@geekmidas/cli 10.0.0-alpha.90 → 10.0.0-alpha.92

package/dist/{seeds-odfgSCmu.mjs → seeds-CvGQJnPO.mjs}

@@ -1,12 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { r as storedCredentials, s as run$1, x as gkmHome } from "./credentials-CnVqoXMb.mjs";
-import { d as output, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { r as storedCredentials, s as run$1, x as gkmHome } from "./credentials-C4KII3PD.mjs";
+import { d as output, r as discover, u as ConstructGenerator } from "./discover-qjFapetL.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { $ as RotationInProgress, B as LOGS_PORT, G as checkS3Config, H as provisioningOf, J as BucketNameUnavailable, K as AccessKeyLimit, Q as RecordedBucketUnreachable, R as stageSampleRate, U as stageProvider, W as S3_PROVISIONING, X as IamUserNotOwned, Y as BucketOwnedByAnotherProject, Z as ProvisionedBucketUnreachable, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, at as SERVER_IPV6_KEY, et as S3RegionRequired, it as SERVER_IPV4_KEY, j as TEST_STAGE, lt as UnknownSecretsStoreProvider, q as BucketKeySetElsewhere, st as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-CJ0lKFq-.mjs";
+import { $ as RotationInProgress, B as LOGS_PORT, G as checkS3Config, H as provisioningOf, J as BucketNameUnavailable, K as AccessKeyLimit, Q as RecordedBucketUnreachable, R as stageSampleRate, U as stageProvider, W as S3_PROVISIONING, X as IamUserNotOwned, Y as BucketOwnedByAnotherProject, Z as ProvisionedBucketUnreachable, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, at as SERVER_IPV6_KEY, et as S3RegionRequired, it as SERVER_IPV4_KEY, j as TEST_STAGE, lt as UnknownSecretsStoreProvider, q as BucketKeySetElsewhere, st as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-Bzw7Zs82.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { a as telemetryArgs, c as startTelemetryCode, n as runtimeFor, u as writeTelemetryModule } from "./EndpointGenerator-CVc6Oi1Y.mjs";
-import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-BPqQf8fB.mjs";
-import { c as runtimeOf } from "./resolve-DNg0icnh.mjs";
+import { a as telemetryArgs, c as startTelemetryCode, n as runtimeFor, u as writeTelemetryModule } from "./EndpointGenerator-Bor2tZCm.mjs";
+import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-CyN2VF5X.mjs";
+import { c as runtimeOf } from "./resolve-Be4bF1w4.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -63,7 +64,7 @@ function rootSite(sites) {
 	throw new AmbiguousRootSite(sites.map(({ name }) => name), declared.length > 1);
 }
 /** Several sites could hold the base domain, and none of them says it does. */
-var AmbiguousRootSite = class extends Error {
+var AmbiguousRootSite = class extends GkmError {
 	sites;
 	tooMany;
 	constructor(sites, tooMany = false) {
@@ -76,7 +77,7 @@ var AmbiguousRootSite = class extends Error {
 //#endregion
 //#region src/target/dokploy/domain.ts
 /** A stage was deployed that `domains` gives no domain. */
-var NoDomainForStage = class extends Error {
+var NoDomainForStage = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`No domain for stage "${stage}". Add it to gkm.config.ts: domains: { ${stage}: 'example.com' }.`);
@@ -167,7 +168,7 @@ const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
 */
 const LOCAL_LOGS_EMAIL = "admin@gkm.localhost";
 /** A root password OpenObserve would refuse to start with. */
-var LogsPasswordWeak = class extends Error {
+var LogsPasswordWeak = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
@@ -176,7 +177,7 @@ var LogsPasswordWeak = class extends Error {
 	}
 };
 /** A deployed stage with logs on and no root password generated yet. */
-var LogsPasswordMissing = class extends Error {
+var LogsPasswordMissing = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
@@ -433,7 +434,7 @@ function validateEnvironmentVariables(requiredVars, secrets) {
 * `DeployIdentity` is what a deploy names and claims its resources by instead.
