@geekmidas/cli 1.5.0 → 1.6.0

package/dist/index.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env -S npx tsx
 import { __require } from "./chunk-Duj1WY3L.mjs";
-import { getAppBuildOrder, getDependencyEnvVars, getDeployTargetError, isDeployTargetSupported } from "./workspace-BW2iU37P.mjs";
-import { getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig } from "./config-DfCJ29PQ.mjs";
+import { getAppBuildOrder, getDependencyEnvVars, getDeployTargetError, isDeployTargetSupported } from "./workspace-9IQIjwkQ.mjs";
+import { getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, parseModuleConfig } from "./config-DxASSNjr.mjs";
 import { getCredentialsPath, getDokployCredentials, getDokployRegistryId, getDokployToken, removeDokployCredentials, storeDokployCredentials, storeDokployRegistryId } from "./credentials-s1kLcIzK.mjs";
-import { ConstructGenerator, EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi-BcSjLfWq.mjs";
+import { ConstructGenerator, EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi-BYlyAbH3.mjs";
 import { getKeyPath, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-DmCbr6DI.mjs";
-import { DokployApi } from "./dokploy-api-z0833e7r.mjs";
+import { DokployApi } from "./dokploy-api-2ldYoN3i.mjs";
 import { encryptSecrets } from "./encryption-BOH5M-f-.mjs";
 import { CachedStateProvider } from "./CachedStateProvider-BDq5WqSy.mjs";
 import { generateReactQueryCommand } from "./openapi-react-query-DaTMSPD5.mjs";
@@ -21,6 +21,7 @@ import { createServer } from "node:net";
 import chokidar from "chokidar";
 import { config } from "dotenv";
 import fg from "fast-glob";
+import { parse as parse$1 } from "yaml";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Function } from "@geekmidas/constructs/functions";
 import { Subscriber } from "@geekmidas/constructs/subscribers";
@@ -32,7 +33,7 @@ import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "1.4.0";
+var version = "1.5.1";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -78,7 +79,9 @@ var repository = {
 };
 var dependencies = {
 	"@apidevtools/swagger-parser": "^10.1.0",
+	"@aws-sdk/client-iam": "~3.971.0",
 	"@aws-sdk/client-route-53": "~3.971.0",
+	"@aws-sdk/client-s3": "~3.971.0",
 	"@aws-sdk/client-ssm": "~3.971.0",
 	"@aws-sdk/credential-providers": "~3.971.0",
 	"@geekmidas/constructs": "workspace:~",
@@ -95,7 +98,8 @@ var dependencies = {
 	"openapi-typescript": "^7.4.2",
 	"pg": "~8.17.1",
 	"prompts": "~2.4.2",
-	"tsx": "~4.20.3"
+	"tsx": "~4.20.3",
+	"yaml": "~2.8.2"
 };
 var devDependencies = {
 	"@geekmidas/testkit": "workspace:*",
@@ -132,7 +136,7 @@ const logger$11 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi: DokployApi$1 } = await import("./dokploy-api-DSJYNx88.mjs");
+	const { DokployApi: DokployApi$1 } = await import("./dokploy-api-C93pveuy.mjs");
 	const api = new DokployApi$1({
 		baseUrl: endpoint,
 		token
@@ -417,7 +421,7 @@ var FunctionGenerator = class extends ConstructGenerator {
 		const importPath = relativePath.replace(/\.ts$/, ".js");
 		const relativeEnvParserPath = relative(dirname(handlerPath), context.envParserPath);
 		const relativeLoggerPath = relative(dirname(handlerPath), context.loggerPath);
-		const content = `import { AWSLambdaFunction } from '@geekmidas/constructs/functions';
+		const content = `import { AWSLambdaFunction } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
 import ${context.envParserImportPattern} from '${relativeEnvParserPath}';
 import ${context.loggerImportPattern} from '${relativeLoggerPath}';
@@ -773,6 +777,152 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
+const PORT_STATE_PATH = ".gkm/ports.json";
+/**
+* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
+* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
+* Fixed port mappings like `'5050:80'` are skipped.
+* @internal Exported for testing
+*/
+function parseComposePortMappings(composePath) {
+	if (!existsSync(composePath)) return [];
+	const content = readFileSync(composePath, "utf-8");
+	const compose = parse$1(content);
+	if (!compose?.services) return [];
+	const results = [];
+	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
+		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
+		if (match?.[1] && match[2] && match[3]) results.push({
+			service: serviceName,
+			envVar: match[1],
+			defaultPort: Number(match[2]),
+			containerPort: Number(match[3])
+		});
+	}
+	return results;
+}
+/**
+* Load saved port state from .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function loadPortState(workspaceRoot) {
+	try {
+		const raw = await readFile(join(workspaceRoot, PORT_STATE_PATH), "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+/**
+* Save port state to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function savePortState(workspaceRoot, ports) {
+	const dir = join(workspaceRoot, ".gkm");
+	await mkdir(dir, { recursive: true });
+	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
+}
+/**
+* Check if a project's own Docker container is running and return its host port.
+* Uses `docker compose port` scoped to the project's compose file.
+* @internal Exported for testing
+*/
+function getContainerHostPort(workspaceRoot, service, containerPort) {
