@geekmidas/cli 10.0.0-alpha.97 → 10.0.0-alpha.99

package/dist/index.mjs

@@ -5,9 +5,10 @@ import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs"
 import { a as getDokployCredentials, d as removeGoDaddyCredentials, f as storeDokployCredentials, i as getCredentialsPath, l as readCredentials, m as storeHostingerToken, o as getDokployRegistryId, p as storeGoDaddyToken, s as getDokployToken, u as removeDokployCredentials } from "./credentials-B5N5yKk6.mjs";
 import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-qjFapetL.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-Bv4xROeu.mjs";
+import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-D5CpOp1y.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { C as assertDevServicesFlag, Cn as loadEnvFiles, Ct as LOCAL_CA_PATH, En as prepareEntryCredentials, Ft as pgClient, Gn as maskPassword, Jn as withCustomSecret, Jt as imageBuildCredentials, Ln as deployIdentity, Mn as getKeyPath, On as secretsStoreFor, Pn as projectKey, Qt as providerOf, Sn as isPortAvailable, Tn as loadSecretsForApp, Xt as cacheBackendFor, Yn as LOCAL_LOGS_EMAIL, Yt as isImageBuild, Zt as eventsBackendFor, _n as portsOf, at as CronGenerator, bn as createEntryWrapper, ct as constructGlobs, dn as telemetryOf, en as CLUSTER_DATABASE, et as workerUnits, g as describeActor, hn as fakeKey, ht as readLocalCredentials, it as QueueGenerator, jn as FileSecretsStore, jt as quoteIdentifier, kt as postgresDatabaseNames, ln as scopeTelemetryEnv, lt as derivedContainers, mn as describeServices, nt as workerBundleName, ot as FAKE_ENV, p as dnsResources, qn as toEmbeddableSecrets, rn as TELEMETRY_CONTAINER, rt as workerEntryDir, s as dockerCommand, sn as appTelemetry, st as backendsOf$1, tt as WorkerGenerator, un as surfaceClientTraced, ut as reconcileWorkspace, vn as primaryPortKey, wn as loadPortState, wt as forgetState, xn as findAvailablePort, yn as createCredentialsPreload } from "./seeds-BsJRUL1K.mjs";
+import { Bn as withCustomSecret, C as assertDevServicesFlag, Cn as loadEnvFiles, Ct as LOCAL_CA_PATH, En as prepareEntryCredentials, Ft as pgClient, Jt as imageBuildCredentials, Ln as maskPassword, Mn as getKeyPath, On as secretsStoreFor, Pn as projectKey, Qt as providerOf, Sn as isPortAvailable, Tn as loadSecretsForApp, Vn as LOCAL_LOGS_EMAIL, Xt as cacheBackendFor, Yt as isImageBuild, Zt as eventsBackendFor, _n as portsOf, at as CronGenerator, bn as createEntryWrapper, ct as constructGlobs, dn as telemetryOf, en as CLUSTER_DATABASE, et as workerUnits, g as describeActor, hn as fakeKey, ht as readLocalCredentials, it as QueueGenerator, jn as FileSecretsStore, jt as quoteIdentifier, kt as postgresDatabaseNames, ln as scopeTelemetryEnv, lt as derivedContainers, mn as describeServices, nt as workerBundleName, ot as FAKE_ENV, p as dnsResources, rn as TELEMETRY_CONTAINER, rt as workerEntryDir, s as dockerCommand, sn as appTelemetry, st as backendsOf$1, tt as WorkerGenerator, un as surfaceClientTraced, ut as reconcileWorkspace, vn as primaryPortKey, wn as loadPortState, wt as forgetState, xn as findAvailablePort, yn as createCredentialsPreload, zn as toEmbeddableSecrets } from "./seeds-C4bZ8L-T.mjs";
+import { n as deployIdentity } from "./identity-CBXr4wNi.mjs";
 import { c as startTelemetryCode, l as telemetryFor, n as runtimeFor, o as mountRequestSpansCode, r as parseTelemetryFlag, s as routeTelemetry, t as EndpointGenerator, u as writeTelemetryModule } from "./EndpointGenerator-Bor2tZCm.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { s as isCacheBackend, t as SubscriberGenerator } from "./SubscriberGenerator-CyN2VF5X.mjs";
@@ -15,12 +16,11 @@ import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s
 import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-CTaWrA_L.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
