@geekmidas/cli 1.5.1 → 1.6.0

package/dist/index.cjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env -S npx tsx
 const require_chunk = require('./chunk-CUT6urMc.cjs');
-const require_workspace = require('./workspace-DIMnYaYt.cjs');
-const require_config = require('./config-BYn5yUt5.cjs');
+const require_workspace = require('./workspace-D2ocAlpl.cjs');
+const require_config = require('./config-6JHOwLCx.cjs');
 const require_credentials = require('./credentials-C8DWtnMY.cjs');
-const require_openapi = require('./openapi-CqblwJZ4.cjs');
+const require_openapi = require('./openapi-CnvwSRDU.cjs');
 const require_storage = require('./storage-CoCNe0Pt.cjs');
 const require_dokploy_api = require('./dokploy-api-DLgvEQlr.cjs');
 const require_encryption = require('./encryption-BE0UOb8j.cjs');
@@ -20,6 +20,7 @@ const node_net = require_chunk.__toESM(require("node:net"));
 const chokidar = require_chunk.__toESM(require("chokidar"));
 const dotenv = require_chunk.__toESM(require("dotenv"));
 const fast_glob = require_chunk.__toESM(require("fast-glob"));
+const yaml = require_chunk.__toESM(require("yaml"));
 const __geekmidas_constructs_crons = require_chunk.__toESM(require("@geekmidas/constructs/crons"));
 const __geekmidas_constructs_functions = require_chunk.__toESM(require("@geekmidas/constructs/functions"));
 const __geekmidas_constructs_subscribers = require_chunk.__toESM(require("@geekmidas/constructs/subscribers"));
@@ -32,7 +33,7 @@ const prompts = require_chunk.__toESM(require("prompts"));
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "1.5.0";
+var version = "1.5.1";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -97,7 +98,8 @@ var dependencies = {
 	"openapi-typescript": "^7.4.2",
 	"pg": "~8.17.1",
 	"prompts": "~2.4.2",
-	"tsx": "~4.20.3"
+	"tsx": "~4.20.3",
+	"yaml": "~2.8.2"
 };
 var devDependencies = {
 	"@geekmidas/testkit": "workspace:*",
@@ -775,6 +777,152 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
+const PORT_STATE_PATH = ".gkm/ports.json";
+/**
+* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
+* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
+* Fixed port mappings like `'5050:80'` are skipped.
+* @internal Exported for testing
+*/
+function parseComposePortMappings(composePath) {
+	if (!(0, node_fs.existsSync)(composePath)) return [];
+	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
+	const compose = (0, yaml.parse)(content);
+	if (!compose?.services) return [];
+	const results = [];
+	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
+		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
+		if (match?.[1] && match[2] && match[3]) results.push({
+			service: serviceName,
+			envVar: match[1],
+			defaultPort: Number(match[2]),
+			containerPort: Number(match[3])
+		});
+	}
+	return results;
+}
+/**
+* Load saved port state from .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function loadPortState(workspaceRoot) {
+	try {
+		const raw = await (0, node_fs_promises.readFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+/**
+* Save port state to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function savePortState(workspaceRoot, ports) {
+	const dir = (0, node_path.join)(workspaceRoot, ".gkm");
+	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
+}
+/**
+* Check if a project's own Docker container is running and return its host port.
+* Uses `docker compose port` scoped to the project's compose file.
+* @internal Exported for testing
+*/
+function getContainerHostPort(workspaceRoot, service, containerPort) {
+	try {
+		const result = (0, node_child_process.execSync)(`docker compose port ${service} ${containerPort}`, {
+			cwd: workspaceRoot,
+			stdio: "pipe"
+		}).toString().trim();
+		const match = result.match(/:(\d+)$/);
+		return match ? Number(match[1]) : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Resolve host ports for Docker services by parsing docker-compose.yml.
+* Priority: running container → saved state → find available port.
+* Persists resolved ports to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function resolveServicePorts(workspaceRoot) {
+	const composePath = (0, node_path.join)(workspaceRoot, "docker-compose.yml");
+	const mappings = parseComposePortMappings(composePath);
+	if (mappings.length === 0) return {
+		dockerEnv: {},
+		ports: {},
+		mappings: []
+	};
+	const savedState = await loadPortState(workspaceRoot);
+	const dockerEnv = {};
+	const ports = {};
+	logger$9.log("\n🔌 Resolving service ports...");
+	for (const mapping of mappings) {
+		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
+		if (containerPort !== null) {
+			ports[mapping.envVar] = containerPort;
+			dockerEnv[mapping.envVar] = String(containerPort);
+			logger$9.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
+			continue;
+		}
+		const savedPort = savedState[mapping.envVar];
+		if (savedPort && await isPortAvailable(savedPort)) {
+			ports[mapping.envVar] = savedPort;
+			dockerEnv[mapping.envVar] = String(savedPort);
+			logger$9.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
+			continue;
+		}
+		const resolvedPort = await findAvailablePort(mapping.defaultPort);
+		ports[mapping.envVar] = resolvedPort;
+		dockerEnv[mapping.envVar] = String(resolvedPort);
+		if (resolvedPort !== mapping.defaultPort) logger$9.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
+		else logger$9.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
+	}
+	await savePortState(workspaceRoot, ports);
+	return {
+		dockerEnv,
+		ports,
+		mappings
+	};
+}
+/**
+* Replace a port in a URL string.
+* Handles both `hostname:port` and `localhost:port` patterns.
+* @internal Exported for testing
+*/
+function replacePortInUrl(url, oldPort, newPort) {
+	if (oldPort === newPort) return url;
+	return url.replace(new RegExp(`:${oldPort}(?=/|$)`, "g"), `:${newPort}`);
+}
+/**
+* Rewrite connection URLs and port vars in secrets with resolved ports.
+* Uses the parsed compose mappings to determine which default ports to replace.
+* Pure transform — does not modify secrets on disk.
+* @internal Exported for testing
+*/
+function rewriteUrlsWithPorts(secrets, resolvedPorts) {
+	const { ports, mappings } = resolvedPorts;
+	const result = { ...secrets };
+	const portReplacements = [];
+	for (const mapping of mappings) {
+		const resolved = ports[mapping.envVar];
+		if (resolved !== void 0) portReplacements.push({
+			defaultPort: mapping.defaultPort,
+			resolvedPort: resolved
+		});
+	}
+	for (const [key, value] of Object.entries(result)) {
+		if (!key.endsWith("_PORT")) continue;
+		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
+	}
+	for (const [key, value] of Object.entries(result)) {
+		if (!key.endsWith("_URL") && key !== "DATABASE_URL") continue;
