@geekmidas/cli 10.0.0-alpha.82 → 10.0.0-alpha.84

package/dist/index.mjs

@@ -4,22 +4,22 @@ import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs"
 import { c as getDokployCredentials, f as removeDokployCredentials, i as LocalSandbox, l as getDokployRegistryId, m as storeHostingerToken, p as storeDokployCredentials, s as getCredentialsPath, u as getDokployToken } from "./credentials-pAtB70k3.mjs";
 import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { A as deployedProblems, D as InvalidStages, I as resolveLogs, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-BBdqmkch.mjs";
+import { I as stageSampleRate, M as deployedProblems, N as stageProblems, O as InvalidStages, c as getAppBuildOrder, k as TEST_STAGE, l as getAppGkmConfig, r as allConstructGlobs } from "./workspace-Drz4jsvy.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { B as WorkerGenerator, Ct as postgresDatabaseNames, F as parseDevServices, Fn as withCustomSecret, G as FAKE_ENV, Gt as imageBuildCredentials, H as workerEntryDir, J as derivedContainers, Jt as eventsBackendFor, K as backendsOf$1, Kt as isImageBuild, Mn as maskPassword, Pn as toEmbeddableSecrets, Tt as quoteIdentifier, U as QueueGenerator, V as workerBundleName, W as CronGenerator, Y as reconcileWorkspace, Yt as providerOf, Zt as CLUSTER_DATABASE, _t as LOCAL_CA_PATH, an as primaryPortKey, cn as findAvailablePort, dn as loadPortState, et as readLocalCredentials, fn as loadSecretsForApp, hn as secretsStoreFor, in as portsOf, kt as pgClient, ln as isPortAvailable, nn as fakeKey, on as createCredentialsPreload, pn as prepareEntryCredentials, q as constructGlobs, qt as cacheBackendFor, sn as createEntryWrapper, tn as describeServices, un as loadEnvFiles, vn as FileSecretsStore, vt as forgetState, wn as deployIdentity, x as dockerCommand, xn as projectKey, yn as getKeyPath, z as workerUnits } from "./seeds-DbyqaXW4.mjs";
-import { a as parseTelemetryFlag, i as telemetryFor, n as runtimeFor, t as EndpointGenerator } from "./EndpointGenerator-DtnIGafh.mjs";
+import { $t as describeServices, An as maskPassword, B as WorkerGenerator, F as parseDevServices, Ft as cacheBackendFor, G as FAKE_ENV, H as workerEntryDir, Ht as TELEMETRY_CONTAINER, It as eventsBackendFor, J as derivedContainers, Jt as scopeTelemetryEnv, K as backendsOf$1, Kt as appTelemetry, Lt as providerOf, Mn as toEmbeddableSecrets, Nn as withCustomSecret, Nt as imageBuildCredentials, Pn as LOCAL_LOGS_EMAIL, Pt as isImageBuild, Sn as deployIdentity, U as QueueGenerator, V as workerBundleName, W as CronGenerator, Xt as telemetryOf, Y as reconcileWorkspace, Yt as surfaceClientTraced, _n as getKeyPath, an as createEntryWrapper, bt as pgClient, cn as loadEnvFiles, ct as LOCAL_CA_PATH, dn as prepareEntryCredentials, en as fakeKey, et as readLocalCredentials, gn as FileSecretsStore, gt as quoteIdentifier, in as createCredentialsPreload, ln as loadPortState, lt as forgetState, mt as postgresDatabaseNames, nn as portsOf, on as findAvailablePort, pn as secretsStoreFor, q as constructGlobs, rn as primaryPortKey, sn as isPortAvailable, un as loadSecretsForApp, x as dockerCommand, yn as projectKey, z as workerUnits, zt as CLUSTER_DATABASE } from "./seeds-BK8caVMm.mjs";
+import { c as startTelemetryCode, l as telemetryFor, n as runtimeFor, o as mountRequestSpansCode, r as parseTelemetryFlag, s as routeTelemetry, t as EndpointGenerator, u as writeTelemetryModule } from "./EndpointGenerator-CVc6Oi1Y.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-DQZeGkDW.mjs";
+import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-BPqQf8fB.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-B4RP2B2O.mjs";
+import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-DTZzxeIl.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi, x as keyFingerprint } from "./sniffer-ByWtH28i.mjs";
-import { t as deploy$1 } from "./deploy-C00DAKOt.mjs";
-import { a as stackOverrideFile, c as parseDigests, d as removeEdgeRoutes, f as EDGE_PROJECT, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, p as dockerCompose, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as edgeDir } from "./compose-D4sD4Lgr.mjs";
+import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi, x as keyFingerprint } from "./sniffer-CqE_KTTp.mjs";
+import { t as deploy$1 } from "./deploy-BwIKGxWH.mjs";
+import { a as stackOverrideFile, c as parseDigests, d as removeEdgeRoutes, f as EDGE_PROJECT, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, p as dockerCompose, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as edgeDir } from "./compose-C5wz8mf9.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJqRJNK4.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-C72bwpG2.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-D1VfxRuK.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
-import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-DhZbZtFw.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-b6vm0-W-.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Command, Option } from "commander";
@@ -47,7 +47,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.82";
+var version = "10.0.0-alpha.84";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -130,7 +130,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-ByWtH28i.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-CqE_KTTp.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -530,10 +530,9 @@ var NoLocalCredentials = class extends Error {
 /** The logins of every service the workspace last published. */
 function devCredentials(workspace, credentials, ports) {
 	const containers = SIGNED_IN.filter((container) => portsOf(container).some((port) => ports[port.key] !== void 0));
-	const logs = resolveLogs(workspace.deploy?.compose?.logs);
-	const local = logs ? {
-		url: logs.public ? `https://logs.${workspace.name}.localhost` : `http://localhost:${logs.port}`,
-		via: `gkm compose --stage ${workspace.stages.local}`
+	const local = ports.openobserve !== void 0 ? {
+		url: `http://localhost:${ports.openobserve}`,
+		via: "gkm dev"
 	} : void 0;
 	return {
 		workspace: workspace.name,
@@ -753,6 +752,7 @@ async function collect(records) {
 			root,
 			stage: lead.workspace.stage,
 			manifest: group.find((r) => r.manifest)?.manifest ?? null,
+			telemetry: group.find((r) => r.telemetry)?.telemetry ?? null,
 			apps: discovered,
 			allowedOrigins: [...new Set(group.flatMap((r) => r.allowedOrigins))]
 		});
@@ -1097,6 +1097,7 @@ var DiscoverySession = class DiscoverySession {
 			workspace: options.workspace,
 			allowedOrigins: [...options.allowedOrigins ?? []],
 			...options.manifest ? { manifest: options.manifest } : {},
+			...options.telemetry ? { telemetry: options.telemetry } : {},
 			apps: options.apps
 		};
 		writeRecord(registry, record);
@@ -1850,7 +1851,8 @@ async function devCommand(options) {
 		hooks,
 		skipBundle: true,
 		bustCache,
-		serveEmpty: true
+		serveEmpty: true,
+		workspaceName: workspace.name
 	}));
 	logger$5.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
 	const initial = await build();
@@ -1858,6 +1860,7 @@ async function devCommand(options) {
 	let secretsJsonPath;
 	let publicUrl;
 	let manifest;
+	let telemetryUi;
 	const appSecrets = await loadSecretsForApp(workspace ? await secretsStoreFor(workspace, config.stages.local) : new FileSecretsStore(secretsRoot), config.stages.local);
 	if (workspace) {
 		const reconciled = await reconcileWorkspace(workspace, {
@@ -1869,10 +1872,25 @@ async function devCommand(options) {
 			logger$5.log("🐳 Services");
 			for (const line of describeServices(reconciled.services)) logger$5.log(line);
 		}
+		if (!process.env["GKM_DISCOVERY_QUIET"] && reconciled.credentials && reconciled.ports) {
+			const { services: logins } = devCredentials(workspace, reconciled.credentials, reconciled.ports);
+			if (logins.length > 0) {
+				logger$5.log("🔑 Logins (again any time: gkm dev:credentials)");
+				for (const line of describeLogins(logins)) logger$5.log(line);
+			}
+		}
 		Object.assign(appSecrets, reconciled.env);
+		const scoped = scopeTelemetryEnv(appSecrets, {
+			uses: reconciled.manifest !== void 0 && appTelemetry(reconciled.manifest, workspaceAppName) !== void 0,
+			serviceName: workspaceAppName,
+			telemetry: reconciled.env
+		});
+		for (const key of Object.keys(appSecrets)) if (!(key in scoped)) delete appSecrets[key];
+		Object.assign(appSecrets, scoped);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && appKey(r.id) === workspaceAppName);
 		publicUrl = own ? reconciled.env[own.envKey] : void 0;
 		manifest = reconciled.manifest;
+		telemetryUi = telemetryUiOf(reconciled.services);
 	}
 	if (Object.keys(appSecrets).length > 0) {
 		const secretsDir = join(secretsRoot, ".gkm");
@@ -1895,6 +1913,7 @@ async function devCommand(options) {
 		},
 		allowedOrigins: workspace.dev?.allowedOrigins ?? [],
 		...manifest ? { manifest } : {},
+		...telemetryUi ? { telemetry: telemetryUi } : {},
 		apps: [{
 			name: workspaceAppName,
 			type: "backend",
@@ -2203,17 +2222,20 @@ async function workspaceDevCommand(configured, options) {
 		logger$5.log("🔑 Logins (again any time: gkm dev:credentials)");
 		for (const line of describeLogins(logins)) logger$5.log(line);
 	}
-	const secretsEnv = {
+	const secretsEnv = scopeTelemetryEnv({
 		...rawSecrets,
 		...reconciled.env
-	};
+	}, {
+		uses: false,
+		serviceName: workspace.name
+	});
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-CCejlgU0.mjs");
+		const { prepareDevDatabases } = await import("./migrate-CdXcX0XR.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-CCejlgU0.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-CdXcX0XR.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2268,6 +2290,7 @@ async function workspaceDevCommand(configured, options) {
 			break;
 		}
 	}
+	const workspaceTelemetry = telemetryUiOf(reconciled.services);
 	const discovery = await joinDiscovery({
 		role: "workspace",
 		port: discoveryPort(workspace.dev),
@@ -2278,6 +2301,7 @@ async function workspaceDevCommand(configured, options) {
 		},
 		allowedOrigins: workspace.dev?.allowedOrigins ?? [],
 		...reconciled.manifest ? { manifest: reconciled.manifest } : {},
+		...workspaceTelemetry ? { telemetry: workspaceTelemetry } : {},
 		apps: buildOrder.flatMap((name) => {
 			const app = workspace.apps[name];
 			if (!app) return [];
@@ -2475,6 +2499,18 @@ var EntryRunner = class {
 	}
 };
 /**
+* Where the local OpenObserve is, and who signs in to it, when reconcile runs
+* one — for the discovery endpoint, which is told no password.
+*/
+function telemetryUiOf(services) {
+	const ui = services.find((s) => s.container === TELEMETRY_CONTAINER);
+	if (!ui) return void 0;
+	return {
+		url: ui.address,
+		email: LOCAL_LOGS_EMAIL
+	};
+}
+/**
 * Generate the content of the dev server entry file (server.ts).
 * Uses dynamic import for createApp so Credentials are populated
 * before any app modules evaluate.
@@ -2520,6 +2556,7 @@ if (existsSync(secretsPath)) {
       injectWs(server);
       console.log('🔌 Telescope real-time updates enabled');
     }`;
+	const telemetry = startTelemetryCode(["/health", "/ready"]);
 	if (selfServing) return `#!/usr/bin/env node
 /**
  * Development server entry point for a surface that serves itself
@@ -2529,8 +2566,17 @@ ${credentialsInjection}${parentWatch}const port = process.argv.includes('--port'
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
   : 3000;
 