 import { t as LocalSandbox } from "./local-BwC2v2Y8.mjs";
-import { S as createStateStore, k as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-DVsvP8s-.mjs";
-import { t as deploy$1 } from "./deploy-LY-20Yeb.mjs";
+import { S as createStateStore, k as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-BIBm9dAb.mjs";
+import { t as deploy$1 } from "./deploy-n_IB8r6H.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BJFvfkaz.mjs";
-import { a as stackOverrideFile, c as dockerCompose, i as ComposePushNeedsBuild, o as edgeDir, r as ComposePinNeedsPull, s as removeEdgeRoutes, t as composeTarget } from "./compose-DgWrNd2k.mjs";
-import { d as parseDigests, h as EDGE_PROJECT, i as composeProject, p as pinnedRef, s as stackDir } from "./stack-BQOyqaVG.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-B_mfgcO8.mjs";
+import { a as stackOverrideFile, c as composeServer, d as parseDigests, f as pinnedRef, g as dockerCompose, h as EDGE_PROJECT, i as ComposePushNeedsBuild, l as dockerHost, m as removeEdgeRoutes, o as composeProject, p as edgeRef, r as ComposePinNeedsPull, s as stackDir, t as composeTarget, u as sshTarget } from "./compose-CLsRcHkA.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-C5mNp91D.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
 import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-naOSJpeJ.mjs";
 import { createRequire } from "node:module";
@@ -50,7 +50,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.97";
+var version = "10.0.0-alpha.99";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -133,7 +133,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-DVsvP8s-.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-BIBm9dAb.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2327,9 +2327,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-BJ8aLOWk.mjs");
+		const { prepareDevDatabases } = await import("./migrate-CZIGT3kB.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-BJ8aLOWk.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-CZIGT3kB.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3382,7 +3382,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await import("./bundler-CBomFsnd.mjs");
+			const { bundleServer } = await import("./bundler-Q6Kp8b0r.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3527,7 +3527,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-CBomFsnd.mjs");
+		const { bundleServer } = await import("./bundler-Q6Kp8b0r.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -3613,7 +3613,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-CBomFsnd.mjs");
+			const { bundleServer } = await import("./bundler-Q6Kp8b0r.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3871,15 +3871,26 @@ async function composeCommand(options, deps = {}) {
 	const { workspace } = await loadWorkspaceConfig(cwd);
 	const { stage } = options;
 	if (options.down) {
+		const local = stage === workspace.stages.local;
+		const server = local ? void 0 : composeServer({
+			stage,
+			local,
+			config: workspace.deploy?.compose?.server,
+			custom: (await (await secretsStoreFor(workspace, stage)).read(stage))?.custom
+		});
 		const override = stackOverrideFile(workspace.root, stage);
+		const dir = join(workspace.root, stackDir(stage));
 		const ref = {
 			project: composeProject(deployIdentity(workspace, stage)),
-			file: join(workspace.root, stackDir(stage), "docker-compose.yml"),
+			file: join(dir, "docker-compose.yml"),
 			...existsSync(override) ? { overrides: [override] } : {},
-			cwd: workspace.root
+			cwd: workspace.root,
+			...server ? { host: dockerHost(server) } : {}
 		};
-		if (await removeEdgeRoutes(edgeDir(deps.env ?? process.env), ref.project)) console.log(`🌐 Removed ${ref.project}'s routes from ${EDGE_PROJECT}.`);