+		let rewritten = value;
+		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
+		result[key] = rewritten;
+	}
+	return result;
+}
 /**
 * Normalize telescope configuration
 * @internal Exported for testing
@@ -1002,8 +1150,11 @@ async function devCommand(options) {
 		rebuildTimeout = setTimeout(async () => {
 			try {
 				logger$9.log("🔄 Rebuilding...");
-				await buildServer(config, buildContext, resolved.providers[0], enableOpenApi, appRoot);
-				if (enableOpenApi) await require_openapi.generateOpenApi(config, { silent: true });
+				await buildServer(config, buildContext, resolved.providers[0], enableOpenApi, appRoot, true);
+				if (enableOpenApi) await require_openapi.generateOpenApi(config, {
+					silent: true,
+					bustCache: true
+				});
 				logger$9.log("✅ Rebuild complete, restarting server...");
 				await devServer.restart();
 			} catch (error) {
@@ -1156,7 +1307,7 @@ async function loadSecretsForApp(secretsRoot, appName) {
 * Start docker-compose services for the workspace.
 * @internal Exported for testing
 */
-async function startWorkspaceServices(workspace) {
+async function startWorkspaceServices(workspace, portEnv) {
 	const services = workspace.services;
 	if (!services.db && !services.cache && !services.mail) return;
 	const servicesToStart = [];
@@ -1173,7 +1324,11 @@ async function startWorkspaceServices(workspace) {
 		}
 		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
 			cwd: workspace.root,
-			stdio: "inherit"
+			stdio: "inherit",
+			env: {
+				...process.env,
+				...portEnv
+			}
 		});
 		logger$9.log("✅ Services started");
 	} catch (error) {
@@ -1221,8 +1376,9 @@ async function workspaceDevCommand(workspace, options) {
 		const copiedCount = clientResults.filter((r) => r.success).length;
 		if (copiedCount > 0) logger$9.log(`\n📦 Copied ${copiedCount} API client(s)`);
 	}
-	await startWorkspaceServices(workspace);
-	const secretsEnv = await loadDevSecrets(workspace);
+	const resolvedPorts = await resolveServicePorts(workspace.root);
+	await startWorkspaceServices(workspace, resolvedPorts.dockerEnv);
+	const secretsEnv = rewriteUrlsWithPorts(await loadDevSecrets(workspace), resolvedPorts);
 	if (Object.keys(secretsEnv).length > 0) logger$9.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
 	const dependencyEnv = generateAllDependencyEnvVars(workspace);
 	if (Object.keys(dependencyEnv).length > 0) {
@@ -1347,16 +1503,16 @@ async function workspaceDevCommand(workspace, options) {
 		});
 	});
 }
-async function buildServer(config, context, provider, enableOpenApi, appRoot = process.cwd()) {
+async function buildServer(config, context, provider, enableOpenApi, appRoot = process.cwd(), bustCache = false) {
 	const endpointGenerator = new require_openapi.EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
 	const cronGenerator = new CronGenerator();
 	const subscriberGenerator = new SubscriberGenerator();
 	const [allEndpoints, allFunctions, allCrons, allSubscribers] = await Promise.all([
-		endpointGenerator.load(config.routes, appRoot),
-		config.functions ? functionGenerator.load(config.functions, appRoot) : [],
-		config.crons ? cronGenerator.load(config.crons, appRoot) : [],
-		config.subscribers ? subscriberGenerator.load(config.subscribers, appRoot) : []
+		endpointGenerator.load(config.routes, appRoot, bustCache),
+		config.functions ? functionGenerator.load(config.functions, appRoot, bustCache) : [],
+		config.crons ? cronGenerator.load(config.crons, appRoot, bustCache) : [],
+		config.subscribers ? subscriberGenerator.load(config.subscribers, appRoot, bustCache) : []
 	]);
 	const outputDir = (0, node_path.join)(appRoot, ".gkm", provider);
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
@@ -1445,10 +1601,10 @@ async function prepareEntryCredentials(options) {
 	let secretsRoot = cwd;
 	let appName;
 	try {
-		const appConfig = await require_config.loadAppConfig(cwd);
-		workspaceAppPort = appConfig.app.port;
-		secretsRoot = appConfig.workspaceRoot;
-		appName = appConfig.appName;
+		const appInfo = await require_config.loadWorkspaceAppInfo(cwd);
+		workspaceAppPort = appInfo.app.port;
+		secretsRoot = appInfo.workspaceRoot;
+		appName = appInfo.appName;
 	} catch (error) {
 		logger$9.log(`⚠️  Could not load workspace config: ${error.message}`);
 		secretsRoot = findSecretsRoot(cwd);
@@ -1746,17 +1902,39 @@ async function execCommand(commandArgs, options = {}) {
 	if (commandArgs.length === 0) throw new Error("No command specified. Usage: gkm exec -- <command>");
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$9.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({ cwd });
+	const { credentials, secretsJsonPath, appName, secretsRoot } = await prepareEntryCredentials({ cwd });
 	if (appName) logger$9.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
 	if (secretCount > 0) logger$9.log(`🔐 Loaded ${secretCount} secret(s)`);
+	const composePath = (0, node_path.join)(secretsRoot, "docker-compose.yml");
+	const mappings = parseComposePortMappings(composePath);
+	if (mappings.length > 0) {
+		const ports = await loadPortState(secretsRoot);
+		if (Object.keys(ports).length > 0) {
+			const rewritten = rewriteUrlsWithPorts(credentials, {
+				dockerEnv: {},
+				ports,
+				mappings
+			});
+			Object.assign(credentials, rewritten);
+			logger$9.log(`🔌 Applied ${Object.keys(ports).length} port mapping(s)`);
+		}
+	}
+	try {
+		const appInfo = await require_config.loadWorkspaceAppInfo(cwd);
+		if (appInfo.appName) {
+			const depEnv = require_workspace.getDependencyEnvVars(appInfo.workspace, appInfo.appName);
+			Object.assign(credentials, depEnv);
+		}
+	} catch {}
 	const preloadDir = (0, node_path.join)(cwd, ".gkm");
 	await (0, node_fs_promises.mkdir)(preloadDir, { recursive: true });
 	const preloadPath = (0, node_path.join)(preloadDir, "credentials-preload.ts");
 	await createCredentialsPreload(preloadPath, secretsJsonPath);
-	const [cmd, ...args] = commandArgs;
+	const [cmd, ...rawArgs] = commandArgs;
 	if (!cmd) throw new Error("No command specified");
-	logger$9.log(`🚀 Running: ${commandArgs.join(" ")}`);
+	const args = rawArgs.map((arg) => arg.replace(/\$PORT\b/g, credentials.PORT ?? "3000"));
+	logger$9.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const existingNodeOptions = process.env.NODE_OPTIONS ?? "";
 	const tsxImport = "--import=tsx";
 	const preloadImport = `--import=${preloadPath}`;
@@ -2637,7 +2815,7 @@ function generateDockerCompose(options) {
 	const { imageName, registry, port, healthCheckPath, services } = options;
 	const serviceMap = normalizeServices(services);
 	const imageRef = registry ? `\${REGISTRY:-${registry}}/` : "";
-	let yaml = `version: '3.8'
+	let yaml$1 = `version: '3.8'
 