 */
 /** A namespace that cannot be part of a Dokploy name or an image path. */
-var DeployNamespaceInvalid = class extends Error {
+var DeployNamespaceInvalid = class extends GkmError {
 	namespace;
 	constructor(namespace) {
 		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
@@ -442,7 +443,7 @@ var DeployNamespaceInvalid = class extends Error {
 	}
 };
 /** A workspace name with nothing a target can name a resource by. */
-var DeployProjectNameInvalid = class extends Error {
+var DeployProjectNameInvalid = class extends GkmError {
 	workspaceName;
 	constructor(workspaceName) {
 		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
@@ -548,7 +549,7 @@ function applicationName(identity, app) {
 /** Key length for AES-256 encryption */
 const KEY_LENGTH = 32;
 /** A keystore project key that is not `<namespace>/<project>`. */
-var KeystoreProjectInvalid = class extends Error {
+var KeystoreProjectInvalid = class extends GkmError {
 	key;
 	constructor(key) {
 		super(`'${key}' is not a keystore project: expected '<namespace>/<project>' in lowercase letters, digits and '-', as deployIdentity() produces. Pass the workspace's identity key.`);
@@ -557,7 +558,7 @@ var KeystoreProjectInvalid = class extends Error {
 	}
 };
 /** A stage has no key, here or at the place keys used to be kept. */
-var KeyNotFound = class extends Error {
+var KeyNotFound = class extends GkmError {
 	stage;
 	project;
 	path;
@@ -754,7 +755,7 @@ var FileSecretsStore = class {
 	}
 };
 /** A stage's secrets file exists, and the key that opens it does not. */
-var MissingSecretsKey = class extends Error {
+var MissingSecretsKey = class extends GkmError {
 	stage;
 	project;
 	path;
@@ -829,7 +830,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
 		case "ssm": {
-			const { AwsSecretsStore } = await import("./aws-B-6uEhgP.mjs").then((n) => n.t);
+			const { AwsSecretsStore } = await import("./aws-Dz2bYxK1.mjs").then((n) => n.t);
 			return new AwsSecretsStore({
 				project: workspace.name,
 				region: config.region,
@@ -838,7 +839,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 		}
 		case "secrets-manager": {
 			const { kmsKeyId } = config;
-			const { SecretsManagerSecretsStore } = await import("./secretsManager-Chs9VV2r.mjs").then((n) => n.n);
+			const { SecretsManagerSecretsStore } = await import("./secretsManager-C6wm-9uZ.mjs").then((n) => n.n);
 			return new SecretsManagerSecretsStore({
 				project: workspace.name,
 				region: config.region,
@@ -1842,7 +1843,7 @@ function planFor(manifest, stage, order, options = {}) {
 * code either way — declare a database, or select a backend that brings its own
 * broker.
 */
-var CacheNeedsDatabase = class extends Error {
+var CacheNeedsDatabase = class extends GkmError {
 	ids;
 	constructor(ids) {
 		super(`A cache backed by the database needs a declared database, and none was declared, and on this deploy target that is where a cache lives. Declare one. Caches affected: ${ids.join(", ")}.`);
@@ -1861,7 +1862,7 @@ var CacheNeedsDatabase = class extends Error {
 * `orders.cache('Sessions')` names the database, which is a fact about the
 * application rather than a deployment choice.
 */
-var CacheIsAmbiguous = class extends Error {
+var CacheIsAmbiguous = class extends GkmError {
 	ids;
 	databases;
 	constructor(ids, databases) {
@@ -1871,7 +1872,7 @@ var CacheIsAmbiguous = class extends Error {
 		this.name = "CacheIsAmbiguous";
 	}
 };
-var PgBossNeedsDatabase = class extends Error {
+var PgBossNeedsDatabase = class extends GkmError {
 	ids;
 	constructor(ids) {
 		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one: on this deploy target, events are carried by pg-boss. Queues and topics affected: ${ids.join(", ")}.`);
@@ -3127,7 +3128,7 @@ CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile
 * prune` to one app's slice. Nothing is built on the host.
 */
 /** A workspace of packages with no turbo.json, which every image prunes with. */
-var MonorepoNeedsTurbo = class extends Error {
+var MonorepoNeedsTurbo = class extends GkmError {
 	buildRoot;
 	constructor(buildRoot) {
 		super(`${buildRoot} is a workspace of packages, and its images are built from a turbo-pruned slice of it — but it has no turbo.json.\n\nTo fix this:
@@ -3666,7 +3667,7 @@ function schemaOf(resource, plan) {
 * On SNS each topic and queue is its own address, so there is no project-wide
 * one to hand out — a cron's schedule store, say, cannot live there.
