@geekmidas/cli 10.0.0-alpha.85 → 10.0.0-alpha.86

package/dist/index.mjs

@@ -1,23 +1,23 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs";
-import { c as getDokployCredentials, f as removeDokployCredentials, i as LocalSandbox, l as getDokployRegistryId, m as storeHostingerToken, p as storeDokployCredentials, s as getCredentialsPath, u as getDokployToken } from "./credentials-pAtB70k3.mjs";
+import { d as getDokployRegistryId, f as getDokployToken, g as storeHostingerToken, h as storeDokployCredentials, i as CommandFailed, l as getCredentialsPath, m as removeDokployCredentials, o as DEFAULT_TIMEOUT_MS, u as getDokployCredentials } from "./credentials-BgJ5mS_d.mjs";
 import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { I as stageSampleRate, M as deployedProblems, N as stageProblems, O as InvalidStages, c as getAppBuildOrder, k as TEST_STAGE, l as getAppGkmConfig, r as allConstructGlobs } from "./workspace-Drz4jsvy.mjs";
+import { I as stageSampleRate, M as deployedProblems, N as stageProblems, O as InvalidStages, c as getAppBuildOrder, k as TEST_STAGE, l as getAppGkmConfig, r as allConstructGlobs } from "./workspace-D2CYLMCW.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { $t as describeServices, An as maskPassword, B as WorkerGenerator, F as parseDevServices, Ft as cacheBackendFor, G as FAKE_ENV, H as workerEntryDir, Ht as TELEMETRY_CONTAINER, It as eventsBackendFor, J as derivedContainers, Jt as scopeTelemetryEnv, K as backendsOf$1, Kt as appTelemetry, Lt as providerOf, Mn as toEmbeddableSecrets, Nn as withCustomSecret, Nt as imageBuildCredentials, Pn as LOCAL_LOGS_EMAIL, Pt as isImageBuild, Sn as deployIdentity, U as QueueGenerator, V as workerBundleName, W as CronGenerator, Xt as telemetryOf, Y as reconcileWorkspace, Yt as surfaceClientTraced, _n as getKeyPath, an as createEntryWrapper, bt as pgClient, cn as loadEnvFiles, ct as LOCAL_CA_PATH, dn as prepareEntryCredentials, en as fakeKey, et as readLocalCredentials, gn as FileSecretsStore, gt as quoteIdentifier, in as createCredentialsPreload, ln as loadPortState, lt as forgetState, mt as postgresDatabaseNames, nn as portsOf, on as findAvailablePort, pn as secretsStoreFor, q as constructGlobs, rn as primaryPortKey, sn as isPortAvailable, un as loadSecretsForApp, x as dockerCommand, yn as projectKey, z as workerUnits, zt as CLUSTER_DATABASE } from "./seeds-9C5CkDon.mjs";
+import { Cn as loadEnvFiles, Ct as LOCAL_CA_PATH, D as dockerCommand, En as prepareEntryCredentials, Ft as pgClient, Gn as maskPassword, Jn as withCustomSecret, Jt as imageBuildCredentials, K as assertDevServicesFlag, Ln as deployIdentity, Mn as getKeyPath, On as secretsStoreFor, Pn as projectKey, Qt as providerOf, S as provisionCommand, Sn as isPortAvailable, Tn as loadSecretsForApp, Xt as cacheBackendFor, Yn as LOCAL_LOGS_EMAIL, Yt as isImageBuild, Zt as eventsBackendFor, _n as portsOf, a as provisionStage, at as CronGenerator, bn as createEntryWrapper, ct as constructGlobs, dn as telemetryOf, en as CLUSTER_DATABASE, et as workerUnits, hn as fakeKey, ht as readLocalCredentials, it as QueueGenerator, jn as FileSecretsStore, jt as quoteIdentifier, kt as postgresDatabaseNames, ln as scopeTelemetryEnv, lt as derivedContainers, mn as describeServices, nt as workerBundleName, ot as FAKE_ENV, qn as toEmbeddableSecrets, rn as TELEMETRY_CONTAINER, rt as workerEntryDir, sn as appTelemetry, st as backendsOf$1, tt as WorkerGenerator, un as surfaceClientTraced, ut as reconcileWorkspace, vn as primaryPortKey, wn as loadPortState, wt as forgetState, xn as findAvailablePort, yn as createCredentialsPreload, z as createStateStore } from "./seeds-BYdrtZsC.mjs";
 import { c as startTelemetryCode, l as telemetryFor, n as runtimeFor, o as mountRequestSpansCode, r as parseTelemetryFlag, s as routeTelemetry, t as EndpointGenerator, u as writeTelemetryModule } from "./EndpointGenerator-CVc6Oi1Y.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-BPqQf8fB.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
 import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-DTZzxeIl.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi, x as keyFingerprint } from "./sniffer-DgBkaLAu.mjs";
-import { t as deploy$1 } from "./deploy-BuU117CA.mjs";
-import { a as stackOverrideFile, c as parseDigests, d as removeEdgeRoutes, f as EDGE_PROJECT, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, p as dockerCompose, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as edgeDir } from "./compose-CQK6StuE.mjs";
+import { t as LocalSandbox } from "./local-Ciq-bTPr.mjs";
+import { f as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-B0EU73bj.mjs";
+import { t as deploy$1 } from "./deploy-BTfmXd3g.mjs";
