@geekmidas/cli 10.0.0-alpha.80 → 10.0.0-alpha.82

package/dist/index.mjs

@@ -4,22 +4,22 @@ import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs"
 import { c as getDokployCredentials, f as removeDokployCredentials, i as LocalSandbox, l as getDokployRegistryId, m as storeHostingerToken, p as storeDokployCredentials, s as getCredentialsPath, u as getDokployToken } from "./credentials-pAtB70k3.mjs";
 import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { A as deployedProblems, D as InvalidStages, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-BBdqmkch.mjs";
+import { A as deployedProblems, D as InvalidStages, I as resolveLogs, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-BBdqmkch.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { $ as constructGlobs, $t as getKeyPath, At as imageBuildCredentials, Bt as primaryPortKey, G as workerUnits, Gt as loadEnvFiles, Ht as createEntryWrapper, J as workerEntryDir, K as WorkerGenerator, Kt as loadSecretsForApp, Lt as describeServices, Mt as cacheBackendFor, Nt as eventsBackendFor, Pt as providerOf, Q as backendsOf$1, Qt as FileSecretsStore, Rt as fakeKey, S as dockerCommand, Ut as findAvailablePort, V as parseDevServices, Vt as createCredentialsPreload, Wt as isPortAvailable, X as CronGenerator, Y as QueueGenerator, Yt as secretsStoreFor, Z as FAKE_ENV, dt as quoteIdentifier, et as derivedContainers, fn as maskPassword, hn as withCustomSecret, in as deployIdentity, it as forgetState, jt as isImageBuild, lt as postgresDatabaseNames, mn as toEmbeddableSecrets, mt as pgClient, q as workerBundleName, qt as prepareEntryCredentials, rt as LOCAL_CA_PATH, tn as projectKey, tt as reconcileWorkspace } from "./seeds-BdkFpW0P.mjs";
-import { i as telemetryFor, n as runtimeFor, t as EndpointGenerator } from "./EndpointGenerator-DftalLYg.mjs";
+import { B as WorkerGenerator, Ct as postgresDatabaseNames, F as parseDevServices, Fn as withCustomSecret, G as FAKE_ENV, Gt as imageBuildCredentials, H as workerEntryDir, J as derivedContainers, Jt as eventsBackendFor, K as backendsOf$1, Kt as isImageBuild, Mn as maskPassword, Pn as toEmbeddableSecrets, Tt as quoteIdentifier, U as QueueGenerator, V as workerBundleName, W as CronGenerator, Y as reconcileWorkspace, Yt as providerOf, Zt as CLUSTER_DATABASE, _t as LOCAL_CA_PATH, an as primaryPortKey, cn as findAvailablePort, dn as loadPortState, et as readLocalCredentials, fn as loadSecretsForApp, hn as secretsStoreFor, in as portsOf, kt as pgClient, ln as isPortAvailable, nn as fakeKey, on as createCredentialsPreload, pn as prepareEntryCredentials, q as constructGlobs, qt as cacheBackendFor, sn as createEntryWrapper, tn as describeServices, un as loadEnvFiles, vn as FileSecretsStore, vt as forgetState, wn as deployIdentity, x as dockerCommand, xn as projectKey, yn as getKeyPath, z as workerUnits } from "./seeds-DbyqaXW4.mjs";
+import { a as parseTelemetryFlag, i as telemetryFor, n as runtimeFor, t as EndpointGenerator } from "./EndpointGenerator-DtnIGafh.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-5looQ3gB.mjs";
+import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-DQZeGkDW.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-Ch1rJitn.mjs";
+import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-B4RP2B2O.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
 import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi, x as keyFingerprint } from "./sniffer-ByWtH28i.mjs";
-import { t as deploy$1 } from "./deploy-DK4Y6ev4.mjs";
-import { a as stackOverrideFile, c as parseDigests, d as removeEdgeRoutes, f as EDGE_PROJECT, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, p as dockerCompose, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as edgeDir } from "./compose-n7K8H5j8.mjs";
+import { t as deploy$1 } from "./deploy-C00DAKOt.mjs";
+import { a as stackOverrideFile, c as parseDigests, d as removeEdgeRoutes, f as EDGE_PROJECT, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, p as dockerCompose, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as edgeDir } from "./compose-D4sD4Lgr.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJqRJNK4.mjs";
 import { t as LocalStateStore } from "./LocalStateStore-C72bwpG2.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
-import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-ZZoNskrr.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-DhZbZtFw.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Command, Option } from "commander";
@@ -47,7 +47,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.80";
+var version = "10.0.0-alpha.82";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -234,6 +234,91 @@ function maskToken(token) {
 	return `${token.slice(0, 4)}...${token.slice(-4)}`;
 }
 //#endregion
+//#region src/reconcile/serviceLogins.ts
+/**
+* Where to sign in to each local service, and as whom — what `gkm dev`
+* prints with its other addresses and `gkm dev:credentials` prints alone.
