@geekmidas/cli 1.10.41 → 1.12.0

package/dist/setup-WZ-xqAQO.cjs

@@ -0,0 +1,849 @@
+const require_chunk = require('./chunk-CUT6urMc.cjs');
+const require_workspace = require('./workspace-CQTT7HJQ.cjs');
+const require_config = require('./config-DujV8DbR.cjs');
+const require_fullstack_secrets = require('./fullstack-secrets-BYzi6Hwl.cjs');
+const require_storage = require('./storage-B1wvztiJ.cjs');
+const require_sync = require('./sync-o_CtEbvR.cjs');
+const node_fs = require_chunk.__toESM(require("node:fs"));
+const node_path = require_chunk.__toESM(require("node:path"));
+const node_fs_promises = require_chunk.__toESM(require("node:fs/promises"));
+const node_child_process = require_chunk.__toESM(require("node:child_process"));
+const node_net = require_chunk.__toESM(require("node:net"));
+const dotenv = require_chunk.__toESM(require("dotenv"));
+const yaml = require_chunk.__toESM(require("yaml"));
+const prompts = require_chunk.__toESM(require("prompts"));
+
+//#region src/credentials/index.ts
+const logger$1 = console;
+/**
+* Load environment files
+* @internal Exported for testing
+*/
+function loadEnvFiles(envConfig, cwd = process.cwd()) {
+	const loaded = [];
+	const missing = [];
+	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
+	for (const envFile of envFiles) {
+		const envPath = (0, node_path.resolve)(cwd, envFile);
+		if ((0, node_fs.existsSync)(envPath)) {
+			(0, dotenv.config)({
+				path: envPath,
+				override: true,
+				quiet: true
+			});
+			loaded.push(envFile);
+		} else if (envConfig) missing.push(envFile);
+	}
+	return {
+		loaded,
+		missing
+	};
+}
+/**
+* Check if a port is available
+* @internal Exported for testing
+*/
+async function isPortAvailable(port) {
+	return new Promise((resolve$1) => {
+		const server = (0, node_net.createServer)();
+		server.once("error", (err) => {
+			if (err.code === "EADDRINUSE") resolve$1(false);
+			else resolve$1(false);
+		});
+		server.once("listening", () => {
+			server.close();
+			resolve$1(true);
+		});
+		server.listen(port);
+	});
+}
+/**
+* Find an available port starting from the preferred port
+* @internal Exported for testing
+*/
+async function findAvailablePort(preferredPort, maxAttempts = 10) {
+	for (let i = 0; i < maxAttempts; i++) {
+		const port = preferredPort + i;
+		if (await isPortAvailable(port)) return port;
+		logger$1.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+	}
+	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
+}
+const PORT_STATE_PATH = ".gkm/ports.json";
+/**
+* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
+* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
+* Fixed port mappings like `'5050:80'` are skipped.
+* @internal Exported for testing
+*/
+function parseComposePortMappings(composePath) {
+	if (!(0, node_fs.existsSync)(composePath)) return [];
+	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
+	const compose = (0, yaml.parse)(content);
+	if (!compose?.services) return [];
+	const results = [];
+	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
+		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
+		if (match?.[1] && match[2] && match[3]) results.push({
+			service: serviceName,
+			envVar: match[1],
+			defaultPort: Number(match[2]),
+			containerPort: Number(match[3])
+		});
+	}
+	return results;
+}
+/**
+* Load saved port state from .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function loadPortState(workspaceRoot) {
+	try {
+		const raw = await (0, node_fs_promises.readFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+/**
+* Save port state to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function savePortState(workspaceRoot, ports) {
+	const dir = (0, node_path.join)(workspaceRoot, ".gkm");
+	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
+}
+/**
+* Check if a project's own Docker container is running and return its host port.
+* Uses `docker compose port` scoped to the project's compose file.
+* @internal Exported for testing
+*/
+function getContainerHostPort(workspaceRoot, service, containerPort) {
+	try {
+		const result = (0, node_child_process.execSync)(`docker compose port ${service} ${containerPort}`, {
+			cwd: workspaceRoot,
+			stdio: "pipe"
+		}).toString().trim();
+		const match = result.match(/:(\d+)$/);
+		return match ? Number(match[1]) : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Resolve host ports for Docker services by parsing docker-compose.yml.
+* Priority: running container → saved state → find available port.
