path.join)(workspace.root, require_seeds.LOCAL_CA_PATH);
 	if (!(0, node_fs.existsSync)(certificate)) throw new NoLocalAuthority(certificate);
 	const { describe, asks, steps } = installation(process.platform, certificate);
 	logger$7.log(`\n🔐 Trusting the local authority in ${describe}`);
@@ -1488,7 +1488,7 @@ async function serveFakes(fakes, ports) {
 	const served = [];
 	for (const [id, local] of Object.entries(fakes)) {
 		if (local.image) continue;
-		const port = ports[require_stale.fakeKey(id)];
+		const port = ports[require_seeds.fakeKey(id)];
 		if (port === void 0) continue;
 		const { handler } = (await import((0, node_url.pathToFileURL)(local.file).href)).default;
 		const server = serve({
@@ -1531,16 +1531,16 @@ var NoCommandSpecified = class extends Error {
 async function execCommand(commandArgs, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
-	const defaultEnv = require_stale.loadEnvFiles(".env");
+	const defaultEnv = require_seeds.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = require_stale.isImageBuild() ? await imageBuildEntry(cwd) : await require_stale.prepareEntryCredentials({ cwd });
+	const { credentials, secretsJsonPath, appName } = require_seeds.isImageBuild() ? await imageBuildEntry(cwd) : await require_seeds.prepareEntryCredentials({ cwd });
 	if (appName) logger$6.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0 && !require_stale.isImageBuild()) logger$6.log(`🔐 Loaded ${secretCount} secret(s)`);
+	if (secretCount > 0 && !require_seeds.isImageBuild()) logger$6.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const preloadDir = (0, node_path.join)(cwd, ".gkm");
 	await (0, node_fs_promises.mkdir)(preloadDir, { recursive: true });
 	const preloadPath = (0, node_path.join)(preloadDir, "credentials-preload.mjs");
-	await require_stale.createCredentialsPreload(preloadPath, secretsJsonPath);
+	await require_seeds.createCredentialsPreload(preloadPath, secretsJsonPath);
 	const [cmd, ...args] = commandArgs;
 	logger$6.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const nodeOptions = [(process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim(), `--import=${preloadPath}`].filter(Boolean).join(" ");
@@ -1568,7 +1568,7 @@ async function execCommand(commandArgs, options = {}) {
 * secret read and no address resolved.
 */
 async function imageBuildEntry(cwd) {
-	const credentials = require_stale.imageBuildCredentials();
+	const credentials = require_seeds.imageBuildCredentials();
 	logger$6.log(`🐳 Image build: ${Object.keys(credentials).length} public value(s) from the build args`);
 	const dir = (0, node_path.join)(cwd, ".gkm");
 	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
@@ -1649,7 +1649,7 @@ const SUBSCRIBERS_ENV = "GKM_SUBSCRIBERS";
 async function devCommand(options) {
 	if (options.subscribers === false) process.env[SUBSCRIBERS_ENV] = "off";
 	if (options.entry) return entryDevCommand(options);
-	const defaultEnv = require_stale.loadEnvFiles(".env");
+	const defaultEnv = require_seeds.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$5.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const appConfig = await require_config.loadAppConfig().catch((error) => {
 		if (error instanceof require_config.NotInAnApp || error instanceof require_config.NotABackendApp) return;
@@ -1665,7 +1665,7 @@ async function devCommand(options) {
 	const secretsRoot = appConfig.workspaceRoot;
 	const workspaceAppName = appConfig.appName;
 	const assigned = await require_appPorts.assignAppPorts(appConfig.workspace, [workspaceAppName], {
-		free: require_stale.isPortAvailable,
+		free: require_seeds.isPortAvailable,
 		holder: require_appPorts.holderOf
 	});
 	if (assigned.running.length > 0) throw new WorkspacePortsInUse(assigned.running);
@@ -1683,7 +1683,7 @@ async function devCommand(options) {
 		});
 	}
 	if (config.env) {
