@geekmidas/cli 10.0.0-alpha.90 → 10.0.0-alpha.92

package/dist/index.mjs

@@ -1,25 +1,27 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { _ as storeDokployCredentials, d as getDokployRegistryId, f as getDokployToken, g as removeGoDaddyCredentials, h as removeDokployCredentials, i as CommandFailed, l as getCredentialsPath, m as readCredentials, o as DEFAULT_TIMEOUT_MS, t as MissingCredential, u as getDokployCredentials, v as storeGoDaddyToken, y as storeHostingerToken } from "./credentials-CnVqoXMb.mjs";
-import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
+import { n as isGkmError, t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { _ as storeDokployCredentials, d as getDokployRegistryId, f as getDokployToken, g as removeGoDaddyCredentials, h as removeDokployCredentials, i as CommandFailed, l as getCredentialsPath, m as readCredentials, o as DEFAULT_TIMEOUT_MS, t as MissingCredential, u as getDokployCredentials, v as storeGoDaddyToken, y as storeHostingerToken } from "./credentials-C4KII3PD.mjs";
+import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-qjFapetL.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-CJ0lKFq-.mjs";
+import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-Bzw7Zs82.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { $n as LOCAL_LOGS_EMAIL, $t as isImageBuild, An as prepareEntryCredentials, Cn as createCredentialsPreload, Dn as loadEnvFiles, Dt as LOCAL_CA_PATH, En as isPortAvailable, Fn as FileSecretsStore, Ft as quoteIdentifier, In as getKeyPath, Mn as secretsStoreFor, Nt as postgresDatabaseNames, On as loadPortState, Ot as forgetState, Qn as withCustomSecret, Qt as imageBuildCredentials, Rn as projectKey, Sn as primaryPortKey, Tn as findAvailablePort, U as createStateStore, Vn as deployIdentity, X as assertDevServicesFlag, Yn as maskPassword, Zn as toEmbeddableSecrets, a as provisionStage, at as WorkerGenerator, ct as QueueGenerator, dn as appTelemetry, dt as backendsOf$1, en as cacheBackendFor, ft as constructGlobs, h as dockerCommand, hn as telemetryOf, in as CLUSTER_DATABASE, it as workerUnits, kn as loadSecretsForApp, lt as CronGenerator, mn as surfaceClientTraced, mt as reconcileWorkspace, nn as providerOf, ot as workerBundleName, pn as scopeTelemetryEnv, pt as derivedContainers, sn as TELEMETRY_CONTAINER, st as workerEntryDir, tn as eventsBackendFor, u as provisionCommand, ut as FAKE_ENV, vn as describeServices, wn as createEntryWrapper, xn as portsOf, yn as fakeKey, yt as readLocalCredentials, zt as pgClient } from "./seeds-odfgSCmu.mjs";
-import { c as startTelemetryCode, l as telemetryFor, n as runtimeFor, o as mountRequestSpansCode, r as parseTelemetryFlag, s as routeTelemetry, t as EndpointGenerator, u as writeTelemetryModule } from "./EndpointGenerator-CVc6Oi1Y.mjs";
+import { $n as LOCAL_LOGS_EMAIL, $t as isImageBuild, An as prepareEntryCredentials, Cn as createCredentialsPreload, Dn as loadEnvFiles, Dt as LOCAL_CA_PATH, En as isPortAvailable, Fn as FileSecretsStore, Ft as quoteIdentifier, In as getKeyPath, Mn as secretsStoreFor, Nt as postgresDatabaseNames, On as loadPortState, Ot as forgetState, Qn as withCustomSecret, Qt as imageBuildCredentials, Rn as projectKey, Sn as primaryPortKey, Tn as findAvailablePort, U as createStateStore, Vn as deployIdentity, X as assertDevServicesFlag, Yn as maskPassword, Zn as toEmbeddableSecrets, a as provisionStage, at as WorkerGenerator, ct as QueueGenerator, dn as appTelemetry, dt as backendsOf$1, en as cacheBackendFor, ft as constructGlobs, h as dockerCommand, hn as telemetryOf, in as CLUSTER_DATABASE, it as workerUnits, kn as loadSecretsForApp, lt as CronGenerator, mn as surfaceClientTraced, mt as reconcileWorkspace, nn as providerOf, ot as workerBundleName, pn as scopeTelemetryEnv, pt as derivedContainers, sn as TELEMETRY_CONTAINER, st as workerEntryDir, tn as eventsBackendFor, u as provisionCommand, ut as FAKE_ENV, vn as describeServices, wn as createEntryWrapper, xn as portsOf, yn as fakeKey, yt as readLocalCredentials, zt as pgClient } from "./seeds-CvGQJnPO.mjs";
+import { c as startTelemetryCode, l as telemetryFor, n as runtimeFor, o as mountRequestSpansCode, r as parseTelemetryFlag, s as routeTelemetry, t as EndpointGenerator, u as writeTelemetryModule } from "./EndpointGenerator-Bor2tZCm.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-BPqQf8fB.mjs";
+import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-CyN2VF5X.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-DTZzxeIl.mjs";
+import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-CTaWrA_L.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { t as LocalSandbox } from "./local-IuoIF3CT.mjs";
-import { f as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-BTtX3NUM.mjs";
-import { t as deploy$1 } from "./deploy-QNtx_eWR.mjs";