+${telemetry}
 // Dynamic import so Credentials are populated before the surface evaluates
-const { app } = await import('${appImportPath}');
+const { app: surface } = await import('${appImportPath}');
+
+// Behind the request spans when there are any, as the production server is.
+const { Hono } = await import('hono');
+const app = requestSpans ? new Hono() : surface;
+if (requestSpans) {
+  ${mountRequestSpansCode("app").trim().replace(/\n/g, "\n  ")}
+  app.route('/', surface);
+}
 
 ${serveCode.replace(/^ {4}/gm, "")}
 `;
@@ -2543,11 +2589,16 @@ ${credentialsInjection}${parentWatch}const port = process.argv.includes('--port'
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
   : 3000;
 
+${telemetry}
 // Dynamic import so Credentials are populated before env.ts evaluates
 const { createApp } = await import('${appImportPath}');
 
+// The span middleware first, as the production server mounts it.
+const { Hono } = await import('hono');
+const root = new Hono();
+${mountRequestSpansCode("root")}
 // createApp is async to support optional WebSocket setup
-const { app, start } = await createApp(undefined, ${enableOpenApi});
+const { app, start } = await createApp(root, ${enableOpenApi});
 
 // Start the server
 start({
@@ -2989,6 +3040,7 @@ export default app;
 */
 async function writeSurfaceServer(outputDir, options) {
 	await mkdir(outputDir, { recursive: true });
+	await writeTelemetryModule(outputDir, options.telemetry);
 	const shutdown = options.gracefulShutdown ? `
 // Stop taking requests, let in-flight ones finish, then close what the
 // construct opened — bounded by GKM_SHUTDOWN_TIMEOUT_MS, under Docker's 10s
@@ -3015,12 +3067,14 @@ process.on('SIGINT', shutdown);
  */
 import { serve } from '@hono/node-server';
 import { Hono } from 'hono';
-${options.gracefulShutdown ? "import { runShutdownHooks } from '@geekmidas/constructs';\n" : ""}import { app as surface } from './app.js';
+${options.gracefulShutdown ? "import { runShutdownHooks } from '@geekmidas/constructs';\n" : ""}
+${startTelemetryCode([options.healthCheck])}
+const { app: surface } = await import('./app.js');
 
 const port = Number(process.env.PORT) || 3000;
 