-		const { loaded, missing } = require_stale.loadEnvFiles(config.env, appRoot);
+		const { loaded, missing } = require_seeds.loadEnvFiles(config.env, appRoot);
 		if (loaded.length > 0) logger$5.log(`📦 Loaded env: ${loaded.join(", ")}`);
 		if (missing.length > 0) logger$5.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
@@ -1696,8 +1696,8 @@ async function devCommand(options) {
 		appRoot,
 		target: "server",
 		enableOpenApi,
-		cacheBackend: require_stale.cacheBackendFor(require_stale.providerOf(workspace ?? config)),
-		eventsBackend: require_stale.eventsBackendFor(require_stale.providerOf(workspace ?? config)),
+		cacheBackend: require_seeds.cacheBackendFor(require_seeds.providerOf(workspace ?? config)),
+		eventsBackend: require_seeds.eventsBackendFor(require_seeds.providerOf(workspace ?? config)),
 		telescope,
 		databaseApi: true,
 		hooks,
@@ -1711,16 +1711,16 @@ async function devCommand(options) {
 	let secretsJsonPath;
 	let publicUrl;
 	let manifest;
-	const appSecrets = await require_stale.loadSecretsForApp(workspace ? await require_stale.secretsStoreFor(workspace, config.stages.local) : new require_stale.FileSecretsStore(secretsRoot), config.stages.local);
+	const appSecrets = await require_seeds.loadSecretsForApp(workspace ? await require_seeds.secretsStoreFor(workspace, config.stages.local) : new require_seeds.FileSecretsStore(secretsRoot), config.stages.local);
 	if (workspace) {
-		const reconciled = await require_stale.reconcileWorkspace(workspace, {
+		const reconciled = await require_seeds.reconcileWorkspace(workspace, {
 			stage: workspace.stages.local,
 			...options.fake ? { fake: true } : {},
 			progress: (message) => logger$5.log(message)
 		});
 		if (reconciled.services.length > 0) {
 			logger$5.log("🐳 Services");
-			for (const line of require_stale.describeServices(reconciled.services)) logger$5.log(line);
+			for (const line of require_seeds.describeServices(reconciled.services)) logger$5.log(line);
 		}
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_derive.appKey(r.id) === workspaceAppName);
@@ -1999,8 +1999,8 @@ async function validateFrontendApps(workspace) {
 async function loadDevSecrets(workspace) {
 	if (!workspace.secrets.enabled) return {};
 	const stage = workspace.stages.local;
-	const secrets = await (await require_stale.secretsStoreFor(workspace, stage)).read(stage);
-	if (secrets) return require_stale.toEmbeddableSecrets(secrets);
+	const secrets = await (await require_seeds.secretsStoreFor(workspace, stage)).read(stage);
+	if (secrets) return require_seeds.toEmbeddableSecrets(secrets);
 	return {};
 }
 /**
@@ -2015,7 +2015,7 @@ async function loadDevSecrets(workspace) {
 async function workspaceDevCommand(configured, options) {
 	const scoped = options.app ? [options.app] : options.filter ? [] : Object.keys(configured.apps);
 	const assigned = await require_appPorts.assignAppPorts(configured, scoped, {
-		free: require_stale.isPortAvailable,
+		free: require_seeds.isPortAvailable,
 		holder: require_appPorts.holderOf
 	});
 	if (assigned.running.length > 0) throw new WorkspacePortsInUse(assigned.running);
@@ -2042,14 +2042,14 @@ async function workspaceDevCommand(configured, options) {
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
 	}
 	const rawSecrets = await loadDevSecrets(workspace);
-	const reconciled = await require_stale.reconcileWorkspace(workspace, {
+	const reconciled = await require_seeds.reconcileWorkspace(workspace, {
 		stage: workspace.stages.local,
 		...options.fake ? { fake: true } : {},
 		progress: (message) => logger$5.log(message)
 	});
 	if (reconciled.services.length > 0) {
 		logger$5.log("🐳 Services");
-		for (const line of require_stale.describeServices(reconciled.services)) logger$5.log(line);
+		for (const line of require_seeds.describeServices(reconciled.services)) logger$5.log(line);
 	}
 	const secretsEnv = {
 		...rawSecrets,