-import { _ as planStackDns, a as stackOverrideFile, b as serverAddressHint, d as pinnedRef, f as edgeDir, g as applyStackDns, h as dockerCompose, i as ComposePushNeedsBuild, m as EDGE_PROJECT, o as composeProject, p as removeEdgeRoutes, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as parseDigests, v as requiredServerAddress, x as stackHosts, y as serverAddress } from "./compose-Bhmf0n4o.mjs";
-import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJqRJNK4.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-CU-O0SBp.mjs";
+import { t as LocalSandbox } from "./local-Otp74ak0.mjs";
+import { f as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-BTtGAtm3.mjs";
+import { t as deploy$1 } from "./deploy-yuJHlkY0.mjs";
+import { _ as planStackDns, a as stackOverrideFile, b as serverAddressHint, d as pinnedRef, f as edgeDir, g as applyStackDns, h as dockerCompose, i as ComposePushNeedsBuild, m as EDGE_PROJECT, o as composeProject, p as removeEdgeRoutes, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as parseDigests, v as requiredServerAddress, x as stackHosts, y as serverAddress } from "./compose-CTdVeeVk.mjs";
+import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJFvfkaz.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-Y8XHdoCR.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
-import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-b6vm0-W-.mjs";
+import "./awsStore-BWa1KNY-.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-naOSJpeJ.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Command, Option } from "commander";
@@ -47,7 +49,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.90";
+var version = "10.0.0-alpha.92";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -58,7 +60,7 @@ var version = "10.0.0-alpha.90";
 * named error instead, and the command decides whether to ask.
 */
 /** A prompt was needed with no terminal to ask at. */
-var PromptNeedsTerminal = class extends Error {
+var PromptNeedsTerminal = class extends GkmError {
 	question;
 	instead;
 	constructor(question, instead) {
@@ -130,7 +132,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-BTtX3NUM.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-BTtGAtm3.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -514,7 +516,7 @@ async function isTrusted(url) {
 	}
 }
 /** The edge has not run, so there is no authority to trust yet. */
-var NoLocalAuthority = class extends Error {
+var NoLocalAuthority = class extends GkmError {
 	path;
 	constructor(path) {
 		super(`No local certificate authority at ${path}. It is generated the first time the edge starts, so run "gkm setup" (or "gkm dev") once — and if this project declares no file server, nothing needs one.`);
@@ -523,7 +525,7 @@ var NoLocalAuthority = class extends Error {
 	}
 };
 /** A platform with no trust store this knows how to write to. */
-var UnsupportedPlatform = class extends Error {
+var UnsupportedPlatform = class extends GkmError {
 	platform;
 	certificate;
 	constructor(platform, certificate) {
@@ -608,7 +610,7 @@ const SIGNED_IN = [
 	"localstack"
 ];
 /** Nothing has generated this workspace's local logins yet. */
-var NoLocalCredentials = class extends Error {
+var NoLocalCredentials = class extends GkmError {
 	workspace;
 	constructor(workspace) {
 		super(`'${workspace}' has no local logins on this machine yet: they are generated the first time gkm dev, gkm test or gkm setup starts its services. Run one of them, then this again.`);
@@ -658,7 +660,7 @@ const DISCOVERY_QUIET_ENV = "GKM_DISCOVERY_QUIET";
 /** The route everything is served under. */
 const BASE = "/__gkm";
 /** `GKM_DISCOVERY_PORT` is set to something that is not a port. */
-var InvalidDiscoveryPort = class extends Error {
+var InvalidDiscoveryPort = class extends GkmError {
 	value;
 	constructor(value) {
 		super(`${DISCOVERY_PORT_ENV}=${value} is not a port. Set it to a number from 0 to 65535 (0 serves discovery on a free port of its own), or unset it to use dev.discoveryPort.`);
@@ -1748,7 +1750,7 @@ function closeFakes(served) {
 //#region src/exec/index.ts
 const logger$6 = console;
 /** `gkm exec` was given nothing to run. */
-var NoCommandSpecified = class extends Error {
+var NoCommandSpecified = class extends GkmError {
 	constructor() {
 		super("No command specified. Usage: gkm exec -- <command>");
 		this.name = "NoCommandSpecified";
@@ -2324,9 +2326,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-DbtcuOr_.mjs");
+		const { prepareDevDatabases } = await import("./migrate-BSbZ7-9n.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-DbtcuOr_.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-BSbZ7-9n.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2736,7 +2738,7 @@ function tsxCommand(appRoot, args) {
 	}
 }
 /** A port this app must serve on is held by something else. */
-var DevPortInUse = class extends Error {
+var DevPortInUse = class extends GkmError {
 	port;
 	holder;
 	constructor(port, holder) {
@@ -2753,7 +2755,7 @@ var DevPortInUse = class extends Error {
 * Only these are refused: a port another project holds is moved off instead
 * (see `assignAppPorts`), but moving off our own would start a second copy.