+*
+* Only the services a person opens or connects a client to: Postgres, the
+* MinIO console, Mailpit's inbox, Redis and its HTTP proxy, RabbitMQ's
+* console, the AWS emulator — and OpenObserve, where `gkm compose` runs it
+* for the local stage.
+*/
+/** Each running service's address and login, in a stable order. */
+function serviceLogins(options) {
+	const { containers, ports, credentials } = options;
+	const has = (container, key) => containers.includes(container) && ports[key] !== void 0;
+	const logins = [];
+	if (has("postgres", "postgres")) {
+		const { user, password } = credentials.postgres;
+		logins.push({
+			service: "postgres",
+			label: "Postgres",
+			url: `postgres://${user}:${encodeURIComponent(password)}@localhost:${ports.postgres}/${CLUSTER_DATABASE}`,
+			user,
+			password
+		});
+	}
+	if (has("minio", "minio-console")) logins.push({
+		service: "minio",
+		label: "MinIO console",
+		url: `http://localhost:${ports["minio-console"]}`,
+		...credentials.minio,
+		...ports.minio !== void 0 ? { note: `S3 API on http://localhost:${ports.minio}` } : {}
+	});
+	if (has("mailpit", "mailpit-web")) logins.push({
+		service: "mailpit",
+		label: "Mailpit inbox",
+		url: `http://localhost:${ports["mailpit-web"]}`,
+		note: "no login"
+	});
+	if (has("redis", "redis")) logins.push({
+		service: "redis",
+		label: "Redis",
+		url: `redis://:${encodeURIComponent(credentials.redis.password)}@localhost:${ports.redis}`,
+		password: credentials.redis.password
+	});
+	if (has("redis-http", "redis-http")) logins.push({
+		service: "redis-http",
+		label: "Cache (HTTP)",
+		url: `http://localhost:${ports["redis-http"]}`,
+		password: credentials.cacheToken,
+		note: "the password is its bearer token"
+	});
+	if (has("rabbitmq", "rabbitmq-management")) logins.push({
+		service: "rabbitmq",
+		label: "RabbitMQ console",
+		url: `http://localhost:${ports["rabbitmq-management"]}`,
+		...credentials.rabbitmq
+	});
+	if (has("localstack", "localstack")) logins.push({
+		service: "localstack",
+		label: "AWS emulator",
+		url: `http://localhost:${ports.localstack}`,
+		user: credentials.emulator.accessKeyId,
+		password: credentials.emulator.secretAccessKey,
+		note: "access key id / secret access key"
+	});
+	if (options.logs) logins.push({
+		service: "openobserve",
+		label: "OpenObserve",
+		url: options.logs.url,
+		user: credentials.logs.email,
+		password: credentials.logs.password,
+		note: `when running: ${options.logs.via}`
+	});
+	return logins;
+}
+/** The lines `gkm dev` and `gkm dev:credentials` print, one per service. */
+function describeLogins(logins) {
+	const width = Math.max(0, ...logins.map(({ label }) => label.length));
+	return logins.flatMap((login) => {
+		const head = `   ${login.label.padEnd(width)}  ${login.url}`;
+		const detail = [login.user !== void 0 && login.password !== void 0 ? `user ${login.user}, password ${login.password}` : login.password !== void 0 ? `password ${login.password}` : void 0, login.note].filter(Boolean).join(" — ");
+		return detail ? [head, `   ${" ".repeat(width)}  ${detail}`] : [head];
+	});
+}
+//#endregion
 //#region src/trust/index.ts
 /**
 * Installing the local edge's certificate authority into the OS trust store.