 const app = new Hono();
-// First, so a probe is answered without reaching the surface's own routes.
+${mountRequestSpansCode("app")}// First, so a probe is answered without reaching the surface's own routes.
 app.get(${JSON.stringify(options.healthCheck)}, (c) =>
   c.json({ status: 'ok', timestamp: Date.now() }),
 );
@@ -3217,11 +3271,23 @@ async function buildApp(input) {
 	});
 	if (selfServing) {
 		await writeSurfaceEntry(join(appRoot, ".gkm", "server"), selfServing.source);
+		const telemetry = telemetryFor({
+			node: telemetryOf(declared, selfServing.id),
+			appRoot,
+			app: appNameOf(input),
+			cwd: workspaceRoot,
+			serviceName: selfServing.id,
+			...input.workspaceName && { workspaceName: input.workspaceName }
+		});
+		await writeTelemetryModule(join(appRoot, ".gkm", "server"), telemetry);
 		logger$4.log(`Generated a server for ${selfServing.id} from its own declaration`);
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = join(appRoot, ".gkm", "server");
-			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await import("./bundler-DlKdxCGh.mjs");
+			const entryPoint = await writeSurfaceServer(outputDir, {
+				...production,
+				...telemetry ? { telemetry } : {}
+			});
+			const { bundleServer } = await import("./bundler-D4030Afw.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3256,12 +3322,7 @@ async function buildApp(input) {
 			events: eventsBackends
 		}),
 		eventsBackends,
-		markOptional: input.markOptional ?? false,
-		...production && { telemetry: telemetryFor({
-			appRoot,
-			surfaceId: derived.surface?.id,
-			workspaceName: input.workspaceName
-		}) }
+		markOptional: input.markOptional ?? false
 	};
 	const endpointGenerator = new EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
@@ -3279,6 +3340,15 @@ async function buildApp(input) {
 		topicGenerator.load(code, appRoot, bustCache)
 	]);
 	const allEndpoints = servedBy(loadedEndpoints, derived.surface);
+	if (target === "server") buildContext.telemetry = telemetryFor({
+		node: derived.surface ? telemetryOf(declared, derived.surface.id) : void 0,
+		appRoot,
+		app: appNameOf(input),
+		cwd: workspaceRoot,
+		serviceName: derived.surface?.id ?? basename(appRoot),
+		...input.workspaceName && { workspaceName: input.workspaceName },
+		routes: routeTelemetry(allEndpoints.map(({ construct }) => construct))
+	});
 	logger$4.log(`Found ${allEndpoints.length} endpoints`);
 	logger$4.log(`Found ${allFunctions.length} functions`);
 	logger$4.log(`Found ${allCrons.length} crons`);
@@ -3306,6 +3376,14 @@ async function buildApp(input) {
 		const appName = Object.entries(input.workspace.apps).find(([, app]) => resolve(input.workspace.root, app.path) === resolve(appRoot))?.[0];
 		await buildWorkers({
 			context: buildContext,
+			telemetry: (workerId) => telemetryFor({
+				node: telemetryOf(declared, workerId),
+				appRoot,
+				app: appNameOf(input),
+				cwd: workspaceRoot,
+				serviceName: workerId,
+				...input.workspaceName && { workspaceName: input.workspaceName }
+			}),
 			workers: workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName),
 			serverDir: join(appRoot, ".gkm", "server"),
 			crons: allCrons,
@@ -3317,7 +3395,14 @@ async function buildApp(input) {
 	}
 	await generateOpenApi(allEndpoints.map(({ construct }) => construct), {
 		openapi: config.openapi,
-		root: workspaceRoot
+		root: workspaceRoot,
+		...derived.surface ? clientTelemetry({
+			manifest: declared,
+			surfaceId: derived.surface.id,
+			telemetry: input.workspace?.deploy?.telemetry,
+			stage: input.stage,
+			localStage: input.workspace?.stages.local ?? config.stages?.local
+		}) : {}
 	});
 	return {
 		...result,
@@ -3335,9 +3420,11 @@ async function buildWorkers(input) {
 		const crons = owned(input.crons);
 		const queues = owned(input.queues);
 		const subscribers = owned(input.subscribers);
+		const telemetry = input.telemetry(worker.id);
 		const entryPoint = await generator.build({
 			context: input.context,
 			workerId: worker.id,
+			...telemetry ? { telemetry } : {},
 			outputDir: workerEntryDir(input.serverDir, worker.id),
 			crons,
 			queues,
@@ -3345,7 +3432,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-DlKdxCGh.mjs");
+		const { bundleServer } = await import("./bundler-D4030Afw.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3364,6 +3451,22 @@ async function buildWorkers(input) {
 		logger$4.log(`✅ Bundle complete: .gkm/server/dist/${outfile}`);
 	}
 }
+/**
+* Whether the surface's generated client propagates trace context, and at
+* what rate: on when a site that calls it has an edge to a `Telemetry`
+* construct, at the stage's sample rate — every trace locally, and on a build
+* for no stage. Off for a stage that sends no telemetry.
+*/
+function clientTelemetry(options) {
+	if (!surfaceClientTraced(options.manifest, options.surfaceId)) return {};
+	const local = !options.stage || options.stage === options.localStage;
+	const sampleRate = stageSampleRate(options.telemetry, options.stage ?? "", local);
+	return sampleRate === void 0 ? {} : { telemetry: { sampleRate } };
+}
+/** The app being built, by its workspace name or its directory's. */
+function appNameOf(input) {
+	return (input.workspace ? Object.entries(input.workspace.apps).find(([, app]) => resolve(input.workspace.root, app.path) === resolve(input.appRoot))?.[0] : void 0) ?? basename(input.appRoot);
+}
 async function buildForTarget(target, context, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
 	const outputDir = join(appRoot, ".gkm", target);
 	await Promise.all([...SUPERSEDED_OUTPUT.map((dir) => join(appRoot, ".gkm", dir)), ...appRoot === workspaceRoot ? [] : [join(appRoot, ".gkm", "manifest")]].map((dir) => rm(dir, {
@@ -3415,7 +3518,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-DlKdxCGh.mjs");
+			const { bundleServer } = await import("./bundler-D4030Afw.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5102,12 +5205,12 @@ const PNPM_VERSION = "pnpm@10.13.1";
 const BIOME_SCHEMA = `https://biomejs.dev/schemas/${DEPENDENCY_VERSIONS["@biomejs/biome"].replace(/^[~^]/, "")}/schema.json`;
 //#endregion
 //#region src/init/versions.ts
-const require$1 = createRequire(import.meta.url);
+const require$2 = createRequire(import.meta.url);