 */
-var WorkspacePortsInUse = class extends Error {
+var WorkspacePortsInUse = class extends GkmError {
 	held;
 	constructor(held) {
 		super(`This workspace's apps are already running:\n${held.map(({ app, port, holder }) => `   ${app}: ${port} — ${describeHolder(holder)}`).join("\n")}\nA previous \`gkm dev\` left them behind. Stop them (kill the pids above) and start again. Nothing was started.`);
@@ -3210,7 +3212,7 @@ const SUPERSEDED_OUTPUT = [
 function isMainProvider(value) {
 	return value === "aws" || value === "server";
 }
-var UnknownBuildProvider = class extends Error {
+var UnknownBuildProvider = class extends GkmError {
 	provider;
 	constructor(provider) {
 		super(`'${provider}' is not a build target. Pass --provider aws or --provider server, or leave it out to build for where gkm.config.ts deploys.`);
@@ -3219,7 +3221,7 @@ var UnknownBuildProvider = class extends Error {
 	}
 };
 /** `--cache` named something that is not a cache backend. */
-var UnknownCacheBackend = class extends Error {
+var UnknownCacheBackend = class extends GkmError {
 	backend;
 	constructor(backend) {
 		super(`'${backend}' is not a cache backend. Pass --cache upstash, elasticache, db or redis, or leave it out to register the deploy target's.`);
@@ -3379,7 +3381,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await import("./bundler-D6eBfVkl.mjs");
+			const { bundleServer } = await import("./bundler-C-AdesaG.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3524,7 +3526,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-D6eBfVkl.mjs");
+		const { bundleServer } = await import("./bundler-C-AdesaG.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3610,7 +3612,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-D6eBfVkl.mjs");
+			const { bundleServer } = await import("./bundler-C-AdesaG.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3848,7 +3850,7 @@ function formatRoutes(routes) {
 * `deploy()` as any other target, so there is one way a stack comes up.
 */
 /** `--build` and `--pull` together ask for two different things. */
-var ComposeModeConflict = class extends Error {
+var ComposeModeConflict = class extends GkmError {
 	constructor() {
 		super("--build and --pull ask for opposite things: build images from this checkout, or pull a tag CI pushed. Pass one of them.");
 		this.name = "ComposeModeConflict";
@@ -3930,12 +3932,37 @@ async function composeCommand(options, deps = {}) {
 		deploy: result
 	};
 }
+//#endregion
+//#region src/debug.ts
+let _debug = false;
+/**
+* Enable debug mode globally.
+* When enabled, verbose error details are shown everywhere.
+*/
+function enableDebug() {
+	_debug = true;
+}
+/**
+* Check if debug mode is active.
+* Activated by `--debug` flag or `GKM_DEBUG=1` env var.
+*/
+function isDebug() {
+	return _debug || process.env.GKM_DEBUG === "1";
+}
 /**
 * Format a fatal error for display.
-* Always includes the full stack trace since these are process-ending errors.
+*
+* An error gkm raised on purpose ({@link isGkmError}) is `Name: message` —
+* its message is the answer, and a stack would only point into gkm. Anything
+* else is unexpected, and prints its stack and every cause beneath it. Debug
+* mode prints the stack of both.
 */
 function formatError(error) {
 	if (!(error instanceof Error)) return String(error);
+	if (isGkmError(error) && !isDebug()) {
+		const cause = error.cause;
+		return cause === void 0 ? `${error.name}: ${error.message}` : `${error.name}: ${error.message}\n\nCaused by: ${cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause)}`;
+	}
 	let output = error.stack ?? error.message;
 	let cause = error.cause;
 	while (cause) if (cause instanceof Error) {
@@ -3947,6 +3974,14 @@ function formatError(error) {
 	}
 	return output;
 }
+/**
+* End a command that failed: print the error ({@link formatError}) on stderr
+* and exit 1. What every command's action does with what it throws.