@@ -2059,9 +2059,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-Cgoy58Sh.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-DkB833Jj.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-Cgoy58Sh.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-DkB833Jj.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2147,7 +2147,7 @@ async function workspaceDevCommand(configured, options) {
 		...secretsEnv,
 		NODE_ENV: "development",
 		...configPath ? { GKM_CONFIG_PATH: configPath } : {},
-		...options.fake ? { [require_stale.FAKE_ENV]: "1" } : {},
+		...options.fake ? { [require_seeds.FAKE_ENV]: "1" } : {},
 		[DISCOVERY_QUIET_ENV]: "1"
 	};
 	logger$5.log(`🚀 Starting ${appCount} app(s) — each builds before it answers, and says so when it is ready`);
@@ -2210,16 +2210,16 @@ async function entryDevCommand(options) {
 	if (!entry) throw new Error("--entry requires a file path");
 	const entryPath = (0, node_path.resolve)(process.cwd(), entry);
 	if (!(0, node_fs.existsSync)(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
-	const defaultEnv = require_stale.loadEnvFiles(".env");
+	const defaultEnv = require_seeds.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$5.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_stale.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
+	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_seeds.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
 	if (appName) logger$5.log(`📦 App: ${appName} (port ${resolvedPort})`);
 	logger$5.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
 	if (Object.keys(credentials).length > 1) logger$5.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
 	const wrapperDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(wrapperDir, { recursive: true });
 	const wrapperPath = (0, node_path.join)(wrapperDir, "entry-wrapper.ts");
-	await require_stale.createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
+	await require_seeds.createEntryWrapper(wrapperPath, entryPath, secretsJsonPath);
 	const runner = new EntryRunner(wrapperPath, entryPath, watch, resolvedPort);
 	await runner.start();
 	let isShuttingDown = false;
@@ -2528,10 +2528,10 @@ var DevServer = class {
 		this.startTime = Date.now();
 		if (this.isRunning) await this.stop();
 		if (this.portExplicit) {
-			if (!await require_stale.isPortAvailable(this.requestedPort)) throw new DevPortInUse(this.requestedPort, listenerOn(this.requestedPort));
+			if (!await require_seeds.isPortAvailable(this.requestedPort)) throw new DevPortInUse(this.requestedPort, listenerOn(this.requestedPort));
 			this.actualPort = this.requestedPort;
 		} else {
-			this.actualPort = await require_stale.findAvailablePort(this.requestedPort);
+			this.actualPort = await require_seeds.findAvailablePort(this.requestedPort);
 			if (this.actualPort !== this.requestedPort) logger$5.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
 		const serverEntryPath = (0, node_path.join)(this.appRoot, ".gkm", "server", "server.ts");
@@ -2602,7 +2602,7 @@ var DevServer = class {
 		await this.stop();
 		let attempts = 0;
 		while (attempts < 30) {
-			if (await require_stale.isPortAvailable(portToReuse)) break;
+			if (await require_seeds.isPortAvailable(portToReuse)) break;
 			await new Promise((resolve) => setTimeout(resolve, 100));
 			attempts++;
 		}
@@ -2943,7 +2943,7 @@ async function buildCommand(options) {
 		}
 	}
 	const config = loadedConfig.type !== "workspace" ? await require_config.loadConfig() : (0, node_path.resolve)(process.cwd()) === (0, node_path.resolve)(loadedConfig.workspace.root) ? rootGkmConfig(loadedConfig.workspace) : (await require_config.loadAppConfig()).gkmConfig;
-	const target = options.provider ?? require_stale.providerOf(loadedConfig.workspace);
+	const target = options.provider ?? require_seeds.providerOf(loadedConfig.workspace);