 */
-var UnprovisionedEventsBackend = class extends Error {
+var UnprovisionedEventsBackend = class extends GkmError {
 	backend;
 	constructor(backend) {
 		super(`'${backend}' has no single broker address: each topic and queue is addressed by its own ARN. Something asked for one without naming the topic or queue.`);
@@ -4299,7 +4300,7 @@ const LEGACY_LOCAL_LOGIN = Object.freeze({
 	password: "geekmidas"
 });
 /** No login this workspace knows opens its Postgres. */
-var PostgresLoginRefused = class extends Error {
+var PostgresLoginRefused = class extends GkmError {
 	port;
 	user;
 	constructor(port, user) {
@@ -4310,7 +4311,7 @@ var PostgresLoginRefused = class extends Error {
 	}
 };
 /** No login this workspace knows opens its MinIO. */
-var MinioLoginRefused = class extends Error {
+var MinioLoginRefused = class extends GkmError {
 	port;
 	user;
 	constructor(port, user) {
@@ -4657,7 +4658,7 @@ async function heldElsewhere(kept, keys, observed, probe, ours) {
 	return held;
 }
 /** The window was exhausted. */
-var NoPortAvailable = class extends Error {
+var NoPortAvailable = class extends GkmError {
 	/** Where the search started. */
 	from;
 	/** The window searched, so the caller can report what was full. */
@@ -5403,7 +5404,7 @@ const REDIS_PASSWORD_KEY = "REDIS_PASSWORD";
 /** Redis's own count of logical databases, before `--databases` raises it. */
 const REDIS_DATABASES = 16;
 /** A deployed stage that runs the stack's Redis and has no password yet. */
-var RedisPasswordMissing = class extends Error {
+var RedisPasswordMissing = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' runs the stack's Redis and has no ${REDIS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${REDIS_PASSWORD_KEY} '…' --stage ${stage}`);
@@ -5637,7 +5638,7 @@ function localCredentialsPath(project) {
 	return join(project.home ?? gkmHome(), "local", namespace, `${name}.json`);
 }
 /** The local stage's logins file is there, and its key is not. */
-var LocalCredentialsKeyMissing = class extends Error {
+var LocalCredentialsKeyMissing = class extends GkmError {
 	path;
 	stage;
 	constructor(path, stage) {
@@ -5648,7 +5649,7 @@ var LocalCredentialsKeyMissing = class extends Error {
 	}
 };
 /** Another gkm held the logins file's lock for longer than any write takes. */
-var LocalCredentialsLocked = class extends Error {
+var LocalCredentialsLocked = class extends GkmError {
 	lock;
 	constructor(lock) {
 		super(`Another gkm has been writing the local logins for over ${LOCK_TIMEOUT_MS / 1e3}s. If none is running, remove ${lock} and run the command again.`);
@@ -6348,7 +6349,7 @@ export async function stopQueues(): Promise<void> {
 * reached by building server images for a project that deploys to AWS — where
 * a subscriber is a Lambda instead.
 */
-var WorkerSubscribersNeedPush = class extends Error {
+var WorkerSubscribersNeedPush = class extends GkmError {
 	worker;
 	subscribers;
 	constructor(worker, subscribers) {
@@ -6579,7 +6580,7 @@ logger.info({ port }, 'Worker started');
 //#endregion
 //#region src/build/workers.ts
 /** A worker with background work and no backend app to build it from. */
-var WorkerHasNoApp = class extends Error {
+var WorkerHasNoApp = class extends GkmError {
 	worker;
 	constructor(worker) {
 		super(`The worker '${worker}' has crons, queues or subscribers, and the workspace has no backend app that builds a server to carry its entry. Declare a RestApi whose app holds the worker's code.`);
@@ -6588,7 +6589,7 @@ var WorkerHasNoApp = class extends Error {
 	}
 };
 /** A worker whose service name an app already has. */
-var WorkerNameTaken = class extends Error {
+var WorkerNameTaken = class extends GkmError {
 	worker;
 	service;
 	constructor(worker, service) {
@@ -6688,7 +6689,7 @@ const DEV_SERVICES = ["minio", "mailpit"];
 */
 const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
 /** Dev services asked of a target that runs no containers. */
-var DevServicesNeedServerTarget = class extends Error {
+var DevServicesNeedServerTarget = class extends GkmError {
 	target;
 	constructor(target) {
 		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services.`);
@@ -6701,7 +6702,7 @@ var DevServicesNeedServerTarget = class extends Error {
 * switch now: every construct the stage does not account for gets its dev
 * service.