-		await (deps.docker ?? dockerCompose).down(ref);
+		const docker = deps.docker ?? dockerCompose;
+		if (server) console.log(`→ ${sshTarget(server)} (docker over ssh)`);
+		if (server && await removeEdgeRoutes(docker, edgeRef(join(dir, `gkm-edge.yml`), { host: ref.host }), ref.project)) console.log(`🌐 Removed ${ref.project}'s routes from ${EDGE_PROJECT}.`);
+		await docker.down(ref);
 		console.log(`🛑 Stopped ${ref.project}. Its volumes are kept.`);
 		return;
 	}
@@ -3908,8 +3919,6 @@ async function composeCommand(options, deps = {}) {
 		...options.push ? { buildOnly: true } : {},
 		...options.allowDevServices ? { allowDevServices: true } : {},
 		...options.skipDns ? { skipDns: true } : {},
-		...options.resourcesOnly ? { resourcesOnly: true } : {},
-		...options.skipResources ? { skipResources: true } : {},
 		...options.rotateKeys ? { rotateKeys: true } : {},
 		...options.retireOldKeys ? { retireOldKeys: true } : {},
 		logger: {
@@ -5432,25 +5441,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.97",
-	"@geekmidas/auth": "~10.0.0-alpha.97",
-	"@geekmidas/cache": "~10.0.0-alpha.97",
-	"@geekmidas/client": "~10.0.0-alpha.97",
-	"@geekmidas/cloud": "~10.0.0-alpha.97",
-	"@geekmidas/constructs": "~10.0.0-alpha.97",
-	"@geekmidas/db": "~10.0.0-alpha.97",
-	"@geekmidas/emailkit": "~10.0.0-alpha.97",
-	"@geekmidas/envkit": "~10.0.0-alpha.97",
-	"@geekmidas/errors": "~10.0.0-alpha.97",
-	"@geekmidas/events": "~10.0.0-alpha.97",
-	"@geekmidas/logger": "~10.0.0-alpha.97",
-	"@geekmidas/manifest": "~10.0.0-alpha.97",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.97",
-	"@geekmidas/schema": "~10.0.0-alpha.97",
-	"@geekmidas/services": "~10.0.0-alpha.97",
-	"@geekmidas/storage": "~10.0.0-alpha.97",
-	"@geekmidas/telescope": "~10.0.0-alpha.97",
-	"@geekmidas/testkit": "~10.0.0-alpha.97",
+	"@geekmidas/audit": "~10.0.0-alpha.99",
+	"@geekmidas/auth": "~10.0.0-alpha.99",
+	"@geekmidas/cache": "~10.0.0-alpha.99",
+	"@geekmidas/client": "~10.0.0-alpha.99",
+	"@geekmidas/cloud": "~10.0.0-alpha.99",
+	"@geekmidas/constructs": "~10.0.0-alpha.99",
+	"@geekmidas/db": "~10.0.0-alpha.99",
+	"@geekmidas/emailkit": "~10.0.0-alpha.99",
+	"@geekmidas/envkit": "~10.0.0-alpha.99",
+	"@geekmidas/errors": "~10.0.0-alpha.99",
+	"@geekmidas/events": "~10.0.0-alpha.99",
+	"@geekmidas/logger": "~10.0.0-alpha.99",
+	"@geekmidas/manifest": "~10.0.0-alpha.99",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.99",
+	"@geekmidas/schema": "~10.0.0-alpha.99",
+	"@geekmidas/services": "~10.0.0-alpha.99",
+	"@geekmidas/storage": "~10.0.0-alpha.99",
+	"@geekmidas/telescope": "~10.0.0-alpha.99",
+	"@geekmidas/testkit": "~10.0.0-alpha.99",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -5851,7 +5860,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "3e132c8a7cb4e861d459ae32496c1a122d892b14", version = cliVersion()) {
+function stagesActionUses(commit = "c9e539e1dbb06bad206fc9c356648b8927fd6181", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -6103,7 +6112,6 @@ function stagesJob(options) {
       has-build: \${{ steps.stages.outputs.has-build }}
       has-deploy: \${{ steps.stages.outputs.has-deploy }}
       aws-region: \${{ steps.stages.outputs.aws-region }}
-      resources: \${{ steps.stages.outputs.resources }}
     steps:
       - uses: actions/checkout@v4
 
@@ -6121,10 +6129,6 @@ ${pm.setup}
           stage: \${{ inputs.stage }}
 `;
 }
-/** Every step in `steps` run only when `condition` holds. */
-function onlyIf(steps, condition) {
-	return steps.replace(/^ {6}- /gm, `      - if: ${condition}\n        `);
-}
 /**
 * The registry login a compose build pushes with: GitHub's own token on
 * ghcr.io, otherwise a username variable and a password secret.