+* Persists resolved ports to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function resolveServicePorts(workspaceRoot) {
+	const composePath = (0, node_path.join)(workspaceRoot, "docker-compose.yml");
+	const mappings = parseComposePortMappings(composePath);
+	if (mappings.length === 0) return {
+		dockerEnv: {},
+		ports: {},
+		mappings: []
+	};
+	const savedState = await loadPortState(workspaceRoot);
+	const dockerEnv = {};
+	const ports = {};
+	const assignedPorts = /* @__PURE__ */ new Set();
+	logger$1.log("\n🔌 Resolving service ports...");
+	for (const mapping of mappings) {
+		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
+		if (containerPort !== null) {
+			ports[mapping.envVar] = containerPort;
+			dockerEnv[mapping.envVar] = String(containerPort);
+			assignedPorts.add(containerPort);
+			logger$1.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
+			continue;
+		}
+		const savedPort = savedState[mapping.envVar];
+		if (savedPort && !assignedPorts.has(savedPort) && await isPortAvailable(savedPort)) {
+			ports[mapping.envVar] = savedPort;
+			dockerEnv[mapping.envVar] = String(savedPort);
+			assignedPorts.add(savedPort);
+			logger$1.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
+			continue;
+		}
+		let resolvedPort = await findAvailablePort(mapping.defaultPort);
+		while (assignedPorts.has(resolvedPort)) resolvedPort = await findAvailablePort(resolvedPort + 1);
+		ports[mapping.envVar] = resolvedPort;
+		dockerEnv[mapping.envVar] = String(resolvedPort);
+		assignedPorts.add(resolvedPort);
+		if (resolvedPort !== mapping.defaultPort) logger$1.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
+		else logger$1.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
+	}
+	await savePortState(workspaceRoot, ports);
+	return {
+		dockerEnv,
+		ports,
+		mappings
+	};
+}
+/**
+* Replace a port in a URL string.
+* Handles both `hostname:port` and `localhost:port` patterns.
+* @internal Exported for testing
+*/
+function replacePortInUrl(url, oldPort, newPort) {
+	if (oldPort === newPort) return url;
+	let result = url.replace(new RegExp(`:${oldPort}(?=[/?#]|$)`, "g"), `:${newPort}`);
+	result = result.replace(new RegExp(`%3A${oldPort}(?=[%/?#&]|$)`, "gi"), `%3A${newPort}`);
+	return result;
+}
+/**
+* Rewrite connection URLs and port vars in secrets with resolved ports.
+* Uses the parsed compose mappings to determine which default ports to replace.
+* Pure transform — does not modify secrets on disk.
+* @internal Exported for testing
+*/
+function rewriteUrlsWithPorts(secrets, resolvedPorts) {
+	const { ports, mappings } = resolvedPorts;
+	const result = { ...secrets };
+	const portReplacements = [];
+	const serviceNames = /* @__PURE__ */ new Set();
+	for (const mapping of mappings) {
+		serviceNames.add(mapping.service);
+		const resolved = ports[mapping.envVar];
+		if (resolved !== void 0) portReplacements.push({
+			defaultPort: mapping.defaultPort,
+			resolvedPort: resolved
+		});
+	}
+	for (const [key, value] of Object.entries(result)) {
+		if (!key.endsWith("_HOST")) continue;
+		if (serviceNames.has(value)) result[key] = "localhost";
+	}
+	for (const [key, value] of Object.entries(result)) {
+		if (!key.endsWith("_PORT")) continue;
+		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
+	}
+	for (const [key, value] of Object.entries(result)) {
+		if (!key.endsWith("_URL") && !key.endsWith("_ENDPOINT") && !key.endsWith("_CONNECTION_STRING") && key !== "DATABASE_URL") continue;
+		let rewritten = value;
+		for (const name of serviceNames) rewritten = rewritten.replace(new RegExp(`@${name}:`, "g"), "@localhost:");
+		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
+		result[key] = rewritten;
+	}
+	return result;
+}
+/**
+* Build the environment variables to pass to `docker compose up`.
+* Merges process.env, secrets, and port mappings so that Docker Compose
+* can interpolate variables like ${POSTGRES_USER} correctly.
+* @internal Exported for testing
+*/
+function buildDockerComposeEnv(secretsEnv, portEnv) {
+	return {
+		...process.env,
+		...secretsEnv,
+		...portEnv
+	};
+}
+/**
+* Parse all service names from a docker-compose.yml file.