+*/
+function exitWithError(error) {
+	console.error(formatError(error));
+	process.exit(1);
+}
 //#endregion
 //#region src/deploy/init.ts
 const logger$3 = console;
@@ -5312,25 +5347,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.90",
-	"@geekmidas/auth": "~10.0.0-alpha.90",
-	"@geekmidas/cache": "~10.0.0-alpha.90",
-	"@geekmidas/client": "~10.0.0-alpha.90",
-	"@geekmidas/cloud": "~10.0.0-alpha.90",
-	"@geekmidas/constructs": "~10.0.0-alpha.90",
-	"@geekmidas/db": "~10.0.0-alpha.90",
-	"@geekmidas/emailkit": "~10.0.0-alpha.90",
-	"@geekmidas/envkit": "~10.0.0-alpha.90",
-	"@geekmidas/errors": "~10.0.0-alpha.90",
-	"@geekmidas/events": "~10.0.0-alpha.90",
-	"@geekmidas/logger": "~10.0.0-alpha.90",
-	"@geekmidas/manifest": "~10.0.0-alpha.90",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.90",
-	"@geekmidas/schema": "~10.0.0-alpha.90",
-	"@geekmidas/services": "~10.0.0-alpha.90",
-	"@geekmidas/storage": "~10.0.0-alpha.90",
-	"@geekmidas/telescope": "~10.0.0-alpha.90",
-	"@geekmidas/testkit": "~10.0.0-alpha.90",
+	"@geekmidas/audit": "~10.0.0-alpha.92",
+	"@geekmidas/auth": "~10.0.0-alpha.92",
+	"@geekmidas/cache": "~10.0.0-alpha.92",
+	"@geekmidas/client": "~10.0.0-alpha.92",
+	"@geekmidas/cloud": "~10.0.0-alpha.92",
+	"@geekmidas/constructs": "~10.0.0-alpha.92",
+	"@geekmidas/db": "~10.0.0-alpha.92",
+	"@geekmidas/emailkit": "~10.0.0-alpha.92",
+	"@geekmidas/envkit": "~10.0.0-alpha.92",
+	"@geekmidas/errors": "~10.0.0-alpha.92",
+	"@geekmidas/events": "~10.0.0-alpha.92",
+	"@geekmidas/logger": "~10.0.0-alpha.92",
+	"@geekmidas/manifest": "~10.0.0-alpha.92",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.92",
+	"@geekmidas/schema": "~10.0.0-alpha.92",
+	"@geekmidas/services": "~10.0.0-alpha.92",
+	"@geekmidas/storage": "~10.0.0-alpha.92",
+	"@geekmidas/telescope": "~10.0.0-alpha.92",
+	"@geekmidas/testkit": "~10.0.0-alpha.92",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5731,7 +5766,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "108157b10491802890a494443587d8bbd312f5db", version = cliVersion()) {
+function stagesActionUses(commit = "446c06603533dd304ee5655661784b7a4f07e2b7", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -7242,7 +7277,7 @@ ${inputs.join("\n")}
 * An SST scaffold asked for without a region. `init` always resolves one —
 * asked, `--region`, or eu-west-1 under `--yes` — so this is a caller's bug.
 */
-var SstNeedsRegion = class extends Error {
+var SstNeedsRegion = class extends GkmError {
 	constructor() {
 		super("An SST deploy needs a region: pass --region, e.g. eu-west-1.");
 		this.name = "SstNeedsRegion";
@@ -10682,7 +10717,7 @@ function resolveStages(options, answers) {
 	return stages;
 }
 /** `--deploy` naming a target init has no scaffold for. */
-var UnknownDeployTarget = class extends Error {
+var UnknownDeployTarget = class extends GkmError {
 	target;
 	known;
 	constructor(target, known) {
@@ -10701,7 +10736,7 @@ function defaultRegistry(name) {
 	return `ghcr.io/${(name ?? "my-org").toLowerCase()}`;
 }
 /** `--region` that is not shaped like one, e.g. `europe` for `eu-west-1`. */
-var NotAnAwsRegion = class extends Error {
+var NotAnAwsRegion = class extends GkmError {
 	region;
 	constructor(region) {
 		super(`"${region}" is not an AWS region. Use one like eu-west-1.`);
@@ -10831,7 +10866,7 @@ async function secretsSetCommand(key, value, options) {
 	logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}" (${store.name})`);
 }
 /** `gkm secrets:unset` for a key the stage does not hold. */
-var SecretNotSet = class extends Error {
+var SecretNotSet = class extends GkmError {
 	key;
 	stage;
 	constructor(key, stage) {
@@ -10842,7 +10877,7 @@ var SecretNotSet = class extends Error {
 	}
 };
 /** `gkm secrets:unset` on a stage that has no secrets at all. */
-var StageSecretsNotFound = class extends Error {
+var StageSecretsNotFound = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' has no secrets, so there is nothing to remove.`);
@@ -11049,8 +11084,8 @@ async function composeStageHosts(options) {
 		...options.profile ? { profile: options.profile } : {},
 		...options.home ? { home: options.home } : {}
 	})).read(stage);
-	const { deployedStackSecrets } = await import("./compose-Bhmf0n4o.mjs").then((n) => n.l);
-	const { composeStack } = await import("./compose-Bhmf0n4o.mjs").then((n) => n.c);
+	const { deployedStackSecrets } = await import("./compose-CTdVeeVk.mjs").then((n) => n.l);
+	const { composeStack } = await import("./compose-CTdVeeVk.mjs").then((n) => n.c);
 	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
 	const stack = composeStack({
 		workspace,
@@ -11144,7 +11179,6 @@ async function provisionStageDns(options) {
 //#endregion
 //#region src/setup/index.ts
 var setup_exports = /* @__PURE__ */ __exportAll({
-	StageSecretsUnreadable: () => StageSecretsUnreadable,
 	createFreshWorkspaceSecrets: () => createFreshWorkspaceSecrets,
 	ensureStageSecrets: () => ensureStageSecrets,
 	reconcileSecrets: () => reconcileSecrets,
@@ -11176,7 +11210,7 @@ async function setupCommand(options = {}) {
 	logger$1.log(`📦 Workspace: ${workspace.name}`);
 	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
 	logger$1.log(`🔑 Stage: ${stage}\n`);
-	if (!local) assertStageServer(workspace, stage, await readStageSecrets(await secretsStoreFor(workspace, stage, { ...options.profile ? { profile: options.profile } : {} }), stage, options));
+	if (!local) assertStageServer(workspace, stage, await (await secretsStoreFor(workspace, stage, { ...options.profile ? { profile: options.profile } : {} })).read(stage));
 	if (!local && options.dryRun) {
 		await provisionDeployed(workspace, stage, options);
 		return;
@@ -11195,48 +11229,6 @@ async function setupCommand(options = {}) {
 	}
 	printSummary(workspace, stage);
 }
-/** Where each AWS store keeps a stage's secrets, as a person reads it. */
-const AWS_STORES = {
-	ssm: "SSM Parameter Store",
-	"secrets-manager": "Secrets Manager"
-};
-/**
-* A deployed stage's secrets are kept in its AWS account, and no AWS
-* credentials were found to read them with.
