@geekmidas/cli 10.0.0-alpha.83 → 10.0.0-alpha.84

package/dist/index.mjs

@@ -4,22 +4,22 @@ import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs"
 import { c as getDokployCredentials, f as removeDokployCredentials, i as LocalSandbox, l as getDokployRegistryId, m as storeHostingerToken, p as storeDokployCredentials, s as getCredentialsPath, u as getDokployToken } from "./credentials-pAtB70k3.mjs";
 import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { M as deployedProblems, N as stageProblems, O as InvalidStages, R as resolveLogs, c as getAppBuildOrder, k as TEST_STAGE, l as getAppGkmConfig, r as allConstructGlobs } from "./workspace-DD9mtPy8.mjs";
+import { I as stageSampleRate, M as deployedProblems, N as stageProblems, O as InvalidStages, c as getAppBuildOrder, k as TEST_STAGE, l as getAppGkmConfig, r as allConstructGlobs } from "./workspace-Drz4jsvy.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { B as WorkerGenerator, Ct as postgresDatabaseNames, F as parseDevServices, Fn as withCustomSecret, G as FAKE_ENV, Gt as imageBuildCredentials, H as workerEntryDir, J as derivedContainers, Jt as eventsBackendFor, K as backendsOf$1, Kt as isImageBuild, Mn as maskPassword, Pn as toEmbeddableSecrets, Tt as quoteIdentifier, U as QueueGenerator, V as workerBundleName, W as CronGenerator, Y as reconcileWorkspace, Yt as providerOf, Zt as CLUSTER_DATABASE, _t as LOCAL_CA_PATH, an as primaryPortKey, cn as findAvailablePort, dn as loadPortState, et as readLocalCredentials, fn as loadSecretsForApp, hn as secretsStoreFor, in as portsOf, kt as pgClient, ln as isPortAvailable, nn as fakeKey, on as createCredentialsPreload, pn as prepareEntryCredentials, q as constructGlobs, qt as cacheBackendFor, sn as createEntryWrapper, tn as describeServices, un as loadEnvFiles, vn as FileSecretsStore, vt as forgetState, wn as deployIdentity, x as dockerCommand, xn as projectKey, yn as getKeyPath, z as workerUnits } from "./seeds-BoKQ74Od.mjs";
-import { a as parseTelemetryFlag, i as telemetryFor, n as runtimeFor, t as EndpointGenerator } from "./EndpointGenerator-DtnIGafh.mjs";
+import { $t as describeServices, An as maskPassword, B as WorkerGenerator, F as parseDevServices, Ft as cacheBackendFor, G as FAKE_ENV, H as workerEntryDir, Ht as TELEMETRY_CONTAINER, It as eventsBackendFor, J as derivedContainers, Jt as scopeTelemetryEnv, K as backendsOf$1, Kt as appTelemetry, Lt as providerOf, Mn as toEmbeddableSecrets, Nn as withCustomSecret, Nt as imageBuildCredentials, Pn as LOCAL_LOGS_EMAIL, Pt as isImageBuild, Sn as deployIdentity, U as QueueGenerator, V as workerBundleName, W as CronGenerator, Xt as telemetryOf, Y as reconcileWorkspace, Yt as surfaceClientTraced, _n as getKeyPath, an as createEntryWrapper, bt as pgClient, cn as loadEnvFiles, ct as LOCAL_CA_PATH, dn as prepareEntryCredentials, en as fakeKey, et as readLocalCredentials, gn as FileSecretsStore, gt as quoteIdentifier, in as createCredentialsPreload, ln as loadPortState, lt as forgetState, mt as postgresDatabaseNames, nn as portsOf, on as findAvailablePort, pn as secretsStoreFor, q as constructGlobs, rn as primaryPortKey, sn as isPortAvailable, un as loadSecretsForApp, x as dockerCommand, yn as projectKey, z as workerUnits, zt as CLUSTER_DATABASE } from "./seeds-BK8caVMm.mjs";
+import { c as startTelemetryCode, l as telemetryFor, n as runtimeFor, o as mountRequestSpansCode, r as parseTelemetryFlag, s as routeTelemetry, t as EndpointGenerator, u as writeTelemetryModule } from "./EndpointGenerator-CVc6Oi1Y.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-DQZeGkDW.mjs";
+import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-BPqQf8fB.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-B4RP2B2O.mjs";
+import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-DTZzxeIl.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi, x as keyFingerprint } from "./sniffer-6oYI-MpT.mjs";
-import { t as deploy$1 } from "./deploy-0XpZDYAr.mjs";
-import { a as stackOverrideFile, c as parseDigests, d as removeEdgeRoutes, f as EDGE_PROJECT, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, p as dockerCompose, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as edgeDir } from "./compose-BPJ9bUKp.mjs";