+* @internal Exported for testing
+*/
+function parseComposeServiceNames(composePath) {
+	if (!(0, node_fs.existsSync)(composePath)) return [];
+	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
+	const compose = (0, yaml.parse)(content);
+	return Object.keys(compose?.services ?? {});
+}
+/**
+* Start docker-compose services for a single-app project (no workspace config).
+* Starts all services defined in docker-compose.yml.
+*/
+async function startComposeServices(cwd, portEnv, secretsEnv) {
+	const composeFile = (0, node_path.join)(cwd, "docker-compose.yml");
+	if (!(0, node_fs.existsSync)(composeFile)) return;
+	const servicesToStart = parseComposeServiceNames(composeFile);
+	if (servicesToStart.length === 0) return;
+	logger$1.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
+	try {
+		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
+			cwd,
+			stdio: "inherit",
+			env: buildDockerComposeEnv(secretsEnv, portEnv)
+		});
+		logger$1.log("✅ Services started");
+	} catch (error) {
+		logger$1.error("❌ Failed to start services:", error.message);
+		throw error;
+	}
+}
+/**
+* Start docker-compose services for a workspace.
+* Discovers all services from docker-compose.yml and starts everything
+* except app services (which are managed by turbo).
+* @internal Exported for testing
+*/
+async function startWorkspaceServices(workspace, portEnv, secretsEnv) {
+	const composeFile = (0, node_path.join)(workspace.root, "docker-compose.yml");
+	if (!(0, node_fs.existsSync)(composeFile)) return;
+	const allServices = parseComposeServiceNames(composeFile);
+	const appNames = new Set(Object.keys(workspace.apps));
+	const servicesToStart = allServices.filter((name) => !appNames.has(name));
+	if (servicesToStart.length === 0) return;
+	logger$1.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
+	try {
+		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
+			cwd: workspace.root,
+			stdio: "inherit",
+			env: buildDockerComposeEnv(secretsEnv, portEnv)
+		});
+		logger$1.log("✅ Services started");
+	} catch (error) {
+		logger$1.error("❌ Failed to start services:", error.message);
+		throw error;
+	}
+}
+/**
+* Load and flatten secrets for an app from encrypted storage.
+* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
+* @internal Exported for testing
+*/
+async function loadSecretsForApp(secretsRoot, appName, stages = ["dev", "development"]) {
+	let secrets = {};
+	for (const stage of stages) if (require_storage.secretsExist(stage, secretsRoot)) {
+		const stageSecrets = await require_storage.readStageSecrets(stage, secretsRoot);
+		if (stageSecrets) {
+			logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
+			secrets = require_storage.toEmbeddableSecrets(stageSecrets);
+			break;
+		}
+	}
+	if (Object.keys(secrets).length === 0) return {};
+	if (!appName) return secrets;
+	const prefix = appName.toUpperCase();
+	const mapped = { ...secrets };
+	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
+	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
+	return mapped;
+}
+/**
+* Walk up the directory tree to find the root containing .gkm/secrets/.
+* @internal Exported for testing
+*/
+function findSecretsRoot(startDir) {
+	let dir = startDir;
+	while (dir !== "/") {
+		if ((0, node_fs.existsSync)((0, node_path.join)(dir, ".gkm", "secrets"))) return dir;
+		const parent = (0, node_path.dirname)(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return startDir;
+}
+/**
+* Generate the credentials injection code snippet.
+* This is the common logic used by both entry wrapper and exec preload.
+* @internal
+*/
+function generateCredentialsInjection(secretsJsonPath) {
+	return `import { existsSync, readFileSync } from 'node:fs';
+
+// Inject dev secrets via globalThis and process.env
+// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
+// Object.assign on the Credentials export only mutates one module copy.
+const secretsPath = '${secretsJsonPath}';
+if (existsSync(secretsPath)) {
+  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+  globalThis.__gkm_credentials__ = secrets;
+  Object.assign(process.env, secrets);
+}
+`;
+}
+/**
+* Create a preload script that injects secrets into Credentials.
+* Used by `gkm exec` to inject secrets before running any command.
+* @internal Exported for testing
+*/
+async function createCredentialsPreload(preloadPath, secretsJsonPath) {
+	const content = `/**
+ * Credentials preload generated by 'gkm exec'
+ * This file is loaded via NODE_OPTIONS="--import <path>"
+ */
+${generateCredentialsInjection(secretsJsonPath)}`;
+	await (0, node_fs_promises.writeFile)(preloadPath, content);
+}
+/**
+* Create a wrapper script that injects secrets before importing the entry file.
