@geekmidas/cli 10.0.0-alpha.83 → 10.0.0-alpha.84

package/dist/index.cjs

@@ -5,22 +5,22 @@ const require_run = require("./run-fVZ-rLnc.cjs");
 const require_credentials = require("./credentials-BVs7mrtw.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-4i6Jwsoa.cjs");
+const require_workspace = require("./workspace-Bic_R3tz.cjs");
 const require_config = require("./config.cjs");
-const require_seeds = require("./seeds-Ccju3zGl.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-cKlnllIu.cjs");
+const require_seeds = require("./seeds-DQ0FG57Z.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-CwLjBCFE.cjs");
 const require_openapi = require("./openapi.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-CYriX5BV.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-BVn7cQ-2.cjs");
 const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
-const require_drivers = require("./drivers-CJx76mcb.cjs");
+const require_drivers = require("./drivers-LYSdQDmd.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
-const require_sniffer = require("./sniffer-DeyYI9Iv.cjs");
-const require_deploy = require("./deploy-BlZx6J5x.cjs");
-const require_compose = require("./compose-CGyxYe-h.cjs");
+const require_sniffer = require("./sniffer-hSf5mRgV.cjs");
+const require_deploy = require("./deploy-C8sWg81_.cjs");
+const require_compose = require("./compose-DqWh1TaO.cjs");
 const require_credentialSchemas = require("./credentialSchemas-DCR4Wd1W.cjs");
-const require_LocalStateStore = require("./LocalStateStore-BsFHdSeA.cjs");
+const require_LocalStateStore = require("./LocalStateStore-CdpzTvPn.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
-const require_ready = require("./ready-4kx2pAhm.cjs");
+const require_ready = require("./ready-BpNbORRB.cjs");
 let node_path = require("node:path");
 let commander = require("commander");
 let node_process = require("node:process");
@@ -53,7 +53,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.83";
+var version = "10.0.0-alpha.84";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -136,7 +136,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-DeyYI9Iv.cjs")).then((n) => n.dokploy_api_exports);
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-hSf5mRgV.cjs")).then((n) => n.dokploy_api_exports);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -536,10 +536,9 @@ var NoLocalCredentials = class extends Error {
 /** The logins of every service the workspace last published. */
 function devCredentials(workspace, credentials, ports) {
 	const containers = SIGNED_IN.filter((container) => require_seeds.portsOf(container).some((port) => ports[port.key] !== void 0));
-	const logs = require_workspace.resolveLogs(workspace.deploy?.compose?.logs);
-	const local = logs ? {
-		url: logs.public ? `https://logs.${workspace.name}.localhost` : `http://localhost:${logs.port}`,
-		via: `gkm compose --stage ${workspace.stages.local}`
+	const local = ports.openobserve !== void 0 ? {
+		url: `http://localhost:${ports.openobserve}`,
+		via: "gkm dev"
 	} : void 0;
 	return {
 		workspace: workspace.name,
@@ -759,6 +758,7 @@ async function collect(records) {
 			root,
 			stage: lead.workspace.stage,
 			manifest: group.find((r) => r.manifest)?.manifest ?? null,
+			telemetry: group.find((r) => r.telemetry)?.telemetry ?? null,
 			apps: discovered,
 			allowedOrigins: [...new Set(group.flatMap((r) => r.allowedOrigins))]
 		});
@@ -1103,6 +1103,7 @@ var DiscoverySession = class DiscoverySession {
 			workspace: options.workspace,
 			allowedOrigins: [...options.allowedOrigins ?? []],
 			...options.manifest ? { manifest: options.manifest } : {},
+			...options.telemetry ? { telemetry: options.telemetry } : {},
 			apps: options.apps
 		};
 		writeRecord(registry, record);
@@ -1856,7 +1857,8 @@ async function devCommand(options) {
 		hooks,
 		skipBundle: true,
 		bustCache,
-		serveEmpty: true
+		serveEmpty: true,
+		workspaceName: workspace.name
 	}));
 	logger$5.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
 	const initial = await build();
@@ -1864,6 +1866,7 @@ async function devCommand(options) {
 	let secretsJsonPath;
 	let publicUrl;
 	let manifest;
+	let telemetryUi;
 	const appSecrets = await require_seeds.loadSecretsForApp(workspace ? await require_seeds.secretsStoreFor(workspace, config.stages.local) : new require_seeds.FileSecretsStore(secretsRoot), config.stages.local);