 	const workspaceRoot = loadedConfig.workspace.root;
 	const appRoot = process.cwd();
 	const output = await buildOneApp({
@@ -2975,15 +2975,15 @@ async function declaredIn(config, cwd) {
 */
 function backendsOf(workspace) {
 	return {
-		cache: require_stale.cacheBackendFor(require_stale.providerOf(workspace)),
+		cache: require_seeds.cacheBackendFor(require_seeds.providerOf(workspace)),
 		email: "ses"
 	};
 }
 /** One app's build, from its config and the command's options. */
 async function buildOneApp(input) {
 	const { config, options, workspace, appRoot, target } = input;
-	const cacheBackend = options.cache ?? require_stale.cacheBackendFor(require_stale.providerOf(workspace));
-	const eventsBackend = require_stale.eventsBackendFor(require_stale.providerOf(workspace));
+	const cacheBackend = options.cache ?? require_seeds.cacheBackendFor(require_seeds.providerOf(workspace));
+	const eventsBackend = require_seeds.eventsBackendFor(require_seeds.providerOf(workspace));
 	const production = normalizeProductionConfig(options.production ?? false);
 	if (production) logger$4.log(`🏭 Building for PRODUCTION`);
 	logger$4.log(`Building for ${target}`);
@@ -3069,7 +3069,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = (0, node_path.join)(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C6T-1OLT.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BlbSLFLn.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3113,9 +3113,9 @@ async function buildApp(input) {
 	};
 	const endpointGenerator = new require_EndpointGenerator.EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
-	const cronGenerator = new require_stale.CronGenerator();
+	const cronGenerator = new require_seeds.CronGenerator();
 	const subscriberGenerator = new require_SubscriberGenerator.SubscriberGenerator();
-	const queueGenerator = new require_stale.QueueGenerator();
+	const queueGenerator = new require_seeds.QueueGenerator();
 	const topicGenerator = new TopicGenerator();
 	const code = constructGlobs;
 	const [loadedEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics] = await Promise.all([
@@ -3154,7 +3154,7 @@ async function buildApp(input) {
 		const appName = Object.entries(input.workspace.apps).find(([, app]) => (0, node_path.resolve)(input.workspace.root, app.path) === (0, node_path.resolve)(appRoot))?.[0];
 		await buildWorkers({
 			context: buildContext,
-			workers: require_stale.workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName),
+			workers: require_seeds.workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName),
 			serverDir: (0, node_path.join)(appRoot, ".gkm", "server"),
 			crons: allCrons,
 			queues: allQueues,
@@ -3177,7 +3177,7 @@ async function buildApp(input) {
 * runnables built from that worker, and nothing built from another.
 */
 async function buildWorkers(input) {
-	const generator = new require_stale.WorkerGenerator();
+	const generator = new require_seeds.WorkerGenerator();
 	for (const worker of input.workers) {
 		const owned = (list) => list.filter(({ construct }) => construct.owner === worker.id);
 		const crons = owned(input.crons);
@@ -3186,15 +3186,15 @@ async function buildWorkers(input) {
 		const entryPoint = await generator.build({
 			context: input.context,
 			workerId: worker.id,
-			outputDir: require_stale.workerEntryDir(input.serverDir, worker.id),
+			outputDir: require_seeds.workerEntryDir(input.serverDir, worker.id),
 			crons,
 			queues,
 			subscribers
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C6T-1OLT.cjs"));
-		const outfile = require_stale.workerBundleName(worker.id);
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BlbSLFLn.cjs"));
+		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
 			outputDir: (0, node_path.join)(input.serverDir, "dist"),