+	try {
+		const result = execSync(`docker compose port ${service} ${containerPort}`, {
+			cwd: workspaceRoot,
+			stdio: "pipe"
+		}).toString().trim();
+		const match = result.match(/:(\d+)$/);
+		return match ? Number(match[1]) : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Resolve host ports for Docker services by parsing docker-compose.yml.
+* Priority: running container → saved state → find available port.
+* Persists resolved ports to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function resolveServicePorts(workspaceRoot) {
+	const composePath = join(workspaceRoot, "docker-compose.yml");
+	const mappings = parseComposePortMappings(composePath);
+	if (mappings.length === 0) return {
+		dockerEnv: {},
+		ports: {},
+		mappings: []
+	};
+	const savedState = await loadPortState(workspaceRoot);
+	const dockerEnv = {};
+	const ports = {};
+	logger$9.log("\n🔌 Resolving service ports...");
+	for (const mapping of mappings) {
+		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
+		if (containerPort !== null) {
+			ports[mapping.envVar] = containerPort;
+			dockerEnv[mapping.envVar] = String(containerPort);
+			logger$9.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
+			continue;
+		}
+		const savedPort = savedState[mapping.envVar];
+		if (savedPort && await isPortAvailable(savedPort)) {
+			ports[mapping.envVar] = savedPort;
+			dockerEnv[mapping.envVar] = String(savedPort);
+			logger$9.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
+			continue;
+		}
+		const resolvedPort = await findAvailablePort(mapping.defaultPort);
+		ports[mapping.envVar] = resolvedPort;
+		dockerEnv[mapping.envVar] = String(resolvedPort);
+		if (resolvedPort !== mapping.defaultPort) logger$9.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
+		else logger$9.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
+	}
+	await savePortState(workspaceRoot, ports);
+	return {
+		dockerEnv,
+		ports,
+		mappings
+	};
+}
+/**
+* Replace a port in a URL string.
+* Handles both `hostname:port` and `localhost:port` patterns.
+* @internal Exported for testing
+*/
+function replacePortInUrl(url, oldPort, newPort) {
+	if (oldPort === newPort) return url;
+	return url.replace(new RegExp(`:${oldPort}(?=/|$)`, "g"), `:${newPort}`);
+}
+/**
+* Rewrite connection URLs and port vars in secrets with resolved ports.
+* Uses the parsed compose mappings to determine which default ports to replace.
+* Pure transform — does not modify secrets on disk.
+* @internal Exported for testing
+*/
+function rewriteUrlsWithPorts(secrets, resolvedPorts) {
+	const { ports, mappings } = resolvedPorts;
+	const result = { ...secrets };
+	const portReplacements = [];
+	for (const mapping of mappings) {
+		const resolved = ports[mapping.envVar];
+		if (resolved !== void 0) portReplacements.push({
+			defaultPort: mapping.defaultPort,
+			resolvedPort: resolved
+		});
+	}
+	for (const [key, value] of Object.entries(result)) {
+		if (!key.endsWith("_PORT")) continue;
+		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
+	}
+	for (const [key, value] of Object.entries(result)) {
+		if (!key.endsWith("_URL") && key !== "DATABASE_URL") continue;
+		let rewritten = value;
+		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
+		result[key] = rewritten;
+	}
+	return result;
+}
 /**
 * Normalize telescope configuration
 * @internal Exported for testing
@@ -1000,8 +1150,11 @@ async function devCommand(options) {
 		rebuildTimeout = setTimeout(async () => {
 			try {
 				logger$9.log("🔄 Rebuilding...");
-				await buildServer(config$1, buildContext, resolved.providers[0], enableOpenApi, appRoot);
-				if (enableOpenApi) await generateOpenApi(config$1, { silent: true });
+				await buildServer(config$1, buildContext, resolved.providers[0], enableOpenApi, appRoot, true);
+				if (enableOpenApi) await generateOpenApi(config$1, {
+					silent: true,
+					bustCache: true
+				});
 				logger$9.log("✅ Rebuild complete, restarting server...");
 				await devServer.restart();
 			} catch (error) {
@@ -1154,7 +1307,7 @@ async function loadSecretsForApp(secretsRoot, appName) {
 * Start docker-compose services for the workspace.
 * @internal Exported for testing
 */
-async function startWorkspaceServices(workspace) {
+async function startWorkspaceServices(workspace, portEnv) {
 	const services = workspace.services;
 	if (!services.db && !services.cache && !services.mail) return;
 	const servicesToStart = [];
@@ -1171,7 +1324,11 @@ async function startWorkspaceServices(workspace) {
 		}
 		execSync(`docker compose up -d ${servicesToStart.join(" ")}`, {
 			cwd: workspace.root,
-			stdio: "inherit"
+			stdio: "inherit",
+			env: {
+				...process.env,
+				...portEnv
+			}
 		});
 		logger$9.log("✅ Services started");
 	} catch (error) {
@@ -1219,8 +1376,9 @@ async function workspaceDevCommand(workspace, options) {
 		const copiedCount = clientResults.filter((r) => r.success).length;
 		if (copiedCount > 0) logger$9.log(`\n📦 Copied ${copiedCount} API client(s)`);
 	}
-	await startWorkspaceServices(workspace);
-	const secretsEnv = await loadDevSecrets(workspace);
+	const resolvedPorts = await resolveServicePorts(workspace.root);