@@ -6141,19 +6145,17 @@ function registryLogin(registry) {
 }
 /**
 * The compose deploy: images are built and pushed by the runner, where the
-* code is, and pulled by the server, where the stage runs.
+* code is, and run by the stage's server — whose Docker engine the runner
+* drives over SSH.
 *
 * - `build` (on a push): every deployed stage's images, tagged with the
 *   commit, and their digests kept as the artifact `digests-<stage>`.
 * - `deploy`: the commit the event names — a release's tag, a manual run's
-*   `ref` — then that commit's push build, whose digests pin each image. Over
-*   SSH, with a pinned host key, the server checks the commit out and runs
-*   `gkm compose` on exactly those images.
-* - Resources: where the stage has some the deploy creates — a provider's
-*   bucket and key, DNS records through a provider — the runner creates them
-*   first (`gkm deploy --resources-only`) with the stage's role and the DNS
-*   token from its environment, and the server deploys with
-*   `--skip-resources`: neither credential reaches the server.
+*   `ref` — then that commit's push build, whose digests pin each image. One
+*   `gkm compose` on the runner, with the stage's role and DNS token, creates
+*   the stage's resources and DNS records and runs exactly those images on the
+*   server's engine (`DOCKER_HOST=ssh://…`, from `deploy.compose.server`).
+*   The server holds Docker and the deploy user's key, and no credential.
 */
 function composeDeploy(options) {
 	const pm = tooling(options);
@@ -6185,7 +6187,7 @@ ${pm.setup}
 
 ${registryLogin(registry)}
       # A site's public URLs are built into it, so the build reads the stage's
-      # secrets store. With secrets.store on SSM or Secrets Manager the job
+      # secrets store. With secrets.store on S3, SSM or Secrets Manager the job
       # assumes the stage's role (AWS_ROLE_ARN, set by gkm deploy:github);
       # with the default 'file' store there is no role to assume.
       - name: Assume the stage's AWS role
@@ -6229,13 +6231,8 @@ ${registryLogin(registry)}
     permissions:
       contents: read
       actions: read
+      packages: read
       id-token: write
-    env:
-      # Whether the stage has resources the deploy creates — a provider's
-      # bucket and key (deploy.<kind>.<stage>), DNS records through a provider
-      # in dns: the runner creates them with the stage's role and DNS token,
-      # so neither reaches the server, which deploys with --skip-resources.
-      RESOURCES_ON_RUNNER: \${{ contains(fromJSON(needs.stages.outputs.resources || '[]'), matrix.stage) }}
     steps:
       # A release deploys its tag's commit, never its target_commitish — the
       # branch it was drafted against, which has moved on since.
@@ -6258,40 +6255,30 @@ ${registryLogin(registry)}
           REF: \${{ inputs.ref }}
           SHA: \${{ github.sha }}
 
-      # The deploy's resources, here on the runner: each provider's bucket
-      # and key (written into the stage's secrets store), and every public
-      # host's DNS record — a new app's included, one per host, never a
-      # wildcard — written through the provider where it is missing or out of
-      # date and read back from it. The stage's secrets (GKM_SERVER_IPV4
-      # among them) are read with the stage's role; the DNS token is a secret
-      # on this stage's environment. A missing credential fails here, before
-      # anything is deployed.