+* @internal Exported for testing
+*/
+async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
+	const credentialsInjection = secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
+` : "";
+	const content = `#!/usr/bin/env node
+/**
+ * Entry wrapper generated by 'gkm dev --entry'
+ */
+${credentialsInjection}// Import and run the user's entry file (dynamic import ensures secrets load first)
+await import('${entryPath}');
+`;
+	await (0, node_fs_promises.writeFile)(wrapperPath, content);
+}
+/**
+* Prepare credentials for dev/exec/test modes.
+* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
+* injects PORT, dependency URLs, and writes credentials JSON.
+*
+* @param options.resolveDockerPorts - How to resolve Docker ports:
+*   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.
+*   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.
+* @param options.stages - Secret stages to try, in order. Default: ['dev', 'development'].
+* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
+* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
+* @internal Exported for testing
+*/
+async function prepareEntryCredentials(options) {
+	const cwd = options.cwd ?? process.cwd();
+	const portMode = options.resolveDockerPorts ?? "full";
+	let workspaceAppPort;
+	let secretsRoot = cwd;
+	let appName;
+	let appInfo;
+	try {
+		appInfo = await require_config.loadWorkspaceAppInfo(cwd);
+		workspaceAppPort = appInfo.app.port;
+		secretsRoot = appInfo.workspaceRoot;
+		appName = appInfo.appName;
+	} catch {
+		secretsRoot = findSecretsRoot(cwd);
+		appName = require_config.getAppNameFromCwd(cwd) ?? void 0;
+	}
+	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
+	const credentials = await loadSecretsForApp(secretsRoot, appName, options.stages);
+	credentials.PORT = String(resolvedPort);
+	const composePath = (0, node_path.join)(secretsRoot, "docker-compose.yml");
+	const mappings = parseComposePortMappings(composePath);
+	if (mappings.length > 0) {
+		let resolvedPorts;
+		if (portMode === "full") resolvedPorts = await resolveServicePorts(secretsRoot);
+		else {
+			const savedPorts = await loadPortState(secretsRoot);
+			const ports = {};
+			for (const mapping of mappings) {
+				const containerPort = getContainerHostPort(secretsRoot, mapping.service, mapping.containerPort);
+				if (containerPort !== null) ports[mapping.envVar] = containerPort;
+				else {
+					const saved = savedPorts[mapping.envVar];
+					if (saved !== void 0) ports[mapping.envVar] = saved;
+				}
+			}
+			resolvedPorts = {
+				dockerEnv: {},
+				ports,
+				mappings
+			};
+		}
+		if (options.startDocker) if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
+		else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
+		if (Object.keys(resolvedPorts.ports).length > 0) {
+			const rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);
+			Object.assign(credentials, rewritten);
+			logger$1.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
+		}
+	}
+	if (appInfo?.appName) {
+		const depEnv = require_workspace.getDependencyEnvVars(appInfo.workspace, appInfo.appName);
+		Object.assign(credentials, depEnv);
+	}
+	if (!credentials.EVENT_PUBLISHER_CONNECTION_STRING && !credentials.EVENT_SUBSCRIBER_CONNECTION_STRING && credentials.PGBOSS_DB_USER) {
+		const pgbossUrl = require_fullstack_secrets.generatePgBossUrl({
+			username: credentials.PGBOSS_DB_USER,
+			password: credentials.PGBOSS_DB_PASSWORD ?? "",
+			host: credentials.POSTGRES_HOST ?? "localhost",
+			port: Number(credentials.POSTGRES_PORT ?? "5432"),
+			database: credentials.POSTGRES_DB ?? "app"
+		});
+		credentials.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
+		credentials.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
+	}
+	const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
+	await (0, node_fs_promises.mkdir)(secretsDir, { recursive: true });
+	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
+	const secretsJsonPath = (0, node_path.join)(secretsDir, secretsFileName);
+	await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(credentials, null, 2));
+	return {
+		credentials,
+		resolvedPort,
+		secretsJsonPath,
+		appName,
+		secretsRoot,
+		appInfo
+	};
+}
+
+//#endregion
+//#region src/setup/index.ts
+const logger = console;
+/**
+* Setup development environment.