+import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi, x as keyFingerprint } from "./sniffer-CqE_KTTp.mjs";
+import { t as deploy$1 } from "./deploy-BwIKGxWH.mjs";
+import { a as stackOverrideFile, c as parseDigests, d as removeEdgeRoutes, f as EDGE_PROJECT, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, p as dockerCompose, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as edgeDir } from "./compose-C5wz8mf9.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJqRJNK4.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-DIfuh0Z1.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-D1VfxRuK.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
-import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-DhZbZtFw.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-b6vm0-W-.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Command, Option } from "commander";
@@ -47,7 +47,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.83";
+var version = "10.0.0-alpha.84";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -130,7 +130,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-6oYI-MpT.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-CqE_KTTp.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -530,10 +530,9 @@ var NoLocalCredentials = class extends Error {
 /** The logins of every service the workspace last published. */
 function devCredentials(workspace, credentials, ports) {
 	const containers = SIGNED_IN.filter((container) => portsOf(container).some((port) => ports[port.key] !== void 0));
-	const logs = resolveLogs(workspace.deploy?.compose?.logs);
-	const local = logs ? {
-		url: logs.public ? `https://logs.${workspace.name}.localhost` : `http://localhost:${logs.port}`,
-		via: `gkm compose --stage ${workspace.stages.local}`
+	const local = ports.openobserve !== void 0 ? {
+		url: `http://localhost:${ports.openobserve}`,
+		via: "gkm dev"
 	} : void 0;
 	return {
 		workspace: workspace.name,
@@ -753,6 +752,7 @@ async function collect(records) {
 			root,
 			stage: lead.workspace.stage,
 			manifest: group.find((r) => r.manifest)?.manifest ?? null,
+			telemetry: group.find((r) => r.telemetry)?.telemetry ?? null,
 			apps: discovered,
 			allowedOrigins: [...new Set(group.flatMap((r) => r.allowedOrigins))]
 		});
@@ -1097,6 +1097,7 @@ var DiscoverySession = class DiscoverySession {
 			workspace: options.workspace,
 			allowedOrigins: [...options.allowedOrigins ?? []],
 			...options.manifest ? { manifest: options.manifest } : {},
+			...options.telemetry ? { telemetry: options.telemetry } : {},
 			apps: options.apps
 		};
 		writeRecord(registry, record);
@@ -1850,7 +1851,8 @@ async function devCommand(options) {
 		hooks,
 		skipBundle: true,
 		bustCache,
-		serveEmpty: true
+		serveEmpty: true,
+		workspaceName: workspace.name
 	}));
 	logger$5.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
 	const initial = await build();
@@ -1858,6 +1860,7 @@ async function devCommand(options) {
 	let secretsJsonPath;
 	let publicUrl;
 	let manifest;
+	let telemetryUi;
 	const appSecrets = await loadSecretsForApp(workspace ? await secretsStoreFor(workspace, config.stages.local) : new FileSecretsStore(secretsRoot), config.stages.local);
 	if (workspace) {
 		const reconciled = await reconcileWorkspace(workspace, {
@@ -1869,10 +1872,25 @@ async function devCommand(options) {
 			logger$5.log("🐳 Services");
 			for (const line of describeServices(reconciled.services)) logger$5.log(line);
 		}
+		if (!process.env["GKM_DISCOVERY_QUIET"] && reconciled.credentials && reconciled.ports) {
+			const { services: logins } = devCredentials(workspace, reconciled.credentials, reconciled.ports);
+			if (logins.length > 0) {
+				logger$5.log("🔑 Logins (again any time: gkm dev:credentials)");
+				for (const line of describeLogins(logins)) logger$5.log(line);
+			}
+		}
 		Object.assign(appSecrets, reconciled.env);
+		const scoped = scopeTelemetryEnv(appSecrets, {
+			uses: reconciled.manifest !== void 0 && appTelemetry(reconciled.manifest, workspaceAppName) !== void 0,