-*
-* Raised before any provider runs: even a dry run reads the stage's secrets,
-* since its plan needs the server they name (`GKM_SERVER_IPV4`).
-*/
-var StageSecretsUnreadable = class extends Error {
-	stage;
-	store;
-	profile;
-	dryRun;
-	constructor(stage, store, profile, dryRun, cause) {
-		const where = AWS_STORES[store] ?? `the '${store}' store`;
-		const command = `gkm setup --stage ${stage}${dryRun ? " --dry-run" : ""}`;
-		super(`The '${stage}' stage's secrets are kept in ${where}, in the stage's AWS account, and ` + (profile ? `the AWS profile '${profile}' has no credentials to read them with. Sign in to it (aws sso login --profile ${profile}) or name another: ${command} --profile <profile>.` : `no AWS credentials were found to read them with. Name the account's profile: ${command} --profile <profile>, or AWS_PROFILE=<profile> ${command}.`) + (dryRun ? " A dry run still reads them: its plan needs the server the stage names (GKM_SERVER_IPV4)." : ""), { cause });
-		this.stage = stage;
-		this.store = store;
-		this.profile = profile;
-		this.dryRun = dryRun;
-		this.name = "StageSecretsUnreadable";
-	}
-};
-/**
-* The stage's secrets from its store, refused with
-* {@link StageSecretsUnreadable} when there are no AWS credentials to read
-* them — matched by the SDK's error name, its message being free to change.
-* Any other failure is the store's own, and passes through.
-*/
-async function readStageSecrets(store, stage, options) {
-	try {
-		return await store.read(stage);
-	} catch (error) {
-		if (error?.name === "CredentialsProviderError") throw new StageSecretsUnreadable(stage, store.name, options.profile, options.dryRun === true, error);
-		throw error;
-	}
-}
 /**
 * A deployed stage's providers: each one's `ensure()`, in the stage's own
 * account, its keys written into the stage's secrets.
@@ -11479,7 +11471,7 @@ async function readReady(path) {
 	}
 }
 /** A name recorded for the test stage without the test stage's suffix. */
-var NotATestDatabase = class extends Error {
+var NotATestDatabase = class extends GkmError {
 	database;
 	constructor(database) {
 		super(`Refusing to drop '${database}': only the test stage's databases (named '…_${TEST_STAGE}') are dropped after a suite. Delete ${TEST_READY_FILE} if it was edited by hand.`);
@@ -11616,8 +11608,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-DbtcuOr_.mjs");
-	const { discover } = await import("./discover-BPelzeGW.mjs").then((n) => n.i);
+	const { migrateAndSeed } = await import("./migrate-BSbZ7-9n.mjs");
+	const { discover } = await import("./discover-qjFapetL.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
 		patterns: constructGlobs(workspace),
@@ -11635,7 +11627,7 @@ async function migrateTestStage(workspace, env) {
 	for (const { target, seeded } of seeds) if (seeded.length > 0) console.log(`  🌱 ${target.seeds}: ran ${seeded.join(", ")}`);
 }
 /** `gkm test` outside a project that declares stages, with none named. */
-var NoStageToTest = class extends Error {
+var NoStageToTest = class extends GkmError {
 	constructor() {
 		super("No stage to test with: add `stages` to gkm.config.ts, or pass --stage.");
 		this.name = "NoStageToTest";
@@ -11903,7 +11895,7 @@ function install(pm, cwd) {
 	}
 }
 /** npm did not answer for a package, so there is no version to compare. */
-var RegistryUnavailable = class extends Error {
+var RegistryUnavailable = class extends GkmError {
 	packageName;
 	status;
 	constructor(packageName, status) {
@@ -11914,7 +11906,7 @@ var RegistryUnavailable = class extends Error {
 	}
 };
 /** A dist-tag npm does not have, e.g. `--tag beta` before any beta. */
-var NoReleaseOnTag = class extends Error {
+var NoReleaseOnTag = class extends GkmError {
 	tag;
 	tags;
 	constructor(tag, tags) {
@@ -11925,7 +11917,7 @@ var NoReleaseOnTag = class extends Error {
 	}
 };
 /** The line asked for is behind what is installed; upgrade never goes back. */
-var WouldDowngrade = class extends Error {
+var WouldDowngrade = class extends GkmError {
 	installed;
 	tag;
 	target;
@@ -11950,7 +11942,7 @@ var InstallFailed = class extends Error {
 //#region src/index.ts
 const program = new Command();
 program.name("gkm").description("GeekMidas backend framework CLI").version(version).option("--cwd <path>", "Change working directory").option("--debug", "Enable debug mode (verbose errors with stack traces)").hook("preAction", () => {
-	if (program.opts().debug);
+	if (program.opts().debug) enableDebug();
 });
 program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").option("--deploy <target>", "Where it deploys (dokploy, compose, sst, none)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").option("--registry <registry>", "Container registry for a compose deploy (e.g. ghcr.io/acme)").option("--stages <names>", "Deployed stages, comma-separated (e.g. staging,prod)").option("--protected-stage <name>", "Which deployed stage is production").option("--local-stage <name>", "What gkm dev runs as (e.g. dev)").action(async (name, options) => {
 	try {
@@ -11958,8 +11950,7 @@ program.command("init").description("Scaffold a new project").argument("[name]",
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await initCommand(name, options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("trust").description("Trust the local edge's certificate authority, so a browser accepts https").option("--dry-run", "Print the commands instead of running them").action(async (options) => {
@@ -11968,8 +11959,7 @@ program.command("trust").description("Trust the local edge's certificate authori
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await trustCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("setup").description("Reconcile declared constructs — locally, containers and secrets; on a deployed stage, its providers (deploy.objects)").option("--stage <stage>", "Stage name (default: stages.local)").option("--force", "Regenerate secrets even if they exist").option("--skip-docker", "Skip starting Docker services").option("-y, --yes", "Skip prompts").option("--dry-run", "A deployed stage: print what its providers would create or change, and write nothing").option("--profile <profile>", "AWS profile for the stage's account").option("--rotate-keys", "A deployed stage: issue each provisioned key a successor (the old one is deleted after the next deploy)").option("--retire-old-keys", "A deployed stage: delete a rotated-out key now instead of after the next deploy").action(async (options) => {