+*
+* Orchestrates:
+* 1. Load workspace config
+* 2. Resolve secrets (local → SSM → generate fresh)
+* 3. Write docker/.env from secrets
+* 4. Start Docker services
+*/
+async function setupCommand(options = {}) {
+	const stage = options.stage ?? "development";
+	logger.log("\n🔧 Setting up development environment...\n");
+	let loadedConfig;
+	try {
+		loadedConfig = await require_config.loadWorkspaceConfig();
+	} catch {
+		logger.error("❌ No gkm.config.ts found. Run this command from a workspace root.");
+		process.exit(1);
+	}
+	const { workspace } = loadedConfig;
+	const isMultiApp = Object.keys(workspace.apps).length > 1;
+	logger.log(`📦 Workspace: ${workspace.name}`);
+	logger.log(`📱 Apps: ${Object.keys(workspace.apps).join(", ")}`);
+	logger.log(`🔑 Stage: ${stage}\n`);
+	const secrets = await resolveSecrets(stage, workspace, options);
+	if (!secrets) {
+		logger.error("❌ Failed to resolve secrets. Exiting.");
+		process.exit(1);
+	}
+	if (isMultiApp && workspace.services.db) {
+		await require_fullstack_secrets.writeDockerEnvFromSecrets(secrets, workspace.root);
+		logger.log("📄 Generated docker/.env with database passwords");
+	}
+	if (!options.skipDocker) {
+		const composeFile = (0, node_path.join)(workspace.root, "docker-compose.yml");
+		if ((0, node_fs.existsSync)(composeFile)) {
+			logger.log("");
+			const resolvedPorts = await resolveServicePorts(workspace.root);
+			await startWorkspaceServices(workspace, resolvedPorts.dockerEnv);
+		} else logger.log("⚠️  No docker-compose.yml found. Skipping Docker services.");
+	}
+	printSummary(workspace, stage);
+}
+/**
+* Resolve secrets with priority:
+* 1. Local secrets exist → use them (preserves manual additions)
+* 2. SSM configured and has secrets → pull and use
+* 3. Neither → generate fresh secrets
+*
+* --force skips checks 1 and 2 and always regenerates.
+*/
+async function resolveSecrets(stage, workspace, options) {
+	if (options.force) {
+		logger.log("🔐 Generating fresh secrets (--force)...");
+		return generateFreshSecrets(stage, workspace, options);
+	}
+	if (require_storage.secretsExist(stage, workspace.root)) {
+		logger.log("🔐 Using existing local secrets");
+		const secrets = await require_storage.readStageSecrets(stage, workspace.root);
+		if (secrets) {
+			const reconciled = reconcileSecrets(secrets, workspace);
+			if (reconciled) await require_storage.writeStageSecrets(reconciled, workspace.root);
+			return reconciled ?? secrets;
+		}
+	}
+	if (require_sync.isSSMConfigured(workspace)) {
+		logger.log("☁️  Checking for remote secrets in SSM...");
+		try {
+			const remoteSecrets = await require_sync.pullSecrets(stage, workspace);
+			if (remoteSecrets) {
+				logger.log("✅ Pulled secrets from SSM");
+				await require_storage.writeStageSecrets(remoteSecrets, workspace.root);
+				return remoteSecrets;
+			}
+			logger.log("   No remote secrets found");
+		} catch (error) {
+			logger.warn(`⚠️  Failed to pull from SSM: ${error.message}`);
+		}
+	}
+	logger.log("🔐 Generating fresh development secrets...");
+	return generateFreshSecrets(stage, workspace, options);
+}
+/**
+* Reconcile existing secrets with expected workspace-derived keys.
+* Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.
+* Returns the updated secrets if changes were made, or null if no changes needed.