@@ -3263,7 +3263,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-C6T-1OLT.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BlbSLFLn.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3394,7 +3394,7 @@ async function workspaceBuildCommand(workspace, options) {
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
 	logger$4.log(`   Build order: ${buildOrder.join(" → ")}`);
 	try {
-		const target = options.provider ?? require_stale.providerOf(workspace);
+		const target = options.provider ?? require_seeds.providerOf(workspace);
 		const builds = [];
 		for (const appName of buildOrder) {
 			const app = workspace.apps[appName];
@@ -3517,14 +3517,14 @@ async function composeCommand(options, deps = {}) {
 	if (options.push && !options.build) throw new require_compose.ComposePushNeedsBuild();
 	const pulls = !options.build && (options.pull || options.tag !== void 0);
 	if (options.digestsFile && !options.push && !pulls) throw new require_compose.ComposePinNeedsPull();
-	const allowDevServices = require_stale.parseDevServices(options.allowDevServices);
+	const allowDevServices = require_seeds.parseDevServices(options.allowDevServices);
 	const cwd = (0, node_path.resolve)(options.cwd ?? process.cwd());
 	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
 	const { stage } = options;
 	if (options.down) {
 		const override = require_compose.stackOverrideFile(workspace.root, stage);
 		const ref = {
-			project: require_compose.composeProject(require_stale.deployIdentity(workspace, stage)),
+			project: require_compose.composeProject(require_seeds.deployIdentity(workspace, stage)),
 			file: (0, node_path.join)(workspace.root, require_compose.stackDir(stage), "docker-compose.yml"),
 			...(0, node_fs.existsSync)(override) ? { overrides: [override] } : {},
 			cwd: workspace.root
@@ -4965,25 +4965,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.78",
-	"@geekmidas/auth": "~10.0.0-alpha.78",
-	"@geekmidas/cache": "~10.0.0-alpha.78",
-	"@geekmidas/client": "~10.0.0-alpha.78",
-	"@geekmidas/cloud": "~10.0.0-alpha.78",
-	"@geekmidas/constructs": "~10.0.0-alpha.78",
-	"@geekmidas/db": "~10.0.0-alpha.78",
-	"@geekmidas/emailkit": "~10.0.0-alpha.78",
-	"@geekmidas/envkit": "~10.0.0-alpha.78",
-	"@geekmidas/errors": "~10.0.0-alpha.78",
-	"@geekmidas/events": "~10.0.0-alpha.78",
-	"@geekmidas/logger": "~10.0.0-alpha.78",
-	"@geekmidas/manifest": "~10.0.0-alpha.78",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.78",
-	"@geekmidas/schema": "~10.0.0-alpha.78",
-	"@geekmidas/services": "~10.0.0-alpha.78",
-	"@geekmidas/storage": "~10.0.0-alpha.78",
-	"@geekmidas/telescope": "~10.0.0-alpha.78",
-	"@geekmidas/testkit": "~10.0.0-alpha.78",
+	"@geekmidas/audit": "~10.0.0-alpha.80",
+	"@geekmidas/auth": "~10.0.0-alpha.80",
+	"@geekmidas/cache": "~10.0.0-alpha.80",
+	"@geekmidas/client": "~10.0.0-alpha.80",
+	"@geekmidas/cloud": "~10.0.0-alpha.80",
+	"@geekmidas/constructs": "~10.0.0-alpha.80",
+	"@geekmidas/db": "~10.0.0-alpha.80",
+	"@geekmidas/emailkit": "~10.0.0-alpha.80",
+	"@geekmidas/envkit": "~10.0.0-alpha.80",
+	"@geekmidas/errors": "~10.0.0-alpha.80",
+	"@geekmidas/events": "~10.0.0-alpha.80",
+	"@geekmidas/logger": "~10.0.0-alpha.80",
+	"@geekmidas/manifest": "~10.0.0-alpha.80",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.80",
+	"@geekmidas/schema": "~10.0.0-alpha.80",
+	"@geekmidas/services": "~10.0.0-alpha.80",
+	"@geekmidas/storage": "~10.0.0-alpha.80",
+	"@geekmidas/telescope": "~10.0.0-alpha.80",
+	"@geekmidas/testkit": "~10.0.0-alpha.80",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5566,7 +5566,7 @@ function deploy(options) {
           role-to-assume: \${{ vars.AWS_ROLE_ARN }}
           aws-region: ${options.region}
 ` : "";
-	const keyDir = `~/.gkm/keys/${require_stale.projectKey({ name: options.name })}`;
+	const keyDir = `~/.gkm/keys/${require_seeds.projectKey({ name: options.name })}`;
 	const stageSecrets = sst ? credentials : `