 function loadPackageJson() {
 	try {
-		return require$1("../package.json");
+		return require$2("../package.json");
 	} catch {
-		return require$1("../../package.json");
+		return require$2("../../package.json");
 	}
 }
 /**
@@ -5117,25 +5220,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.82",
-	"@geekmidas/auth": "~10.0.0-alpha.82",
-	"@geekmidas/cache": "~10.0.0-alpha.82",
-	"@geekmidas/client": "~10.0.0-alpha.82",
-	"@geekmidas/cloud": "~10.0.0-alpha.82",
-	"@geekmidas/constructs": "~10.0.0-alpha.82",
-	"@geekmidas/db": "~10.0.0-alpha.82",
-	"@geekmidas/emailkit": "~10.0.0-alpha.82",
-	"@geekmidas/envkit": "~10.0.0-alpha.82",
-	"@geekmidas/errors": "~10.0.0-alpha.82",
-	"@geekmidas/events": "~10.0.0-alpha.82",
-	"@geekmidas/logger": "~10.0.0-alpha.82",
-	"@geekmidas/manifest": "~10.0.0-alpha.82",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.82",
-	"@geekmidas/schema": "~10.0.0-alpha.82",
-	"@geekmidas/services": "~10.0.0-alpha.82",
-	"@geekmidas/storage": "~10.0.0-alpha.82",
-	"@geekmidas/telescope": "~10.0.0-alpha.82",
-	"@geekmidas/testkit": "~10.0.0-alpha.82",
+	"@geekmidas/audit": "~10.0.0-alpha.84",
+	"@geekmidas/auth": "~10.0.0-alpha.84",
+	"@geekmidas/cache": "~10.0.0-alpha.84",
+	"@geekmidas/client": "~10.0.0-alpha.84",
+	"@geekmidas/cloud": "~10.0.0-alpha.84",
+	"@geekmidas/constructs": "~10.0.0-alpha.84",
+	"@geekmidas/db": "~10.0.0-alpha.84",
+	"@geekmidas/emailkit": "~10.0.0-alpha.84",
+	"@geekmidas/envkit": "~10.0.0-alpha.84",
+	"@geekmidas/errors": "~10.0.0-alpha.84",
+	"@geekmidas/events": "~10.0.0-alpha.84",
+	"@geekmidas/logger": "~10.0.0-alpha.84",
+	"@geekmidas/manifest": "~10.0.0-alpha.84",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.84",
+	"@geekmidas/schema": "~10.0.0-alpha.84",
+	"@geekmidas/services": "~10.0.0-alpha.84",
+	"@geekmidas/storage": "~10.0.0-alpha.84",
+	"@geekmidas/telescope": "~10.0.0-alpha.84",
+	"@geekmidas/testkit": "~10.0.0-alpha.84",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5508,6 +5611,38 @@ coverage/
 	return files;
 }
 //#endregion
+//#region src/init/stagesAction.ts
+/**
+* How a scaffolded workflow names the `stages` action.
+*
+* A published CLI pins it to the commit it was released from: the release
+* build is given that commit as `GKM_RELEASE_COMMIT`, which the build writes
+* into the bundle (`define` in tsdown.config.ts). The action at that commit is
+* the one released beside this CLI, and a commit SHA cannot be moved under a
+* project the way a branch or a tag can.
+*
+* A CLI built anywhere else — a checkout, a local build — knows no released
+* commit, and names `main`.
+*/
+const require$1 = createRequire(import.meta.url);
+function cliVersion() {
+	try {
+		return require$1("../package.json").version;
+	} catch {
+		return require$1("../../package.json").version;
+	}
+}
+/** The action, as a workflow's `uses:` names it before the `@`. */
+const STAGES_ACTION = "geekmidas/toolbox/actions/stages";
+const COMMIT = /^[0-9a-f]{40}$/;
+/**
+* The `uses:` value for the stages action, with a comment saying which CLI
+* release the pinned commit is.
+*/
+function stagesActionUses(commit = "1a6631b7e6dc71b7dd7b7afb8ca5b82225454826", version = cliVersion()) {
+	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
+}
+//#endregion
 //#region src/init/generators/github.ts
 /**
 * The GitHub workflows a scaffold ships with.
@@ -5517,11 +5652,14 @@ coverage/
 *   release, labelled from their titles.
 * - `deploy.yml` — when a deploy target was picked: a push to main deploys the
 *   stages that are not protected, publishing the drafted release deploys the
-*   protected ones.
+*   protected ones, and a manual run deploys the one stage it names.
 *
-* The deploy workflow names no stage. It reads `stages` from gkm.config.ts at
-* run time, so the config stays the one place stages are declared and a
-* workflow cannot fall out of step with it.
+* The deploy workflow names no stage. Its first job runs the
+* `geekmidas/toolbox/actions/stages` action, which asks the project's own
+* `gkm stages --github-output` which stages the run builds and deploys — so
+* the config stays the one place stages are declared, the rules for each event
+* are tested code in the CLI, and a workflow cannot fall out of step with
+* either.
 */
 /** How each package manager is set up, installs, and runs a script. */
 const TOOLING = {
@@ -5707,46 +5845,21 @@ template: |
   **Full Changelog**: https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION
 `;
 }
-function deploy(options) {
-	const pm = tooling(options);
-	const sst = options.deployTarget === "sst";
-	const credentials = sst ? `
-      # An IAM role GitHub assumes through OIDC — no long-lived AWS keys. Set
-      # AWS_ROLE_ARN as a variable on each environment.
-      - uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: \${{ vars.AWS_ROLE_ARN }}
-          aws-region: ${options.region}
-` : "";
-	const keyDir = `~/.gkm/keys/${projectKey({ name: options.name })}`;
-	const stageSecrets = sst ? credentials : `
-      # The stage's secrets are kept in the encrypted .gkm/secrets/<stage>.json,
-      # and each environment holds its key as GKM_SECRETS_KEY. .gkm/ is
-      # gitignored, so a checkout has the key but not the file: set
-      # secrets.store in gkm.config.ts to a store CI can reach before deploying
-      # from here.
-      # Owner-only, as the CLI writes its own keys. The stage reaches the shell
-      # as a variable, never pasted into the script: on a manual run it is
-      # whatever was typed.
-      - name: Stage secrets key
-        run: |
-          mkdir -p -m 700 ${keyDir}
-          (umask 077 && printf '%s' "$KEY" > ${keyDir}/"$STAGE".key)
-        env:
-          KEY: \${{ secrets.GKM_SECRETS_KEY }}
-          STAGE: \${{ matrix.stage }}
-`;
-	const deployEnv = sst ? "" : `
-          DOKPLOY_API_TOKEN: \${{ secrets.DOKPLOY_API_TOKEN }}
-          DOKPLOY_ENDPOINT: \${{ vars.DOKPLOY_ENDPOINT }}`;
+/**
+* What every deploy workflow starts with: its triggers, and the `stages` job,
+* which asks the project's own gkm (through the stages action) which stages
+* this run builds and deploys. Nothing in a workflow names a stage.
+*/
+function deployHeader(build) {
 	return `name: Deploy
 
