@geekmidas/cli 10.0.0-alpha.89 → 10.0.0-alpha.90

package/dist/index.mjs

@@ -5,7 +5,7 @@ import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } fr
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-CJ0lKFq-.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { $n as LOCAL_LOGS_EMAIL, $t as isImageBuild, An as prepareEntryCredentials, Cn as createCredentialsPreload, Dn as loadEnvFiles, Dt as LOCAL_CA_PATH, En as isPortAvailable, Fn as FileSecretsStore, Ft as quoteIdentifier, In as getKeyPath, Mn as secretsStoreFor, Nt as postgresDatabaseNames, On as loadPortState, Ot as forgetState, Qn as withCustomSecret, Qt as imageBuildCredentials, Rn as projectKey, Sn as primaryPortKey, Tn as findAvailablePort, U as createStateStore, Vn as deployIdentity, X as assertDevServicesFlag, Yn as maskPassword, Zn as toEmbeddableSecrets, a as provisionStage, at as WorkerGenerator, ct as QueueGenerator, dn as appTelemetry, dt as backendsOf$1, en as cacheBackendFor, ft as constructGlobs, h as dockerCommand, hn as telemetryOf, in as CLUSTER_DATABASE, it as workerUnits, kn as loadSecretsForApp, lt as CronGenerator, mn as surfaceClientTraced, mt as reconcileWorkspace, nn as providerOf, ot as workerBundleName, pn as scopeTelemetryEnv, pt as derivedContainers, sn as TELEMETRY_CONTAINER, st as workerEntryDir, tn as eventsBackendFor, u as provisionCommand, ut as FAKE_ENV, vn as describeServices, wn as createEntryWrapper, xn as portsOf, yn as fakeKey, yt as readLocalCredentials, zt as pgClient } from "./seeds-perzdN81.mjs";
+import { $n as LOCAL_LOGS_EMAIL, $t as isImageBuild, An as prepareEntryCredentials, Cn as createCredentialsPreload, Dn as loadEnvFiles, Dt as LOCAL_CA_PATH, En as isPortAvailable, Fn as FileSecretsStore, Ft as quoteIdentifier, In as getKeyPath, Mn as secretsStoreFor, Nt as postgresDatabaseNames, On as loadPortState, Ot as forgetState, Qn as withCustomSecret, Qt as imageBuildCredentials, Rn as projectKey, Sn as primaryPortKey, Tn as findAvailablePort, U as createStateStore, Vn as deployIdentity, X as assertDevServicesFlag, Yn as maskPassword, Zn as toEmbeddableSecrets, a as provisionStage, at as WorkerGenerator, ct as QueueGenerator, dn as appTelemetry, dt as backendsOf$1, en as cacheBackendFor, ft as constructGlobs, h as dockerCommand, hn as telemetryOf, in as CLUSTER_DATABASE, it as workerUnits, kn as loadSecretsForApp, lt as CronGenerator, mn as surfaceClientTraced, mt as reconcileWorkspace, nn as providerOf, ot as workerBundleName, pn as scopeTelemetryEnv, pt as derivedContainers, sn as TELEMETRY_CONTAINER, st as workerEntryDir, tn as eventsBackendFor, u as provisionCommand, ut as FAKE_ENV, vn as describeServices, wn as createEntryWrapper, xn as portsOf, yn as fakeKey, yt as readLocalCredentials, zt as pgClient } from "./seeds-odfgSCmu.mjs";
 import { c as startTelemetryCode, l as telemetryFor, n as runtimeFor, o as mountRequestSpansCode, r as parseTelemetryFlag, s as routeTelemetry, t as EndpointGenerator, u as writeTelemetryModule } from "./EndpointGenerator-CVc6Oi1Y.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-BPqQf8fB.mjs";
@@ -14,10 +14,10 @@ import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
 import { t as LocalSandbox } from "./local-IuoIF3CT.mjs";
 import { f as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-BTtX3NUM.mjs";
-import { t as deploy$1 } from "./deploy-BaERRh0Q.mjs";
-import { _ as planStackDns, a as stackOverrideFile, b as serverAddressHint, d as pinnedRef, f as edgeDir, g as applyStackDns, h as dockerCompose, i as ComposePushNeedsBuild, m as EDGE_PROJECT, o as composeProject, p as removeEdgeRoutes, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as parseDigests, v as requiredServerAddress, x as stackHosts, y as serverAddress } from "./compose-Dn0oAgQ0.mjs";
+import { t as deploy$1 } from "./deploy-QNtx_eWR.mjs";
+import { _ as planStackDns, a as stackOverrideFile, b as serverAddressHint, d as pinnedRef, f as edgeDir, g as applyStackDns, h as dockerCompose, i as ComposePushNeedsBuild, m as EDGE_PROJECT, o as composeProject, p as removeEdgeRoutes, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as parseDigests, v as requiredServerAddress, x as stackHosts, y as serverAddress } from "./compose-Bhmf0n4o.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJqRJNK4.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-C_hYDv6I.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-CU-O0SBp.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
 import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-b6vm0-W-.mjs";
 import { createRequire } from "node:module";
@@ -47,7 +47,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.89";
+var version = "10.0.0-alpha.90";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -2324,9 +2324,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-CKLJ73OO.mjs");