       # The stage's secrets are kept in the encrypted .gkm/secrets/<stage>.json,
       # and each environment holds its key as GKM_SECRETS_KEY. .gkm/ is
@@ -9902,11 +9902,11 @@ async function initCommand(projectName, options = {}) {
 	}
 	devSecrets.custom = customSecrets;
 	const keys = {
-		key: require_stale.projectKey({ name }),
+		key: require_seeds.projectKey({ name }),
 		legacy: [(0, node_path.basename)(targetDir)]
 	};
-	await new require_stale.FileSecretsStore(targetDir, keys).write(local, devSecrets);
-	const keyPath = require_stale.getKeyPath(local, keys);
+	await new require_seeds.FileSecretsStore(targetDir, keys).write(local, devSecrets);
+	const keyPath = require_seeds.getKeyPath(local, keys);
 	console.log(`  Secrets: .gkm/secrets/${local}.json (encrypted)`);
 	console.log(`  Key: ${keyPath}\n`);
 	if (!options.skipInstall) {
@@ -10101,9 +10101,9 @@ const logger$2 = console;
 */
 async function storeFor(stage) {
 	try {
-		return await require_stale.secretsStoreFor(await require_config.loadWorkspaceSettings(), stage);
+		return await require_seeds.secretsStoreFor(await require_config.loadWorkspaceSettings(), stage);
 	} catch (error) {
-		if (error instanceof require_config.ConfigNotFound) return new require_stale.FileSecretsStore(process.cwd());
+		if (error instanceof require_config.ConfigNotFound) return new require_seeds.FileSecretsStore(process.cwd());
 		throw error;
 	}
 }
@@ -10174,7 +10174,7 @@ async function secretsSetCommand(key, value, options) {
 		process.exit(1);
 	}
 	await assertCredentialValue(key, secretValue, stage);
-	await store.write(stage, require_stale.withCustomSecret(secrets, key, secretValue));
+	await store.write(stage, require_seeds.withCustomSecret(secrets, key, secretValue));
 	logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}" (${store.name})`);
 }
 /** `gkm secrets:unset` for a key the stage does not hold. */
@@ -10237,7 +10237,7 @@ async function assertCredentialValue(key, value, stage) {
 	}
 	const check = await (await require_credentialSchemas.loadCredentialSchemas({
 		root: workspace.root,
-		patterns: require_stale.constructGlobs(workspace)
+		patterns: require_seeds.constructGlobs(workspace)
 	})).check(key, value);
 	if (!check.ok) throw new require_credentialSchemas.CredentialsInvalid(stage, [{
 		key,
@@ -10263,7 +10263,7 @@ async function secretsShowCommand(options) {
 		logger$2.log(`    host: ${creds.host}`);
 		logger$2.log(`    port: ${creds.port}`);
 		logger$2.log(`    username: ${creds.username}`);
-		logger$2.log(`    password: ${reveal ? creds.password : require_stale.maskPassword(creds.password)}`);
+		logger$2.log(`    password: ${reveal ? creds.password : require_seeds.maskPassword(creds.password)}`);
 		if (creds.database) logger$2.log(`    database: ${creds.database}`);
 		if (creds.bucket) logger$2.log(`    bucket: ${creds.bucket}`);
 	}
@@ -10273,7 +10273,7 @@ async function secretsShowCommand(options) {
 	if (secrets.urls.STORAGE_ENDPOINT) logger$2.log(`  STORAGE_ENDPOINT: ${secrets.urls.STORAGE_ENDPOINT}`);
 	if (Object.keys(secrets.custom).length > 0) {
 		logger$2.log("\nCustom Secrets:");
-		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : require_stale.maskPassword(value)}`);
+		for (const [key, value] of Object.entries(secrets.custom)) logger$2.log(`  ${key}: ${reveal ? value : require_seeds.maskPassword(value)}`);
 	}
 	if (!reveal) logger$2.log("\nUse --reveal to show actual values");
 }
@@ -10353,7 +10353,7 @@ async function secretsImportCommand(file, options) {
 function maskUrl(url) {
 	try {
 		const parsed = new URL(url);
-		if (parsed.password) parsed.password = require_stale.maskPassword(parsed.password);
+		if (parsed.password) parsed.password = require_seeds.maskPassword(parsed.password);
 		return parsed.toString();
 	} catch {
 		return url;
@@ -10408,7 +10408,7 @@ async function setupCommand(options = {}) {
 * free and quiet.