+import { a as stackOverrideFile, c as parseDigests, d as removeEdgeRoutes, f as EDGE_PROJECT, i as ComposePushNeedsBuild, l as pinnedRef, o as composeProject, p as dockerCompose, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as edgeDir } from "./compose-DbJhRQlh.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJqRJNK4.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-ByVjUIvS.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-Q4vXg2ua.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
 import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-b6vm0-W-.mjs";
 import { createRequire } from "node:module";
@@ -47,7 +47,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.85";
+var version = "10.0.0-alpha.86";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -130,7 +130,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-DgBkaLAu.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-B0EU73bj.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2233,9 +2233,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-BeTWLSeC.mjs");
+		const { prepareDevDatabases } = await import("./migrate-ggkPVJRC.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-BeTWLSeC.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-ggkPVJRC.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3287,7 +3287,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await import("./bundler-CaAKsbcN.mjs");
+			const { bundleServer } = await import("./bundler-BMo-JP5s.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3432,7 +3432,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-CaAKsbcN.mjs");
+		const { bundleServer } = await import("./bundler-BMo-JP5s.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3518,7 +3518,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-CaAKsbcN.mjs");
+			const { bundleServer } = await import("./bundler-BMo-JP5s.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3772,7 +3772,6 @@ async function composeCommand(options, deps = {}) {
 	if (options.push && !options.build) throw new ComposePushNeedsBuild();
 	const pulls = !options.build && (options.pull || options.tag !== void 0);
 	if (options.digestsFile && !options.push && !pulls) throw new ComposePinNeedsPull();
-	const allowDevServices = parseDevServices(options.allowDevServices);
 	const cwd = resolve(options.cwd ?? process.cwd());
 	const { workspace } = await loadWorkspaceConfig(cwd);
 	const { stage } = options;
@@ -3812,7 +3811,7 @@ async function composeCommand(options, deps = {}) {
 		...tag ? { tag } : {},
 		...options.dryRun ? { dryRun: true } : {},
 		...options.push ? { buildOnly: true } : {},
-		...allowDevServices.length > 0 ? { allowDevServices } : {},
+		...options.allowDevServices ? { allowDevServices: true } : {},
 		logger: {
 			info: (message) => console.log(message),
 			warn: (message) => console.warn(message),
@@ -5220,25 +5219,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.85",
-	"@geekmidas/auth": "~10.0.0-alpha.85",
-	"@geekmidas/cache": "~10.0.0-alpha.85",
-	"@geekmidas/client": "~10.0.0-alpha.85",
-	"@geekmidas/cloud": "~10.0.0-alpha.85",
-	"@geekmidas/constructs": "~10.0.0-alpha.85",
-	"@geekmidas/db": "~10.0.0-alpha.85",
-	"@geekmidas/emailkit": "~10.0.0-alpha.85",
-	"@geekmidas/envkit": "~10.0.0-alpha.85",
-	"@geekmidas/errors": "~10.0.0-alpha.85",
-	"@geekmidas/events": "~10.0.0-alpha.85",
-	"@geekmidas/logger": "~10.0.0-alpha.85",
-	"@geekmidas/manifest": "~10.0.0-alpha.85",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.85",
-	"@geekmidas/schema": "~10.0.0-alpha.85",
-	"@geekmidas/services": "~10.0.0-alpha.85",
-	"@geekmidas/storage": "~10.0.0-alpha.85",
-	"@geekmidas/telescope": "~10.0.0-alpha.85",
-	"@geekmidas/testkit": "~10.0.0-alpha.85",
+	"@geekmidas/audit": "~10.0.0-alpha.86",
+	"@geekmidas/auth": "~10.0.0-alpha.86",
+	"@geekmidas/cache": "~10.0.0-alpha.86",
+	"@geekmidas/client": "~10.0.0-alpha.86",
+	"@geekmidas/cloud": "~10.0.0-alpha.86",
+	"@geekmidas/constructs": "~10.0.0-alpha.86",
+	"@geekmidas/db": "~10.0.0-alpha.86",
+	"@geekmidas/emailkit": "~10.0.0-alpha.86",
+	"@geekmidas/envkit": "~10.0.0-alpha.86",
+	"@geekmidas/errors": "~10.0.0-alpha.86",
+	"@geekmidas/events": "~10.0.0-alpha.86",
+	"@geekmidas/logger": "~10.0.0-alpha.86",
+	"@geekmidas/manifest": "~10.0.0-alpha.86",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.86",
+	"@geekmidas/schema": "~10.0.0-alpha.86",
+	"@geekmidas/services": "~10.0.0-alpha.86",
+	"@geekmidas/storage": "~10.0.0-alpha.86",
+	"@geekmidas/telescope": "~10.0.0-alpha.86",
+	"@geekmidas/testkit": "~10.0.0-alpha.86",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5639,7 +5638,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "66f8094280d04ad763f978cdd0a55aeaa5b4180b", version = cliVersion()) {
+function stagesActionUses(commit = "4b431683030dbd72d145ef850ef5348106aac97f", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -10929,12 +10928,14 @@ var setup_exports = /* @__PURE__ */ __exportAll({
 });
 const logger$1 = console;
 /**
-* Setup development environment.