+* @internal Exported for testing
+*/
+function reconcileSecrets(secrets, workspace) {
+	let changed = false;
+	let result = { ...secrets };
+	const serviceMap = [
+		{
+			key: "db",
+			name: "postgres"
+		},
+		{
+			key: "cache",
+			name: "redis"
+		},
+		{
+			key: "storage",
+			name: "minio"
+		},
+		{
+			key: "mail",
+			name: "mailpit"
+		}
+	];
+	for (const { key, name } of serviceMap) if (workspace.services[key] && !result.services[name]) {
+		const creds = require_fullstack_secrets.generateServiceCredentials(name);
+		if (name === "minio") {
+			creds.bucket = workspace.name;
+			creds.username = workspace.name;
+		}
+		result = {
+			...result,
+			services: {
+				...result.services,
+				[name]: creds
+			}
+		};
+		result.urls = require_fullstack_secrets.generateConnectionUrls(result.services, result.eventsBackend);
+		logger.log(`   🔄 Adding missing service credentials: ${name}`);
+		changed = true;
+	}
+	if (result.services.postgres && !result.services.pgboss) {
+		result = {
+			...result,
+			services: {
+				...result.services,
+				pgboss: {
+					host: result.services.postgres.host,
+					port: result.services.postgres.port,
+					username: "pgboss",
+					password: require_fullstack_secrets.generateSecurePassword(),
+					database: result.services.postgres.database ?? "app"
+				}
+			}
+		};
+		result.urls = require_fullstack_secrets.generateConnectionUrls(result.services, result.eventsBackend);
+		logger.log("   🔄 Adding missing service credentials: pgboss");
+		changed = true;
+	}
+	const eventsBackend = workspace.services.events;
+	if (eventsBackend && result.eventsBackend !== eventsBackend) {
+		result.eventsBackend = eventsBackend;
+		if (eventsBackend === "sns" && !result.services.localstack) {
+			result = {
+				...result,
+				services: {
+					...result.services,
+					localstack: require_fullstack_secrets.generateLocalStackCredentials()
+				}
+			};
+			logger.log("   🔄 Adding missing service credentials: localstack");
+			changed = true;
+		}
+		if (eventsBackend === "rabbitmq" && !result.services.rabbitmq) {
+			result = {
+				...result,
+				services: {
+					...result.services,
+					rabbitmq: require_fullstack_secrets.generateServiceCredentials("rabbitmq")
+				}
+			};
+			logger.log("   🔄 Adding missing service credentials: rabbitmq");
+			changed = true;
+		}
+		result.urls = require_fullstack_secrets.generateConnectionUrls(result.services, eventsBackend);
+		changed = true;
+	}
+	const isMultiApp = Object.keys(workspace.apps).length > 1;
+	if (isMultiApp) {
+		const expected = require_fullstack_secrets.generateFullstackCustomSecrets(workspace);
+		const missing = {};
+		for (const [key, value] of Object.entries(expected)) if (!(key in result.custom)) missing[key] = value;
+		if (Object.keys(missing).length > 0) {
+			logger.log(`   🔄 Adding missing secrets: ${Object.keys(missing).join(", ")}`);
+			result = {
+				...result,
+				custom: {
+					...result.custom,
+					...missing
+				}
+			};
+			changed = true;
+		}
+	}
+	if (!changed) return null;
+	return {
+		...result,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Build a fresh StageSecrets object for a workspace: service credentials,
+* connection URLs, and custom secrets. Pure — does not write to disk or touch
+* SSM. Service passwords are freshly randomized, so the result must be the same
+* one used to start the matching Docker containers.
+* @internal Exported for reuse by `gkm test` auto-setup.
+*/
+function createFreshWorkspaceSecrets(stage, workspace) {
+	const serviceNames = [];
+	if (workspace.services.db) serviceNames.push("postgres");
+	if (workspace.services.cache) serviceNames.push("redis");
+	if (workspace.services.storage) serviceNames.push("minio");
+	if (workspace.services.mail) serviceNames.push("mailpit");
+	if (workspace.services.events === "sns") serviceNames.push("localstack");
+	if (workspace.services.events === "rabbitmq") serviceNames.push("rabbitmq");
+	const secrets = require_fullstack_secrets.createStageSecrets(stage, serviceNames, {
+		projectName: workspace.name,
+		eventsBackend: workspace.services.events
+	});
+	const isMultiApp = Object.keys(workspace.apps).length > 1;
+	if (isMultiApp) secrets.custom = require_fullstack_secrets.generateFullstackCustomSecrets(workspace);
+	else secrets.custom = {
+		NODE_ENV: "development",
+		PORT: "3000",
+		LOG_LEVEL: "debug",
+		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
+	};
+	return secrets;
+}
+/**
+* Ensure a usable secret set exists for a stage, generating a fresh one from the
+* workspace config when none is present. No-op if secrets already exist.
+*
+* Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a
+* committed secrets file or a shared encryption key — the stage is regenerated
+* from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.