 # Which stages exist, and which are protected, is read from \`stages\` in
-# gkm.config.ts — nothing here names one:
+# gkm.config.ts by the project's own gkm, through the stages action — nothing
+# here names one:
 #
-#   push to main       every deployed stage that is not protected
+#   push to main       ${build ? "builds every deployed stage, deploys those not protected" : "every deployed stage that is not protected"}
 #   release published  the protected stages (publish the drafted release)
-#   run workflow       the one stage you name
+#   run workflow       the one stage you name, at the ref you name
 on:
   push:
     branches: [main]
@@ -5757,17 +5870,27 @@ on:
       stage:
         description: A deployed stage from gkm.config.ts
         required: true
+        type: string
+      ref:
+        description: The commit, tag or branch to deploy (default the latest on main)
+        required: false
+        type: string
 
 permissions:
   contents: read
-  id-token: write
-
-jobs:
-  stages:
+`;
+}
+function stagesJob(options) {
+	const pm = tooling(options);
+	return `  stages:
     name: Pick stages
     runs-on: ubuntu-latest
     outputs:
-      stages: \${{ steps.pick.outputs.stages }}
+      build: \${{ steps.stages.outputs.build }}
+      deploy: \${{ steps.stages.outputs.deploy }}
+      has-build: \${{ steps.stages.outputs.has-build }}
+      has-deploy: \${{ steps.stages.outputs.has-deploy }}
+      aws-region: \${{ steps.stages.outputs.aws-region }}
     steps:
       - uses: actions/checkout@v4
 
@@ -5775,44 +5898,286 @@ ${pm.setup}
       - name: Install
         run: ${pm.install}
 