 */
-var AllowDevServicesTakesNoValue = class extends Error {
+var AllowDevServicesTakesNoValue = class extends GkmError {
 	value;
 	constructor(value) {
 		super(`--allow-dev-services takes no value (it was given '${value}'). It runs the dev service for every bucket and mail the stage does not account for — no key in its secrets, no provider in deploy.<kind>.<stage> — so there is nothing to list. Pass --allow-dev-services on its own.`);
@@ -6729,7 +6730,7 @@ function assertDevServicesFlag(argv) {
 * A deployed stage with mail or object storage that its secrets do not
 * configure — every missing key, across every app, at once.
 */
-var ExternalServicesNotConfigured = class extends Error {
+var ExternalServicesNotConfigured = class extends GkmError {
 	stage;
 	missing;
 	constructor(stage, missing) {
@@ -6975,7 +6976,7 @@ function isStateProvider(value) {
 * custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
 * working but cannot lock.
 */
-var StateLocked = class extends Error {
+var StateLocked = class extends GkmError {
 	stage;
 	holder;
 	location;
@@ -6988,7 +6989,7 @@ var StateLocked = class extends Error {
 		this.name = "StateLocked";
 	}
 };
-var StateVersionConflict = class extends Error {
+var StateVersionConflict = class extends GkmError {
 	stage;
 	expectedVersion;
 	actualVersion;
@@ -7000,7 +7001,7 @@ var StateVersionConflict = class extends Error {
 		this.name = "StateVersionConflict";
 	}
 };
-var StageStateMissing = class extends Error {
+var StageStateMissing = class extends GkmError {
 	stage;
 	constructor(stage) {
 		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
@@ -7008,7 +7009,7 @@ var StageStateMissing = class extends Error {
 		this.name = "StageStateMissing";
 	}
 };
-var StateUnreadable = class extends Error {
+var StateUnreadable = class extends GkmError {
 	stage;
 	location;
 	constructor(stage, location, cause) {
@@ -7018,7 +7019,7 @@ var StateUnreadable = class extends Error {
 		this.name = "StateUnreadable";
 	}
 };
-var StateSchemaTooNew = class extends Error {
+var StateSchemaTooNew = class extends GkmError {
 	stage;
 	schemaVersion;
 	constructor(stage, schemaVersion) {
@@ -7033,7 +7034,7 @@ var StateSchemaTooNew = class extends Error {
 * in for a store, so a deploy that cannot be protected from a concurrent one
 * says so.
 */
-var StateStoreWithoutLocking = class extends Error {
+var StateStoreWithoutLocking = class extends GkmError {
 	provider;
 	constructor(provider) {
 		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
@@ -7041,7 +7042,7 @@ var StateStoreWithoutLocking = class extends Error {
 		this.name = "StateStoreWithoutLocking";
 	}
 };
-var StateStoreNeedsWorkspaceName = class extends Error {
+var StateStoreNeedsWorkspaceName = class extends GkmError {
 	provider;
 	constructor(provider) {
 		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
@@ -7049,7 +7050,7 @@ var StateStoreNeedsWorkspaceName = class extends Error {
 		this.name = "StateStoreNeedsWorkspaceName";
 	}
 };
-var UnknownStateProvider = class extends Error {
+var UnknownStateProvider = class extends GkmError {
 	config;
 	constructor(config) {
 		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
@@ -7058,7 +7059,7 @@ var UnknownStateProvider = class extends Error {
 	}
 };
 /** A lock or write that could not get at the state backend in time. */
-var StateStoreBusy = class extends Error {
+var StateStoreBusy = class extends GkmError {
 	stage;
 	location;
 	constructor(stage, location) {
@@ -7267,17 +7268,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await import("./LocalStateStore-CU-O0SBp.mjs").then((n) => n.n);
+		const { LocalStateStore } = await import("./LocalStateStore-Y8XHdoCR.mjs").then((n) => n.n);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await import("./LegacyStateStore-ZkdmiUFZ.mjs");
+		const { LegacyStateStore } = await import("./LegacyStateStore-DdJ1bCRV.mjs");
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await import("./SSMStateStore-CsOS0W1y.mjs");
+		const { SSMStateStore } = await import("./SSMStateStore-Bdyw_0Jj.mjs");
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -7287,7 +7288,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await import("./S3StateStore-bwxcI_wQ.mjs");
+		const { S3StateStore } = await import("./S3StateStore-BfoY4MvD.mjs");
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -7322,7 +7323,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-BI6J7oJr.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-1mqD6aG8.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -7335,7 +7336,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-DSStJVAv.mjs");
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-BqYGk9XT.mjs");
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -7346,7 +7347,7 @@ async function createDnsProvider(options) {
 * scoped to updates only. What reads them falls back to writing every record,
 * which is idempotent, without a diff.