+* Converge a stage on what its constructs declare.
 *
-* Orchestrates:
-* 1. Load workspace config
-* 2. Resolve secrets (local → the stage's store → generate fresh)
-* 3. Start Docker services
+* The local stage: its secrets (local → the stage's store → generated) and
+* the containers on this machine. A deployed stage: its secrets, and then
+* every provider `deploy.<kind>.<stage>` names — the bucket, user and key an
+* `objects: { provider: 's3' }` stage is backed by — created or repaired in
+* the stage's own account. A deployed stage's infrastructure is not on this
+* machine, so no container is started for one.
 */
 async function setupCommand(options = {}) {
 	logger$1.log("\n🔧 Setting up the local environment...\n");
@@ -10947,13 +10948,22 @@ async function setupCommand(options = {}) {
 	}
 	const stage = options.stage ?? loadedConfig.workspace.stages.local;
 	const { workspace } = loadedConfig;
+	const local = stage === workspace.stages.local;
 	logger$1.log(`📦 Workspace: ${workspace.name}`);
 	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
 	logger$1.log(`🔑 Stage: ${stage}\n`);
+	if (!local && options.dryRun) {
+		await provisionDeployed(workspace, stage, options);
+		return;
+	}
 	if (!await resolveSecrets(stage, workspace, options)) {
 		logger$1.error("❌ Failed to resolve secrets. Exiting.");
 		process.exit(1);
 	}
+	if (!local) {
+		await provisionDeployed(workspace, stage, options);
+		return;
+	}
 	if (!options.skipDocker) {
 		logger$1.log("");
 		await reconcileLocal(workspace, stage, options);
@@ -10961,6 +10971,28 @@ async function setupCommand(options = {}) {
 	printSummary(workspace, stage);
 }
 /**
+* A deployed stage's providers: each one's `ensure()`, in the stage's own
+* account, its keys written into the stage's secrets.
+*/
+async function provisionDeployed(workspace, stage, options) {
+	logger$1.log(options.dryRun ? `\n☁️  Providers for '${stage}' (dry run — nothing is created or written)` : `\n☁️  Providers for '${stage}'`);
+	const configured = (await provisionStage({
+		workspace,
+		stage,
+		...options.dryRun ? { dryRun: true } : {},
+		...options.profile ? { profile: options.profile } : {},
+		...options.rotateKeys ? { rotateKeys: true } : {},
+		...options.retireOldKeys ? { retireOldKeys: true } : {},
+		log: (line) => logger$1.log(line)
+	})).filter((r) => r.mode === "provider");
+	if (configured.length === 0) {
+		logger$1.log(`   None configured: '${stage}' takes every key from its secrets (gkm secrets:add --stage ${stage}). Name one in gkm.config.ts — deploy: { objects: { ${stage}: { provider: 's3' } } } — to have ${provisionCommand(stage)} create it.`);
+		return;
+	}
+	const changes = configured.reduce((n, r) => n + r.actions.length, 0);
+	logger$1.log(options.dryRun ? `\n${changes === 0 ? "✅ Nothing to change" : `📋 ${changes} change${changes === 1 ? "" : "s"} planned`}` : `\n✅ '${stage}' provisioned${changes === 0 ? " — already up to date" : ` (${changes} change${changes === 1 ? "" : "s"})`}`);
+}
+/**
 * Converge this machine on what the manifest declares.