+      # Runs \`gkm stages --github-output\`: the rules for each event are the
+      # installed CLI's, and a manual run naming a stage gkm.config.ts does not
+      # deploy fails here.
       - name: Read stages from gkm.config.ts
-        id: pick
+        id: stages
+        uses: ${stagesActionUses()}
+        with:
+          stage: \${{ inputs.stage }}
+`;
+}
+/**
+* The registry login a compose build pushes with: GitHub's own token on
+* ghcr.io, otherwise a username variable and a password secret.
+*/
+function registryLogin(registry) {
+	const host = registry.split("/")[0];
+	const ghcr = host === "ghcr.io";
+	return `      - uses: docker/login-action@v3
+        with:
+          registry: ${host}
+          username: ${ghcr ? "${{ github.actor }}" : "${{ vars.REGISTRY_USERNAME }}"}
+          password: ${ghcr ? "${{ secrets.GITHUB_TOKEN }}" : "${{ secrets.REGISTRY_PASSWORD }}"}
+`;
+}
+/**
+* The compose deploy: images are built and pushed by the runner, where the
+* code is, and pulled by the server, where the stage runs.
+*
+* - `build` (on a push): every deployed stage's images, tagged with the
+*   commit, and their digests kept as the artifact `digests-<stage>`.
+* - `deploy`: the commit the event names — a release's tag, a manual run's
+*   `ref` — then that commit's push build, whose digests pin each image. Over
+*   SSH, with a pinned host key, the server checks the commit out and runs
+*   `gkm compose` on exactly those images.
+*/
+function composeDeploy(options) {
+	const pm = tooling(options);
+	const registry = options.registry ?? "";
+	return `${deployHeader(true)}
+jobs:
+${stagesJob(options)}
+  build:
+    name: Build \${{ matrix.stage }}
+    needs: stages
+    if: needs.stages.outputs.has-build == 'true'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        stage: \${{ fromJSON(needs.stages.outputs.build) }}
+    # One GitHub environment per stage: its secrets, variables and approvals.
+    environment: \${{ matrix.stage }}
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+${pm.setup}
+      - name: Install
+        run: ${pm.install}
+
+${registryLogin(registry)}
+      # A site's public URLs are built into it, so the build reads the stage's
+      # secrets store. With secrets.store on SSM or Secrets Manager the job
+      # assumes the stage's role (AWS_ROLE_ARN, set by gkm deploy:github);
+      # with the default 'file' store there is no role to assume.
+      - name: Assume the stage's AWS role
+        if: needs.stages.outputs.aws-region != ''
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: \${{ vars.AWS_ROLE_ARN }}
+          aws-region: \${{ needs.stages.outputs.aws-region }}
+
+      # Builds and pushes every image the stage runs, tagged with the commit,
+      # and starts nothing.
+      - name: Build and push
+        run: ${pm.exec} gkm compose --stage "$STAGE" --build --push --tag "$SHA" --digests-file digests.json
+        env:
+          STAGE: \${{ matrix.stage }}
+          SHA: \${{ github.sha }}
+
+      # What each tag pointed at when it was pushed. A deploy runs these
+      # digests, so a tag moved since cannot change what is released.
+      - uses: actions/upload-artifact@v4
+        with:
+          name: digests-\${{ matrix.stage }}
+          path: digests.json
+          retention-days: 90
+
+  deploy:
+    name: Deploy \${{ matrix.stage }}
+    needs: [stages, build]
+    # The build is skipped on a release or a manual run: deploy then anyway,
+    # but never after a failed build.
+    if: \${{ !cancelled() && !failure() && needs.stages.outputs.has-deploy == 'true' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        stage: \${{ fromJSON(needs.stages.outputs.deploy) }}
+    environment: \${{ matrix.stage }}
+    concurrency:
+      group: deploy-\${{ matrix.stage }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      # A release deploys its tag's commit, never its target_commitish — the
+      # branch it was drafted against, which has moved on since.
+      - name: Resolve the commit
+        id: commit
+        run: |
+          case "$EVENT" in
+            release) ref="tags/$TAG" ;;
+            workflow_dispatch) ref="\${REF:-$SHA}" ;;
+            *) ref="$SHA" ;;
+          esac
+          sha=$(gh api "repos/$REPO/commits/$ref" --jq .sha)
+          echo "Deploying $sha"
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: \${{ github.token }}
+          REPO: \${{ github.repository }}
+          EVENT: \${{ github.event_name }}
+          TAG: \${{ github.event.release.tag_name }}
+          REF: \${{ inputs.ref }}
+          SHA: \${{ github.sha }}
+
+      # The push run of this workflow that built the commit for this stage:
+      # this run on a push, the newest one with the stage's digests otherwise.
+      - name: Find the commit's push build
+        id: build
         run: |
-          ${pm.exec} tsx -e "
-            import config from './gkm.config.ts';
-            const { deployed, protected: kept = [] } = config.stages;
-            const event = process.env.EVENT;
-            if (event === 'workflow_dispatch' && !deployed.includes(process.env.STAGE)) {
-              console.error('Not a deployed stage: ' + process.env.STAGE + ' (deployed: ' + deployed.join(', ') + ')');
-              process.exit(1);
-            }
-            const stages =
-              event === 'workflow_dispatch' ? [process.env.STAGE]
-              : event === 'release' ? kept
-              : deployed.filter((stage) => !kept.includes(stage));
-            console.log('stages=' + JSON.stringify(stages));
-          " >> "$GITHUB_OUTPUT"
+          if [ "$EVENT" = push ]; then
+            echo "run-id=$RUN_ID" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          workflow=\${WORKFLOW_REF%%@*}
+          workflow=\${workflow##*/}
+          for id in $(gh run list --repo "$REPO" --workflow "$workflow" --event push --commit "$SHA" --limit 20 --json databaseId --jq '.[].databaseId'); do
+            found=$(gh api "repos/$REPO/actions/runs/$id/artifacts?name=$ARTIFACT" --jq '[.artifacts[] | select(.expired | not)] | length')
+            if [ "$found" -gt 0 ]; then
+              echo "run-id=$id" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          done
+          echo "run-id=" >> "$GITHUB_OUTPUT"
         env:
+          GH_TOKEN: \${{ github.token }}
+          REPO: \${{ github.repository }}
           EVENT: \${{ github.event_name }}
-          STAGE: \${{ inputs.stage }}
+          RUN_ID: \${{ github.run_id }}
+          WORKFLOW_REF: \${{ github.workflow_ref }}
+          SHA: \${{ steps.commit.outputs.sha }}
+          ARTIFACT: digests-\${{ matrix.stage }}
+
+      - name: Download digests-\${{ matrix.stage }}
+        if: steps.build.outputs.run-id != ''
+        uses: actions/download-artifact@v4
+        with:
+          name: digests-\${{ matrix.stage }}
+          run-id: \${{ steps.build.outputs.run-id }}
+          github-token: \${{ github.token }}
 