@@ -407,6 +492,74 @@ var UnsupportedPlatform = class extends Error {
 		this.name = "UnsupportedPlatform";
 	}
 };
+//#endregion
+//#region src/dev/credentials.ts
+/**
+* `gkm dev:credentials` — where to sign in to each local service, and as
+* whom, without starting anything.
+*
+* Reads the workspace's generated local logins (see
+* `reconcile/localCredentials.ts`) and the ports the last `gkm dev` or
+* `gkm test` published them on (`.gkm/ports.json`). `--json` prints the same
+* for a script.
+*/
+var credentials_exports = /* @__PURE__ */ __exportAll({
+	NoLocalCredentials: () => NoLocalCredentials,
+	devCredentials: () => devCredentials,
+	devCredentialsCommand: () => devCredentialsCommand
+});
+/** The containers a person may sign in to, in the order they print. */
+const SIGNED_IN = [
+	"postgres",
+	"minio",
+	"mailpit",
+	"redis",
+	"redis-http",
+	"rabbitmq",
+	"localstack"
+];
+/** Nothing has generated this workspace's local logins yet. */
+var NoLocalCredentials = class extends Error {
+	workspace;
+	constructor(workspace) {
+		super(`'${workspace}' has no local logins on this machine yet: they are generated the first time gkm dev, gkm test or gkm setup starts its services. Run one of them, then this again.`);
+		this.workspace = workspace;
+		this.name = "NoLocalCredentials";
+	}
+};
+/** The logins of every service the workspace last published. */
+function devCredentials(workspace, credentials, ports) {
+	const containers = SIGNED_IN.filter((container) => portsOf(container).some((port) => ports[port.key] !== void 0));
+	const logs = resolveLogs(workspace.deploy?.compose?.logs);
+	const local = logs ? {
+		url: logs.public ? `https://logs.${workspace.name}.localhost` : `http://localhost:${logs.port}`,
+		via: `gkm compose --stage ${workspace.stages.local}`
+	} : void 0;
+	return {
+		workspace: workspace.name,
+		stage: workspace.stages.local,
+		services: serviceLogins({
+			containers,
+			ports,
+			credentials,
+			...local ? { logs: local } : {}
+		})
+	};
+}
+async function devCredentialsCommand(options = {}, print = (line) => console.log(line)) {
+	const { workspace } = await loadWorkspaceConfig(process.cwd());
+	const credentials = await readLocalCredentials(workspace);
+	if (!credentials) throw new NoLocalCredentials(workspace.name);
+	const output = devCredentials(workspace, credentials, await loadPortState(workspace.root));
+	if (options.json) {
+		print(JSON.stringify(output, null, 2));
+		return output;
+	}
+	print(`🔑 Local logins for ${output.workspace} (${output.stage})`);
+	if (output.services.length === 0) print("   No service has been published yet — start them with gkm dev, then run this again.");
+	for (const line of describeLogins(output.services)) print(line);
+	return output;
+}
 /** Overrides `dev.discoveryPort` — `0` serves on a port of its own. */
 const DISCOVERY_PORT_ENV = "GKM_DISCOVERY_PORT";
 /**
@@ -2045,6 +2198,11 @@ async function workspaceDevCommand(configured, options) {
 		logger$5.log("🐳 Services");
 		for (const line of describeServices(reconciled.services)) logger$5.log(line);
 	}
+	const { services: logins } = devCredentials(workspace, reconciled.credentials, reconciled.ports);