 services:
   api:
@@ -2652,30 +2830,30 @@ services:
     environment:
       - NODE_ENV=production
 `;
-	if (serviceMap.has("postgres")) yaml += `      - DATABASE_URL=\${DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/app}
+	if (serviceMap.has("postgres")) yaml$1 += `      - DATABASE_URL=\${DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/app}
 `;
-	if (serviceMap.has("redis")) yaml += `      - REDIS_URL=\${REDIS_URL:-redis://redis:6379}
+	if (serviceMap.has("redis")) yaml$1 += `      - REDIS_URL=\${REDIS_URL:-redis://redis:6379}
 `;
-	if (serviceMap.has("rabbitmq")) yaml += `      - RABBITMQ_URL=\${RABBITMQ_URL:-amqp://rabbitmq:5672}
+	if (serviceMap.has("rabbitmq")) yaml$1 += `      - RABBITMQ_URL=\${RABBITMQ_URL:-amqp://rabbitmq:5672}
 `;
-	yaml += `    healthcheck:
+	yaml$1 += `    healthcheck:
       test: ["CMD", "wget", "-q", "--spider", "http://localhost:${port}${healthCheckPath}"]
       interval: 30s
       timeout: 3s
       retries: 3
 `;
 	if (serviceMap.size > 0) {
-		yaml += `    depends_on:
+		yaml$1 += `    depends_on:
 `;
-		for (const serviceName of serviceMap.keys()) yaml += `      ${serviceName}:
+		for (const serviceName of serviceMap.keys()) yaml$1 += `      ${serviceName}:
         condition: service_healthy
 `;
 	}
-	yaml += `    networks:
+	yaml$1 += `    networks:
       - app-network
 `;
 	const postgresImage = serviceMap.get("postgres");
-	if (postgresImage) yaml += `
+	if (postgresImage) yaml$1 += `
   postgres:
     image: ${postgresImage}
     container_name: postgres
@@ -2695,7 +2873,7 @@ services:
       - app-network
 `;
 	const redisImage = serviceMap.get("redis");
-	if (redisImage) yaml += `
+	if (redisImage) yaml$1 += `
   redis:
     image: ${redisImage}
     container_name: redis
@@ -2711,7 +2889,7 @@ services:
       - app-network
 `;
 	const rabbitmqImage = serviceMap.get("rabbitmq");
-	if (rabbitmqImage) yaml += `
+	if (rabbitmqImage) yaml$1 += `
   rabbitmq:
     image: ${rabbitmqImage}
     container_name: rabbitmq
@@ -2731,21 +2909,21 @@ services:
     networks:
       - app-network
 `;
-	yaml += `
+	yaml$1 += `
 volumes:
 `;
-	if (serviceMap.has("postgres")) yaml += `  postgres_data:
+	if (serviceMap.has("postgres")) yaml$1 += `  postgres_data:
 `;
-	if (serviceMap.has("redis")) yaml += `  redis_data:
+	if (serviceMap.has("redis")) yaml$1 += `  redis_data:
 `;
-	if (serviceMap.has("rabbitmq")) yaml += `  rabbitmq_data:
+	if (serviceMap.has("rabbitmq")) yaml$1 += `  rabbitmq_data:
 `;
-	yaml += `
+	yaml$1 += `
 networks:
   app-network:
     driver: bridge
 `;
-	return yaml;
+	return yaml$1;
 }
 /**
 * Generate a minimal docker-compose.yml for API only
@@ -2794,17 +2972,17 @@ function generateWorkspaceCompose(workspace, options = {}) {
 	const hasMail = services.mail !== void 0 && services.mail !== false;
 	const postgresImage = getInfraServiceImage("postgres", services.db);
 	const redisImage = getInfraServiceImage("redis", services.cache);
-	let yaml = `# Docker Compose for ${workspace.name} workspace
+	let yaml$1 = `# Docker Compose for ${workspace.name} workspace
 # Generated by gkm - do not edit manually
 
