@geekmidas/cli 10.0.0-alpha.91 → 10.0.0-alpha.92

package/dist/{secretsManager-DcMlHnRC.cjs → secretsManager-Cwwgs81g.cjs}

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_awsStore = require("./awsStore-7VmS_cZR.cjs");
+const require_awsStore = require("./awsStore-B5We7bMg.cjs");
 let _aws_sdk_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
 //#region src/secrets/secretsManager.ts
 /**
@@ -40,20 +40,41 @@ var SecretsManagerSecretsStore = class {
 	secretName(stage) {
 		return secretsManagerSecretName(this.options.project, stage);
 	}
+	/** Where a call for `stage` is, for an error saying it has no credentials. */
+	context(stage, access) {
+		return {
+			stage,
+			store: this.name,
+			profile: this.options.profile,
+			access
+		};
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* read it with, or they have expired
+	*/
 	async read(stage) {
 		const client = await this.secretsManager();
 		try {
-			const { SecretString } = await client.send(new _aws_sdk_client_secrets_manager.GetSecretValueCommand({ SecretId: this.secretName(stage) }));
+			const { SecretString } = await require_awsStore.withStageCredentials(this.context(stage, "read"), () => client.send(new _aws_sdk_client_secrets_manager.GetSecretValueCommand({ SecretId: this.secretName(stage) })));
 			return SecretString ? JSON.parse(SecretString) : null;
 		} catch (error) {
 			if (error instanceof _aws_sdk_client_secrets_manager.ResourceNotFoundException) return null;
 			throw error;
 		}
 	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* write it with, or they have expired
+	*/
 	async write(stage, secrets) {
 		const value = require_awsStore.serializeWithin(stage, this.name, secrets, SECRETS_MANAGER_SECRET_LIMIT);
 		const client = await this.secretsManager();
 		const name = this.secretName(stage);
+		await require_awsStore.withStageCredentials(this.context(stage, "write"), () => this.put(client, stage, name, value));
+	}
+	/** Put the secret, creating it on the stage's first write. */
+	async put(client, stage, name, value) {
 		try {
 			await client.send(new _aws_sdk_client_secrets_manager.PutSecretValueCommand({
 				SecretId: name,
@@ -84,4 +105,4 @@ Object.defineProperty(exports, "secretsManager_exports", {
 	}
 });
 
-//# sourceMappingURL=secretsManager-DcMlHnRC.cjs.map
+//# sourceMappingURL=secretsManager-Cwwgs81g.cjs.map

package/dist/secretsManager-Cwwgs81g.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretsManager-Cwwgs81g.cjs","names":["SecretsManagerClient","awsClientConfig","withStageCredentials","GetSecretValueCommand","ResourceNotFoundException","serializeWithin","PutSecretValueCommand","CreateSecretCommand"],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n\twithStageCredentials,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\t/** Where a call for `stage` is, for an error saying it has no credentials. */\n\tprivate context(stage: string, access: 'read' | 'write') {\n\t\treturn { stage, store: this.name, profile: this.options.profile, access };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await withStageCredentials(\n\t\t\t\tthis.context(stage, 'read'),\n\t\t\t\t() =>\n\t\t\t\t\tclient.send(\n\t\t\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t\t\t),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\tawait withStageCredentials(this.context(stage, 'write'), () =>\n\t\t\tthis.put(client, stage, name, value),\n\t\t);\n\t}\n\n\t/** Put the secret, creating it on the stage's first write. */\n\tprivate async put(\n\t\tclient: SecretsManagerClient,\n\t\tstage: string,\n\t\tname: string,\n\t\tvalue: string,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAIA,gCAAAA,qBAAqB,MAAMC,iBAAAA,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;;CAGA,QAAgB,OAAe,QAA0B;EACxD,OAAO;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO;CACzE;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAMC,iBAAAA,qBAC9B,KAAK,QAAQ,OAAO,MAAM,SAEzB,OAAO,KACN,IAAIC,gCAAAA,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D,CACF;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiBC,gCAAAA,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;;;;;CAMA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQC,iBAAAA,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,MAAMH,iBAAAA,qBAAqB,KAAK,QAAQ,OAAO,OAAO,SACrD,KAAK,IAAI,QAAQ,OAAO,MAAM,KAAK,CACpC;CACD;;CAGA,MAAc,IACb,QACA,OACA,MACA,OACgB;EAChB,IAAI;GACH,MAAM,OAAO,KACZ,IAAII,gCAAAA,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiBF,gCAAAA,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAIG,gCAAAA,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}

package/dist/{seeds-CkIPFGNO.cjs → seeds-BKoJYsE7.cjs}

@@ -1,12 +1,13 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_credentials = require("./credentials-BKfIugu2.cjs");
-const require_discover = require("./discover-D1It5r_h.cjs");
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_credentials = require("./credentials-QBu7VgaQ.cjs");
+const require_discover = require("./discover-DPgu-ScS.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-CwW3Gkru.cjs");
+const require_workspace = require("./workspace-CHOB2Xg3.cjs");
 const require_config = require("./config.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-CwLjBCFE.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-BVn7cQ-2.cjs");
-const require_resolve = require("./resolve-Cns0v6dN.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-De03t1hd.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-Dvz7EzqK.cjs");
+const require_resolve = require("./resolve-DUp65SnJ.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -66,7 +67,7 @@ function rootSite(sites) {
 	throw new AmbiguousRootSite(sites.map(({ name }) => name), declared.length > 1);
 }
 /** Several sites could hold the base domain, and none of them says it does. */
-var AmbiguousRootSite = class extends Error {
+var AmbiguousRootSite = class extends require_errors.GkmError {
 	sites;
 	tooMany;
 	constructor(sites, tooMany = false) {
@@ -79,7 +80,7 @@ var AmbiguousRootSite = class extends Error {
 //#endregion
 //#region src/target/dokploy/domain.ts
 /** A stage was deployed that `domains` gives no domain. */
-var NoDomainForStage = class extends Error {
+var NoDomainForStage = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`No domain for stage "${stage}". Add it to gkm.config.ts: domains: { ${stage}: 'example.com' }.`);
@@ -170,7 +171,7 @@ const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
 */
 const LOCAL_LOGS_EMAIL = "admin@gkm.localhost";
 /** A root password OpenObserve would refuse to start with. */
-var LogsPasswordWeak = class extends Error {
+var LogsPasswordWeak = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
@@ -179,7 +180,7 @@ var LogsPasswordWeak = class extends Error {
 	}
 };
 /** A deployed stage with logs on and no root password generated yet. */
-var LogsPasswordMissing = class extends Error {
+var LogsPasswordMissing = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
@@ -436,7 +437,7 @@ function validateEnvironmentVariables(requiredVars, secrets) {
 * `DeployIdentity` is what a deploy names and claims its resources by instead.
 */
 /** A namespace that cannot be part of a Dokploy name or an image path. */
-var DeployNamespaceInvalid = class extends Error {
+var DeployNamespaceInvalid = class extends require_errors.GkmError {
 	namespace;
 	constructor(namespace) {
 		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
@@ -445,7 +446,7 @@ var DeployNamespaceInvalid = class extends Error {
 	}
 };
 /** A workspace name with nothing a target can name a resource by. */
-var DeployProjectNameInvalid = class extends Error {
+var DeployProjectNameInvalid = class extends require_errors.GkmError {
 	workspaceName;
 	constructor(workspaceName) {
 		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
@@ -551,7 +552,7 @@ function applicationName(identity, app) {
 /** Key length for AES-256 encryption */
 const KEY_LENGTH = 32;