 */
-var DnsRecordsUnreadable = class extends Error {
+var DnsRecordsUnreadable = class extends GkmError {
 	provider;
 	domain;
 	reason;
@@ -7368,7 +7369,7 @@ var DnsProviderNotImplemented = class extends Error {
 	}
 };
 /** A `provider:` that is none of the built-ins, nor a DnsProvider object. */
-var DnsProviderUnknown = class extends Error {
+var DnsProviderUnknown = class extends GkmError {
 	config;
 	constructor(config) {
 		super(`Unknown DNS provider: ${JSON.stringify(config)}. dns takes 'route53', 'godaddy', 'hostinger', 'manual', or an object implementing DnsProvider.`);
@@ -7882,7 +7883,7 @@ const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPON
 /** Docker refuses a repository name longer than this. */
 const MAX_NAME_LENGTH = 255;
 /** A value that is not an image reference was about to be built or pushed. */
-var ImageRefInvalid = class extends Error {
+var ImageRefInvalid = class extends GkmError {
 	ref;
 	constructor(ref) {
 		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
@@ -7918,7 +7919,7 @@ var DockerPushFailed = class extends Error {
 	}
 };
 /** `gkm docker --push` was asked for with nowhere to push to. */
-var PushNeedsRegistry = class extends Error {
+var PushNeedsRegistry = class extends GkmError {
 	imageName;
 	constructor(imageName) {
 		super(`Registry is required to push Docker image '${imageName}'. Use --registry or configure docker.registry in gkm.config.ts`);
@@ -8185,7 +8186,7 @@ function constructsOf$1(manifest, kind) {
 	return Object.entries(manifest).filter(([, d]) => d.kind === kind).map(([id]) => id).sort();
 }
 /** A stage that names `false` for a kind, and declares constructs of it. */
-var StageProviderDisabled = class extends Error {
+var StageProviderDisabled = class extends GkmError {
 	kind;
 	stage;
 	ids;
@@ -8421,7 +8422,7 @@ async function awsClientConfig(credential, region) {
 }
 const SUFFIX_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
 /** A name that S3 would refuse — what the name builder never returns. */
-var InvalidBucketName = class extends Error {
+var InvalidBucketName = class extends GkmError {
 	bucket;
 	reason;
 	constructor(bucket, reason) {
@@ -9423,7 +9424,7 @@ const LOOPBACK = /* @__PURE__ */ new Set([
 * `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
 * generated. Set by hand wins over derived, so the app would be handed it.