 services:
 `;
-	for (const [appName, app] of apps) yaml += generateAppService(appName, app, apps, {
+	for (const [appName, app] of apps) yaml$1 += generateAppService(appName, app, apps, {
 		registry,
 		hasPostgres,
 		hasRedis
 	});
-	if (hasPostgres) yaml += `
+	if (hasPostgres) yaml$1 += `
   postgres:
     image: ${postgresImage}
     container_name: ${workspace.name}-postgres
@@ -2823,7 +3001,7 @@ services:
     networks:
       - workspace-network
 `;
-	if (hasRedis) yaml += `
+	if (hasRedis) yaml$1 += `
   redis:
     image: ${redisImage}
     container_name: ${workspace.name}-redis
@@ -2838,7 +3016,7 @@ services:
     networks:
       - workspace-network
 `;
-	if (hasMail) yaml += `
+	if (hasMail) yaml$1 += `
   mailpit:
     image: axllent/mailpit:latest
     container_name: ${workspace.name}-mailpit
@@ -2849,19 +3027,19 @@ services:
     networks:
       - workspace-network
 `;
-	yaml += `
+	yaml$1 += `
 volumes:
 `;
-	if (hasPostgres) yaml += `  postgres_data:
+	if (hasPostgres) yaml$1 += `  postgres_data:
 `;
-	if (hasRedis) yaml += `  redis_data:
+	if (hasRedis) yaml$1 += `  redis_data:
 `;
-	yaml += `
+	yaml$1 += `
 networks:
   workspace-network:
     driver: bridge
 `;
-	return yaml;
+	return yaml$1;
 }
 /**
 * Get infrastructure service image with version.
@@ -2889,7 +3067,7 @@ function generateAppService(appName, app, allApps, options) {
 	const imageRef = registry ? `\${REGISTRY:-${registry}}/` : "";
 	const healthCheckPath = app.type === "frontend" ? "/" : "/health";
 	const healthCheckCmd = app.type === "frontend" ? `["CMD", "wget", "-q", "--spider", "http://localhost:${app.port}/"]` : `["CMD", "wget", "-q", "--spider", "http://localhost:${app.port}${healthCheckPath}"]`;
-	let yaml = `
+	let yaml$1 = `
   ${appName}:
     build:
       context: .
@@ -2905,16 +3083,16 @@ function generateAppService(appName, app, allApps, options) {
 `;
 	for (const dep of app.dependencies) {
 		const depApp = allApps.find(([name$1]) => name$1 === dep)?.[1];
-		if (depApp) yaml += `      - ${dep.toUpperCase()}_URL=http://${dep}:${depApp.port}
+		if (depApp) yaml$1 += `      - ${dep.toUpperCase()}_URL=http://${dep}:${depApp.port}
 `;
 	}
 	if (app.type === "backend") {
-		if (hasPostgres) yaml += `      - DATABASE_URL=\${DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/app}
+		if (hasPostgres) yaml$1 += `      - DATABASE_URL=\${DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/app}
 `;
-		if (hasRedis) yaml += `      - REDIS_URL=\${REDIS_URL:-redis://redis:6379}
+		if (hasRedis) yaml$1 += `      - REDIS_URL=\${REDIS_URL:-redis://redis:6379}
 `;
 	}
-	yaml += `    healthcheck:
+	yaml$1 += `    healthcheck:
       test: ${healthCheckCmd}
       interval: 30s
       timeout: 3s
@@ -2926,16 +3104,16 @@ function generateAppService(appName, app, allApps, options) {
 		if (hasRedis) dependencies$1.push("redis");
 	}
 	if (dependencies$1.length > 0) {
-		yaml += `    depends_on:
+		yaml$1 += `    depends_on:
 `;
-		for (const dep of dependencies$1) yaml += `      ${dep}:
+		for (const dep of dependencies$1) yaml$1 += `      ${dep}:
         condition: service_healthy
 `;
 	}
-	yaml += `    networks:
+	yaml$1 += `    networks:
       - workspace-network
 `;
-	return yaml;
+	return yaml$1;
 }
 