+	if (logins.length > 0) {
+		logger$5.log("🔑 Logins (again any time: gkm dev:credentials)");
+		for (const line of describeLogins(logins)) logger$5.log(line);
+	}
 	const secretsEnv = {
 		...rawSecrets,
 		...reconciled.env
@@ -2053,9 +2211,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-DlBgATa-.mjs");
+		const { prepareDevDatabases } = await import("./migrate-CCejlgU0.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-DlBgATa-.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-CCejlgU0.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3063,7 +3221,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = join(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await import("./bundler-D4pl87A5.mjs");
+			const { bundleServer } = await import("./bundler-DlKdxCGh.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3187,7 +3345,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-D4pl87A5.mjs");
+		const { bundleServer } = await import("./bundler-DlKdxCGh.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3257,7 +3415,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-D4pl87A5.mjs");
+			const { bundleServer } = await import("./bundler-DlKdxCGh.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -4959,25 +5117,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.80",
-	"@geekmidas/auth": "~10.0.0-alpha.80",
-	"@geekmidas/cache": "~10.0.0-alpha.80",
-	"@geekmidas/client": "~10.0.0-alpha.80",
-	"@geekmidas/cloud": "~10.0.0-alpha.80",
-	"@geekmidas/constructs": "~10.0.0-alpha.80",
-	"@geekmidas/db": "~10.0.0-alpha.80",
-	"@geekmidas/emailkit": "~10.0.0-alpha.80",
-	"@geekmidas/envkit": "~10.0.0-alpha.80",
-	"@geekmidas/errors": "~10.0.0-alpha.80",
-	"@geekmidas/events": "~10.0.0-alpha.80",
-	"@geekmidas/logger": "~10.0.0-alpha.80",
-	"@geekmidas/manifest": "~10.0.0-alpha.80",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.80",
-	"@geekmidas/schema": "~10.0.0-alpha.80",
-	"@geekmidas/services": "~10.0.0-alpha.80",
-	"@geekmidas/storage": "~10.0.0-alpha.80",
-	"@geekmidas/telescope": "~10.0.0-alpha.80",
-	"@geekmidas/testkit": "~10.0.0-alpha.80",
+	"@geekmidas/audit": "~10.0.0-alpha.82",
+	"@geekmidas/auth": "~10.0.0-alpha.82",
+	"@geekmidas/cache": "~10.0.0-alpha.82",
+	"@geekmidas/client": "~10.0.0-alpha.82",
+	"@geekmidas/cloud": "~10.0.0-alpha.82",
+	"@geekmidas/constructs": "~10.0.0-alpha.82",
+	"@geekmidas/db": "~10.0.0-alpha.82",
+	"@geekmidas/emailkit": "~10.0.0-alpha.82",
+	"@geekmidas/envkit": "~10.0.0-alpha.82",
+	"@geekmidas/errors": "~10.0.0-alpha.82",
+	"@geekmidas/events": "~10.0.0-alpha.82",
+	"@geekmidas/logger": "~10.0.0-alpha.82",
+	"@geekmidas/manifest": "~10.0.0-alpha.82",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.82",
+	"@geekmidas/schema": "~10.0.0-alpha.82",
+	"@geekmidas/services": "~10.0.0-alpha.82",
+	"@geekmidas/storage": "~10.0.0-alpha.82",
+	"@geekmidas/telescope": "~10.0.0-alpha.82",
+	"@geekmidas/testkit": "~10.0.0-alpha.82",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10586,7 +10744,7 @@ function printSummary(workspace, stage) {
 * A no-op when nothing is recorded — no run yet, or one already torn down —
 * so running it twice, or before a setup, is harmless.