 *
 * Says what it did in one line and stays silent when it did nothing, because
@@ -11311,7 +11343,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-BeTWLSeC.mjs");
+	const { migrateAndSeed } = await import("./migrate-ggkPVJRC.mjs");
 	const { discover } = await import("./discover-BPelzeGW.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
@@ -11667,7 +11699,7 @@ program.command("trust").description("Trust the local edge's certificate authori
 		process.exit(1);
 	}
 });
-program.command("setup").description("Reconcile declared constructs — containers, databases, buckets, secrets").option("--stage <stage>", "Stage name (default: stages.local)").option("--force", "Regenerate secrets even if they exist").option("--skip-docker", "Skip starting Docker services").option("-y, --yes", "Skip prompts").action(async (options) => {
+program.command("setup").description("Reconcile declared constructs — locally, containers and secrets; on a deployed stage, its providers (deploy.objects)").option("--stage <stage>", "Stage name (default: stages.local)").option("--force", "Regenerate secrets even if they exist").option("--skip-docker", "Skip starting Docker services").option("-y, --yes", "Skip prompts").option("--dry-run", "A deployed stage: print what its providers would create or change, and write nothing").option("--profile <profile>", "AWS profile for the stage's account").option("--rotate-keys", "A deployed stage: issue each provisioned key a successor (the old one is deleted after the next deploy)").option("--retire-old-keys", "A deployed stage: delete a rotated-out key now instead of after the next deploy").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -11755,7 +11787,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-BeTWLSeC.mjs");
+		const { migrateCommand } = await import("./migrate-ggkPVJRC.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11769,7 +11801,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-BeTWLSeC.mjs");
+		const { seedCommand } = await import("./migrate-ggkPVJRC.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11783,7 +11815,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-BeTWLSeC.mjs");
+		const { migrationCommand } = await import("./migrate-ggkPVJRC.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11832,7 +11864,7 @@ program.command("docker").description("Generate Docker deployment files").option
 		process.exit(1);
 	}
 });
-program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services <list>", "Deployed stage: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
+program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -11891,7 +11923,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-jpX7M8RB.mjs");
+		const { secretsAddCommand } = await import("./add-D_jNqnfZ.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11902,7 +11934,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-DpAum8W7.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-C-8Tt5Hh.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11913,7 +11945,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-DpAum8W7.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-C-8Tt5Hh.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11956,7 +11988,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./seeds-9C5CkDon.mjs").then((n) => n.hn);
+		const { secretsStoreFor } = await import("./seeds-BYdrtZsC.mjs").then((n) => n.An);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11965,7 +11997,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-9C5CkDon.mjs").then((n) => n.X);
+		const { derivedContainers } = await import("./seeds-BYdrtZsC.mjs").then((n) => n.dt);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11983,15 +12015,15 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-sDq7NApJ.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-Dn7nK6sh.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await import("./cli-BV3jzbk0.mjs");
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").action(async (options) => {
+	const { deployCli } = await import("./cli-7edNFwGk.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12002,14 +12034,14 @@ program.command("deploy").description("Deploy a stage through its target").optio
 		...options.json ? { json: true } : {},
 		...options.dryRun ? { dryRun: true } : {},
 		...options.atomic ? { atomic: true } : {},
-		...options.allowDevServices ? { allowDevServices: options.allowDevServices } : {}
+		...options.allowDevServices ? { allowDevServices: true } : {}
 	});
 	if (code !== 0) process.exit(code);
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-ByyFE5lV.mjs").then((n) => n.a);
-		const { terminalCredentials } = await import("./terminal-BdvrmkaC.mjs");
+		const { rollbackStage } = await import("./rollback-CEE6dse4.mjs").then((n) => n.a);
+		const { terminalCredentials } = await import("./terminal-BTbZlrFV.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12044,7 +12076,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-8B68qrLs.mjs");
+		const { deployGithubCommand } = await import("./github-CZHAtwPT.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12055,7 +12087,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await import("./stages-CSXt7N2b.mjs");
+		const { stagesCommand } = await import("./stages-DoHHz6pS.mjs");
 		await stagesCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12188,6 +12220,12 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 		process.exit(1);
 	}
 });
+try {
+	assertDevServicesFlag(process.argv.slice(2));
+} catch (error) {
+	console.error(formatError(error));
+	process.exit(1);
+}
 program.parse();
 //#endregion
 export { validateDokployToken as a, formatError as i, slug as n, canPrompt as o, stamp as r, prompt as s, generateFullstackCustomSecrets as t };