@@ -11978,8 +11968,7 @@ program.command("setup").description("Reconcile declared constructs — locally,
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await setupCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("build").description("Build handlers and the manifest from declared constructs").option("--provider <provider>", "Build for aws or server (default: where gkm.config.ts deploys)").option("--enable-openapi", "Enable OpenAPI documentation generation for server builds").option("--production", "Build for production (no dev tools, bundled output)").option("--skip-bundle", "Skip bundling step in production build").option("--stage <stage>", "Inject encrypted secrets for deployment stage").option("--mark-optional", "Suffix optional env vars with ? in manifest envVars field (e.g. PORT?)").addOption(new Option("--cache <backend>", "Register the drivers for this cache backend rather than the target default").hideHelp()).action(async (options) => {
@@ -11998,8 +11987,7 @@ program.command("build").description("Build handlers and the manifest from decla
 			markOptional: options.markOptional || false
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("dev").description("Reconcile constructs and start the dev server with automatic reload").option("-p, --port <port>", "Port to run the development server on").option("--entry <file>", "Entry file to run (bypasses gkm config)").option("--watch", "Watch for file changes (default: true with --entry)").option("--no-watch", "Disable file watching").option("--enable-openapi", "Enable OpenAPI documentation for development server", true).option("--migrate", "Apply pending migrations before the apps start").option("--seed", "Migrate, then run the seeds, before the apps start").option("--fake", "Call each external API’s fake (test/fakes/<id>.ts) instead of the provider").option("--no-subscribers", "Run no topic subscribers: nothing is subscribed, polled or pushed to").action(async (options) => {
@@ -12018,8 +12006,7 @@ program.command("dev").description("Reconcile constructs and start the dev serve
 			subscribers: options.subscribers
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("dev:credentials").description("Print each local service's address and login — Postgres, MinIO, Mailpit, Redis, … — without starting anything").option("--json", "Print them as JSON, for a script").action(async (options) => {
@@ -12029,8 +12016,7 @@ program.command("dev:credentials").description("Print each local service's addre
 		const { devCredentialsCommand } = await Promise.resolve().then(() => credentials_exports);
 		await devCredentialsCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("exec").description("Run a command with secrets injected into Credentials").argument("<command...>", "Command to run (use -- before command)").action(async (commandArgs) => {
@@ -12039,8 +12025,7 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await execCommand(commandArgs);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile, migrate and seed the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").option("--teardown", "Drop the test stage's databases the last setup created, then stop — what @geekmidas/cli/vitest runs when the suite ends").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
@@ -12052,50 +12037,46 @@ program.command("test").description("Run tests with secrets loaded from environm
 			pattern
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("migrate").description("Apply each database construct's migrations from db/<construct>/migrations/, as its owner").argument("[construct]", "Only this construct, by name").option("--stage <stage>", "The local stage (default) or test — a deploy migrates its own stage").action(async (construct, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-DbtcuOr_.mjs");
+		const { migrateCommand } = await import("./migrate-BSbZ7-9n.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("seed").description("Migrate, then run each database construct's seeds from db/<construct>/seeds/, as its owner").argument("[construct]", "Only this construct, by name").option("--stage <stage>", "The local stage (default) or test — a deploy seeds its own stage").action(async (construct, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-DbtcuOr_.mjs");
+		const { seedCommand } = await import("./migrate-BSbZ7-9n.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("migration").description("Write a construct's next migration: an empty one for a database, the schema change for an auth server").argument("<construct>", "The construct, by name").argument("[name]", "What the migration is called").action(async (construct, name) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-DbtcuOr_.mjs");
+		const { migrationCommand } = await import("./migrate-BSbZ7-9n.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("cron").description("Manage cron jobs").action(() => {
@@ -12123,8 +12104,7 @@ program.command("openapi").description("Generate OpenAPI specification from endp
 			...telemetry !== void 0 ? { telemetry } : {}
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("docker").description("Generate Docker deployment files").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").action(async (options) => {
@@ -12133,8 +12113,7 @@ program.command("docker").description("Generate Docker deployment files").option
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await dockerCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Deployed stage: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
@@ -12143,8 +12122,7 @@ program.command("compose").description("Run the workspace's APIs and sites for a
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await composeCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("prepack").description("Generate Docker files for production deployment").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").action(async (options) => {
@@ -12158,8 +12136,7 @@ program.command("prepack").description("Generate Docker files for production dep
 			registry: options.registry
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("secrets:init").description("Initialize secrets for a deployment stage").requiredOption("--stage <stage>", "Stage name (e.g., production, staging)").option("--force", "Overwrite existing secrets").action(async (options) => {