+			serviceName: workspaceAppName,
+			telemetry: reconciled.env
+		});
+		for (const key of Object.keys(appSecrets)) if (!(key in scoped)) delete appSecrets[key];
+		Object.assign(appSecrets, scoped);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && appKey(r.id) === workspaceAppName);
 		publicUrl = own ? reconciled.env[own.envKey] : void 0;
 		manifest = reconciled.manifest;
+		telemetryUi = telemetryUiOf(reconciled.services);
 	}
 	if (Object.keys(appSecrets).length > 0) {
 		const secretsDir = join(secretsRoot, ".gkm");
@@ -1895,6 +1913,7 @@ async function devCommand(options) {
 		},
 		allowedOrigins: workspace.dev?.allowedOrigins ?? [],
 		...manifest ? { manifest } : {},
+		...telemetryUi ? { telemetry: telemetryUi } : {},
 		apps: [{
 			name: workspaceAppName,
 			type: "backend",
@@ -2203,17 +2222,20 @@ async function workspaceDevCommand(configured, options) {
 		logger$5.log("🔑 Logins (again any time: gkm dev:credentials)");
 		for (const line of describeLogins(logins)) logger$5.log(line);
 	}
-	const secretsEnv = {
+	const secretsEnv = scopeTelemetryEnv({
 		...rawSecrets,
 		...reconciled.env
-	};
+	}, {
+		uses: false,
+		serviceName: workspace.name
+	});
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-1dGEzuJ-.mjs");
+		const { prepareDevDatabases } = await import("./migrate-CdXcX0XR.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-1dGEzuJ-.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-CdXcX0XR.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2268,6 +2290,7 @@ async function workspaceDevCommand(configured, options) {
 			break;
 		}
 	}
+	const workspaceTelemetry = telemetryUiOf(reconciled.services);
 	const discovery = await joinDiscovery({
 		role: "workspace",
 		port: discoveryPort(workspace.dev),
@@ -2278,6 +2301,7 @@ async function workspaceDevCommand(configured, options) {
 		},
 		allowedOrigins: workspace.dev?.allowedOrigins ?? [],
 		...reconciled.manifest ? { manifest: reconciled.manifest } : {},
+		...workspaceTelemetry ? { telemetry: workspaceTelemetry } : {},
 		apps: buildOrder.flatMap((name) => {
 			const app = workspace.apps[name];
 			if (!app) return [];
@@ -2475,6 +2499,18 @@ var EntryRunner = class {
 	}
 };
 /**
+* Where the local OpenObserve is, and who signs in to it, when reconcile runs
+* one — for the discovery endpoint, which is told no password.
+*/
+function telemetryUiOf(services) {
+	const ui = services.find((s) => s.container === TELEMETRY_CONTAINER);
+	if (!ui) return void 0;
+	return {
+		url: ui.address,
+		email: LOCAL_LOGS_EMAIL
+	};
+}
+/**
 * Generate the content of the dev server entry file (server.ts).
 * Uses dynamic import for createApp so Credentials are populated
 * before any app modules evaluate.
@@ -2520,6 +2556,7 @@ if (existsSync(secretsPath)) {
       injectWs(server);
       console.log('🔌 Telescope real-time updates enabled');
     }`;
+	const telemetry = startTelemetryCode(["/health", "/ready"]);
 	if (selfServing) return `#!/usr/bin/env node
 /**
  * Development server entry point for a surface that serves itself
@@ -2529,8 +2566,17 @@ ${credentialsInjection}${parentWatch}const port = process.argv.includes('--port'
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
   : 3000;
 
+${telemetry}
 // Dynamic import so Credentials are populated before the surface evaluates
-const { app } = await import('${appImportPath}');
+const { app: surface } = await import('${appImportPath}');
+
+// Behind the request spans when there are any, as the production server is.
+const { Hono } = await import('hono');
+const app = requestSpans ? new Hono() : surface;
+if (requestSpans) {
+  ${mountRequestSpansCode("app").trim().replace(/\n/g, "\n  ")}
+  app.route('/', surface);
+}
 
 ${serveCode.replace(/^ {4}/gm, "")}
 `;
@@ -2543,11 +2589,16 @@ ${credentialsInjection}${parentWatch}const port = process.argv.includes('--port'
   ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
   : 3000;
 
+${telemetry}
 // Dynamic import so Credentials are populated before env.ts evaluates
 const { createApp } = await import('${appImportPath}');
 
+// The span middleware first, as the production server mounts it.