 //#endregion
@@ -6369,16 +6547,16 @@ const GEEKMIDAS_VERSIONS = {
 	"@geekmidas/cache": "~1.0.0",
 	"@geekmidas/client": "~1.0.0",
 	"@geekmidas/cloud": "~1.0.0",
-	"@geekmidas/constructs": "~1.0.4",
+	"@geekmidas/constructs": "~1.0.5",
 	"@geekmidas/db": "~1.0.0",
 	"@geekmidas/emailkit": "~1.0.0",
-	"@geekmidas/envkit": "~1.0.1",
+	"@geekmidas/envkit": "~1.0.2",
 	"@geekmidas/errors": "~1.0.0",
 	"@geekmidas/events": "~1.0.0",
 	"@geekmidas/logger": "~1.0.0",
 	"@geekmidas/rate-limit": "~1.0.0",
 	"@geekmidas/schema": "~1.0.0",
-	"@geekmidas/services": "~1.0.0",
+	"@geekmidas/services": "~1.0.1",
 	"@geekmidas/storage": "~1.0.0",
 	"@geekmidas/studio": "~1.0.0",
 	"@geekmidas/telescope": "~1.0.0",
@@ -6431,6 +6609,7 @@ function generateAuthAppFiles(options) {
 		extends: "../../tsconfig.json",
 		compilerOptions: {
 			noEmit: true,
+			allowImportingTsExtensions: true,
 			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
@@ -6461,8 +6640,8 @@ export const logger = createLogger();
 	const authTs = `import { betterAuth } from 'better-auth';
 import { magicLink } from 'better-auth/plugins';
 import pg from 'pg';
-import { envParser } from './config/env.js';
-import { logger } from './config/logger.js';
+import { envParser } from './config/env.ts';
+import { logger } from './config/logger.ts';
 
 // Parse auth-specific config (no defaults - values from secrets)
 const authConfig = envParser
@@ -6505,9 +6684,9 @@ export type Auth = typeof auth;
 	const indexTs = `import { Hono } from 'hono';
 import { cors } from 'hono/cors';
 import { serve } from '@hono/node-server';
-import { auth } from './auth.js';
-import { envParser } from './config/env.js';
-import { logger } from './config/logger.js';
+import { auth } from './auth.ts';
+import { envParser } from './config/env.ts';
+import { logger } from './config/logger.ts';
 
 // Parse server config (no defaults - values from secrets)
 const serverConfig = envParser
@@ -6593,6 +6772,20 @@ dist/
 //#endregion
 //#region src/init/generators/config.ts
 /**
+* Vitest config content with globalSetup for database-enabled apps
+*/
+const vitestConfigContent = `import { defineConfig } from 'vitest/config';
+import tsconfigPaths from 'vite-tsconfig-paths';
+
+export default defineConfig({
+  plugins: [tsconfigPaths()],
+  test: {
+    environment: 'node',
+    globalSetup: './test/globalSetup.ts',
+  },
+});
+`;
+/**
 * Generate configuration files (gkm.config.ts, tsconfig.json, biome.json, turbo.json)
 */
 function generateConfigFiles(options, template) {
@@ -6644,6 +6837,7 @@ export default defineConfig({
 		extends: "../../tsconfig.json",
 		compilerOptions: {
 			noEmit: true,
+			allowImportingTsExtensions: true,
 			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
@@ -6663,21 +6857,26 @@ export default defineConfig({
 			skipLibCheck: true,
 			forceConsistentCasingInFileNames: true,
 			resolveJsonModule: true,
-			declaration: true,
-			declarationMap: true,
-			outDir: "./dist",
-			rootDir: "./src"
+			noEmit: true,
+			allowImportingTsExtensions: true
 		},
 		include: ["src/**/*.ts"],
 		exclude: ["node_modules", "dist"]
 	};
-	if (options.monorepo) return [{
-		path: "gkm.config.ts",
-		content: gkmConfig
-	}, {
-		path: "tsconfig.json",
-		content: `${JSON.stringify(tsConfig, null, 2)}\n`
-	}];
+	if (options.monorepo) {
+		const files$1 = [{
+			path: "gkm.config.ts",
+			content: gkmConfig
+		}, {
+			path: "tsconfig.json",
+			content: `${JSON.stringify(tsConfig, null, 2)}\n`
+		}];
+		if (options.database) files$1.push({
+			path: "vitest.config.ts",
+			content: vitestConfigContent
+		});
+		return files$1;
+	}
 	const biomeConfig = {
 		$schema: "https://biomejs.dev/schemas/2.3.0/schema.json",
 		vcs: {
@@ -6743,7 +6942,7 @@ export default defineConfig({
 			fmt: { outputs: [] }
 		}
 	};
-	return [
+	const files = [
 		{
 			path: "gkm.config.ts",
 			content: gkmConfig
@@ -6761,12 +6960,18 @@ export default defineConfig({
 			content: `${JSON.stringify(turboConfig, null, 2)}\n`
 		}
 	];
+	if (options.database) files.push({
+		path: "vitest.config.ts",
+		content: vitestConfigContent
+	});
+	return files;
 }
 function generateSingleAppConfigFiles(options, _template, _helpers) {
 	const tsConfig = {
 		extends: "../../tsconfig.json",
 		compilerOptions: {
 			noEmit: true,
+			allowImportingTsExtensions: true,
 			baseUrl: ".",
 			paths: {
 				"~/*": ["./src/*"],
@@ -6776,10 +6981,15 @@ function generateSingleAppConfigFiles(options, _template, _helpers) {
 		include: ["src/**/*.ts"],
 		exclude: ["node_modules", "dist"]
 	};
-	return [{
+	const files = [{
 		path: "tsconfig.json",
 		content: `${JSON.stringify(tsConfig, null, 2)}\n`
 	}];
+	if (options.database) files.push({
+		path: "vitest.config.ts",
+		content: vitestConfigContent
+	});
+	return files;
 }
 