+	await startWorkspaceServices(workspace, resolvedPorts.dockerEnv);
+	const secretsEnv = rewriteUrlsWithPorts(await loadDevSecrets(workspace), resolvedPorts);
 	if (Object.keys(secretsEnv).length > 0) logger$9.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
 	const dependencyEnv = generateAllDependencyEnvVars(workspace);
 	if (Object.keys(dependencyEnv).length > 0) {
@@ -1345,16 +1503,16 @@ async function workspaceDevCommand(workspace, options) {
 		});
 	});
 }
-async function buildServer(config$1, context, provider, enableOpenApi, appRoot = process.cwd()) {
+async function buildServer(config$1, context, provider, enableOpenApi, appRoot = process.cwd(), bustCache = false) {
 	const endpointGenerator = new EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
 	const cronGenerator = new CronGenerator();
 	const subscriberGenerator = new SubscriberGenerator();
 	const [allEndpoints, allFunctions, allCrons, allSubscribers] = await Promise.all([
-		endpointGenerator.load(config$1.routes, appRoot),
-		config$1.functions ? functionGenerator.load(config$1.functions, appRoot) : [],
-		config$1.crons ? cronGenerator.load(config$1.crons, appRoot) : [],
-		config$1.subscribers ? subscriberGenerator.load(config$1.subscribers, appRoot) : []
+		endpointGenerator.load(config$1.routes, appRoot, bustCache),
+		config$1.functions ? functionGenerator.load(config$1.functions, appRoot, bustCache) : [],
+		config$1.crons ? cronGenerator.load(config$1.crons, appRoot, bustCache) : [],
+		config$1.subscribers ? subscriberGenerator.load(config$1.subscribers, appRoot, bustCache) : []
 	]);
 	const outputDir = join(appRoot, ".gkm", provider);
 	await mkdir(outputDir, { recursive: true });
@@ -1443,10 +1601,10 @@ async function prepareEntryCredentials(options) {
 	let secretsRoot = cwd;
 	let appName;
 	try {
-		const appConfig = await loadAppConfig(cwd);
-		workspaceAppPort = appConfig.app.port;
-		secretsRoot = appConfig.workspaceRoot;
-		appName = appConfig.appName;
+		const appInfo = await loadWorkspaceAppInfo(cwd);
+		workspaceAppPort = appInfo.app.port;
+		secretsRoot = appInfo.workspaceRoot;
+		appName = appInfo.appName;
 	} catch (error) {
 		logger$9.log(`⚠️  Could not load workspace config: ${error.message}`);
 		secretsRoot = findSecretsRoot(cwd);
@@ -1744,17 +1902,39 @@ async function execCommand(commandArgs, options = {}) {
 	if (commandArgs.length === 0) throw new Error("No command specified. Usage: gkm exec -- <command>");
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$9.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({ cwd });
+	const { credentials, secretsJsonPath, appName, secretsRoot } = await prepareEntryCredentials({ cwd });
 	if (appName) logger$9.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
 	if (secretCount > 0) logger$9.log(`🔐 Loaded ${secretCount} secret(s)`);
+	const composePath = join(secretsRoot, "docker-compose.yml");
+	const mappings = parseComposePortMappings(composePath);
+	if (mappings.length > 0) {
+		const ports = await loadPortState(secretsRoot);
+		if (Object.keys(ports).length > 0) {
+			const rewritten = rewriteUrlsWithPorts(credentials, {
+				dockerEnv: {},
+				ports,
+				mappings
+			});
+			Object.assign(credentials, rewritten);
+			logger$9.log(`🔌 Applied ${Object.keys(ports).length} port mapping(s)`);
+		}
+	}
+	try {
+		const appInfo = await loadWorkspaceAppInfo(cwd);
+		if (appInfo.appName) {
+			const depEnv = getDependencyEnvVars(appInfo.workspace, appInfo.appName);
+			Object.assign(credentials, depEnv);
+		}
+	} catch {}
 	const preloadDir = join(cwd, ".gkm");
 	await mkdir(preloadDir, { recursive: true });
 	const preloadPath = join(preloadDir, "credentials-preload.ts");
 	await createCredentialsPreload(preloadPath, secretsJsonPath);
-	const [cmd, ...args] = commandArgs;
+	const [cmd, ...rawArgs] = commandArgs;
 	if (!cmd) throw new Error("No command specified");
-	logger$9.log(`🚀 Running: ${commandArgs.join(" ")}`);
+	const args = rawArgs.map((arg) => arg.replace(/\$PORT\b/g, credentials.PORT ?? "3000"));
+	logger$9.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const existingNodeOptions = process.env.NODE_OPTIONS ?? "";
 	const tsxImport = "--import=tsx";
 	const preloadImport = `--import=${preloadPath}`;
@@ -2176,6 +2356,41 @@ function isDnsVerified(state, hostname, serverIp) {
 	const record = state?.dnsVerified?.[hostname];
 	return record?.serverIp === serverIp;
 }
+/**
+* Get the key for a DNS record in state
+*/
+function getDnsRecordKey(name$1, type$1) {
+	return `${name$1}:${type$1}`;
+}
+/**
+* Set a created DNS record in state (mutates state)
+*/
+function setDnsRecord(state, record) {
+	if (!state.dnsRecords) state.dnsRecords = {};
+	const key = getDnsRecordKey(record.name, record.type);
+	state.dnsRecords[key] = {
+		...record,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Get backup state from state
+*/
+function getBackupState(state) {
+	return state?.backups;
+}
+/**
+* Set backup state (mutates state)
+*/
+function setBackupState(state, backupState) {
+	state.backups = backupState;
+}
+/**
+* Set postgres backup ID in state (mutates state)
+*/
+function setPostgresBackupId(state, backupId) {
+	if (state.backups) state.backups.postgresBackupId = backupId;
+}
 