+      - name: No digests — deploying by tag
+        if: steps.build.outputs.run-id == ''
+        run: |
+          echo "::warning title=$STAGE deploys by tag, not digest::No push build of $SHA kept digests-$STAGE (never built, or older than 90 days). The server runs whatever the tag $SHA points at in the registry now, which anyone who can push there could have replaced."
+        env:
+          STAGE: \${{ matrix.stage }}
+          SHA: \${{ steps.commit.outputs.sha }}
+
+      # Each environment holds DEPLOY_SSH_KEY (secret) and DEPLOY_KNOWN_HOSTS,
+      # DEPLOY_HOST, DEPLOY_USER and DEPLOY_PATH (variables): the server's
+      # host key is pinned, never accepted on first sight. DEPLOY_PATH is a
+      # clone of this repository, with a docker login to ${registry.split("/")[0]}
+      # and the stage's secrets.
+      #
+      # Every value reaches the server as an argument to a quoted heredoc —
+      # nothing is pasted into the script.
+      - name: Deploy on the server
+        run: |
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          (umask 077 && printf '%s\\n' "$SSH_KEY" > ~/.ssh/deploy_key)
+          printf '%s\\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
+          digests=""
+          if [ -f digests.json ]; then digests=$(base64 -w0 < digests.json); fi
+          ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \\
+            "$DEPLOY_USER@$DEPLOY_HOST" \\
+            "bash -s -- $(printf '%q ' "$STAGE" "$SHA" "$DEPLOY_PATH" "$digests")" <<'REMOTE'
+          set -euo pipefail
+          stage=$1 sha=$2 dir=$3 digests=$4
+          cd "$dir"
+          git fetch --quiet origin
+          git checkout --quiet --detach "$sha"
+          ${pm.install}
+          args=(--stage "$stage" --tag "$sha")
+          if [ -n "$digests" ]; then
+            mkdir -p .gkm
+            printf '%s' "$digests" | base64 -d > ".gkm/digests-$stage.json"
+            args+=(--digests-file ".gkm/digests-$stage.json")
+          fi
+          ${pm.exec} gkm compose "\${args[@]}"
+          REMOTE
+        env:
+          SSH_KEY: \${{ secrets.DEPLOY_SSH_KEY }}
+          KNOWN_HOSTS: \${{ vars.DEPLOY_KNOWN_HOSTS }}
+          DEPLOY_HOST: \${{ vars.DEPLOY_HOST }}
+          DEPLOY_USER: \${{ vars.DEPLOY_USER }}
+          DEPLOY_PATH: \${{ vars.DEPLOY_PATH }}
+          STAGE: \${{ matrix.stage }}
+          SHA: \${{ steps.commit.outputs.sha }}
+`;
+}
+/**
+* Dokploy and SST: `gkm deploy` builds, releases and health-checks a stage in
+* one step, from a checkout, so there is no separate build job — the stages
+* job's `deploy` list is the matrix, and `build` goes unused.
+*/
+function targetDeploy(options) {
+	const pm = tooling(options);
+	const sst = options.deployTarget === "sst";
+	const credentials = sst ? `
+      # An IAM role GitHub assumes through OIDC — no long-lived AWS keys. Set
+      # AWS_ROLE_ARN as a variable on each environment.
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: \${{ vars.AWS_ROLE_ARN }}
+          aws-region: ${options.region}
+` : "";
+	const keyDir = `~/.gkm/keys/${projectKey({ name: options.name })}`;
+	const stageSecrets = sst ? credentials : `
+      # The stage's secrets are kept in the encrypted .gkm/secrets/<stage>.json,
+      # and each environment holds its key as GKM_SECRETS_KEY. .gkm/ is
+      # gitignored, so a checkout has the key but not the file: set
+      # secrets.store in gkm.config.ts to a store CI can reach before deploying
+      # from here.
+      # Owner-only, as the CLI writes its own keys. The stage reaches the shell
+      # as a variable, never pasted into the script: on a manual run it is
+      # whatever was typed.
+      - name: Stage secrets key
+        run: |
+          mkdir -p ${keyDir} && chmod 700 ${keyDir}
+          (umask 077 && printf '%s' "$KEY" > ${keyDir}/"$STAGE".key)
+        env:
+          KEY: \${{ secrets.GKM_SECRETS_KEY }}
+          STAGE: \${{ matrix.stage }}
+`;
+	const deployEnv = sst ? "" : `
+          DOKPLOY_API_TOKEN: \${{ secrets.DOKPLOY_API_TOKEN }}
+          DOKPLOY_ENDPOINT: \${{ vars.DOKPLOY_ENDPOINT }}`;
+	return `${deployHeader(false)}
+jobs:
+${stagesJob(options)}
   deploy:
     name: Deploy \${{ matrix.stage }}
     needs: stages
-    if: needs.stages.outputs.stages != '[]'
+    if: needs.stages.outputs.has-deploy == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        stage: \${{ fromJSON(needs.stages.outputs.stages) }}
+        stage: \${{ fromJSON(needs.stages.outputs.deploy) }}
     # One GitHub environment per stage: its secrets and variables, and any
     # approval rule you put on a protected one.
     environment: \${{ matrix.stage }}
     concurrency:
       group: deploy-\${{ matrix.stage }}
       cancel-in-progress: false
+    permissions:
+      contents: read${sst ? "\n      id-token: write" : ""}
     steps:
+      # The event's own commit — a release's tag, the push — or the ref a
+      # manual run names.
       - uses: actions/checkout@v4
+        with:
+          ref: \${{ inputs.ref }}
 