 /** A keystore project key that is not `<namespace>/<project>`. */
-var KeystoreProjectInvalid = class extends Error {
+var KeystoreProjectInvalid = class extends require_errors.GkmError {
 	key;
 	constructor(key) {
 		super(`'${key}' is not a keystore project: expected '<namespace>/<project>' in lowercase letters, digits and '-', as deployIdentity() produces. Pass the workspace's identity key.`);
@@ -560,7 +561,7 @@ var KeystoreProjectInvalid = class extends Error {
 	}
 };
 /** A stage has no key, here or at the place keys used to be kept. */
-var KeyNotFound = class extends Error {
+var KeyNotFound = class extends require_errors.GkmError {
 	stage;
 	project;
 	path;
@@ -757,7 +758,7 @@ var FileSecretsStore = class {
 	}
 };
 /** A stage's secrets file exists, and the key that opens it does not. */
-var MissingSecretsKey = class extends Error {
+var MissingSecretsKey = class extends require_errors.GkmError {
 	stage;
 	project;
 	path;
@@ -832,7 +833,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
 		case "ssm": {
-			const { AwsSecretsStore } = await Promise.resolve().then(() => require("./aws-BTawF0F-.cjs")).then((n) => n.aws_exports);
+			const { AwsSecretsStore } = await Promise.resolve().then(() => require("./aws-BTReGjpY.cjs")).then((n) => n.aws_exports);
 			return new AwsSecretsStore({
 				project: workspace.name,
 				region: config.region,
@@ -841,7 +842,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 		}
 		case "secrets-manager": {
 			const { kmsKeyId } = config;
-			const { SecretsManagerSecretsStore } = await Promise.resolve().then(() => require("./secretsManager-DcMlHnRC.cjs")).then((n) => n.secretsManager_exports);
+			const { SecretsManagerSecretsStore } = await Promise.resolve().then(() => require("./secretsManager-Cwwgs81g.cjs")).then((n) => n.secretsManager_exports);
 			return new SecretsManagerSecretsStore({
 				project: workspace.name,
 				region: config.region,
@@ -1845,7 +1846,7 @@ function planFor(manifest, stage, order, options = {}) {
 * code either way — declare a database, or select a backend that brings its own
 * broker.
 */
-var CacheNeedsDatabase = class extends Error {
+var CacheNeedsDatabase = class extends require_errors.GkmError {
 	ids;
 	constructor(ids) {
 		super(`A cache backed by the database needs a declared database, and none was declared, and on this deploy target that is where a cache lives. Declare one. Caches affected: ${ids.join(", ")}.`);
@@ -1864,7 +1865,7 @@ var CacheNeedsDatabase = class extends Error {
 * `orders.cache('Sessions')` names the database, which is a fact about the
 * application rather than a deployment choice.
 */
-var CacheIsAmbiguous = class extends Error {
+var CacheIsAmbiguous = class extends require_errors.GkmError {
 	ids;
 	databases;
 	constructor(ids, databases) {
@@ -1874,7 +1875,7 @@ var CacheIsAmbiguous = class extends Error {
 		this.name = "CacheIsAmbiguous";
 	}
 };
-var PgBossNeedsDatabase = class extends Error {
+var PgBossNeedsDatabase = class extends require_errors.GkmError {
 	ids;
 	constructor(ids) {
 		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one: on this deploy target, events are carried by pg-boss. Queues and topics affected: ${ids.join(", ")}.`);
@@ -3130,7 +3131,7 @@ CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile
 * prune` to one app's slice. Nothing is built on the host.
 */
 /** A workspace of packages with no turbo.json, which every image prunes with. */
-var MonorepoNeedsTurbo = class extends Error {
+var MonorepoNeedsTurbo = class extends require_errors.GkmError {
 	buildRoot;
 	constructor(buildRoot) {
 		super(`${buildRoot} is a workspace of packages, and its images are built from a turbo-pruned slice of it — but it has no turbo.json.\n\nTo fix this:
@@ -3669,7 +3670,7 @@ function schemaOf(resource, plan) {
 * On SNS each topic and queue is its own address, so there is no project-wide
 * one to hand out — a cron's schedule store, say, cannot live there.
