@geekmidas/cli 10.0.0-alpha.97 → 10.0.0-alpha.98

package/dist/index.cjs

@@ -6,9 +6,9 @@ const require_run = require("./run-fVZ-rLnc.cjs");
 const require_credentials = require("./credentials-Zqr3QQYB.cjs");
 const require_discover = require("./discover-DPgu-ScS.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-C1M-S4al.cjs");
+const require_workspace = require("./workspace-BJ78Bgvm.cjs");
 const require_config = require("./config.cjs");
-const require_seeds = require("./seeds-BQlj9Fsg.cjs");
+const require_seeds = require("./seeds-Df4BI-T3.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-De03t1hd.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-Dvz7EzqK.cjs");
@@ -16,12 +16,12 @@ const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
 const require_drivers = require("./drivers-DDojgzz0.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
 const require_local = require("./local-DNhnkugT.cjs");
-const require_sniffer = require("./sniffer-CeUKUoHn.cjs");
-const require_deploy = require("./deploy-Cu_HyWoJ.cjs");
+const require_sniffer = require("./sniffer-DZeQJKty.cjs");
+const require_deploy = require("./deploy-277jek46.cjs");
 const require_credentialSchemas = require("./credentialSchemas-CAPKFkrG.cjs");
-const require_compose = require("./compose-C39XupJu.cjs");
-const require_stack = require("./stack-Clzi40EE.cjs");
-const require_LocalStateStore = require("./LocalStateStore-B_bRI8M7.cjs");
+const require_compose = require("./compose-DMY4ouEk.cjs");
+const require_stack = require("./stack-BpkZEEfB.cjs");
+const require_LocalStateStore = require("./LocalStateStore-QcrdjCl6.cjs");
 const require_utils = require("./utils-D2Nk1Nv2.cjs");
 const require_ready = require("./ready-D3PIjx3S.cjs");
 let node_path = require("node:path");
@@ -56,7 +56,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.97";
+var version = "10.0.0-alpha.98";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -139,7 +139,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-CeUKUoHn.cjs")).then((n) => n.dokploy_api_exports);
+	const { DokployApi } = await Promise.resolve().then(() => require("./sniffer-DZeQJKty.cjs")).then((n) => n.dokploy_api_exports);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2333,9 +2333,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-CWq8-s21.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-Cs7kQxD5.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-CWq8-s21.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-Cs7kQxD5.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3388,7 +3388,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-SX3Uy8qT.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-B0Pj5FXT.cjs"));
 			await bundleServer({
 				entryPoint,
 				outputDir: (0, node_path.join)(outputDir, "dist"),
@@ -3533,7 +3533,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-SX3Uy8qT.cjs"));
+		const { bundleServer } = await Promise.resolve().then(() => require("./bundler-B0Pj5FXT.cjs"));
 		const outfile = require_seeds.workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3619,7 +3619,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-SX3Uy8qT.cjs"));
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-B0Pj5FXT.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5438,25 +5438,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.97",
-	"@geekmidas/auth": "~10.0.0-alpha.97",
-	"@geekmidas/cache": "~10.0.0-alpha.97",
-	"@geekmidas/client": "~10.0.0-alpha.97",
-	"@geekmidas/cloud": "~10.0.0-alpha.97",
-	"@geekmidas/constructs": "~10.0.0-alpha.97",
-	"@geekmidas/db": "~10.0.0-alpha.97",
-	"@geekmidas/emailkit": "~10.0.0-alpha.97",
-	"@geekmidas/envkit": "~10.0.0-alpha.97",
-	"@geekmidas/errors": "~10.0.0-alpha.97",