 ${pm.setup}
       - name: Install
@@ -5826,6 +6191,9 @@ ${stageSecrets}
           STAGE: \${{ matrix.stage }}${deployEnv}
 `;
 }
+function deploy(options) {
+	return options.deployTarget === "compose" ? composeDeploy(options) : targetDeploy(options);
+}
 function generateGithubFiles(options) {
 	const files = [
 		{
@@ -6666,6 +7034,11 @@ export type ListUsersResponse = z.infer<typeof ListUsersResponseSchema>;
 const perStage = (options, command) => Object.fromEntries(options.stages.deployed.map((stage) => [`deploy:${stage}`, command(stage)]));
 function deployPackage(options) {
 	switch (options.deployTarget) {
+		case "compose": return {
+			scripts: perStage(options, (stage) => `gkm compose --stage ${stage}`),
+			dependencies: {},
+			devDependencies: {}
+		};
 		case "dokploy": return {
 			scripts: perStage(options, (stage) => `gkm deploy --stage ${stage}`),
 			dependencies: {},
@@ -7175,6 +7548,13 @@ ${workspaceConstructsGlobs(options.routesStructure, dirname(options.apiPath)).ma
 * `gkm build` builds for, and which backends a cache or a broker resolves to.
 */
 function deployBlock(options) {
+	if (options.deployTarget === "compose") return `
+  // \`gkm compose --stage <stage>\` runs a stage as one Docker Compose stack on
+  // the machine it runs on. CI builds every image and pushes it here; the
+  // server pulls exactly those. On ghcr.io the owner is the repository's —
+  // the user or organisation whose packages the workflow's token can write.
+  deploy: { default: 'compose', registry: '${options.registry}' },
+`;
 	if (options.deployTarget !== "sst") return "";
 	return `
   // \`gkm deploy\` runs \`sst deploy\` on the manifest \`gkm build\` writes to
@@ -9751,6 +10131,11 @@ const deployTargetChoices = [
 		value: "dokploy",
 		description: "Deploy to Dokploy (Docker-based hosting)"
 	},
+	{
+		title: "Server (Docker Compose)",
+		value: "compose",
+		description: "One Docker Compose stack per stage on your own server; CI builds the images"
+	},
 	{
 		title: "AWS (SST)",
 		value: "sst",
@@ -9888,6 +10273,13 @@ async function initCommand(projectName, options = {}) {
 			message: "AWS region (e.g. eu-west-1):",
 			validate: (value) => AWS_REGION.test(value.trim()) || "An AWS region, like eu-west-1"
 		},
+		{
+			type: (_prev, values) => !options.yes && !options.registry && (options.deploy ?? values.deployTarget) === "compose" ? "text" : null,
+			name: "registry",
+			message: "Container registry CI pushes to (e.g. ghcr.io/<your GitHub owner>):",
+			initial: (_prev, values) => defaultRegistry(projectName || options.name || values.name),
+			validate: (value) => value.trim().length > 0 || "A registry, like ghcr.io/acme"
+		},
 		{
 			type: options.yes || options.stages ? null : "text",
 			name: "deployedStages",
@@ -9989,6 +10381,7 @@ async function initCommand(projectName, options = {}) {
 		packageManager: pkgManager,
 		deployTarget,
 		stages: resolveStages(options, answers),
+		...deployTarget === "compose" ? { registry: options.registry ?? answers.registry?.trim() ?? defaultRegistry(name) } : {},
 		...deployTarget === "sst" ? { region: options.region ?? (options.yes ? "eu-west-1" : answers.region?.trim()) } : {},
 		constructs,
 		frontendFramework
@@ -10160,6 +10553,13 @@ function printNextSteps(projectName, options, pkgManager) {
 		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}`);
 		console.log("");
 	}
+	if (options.deployTarget === "compose") {
+		console.log("🚀 Deployment (Docker Compose, on your server):");
+		console.log(`  Images are pushed to ${options.registry}; .github/workflows/deploy.yml builds them`);
+		console.log("  and runs gkm compose on the server over SSH. See the comments in it for the");
+		console.log("  environment variables and secrets each stage needs.");
+		console.log("");
+	}
 	if (options.deployTarget === "sst") {
 		console.log("🚀 Deployment (AWS, through SST):");
 		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}  # gkm deploy: build, sst deploy, health checks`);
@@ -10199,6 +10599,14 @@ var UnknownDeployTarget = class extends Error {
 		this.name = "UnknownDeployTarget";
 	}
 };
+/**
+* Where a compose deploy's images go when nobody said: GitHub's registry,
+* under an owner named after the project. The generated config says to change
+* it to the repository's owner, whose packages the workflow's token can write.
+*/
+function defaultRegistry(name) {
+	return `ghcr.io/${(name ?? "my-org").toLowerCase()}`;
+}
 /** `--region` that is not shaped like one, e.g. `europe` for `eu-west-1`. */
 var NotAnAwsRegion = class extends Error {
 	region;
@@ -10903,7 +11311,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-CCejlgU0.mjs");
+	const { migrateAndSeed } = await import("./migrate-CdXcX0XR.mjs");
 	const { discover } = await import("./discover-BPelzeGW.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
@@ -11239,7 +11647,7 @@ const program = new Command();
 program.name("gkm").description("GeekMidas backend framework CLI").version(version).option("--cwd <path>", "Change working directory").option("--debug", "Enable debug mode (verbose errors with stack traces)").hook("preAction", () => {
 	if (program.opts().debug);
 });
-program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").option("--deploy <target>", "Where it deploys (dokploy, sst, none)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").option("--stages <names>", "Deployed stages, comma-separated (e.g. staging,prod)").option("--protected-stage <name>", "Which deployed stage is production").option("--local-stage <name>", "What gkm dev runs as (e.g. dev)").action(async (name, options) => {
+program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").option("--deploy <target>", "Where it deploys (dokploy, compose, sst, none)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").option("--registry <registry>", "Container registry for a compose deploy (e.g. ghcr.io/acme)").option("--stages <names>", "Deployed stages, comma-separated (e.g. staging,prod)").option("--protected-stage <name>", "Which deployed stage is production").option("--local-stage <name>", "What gkm dev runs as (e.g. dev)").action(async (name, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -11347,7 +11755,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-CCejlgU0.mjs");
+		const { migrateCommand } = await import("./migrate-CdXcX0XR.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11361,7 +11769,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-CCejlgU0.mjs");
+		const { seedCommand } = await import("./migrate-CdXcX0XR.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11375,7 +11783,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-CCejlgU0.mjs");
+		const { migrationCommand } = await import("./migrate-CdXcX0XR.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11483,7 +11891,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-DnYHJOap.mjs");
+		const { secretsAddCommand } = await import("./add-DbnzC7Kl.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11494,7 +11902,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-DPFljXtM.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-BRcBAmjL.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11505,7 +11913,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-DPFljXtM.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-BRcBAmjL.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11548,7 +11956,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./seeds-DbyqaXW4.mjs").then((n) => n._n);
+		const { secretsStoreFor } = await import("./seeds-BK8caVMm.mjs").then((n) => n.hn);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11557,7 +11965,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-DbyqaXW4.mjs").then((n) => n.X);
+		const { derivedContainers } = await import("./seeds-BK8caVMm.mjs").then((n) => n.X);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11575,7 +11983,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-Cd3kcI7o.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-DOMU4uKe.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11583,7 +11991,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await import("./cli-qMszGvDu.mjs");
+	const { deployCli } = await import("./cli-DwTa9d_8.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11600,7 +12008,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-DXU6cr7q.mjs").then((n) => n.a);
+		const { rollbackStage } = await import("./rollback-BSdxnW3X.mjs").then((n) => n.a);
 		const { terminalCredentials } = await import("./terminal-BdvrmkaC.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -11636,13 +12044,24 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-DL4zwJsR.mjs");
+		const { deployGithubCommand } = await import("./github-Zs-dVJbR.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
 	}
 });
+program.command("stages").description("The workspace's stages from gkm.config.ts: local, deployed and protected").option("--json", "Print them as JSON").option("--github-output", "Write the stages, and which this workflow run builds and deploys, to $GITHUB_OUTPUT").option("--event <name>", "The event to plan for (default: $GITHUB_EVENT_NAME)").option("--stage <stage>", "The stage a workflow_dispatch deploys").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { stagesCommand } = await import("./stages-CSXt7N2b.mjs");
+		await stagesCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("deploy:list").description("List Dokploy resources (projects, registries)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").option("--projects", "List projects").option("--registries", "List registries").action(async (options) => {
 	try {
 		const globalOptions = program.opts();