+const { Hono } = await import('hono');
+const root = new Hono();
+${mountRequestSpansCode("root")}
 // createApp is async to support optional WebSocket setup
-const { app, start } = await createApp(undefined, ${enableOpenApi});
+const { app, start } = await createApp(root, ${enableOpenApi});
 
 // Start the server
 start({
@@ -2989,6 +3040,7 @@ export default app;
 */
 async function writeSurfaceServer(outputDir, options) {
 	await mkdir(outputDir, { recursive: true });
+	await writeTelemetryModule(outputDir, options.telemetry);
 	const shutdown = options.gracefulShutdown ? `
 // Stop taking requests, let in-flight ones finish, then close what the
 // construct opened — bounded by GKM_SHUTDOWN_TIMEOUT_MS, under Docker's 10s
@@ -3015,12 +3067,14 @@ process.on('SIGINT', shutdown);
  */
 import { serve } from '@hono/node-server';
 import { Hono } from 'hono';
-${options.gracefulShutdown ? "import { runShutdownHooks } from '@geekmidas/constructs';\n" : ""}import { app as surface } from './app.js';
+${options.gracefulShutdown ? "import { runShutdownHooks } from '@geekmidas/constructs';\n" : ""}
+${startTelemetryCode([options.healthCheck])}
+const { app: surface } = await import('./app.js');
 
 const port = Number(process.env.PORT) || 3000;
 
 const app = new Hono();
-// First, so a probe is answered without reaching the surface's own routes.
+${mountRequestSpansCode("app")}// First, so a probe is answered without reaching the surface's own routes.
 app.get(${JSON.stringify(options.healthCheck)}, (c) =>
   c.json({ status: 'ok', timestamp: Date.now() }),
 );
@@ -3217,11 +3271,23 @@ async function buildApp(input) {
 	});
 	if (selfServing) {
 		await writeSurfaceEntry(join(appRoot, ".gkm", "server"), selfServing.source);
+		const telemetry = telemetryFor({
+			node: telemetryOf(declared, selfServing.id),
+			appRoot,
+			app: appNameOf(input),
+			cwd: workspaceRoot,
+			serviceName: selfServing.id,
+			...input.workspaceName && { workspaceName: input.workspaceName }
+		});
+		await writeTelemetryModule(join(appRoot, ".gkm", "server"), telemetry);
 		logger$4.log(`Generated a server for ${selfServing.id} from its own declaration`);
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = join(appRoot, ".gkm", "server");
-			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await import("./bundler-B8TGsunu.mjs");
+			const entryPoint = await writeSurfaceServer(outputDir, {
+				...production,
+				...telemetry ? { telemetry } : {}
+			});
+			const { bundleServer } = await import("./bundler-D4030Afw.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3256,12 +3322,7 @@ async function buildApp(input) {
 			events: eventsBackends
 		}),
 		eventsBackends,
-		markOptional: input.markOptional ?? false,
-		...production && { telemetry: telemetryFor({
-			appRoot,
-			surfaceId: derived.surface?.id,
-			workspaceName: input.workspaceName
-		}) }
+		markOptional: input.markOptional ?? false
 	};
 	const endpointGenerator = new EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
@@ -3279,6 +3340,15 @@ async function buildApp(input) {
 		topicGenerator.load(code, appRoot, bustCache)
 	]);
 	const allEndpoints = servedBy(loadedEndpoints, derived.surface);
+	if (target === "server") buildContext.telemetry = telemetryFor({
+		node: derived.surface ? telemetryOf(declared, derived.surface.id) : void 0,
+		appRoot,
+		app: appNameOf(input),
+		cwd: workspaceRoot,
+		serviceName: derived.surface?.id ?? basename(appRoot),
+		...input.workspaceName && { workspaceName: input.workspaceName },
+		routes: routeTelemetry(allEndpoints.map(({ construct }) => construct))
+	});
 	logger$4.log(`Found ${allEndpoints.length} endpoints`);
 	logger$4.log(`Found ${allFunctions.length} functions`);
 	logger$4.log(`Found ${allCrons.length} crons`);
@@ -3306,6 +3376,14 @@ async function buildApp(input) {
 		const appName = Object.entries(input.workspace.apps).find(([, app]) => resolve(input.workspace.root, app.path) === resolve(appRoot))?.[0];
 		await buildWorkers({
 			context: buildContext,
+			telemetry: (workerId) => telemetryFor({
+				node: telemetryOf(declared, workerId),
+				appRoot,
+				app: appNameOf(input),