 //#endregion
@@ -6810,7 +7020,7 @@ function generateDockerFiles(options, template, dbApps) {
       POSTGRES_PASSWORD: postgres
       POSTGRES_DB: ${options.name.replace(/-/g, "_")}_dev
     ports:
-      - '5432:5432'
+      - '\${POSTGRES_HOST_PORT:-5432}:5432'
     volumes:
       - postgres_data:/var/lib/postgresql/data${initVolume}
     healthcheck:
@@ -6836,7 +7046,7 @@ function generateDockerFiles(options, template, dbApps) {
     container_name: ${options.name}-redis
     restart: unless-stopped
     ports:
-      - '6379:6379'
+      - '\${REDIS_HOST_PORT:-6379}:6379'
     volumes:
       - redis_data:/data
     healthcheck:
@@ -6850,7 +7060,7 @@ function generateDockerFiles(options, template, dbApps) {
     container_name: ${options.name}-serverless-redis
     restart: unless-stopped
     ports:
-      - '8079:80'
+      - '\${SRH_HOST_PORT:-8079}:80'
     environment:
       SRH_MODE: env
       SRH_TOKEN: local_dev_token
@@ -6865,7 +7075,7 @@ function generateDockerFiles(options, template, dbApps) {
     container_name: ${options.name}-redis
     restart: unless-stopped
     ports:
-      - '6379:6379'
+      - '\${REDIS_HOST_PORT:-6379}:6379'
     volumes:
       - redis_data:/data
     healthcheck:
@@ -6881,8 +7091,8 @@ function generateDockerFiles(options, template, dbApps) {
     container_name: ${options.name}-rabbitmq
     restart: unless-stopped
     ports:
-      - '5672:5672'
-      - '15672:15672'
+      - '\${RABBITMQ_HOST_PORT:-5672}:5672'
+      - '\${RABBITMQ_MGMT_HOST_PORT:-15672}:15672'
     environment:
       RABBITMQ_DEFAULT_USER: guest
       RABBITMQ_DEFAULT_PASS: guest
@@ -6900,8 +7110,8 @@ function generateDockerFiles(options, template, dbApps) {
     container_name: ${options.name}-mailpit
     restart: unless-stopped
     ports:
-      - '1025:1025'
-      - '8025:8025'
+      - '\${MAILPIT_SMTP_HOST_PORT:-1025}:1025'
+      - '\${MAILPIT_UI_HOST_PORT:-8025}:8025'
     environment:
       MP_SMTP_AUTH_ACCEPT_ANY: 1
       MP_SMTP_AUTH_ALLOW_INSECURE: 1`);
@@ -7055,10 +7265,8 @@ function generateModelsPackage(options) {
 	const tsConfig = {
 		extends: "../../tsconfig.json",
 		compilerOptions: {
-			declaration: true,
-			declarationMap: true,
-			outDir: "./dist",
-			rootDir: "./src"
+			noEmit: true,
+			allowImportingTsExtensions: true
 		},
 		include: ["src/**/*.ts"],
 		exclude: ["node_modules", "dist"]
@@ -7104,7 +7312,7 @@ export type Timestamps = z.infer<typeof TimestampsSchema>;
 export type Pagination = z.infer<typeof PaginationSchema>;
 `;
 	const userTs = `import { z } from 'zod';
-import { IdSchema, TimestampsSchema } from './common.js';
+import { IdSchema, TimestampsSchema } from './common.ts';
 
 // ============================================
 // User Schemas
@@ -7595,7 +7803,7 @@ export const config = envParser
 			{
 				path: getRoutePath("health.ts"),
 				content: monorepo ? `import { z } from 'zod';
-import { publicRouter } from '~/router';
+import { publicRouter } from '~/router.ts';
 
 export const healthEndpoint = publicRouter
   .get('/health')
@@ -7738,8 +7946,8 @@ export const authService = {
 				path: "src/router.ts",
 				content: `import { e } from '@geekmidas/constructs/endpoints';
 import { UnauthorizedError } from '@geekmidas/errors';
-import { authService, type Session } from './services/auth.js';
-import { logger } from './config/logger.js';
+import { authService, type Session } from './services/auth.ts';
+import { logger } from './config/logger.ts';
 
 // Public router - no auth required
 export const publicRouter = e.logger(logger);
@@ -7763,7 +7971,7 @@ export const sessionRouter = r.session<Session>(async ({ services, header }) =>
 			files.push({
 				path: getRoutePath("profile.ts"),
 				content: `import { z } from 'zod';
-import { sessionRouter } from '~/router';
+import { sessionRouter } from '~/router.ts';
 
 export const profileEndpoint = sessionRouter
   .get('/profile')
@@ -7832,8 +8040,8 @@ export const telescope = new Telescope({
 			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
 import { Kysely, PostgresDialect } from 'kysely';
 import pg from 'pg';
-import type { Database } from '../services/database.js';
-import { envParser } from './env.js';
+import type { Database } from '~/services/database.ts';
+import { envParser } from '~/config/env.ts';
 
 // Parse database config for Studio
 const studioConfig = envParser
@@ -8006,8 +8214,8 @@ export const telescope = new Telescope({
 			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
 import { Kysely, PostgresDialect } from 'kysely';
 import pg from 'pg';
-import type { Database } from '../services/database.js';
-import { envParser } from './env.js';
+import type { Database } from '~/services/database.ts';
+import { envParser } from '~/config/env.ts';
 
 // Parse database config for Studio
 const studioConfig = envParser
@@ -8263,7 +8471,7 @@ export type AppEvents =
 				path: "src/events/publisher.ts",
 				content: `import type { Service, ServiceRegisterOptions } from '@geekmidas/services';
 import { Publisher, type EventPublisher } from '@geekmidas/events';
-import type { AppEvents } from './types.js';
+import type { AppEvents } from './types.ts';
 
 export const eventsPublisherService = {
   serviceName: 'events' as const,
@@ -8290,7 +8498,7 @@ export const eventsPublisherService = {
 			{
 				path: "src/subscribers/user-events.ts",
 				content: `import { s } from '@geekmidas/constructs/subscribers';
-import { eventsPublisherService } from '../events/publisher.js';
+import { eventsPublisherService } from '~/events/publisher.ts';
 
 export const userEventsSubscriber = s
   .publisher(eventsPublisherService)
@@ -8492,6 +8700,9 @@ function generatePackageJson(options, template) {
 		dependencies$1.kysely = "~0.28.2";
 		dependencies$1.pg = "~8.16.0";
 		devDependencies$1["@types/pg"] = "~8.15.0";
+		devDependencies$1["@geekmidas/testkit"] = GEEKMIDAS_VERSIONS["@geekmidas/testkit"];
+		devDependencies$1["@faker-js/faker"] = "~9.8.0";
+		devDependencies$1["vite-tsconfig-paths"] = "~5.1.0";
 	}
 	if (monorepo) {
 		delete devDependencies$1["@biomejs/biome"];
@@ -8538,6 +8749,118 @@ function generateSourceFiles(options, template) {
 	return template.files(options);
 }
 
