@geekmidas/cli 10.0.0-alpha.92 → 10.0.0-alpha.93

package/dist/index.cjs

@@ -7,7 +7,7 @@ const require_discover = require("./discover-DPgu-ScS.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-CHOB2Xg3.cjs");
 const require_config = require("./config.cjs");
-const require_seeds = require("./seeds-BKoJYsE7.cjs");
+const require_seeds = require("./seeds-c-ByX9je.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-De03t1hd.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-Dvz7EzqK.cjs");
@@ -16,10 +16,11 @@ const require_drivers = require("./drivers-DDojgzz0.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
 const require_local = require("./local-B61kUh0w.cjs");
 const require_sniffer = require("./sniffer-Dq5BS98f.cjs");
-const require_deploy = require("./deploy-6ToUHJmM.cjs");
-const require_compose = require("./compose-fnYmPk_c.cjs");
+const require_deploy = require("./deploy-C3Mhnmus.cjs");
+const require_compose = require("./compose-BHVKLluX.cjs");
+const require_stack = require("./stack-1PeLJS2j.cjs");
 const require_credentialSchemas = require("./credentialSchemas-CAPKFkrG.cjs");
-const require_LocalStateStore = require("./LocalStateStore-BMfseje2.cjs");
+const require_LocalStateStore = require("./LocalStateStore-oX_zxj9V.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
 require("./awsStore-B5We7bMg.cjs");
 const require_ready = require("./ready-D3PIjx3S.cjs");
@@ -55,7 +56,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.92";
+var version = "10.0.0-alpha.93";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -2332,9 +2333,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-D3VVsiHp.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-C8wTpakT.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-D3VVsiHp.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-C8wTpakT.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3387,7 +3388,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CXQDrhzN.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-Dfsr6KXU.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3532,7 +3533,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CXQDrhzN.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-Dfsr6KXU.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3618,7 +3619,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CXQDrhzN.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-Dfsr6KXU.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3864,7 +3865,7 @@ var ComposeModeConflict = class extends require_errors.GkmError {
 };
 /** Each pushed image as `<ref>@sha256:…`, by app. */
 function pushedDigests(run) {
-	return Object.fromEntries(Object.entries(run.images).filter(([, image]) => image.digest).sort(([a], [b]) => a.localeCompare(b)).map(([app, image]) => [app, require_compose.pinnedRef(image.ref, image.digest)]));
+	return Object.fromEntries(Object.entries(run.images).filter(([, image]) => image.digest).sort(([a], [b]) => a.localeCompare(b)).map(([app, image]) => [app, require_stack.pinnedRef(image.ref, image.digest)]));
 }
 /** `gkm compose`. */
 async function composeCommand(options, deps = {}) {
@@ -3878,12 +3879,12 @@ async function composeCommand(options, deps = {}) {
 	if (options.down) {
 		const override = require_compose.stackOverrideFile(workspace.root, stage);
 		const ref = {
-			project: require_compose.composeProject(require_seeds.deployIdentity(workspace, stage)),
-			file: (0, node_path.join)(workspace.root, require_compose.stackDir(stage), "docker-compose.yml"),
+			project: require_stack.composeProject(require_seeds.deployIdentity(workspace, stage)),
+			file: (0, node_path.join)(workspace.root, require_stack.stackDir(stage), "docker-compose.yml"),
 			...(0, node_fs.existsSync)(override) ? { overrides: [override] } : {},
 			cwd: workspace.root
 		};
-		if (await require_compose.removeEdgeRoutes(require_compose.edgeDir(deps.env ?? process.env), ref.project)) console.log(`🌐 Removed ${ref.project}'s routes from ${require_compose.EDGE_PROJECT}.`);
+		if (await require_compose.removeEdgeRoutes(require_compose.edgeDir(deps.env ?? process.env), ref.project)) console.log(`🌐 Removed ${ref.project}'s routes from ${require_stack.EDGE_PROJECT}.`);
 		await (deps.docker ?? require_compose.dockerCompose).down(ref);
 		console.log(`🛑 Stopped ${ref.project}. Its volumes are kept.`);
 		return;
@@ -3893,7 +3894,7 @@ async function composeCommand(options, deps = {}) {
 	const tag = options.tag ?? (options.pull ? "latest" : void 0);
 	const pin = options.digestsFile && pulls ? {
 		file: options.digestsFile,
-		digests: require_compose.parseDigests(options.digestsFile, await (0, node_fs_promises.readFile)((0, node_path.resolve)(cwd, options.digestsFile), "utf-8"))
+		digests: require_stack.parseDigests(options.digestsFile, await (0, node_fs_promises.readFile)((0, node_path.resolve)(cwd, options.digestsFile), "utf-8"))
 	} : void 0;