 */
 async function reconcileLocal(workspace, stage, options) {
-	const result = await require_stale.reconcileWorkspace(workspace, { stage });
+	const result = await require_seeds.reconcileWorkspace(workspace, { stage });
 	if (result.plan.containers.length === 0) {
 		logger$1.log("🐳 No containers declared");
 		return;
@@ -10418,7 +10418,7 @@ async function reconcileLocal(workspace, stage, options) {
 		return;
 	}
 	logger$1.log("🐳 Services");
-	for (const line of require_stale.describeServices(result.services)) logger$1.log(line);
+	for (const line of require_seeds.describeServices(result.services)) logger$1.log(line);
 	const url = result.plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site" || r.kind === "file-server").map((r) => result.env[r.envKey]).find((address) => address?.startsWith("https://"));
 	if (url) await ensureTrusted(workspace.root, url, { ...options.yes ? { assumeYes: true } : {} });
 }
@@ -10435,11 +10435,11 @@ async function resolveSecrets(stage, workspace, options) {
 		logger$1.log("🔐 Generating fresh secrets (--force)...");
 		return generateFreshSecrets(stage, workspace);
 	}
-	const store = await require_stale.secretsStoreFor(workspace, stage);
+	const store = await require_seeds.secretsStoreFor(workspace, stage);
 	const secrets = await store.read(stage);
 	if (secrets) {
 		logger$1.log("🔐 Using existing secrets");
-		const reconciled = reconcileSecrets(secrets, workspace, await require_stale.derivedContainers(workspace, stage));
+		const reconciled = reconcileSecrets(secrets, workspace, await require_seeds.derivedContainers(workspace, stage));
 		if (reconciled) await store.write(stage, reconciled);
 		return reconciled ?? secrets;
 	}
@@ -10541,9 +10541,9 @@ function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
 */
 async function ensureStageSecrets(stage, cwd = process.cwd()) {
 	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
-	const store = await require_stale.secretsStoreFor(workspace, stage);
+	const store = await require_seeds.secretsStoreFor(workspace, stage);
 	if (await store.read(stage)) return false;
-	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_stale.derivedContainers(workspace, stage));
+	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_seeds.derivedContainers(workspace, stage));
 	await store.write(stage, secrets);
 	return true;
 }
@@ -10551,8 +10551,8 @@ async function ensureStageSecrets(stage, cwd = process.cwd()) {
 * Generate fresh secrets for the workspace.
 */
 async function generateFreshSecrets(stage, workspace) {
-	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_stale.derivedContainers(workspace, stage));
-	const store = await require_stale.secretsStoreFor(workspace, stage);
+	const secrets = createFreshWorkspaceSecrets(stage, workspace, await require_seeds.derivedContainers(workspace, stage));
+	const store = await require_seeds.secretsStoreFor(workspace, stage);
 	await store.write(stage, secrets);
 	logger$1.log(`   Secrets written to the "${stage}" store (${store.name})`);
 	return secrets;
@@ -10592,7 +10592,7 @@ function printSummary(workspace, stage) {
 * A no-op when nothing is recorded — no run yet, or one already torn down —
 * so running it twice, or before a setup, is harmless.
 */
-async function dropTestDatabases(cwd, root, sql = require_stale.pgClient) {
+async function dropTestDatabases(cwd, root, sql = require_seeds.pgClient) {
 	const readyPath = (0, node_path.join)(cwd, require_ready.TEST_READY_FILE);
 	const ready = await readReady(readyPath);
 	const recorded = ready?.databases;
@@ -10600,9 +10600,9 @@ async function dropTestDatabases(cwd, root, sql = require_stale.pgClient) {
 	const client = sql(recorded.port);
 	for (const name of recorded.names) {
 		if (!name.endsWith(`_test`)) throw new NotATestDatabase(name);
-		await client.query(void 0, `DROP DATABASE IF EXISTS ${require_stale.quoteIdentifier(name)} WITH (FORCE)`);
+		await client.query(void 0, `DROP DATABASE IF EXISTS ${require_seeds.quoteIdentifier(name)} WITH (FORCE)`);
 	}
-	await require_stale.forgetState(root, require_workspace.TEST_STAGE);
+	await require_seeds.forgetState(root, require_workspace.TEST_STAGE);
 	const { databases: _dropped, ...rest } = ready;
 	await (0, node_fs_promises.writeFile)(readyPath, JSON.stringify(rest, null, 2));
 	return recorded.names;
@@ -10642,10 +10642,10 @@ async function testCommand(options = {}) {
 		const { ensureStageSecrets } = await Promise.resolve().then(() => setup_exports);
 		if (await ensureStageSecrets(stage, cwd)) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
 	}
-	const defaultEnv = require_stale.loadEnvFiles(".env");
+	const defaultEnv = require_seeds.loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	if (!options.prepare) await teardown(cwd);
-	const result = await require_stale.prepareEntryCredentials({
+	const result = await require_seeds.prepareEntryCredentials({
 		stage,
 		startDocker: !options.prepare,
 		secretsFileName: "test-secrets.json",
@@ -10666,14 +10666,14 @@ async function testCommand(options = {}) {
 	await (0, node_fs_promises.writeFile)(result.secretsJsonPath, JSON.stringify(finalCredentials, null, 2));