+//#endregion
+//#region src/init/generators/test.ts
+/**
+* Generate test infrastructure files when database is enabled.
+* Includes transaction-isolated test config, global setup with migrations,
+* factory system with builders/seeds, and an example spec.
+*/
+function generateTestFiles(options, _template) {
+	if (!options.database) return [];
+	return [
+		{
+			path: "test/config.ts",
+			content: `import { it as itVitest } from 'vitest';
+import { Kysely, PostgresDialect } from 'kysely';
+import pg from 'pg';
+import { wrapVitestKyselyTransaction } from '@geekmidas/testkit/kysely';
+import type { Database } from '~/services/database.ts';
+
+const connection = new Kysely<Database>({
+  dialect: new PostgresDialect({
+    pool: new pg.Pool({ connectionString: process.env.DATABASE_URL }),
+  }),
+});
+
+export const it = wrapVitestKyselyTransaction<Database>(itVitest, {
+  connection,
+});
+`
+		},
+		{
+			path: "test/globalSetup.ts",
+			content: `import { Kysely, PostgresDialect } from 'kysely';
+import pg from 'pg';
+import { PostgresKyselyMigrator } from '@geekmidas/testkit/kysely';
+import type { Database } from '~/services/database.ts';
+
+export async function setup() {
+  const testUrl = process.env.DATABASE_URL;
+  if (!testUrl) throw new Error('DATABASE_URL is required for tests');
+
+  // Run migrations on the test database
+  // (gkm test already rewrites DATABASE_URL to point to the _test database)
+  const db = new Kysely<Database>({
+    dialect: new PostgresDialect({
+      pool: new pg.Pool({ connectionString: testUrl }),
+    }),
+  });
+
+  const migrator = new PostgresKyselyMigrator({
+    db,
+    migrationsPath: './src/migrations',
+  });
+
+  await migrator.migrateToLatest();
+  await db.destroy();
+}
+`
+		},
+		{
+			path: "test/factory/index.ts",
+			content: `import type { Kysely } from 'kysely';
+import { KyselyFactory } from '@geekmidas/testkit/kysely';
+import type { Database } from '~/services/database.ts';
+import { usersBuilder } from './users.ts';
+
+const builders = { users: usersBuilder };
+const seeds = {};
+
+export function createFactory(db: Kysely<Database>) {
+  return new KyselyFactory<Database, typeof builders, typeof seeds>(
+    builders,
+    seeds,
+    db,
+  );
+}
+
+export type Factory = ReturnType<typeof createFactory>;
+`
+		},
+		{
+			path: "test/factory/users.ts",
+			content: `import { KyselyFactory } from '@geekmidas/testkit/kysely';
+import type { Database } from '~/services/database.ts';
+
+export const usersBuilder = KyselyFactory.createBuilder<Database, 'users'>(
+  'users',
+  ({ faker }) => ({
+    id: faker.string.uuid(),
+    name: faker.person.fullName(),
+    email: faker.internet.email(),
+    created_at: new Date(),
+  }),
+);
+`
+		},
+		{
+			path: "test/example.spec.ts",
+			content: `import { describe, expect } from 'vitest';
+import { it } from './config.ts';
+
+describe('example', () => {
+  it('should have a working test setup', async ({ db }) => {
+    // db is a transaction-wrapped Kysely instance
+    // All changes are automatically rolled back after the test
+    expect(db).toBeDefined();
+  });
+});
+`
+		}
+	];
+}
+
 //#endregion
 //#region src/init/generators/ui.ts
 /**
@@ -8607,6 +8930,7 @@ function generateUiPackageFiles(options) {
 				"DOM.Iterable"
 			],
 			noEmit: true,
+			allowImportingTsExtensions: true,
 			baseUrl: ".",
 			paths: { "~/*": ["./src/*"] }
 		},
@@ -9780,8 +10104,8 @@ export const Alert: Story = {
   ),
 };
 `;
-	const componentsUiIndex = `export { Button, type ButtonProps, buttonVariants } from './button';
-export { Input } from './input';
+	const componentsUiIndex = `export { Button, type ButtonProps, buttonVariants } from './button.tsx';
+export { Input } from './input.tsx';
 export {
   Card,
   CardHeader,
@@ -9789,17 +10113,17 @@ export {
   CardTitle,
   CardDescription,
   CardContent,
-} from './card';
-export { Label } from './label';
-export { Badge, type BadgeProps, badgeVariants } from './badge';
-export { Separator } from './separator';
-export { Tabs, TabsList, TabsTrigger, TabsContent } from './tabs';
+} from './card.tsx';
+export { Label } from './label.tsx';
+export { Badge, type BadgeProps, badgeVariants } from './badge.tsx';
+export { Separator } from './separator.tsx';
+export { Tabs, TabsList, TabsTrigger, TabsContent } from './tabs.tsx';
 export {
   Tooltip,
   TooltipTrigger,
   TooltipContent,
   TooltipProvider,
-} from './tooltip';
+} from './tooltip.tsx';
 export {
   Dialog,
   DialogPortal,
@@ -9811,20 +10135,20 @@ export {
   DialogFooter,
   DialogTitle,
   DialogDescription,
-} from './dialog';
+} from './dialog.tsx';
 `;
 	const buttonIndexTsx = buttonTsx;
 	const inputIndexTsx = inputTsx;
 	const cardIndexTsx = cardTsx;
-	const componentsIndex = `export * from './ui';
+	const componentsIndex = `export * from './ui/index.ts';
 `;
 	const indexTs = `// @${options.name}/ui - Shared UI component library
 