@@ -12168,8 +12145,7 @@ program.command("secrets:init").description("Initialize secrets for a deployment
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await secretsInitCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("secrets:set").description("Set a custom secret for a stage").argument("<key>", "Secret key (e.g., API_KEY)").argument("[value]", "Secret value (reads from stdin if omitted)").requiredOption("--stage <stage>", "Stage name").action(async (key, value, options) => {
@@ -12178,8 +12154,7 @@ program.command("secrets:set").description("Set a custom secret for a stage").ar
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await secretsSetCommand(key, value, options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("secrets:unset").description("Remove a custom secret from a stage").argument("<key>", "Secret key (e.g., API_KEY)").requiredOption("--stage <stage>", "Stage name").action(async (key, options) => {
@@ -12188,41 +12163,37 @@ program.command("secrets:unset").description("Remove a custom secret from a stag
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await secretsUnsetCommand(key, options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("secrets:add").description("Build the keys a stage must be given — buckets, mail, file servers, third parties' credentials — across every app").requiredOption("--stage <stage>", "Stage name").option("--missing", "Only the keys the stage has not set").option("--json", "Print the keys as JSON and ask nothing").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-DHk1roh_.mjs");
+		const { secretsAddCommand } = await import("./add-2Opn2VVE.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("encryption:rotate").description("Add a new current key to an Encryption construct's keyring on a server stage").argument("<construct>", "The Encryption construct (e.g. Pii)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-BrEef7Jk.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-C9Jm9dfn.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("encryption:retire").description("Remove an old key from an Encryption construct's keyring, once nothing is under it").argument("<construct>", "The Encryption construct (e.g. Pii)").argument("<key>", "The key to retire (e.g. k1)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, key, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-BrEef7Jk.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-C9Jm9dfn.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("secrets:show").description("Show secrets for a stage").requiredOption("--stage <stage>", "Stage name").option("--reveal", "Show actual secret values (not masked)").action(async (options) => {
@@ -12231,8 +12202,7 @@ program.command("secrets:show").description("Show secrets for a stage").required
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await secretsShowCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("secrets:rotate").description("Rotate service passwords").requiredOption("--stage <stage>", "Stage name").option("--service <service>", "Specific service to rotate (postgres, redis, minio, …)").action(async (options) => {
@@ -12241,8 +12211,7 @@ program.command("secrets:rotate").description("Rotate service passwords").requir
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await secretsRotateCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("secrets:import").description("Import secrets from a JSON file").argument("<file>", "JSON file path (e.g., secrets.json)").requiredOption("--stage <stage>", "Stage name").option("--no-merge", "Replace all custom secrets instead of merging").action(async (file, options) => {
@@ -12251,8 +12220,7 @@ program.command("secrets:import").description("Import secrets from a JSON file")
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await secretsImportCommand(file, options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("secrets:reconcile").description("Backfill missing custom secrets from workspace config").option("--stage <stage>", "Stage name (default: stages.local)").action(async (options) => {
@@ -12261,7 +12229,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile-Dh1Jk7WE.mjs");
-		const { secretsStoreFor } = await import("./seeds-odfgSCmu.mjs").then((n) => n.Pn);
+		const { secretsStoreFor } = await import("./seeds-CvGQJnPO.mjs").then((n) => n.Pn);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12270,7 +12238,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-odfgSCmu.mjs").then((n) => n.ht);
+		const { derivedContainers } = await import("./seeds-CvGQJnPO.mjs").then((n) => n.ht);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12280,23 +12248,21 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		console.log(`\n✓ Reconciled ${result.addedKeys.length} missing secret(s) for stage "${stage}":`);
 		for (const key of result.addedKeys) console.log(`    + ${key}`);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("secrets:migrate").description("Copy a deployed stage's secrets from the configured store to another (file, ssm, secrets-manager)").requiredOption("--stage <stage>", "A deployed stage").requiredOption("--to <provider>", "file, ssm or secrets-manager").option("--region <region>", "The target's AWS region (default: the configured store's)").option("--profile <profile>", "AWS profile for the stage's account").option("--force", "Replace a stage the target already holds").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-DWZz9kah.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-IZsYyZ5F.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Compose: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
-	const { deployCli } = await import("./cli-DD-Yk-I5.mjs");
+	const { deployCli } = await import("./cli-BjhaVObS.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12314,8 +12280,8 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-CFrNLmxs.mjs").then((n) => n.a);
-		const { terminalCredentials } = await import("./terminal-D8TPK7o9.mjs");
+		const { rollbackStage } = await import("./rollback-D1d-fW0r.mjs").then((n) => n.a);
+		const { terminalCredentials } = await import("./terminal-Dtd6BZX9.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12326,8 +12292,7 @@ program.command("deploy:rollback").description("Put a stage's app back on its pr
 			log: (line) => console.log(line)