 */
-var UnprovisionedEventsBackend = class extends Error {
+var UnprovisionedEventsBackend = class extends require_errors.GkmError {
 	backend;
 	constructor(backend) {
 		super(`'${backend}' has no single broker address: each topic and queue is addressed by its own ARN. Something asked for one without naming the topic or queue.`);
@@ -4302,7 +4303,7 @@ const LEGACY_LOCAL_LOGIN = Object.freeze({
 	password: "geekmidas"
 });
 /** No login this workspace knows opens its Postgres. */
-var PostgresLoginRefused = class extends Error {
+var PostgresLoginRefused = class extends require_errors.GkmError {
 	port;
 	user;
 	constructor(port, user) {
@@ -4313,7 +4314,7 @@ var PostgresLoginRefused = class extends Error {
 	}
 };
 /** No login this workspace knows opens its MinIO. */
-var MinioLoginRefused = class extends Error {
+var MinioLoginRefused = class extends require_errors.GkmError {
 	port;
 	user;
 	constructor(port, user) {
@@ -4660,7 +4661,7 @@ async function heldElsewhere(kept, keys, observed, probe, ours) {
 	return held;
 }
 /** The window was exhausted. */
-var NoPortAvailable = class extends Error {
+var NoPortAvailable = class extends require_errors.GkmError {
 	/** Where the search started. */
 	from;
 	/** The window searched, so the caller can report what was full. */
@@ -5406,7 +5407,7 @@ const REDIS_PASSWORD_KEY = "REDIS_PASSWORD";
 /** Redis's own count of logical databases, before `--databases` raises it. */
 const REDIS_DATABASES = 16;
 /** A deployed stage that runs the stack's Redis and has no password yet. */
-var RedisPasswordMissing = class extends Error {
+var RedisPasswordMissing = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`The stage '${stage}' runs the stack's Redis and has no ${REDIS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${REDIS_PASSWORD_KEY} '…' --stage ${stage}`);
@@ -5640,7 +5641,7 @@ function localCredentialsPath(project) {
 	return (0, node_path.join)(project.home ?? require_credentials.gkmHome(), "local", namespace, `${name}.json`);
 }
 /** The local stage's logins file is there, and its key is not. */
-var LocalCredentialsKeyMissing = class extends Error {
+var LocalCredentialsKeyMissing = class extends require_errors.GkmError {
 	path;
 	stage;
 	constructor(path, stage) {
@@ -5651,7 +5652,7 @@ var LocalCredentialsKeyMissing = class extends Error {
 	}
 };
 /** Another gkm held the logins file's lock for longer than any write takes. */
-var LocalCredentialsLocked = class extends Error {
+var LocalCredentialsLocked = class extends require_errors.GkmError {
 	lock;
 	constructor(lock) {
 		super(`Another gkm has been writing the local logins for over ${LOCK_TIMEOUT_MS / 1e3}s. If none is running, remove ${lock} and run the command again.`);
@@ -6351,7 +6352,7 @@ export async function stopQueues(): Promise<void> {
 * reached by building server images for a project that deploys to AWS — where
 * a subscriber is a Lambda instead.
 */
-var WorkerSubscribersNeedPush = class extends Error {
+var WorkerSubscribersNeedPush = class extends require_errors.GkmError {
 	worker;
 	subscribers;
 	constructor(worker, subscribers) {
@@ -6582,7 +6583,7 @@ logger.info({ port }, 'Worker started');
 //#endregion
 //#region src/build/workers.ts
 /** A worker with background work and no backend app to build it from. */
-var WorkerHasNoApp = class extends Error {
+var WorkerHasNoApp = class extends require_errors.GkmError {
 	worker;
 	constructor(worker) {
 		super(`The worker '${worker}' has crons, queues or subscribers, and the workspace has no backend app that builds a server to carry its entry. Declare a RestApi whose app holds the worker's code.`);
@@ -6591,7 +6592,7 @@ var WorkerHasNoApp = class extends Error {
 	}
 };
 /** A worker whose service name an app already has. */
-var WorkerNameTaken = class extends Error {
+var WorkerNameTaken = class extends require_errors.GkmError {
 	worker;
 	service;
 	constructor(worker, service) {
@@ -6691,7 +6692,7 @@ const DEV_SERVICES = ["minio", "mailpit"];
 */
 const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
 /** Dev services asked of a target that runs no containers. */
-var DevServicesNeedServerTarget = class extends Error {
+var DevServicesNeedServerTarget = class extends require_errors.GkmError {
 	target;
 	constructor(target) {
 		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services.`);
@@ -6704,7 +6705,7 @@ var DevServicesNeedServerTarget = class extends Error {
 * switch now: every construct the stage does not account for gets its dev
 * service.