+		const { prepareDevDatabases } = await import("./migrate-DbtcuOr_.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-CKLJ73OO.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-DbtcuOr_.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3379,7 +3379,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await import("./bundler-C_fCgcVO.mjs");
+			const { bundleServer } = await import("./bundler-D6eBfVkl.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3524,7 +3524,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-C_fCgcVO.mjs");
+		const { bundleServer } = await import("./bundler-D6eBfVkl.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3610,7 +3610,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-C_fCgcVO.mjs");
+			const { bundleServer } = await import("./bundler-D6eBfVkl.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5312,25 +5312,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.89",
-	"@geekmidas/auth": "~10.0.0-alpha.89",
-	"@geekmidas/cache": "~10.0.0-alpha.89",
-	"@geekmidas/client": "~10.0.0-alpha.89",
-	"@geekmidas/cloud": "~10.0.0-alpha.89",
-	"@geekmidas/constructs": "~10.0.0-alpha.89",
-	"@geekmidas/db": "~10.0.0-alpha.89",
-	"@geekmidas/emailkit": "~10.0.0-alpha.89",
-	"@geekmidas/envkit": "~10.0.0-alpha.89",
-	"@geekmidas/errors": "~10.0.0-alpha.89",
-	"@geekmidas/events": "~10.0.0-alpha.89",
-	"@geekmidas/logger": "~10.0.0-alpha.89",
-	"@geekmidas/manifest": "~10.0.0-alpha.89",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.89",
-	"@geekmidas/schema": "~10.0.0-alpha.89",
-	"@geekmidas/services": "~10.0.0-alpha.89",
-	"@geekmidas/storage": "~10.0.0-alpha.89",
-	"@geekmidas/telescope": "~10.0.0-alpha.89",
-	"@geekmidas/testkit": "~10.0.0-alpha.89",
+	"@geekmidas/audit": "~10.0.0-alpha.90",
+	"@geekmidas/auth": "~10.0.0-alpha.90",
+	"@geekmidas/cache": "~10.0.0-alpha.90",
+	"@geekmidas/client": "~10.0.0-alpha.90",
+	"@geekmidas/cloud": "~10.0.0-alpha.90",
+	"@geekmidas/constructs": "~10.0.0-alpha.90",
+	"@geekmidas/db": "~10.0.0-alpha.90",
+	"@geekmidas/emailkit": "~10.0.0-alpha.90",
+	"@geekmidas/envkit": "~10.0.0-alpha.90",
+	"@geekmidas/errors": "~10.0.0-alpha.90",
+	"@geekmidas/events": "~10.0.0-alpha.90",
+	"@geekmidas/logger": "~10.0.0-alpha.90",
+	"@geekmidas/manifest": "~10.0.0-alpha.90",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.90",
+	"@geekmidas/schema": "~10.0.0-alpha.90",
+	"@geekmidas/services": "~10.0.0-alpha.90",
+	"@geekmidas/storage": "~10.0.0-alpha.90",
+	"@geekmidas/telescope": "~10.0.0-alpha.90",
+	"@geekmidas/testkit": "~10.0.0-alpha.90",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5731,7 +5731,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "e1be097c3e5909843479a2dcd97f06e952f5b1aa", version = cliVersion()) {
+function stagesActionUses(commit = "108157b10491802890a494443587d8bbd312f5db", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -11049,8 +11049,8 @@ async function composeStageHosts(options) {
 		...options.profile ? { profile: options.profile } : {},
 		...options.home ? { home: options.home } : {}
 	})).read(stage);
-	const { deployedStackSecrets } = await import("./compose-Dn0oAgQ0.mjs").then((n) => n.l);
-	const { composeStack } = await import("./compose-Dn0oAgQ0.mjs").then((n) => n.c);
+	const { deployedStackSecrets } = await import("./compose-Bhmf0n4o.mjs").then((n) => n.l);
+	const { composeStack } = await import("./compose-Bhmf0n4o.mjs").then((n) => n.c);
 	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
 	const stack = composeStack({
 		workspace,
@@ -11144,6 +11144,7 @@ async function provisionStageDns(options) {
 //#endregion
 //#region src/setup/index.ts
 var setup_exports = /* @__PURE__ */ __exportAll({
+	StageSecretsUnreadable: () => StageSecretsUnreadable,
 	createFreshWorkspaceSecrets: () => createFreshWorkspaceSecrets,
 	ensureStageSecrets: () => ensureStageSecrets,
 	reconcileSecrets: () => reconcileSecrets,
@@ -11175,7 +11176,7 @@ async function setupCommand(options = {}) {
 	logger$1.log(`📦 Workspace: ${workspace.name}`);
 	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
 	logger$1.log(`🔑 Stage: ${stage}\n`);
-	if (!local) assertStageServer(workspace, stage, await (await secretsStoreFor(workspace, stage, { ...options.profile ? { profile: options.profile } : {} })).read(stage));
+	if (!local) assertStageServer(workspace, stage, await readStageSecrets(await secretsStoreFor(workspace, stage, { ...options.profile ? { profile: options.profile } : {} }), stage, options));
 	if (!local && options.dryRun) {
 		await provisionDeployed(workspace, stage, options);
 		return;
@@ -11194,6 +11195,48 @@ async function setupCommand(options = {}) {
 	}
 	printSummary(workspace, stage);
 }
+/** Where each AWS store keeps a stage's secrets, as a person reads it. */
+const AWS_STORES = {
+	ssm: "SSM Parameter Store",
+	"secrets-manager": "Secrets Manager"
+};
+/**
+* A deployed stage's secrets are kept in its AWS account, and no AWS
+* credentials were found to read them with.