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("deploy:init").description("Initialize Dokploy deployment (create project and application)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").requiredOption("--project <name>", "Project name (creates if not exists)").requiredOption("--app <name>", "Application name").option("--project-id <id>", "Use existing project ID instead of creating").option("--registry-id <id>", "Configure registry for the application").action(async (options) => {
@@ -12342,30 +12307,27 @@ program.command("deploy:init").description("Initialize Dokploy deployment (creat
 			registryId: options.registryId
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("deploy:github").description("Let GitHub Actions deploy a stage: OIDC role in the stage's AWS account, and the GitHub environment the deploy workflow uses").requiredOption("--stage <stage>", "A deployed stage from gkm.config.ts").option("--profile <profile>", "AWS profile for the stage's account").option("--repo <owner/name>", "GitHub repository (default: this one)").option("--policy-arn <arn>", "Policy for the deploy role (default: AdministratorAccess)").option("--dry-run", "Show the plan without changing AWS or GitHub").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-BCDF6xVH.mjs");
+		const { deployGithubCommand } = await import("./github-B1k42hIt.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("stages").description("The workspace's stages from gkm.config.ts: local, deployed and protected").option("--json", "Print them as JSON").option("--github-output", "Write the stages, and which this workflow run builds and deploys, to $GITHUB_OUTPUT").option("--event <name>", "The event to plan for (default: $GITHUB_EVENT_NAME)").option("--stage <stage>", "The stage a workflow_dispatch deploys").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await import("./stages-CnZRYmkI.mjs");
+		const { stagesCommand } = await import("./stages-DY-fQKmo.mjs");
 		await stagesCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("deploy:list").description("List Dokploy resources (projects, registries)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").option("--projects", "List projects").option("--registries", "List registries").action(async (options) => {
@@ -12391,8 +12353,7 @@ program.command("deploy:list").description("List Dokploy resources (projects, re
 			});
 		}
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("login").description("Authenticate with a deployment or DNS provider").option("--provider <provider>", "Provider to log in to (dokploy, hostinger, godaddy)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").option("--token <token>", "API token (will prompt if not provided)").option("--endpoint <url>", "Service endpoint URL").action(async (options) => {
@@ -12414,8 +12375,7 @@ program.command("login").description("Authenticate with a deployment or DNS prov
 			endpoint: options.endpoint
 		});
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("logout").description("Remove stored credentials").option("--provider <provider>", "Whose credentials to remove (dokploy, godaddy, all)", "dokploy").option("--service <provider>", "[DEPRECATED] Use --provider instead").action(async (options) => {
@@ -12424,8 +12384,7 @@ program.command("logout").description("Remove stored credentials").option("--pro
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await logoutCommand({ provider: options.service ?? options.provider });
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("whoami").description("Show current authentication status").action(async () => {
@@ -12434,8 +12393,7 @@ program.command("whoami").description("Show current authentication status").acti
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await whoamiCommand();
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("state:pull").description("Pull deployment state from remote to local").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").action(async (options) => {
@@ -12444,8 +12402,7 @@ program.command("state:pull").description("Pull deployment state from remote to
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await statePullCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("state:push").description("Push deployment state from local to remote").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").action(async (options) => {
@@ -12454,8 +12411,7 @@ program.command("state:push").description("Push deployment state from local to r
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await statePushCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("state:show").description("Show deployment state for a stage").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--json", "Output as JSON").action(async (options) => {
@@ -12464,8 +12420,7 @@ program.command("state:show").description("Show deployment state for a stage").r
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await stateShowCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("state:unlock").description("Release a stage deploy lock left behind by a run that crashed").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").action(async (options) => {
@@ -12474,8 +12429,7 @@ program.command("state:unlock").description("Release a stage deploy lock left be
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await stateUnlockCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("state:diff").description("Compare local and remote deployment state").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").action(async (options) => {
@@ -12484,8 +12438,7 @@ program.command("state:diff").description("Compare local and remote deployment s
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await stateDiffCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, every @geekmidas package) along the release line the project is on").option("--dry-run", "Show what would be upgraded without making changes").option("--all", "Every @geekmidas package, and the third-party packages their peers require").option("--tag <tag>", "npm dist-tag to follow (default: the line you are on)").action(async (options) => {
@@ -12494,15 +12447,13 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		await upgradeCommand(options);
 	} catch (error) {
-		console.error(formatError(error));
-		process.exit(1);
+		exitWithError(error);
 	}
 });
 try {
 	assertDevServicesFlag(process.argv.slice(2));
 } catch (error) {
-	console.error(formatError(error));
-	process.exit(1);
+	exitWithError(error);
 }
 program.parse();
 //#endregion