       - name: Check out the commit
-        if: env.RESOURCES_ON_RUNNER == 'true'
         uses: actions/checkout@v4
         with:
           ref: \${{ steps.commit.outputs.sha }}
 
-${onlyIf(pm.setup, "env.RESOURCES_ON_RUNNER == 'true'")}
+${pm.setup}
       - name: Install
-        if: env.RESOURCES_ON_RUNNER == 'true'
         run: ${pm.install}
 
+      # The server's engine pulls with the login docker sends from here: it
+      # holds none of its own.
+${registryLogin(registry)}
+      # The stage's secrets and deploy state are read and written here, with
+      # the stage's role (AWS_ROLE_ARN, set by gkm deploy:github). With the
+      # default 'file' secrets store there is no role, and no secrets file in
+      # a checkout: set secrets.store in gkm.config.ts to a store on AWS to
+      # deploy from CI.
       - name: Assume the stage's AWS role
-        if: env.RESOURCES_ON_RUNNER == 'true' && needs.stages.outputs.aws-region != ''
+        if: needs.stages.outputs.aws-region != ''
         uses: aws-actions/configure-aws-credentials@v4
         with:
           role-to-assume: \${{ vars.AWS_ROLE_ARN }}
           aws-region: \${{ needs.stages.outputs.aws-region }}
 
-      - name: Create the stage's resources
-        if: env.RESOURCES_ON_RUNNER == 'true'
-        run: ${pm.exec} gkm deploy --stage "$STAGE" --resources-only
-        env:
-          STAGE: \${{ matrix.stage }}
-          GODADDY_API_TOKEN: \${{ secrets.GODADDY_API_TOKEN }}
-          HOSTINGER_API_TOKEN: \${{ secrets.HOSTINGER_API_TOKEN }}
-
       # The push run of this workflow that built the commit for this stage:
       # this run on a push, the newest one with the stage's digests otherwise.
       - name: Find the commit's push build
@@ -6336,48 +6323,42 @@ ${onlyIf(pm.setup, "env.RESOURCES_ON_RUNNER == 'true'")}
           STAGE: \${{ matrix.stage }}
           SHA: \${{ steps.commit.outputs.sha }}
 
-      # Each environment holds DEPLOY_SSH_KEY (secret) and DEPLOY_KNOWN_HOSTS,
-      # DEPLOY_HOST, DEPLOY_USER and DEPLOY_PATH (variables): the server's
-      # host key is pinned, never accepted on first sight. DEPLOY_PATH is a
-      # clone of this repository, with a docker login to ${registry.split("/")[0]}
-      # and the stage's secrets.
-      #
-      # Every value reaches the server as an argument to a quoted heredoc —
-      # nothing is pasted into the script.
-      - name: Deploy on the server
+      # The deploy user's key (DEPLOY_SSH_KEY, a secret) and the server's
+      # pinned host key (DEPLOY_KNOWN_HOSTS, a variable) on each environment:
+      # never accepted on first sight. The server — user and host — is
+      # deploy.compose.server in gkm.config.ts and the stage's GKM_SERVER_IPV4.
+      - name: SSH to the server
         run: |
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
           (umask 077 && printf '%s\\n' "$SSH_KEY" > ~/.ssh/deploy_key)
           printf '%s\\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
-          digests=""
-          if [ -f digests.json ]; then digests=$(base64 -w0 < digests.json); fi
-          ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \\
-            "$DEPLOY_USER@$DEPLOY_HOST" \\
-            "bash -s -- $(printf '%q ' "$STAGE" "$SHA" "$DEPLOY_PATH" "$digests" "$RESOURCES_ON_RUNNER")" <<'REMOTE'
-          set -euo pipefail
-          stage=$1 sha=$2 dir=$3 digests=$4 resources_on_runner=$5
-          cd "$dir"
-          git fetch --quiet origin
-          git checkout --quiet --detach "$sha"
-          ${pm.install}
-          args=(--stage "$stage" --tag "$sha")
-          if [ -n "$digests" ]; then
-            mkdir -p .gkm
-            printf '%s' "$digests" | base64 -d > ".gkm/digests-$stage.json"
-            args+=(--digests-file ".gkm/digests-$stage.json")
-          fi
-          # Created and confirmed from the runner already.