 	const result = await require_deploy.deploy({
 		cwd,
@@ -4139,6 +4140,7 @@ const MASKED = "********";
 */
 function maskStateSecrets(state) {
 	const masked = structuredClone(state);
+	if (masked.provider !== "dokploy") return masked;
 	for (const credentials of Object.values(masked.appCredentials ?? {})) credentials.dbPassword = MASKED;
 	for (const secrets of Object.values(masked.generatedSecrets ?? {})) for (const name of Object.keys(secrets)) secrets[name] = MASKED;
 	if (masked.backups) {
@@ -4194,6 +4196,7 @@ async function stateShowCommand(options) {
 	if (options.json) console.log(JSON.stringify(state, null, 2));
 	else {
 		printStateDetails(state);
+		printDnsRecords(stored.resources);
 		printUnfinished(stored.resources);
 	}
 }
@@ -4238,8 +4241,8 @@ async function stateDiffCommand(options) {
 	if (!remote) console.log("Remote: (none)");
 	else console.log(`Remote: Last deployed ${remote.lastDeployedAt}`);
 	console.log("");
-	const localApps = local?.applications ?? {};
-	const remoteApps = remote?.applications ?? {};
+	const localApps = dokploy(local)?.applications ?? {};
+	const remoteApps = dokploy(remote)?.applications ?? {};
 	const allApps = /* @__PURE__ */ new Set([...Object.keys(localApps), ...Object.keys(remoteApps)]);
 	if (allApps.size > 0) {
 		console.log("Applications:");
@@ -4252,8 +4255,8 @@ async function stateDiffCommand(options) {
 			else console.log(`  ${app}: ${localId} (local) != ${remoteId} (remote) [MISMATCH]`);
 		}
 	}
-	const localServices = local?.services ?? {};
-	const remoteServices = remote?.services ?? {};
+	const localServices = dokploy(local)?.services ?? {};
+	const remoteServices = dokploy(remote)?.services ?? {};
 	if (Object.keys(localServices).length > 0 || Object.keys(remoteServices).length > 0) {
 		console.log("\nServices:");
 		const serviceKeys = /* @__PURE__ */ new Set([...Object.keys(localServices), ...Object.keys(remoteServices)]);
@@ -4318,6 +4321,10 @@ async function copyStage(from, to, stage) {
 	for (const { updatedAt: _stamped, ...record } of Object.values(source.resources)) version = await to.putResource(stage, record, { expectedVersion: version });
 	return source;
 }
+/** `state` if Dokploy wrote it — the only shape with ids of its own. */
+function dokploy(state) {
+	return state?.provider === "dokploy" ? state : null;
+}
 function describeRecord(record) {
 	if (!record) return "(none)";
 	return record.id ? `${record.status} ${record.id}` : record.status;
@@ -4331,6 +4338,12 @@ function printUnfinished(resources) {
 	for (const record of pending) console.log(`  ${record.key}`);
 }
 function printStateSummary(state) {
+	if (state.provider !== "dokploy") {
+		console.log(`  Stage: ${state.stage} (${state.provider})`);
+		console.log(`  Apps released: ${Object.keys(state.releases ?? {}).length}`);
+		console.log(`  Last deployed: ${state.lastDeployedAt}`);
+		return;
+	}
 	const appCount = Object.keys(state.applications).length;
 	const hasPostgres = !!state.services.postgresId;
 	const hasRedis = !!state.services.redisId;
@@ -4341,6 +4354,14 @@ function printStateSummary(state) {
 	console.log(`  Last deployed: ${state.lastDeployedAt}`);
 }
 function printStateDetails(state) {
+	if (state.provider !== "dokploy") {
+		console.log(`Stage: ${state.stage} (${state.provider})`);
+		console.log(`Last Deployed: ${state.lastDeployedAt}`);
+		if (state.identity) console.log(`Identity: ${state.identity}`);
+		console.log("");
+		printReleases(state.releases);
+		return;
+	}
 	console.log(`Stage: ${state.stage}`);
 	console.log(`Environment ID: ${state.environmentId}`);
 	console.log(`Last Deployed: ${state.lastDeployedAt}`);
@@ -4382,6 +4403,62 @@ function printStateDetails(state) {
 		for (const [hostname, info] of Object.entries(state.dnsVerified)) console.log(`  ${hostname}: ${info.serverIp} (${info.verifiedAt})`);
 	}
 }
+/** Each app's current release, and who released it. */
+function printReleases(releases) {
+	console.log("Releases:");
+	const apps = Object.entries(releases ?? {});
+	if (apps.length === 0) {
+		console.log("  (none)");
+		return;
+	}
+	for (const [app, { current }] of apps) console.log(`  ${app}: ${describeRelease(current)}`);
+}
+/** `ghcr.io/acme/api:v2 (sha256:…) · 2026-… · ada@laptop` */
+function describeRelease(release) {
+	return [
+		`${release.ref}${release.digest ? ` (${release.digest})` : ""}`,
+		release.releasedAt,
+		require_seeds.describeActor(release.releasedBy)
+	].join(" · ");
+}
+/** The DNS records gkm wrote for the stage. */
+function printDnsRecords(resources) {
+	const records = require_seeds.dnsResources(resources);
+	if (records.length === 0) return;
+	console.log("");
+	console.log("DNS Records:");
+	for (const record of records) console.log(`  ${record.fqdn} ${record.type} ${record.value} (TTL ${record.ttl}${record.provider ? `, ${record.provider}` : ""})`);
+}
+/**
+* Who wrote a stage's state, newest first, and what each app runs.