 */
-var AllowDevServicesTakesNoValue = class extends Error {
+var AllowDevServicesTakesNoValue = class extends require_errors.GkmError {
 	value;
 	constructor(value) {
 		super(`--allow-dev-services takes no value (it was given '${value}'). It runs the dev service for every bucket and mail the stage does not account for — no key in its secrets, no provider in deploy.<kind>.<stage> — so there is nothing to list. Pass --allow-dev-services on its own.`);
@@ -6732,7 +6733,7 @@ function assertDevServicesFlag(argv) {
 * A deployed stage with mail or object storage that its secrets do not
 * configure — every missing key, across every app, at once.
 */
-var ExternalServicesNotConfigured = class extends Error {
+var ExternalServicesNotConfigured = class extends require_errors.GkmError {
 	stage;
 	missing;
 	constructor(stage, missing) {
@@ -6978,7 +6979,7 @@ function isStateProvider(value) {
 * custom `StateProvider` is wrapped by `LegacyStateStore`, which keeps it
 * working but cannot lock.
 */
-var StateLocked = class extends Error {
+var StateLocked = class extends require_errors.GkmError {
 	stage;
 	holder;
 	location;
@@ -6991,7 +6992,7 @@ var StateLocked = class extends Error {
 		this.name = "StateLocked";
 	}
 };
-var StateVersionConflict = class extends Error {
+var StateVersionConflict = class extends require_errors.GkmError {
 	stage;
 	expectedVersion;
 	actualVersion;
@@ -7003,7 +7004,7 @@ var StateVersionConflict = class extends Error {
 		this.name = "StateVersionConflict";
 	}
 };
-var StageStateMissing = class extends Error {
+var StageStateMissing = class extends require_errors.GkmError {
 	stage;
 	constructor(stage) {
 		super(`There is no deploy state for stage '${stage}' to record a resource in. Write the stage's state first (write with expectedVersion: null).`);
@@ -7011,7 +7012,7 @@ var StageStateMissing = class extends Error {
 		this.name = "StageStateMissing";
 	}
 };
-var StateUnreadable = class extends Error {
+var StateUnreadable = class extends require_errors.GkmError {
 	stage;
 	location;
 	constructor(stage, location, cause) {
@@ -7021,7 +7022,7 @@ var StateUnreadable = class extends Error {
 		this.name = "StateUnreadable";
 	}
 };
-var StateSchemaTooNew = class extends Error {
+var StateSchemaTooNew = class extends require_errors.GkmError {
 	stage;
 	schemaVersion;
 	constructor(stage, schemaVersion) {
@@ -7036,7 +7037,7 @@ var StateSchemaTooNew = class extends Error {
 * in for a store, so a deploy that cannot be protected from a concurrent one
 * says so.
 */
-var StateStoreWithoutLocking = class extends Error {
+var StateStoreWithoutLocking = class extends require_errors.GkmError {
 	provider;
 	constructor(provider) {
 		super(`The custom state provider '${provider}' has no lock and no versions, so two deploys of the same stage can still overwrite each other. Implement StateStore (lock, versioned read, conditional write) or use the 'local', 'ssm' or 's3' state provider.`);
@@ -7044,7 +7045,7 @@ var StateStoreWithoutLocking = class extends Error {
 		this.name = "StateStoreWithoutLocking";
 	}
 };
-var StateStoreNeedsWorkspaceName = class extends Error {
+var StateStoreNeedsWorkspaceName = class extends require_errors.GkmError {
 	provider;
 	constructor(provider) {
 		super(`The '${provider}' state provider keys state by workspace name. Set "name" in gkm.config.ts.`);
@@ -7052,7 +7053,7 @@ var StateStoreNeedsWorkspaceName = class extends Error {
 		this.name = "StateStoreNeedsWorkspaceName";
 	}
 };
-var UnknownStateProvider = class extends Error {
+var UnknownStateProvider = class extends require_errors.GkmError {
 	config;
 	constructor(config) {
 		super(`Unknown state provider ${JSON.stringify(config)}. Use 'local', 'ssm', 's3', or an object implementing StateStore or StateProvider.`);
@@ -7061,7 +7062,7 @@ var UnknownStateProvider = class extends Error {
 	}
 };
 /** A lock or write that could not get at the state backend in time. */
-var StateStoreBusy = class extends Error {
+var StateStoreBusy = class extends require_errors.GkmError {
 	stage;
 	location;
 	constructor(stage, location) {
@@ -7270,17 +7271,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-BBeTlRTH.cjs")).then((n) => n.LocalStateStore_exports);
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-BMfseje2.cjs")).then((n) => n.LocalStateStore_exports);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-DXmNA7hy.cjs"));
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-CeEwayMB.cjs"));
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-DoZE1Wi1.cjs"));
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-D9K62wM4.cjs"));
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -7290,7 +7291,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-Br8VMY22.cjs"));
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-BmMt2HhW.cjs"));
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -7325,7 +7326,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-CyTpG_jy.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-C6t-PSNe.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -7338,7 +7339,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-DqZ1qD_F.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-CJwg2r_9.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -7349,7 +7350,7 @@ async function createDnsProvider(options) {
 * scoped to updates only. What reads them falls back to writing every record,
 * which is idempotent, without a diff.