-          if [ "$resources_on_runner" = true ]; then args+=(--skip-resources); fi
-          ${pm.exec} gkm compose "\${args[@]}"
-          REMOTE
+          cat > ~/.ssh/config <<'CONFIG'
+          Host *
+            IdentityFile ~/.ssh/deploy_key
+            IdentitiesOnly yes
+            StrictHostKeyChecking yes
+            ControlMaster auto
+            ControlPath ~/.ssh/cm-%C
+            ControlPersist 5m
+          CONFIG
         env:
           SSH_KEY: \${{ secrets.DEPLOY_SSH_KEY }}
           KNOWN_HOSTS: \${{ vars.DEPLOY_KNOWN_HOSTS }}
-          DEPLOY_HOST: \${{ vars.DEPLOY_HOST }}
-          DEPLOY_USER: \${{ vars.DEPLOY_USER }}
-          DEPLOY_PATH: \${{ vars.DEPLOY_PATH }}
+
+      # Everything, from here: the stage's resources and DNS records, its
+      # databases migrated through an SSH tunnel, and exactly the pushed
+      # images run on the server's Docker. The DNS token is a secret on the
+      # stage's environment, and never leaves the runner.
+      - name: Deploy
+        run: |
+          args=(--stage "$STAGE" --tag "$SHA")
+          if [ -f digests.json ]; then args+=(--digests-file digests.json); fi
+          ${pm.exec} gkm compose "\${args[@]}"
+        env:
           STAGE: \${{ matrix.stage }}
           SHA: \${{ steps.commit.outputs.sha }}
+          GODADDY_API_TOKEN: \${{ secrets.GODADDY_API_TOKEN }}
+          HOSTINGER_API_TOKEN: \${{ secrets.HOSTINGER_API_TOKEN }}
 `;
 }
 /**
@@ -7805,7 +7786,7 @@ ${deployBlock(options)}
 ${workspaceConstructsGlobs(options.routesStructure, dirname(options.apiPath)).map((glob) => `    '${glob}',`).join("\n")}
   ],
 
-  secrets: {
+${stateBlock(options)}  secrets: {
     enabled: true,${secretsStore(options)}
   },
 });
@@ -7816,13 +7797,24 @@ ${workspaceConstructsGlobs(options.routesStructure, dirname(options.apiPath)).ma
 * `gkm build` builds for, and which backends a cache or a broker resolves to.
 */
 function deployBlock(options) {
-	if (options.deployTarget === "compose") return `
-  // \`gkm compose --stage <stage>\` runs a stage as one Docker Compose stack on
-  // the machine it runs on. CI builds every image and pushes it here; the
-  // server pulls exactly those. On ghcr.io the owner is the repository's —
+	if (options.deployTarget === "compose") {
+		const key = (stage) => /^[A-Za-z_$][\w$]*$/.test(stage) ? stage : `'${stage}'`;
+		const servers = options.stages.deployed.map((stage) => `${key(stage)}: { user: 'deploy' }`).join(", ");
+		return `
+  // \`gkm compose --stage <stage>\` runs a stage as one Docker Compose stack:
+  // the local stage on this machine, a deployed stage on its server, whose
+  // Docker it drives over SSH. CI builds every image and pushes it here, and
+  // the server runs exactly those. On ghcr.io the owner is the repository's —
   // the user or organisation whose packages the workflow's token can write.
-  deploy: { default: 'compose', registry: '${options.registry}' },
+  deploy: {
+    default: 'compose',
+    registry: '${options.registry}',
+    // Each deployed stage's server: the SSH user, in its docker group. The
+    // host is the stage's GKM_SERVER_IPV4 secret unless \`host\` is set.