 //#endregion
 //#region src/deploy/dns/DnsProvider.ts
@@ -2183,7 +2398,7 @@ function isDnsVerified(state, hostname, serverIp) {
 * Check if value is a DnsProvider implementation.
 */
 function isDnsProvider(value) {
-	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function";
+	return typeof value === "object" && value !== null && typeof value.name === "string" && typeof value.getRecords === "function" && typeof value.upsertRecords === "function" && typeof value.deleteRecords === "function";
 }
 /**
 * Create a DNS provider based on configuration.
@@ -2199,11 +2414,11 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config$1.provider)) return config$1.provider;
 	const provider = config$1.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-B9N-TKbp.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-402UdK89.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
-		const { Route53Provider } = await import("./Route53Provider-C8mS0zY6.mjs");
+		const { Route53Provider } = await import("./Route53Provider-DbBo7Uz5.mjs");
 		const route53Config = config$1;
 		return new Route53Provider({
 			region: route53Config.region,
@@ -2414,8 +2629,13 @@ async function createDnsRecordsForDomain(records, rootDomain, providerConfig) {
 * Supports both legacy single-domain format and new multi-domain format:
 * - Legacy: { provider: 'hostinger', domain: 'example.com' }
 * - Multi:  { 'example.com': { provider: 'hostinger' }, 'example.dev': { provider: 'route53' } }
+*
+* @param appHostnames - Map of app names to hostnames
+* @param dnsConfig - DNS configuration (legacy or multi-domain)
+* @param dokployEndpoint - Dokploy server endpoint to resolve IP from
+* @param state - Optional state to save created records for later deletion
 */
-async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint) {
+async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 	if (!dnsConfig) return null;
 	const normalizedConfig = normalizeDnsConfig(dnsConfig);
 	logger$6.log("\n🌐 Setting up DNS records...");
@@ -2461,6 +2681,15 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint) {
 			logger$6.log(`   ⚠ ${failed} record(s) failed for ${rootDomain}`);
 			hasFailures = true;
 		}
+		if (state) {
+			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
+				domain: rootDomain,
+				name: record.subdomain,
+				type: record.type,
+				value: record.value,
+				ttl: "ttl" in providerConfig && providerConfig.ttl ? providerConfig.ttl : 300
+			});
+		}
 		printDnsRecordsTable(domainRecords, rootDomain);
 		if (providerConfig.provider === "manual" || failed > 0) printDnsRecordsSimple(domainRecords.filter((r) => !r.created && !r.existed), rootDomain);
 	}
@@ -5008,27 +5237,40 @@ async function initializePostgresUsers(api, postgres, serverHostname, users) {
 		for (const user of users) {
 			const schemaName = user.usePublicSchema ? "public" : user.name;
 			logger$1.log(`   Creating user "${user.name}" with schema "${schemaName}"...`);
-			await client.query(`
-				DO $$ BEGIN
-					IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${user.name}') THEN
-						CREATE USER "${user.name}" WITH PASSWORD '${user.password}';
-					ELSE
-						ALTER USER "${user.name}" WITH PASSWORD '${user.password}';
-					END IF;
-				END $$;
-			`);
-			if (user.usePublicSchema) await client.query(`
+			if (user.usePublicSchema) {
+				await client.query(`
+					DO $$ BEGIN
+						IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${user.name}') THEN
+							CREATE USER "${user.name}" WITH PASSWORD '${user.password}';
+						ELSE
+							ALTER USER "${user.name}" WITH PASSWORD '${user.password}';
+						END IF;
+					END $$;
+				`);
+				await client.query(`
 					GRANT ALL ON SCHEMA public TO "${user.name}";
 					ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO "${user.name}";
 					ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO "${user.name}";
 				`);
-			else await client.query(`
+			} else {
+				await client.query(`
+					DO $$ BEGIN
+						IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${user.name}') THEN
+							CREATE USER "${user.name}" WITH PASSWORD '${user.password}';
+						ELSE
+							ALTER USER "${user.name}" WITH PASSWORD '${user.password}';
+						END IF;
+						-- Set search_path in same transaction to avoid tuple conflict
+						ALTER USER "${user.name}" SET search_path TO "${schemaName}";
+					END $$;
+				`);
+				await client.query(`
 					CREATE SCHEMA IF NOT EXISTS "${schemaName}" AUTHORIZATION "${user.name}";
-					ALTER USER "${user.name}" SET search_path TO "${schemaName}";
 					GRANT USAGE ON SCHEMA "${schemaName}" TO "${user.name}";
 					GRANT ALL ON ALL TABLES IN SCHEMA "${schemaName}" TO "${user.name}";
 					ALTER DEFAULT PRIVILEGES IN SCHEMA "${schemaName}" GRANT ALL ON TABLES TO "${user.name}";
 				`);
+			}
 			logger$1.log(`   ✓ User "${user.name}" configured`);
 		}
 	} finally {
@@ -5534,6 +5776,36 @@ async function workspaceDeployCommand(workspace, options) {
 			await initializePostgresUsers(api, provisionedPostgres, serverHostname, usersToCreate);
 		}
 	}
+	if (workspace.deploy?.backups && provisionedPostgres) {
+		logger$1.log("\n💾 Provisioning backup destination...");
+		const { provisionBackupDestination } = await import("./backup-provisioner-BIArpmTr.mjs");
+		const backupState = await provisionBackupDestination({
+			api,
+			projectId: project.projectId,
+			projectName: workspace.name,
+			stage,
+			config: workspace.deploy.backups,
+			existingState: getBackupState(state),
+			logger: logger$1
+		});
+		setBackupState(state, backupState);
+		if (!backupState.postgresBackupId) {
+			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
+			const backupRetention = workspace.deploy.backups.retention ?? 30;
+			logger$1.log("   Creating postgres backup schedule...");
+			const backup = await api.createPostgresBackup({
+				schedule: backupSchedule,
+				prefix: `${stage}/postgres`,
+				destinationId: backupState.destinationId,
+				database: provisionedPostgres.databaseName,
+				postgresId: provisionedPostgres.postgresId,
+				enabled: true,
+				keepLatestCount: backupRetention
+			});
+			setPostgresBackupId(state, backup.backupId);
+			logger$1.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
+		} else logger$1.log("   ✓ Using existing postgres backup schedule");
+	}
 	const publicUrls = {};
 	const results = [];
 	const dokployConfig = workspace.deploy.dokploy;
@@ -6275,16 +6547,16 @@ const GEEKMIDAS_VERSIONS = {
 	"@geekmidas/cache": "~1.0.0",
 	"@geekmidas/client": "~1.0.0",
 	"@geekmidas/cloud": "~1.0.0",
-	"@geekmidas/constructs": "~1.0.0",
+	"@geekmidas/constructs": "~1.0.5",
 	"@geekmidas/db": "~1.0.0",
 	"@geekmidas/emailkit": "~1.0.0",
-	"@geekmidas/envkit": "~1.0.0",
+	"@geekmidas/envkit": "~1.0.2",
 	"@geekmidas/errors": "~1.0.0",
 	"@geekmidas/events": "~1.0.0",
 	"@geekmidas/logger": "~1.0.0",
 	"@geekmidas/rate-limit": "~1.0.0",
 	"@geekmidas/schema": "~1.0.0",
-	"@geekmidas/services": "~1.0.0",
+	"@geekmidas/services": "~1.0.1",
 	"@geekmidas/storage": "~1.0.0",
 	"@geekmidas/studio": "~1.0.0",
 	"@geekmidas/telescope": "~1.0.0",
@@ -6337,6 +6609,7 @@ function generateAuthAppFiles(options) {
 		extends: "../../tsconfig.json",
 		compilerOptions: {
 			noEmit: true,
+			allowImportingTsExtensions: true,
 			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
@@ -6367,8 +6640,8 @@ export const logger = createLogger();
 	const authTs = `import { betterAuth } from 'better-auth';
 import { magicLink } from 'better-auth/plugins';
 import pg from 'pg';
-import { envParser } from './config/env.js';
-import { logger } from './config/logger.js';
+import { envParser } from './config/env.ts';
+import { logger } from './config/logger.ts';
 