 	if (workspace) {
 		const reconciled = await require_seeds.reconcileWorkspace(workspace, {
@@ -1875,10 +1878,25 @@ async function devCommand(options) {
 			logger$5.log("🐳 Services");
 			for (const line of require_seeds.describeServices(reconciled.services)) logger$5.log(line);
 		}
+		if (!process.env["GKM_DISCOVERY_QUIET"] && reconciled.credentials && reconciled.ports) {
+			const { services: logins } = devCredentials(workspace, reconciled.credentials, reconciled.ports);
+			if (logins.length > 0) {
+				logger$5.log("🔑 Logins (again any time: gkm dev:credentials)");
+				for (const line of describeLogins(logins)) logger$5.log(line);
+			}
+		}
 		Object.assign(appSecrets, reconciled.env);
+		const scoped = require_seeds.scopeTelemetryEnv(appSecrets, {
+			uses: reconciled.manifest !== void 0 && require_seeds.appTelemetry(reconciled.manifest, workspaceAppName) !== void 0,
+			serviceName: workspaceAppName,
+			telemetry: reconciled.env
+		});
+		for (const key of Object.keys(appSecrets)) if (!(key in scoped)) delete appSecrets[key];
+		Object.assign(appSecrets, scoped);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_derive.appKey(r.id) === workspaceAppName);
 		publicUrl = own ? reconciled.env[own.envKey] : void 0;
 		manifest = reconciled.manifest;
+		telemetryUi = telemetryUiOf(reconciled.services);
 	}
 	if (Object.keys(appSecrets).length > 0) {
 		const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
@@ -1901,6 +1919,7 @@ async function devCommand(options) {
 		},
 		allowedOrigins: workspace.dev?.allowedOrigins ?? [],
 		...manifest ? { manifest } : {},
+		...telemetryUi ? { telemetry: telemetryUi } : {},
 		apps: [{
 			name: workspaceAppName,
 			type: "backend",
@@ -2209,17 +2228,20 @@ async function workspaceDevCommand(configured, options) {
 		logger$5.log("🔑 Logins (again any time: gkm dev:credentials)");
 		for (const line of describeLogins(logins)) logger$5.log(line);
 	}
-	const secretsEnv = {
+	const secretsEnv = require_seeds.scopeTelemetryEnv({
 		...rawSecrets,
 		...reconciled.env
-	};
+	}, {
+		uses: false,
+		serviceName: workspace.name
+	});
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-BgPWVnAZ.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-BfZN1S32.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-BgPWVnAZ.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-BfZN1S32.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2274,6 +2296,7 @@ async function workspaceDevCommand(configured, options) {
 			break;
 		}
 	}
+	const workspaceTelemetry = telemetryUiOf(reconciled.services);
 	const discovery = await joinDiscovery({
 		role: "workspace",
 		port: discoveryPort(workspace.dev),
@@ -2284,6 +2307,7 @@ async function workspaceDevCommand(configured, options) {
 		},
 		allowedOrigins: workspace.dev?.allowedOrigins ?? [],
 		...reconciled.manifest ? { manifest: reconciled.manifest } : {},
+		...workspaceTelemetry ? { telemetry: workspaceTelemetry } : {},
 		apps: buildOrder.flatMap((name) => {
 			const app = workspace.apps[name];
 			if (!app) return [];
@@ -2481,6 +2505,18 @@ var EntryRunner = class {
 	}
 };
 /**
+* Where the local OpenObserve is, and who signs in to it, when reconcile runs
+* one — for the discovery endpoint, which is told no password.
+*/
+function telemetryUiOf(services) {
+	const ui = services.find((s) => s.container === require_seeds.TELEMETRY_CONTAINER);
+	if (!ui) return void 0;
+	return {
+		url: ui.address,
+		email: require_seeds.LOCAL_LOGS_EMAIL
+	};
+}
+/**
 * Generate the content of the dev server entry file (server.ts).
 * Uses dynamic import for createApp so Credentials are populated
 * before any app modules evaluate.
@@ -2526,6 +2562,7 @@ if (existsSync(secretsPath)) {
       injectWs(server);
       console.log('🔌 Telescope real-time updates enabled');
     }`;
+	const telemetry = require_EndpointGenerator.startTelemetryCode(["/health", "/ready"]);
 	if (selfServing) return `#!/usr/bin/env node
 /**
  * Development server entry point for a surface that serves itself
@@ -2535,8 +2572,17 @@ ${credentialsInjection}${parentWatch}const port = process.argv.includes('--port'
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
   : 3000;
 