+*
+* @returns true if fresh secrets were generated, false if existing ones were kept
+*/
+async function ensureStageSecrets(stage, cwd = process.cwd()) {
+	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
+	if (require_storage.secretsExist(stage, workspace.root)) return false;
+	const secrets = createFreshWorkspaceSecrets(stage, workspace);
+	await require_storage.writeStageSecrets(secrets, workspace.root);
+	return true;
+}
+/**
+* Generate fresh secrets for the workspace.
+*/
+async function generateFreshSecrets(stage, workspace, options) {
+	const secrets = createFreshWorkspaceSecrets(stage, workspace);
+	await require_storage.writeStageSecrets(secrets, workspace.root);
+	logger.log(`   Secrets written to .gkm/secrets/${stage}.json`);
+	if (require_sync.isSSMConfigured(workspace) && !options.yes) {
+		const { shouldPush } = await (0, prompts.default)({
+			type: "confirm",
+			name: "shouldPush",
+			message: "Push secrets to SSM for team sharing?",
+			initial: true
+		});
+		if (shouldPush) try {
+			await require_sync.pushSecrets(stage, workspace);
+			logger.log("☁️  Secrets pushed to SSM");
+		} catch (error) {
+			logger.warn(`⚠️  Failed to push to SSM: ${error.message}`);
+		}
+	}
+	return secrets;
+}
+/**
+* Print setup summary with next steps.
+*/
+function printSummary(workspace, stage) {
+	logger.log(`\n${"─".repeat(50)}`);
+	logger.log("\n✅ Development environment ready!\n");
+	logger.log("📋 Apps:");
+	for (const [name, app] of Object.entries(workspace.apps)) {
+		const icon = app.type === "web" ? "🌐" : app.type === "mobile" ? "📱" : "🔧";
+		logger.log(`   ${icon} ${name} → http://localhost:${app.port}`);
+	}
+	logger.log("\n🚀 Next steps:");
+	logger.log("   gkm dev                    # Start all apps");
+	logger.log(`   gkm secrets:show --stage ${stage}  # View secrets`);
+	logger.log("");
+}
+
+//#endregion
+Object.defineProperty(exports, 'createCredentialsPreload', {
+  enumerable: true,
+  get: function () {
+    return createCredentialsPreload;
+  }
+});
+Object.defineProperty(exports, 'createEntryWrapper', {
+  enumerable: true,
+  get: function () {
+    return createEntryWrapper;
+  }
+});
+Object.defineProperty(exports, 'createFreshWorkspaceSecrets', {
+  enumerable: true,
+  get: function () {
+    return createFreshWorkspaceSecrets;
+  }
+});
+Object.defineProperty(exports, 'ensureStageSecrets', {
+  enumerable: true,
+  get: function () {
+    return ensureStageSecrets;
+  }
+});
+Object.defineProperty(exports, 'findAvailablePort', {
+  enumerable: true,
+  get: function () {
+    return findAvailablePort;
+  }
+});
+Object.defineProperty(exports, 'isPortAvailable', {
+  enumerable: true,
+  get: function () {
+    return isPortAvailable;
+  }
+});
+Object.defineProperty(exports, 'loadEnvFiles', {
+  enumerable: true,
+  get: function () {
+    return loadEnvFiles;
+  }
+});
+Object.defineProperty(exports, 'loadSecretsForApp', {
+  enumerable: true,
+  get: function () {
+    return loadSecretsForApp;
+  }
+});
+Object.defineProperty(exports, 'prepareEntryCredentials', {
+  enumerable: true,
+  get: function () {
+    return prepareEntryCredentials;
+  }
+});
+Object.defineProperty(exports, 'reconcileSecrets', {
+  enumerable: true,
+  get: function () {
+    return reconcileSecrets;
+  }
+});
+Object.defineProperty(exports, 'resolveServicePorts', {
+  enumerable: true,
+  get: function () {
+    return resolveServicePorts;
+  }
+});
+Object.defineProperty(exports, 'rewriteUrlsWithPorts', {
+  enumerable: true,
+  get: function () {
+    return rewriteUrlsWithPorts;
+  }
+});
+Object.defineProperty(exports, 'setupCommand', {
+  enumerable: true,
+  get: function () {
+    return setupCommand;
+  }
+});
+Object.defineProperty(exports, 'startWorkspaceServices', {
+  enumerable: true,
+  get: function () {
+    return startWorkspaceServices;
+  }
+});
+//# sourceMappingURL=setup-WZ-xqAQO.cjs.map