 // Parse auth-specific config (no defaults - values from secrets)
 const authConfig = envParser
@@ -6411,9 +6684,9 @@ export type Auth = typeof auth;
 	const indexTs = `import { Hono } from 'hono';
 import { cors } from 'hono/cors';
 import { serve } from '@hono/node-server';
-import { auth } from './auth.js';
-import { envParser } from './config/env.js';
-import { logger } from './config/logger.js';
+import { auth } from './auth.ts';
+import { envParser } from './config/env.ts';
+import { logger } from './config/logger.ts';
 
 // Parse server config (no defaults - values from secrets)
 const serverConfig = envParser
@@ -6499,6 +6772,20 @@ dist/
 //#endregion
 //#region src/init/generators/config.ts
 /**
+* Vitest config content with globalSetup for database-enabled apps
+*/
+const vitestConfigContent = `import { defineConfig } from 'vitest/config';
+import tsconfigPaths from 'vite-tsconfig-paths';
+
+export default defineConfig({
+  plugins: [tsconfigPaths()],
+  test: {
+    environment: 'node',
+    globalSetup: './test/globalSetup.ts',
+  },
+});
+`;
+/**
 * Generate configuration files (gkm.config.ts, tsconfig.json, biome.json, turbo.json)
 */
 function generateConfigFiles(options, template) {
@@ -6550,6 +6837,7 @@ export default defineConfig({
 		extends: "../../tsconfig.json",
 		compilerOptions: {
 			noEmit: true,
+			allowImportingTsExtensions: true,
 			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
@@ -6569,21 +6857,26 @@ export default defineConfig({
 			skipLibCheck: true,
 			forceConsistentCasingInFileNames: true,
 			resolveJsonModule: true,
-			declaration: true,
-			declarationMap: true,
-			outDir: "./dist",
-			rootDir: "./src"
+			noEmit: true,
+			allowImportingTsExtensions: true
 		},
 		include: ["src/**/*.ts"],
 		exclude: ["node_modules", "dist"]
 	};
-	if (options.monorepo) return [{
-		path: "gkm.config.ts",
-		content: gkmConfig
-	}, {
-		path: "tsconfig.json",
-		content: `${JSON.stringify(tsConfig, null, 2)}\n`
-	}];
+	if (options.monorepo) {
+		const files$1 = [{
+			path: "gkm.config.ts",
+			content: gkmConfig
+		}, {
+			path: "tsconfig.json",
+			content: `${JSON.stringify(tsConfig, null, 2)}\n`
+		}];
+		if (options.database) files$1.push({
+			path: "vitest.config.ts",
+			content: vitestConfigContent
+		});
+		return files$1;
+	}
 	const biomeConfig = {
 		$schema: "https://biomejs.dev/schemas/2.3.0/schema.json",
 		vcs: {
@@ -6649,7 +6942,7 @@ export default defineConfig({
 			fmt: { outputs: [] }
 		}
 	};
-	return [
+	const files = [
 		{
 			path: "gkm.config.ts",
 			content: gkmConfig
@@ -6667,12 +6960,18 @@ export default defineConfig({
 			content: `${JSON.stringify(turboConfig, null, 2)}\n`
 		}
 	];
+	if (options.database) files.push({
+		path: "vitest.config.ts",
+		content: vitestConfigContent
+	});
+	return files;
 }
 function generateSingleAppConfigFiles(options, _template, _helpers) {
 	const tsConfig = {
 		extends: "../../tsconfig.json",
 		compilerOptions: {
 			noEmit: true,
+			allowImportingTsExtensions: true,
 			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
@@ -6682,10 +6981,15 @@ function generateSingleAppConfigFiles(options, _template, _helpers) {
 		include: ["src/**/*.ts"],
 		exclude: ["node_modules", "dist"]
 	};
-	return [{
+	const files = [{
 		path: "tsconfig.json",
 		content: `${JSON.stringify(tsConfig, null, 2)}\n`
 	}];
+	if (options.database) files.push({
+		path: "vitest.config.ts",
+		content: vitestConfigContent
+	});
+	return files;
 }
 
 //#endregion
@@ -6716,7 +7020,7 @@ function generateDockerFiles(options, template, dbApps) {
       POSTGRES_PASSWORD: postgres
       POSTGRES_DB: ${options.name.replace(/-/g, "_")}_dev
     ports:
-      - '5432:5432'
+      - '\${POSTGRES_HOST_PORT:-5432}:5432'
     volumes:
       - postgres_data:/var/lib/postgresql/data${initVolume}
     healthcheck:
@@ -6742,7 +7046,7 @@ function generateDockerFiles(options, template, dbApps) {
     container_name: ${options.name}-redis
     restart: unless-stopped
     ports:
-      - '6379:6379'
+      - '\${REDIS_HOST_PORT:-6379}:6379'
     volumes:
       - redis_data:/data
     healthcheck:
@@ -6756,7 +7060,7 @@ function generateDockerFiles(options, template, dbApps) {
     container_name: ${options.name}-serverless-redis
     restart: unless-stopped
     ports:
-      - '8079:80'
+      - '\${SRH_HOST_PORT:-8079}:80'
     environment:
       SRH_MODE: env
       SRH_TOKEN: local_dev_token
@@ -6771,7 +7075,7 @@ function generateDockerFiles(options, template, dbApps) {
     container_name: ${options.name}-redis
     restart: unless-stopped
     ports:
-      - '6379:6379'
+      - '\${REDIS_HOST_PORT:-6379}:6379'
     volumes:
       - redis_data:/data
     healthcheck:
@@ -6787,8 +7091,8 @@ function generateDockerFiles(options, template, dbApps) {
     container_name: ${options.name}-rabbitmq
     restart: unless-stopped
     ports:
-      - '5672:5672'
-      - '15672:15672'
+      - '\${RABBITMQ_HOST_PORT:-5672}:5672'
+      - '\${RABBITMQ_MGMT_HOST_PORT:-15672}:15672'
     environment:
       RABBITMQ_DEFAULT_USER: guest
       RABBITMQ_DEFAULT_PASS: guest
@@ -6806,8 +7110,8 @@ function generateDockerFiles(options, template, dbApps) {
     container_name: ${options.name}-mailpit
     restart: unless-stopped
     ports:
-      - '1025:1025'
-      - '8025:8025'
+      - '\${MAILPIT_SMTP_HOST_PORT:-1025}:1025'
+      - '\${MAILPIT_UI_HOST_PORT:-8025}:8025'
     environment:
       MP_SMTP_AUTH_ACCEPT_ANY: 1
       MP_SMTP_AUTH_ALLOW_INSECURE: 1`);
@@ -6961,10 +7265,8 @@ function generateModelsPackage(options) {
 	const tsConfig = {
 		extends: "../../tsconfig.json",
 		compilerOptions: {
-			declaration: true,
-			declarationMap: true,
-			outDir: "./dist",
-			rootDir: "./src"
+			noEmit: true,
+			allowImportingTsExtensions: true
 		},
 		include: ["src/**/*.ts"],
 		exclude: ["node_modules", "dist"]
@@ -7010,7 +7312,7 @@ export type Timestamps = z.infer<typeof TimestampsSchema>;
 export type Pagination = z.infer<typeof PaginationSchema>;
 `;
 	const userTs = `import { z } from 'zod';
-import { IdSchema, TimestampsSchema } from './common.js';
+import { IdSchema, TimestampsSchema } from './common.ts';
 