+    compose: { server: { ${servers} } },
+  },
 `;
+	}
 	if (options.deployTarget !== "sst") return "";
 	return `
   // \`gkm deploy\` runs \`sst deploy\` on the manifest \`gkm build\` writes to
@@ -7831,17 +7823,32 @@ function deployBlock(options) {
 `;
 }
 /**
-* Where a deployed stage's secrets live. On AWS that is SSM in the stage's own
-* account, which the deploy job reaches with the role it already assumed; a
-* server target keeps the encrypted local file, the default.
+* Where a deployed stage's deploy state lives: on AWS, the project bucket —
+* one bucket per project and account, created by the first deploy — which
+* the stage's secrets share.
+*/
+function stateBlock(options) {
+	if (options.deployTarget !== "sst" || !options.region) return "";
+	return `  // Deploy state, secrets and backups share one bucket per project and
+  // account, gkm-<project>-<account id>, created by the first deploy:
+  // versioned, encrypted, never public.
+  state: { provider: 's3', region: '${options.region}' },
+
+`;
+}
+/**
+* Where a deployed stage's secrets live. On AWS that is the project bucket,
+* beside the deploy state, in the stage's own account, which the deploy job
+* reaches with the role it already assumed; a server target keeps the
+* encrypted local file, the default.
 */
 function secretsStore(options) {
 	if (options.deployTarget !== "sst" || !options.region) return "";
 	return `
-    // Deployed stages keep their secrets in SSM, in the account each stage
-    // deploys to: \`gkm secrets:set <KEY> '…' --stage <stage>\` writes there.
-    // Past 8 KB a stage needs { provider: 'secrets-manager', region } instead.
-    store: { provider: 'ssm', region: '${options.region}' },`;
+    // Deployed stages keep their secrets in the project bucket, beside the
+    // state, in the account each stage deploys to:
+    // \`gkm secrets:set <KEY> '…' --stage <stage>\` writes there.
+    store: { provider: 's3' },`;
 }
 /**
 * The workspace's constructs, at its root rather than inside an app.
@@ -10824,8 +10831,8 @@ function printNextSteps(projectName, options, pkgManager) {
 	if (options.deployTarget === "compose") {
 		console.log("🚀 Deployment (Docker Compose, on your server):");
 		console.log(`  Images are pushed to ${options.registry}; .github/workflows/deploy.yml builds them`);
-		console.log("  and runs gkm compose on the server over SSH. See the comments in it for the");
-		console.log("  environment variables and secrets each stage needs.");
+		console.log("  and deploys each stage to its server's Docker over SSH (deploy.compose.server");
+		console.log("  in gkm.config.ts). See the comments in it for the secrets each stage needs.");
 		console.log("");
 	}
 	if (options.deployTarget === "sst") {
@@ -11591,7 +11598,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-BJ8aLOWk.mjs");
+	const { migrateAndSeed } = await import("./migrate-CZIGT3kB.mjs");
 	const { discover } = await import("./discover-qjFapetL.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
@@ -12027,7 +12034,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-BJ8aLOWk.mjs");
+		const { migrateCommand } = await import("./migrate-CZIGT3kB.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12040,7 +12047,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-BJ8aLOWk.mjs");
+		const { seedCommand } = await import("./migrate-CZIGT3kB.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -12053,7 +12060,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-BJ8aLOWk.mjs");
+		const { migrationCommand } = await import("./migrate-CZIGT3kB.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -12099,7 +12106,7 @@ program.command("docker").description("Generate Docker deployment files").option
 		exitWithError(error);
 	}
 });
-program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Deployed stage: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--resources-only", "Deployed stage: create its resources — deploy.<kind>.<stage> providers' buckets and keys, and its DNS records — and nothing else (a CI runner, before the server deploys)").option("--skip-resources", "Deployed stage: an earlier --resources-only run created its resources; run no provider and write or check no DNS record").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
+program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").requiredOption("--stage <stage>", "Stage to run — always named, so a stack is never a deployed stage by accident").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--push", "With --build: push every image to deploy.registry and start nothing (for CI)").option("--digests-file <path>", "With --push: write each image as <ref>@sha256:… (JSON). With --tag: run the images at those digests").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").option("--allow-dev-services", "Deployed stage: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Deployed stage: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -12153,7 +12160,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-BA5d4pA0.mjs");