+* `gkm state:history --stage=<stage>`
+*/
+async function stateHistoryCommand(options) {
+	const { workspace } = await require_config.loadWorkspaceConfig();
+	const stored = await (await require_seeds.createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name
+	})).read(options.stage);
+	if (!stored) {
+		console.log(`No state found for stage: ${options.stage}`);
+		return;
+	}
+	const history = {
+		stage: options.stage,
+		history: stored.history,
+		releases: Object.fromEntries(Object.entries(stored.state.releases ?? {}).map(([app, releases]) => [app, releases.current]))
+	};
+	if (options.json) {
+		console.log(JSON.stringify(history, null, 2));
+		return;
+	}
+	console.log(`History of stage ${options.stage} (newest first):`);
+	if (history.history.length === 0) console.log("  (none recorded)");
+	for (const entry of history.history) console.log(`  ${entry.serial} · ${entry.at} · ${require_seeds.describeActor(entry.by)} · ${entry.operation}`);
+	console.log("");
+	printReleases(stored.state.releases);
+}
 //#endregion
 //#region src/secrets/generator.ts
 /**
@@ -5353,25 +5430,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.92",
-	"@geekmidas/auth": "~10.0.0-alpha.92",
-	"@geekmidas/cache": "~10.0.0-alpha.92",
-	"@geekmidas/client": "~10.0.0-alpha.92",
-	"@geekmidas/cloud": "~10.0.0-alpha.92",
-	"@geekmidas/constructs": "~10.0.0-alpha.92",
-	"@geekmidas/db": "~10.0.0-alpha.92",
-	"@geekmidas/emailkit": "~10.0.0-alpha.92",
-	"@geekmidas/envkit": "~10.0.0-alpha.92",
-	"@geekmidas/errors": "~10.0.0-alpha.92",
-	"@geekmidas/events": "~10.0.0-alpha.92",
-	"@geekmidas/logger": "~10.0.0-alpha.92",
-	"@geekmidas/manifest": "~10.0.0-alpha.92",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.92",
-	"@geekmidas/schema": "~10.0.0-alpha.92",
-	"@geekmidas/services": "~10.0.0-alpha.92",
-	"@geekmidas/storage": "~10.0.0-alpha.92",
-	"@geekmidas/telescope": "~10.0.0-alpha.92",
-	"@geekmidas/testkit": "~10.0.0-alpha.92",
+	"@geekmidas/audit": "~10.0.0-alpha.93",
+	"@geekmidas/auth": "~10.0.0-alpha.93",
+	"@geekmidas/cache": "~10.0.0-alpha.93",
+	"@geekmidas/client": "~10.0.0-alpha.93",
+	"@geekmidas/cloud": "~10.0.0-alpha.93",
+	"@geekmidas/constructs": "~10.0.0-alpha.93",
+	"@geekmidas/db": "~10.0.0-alpha.93",
+	"@geekmidas/emailkit": "~10.0.0-alpha.93",
+	"@geekmidas/envkit": "~10.0.0-alpha.93",
+	"@geekmidas/errors": "~10.0.0-alpha.93",
+	"@geekmidas/events": "~10.0.0-alpha.93",
+	"@geekmidas/logger": "~10.0.0-alpha.93",
+	"@geekmidas/manifest": "~10.0.0-alpha.93",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.93",
+	"@geekmidas/schema": "~10.0.0-alpha.93",
+	"@geekmidas/services": "~10.0.0-alpha.93",
+	"@geekmidas/storage": "~10.0.0-alpha.93",
+	"@geekmidas/telescope": "~10.0.0-alpha.93",
+	"@geekmidas/testkit": "~10.0.0-alpha.93",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5772,7 +5849,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "446c06603533dd304ee5655661784b7a4f07e2b7", version = cliVersion()) {
+function stagesActionUses(commit = "a619ff213e362417b184dff08c8175a86f5d9d07", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -11054,135 +11131,6 @@ function maskUrl(url) {
 	}
 }
 //#endregion
-//#region src/providers/dns.ts
-/** Whether the workspace deploys through the compose target. */
-function deploysWithCompose(workspace) {
-	return workspace.deploy?.default === "compose" || Object.values(workspace.apps).some((app) => app.resolvedDeployTarget === "compose");
-}
-/**
-* A compose stage that serves a domain has its server's address in its
-* secrets — checked before `gkm setup --stage` does anything else.