+${telemetry}
 // Dynamic import so Credentials are populated before the surface evaluates
-const { app } = await import('${appImportPath}');
+const { app: surface } = await import('${appImportPath}');
+
+// Behind the request spans when there are any, as the production server is.
+const { Hono } = await import('hono');
+const app = requestSpans ? new Hono() : surface;
+if (requestSpans) {
+  ${require_EndpointGenerator.mountRequestSpansCode("app").trim().replace(/\n/g, "\n  ")}
+  app.route('/', surface);
+}
 
 ${serveCode.replace(/^ {4}/gm, "")}
 `;
@@ -2549,11 +2595,16 @@ ${credentialsInjection}${parentWatch}const port = process.argv.includes('--port'
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
   : 3000;
 
+${telemetry}
 // Dynamic import so Credentials are populated before env.ts evaluates
 const { createApp } = await import('${appImportPath}');
 
+// The span middleware first, as the production server mounts it.
+const { Hono } = await import('hono');
+const root = new Hono();
+${require_EndpointGenerator.mountRequestSpansCode("root")}
 // createApp is async to support optional WebSocket setup
-const { app, start } = await createApp(undefined, ${enableOpenApi});
+const { app, start } = await createApp(root, ${enableOpenApi});
 
 // Start the server
 start({
@@ -2995,6 +3046,7 @@ export default app;
 */
 async function writeSurfaceServer(outputDir, options) {
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
+	await require_EndpointGenerator.writeTelemetryModule(outputDir, options.telemetry);
 	const shutdown = options.gracefulShutdown ? `
 // Stop taking requests, let in-flight ones finish, then close what the
 // construct opened — bounded by GKM_SHUTDOWN_TIMEOUT_MS, under Docker's 10s
@@ -3021,12 +3073,14 @@ process.on('SIGINT', shutdown);
  */
 import { serve } from '@hono/node-server';
 import { Hono } from 'hono';
-${options.gracefulShutdown ? "import { runShutdownHooks } from '@geekmidas/constructs';\n" : ""}import { app as surface } from './app.js';
+${options.gracefulShutdown ? "import { runShutdownHooks } from '@geekmidas/constructs';\n" : ""}
+${require_EndpointGenerator.startTelemetryCode([options.healthCheck])}
+const { app: surface } = await import('./app.js');
 
 const port = Number(process.env.PORT) || 3000;
 