 */
-var DnsRecordsUnreadable = class extends Error {
+var DnsRecordsUnreadable = class extends require_errors.GkmError {
 	provider;
 	domain;
 	reason;
@@ -7371,7 +7372,7 @@ var DnsProviderNotImplemented = class extends Error {
 	}
 };
 /** A `provider:` that is none of the built-ins, nor a DnsProvider object. */
-var DnsProviderUnknown = class extends Error {
+var DnsProviderUnknown = class extends require_errors.GkmError {
 	config;
 	constructor(config) {
 		super(`Unknown DNS provider: ${JSON.stringify(config)}. dns takes 'route53', 'godaddy', 'hostinger', 'manual', or an object implementing DnsProvider.`);
@@ -7891,7 +7892,7 @@ const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPON
 /** Docker refuses a repository name longer than this. */
 const MAX_NAME_LENGTH = 255;
 /** A value that is not an image reference was about to be built or pushed. */
-var ImageRefInvalid = class extends Error {
+var ImageRefInvalid = class extends require_errors.GkmError {
 	ref;
 	constructor(ref) {
 		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
@@ -7927,7 +7928,7 @@ var DockerPushFailed = class extends Error {
 	}
 };
 /** `gkm docker --push` was asked for with nowhere to push to. */
-var PushNeedsRegistry = class extends Error {
+var PushNeedsRegistry = class extends require_errors.GkmError {
 	imageName;
 	constructor(imageName) {
 		super(`Registry is required to push Docker image '${imageName}'. Use --registry or configure docker.registry in gkm.config.ts`);
@@ -8194,7 +8195,7 @@ function constructsOf$1(manifest, kind) {
 	return Object.entries(manifest).filter(([, d]) => d.kind === kind).map(([id]) => id).sort();
 }
 /** A stage that names `false` for a kind, and declares constructs of it. */
-var StageProviderDisabled = class extends Error {
+var StageProviderDisabled = class extends require_errors.GkmError {
 	kind;
 	stage;
 	ids;
@@ -8430,7 +8431,7 @@ async function awsClientConfig(credential, region) {
 }
 const SUFFIX_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
 /** A name that S3 would refuse — what the name builder never returns. */
-var InvalidBucketName = class extends Error {
+var InvalidBucketName = class extends require_errors.GkmError {
 	bucket;
 	reason;
 	constructor(bucket, reason) {
@@ -9432,7 +9433,7 @@ const LOOPBACK = /* @__PURE__ */ new Set([
 * `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
 * generated. Set by hand wins over derived, so the app would be handed it.
 */
-var StaleStageSecrets = class extends Error {
+var StaleStageSecrets = class extends require_errors.GkmError {
 	stage;
 	stale;
 	constructor(stage, stale) {
@@ -10557,4 +10558,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-CkIPFGNO.cjs.map
+//# sourceMappingURL=seeds-BKoJYsE7.cjs.map