-*
-* @throws {ServerAddressMissing} for a compose stage with a domain and none
-* @throws {ServerAddressInvalid} for a value that is not an address
-*/
-function assertStageServer(workspace, stage, secrets) {
-	if (stage === workspace.stages.local) return void 0;
-	if (!deploysWithCompose(workspace)) return require_compose.serverAddress(stage, secrets?.custom);
-	return require_compose.requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
-}
-/**
-* The hosts a compose stage serves: its stack composed as a deploy would —
-* with the secrets it would generate made up in memory, never written — and
-* every route's host read off it.
-*/
-async function composeStageHosts(options) {
-	const { workspace, stage } = options;
-	const runnables = options.runnables ?? {};
-	const background = options.background ?? {};
-	const manifest = options.manifest ?? await require_discover.discover({
-		patterns: require_seeds.constructGlobs(workspace),
-		cwd: workspace.root,
-		runnables,
-		background
-	});
-	const stored = await (await require_seeds.secretsStoreFor(workspace, stage, {
-		...options.profile ? { profile: options.profile } : {},
-		...options.home ? { home: options.home } : {}
-	})).read(stage);
-	const { deployedStackSecrets } = await Promise.resolve().then(() => require("./compose-fnYmPk_c.cjs")).then((n) => n.secrets_exports);
-	const { composeStack } = await Promise.resolve().then(() => require("./compose-fnYmPk_c.cjs")).then((n) => n.stack_exports);
-	const { secrets } = deployedStackSecrets(workspace, stage, stored, manifest);
-	const stack = composeStack({
-		workspace,
-		manifest,
-		runnables,
-		background,
-		stage,
-		identity: require_seeds.deployIdentity(workspace, stage),
-		images: {
-			mode: "pull",
-			tag: "dns",
-			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
-		},
-		secrets,
-		buildOnly: true,
-		allowDevServices: true
-	});
-	return require_compose.stackHosts(stack);
-}
-/**
-* `GKM_SERVER_IPV4` from the stage's secrets and `dns`: each public host's
-* records, created or corrected. A dry run reads and prints, and writes
-* nothing.
-*/
-async function provisionStageDns(options) {
-	const { workspace, stage } = options;
-	const log = options.log ?? ((line) => console.log(line));
-	if (stage === workspace.stages.local || !workspace.dns || !deploysWithCompose(workspace)) return {
-		mode: "none",
-		hosts: [],
-		changes: []
-	};
-	const store = await require_seeds.secretsStoreFor(workspace, stage, {
-		...options.profile ? { profile: options.profile } : {},
-		...options.home ? { home: options.home } : {}
-	});
-	const server = require_compose.serverAddress(stage, (await store.read(stage))?.custom);
-	if (!server) {
-		log(`\n🌐 DNS for '${stage}': no GKM_SERVER_IPV4 in its secrets, so no records — ${require_compose.serverAddressHint(stage)}`);
-		return {
-			mode: "none",
-			hosts: [],
-			changes: []
-		};
-	}
-	const hosts = [...options.hosts ?? await composeStageHosts({
-		workspace,
-		stage,
-		...options.profile ? { profile: options.profile } : {},
-		...options.home ? { home: options.home } : {},
-		...options.manifest ? { manifest: options.manifest } : {},
-		...options.runnables ? { runnables: options.runnables } : {},
-		...options.background ? { background: options.background } : {}
-	})];
-	log(`\n🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${options.dryRun ? " (dry run — nothing is written)" : ""}`);
-	const plan = require_compose.planStackDns({
-		stage,
-		hosts,
-		server,
-		dns: workspace.dns
-	});
-	try {
-		return {
-			mode: "records",
-			hosts,
-			changes: await require_compose.applyStackDns(plan, {
-				...options.dryRun ? { dryRun: true } : {},
-				log,
-				credentials: {
-					env: options.env ?? process.env,
-					...options.home ? { home: options.home } : {},
-					log
-				},
-				...options.providerFor ? { providerFor: options.providerFor } : {}
-			})
-		};
-	} catch (error) {
-		if (error instanceof require_credentials.MissingCredential) {
-			log(`   ⚠ ${error.message}`);
-			log("   Until then, create these records yourself:");
-			for (const domain of plan.domains) for (const r of domain.records) log(`     ${r.host.padEnd(32)} ${r.type.padEnd(5)} ${r.value}  (TTL ${r.ttl})`);
-			return {
-				mode: "records",
-				hosts,
-				changes: []
-			};
-		}
-		throw error;
-	}
-}
-//#endregion
 //#region src/setup/index.ts
 var setup_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	createFreshWorkspaceSecrets: () => createFreshWorkspaceSecrets,
@@ -11216,7 +11164,10 @@ async function setupCommand(options = {}) {
 	logger$1.log(`📦 Workspace: ${workspace.name}`);
 	logger$1.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
 	logger$1.log(`🔑 Stage: ${stage}\n`);