 */
-async function dropTestDatabases(cwd, root, sql = pgClient) {
+async function dropTestDatabases(cwd, root, sql) {
 	const readyPath = join(cwd, TEST_READY_FILE);
 	const ready = await readReady(readyPath);
 	const recorded = ready?.databases;
@@ -10722,7 +10880,10 @@ async function testCommand(options = {}) {
 }
 /** Drop what the last setup created — see `dropTestDatabases`. */
 async function teardown(cwd) {
-	const dropped = await dropTestDatabases(cwd, await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.root).catch(() => cwd));
+	const workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
+	const credentials = workspace ? await readLocalCredentials(workspace) : null;
+	if (!workspace || !credentials) return;
+	const dropped = await dropTestDatabases(cwd, workspace.root, (port) => pgClient(port, credentials.postgres));
 	if (dropped.length > 0) console.log(`  🧹 Dropped ${dropped.join(", ")}`);
 }
 /**
@@ -10742,7 +10903,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-DlBgATa-.mjs");
+	const { migrateAndSeed } = await import("./migrate-CCejlgU0.mjs");
 	const { discover } = await import("./discover-BPelzeGW.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
@@ -11148,6 +11309,17 @@ program.command("dev").description("Reconcile constructs and start the dev serve
 		process.exit(1);
 	}
 });
+program.command("dev:credentials").description("Print each local service's address and login — Postgres, MinIO, Mailpit, Redis, … — without starting anything").option("--json", "Print them as JSON, for a script").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { devCredentialsCommand } = await Promise.resolve().then(() => credentials_exports);
+		await devCredentialsCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("exec").description("Run a command with secrets injected into Credentials").argument("<command...>", "Command to run (use -- before command)").action(async (commandArgs) => {
 	try {
 		const globalOptions = program.opts();
@@ -11175,7 +11347,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-DlBgATa-.mjs");
+		const { migrateCommand } = await import("./migrate-CCejlgU0.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11189,7 +11361,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-DlBgATa-.mjs");
+		const { seedCommand } = await import("./migrate-CCejlgU0.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11203,7 +11375,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-DlBgATa-.mjs");
+		const { migrationCommand } = await import("./migrate-CCejlgU0.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11228,11 +11400,15 @@ program.command("api").description("Manage REST API endpoints").action(() => {
 	if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 	process.stdout.write("REST API management - coming soon\n");
 });
-program.command("openapi").description("Generate OpenAPI specification from endpoints").option("--app <name>", "Workspace mode: generate for a single named backend app").action(async (options) => {
+program.command("openapi").description("Generate OpenAPI specification from endpoints").option("--app <name>", "Workspace mode: generate for a single named backend app").option("--telemetry [sampleRate]", "Generated clients send W3C trace context to their API by default, at the stage's sample rate (0-1, default 1)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await openapiCommand({ app: options.app });
+		const telemetry = parseTelemetryFlag(options.telemetry);
+		await openapiCommand({
+			app: options.app,
+			...telemetry !== void 0 ? { telemetry } : {}
+		});
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -11307,7 +11483,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-CIxT-Iq6.mjs");
+		const { secretsAddCommand } = await import("./add-DnYHJOap.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11318,7 +11494,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-BrsOJFFz.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-DPFljXtM.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11329,7 +11505,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-BrsOJFFz.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-DPFljXtM.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11372,7 +11548,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./seeds-BdkFpW0P.mjs").then((n) => n.Zt);
+		const { secretsStoreFor } = await import("./seeds-DbyqaXW4.mjs").then((n) => n._n);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11381,7 +11557,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-BdkFpW0P.mjs").then((n) => n.nt);
+		const { derivedContainers } = await import("./seeds-DbyqaXW4.mjs").then((n) => n.X);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11399,7 +11575,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-pfu4aYzX.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-Cd3kcI7o.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11407,7 +11583,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await import("./cli-7aLfgIGt.mjs");
+	const { deployCli } = await import("./cli-qMszGvDu.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11424,7 +11600,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-C0cbdsM-.mjs").then((n) => n.a);
+		const { rollbackStage } = await import("./rollback-DXU6cr7q.mjs").then((n) => n.a);
 		const { terminalCredentials } = await import("./terminal-BdvrmkaC.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -11460,7 +11636,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-CVdbVlT5.mjs");
+		const { deployGithubCommand } = await import("./github-DL4zwJsR.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));