-	"@geekmidas/events": "~10.0.0-alpha.97",
-	"@geekmidas/logger": "~10.0.0-alpha.97",
-	"@geekmidas/manifest": "~10.0.0-alpha.97",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.97",
-	"@geekmidas/schema": "~10.0.0-alpha.97",
-	"@geekmidas/services": "~10.0.0-alpha.97",
-	"@geekmidas/storage": "~10.0.0-alpha.97",
-	"@geekmidas/telescope": "~10.0.0-alpha.97",
-	"@geekmidas/testkit": "~10.0.0-alpha.97",
+	"@geekmidas/audit": "~10.0.0-alpha.98",
+	"@geekmidas/auth": "~10.0.0-alpha.98",
+	"@geekmidas/cache": "~10.0.0-alpha.98",
+	"@geekmidas/client": "~10.0.0-alpha.98",
+	"@geekmidas/cloud": "~10.0.0-alpha.98",
+	"@geekmidas/constructs": "~10.0.0-alpha.98",
+	"@geekmidas/db": "~10.0.0-alpha.98",
+	"@geekmidas/emailkit": "~10.0.0-alpha.98",
+	"@geekmidas/envkit": "~10.0.0-alpha.98",
+	"@geekmidas/errors": "~10.0.0-alpha.98",
+	"@geekmidas/events": "~10.0.0-alpha.98",
+	"@geekmidas/logger": "~10.0.0-alpha.98",
+	"@geekmidas/manifest": "~10.0.0-alpha.98",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.98",
+	"@geekmidas/schema": "~10.0.0-alpha.98",
+	"@geekmidas/services": "~10.0.0-alpha.98",
+	"@geekmidas/storage": "~10.0.0-alpha.98",
+	"@geekmidas/telescope": "~10.0.0-alpha.98",
+	"@geekmidas/testkit": "~10.0.0-alpha.98",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5857,7 +5857,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "3e132c8a7cb4e861d459ae32496c1a122d892b14", version = cliVersion()) {
+function stagesActionUses(commit = "e20b5756311a0437161b94dc9be00aa1ff1120ab", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -6191,7 +6191,7 @@ ${pm.setup}
 
 ${registryLogin(registry)}
       # A site's public URLs are built into it, so the build reads the stage's
-      # secrets store. With secrets.store on SSM or Secrets Manager the job
+      # secrets store. With secrets.store on S3, SSM or Secrets Manager the job
       # assumes the stage's role (AWS_ROLE_ARN, set by gkm deploy:github);
       # with the default 'file' store there is no role to assume.
       - name: Assume the stage's AWS role
@@ -7811,7 +7811,7 @@ ${deployBlock(options)}
 ${workspaceConstructsGlobs(options.routesStructure, (0, node_path.dirname)(options.apiPath)).map((glob) => `    '${glob}',`).join("\n")}
   ],
 
-  secrets: {
+${stateBlock(options)}  secrets: {
     enabled: true,${secretsStore(options)}
   },
 });
@@ -7837,17 +7837,32 @@ function deployBlock(options) {
 `;
 }
 /**
-* Where a deployed stage's secrets live. On AWS that is SSM in the stage's own
-* account, which the deploy job reaches with the role it already assumed; a
-* server target keeps the encrypted local file, the default.
+* Where a deployed stage's deploy state lives: on AWS, the project bucket —
+* one bucket per project and account, created by the first deploy — which
+* the stage's secrets share.
+*/
+function stateBlock(options) {
+	if (options.deployTarget !== "sst" || !options.region) return "";
+	return `  // Deploy state, secrets and backups share one bucket per project and
+  // account, gkm-<project>-<account id>, created by the first deploy:
+  // versioned, encrypted, never public.
+  state: { provider: 's3', region: '${options.region}' },
+
+`;
+}
+/**
+* Where a deployed stage's secrets live. On AWS that is the project bucket,
+* beside the deploy state, in the stage's own account, which the deploy job
+* reaches with the role it already assumed; a server target keeps the
+* encrypted local file, the default.
 */
 function secretsStore(options) {
 	if (options.deployTarget !== "sst" || !options.region) return "";
 	return `
-    // Deployed stages keep their secrets in SSM, in the account each stage
-    // deploys to: \`gkm secrets:set <KEY> '…' --stage <stage>\` writes there.