 const app = new Hono();
-// First, so a probe is answered without reaching the surface's own routes.
+${require_EndpointGenerator.mountRequestSpansCode("app")}// First, so a probe is answered without reaching the surface's own routes.
 app.get(${JSON.stringify(options.healthCheck)}, (c) =>
   c.json({ status: 'ok', timestamp: Date.now() }),
 );
@@ -3223,11 +3277,23 @@ async function buildApp(input) {
 	});
 	if (selfServing) {
 		await writeSurfaceEntry((0, node_path.join)(appRoot, ".gkm", "server"), selfServing.source);
+		const telemetry = require_EndpointGenerator.telemetryFor({
+			node: require_seeds.telemetryOf(declared, selfServing.id),
+			appRoot,
+			app: appNameOf(input),
+			cwd: workspaceRoot,
+			serviceName: selfServing.id,
+			...input.workspaceName && { workspaceName: input.workspaceName }
+		});
+		await require_EndpointGenerator.writeTelemetryModule((0, node_path.join)(appRoot, ".gkm", "server"), telemetry);
 		logger$4.log(`Generated a server for ${selfServing.id} from its own declaration`);
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = (0, node_path.join)(appRoot, ".gkm", "server");
-			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BkH1kPEX.cjs"));
+			const entryPoint = await writeSurfaceServer(outputDir, {
+				...production,
+				...telemetry ? { telemetry } : {}
+			});
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DjrRffko.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3262,12 +3328,7 @@ async function buildApp(input) {
 			events: eventsBackends
 		}),
 		eventsBackends,
-		markOptional: input.markOptional ?? false,
-		...production && { telemetry: require_EndpointGenerator.telemetryFor({
-			appRoot,
-			surfaceId: derived.surface?.id,
-			workspaceName: input.workspaceName
-		}) }
+		markOptional: input.markOptional ?? false
 	};
 	const endpointGenerator = new require_EndpointGenerator.EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
@@ -3285,6 +3346,15 @@ async function buildApp(input) {
 		topicGenerator.load(code, appRoot, bustCache)
 	]);
 	const allEndpoints = servedBy(loadedEndpoints, derived.surface);
+	if (target === "server") buildContext.telemetry = require_EndpointGenerator.telemetryFor({
+		node: derived.surface ? require_seeds.telemetryOf(declared, derived.surface.id) : void 0,
+		appRoot,
+		app: appNameOf(input),
+		cwd: workspaceRoot,
+		serviceName: derived.surface?.id ?? (0, node_path.basename)(appRoot),
+		...input.workspaceName && { workspaceName: input.workspaceName },
+		routes: require_EndpointGenerator.routeTelemetry(allEndpoints.map(({ construct }) => construct))
+	});
 	logger$4.log(`Found ${allEndpoints.length} endpoints`);
 	logger$4.log(`Found ${allFunctions.length} functions`);
 	logger$4.log(`Found ${allCrons.length} crons`);
@@ -3312,6 +3382,14 @@ async function buildApp(input) {
 		const appName = Object.entries(input.workspace.apps).find(([, app]) => (0, node_path.resolve)(input.workspace.root, app.path) === (0, node_path.resolve)(appRoot))?.[0];
 		await buildWorkers({
 			context: buildContext,
+			telemetry: (workerId) => require_EndpointGenerator.telemetryFor({
+				node: require_seeds.telemetryOf(declared, workerId),
+				appRoot,
+				app: appNameOf(input),
+				cwd: workspaceRoot,
+				serviceName: workerId,
+				...input.workspaceName && { workspaceName: input.workspaceName }
+			}),
 			workers: require_seeds.workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName),
 			serverDir: (0, node_path.join)(appRoot, ".gkm", "server"),
 			crons: allCrons,
@@ -3323,7 +3401,14 @@ async function buildApp(input) {
 	}
 	await require_openapi.generateOpenApi(allEndpoints.map(({ construct }) => construct), {
 		openapi: config.openapi,
-		root: workspaceRoot
+		root: workspaceRoot,
+		...derived.surface ? clientTelemetry({
+			manifest: declared,
+			surfaceId: derived.surface.id,
+			telemetry: input.workspace?.deploy?.telemetry,
+			stage: input.stage,
+			localStage: input.workspace?.stages.local ?? config.stages?.local
+		}) : {}
 	});
 	return {
 		...result,
@@ -3341,9 +3426,11 @@ async function buildWorkers(input) {
 		const crons = owned(input.crons);
 		const queues = owned(input.queues);
 		const subscribers = owned(input.subscribers);
+		const telemetry = input.telemetry(worker.id);
 		const entryPoint = await generator.build({
 			context: input.context,
 			workerId: worker.id,
+			...telemetry ? { telemetry } : {},
 			outputDir: require_seeds.workerEntryDir(input.serverDir, worker.id),
 			crons,
 			queues,
@@ -3351,7 +3438,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BkH1kPEX.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DjrRffko.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3370,6 +3457,22 @@ async function buildWorkers(input) {
 		logger$4.log(`✅ Bundle complete: .gkm/server/dist/${outfile}`);
 	}
 }
+/**
+* Whether the surface's generated client propagates trace context, and at
+* what rate: on when a site that calls it has an edge to a `Telemetry`
+* construct, at the stage's sample rate — every trace locally, and on a build
+* for no stage. Off for a stage that sends no telemetry.
+*/
+function clientTelemetry(options) {
+	if (!require_seeds.surfaceClientTraced(options.manifest, options.surfaceId)) return {};
+	const local = !options.stage || options.stage === options.localStage;
+	const sampleRate = require_workspace.stageSampleRate(options.telemetry, options.stage ?? "", local);
+	return sampleRate === void 0 ? {} : { telemetry: { sampleRate } };
+}
+/** The app being built, by its workspace name or its directory's. */
+function appNameOf(input) {
+	return (input.workspace ? Object.entries(input.workspace.apps).find(([, app]) => (0, node_path.resolve)(input.workspace.root, app.path) === (0, node_path.resolve)(input.appRoot))?.[0] : void 0) ?? (0, node_path.basename)(input.appRoot);