 // ============================================
 // User Schemas
@@ -7501,7 +7803,7 @@ export const config = envParser
 			{
 				path: getRoutePath("health.ts"),
 				content: monorepo ? `import { z } from 'zod';
-import { publicRouter } from '~/router';
+import { publicRouter } from '~/router.ts';
 
 export const healthEndpoint = publicRouter
   .get('/health')
@@ -7644,8 +7946,8 @@ export const authService = {
 				path: "src/router.ts",
 				content: `import { e } from '@geekmidas/constructs/endpoints';
 import { UnauthorizedError } from '@geekmidas/errors';
-import { authService, type Session } from './services/auth.js';
-import { logger } from './config/logger.js';
+import { authService, type Session } from './services/auth.ts';
+import { logger } from './config/logger.ts';
 
 // Public router - no auth required
 export const publicRouter = e.logger(logger);
@@ -7669,7 +7971,7 @@ export const sessionRouter = r.session<Session>(async ({ services, header }) =>
 			files.push({
 				path: getRoutePath("profile.ts"),
 				content: `import { z } from 'zod';
-import { sessionRouter } from '~/router';
+import { sessionRouter } from '~/router.ts';
 
 export const profileEndpoint = sessionRouter
   .get('/profile')
@@ -7738,8 +8040,8 @@ export const telescope = new Telescope({
 			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
 import { Kysely, PostgresDialect } from 'kysely';
 import pg from 'pg';
-import type { Database } from '../services/database.js';
-import { envParser } from './env.js';
+import type { Database } from '~/services/database.ts';
+import { envParser } from '~/config/env.ts';
 
 // Parse database config for Studio
 const studioConfig = envParser
@@ -7912,8 +8214,8 @@ export const telescope = new Telescope({
 			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
 import { Kysely, PostgresDialect } from 'kysely';
 import pg from 'pg';
-import type { Database } from '../services/database.js';
-import { envParser } from './env.js';
+import type { Database } from '~/services/database.ts';
+import { envParser } from '~/config/env.ts';
 
 // Parse database config for Studio
 const studioConfig = envParser
@@ -8169,7 +8471,7 @@ export type AppEvents =
 				path: "src/events/publisher.ts",
 				content: `import type { Service, ServiceRegisterOptions } from '@geekmidas/services';
 import { Publisher, type EventPublisher } from '@geekmidas/events';
-import type { AppEvents } from './types.js';
+import type { AppEvents } from './types.ts';
 
 export const eventsPublisherService = {
   serviceName: 'events' as const,
@@ -8196,7 +8498,7 @@ export const eventsPublisherService = {
 			{
 				path: "src/subscribers/user-events.ts",
 				content: `import { s } from '@geekmidas/constructs/subscribers';
-import { eventsPublisherService } from '../events/publisher.js';
+import { eventsPublisherService } from '~/events/publisher.ts';
 
 export const userEventsSubscriber = s
   .publisher(eventsPublisherService)
@@ -8398,6 +8700,9 @@ function generatePackageJson(options, template) {
 		dependencies$1.kysely = "~0.28.2";
 		dependencies$1.pg = "~8.16.0";
 		devDependencies$1["@types/pg"] = "~8.15.0";
+		devDependencies$1["@geekmidas/testkit"] = GEEKMIDAS_VERSIONS["@geekmidas/testkit"];
+		devDependencies$1["@faker-js/faker"] = "~9.8.0";
+		devDependencies$1["vite-tsconfig-paths"] = "~5.1.0";
 	}
 	if (monorepo) {
 		delete devDependencies$1["@biomejs/biome"];
@@ -8444,6 +8749,118 @@ function generateSourceFiles(options, template) {
 	return template.files(options);
 }
 