-    // Past 8 KB a stage needs { provider: 'secrets-manager', region } instead.
-    store: { provider: 'ssm', region: '${options.region}' },`;
+    // Deployed stages keep their secrets in the project bucket, beside the
+    // state, in the account each stage deploys to:
+    // \`gkm secrets:set <KEY> '…' --stage <stage>\` writes there.
+    store: { provider: 's3' },`;
 }
 /**
 * The workspace's constructs, at its root rather than inside an app.
@@ -11597,7 +11612,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-CWq8-s21.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-Cs7kQxD5.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-DPgu-ScS.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -12033,7 +12048,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-CWq8-s21.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-Cs7kQxD5.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12046,7 +12061,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-CWq8-s21.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-Cs7kQxD5.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12059,7 +12074,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-CWq8-s21.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-Cs7kQxD5.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -12159,7 +12174,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-HXzTCy_I.cjs"));
+		const { secretsAddCommand } = await Promise.resolve().then(() => require("./add-SRk65Udu.cjs"));
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12169,7 +12184,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CUyw-8sc.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CtVPHWWq.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12179,7 +12194,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CUyw-8sc.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CtVPHWWq.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12218,7 +12233,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await Promise.resolve().then(() => require("./config.cjs"));
 		const { reconcileMissingSecrets } = await Promise.resolve().then(() => require("./reconcile-CuCQBa5-.cjs"));
-		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-BQlj9Fsg.cjs")).then((n) => n.store_exports);
+		const { secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-Df4BI-T3.cjs")).then((n) => n.store_exports);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12227,7 +12242,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-BQlj9Fsg.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./seeds-Df4BI-T3.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12240,18 +12255,18 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		exitWithError(error);
 	}
 });
-program.command("secrets:migrate").description("Copy a deployed stage's secrets from the configured store to another (file, ssm, secrets-manager)").requiredOption("--stage <stage>", "A deployed stage").requiredOption("--to <provider>", "file, ssm or secrets-manager").option("--region <region>", "The target's AWS region (default: the configured store's)").option("--profile <profile>", "AWS profile for the stage's account").option("--force", "Replace a stage the target already holds").action(async (options) => {
+program.command("secrets:migrate").description("Copy a deployed stage's secrets from the configured store to another (s3, ssm, secrets-manager, file), verify the copy, and print how to delete the source").requiredOption("--stage <stage>", "A deployed stage").requiredOption("--to <provider>", "s3, ssm, secrets-manager or file").option("--region <region>", "The target's AWS region (default: the S3 state's for s3, else the configured store's)").option("--profile <profile>", "AWS profile for the stage's account").option("--force", "Replace different secrets the target already holds").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-CsMrI7Dk.cjs"));
+		const { secretsMigrateCommand } = await Promise.resolve().then(() => require("./migrate-DBGyoBvZ.cjs"));
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--resources-only", "Deployed stage: create its resources — deploy.<kind>.<stage> providers' buckets and keys, and its DNS records — and nothing else (a CI runner, before the server deploys)").option("--skip-resources", "Deployed stage: an earlier --resources-only run created its resources; run no provider and write or check no DNS record").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-1l0L9LCA.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-CRDJWWmZ.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -12273,7 +12288,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-CvGfm4DX.cjs")).then((n) => n.rollback_exports);
+		const { rollbackStage } = await Promise.resolve().then(() => require("./rollback-D7p4wJNO.cjs")).then((n) => n.rollback_exports);
 		const { terminalCredentials } = await Promise.resolve().then(() => require("./terminal-CPHuH4S1.cjs"));
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -12307,7 +12322,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-DC4SIqV1.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-BCdfZ9zO.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12317,7 +12332,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-BpDXFPGg.cjs"));
+		const { stagesCommand } = await Promise.resolve().then(() => require("./stages-DH5z89eT.cjs"));
 		await stagesCommand(options);
 	} catch (error) {
 		exitWithError(error);