 */
-var StaleStageSecrets = class extends Error {
+var StaleStageSecrets = class extends GkmError {
 	stage;
 	stale;
 	constructor(stage, stale) {
@@ -9535,4 +9536,4 @@ function reportPlannedSeeds(planned, log) {
 //#endregion
 export { externalServices as $, LOCAL_LOGS_EMAIL as $n, isImageBuild as $t, setApplicationId as A, prepareEntryCredentials as An, applyPolicies as At, StateStoreWithoutLocking as B, applicationName as Bn, appEnvKeys as Bt, orchestrateDns as C, createCredentialsPreload as Cn, redisService as Ct, getGeneratedSecret as D, loadEnvFiles as Dn, LOCAL_CA_PATH as Dt, getBackupState as E, isPortAvailable as En, withRedisPassword as Et, createDnsProvider as F, FileSecretsStore as Fn, quoteIdentifier as Ft, AllowDevServicesTakesNoValue as G, markerOf as Gn, localRolePassword as Gt, contentVersion as H, imageName as Hn, networkEnv as Ht, DocumentStateStore as I, getKeyPath as In, LEGACY_LOCAL_LOGIN as It, ExternalServicesNotConfigured as J, initStageSecrets as Jn, TURBO_VERSION as Jt, DEV_SERVICES as K, ownershipMarker as Kn, composeBuildPaths as Kt, StageStateMissing as L, keystoreProject as Ln, ensurePostgresLogin as Lt, setGeneratedSecret as M, secretsStoreFor as Mn, bucketPolicies as Mt, setPostgresBackupId as N, storeFromConfig as Nn, postgresDatabaseNames as Nt, recordRelease as O, loadPortState as On, forgetState as Ot, DnsRecordsUnreadable as P, store_exports as Pn, postgresStatements as Pt, devServicesUsed as Q, withCustomSecret as Qn, imageBuildCredentials as Qt, StateLocked as R, projectKey as Rn, bucketClient as Rt, normalizeDnsConfig as S, primaryPortKey as Sn, STACK_CACHE as St, createEmptyState as T, findAvailablePort as Tn, stackRedis as Tt, createStateStore as U, imageRef as Un, workerEnvKeys as Ut, StateVersionConflict as V, deployIdentity as Vn, dockerfileOf as Vt, newLockHolder as W, isOwnedBy as Wn, envFor as Wt, assertDevServicesFlag as X, storage_exports as Xn, detectPackageManager as Xt, STORAGE_KEY_PAIR as Y, maskPassword as Yn, WORKER_PORT as Yt, assertExternalServices as Z, toEmbeddableSecrets as Zn, findBuildRoot as Zt, workerDockerfile as _, DEFAULT_IMAGES as _n, loadLocalCredentials as _t, provisionStage as a, composeFor as an, NoDomainForStage as ar, WorkerGenerator as at, extractSubdomain as b, portKeys as bn, withGeneratedSecrets as bt, StageProviderDisabled as c, planFor as cn, QueueGenerator as ct, stageProviderNotes as d, appTelemetry as dn, backendsOf as dt, cacheBackendFor as en, LOGS_SERVICE as er, manifestServiceDeclarations as et, DockerBuildFailed as f, isTelemetryKey as fn, constructGlobs as ft, ensureDockerignore as g, usesTelemetry as gn, LOCAL_RABBITMQ_USER as gt, dockerCommand as h, telemetryOf as hn, workspace_exports as ht, assertNoStaleSecrets as i, CLUSTER_DATABASE as in, withLogsPassword as ir, workerUnits as it, setBackupState as j, isRemoteStore as jn, applyPostgres as jt, recordRollback as k, loadSecretsForApp as kn, applyBuckets as kt, assertStageProvidersEnabled as l, resourceName as ln, CronGenerator as lt, appDockerfile as m, surfaceClientTraced as mn, reconcileWorkspace as mt, reportDatabaseRuns as n, providerOf as nn, logsService as nr, requiredStageKeys as nt, verifyStageProviders as o, EMULATOR_ACCESS_KEY_ID as on, isMainFrontendApp as or, workerBundleName as ot, DockerPushFailed as p, scopeTelemetryEnv as pn, derivedContainers as pt, DevServicesNeedServerTarget as q, projectName as qn, imageLayout as qt, reportPlannedSeeds as r, storageBackendFor as rn, stackLogs as rr, suppliedOnly as rt, DeployJournal as s, TELEMETRY_CONTAINER as sn, resolveHost as sr, workerEntryDir as st, DeploySeedsFailed as t, eventsBackendFor as tn, logsAccess as tr, reportDevServices as tt, provisionCommand as u, hostFor as un, FAKE_ENV as ut, workerDockerfileOf as v, describeServices as vn, postgresSuperuser as vt, verifyDnsRecords as w, createEntryWrapper as wn, runsRedis as wt, findRootDomain as x, portsOf as xn, REDIS_SERVICE as xt, validateImageRef as y, fakeKey as yn, readLocalCredentials as yt, StateStoreBusy as z, readKey as zn, pgClient as zt };
 
-//# sourceMappingURL=seeds-odfgSCmu.mjs.map
+//# sourceMappingURL=seeds-CvGQJnPO.mjs.map