+*
+* Raised before any provider runs: even a dry run reads the stage's secrets,
+* since its plan needs the server they name (`GKM_SERVER_IPV4`).
+*/
+var StageSecretsUnreadable = class extends Error {
+	stage;
+	store;
+	profile;
+	dryRun;
+	constructor(stage, store, profile, dryRun, cause) {
+		const where = AWS_STORES[store] ?? `the '${store}' store`;
+		const command = `gkm setup --stage ${stage}${dryRun ? " --dry-run" : ""}`;
+		super(`The '${stage}' stage's secrets are kept in ${where}, in the stage's AWS account, and ` + (profile ? `the AWS profile '${profile}' has no credentials to read them with. Sign in to it (aws sso login --profile ${profile}) or name another: ${command} --profile <profile>.` : `no AWS credentials were found to read them with. Name the account's profile: ${command} --profile <profile>, or AWS_PROFILE=<profile> ${command}.`) + (dryRun ? " A dry run still reads them: its plan needs the server the stage names (GKM_SERVER_IPV4)." : ""), { cause });
+		this.stage = stage;
+		this.store = store;
+		this.profile = profile;
+		this.dryRun = dryRun;
+		this.name = "StageSecretsUnreadable";
+	}
+};
+/**
+* The stage's secrets from its store, refused with
+* {@link StageSecretsUnreadable} when there are no AWS credentials to read
+* them — matched by the SDK's error name, its message being free to change.
+* Any other failure is the store's own, and passes through.
+*/
+async function readStageSecrets(store, stage, options) {
+	try {
+		return await store.read(stage);
+	} catch (error) {
+		if (error?.name === "CredentialsProviderError") throw new StageSecretsUnreadable(stage, store.name, options.profile, options.dryRun === true, error);
+		throw error;
+	}
+}
 /**
 * A deployed stage's providers: each one's `ensure()`, in the stage's own
 * account, its keys written into the stage's secrets.
@@ -11573,7 +11616,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-CKLJ73OO.mjs");
+	const { migrateAndSeed } = await import("./migrate-DbtcuOr_.mjs");
 	const { discover } = await import("./discover-BPelzeGW.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
@@ -12017,7 +12060,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-CKLJ73OO.mjs");
+		const { migrateCommand } = await import("./migrate-DbtcuOr_.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12031,7 +12074,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-CKLJ73OO.mjs");
+		const { seedCommand } = await import("./migrate-DbtcuOr_.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12045,7 +12088,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-CKLJ73OO.mjs");
+		const { migrationCommand } = await import("./migrate-DbtcuOr_.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -12153,7 +12196,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-v3tCbrpE.mjs");
+		const { secretsAddCommand } = await import("./add-DHk1roh_.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12164,7 +12207,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-BQmhq9_y.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-BrEef7Jk.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12175,7 +12218,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-BQmhq9_y.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-BrEef7Jk.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12218,7 +12261,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile-Dh1Jk7WE.mjs");
-		const { secretsStoreFor } = await import("./seeds-perzdN81.mjs").then((n) => n.Pn);
+		const { secretsStoreFor } = await import("./seeds-odfgSCmu.mjs").then((n) => n.Pn);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12227,7 +12270,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-perzdN81.mjs").then((n) => n.ht);
+		const { derivedContainers } = await import("./seeds-odfgSCmu.mjs").then((n) => n.ht);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12245,7 +12288,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-CpmO5qnl.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-DWZz9kah.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -12253,7 +12296,7 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Compose: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
-	const { deployCli } = await import("./cli-REdO9X5b.mjs");
+	const { deployCli } = await import("./cli-DD-Yk-I5.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12271,7 +12314,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-DpSU2DsD.mjs").then((n) => n.a);
+		const { rollbackStage } = await import("./rollback-CFrNLmxs.mjs").then((n) => n.a);
 		const { terminalCredentials } = await import("./terminal-D8TPK7o9.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -12307,7 +12350,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-xzg99wz8.mjs");
+		const { deployGithubCommand } = await import("./github-BCDF6xVH.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));