+				cwd: workspaceRoot,
+				serviceName: workerId,
+				...input.workspaceName && { workspaceName: input.workspaceName }
+			}),
 			workers: workerUnits(input.workspace, declared, background).filter((unit) => unit.app === appName),
 			serverDir: join(appRoot, ".gkm", "server"),
 			crons: allCrons,
@@ -3317,7 +3395,14 @@ async function buildApp(input) {
 	}
 	await generateOpenApi(allEndpoints.map(({ construct }) => construct), {
 		openapi: config.openapi,
-		root: workspaceRoot
+		root: workspaceRoot,
+		...derived.surface ? clientTelemetry({
+			manifest: declared,
+			surfaceId: derived.surface.id,
+			telemetry: input.workspace?.deploy?.telemetry,
+			stage: input.stage,
+			localStage: input.workspace?.stages.local ?? config.stages?.local
+		}) : {}
 	});
 	return {
 		...result,
@@ -3335,9 +3420,11 @@ async function buildWorkers(input) {
 		const crons = owned(input.crons);
 		const queues = owned(input.queues);
 		const subscribers = owned(input.subscribers);
+		const telemetry = input.telemetry(worker.id);
 		const entryPoint = await generator.build({
 			context: input.context,
 			workerId: worker.id,
+			...telemetry ? { telemetry } : {},
 			outputDir: workerEntryDir(input.serverDir, worker.id),
 			crons,
 			queues,
@@ -3345,7 +3432,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-B8TGsunu.mjs");
+		const { bundleServer } = await import("./bundler-D4030Afw.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3364,6 +3451,22 @@ async function buildWorkers(input) {
 		logger$4.log(`✅ Bundle complete: .gkm/server/dist/${outfile}`);
 	}
 }
+/**
+* Whether the surface's generated client propagates trace context, and at
+* what rate: on when a site that calls it has an edge to a `Telemetry`
+* construct, at the stage's sample rate — every trace locally, and on a build
+* for no stage. Off for a stage that sends no telemetry.
+*/
+function clientTelemetry(options) {
+	if (!surfaceClientTraced(options.manifest, options.surfaceId)) return {};
+	const local = !options.stage || options.stage === options.localStage;
+	const sampleRate = stageSampleRate(options.telemetry, options.stage ?? "", local);
+	return sampleRate === void 0 ? {} : { telemetry: { sampleRate } };
+}
+/** The app being built, by its workspace name or its directory's. */
+function appNameOf(input) {
+	return (input.workspace ? Object.entries(input.workspace.apps).find(([, app]) => resolve(input.workspace.root, app.path) === resolve(input.appRoot))?.[0] : void 0) ?? basename(input.appRoot);
+}
 async function buildForTarget(target, context, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, endpoints, functions, crons, subscribers, queues, topics, enableOpenApi, skipBundle, stage) {
 	const outputDir = join(appRoot, ".gkm", target);
 	await Promise.all([...SUPERSEDED_OUTPUT.map((dir) => join(appRoot, ".gkm", dir)), ...appRoot === workspaceRoot ? [] : [join(appRoot, ".gkm", "manifest")]].map((dir) => rm(dir, {
@@ -3415,7 +3518,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-B8TGsunu.mjs");
+			const { bundleServer } = await import("./bundler-D4030Afw.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5117,25 +5220,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.83",
-	"@geekmidas/auth": "~10.0.0-alpha.83",
-	"@geekmidas/cache": "~10.0.0-alpha.83",
-	"@geekmidas/client": "~10.0.0-alpha.83",
-	"@geekmidas/cloud": "~10.0.0-alpha.83",
-	"@geekmidas/constructs": "~10.0.0-alpha.83",
-	"@geekmidas/db": "~10.0.0-alpha.83",
-	"@geekmidas/emailkit": "~10.0.0-alpha.83",
-	"@geekmidas/envkit": "~10.0.0-alpha.83",
-	"@geekmidas/errors": "~10.0.0-alpha.83",
-	"@geekmidas/events": "~10.0.0-alpha.83",
-	"@geekmidas/logger": "~10.0.0-alpha.83",
-	"@geekmidas/manifest": "~10.0.0-alpha.83",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.83",
-	"@geekmidas/schema": "~10.0.0-alpha.83",
-	"@geekmidas/services": "~10.0.0-alpha.83",
-	"@geekmidas/storage": "~10.0.0-alpha.83",
-	"@geekmidas/telescope": "~10.0.0-alpha.83",
-	"@geekmidas/testkit": "~10.0.0-alpha.83",
+	"@geekmidas/audit": "~10.0.0-alpha.84",
+	"@geekmidas/auth": "~10.0.0-alpha.84",
+	"@geekmidas/cache": "~10.0.0-alpha.84",