 	const gkmDir = (0, node_path.join)(cwd, ".gkm");
 	const preloadPath = (0, node_path.join)(gkmDir, "test-credentials-preload.ts");
-	await require_stale.createCredentialsPreload(preloadPath, result.secretsJsonPath);
+	await require_seeds.createCredentialsPreload(preloadPath, result.secretsJsonPath);
 	const workspace = await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
 	const manifestPath = workspace ? await require_ready.writeTestHarness({
 		root: workspace.root,
 		targets: [workspace.root, ...Object.values(workspace.apps).map((app) => (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path))],
-		patterns: require_stale.constructGlobs(workspace),
-		cacheBackend: require_stale.backendsOf(workspace).cache,
-		eventsBackend: require_stale.backendsOf(workspace).events,
+		patterns: require_seeds.constructGlobs(workspace),
+		cacheBackend: require_seeds.backendsOf(workspace).cache,
+		eventsBackend: require_seeds.backendsOf(workspace).events,
 		stage: require_workspace.TEST_STAGE,
 		env: finalCredentials,
 		factories: (0, node_path.join)(workspace.root, workspace.test.factories ?? "test/factories")
@@ -10736,8 +10736,8 @@ async function teardown(cwd) {
 * the plan provisions, on the port the shared container answers.
 */
 function testDatabases(reconciled) {
-	const port = reconciled?.ports[require_stale.primaryPortKey("postgres")];
-	const names = reconciled ? require_stale.postgresDatabaseNames(reconciled.plan) : [];
+	const port = reconciled?.ports[require_seeds.primaryPortKey("postgres")];
+	const names = reconciled ? require_seeds.postgresDatabaseNames(reconciled.plan) : [];
 	return port !== void 0 && names.length > 0 ? { databases: {
 		port,
 		names
@@ -10748,11 +10748,11 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-Cgoy58Sh.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-DkB833Jj.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-D1It5r_h.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
-		patterns: require_stale.constructGlobs(workspace),
+		patterns: require_seeds.constructGlobs(workspace),
 		cwd: workspace.root,
 		sources
 	});
@@ -11181,7 +11181,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-Cgoy58Sh.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-DkB833Jj.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11195,7 +11195,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-Cgoy58Sh.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-DkB833Jj.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11209,7 +11209,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-Cgoy58Sh.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-DkB833Jj.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11248,7 +11248,7 @@ program.command("docker").description("Generate Docker deployment files").option
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await require_stale.dockerCommand(options);
+		await require_seeds.dockerCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -11268,7 +11268,7 @@ program.command("prepack").description("Generate Docker files for production dep
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await require_stale.dockerCommand({
+		await require_seeds.dockerCommand({
 			build: options.build,
 			push: options.push,
 			tag: options.tag,
@@ -11313,7 +11313,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-BvOICikp.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-DJ0VE-y-.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11324,7 +11324,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CbMI24fI.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CAyR6D7B.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11335,7 +11335,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CbMI24fI.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CAyR6D7B.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11378,7 +11378,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./stale-BsiPJI7Y.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-ZljwYV_p.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11387,7 +11387,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./stale-BsiPJI7Y.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-ZljwYV_p.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11405,7 +11405,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-B4GBvCNY.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-iEdyEx4S.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11413,7 +11413,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-K6Vj_pPW.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-BkNZBe_-.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -11430,7 +11430,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-F3P-rA-r.cjs")).then((n) => n.rollback_exports);
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-CgYUPLbq.cjs")).then((n) => n.rollback_exports);
 		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-BL5E0xbR.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -11466,7 +11466,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-D9vGqdLk.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BLjU59Ye.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));