+}
 async function buildForTarget(target, context, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
 	const outputDir = (0, node_path.join)(appRoot, ".gkm", target);
 	await Promise.all([...SUPERSEDED_OUTPUT.map((dir) => (0, node_path.join)(appRoot, ".gkm", dir)), ...appRoot === workspaceRoot ? [] : [(0, node_path.join)(appRoot, ".gkm", "manifest")]].map((dir) => (0, node_fs_promises.rm)(dir, {
@@ -3421,7 +3524,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-BkH1kPEX.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DjrRffko.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5123,25 +5226,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.83",
-	"@geekmidas/auth": "~10.0.0-alpha.83",
-	"@geekmidas/cache": "~10.0.0-alpha.83",
-	"@geekmidas/client": "~10.0.0-alpha.83",
-	"@geekmidas/cloud": "~10.0.0-alpha.83",
-	"@geekmidas/constructs": "~10.0.0-alpha.83",
-	"@geekmidas/db": "~10.0.0-alpha.83",
-	"@geekmidas/emailkit": "~10.0.0-alpha.83",
-	"@geekmidas/envkit": "~10.0.0-alpha.83",
-	"@geekmidas/errors": "~10.0.0-alpha.83",
-	"@geekmidas/events": "~10.0.0-alpha.83",
-	"@geekmidas/logger": "~10.0.0-alpha.83",
-	"@geekmidas/manifest": "~10.0.0-alpha.83",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.83",
-	"@geekmidas/schema": "~10.0.0-alpha.83",
-	"@geekmidas/services": "~10.0.0-alpha.83",
-	"@geekmidas/storage": "~10.0.0-alpha.83",
-	"@geekmidas/telescope": "~10.0.0-alpha.83",
-	"@geekmidas/testkit": "~10.0.0-alpha.83",
+	"@geekmidas/audit": "~10.0.0-alpha.84",
+	"@geekmidas/auth": "~10.0.0-alpha.84",
+	"@geekmidas/cache": "~10.0.0-alpha.84",
+	"@geekmidas/client": "~10.0.0-alpha.84",
+	"@geekmidas/cloud": "~10.0.0-alpha.84",
+	"@geekmidas/constructs": "~10.0.0-alpha.84",
+	"@geekmidas/db": "~10.0.0-alpha.84",
+	"@geekmidas/emailkit": "~10.0.0-alpha.84",
+	"@geekmidas/envkit": "~10.0.0-alpha.84",
+	"@geekmidas/errors": "~10.0.0-alpha.84",
+	"@geekmidas/events": "~10.0.0-alpha.84",
+	"@geekmidas/logger": "~10.0.0-alpha.84",
+	"@geekmidas/manifest": "~10.0.0-alpha.84",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.84",
+	"@geekmidas/schema": "~10.0.0-alpha.84",
+	"@geekmidas/services": "~10.0.0-alpha.84",
+	"@geekmidas/storage": "~10.0.0-alpha.84",
+	"@geekmidas/telescope": "~10.0.0-alpha.84",
+	"@geekmidas/testkit": "~10.0.0-alpha.84",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5542,7 +5645,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "4dee60bc593ffdfbaa59bbf8d8fe9e3e64f23d41", version = cliVersion()) {
+function stagesActionUses(commit = "1a6631b7e6dc71b7dd7b7afb8ca5b82225454826", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -11214,7 +11317,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-BgPWVnAZ.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-BfZN1S32.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-D1It5r_h.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -11658,7 +11761,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BgPWVnAZ.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BfZN1S32.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11672,7 +11775,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-BgPWVnAZ.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-BfZN1S32.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11686,7 +11789,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BgPWVnAZ.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BfZN1S32.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11794,7 +11897,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-Bwddb4KD.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-BQ8v1ZII.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11805,7 +11908,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CxTfRx4h.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-g6PzwwfL.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11816,7 +11919,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CxTfRx4h.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-g6PzwwfL.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11859,7 +11962,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-Ccju3zGl.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-DQ0FG57Z.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11868,7 +11971,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-Ccju3zGl.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-DQ0FG57Z.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11886,7 +11989,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-Bemd4tkz.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-FoL_mZIz.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11894,7 +11997,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-DO7DQqCq.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-D8YQAYUX.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -11911,7 +12014,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-BVQFDjxr.cjs")).then((n) => n.rollback_exports);
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-CPSDjGse.cjs")).then((n) => n.rollback_exports);
 		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-BL5E0xbR.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -11947,7 +12050,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-Dukt5cJe.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-B8YjwdLK.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11958,7 +12061,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-CwrYVX9u.cjs"));
+		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-CS1sjcRb.cjs"));
 		await stagesCommand(options);
 	} catch (error) {
 		console.error(formatError(error));