-	if (!local) assertStageServer(workspace, stage, await (await require_seeds.secretsStoreFor(workspace, stage, { ...options.profile ? { profile: options.profile } : {} })).read(stage));
+	if (!local) {
+		const store = await require_seeds.secretsStoreFor(workspace, stage, { ...options.profile ? { profile: options.profile } : {} });
+		require_seeds.assertStageServer(workspace, stage, await store.read(stage));
+	}
 	if (!local && options.dryRun) {
 		await provisionDeployed(workspace, stage, options);
 		return;
@@ -11251,7 +11202,7 @@ async function provisionDeployed(workspace, stage, options) {
 		log: (line) => logger$1.log(line)
 	})).filter((r) => r.mode === "provider");
 	if (configured.length === 0) logger$1.log(`   None configured: '${stage}' takes every key from its secrets (gkm secrets:add --stage ${stage}). Name one in gkm.config.ts — deploy: { objects: { ${stage}: { provider: 's3' } } } — to have ${require_seeds.provisionCommand(stage)} create it.`);
-	const dns = await provisionStageDns({
+	const dns = await require_seeds.provisionStageDns({
 		workspace,
 		stage,
 		...options.dryRun ? { dryRun: true } : {},
@@ -11614,7 +11565,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-D3VVsiHp.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-C8wTpakT.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-DPgu-ScS.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -12050,7 +12001,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-D3VVsiHp.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-C8wTpakT.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12063,7 +12014,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-D3VVsiHp.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-C8wTpakT.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12076,7 +12027,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-D3VVsiHp.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-C8wTpakT.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -12176,7 +12127,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-oN0b18HN.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-VcyJnsPX.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12186,7 +12137,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CgW167LO.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-D7zmwzWz.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12196,7 +12147,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CgW167LO.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-D7zmwzWz.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12235,7 +12186,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-BKoJYsE7.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-c-ByX9je.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12244,7 +12195,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-BKoJYsE7.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-c-ByX9je.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12261,14 +12212,14 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-f6JDjyCp.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-DFjbGnSr.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns-check", "Compose: do not check that each public host resolves to GKM_SERVER_IPV4 in the stage secrets before starting (a CDN or proxy in front)").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-BRZFYvdb.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-DL19w4OE.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -12286,7 +12237,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-DDHtd0GJ.cjs")).then((n) => n.rollback_exports);
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback--ympG9ss.cjs")).then((n) => n.rollback_exports);
 		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-8XngdSTo.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -12320,7 +12271,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BD051KZZ.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-zneTMvnO.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12429,6 +12380,15 @@ program.command("state:show").description("Show deployment state for a stage").r
 		exitWithError(error);
 	}
 });
+program.command("state:history").description("Show who wrote a stage's deploy state, newest first, and what each app runs").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--json", "Output as JSON").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await stateHistoryCommand(options);
+	} catch (error) {
+		exitWithError(error);
+	}
+});
 program.command("state:unlock").description("Release a stage deploy lock left behind by a run that crashed").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -12464,7 +12424,6 @@ try {
 program.parse();
 //#endregion
 exports.canPrompt = canPrompt;
-exports.deploysWithCompose = deploysWithCompose;
 exports.formatError = formatError;
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
 exports.prompt = prompt;