+//#endregion
+//#region src/init/generators/test.ts
+/**
+* Generate test infrastructure files when database is enabled.
+* Includes transaction-isolated test config, global setup with migrations,
+* factory system with builders/seeds, and an example spec.
+*/
+function generateTestFiles(options, _template) {
+	if (!options.database) return [];
+	return [
+		{
+			path: "test/config.ts",
+			content: `import { it as itVitest } from 'vitest';
+import { Kysely, PostgresDialect } from 'kysely';
+import pg from 'pg';
+import { wrapVitestKyselyTransaction } from '@geekmidas/testkit/kysely';
+import type { Database } from '~/services/database.ts';
+
+const connection = new Kysely<Database>({
+  dialect: new PostgresDialect({
+    pool: new pg.Pool({ connectionString: process.env.DATABASE_URL }),
+  }),
+});
+
+export const it = wrapVitestKyselyTransaction<Database>(itVitest, {
+  connection,
+});
+`
+		},
+		{
+			path: "test/globalSetup.ts",
+			content: `import { Kysely, PostgresDialect } from 'kysely';
+import pg from 'pg';
+import { PostgresKyselyMigrator } from '@geekmidas/testkit/kysely';
+import type { Database } from '~/services/database.ts';
+
+export async function setup() {
+  const testUrl = process.env.DATABASE_URL;
+  if (!testUrl) throw new Error('DATABASE_URL is required for tests');
+
+  // Run migrations on the test database
+  // (gkm test already rewrites DATABASE_URL to point to the _test database)
+  const db = new Kysely<Database>({
+    dialect: new PostgresDialect({
+      pool: new pg.Pool({ connectionString: testUrl }),
+    }),
+  });
+
+  const migrator = new PostgresKyselyMigrator({
+    db,
+    migrationsPath: './src/migrations',
+  });
+
+  await migrator.migrateToLatest();
+  await db.destroy();
+}
+`
+		},
+		{
+			path: "test/factory/index.ts",
+			content: `import type { Kysely } from 'kysely';
+import { KyselyFactory } from '@geekmidas/testkit/kysely';
+import type { Database } from '~/services/database.ts';
+import { usersBuilder } from './users.ts';
+
+const builders = { users: usersBuilder };
+const seeds = {};
+
+export function createFactory(db: Kysely<Database>) {
+  return new KyselyFactory<Database, typeof builders, typeof seeds>(
+    builders,
+    seeds,
+    db,
+  );
+}
+
+export type Factory = ReturnType<typeof createFactory>;
+`
+		},
+		{
+			path: "test/factory/users.ts",
+			content: `import { KyselyFactory } from '@geekmidas/testkit/kysely';
+import type { Database } from '~/services/database.ts';
+
+export const usersBuilder = KyselyFactory.createBuilder<Database, 'users'>(
+  'users',
+  ({ faker }) => ({
+    id: faker.string.uuid(),
+    name: faker.person.fullName(),
+    email: faker.internet.email(),
+    created_at: new Date(),
+  }),
+);
+`
+		},
+		{
+			path: "test/example.spec.ts",
+			content: `import { describe, expect } from 'vitest';
+import { it } from './config.ts';
+
+describe('example', () => {
+  it('should have a working test setup', async ({ db }) => {
+    // db is a transaction-wrapped Kysely instance
+    // All changes are automatically rolled back after the test
+    expect(db).toBeDefined();
+  });
+});
+`
+		}
+	];
+}
+
 //#endregion
 //#region src/init/generators/ui.ts
 /**
@@ -8513,6 +8930,7 @@ function generateUiPackageFiles(options) {
 				"DOM.Iterable"
 			],
 			noEmit: true,
+			allowImportingTsExtensions: true,
 			baseUrl: ".",
 			paths: { "~/*": ["./src/*"] }
 		},
@@ -9686,8 +10104,8 @@ export const Alert: Story = {
   ),
 };
 `;
-	const componentsUiIndex = `export { Button, type ButtonProps, buttonVariants } from './button';
-export { Input } from './input';
+	const componentsUiIndex = `export { Button, type ButtonProps, buttonVariants } from './button.tsx';
+export { Input } from './input.tsx';
 export {
   Card,
   CardHeader,
@@ -9695,17 +10113,17 @@ export {
   CardTitle,
   CardDescription,
   CardContent,
-} from './card';
-export { Label } from './label';
-export { Badge, type BadgeProps, badgeVariants } from './badge';
-export { Separator } from './separator';
-export { Tabs, TabsList, TabsTrigger, TabsContent } from './tabs';
+} from './card.tsx';
+export { Label } from './label.tsx';
+export { Badge, type BadgeProps, badgeVariants } from './badge.tsx';
+export { Separator } from './separator.tsx';
+export { Tabs, TabsList, TabsTrigger, TabsContent } from './tabs.tsx';
 export {
   Tooltip,
   TooltipTrigger,
   TooltipContent,
   TooltipProvider,
-} from './tooltip';
+} from './tooltip.tsx';
 export {
   Dialog,
   DialogPortal,
@@ -9717,20 +10135,20 @@ export {
   DialogFooter,
   DialogTitle,
   DialogDescription,
-} from './dialog';
+} from './dialog.tsx';
 `;
 	const buttonIndexTsx = buttonTsx;
 	const inputIndexTsx = inputTsx;
 	const cardIndexTsx = cardTsx;
-	const componentsIndex = `export * from './ui';
+	const componentsIndex = `export * from './ui/index.ts';
 `;
 	const indexTs = `// @${options.name}/ui - Shared UI component library
 
 // shadcn/ui components
-export * from './components';
+export * from './components/index.ts';
 
 // Utilities
-export { cn } from './lib/utils';
+export { cn } from './lib/utils.ts';
 `;
 	const gitignore = `node_modules/
 dist/
@@ -9873,7 +10291,7 @@ function generateWebAppFiles(options) {
 		private: true,
 		type: "module",
 		scripts: {
-			dev: "gkm exec -- next dev --turbopack",
+			dev: "gkm exec -- next dev --turbopack -p $PORT",
 			build: "gkm exec -- next build",
 			start: "next start",
 			typecheck: "tsc --noEmit"
@@ -9928,6 +10346,7 @@ export default nextConfig;
 			skipLibCheck: true,
 			strict: true,
 			noEmit: true,
+			allowImportingTsExtensions: true,
 			esModuleInterop: true,
 			module: "ESNext",
 			moduleResolution: "bundler",
@@ -10009,7 +10428,7 @@ export const serverConfig = envParser
 `;
 	const authClientTs = `import { createAuthClient } from 'better-auth/react';
 import { magicLinkClient } from 'better-auth/client/plugins';
-import { clientConfig } from '~/config/client';
+import { clientConfig } from '~/config/client.ts';
 
 export const authClient = createAuthClient({
   baseURL: clientConfig.authUrl,
@@ -10021,7 +10440,7 @@ export const { signIn, signUp, signOut, useSession, magicLink } = authClient;
 	const providersTsx = `'use client';
 
 import { QueryClientProvider } from '@tanstack/react-query';
-import { getQueryClient } from '~/lib/query-client';
+import { getQueryClient } from '~/lib/query-client.ts';
 
 export function Providers({ children }: { children: React.ReactNode }) {
   const queryClient = getQueryClient();
@@ -10031,9 +10450,9 @@ export function Providers({ children }: { children: React.ReactNode }) {
   );
 }
 `;
-	const apiIndexTs = `import { createApi } from './openapi';
-import { getQueryClient } from '~/lib/query-client';
-import { clientConfig } from '~/config/client';
+	const apiIndexTs = `import { createApi } from './api.ts';
+import { getQueryClient } from '~/lib/query-client.ts';
+import { clientConfig } from '~/config/client.ts';
 
 export const api = createApi({
   baseURL: clientConfig.apiUrl,
@@ -10043,7 +10462,7 @@ export const api = createApi({
 	const globalsCss = `@import '${uiPackage}/styles';
 `;
 	const layoutTsx = `import type { Metadata } from 'next';
-import { Providers } from './providers';
+import { Providers } from './providers.tsx';
 import './globals.css';
 
 export const metadata: Metadata = {
@@ -10065,7 +10484,7 @@ export default function RootLayout({
   );
 }
 `;
-	const pageTsx = `import { api } from '~/api';
+	const pageTsx = `import { api } from '~/api/index.ts';
 import { Button, Card, CardContent, CardDescription, CardHeader, CardTitle } from '${uiPackage}/components';
 