+	"@geekmidas/client": "~10.0.0-alpha.84",
+	"@geekmidas/cloud": "~10.0.0-alpha.84",
+	"@geekmidas/constructs": "~10.0.0-alpha.84",
+	"@geekmidas/db": "~10.0.0-alpha.84",
+	"@geekmidas/emailkit": "~10.0.0-alpha.84",
+	"@geekmidas/envkit": "~10.0.0-alpha.84",
+	"@geekmidas/errors": "~10.0.0-alpha.84",
+	"@geekmidas/events": "~10.0.0-alpha.84",
+	"@geekmidas/logger": "~10.0.0-alpha.84",
+	"@geekmidas/manifest": "~10.0.0-alpha.84",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.84",
+	"@geekmidas/schema": "~10.0.0-alpha.84",
+	"@geekmidas/services": "~10.0.0-alpha.84",
+	"@geekmidas/storage": "~10.0.0-alpha.84",
+	"@geekmidas/telescope": "~10.0.0-alpha.84",
+	"@geekmidas/testkit": "~10.0.0-alpha.84",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5536,7 +5639,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "4dee60bc593ffdfbaa59bbf8d8fe9e3e64f23d41", version = cliVersion()) {
+function stagesActionUses(commit = "1a6631b7e6dc71b7dd7b7afb8ca5b82225454826", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -11208,7 +11311,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-1dGEzuJ-.mjs");
+	const { migrateAndSeed } = await import("./migrate-CdXcX0XR.mjs");
 	const { discover } = await import("./discover-BPelzeGW.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
@@ -11652,7 +11755,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-1dGEzuJ-.mjs");
+		const { migrateCommand } = await import("./migrate-CdXcX0XR.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11666,7 +11769,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-1dGEzuJ-.mjs");
+		const { seedCommand } = await import("./migrate-CdXcX0XR.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11680,7 +11783,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-1dGEzuJ-.mjs");
+		const { migrationCommand } = await import("./migrate-CdXcX0XR.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11788,7 +11891,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-DkBEZ5_s.mjs");
+		const { secretsAddCommand } = await import("./add-DbnzC7Kl.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11799,7 +11902,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-0eo9aY_H.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-BRcBAmjL.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11810,7 +11913,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-0eo9aY_H.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-BRcBAmjL.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11853,7 +11956,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./seeds-BoKQ74Od.mjs").then((n) => n._n);
+		const { secretsStoreFor } = await import("./seeds-BK8caVMm.mjs").then((n) => n.hn);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11862,7 +11965,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-BoKQ74Od.mjs").then((n) => n.X);
+		const { derivedContainers } = await import("./seeds-BK8caVMm.mjs").then((n) => n.X);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11880,7 +11983,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-C14NNbFx.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-DOMU4uKe.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11888,7 +11991,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await import("./cli-BgDd4cZB.mjs");
+	const { deployCli } = await import("./cli-DwTa9d_8.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11905,7 +12008,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-CwVhG_xa.mjs").then((n) => n.a);
+		const { rollbackStage } = await import("./rollback-BSdxnW3X.mjs").then((n) => n.a);
 		const { terminalCredentials } = await import("./terminal-BdvrmkaC.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -11941,7 +12044,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-HOfOpFI_.mjs");
+		const { deployGithubCommand } = await import("./github-Zs-dVJbR.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11952,7 +12055,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await import("./stages-CHF9RFog.mjs");
+		const { stagesCommand } = await import("./stages-CSXt7N2b.mjs");
 		await stagesCommand(options);
 	} catch (error) {
 		console.error(formatError(error));