+		const { secretsAddCommand } = await import("./add-DyIEYI97.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12163,7 +12170,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-C0plOf4a.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-C3DcVZQs.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12173,7 +12180,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-C0plOf4a.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-C3DcVZQs.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -12212,7 +12219,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./seeds-BsJRUL1K.mjs").then((n) => n.An);
+		const { secretsStoreFor } = await import("./seeds-C4bZ8L-T.mjs").then((n) => n.An);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -12221,7 +12228,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-BsJRUL1K.mjs").then((n) => n.dt);
+		const { derivedContainers } = await import("./seeds-C4bZ8L-T.mjs").then((n) => n.dt);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -12234,18 +12241,18 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		exitWithError(error);
 	}
 });
-program.command("secrets:migrate").description("Copy a deployed stage's secrets from the configured store to another (file, ssm, secrets-manager)").requiredOption("--stage <stage>", "A deployed stage").requiredOption("--to <provider>", "file, ssm or secrets-manager").option("--region <region>", "The target's AWS region (default: the configured store's)").option("--profile <profile>", "AWS profile for the stage's account").option("--force", "Replace a stage the target already holds").action(async (options) => {
+program.command("secrets:migrate").description("Copy a deployed stage's secrets from the configured store to another (s3, ssm, secrets-manager, file), verify the copy, and print how to delete the source").requiredOption("--stage <stage>", "A deployed stage").requiredOption("--to <provider>", "s3, ssm, secrets-manager or file").option("--region <region>", "The target's AWS region (default: the S3 state's for s3, else the configured store's)").option("--profile <profile>", "AWS profile for the stage's account").option("--force", "Replace different secrets the target already holds").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-C230QeXU.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-DR1x96I4.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
-program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--resources-only", "Deployed stage: create its resources — deploy.<kind>.<stage> providers' buckets and keys, and its DNS records — and nothing else (a CI runner, before the server deploys)").option("--skip-resources", "Deployed stage: an earlier --resources-only run created its resources; run no provider and write or check no DNS record").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
-	const { deployCli } = await import("./cli-D7z1lQtO.mjs");
+program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
+	const { deployCli } = await import("./cli-B9BudUV0.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -12258,8 +12265,6 @@ program.command("deploy").description("Deploy a stage through its target").optio
 		...options.atomic ? { atomic: true } : {},
 		...options.allowDevServices ? { allowDevServices: true } : {},
 		...options.skipDns ? { skipDns: true } : {},
-		...options.resourcesOnly ? { resourcesOnly: true } : {},
-		...options.skipResources ? { skipResources: true } : {},
 		...options.rotateKeys ? { rotateKeys: true } : {},
 		...options.retireOldKeys ? { retireOldKeys: true } : {}
 	});
@@ -12267,7 +12272,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-BsThTeSN.mjs").then((n) => n.a);
+		const { rollbackStage } = await import("./rollback-BkIkE8Qe.mjs").then((n) => n.a);
 		const { terminalCredentials } = await import("./terminal-iNmAXXjs.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -12301,7 +12306,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-zgaBOQvh.mjs");
+		const { deployGithubCommand } = await import("./github-RawRLERq.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -12311,7 +12316,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await import("./stages-DEmn7qI8.mjs");
+		const { stagesCommand } = await import("./stages-CcS9vnNu.mjs");
 		await stagesCommand(options);
 	} catch (error) {
 		exitWithError(error);