 export default async function Home() {
@@ -10408,6 +10827,7 @@ async function initCommand(projectName, options = {}) {
 		...generateConfigFiles(templateOptions, baseTemplate),
 		...generateEnvFiles(templateOptions, baseTemplate),
 		...generateSourceFiles(templateOptions, baseTemplate),
+		...generateTestFiles(templateOptions, baseTemplate),
 		...isMonorepo$1 ? [] : generateDockerFiles(templateOptions, baseTemplate, dbApps)
 	] : [];
 	const dockerFiles = isMonorepo$1 && baseTemplate ? generateDockerFiles(templateOptions, baseTemplate, dbApps) : [];
@@ -10751,23 +11171,61 @@ function maskUrl(url) {
 //#endregion
 //#region src/test/index.ts
 /**
-* Run tests with secrets loaded from the specified stage.
-* Secrets are decrypted and injected into the environment.
+* Run tests with secrets, dependency URLs, and .env files loaded.
+* Environment variables are sniffed to inject only what the app needs.
 */
 async function testCommand(options = {}) {
 	const stage = options.stage ?? "development";
-	console.log(`\n🧪 Running tests with ${stage} secrets...\n`);
-	let envVars = {};
+	const cwd = process.cwd();
+	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
+	const defaultEnv = loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	let secretsEnv = {};
 	try {
 		const secrets = await readStageSecrets(stage);
 		if (secrets) {
-			envVars = toEmbeddableSecrets(secrets);
-			console.log(`  Loaded ${Object.keys(envVars).length} secrets from ${stage}\n`);
-		} else console.log(`  No secrets found for ${stage}, running without secrets\n`);
+			secretsEnv = toEmbeddableSecrets(secrets);
+			console.log(`  🔐 Loaded ${Object.keys(secretsEnv).length} secrets from ${stage}`);
+		} else console.log(`  No secrets found for ${stage}`);
 	} catch (error) {
-		if (error instanceof Error && error.message.includes("key not found")) console.log(`  Decryption key not found for ${stage}, running without secrets\n`);
+		if (error instanceof Error && error.message.includes("key not found")) console.log(`  Decryption key not found for ${stage}`);
 		else throw error;
 	}
+	const composePath = join(cwd, "docker-compose.yml");
+	const mappings = parseComposePortMappings(composePath);
+	if (mappings.length > 0) {
+		const ports = await loadPortState(cwd);
+		if (Object.keys(ports).length > 0) {
+			secretsEnv = rewriteUrlsWithPorts(secretsEnv, {
+				dockerEnv: {},
+				ports,
+				mappings
+			});
+			console.log(`  🔌 Applied ${Object.keys(ports).length} port mapping(s)`);
+		}
+	}
+	secretsEnv = rewriteDatabaseUrlForTests(secretsEnv);
+	await ensureTestDatabase(secretsEnv);
+	let dependencyEnv = {};
+	try {
+		const appInfo = await loadWorkspaceAppInfo(cwd);
+		dependencyEnv = getDependencyEnvVars(appInfo.workspace, appInfo.appName);
+		if (Object.keys(dependencyEnv).length > 0) console.log(`  🔗 Loaded ${Object.keys(dependencyEnv).length} dependency URL(s)`);
+		const sniffed = await sniffAppEnvironment(appInfo.app, appInfo.appName, appInfo.workspaceRoot, { logWarnings: false });
+		if (sniffed.requiredEnvVars.length > 0) {
+			const needed = new Set(sniffed.requiredEnvVars);
+			const allEnv = {
+				...secretsEnv,
+				...dependencyEnv
+			};
+			const filteredEnv = {};
+			for (const [key, value] of Object.entries(allEnv)) if (needed.has(key)) filteredEnv[key] = value;
+			secretsEnv = {};
+			dependencyEnv = filteredEnv;
+			console.log(`  🔍 Sniffed ${sniffed.requiredEnvVars.length} required env var(s)`);
+		}
+	} catch {}
+	console.log("");
 	const args = [];
 	if (options.run) args.push("run");
 	else if (options.watch) args.push("--watch");
@@ -10775,11 +11233,12 @@ async function testCommand(options = {}) {
 	if (options.ui) args.push("--ui");
 	if (options.pattern) args.push(options.pattern);
 	const vitestProcess = spawn("npx", ["vitest", ...args], {
-		cwd: process.cwd(),
+		cwd,
 		stdio: "inherit",
 		env: {
 			...process.env,
-			...envVars,
+			...secretsEnv,
+			...dependencyEnv,
 			NODE_ENV: "test"
 		}
 	});
@@ -10793,6 +11252,57 @@ async function testCommand(options = {}) {
 		});
 	});
 }
+const TEST_DB_SUFFIX = "_test";
+/**
+* Rewrite DATABASE_URL to point to a separate test database.
+* Appends `_test` to the database name (e.g., `app` -> `app_test`).
+* @internal Exported for testing
+*/
+function rewriteDatabaseUrlForTests(env) {
+	const result = { ...env };
+	for (const key of Object.keys(result)) {
+		if (!key.includes("DATABASE_URL")) continue;
+		const value = result[key];
+		try {
+			const url = new URL(value);
+			const dbName = url.pathname.slice(1);
+			if (dbName && !dbName.endsWith(TEST_DB_SUFFIX)) {
+				url.pathname = `/${dbName}${TEST_DB_SUFFIX}`;
+				result[key] = url.toString();
+				console.log(`  🧪 ${key}: using test database "${dbName}${TEST_DB_SUFFIX}"`);
+			}
+		} catch {}
+	}
+	return result;
+}
+/**
+* Ensure the test database exists by connecting to the default database
+* and running CREATE DATABASE IF NOT EXISTS.
+* @internal Exported for testing
+*/
+async function ensureTestDatabase(env) {
+	const databaseUrl = env.DATABASE_URL;
+	if (!databaseUrl) return;
+	try {
+		const url = new URL(databaseUrl);
+		const testDbName = url.pathname.slice(1);
+		if (!testDbName) return;
+		url.pathname = "/postgres";
+		const { default: pg } = await import("pg");
+		const client = new pg.Client({ connectionString: url.toString() });
+		await client.connect();
+		try {
+			await client.query(`CREATE DATABASE "${testDbName}"`);
+			console.log(`  📦 Created test database "${testDbName}"`);
+		} catch (err) {
+			if (err.code !== "42P04") throw err;
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		console.log(`  ⚠️  Could not ensure test database: ${err.message}`);
+	}
+}
 
 //#endregion
 //#region src/index.ts