 // shadcn/ui components
-export * from './components';
+export * from './components/index.ts';
 
 // Utilities
-export { cn } from './lib/utils';
+export { cn } from './lib/utils.ts';
 `;
 	const gitignore = `node_modules/
 dist/
@@ -9967,7 +10291,7 @@ function generateWebAppFiles(options) {
 		private: true,
 		type: "module",
 		scripts: {
-			dev: "gkm exec -- next dev --turbopack",
+			dev: "gkm exec -- next dev --turbopack -p $PORT",
 			build: "gkm exec -- next build",
 			start: "next start",
 			typecheck: "tsc --noEmit"
@@ -10022,6 +10346,7 @@ export default nextConfig;
 			skipLibCheck: true,
 			strict: true,
 			noEmit: true,
+			allowImportingTsExtensions: true,
 			esModuleInterop: true,
 			module: "ESNext",
 			moduleResolution: "bundler",
@@ -10103,7 +10428,7 @@ export const serverConfig = envParser
 `;
 	const authClientTs = `import { createAuthClient } from 'better-auth/react';
 import { magicLinkClient } from 'better-auth/client/plugins';
-import { clientConfig } from '~/config/client';
+import { clientConfig } from '~/config/client.ts';
 
 export const authClient = createAuthClient({
   baseURL: clientConfig.authUrl,
@@ -10115,7 +10440,7 @@ export const { signIn, signUp, signOut, useSession, magicLink } = authClient;
 	const providersTsx = `'use client';
 
 import { QueryClientProvider } from '@tanstack/react-query';
-import { getQueryClient } from '~/lib/query-client';
+import { getQueryClient } from '~/lib/query-client.ts';
 
 export function Providers({ children }: { children: React.ReactNode }) {
   const queryClient = getQueryClient();
@@ -10125,9 +10450,9 @@ export function Providers({ children }: { children: React.ReactNode }) {
   );
 }
 `;
-	const apiIndexTs = `import { createApi } from './openapi';
-import { getQueryClient } from '~/lib/query-client';
-import { clientConfig } from '~/config/client';
+	const apiIndexTs = `import { createApi } from './api.ts';
+import { getQueryClient } from '~/lib/query-client.ts';
+import { clientConfig } from '~/config/client.ts';
 
 export const api = createApi({
   baseURL: clientConfig.apiUrl,
@@ -10137,7 +10462,7 @@ export const api = createApi({
 	const globalsCss = `@import '${uiPackage}/styles';
 `;
 	const layoutTsx = `import type { Metadata } from 'next';
-import { Providers } from './providers';
+import { Providers } from './providers.tsx';
 import './globals.css';
 
 export const metadata: Metadata = {
@@ -10159,7 +10484,7 @@ export default function RootLayout({
   );
 }
 `;
-	const pageTsx = `import { api } from '~/api';
+	const pageTsx = `import { api } from '~/api/index.ts';
 import { Button, Card, CardContent, CardDescription, CardHeader, CardTitle } from '${uiPackage}/components';
 
 export default async function Home() {
@@ -10502,6 +10827,7 @@ async function initCommand(projectName, options = {}) {
 		...generateConfigFiles(templateOptions, baseTemplate),
 		...generateEnvFiles(templateOptions, baseTemplate),
 		...generateSourceFiles(templateOptions, baseTemplate),
+		...generateTestFiles(templateOptions, baseTemplate),
 		...isMonorepo$1 ? [] : generateDockerFiles(templateOptions, baseTemplate, dbApps)
 	] : [];
 	const dockerFiles = isMonorepo$1 && baseTemplate ? generateDockerFiles(templateOptions, baseTemplate, dbApps) : [];
@@ -10845,23 +11171,61 @@ function maskUrl(url) {
 //#endregion
 //#region src/test/index.ts
 /**
-* Run tests with secrets loaded from the specified stage.
-* Secrets are decrypted and injected into the environment.
+* Run tests with secrets, dependency URLs, and .env files loaded.
+* Environment variables are sniffed to inject only what the app needs.
 */
 async function testCommand(options = {}) {
 	const stage = options.stage ?? "development";
-	console.log(`\n🧪 Running tests with ${stage} secrets...\n`);
-	let envVars = {};
+	const cwd = process.cwd();
+	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
+	const defaultEnv = loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	let secretsEnv = {};
 	try {
 		const secrets = await require_storage.readStageSecrets(stage);
 		if (secrets) {
-			envVars = require_storage.toEmbeddableSecrets(secrets);
-			console.log(`  Loaded ${Object.keys(envVars).length} secrets from ${stage}\n`);
-		} else console.log(`  No secrets found for ${stage}, running without secrets\n`);
+			secretsEnv = require_storage.toEmbeddableSecrets(secrets);
+			console.log(`  🔐 Loaded ${Object.keys(secretsEnv).length} secrets from ${stage}`);
+		} else console.log(`  No secrets found for ${stage}`);
 	} catch (error) {
-		if (error instanceof Error && error.message.includes("key not found")) console.log(`  Decryption key not found for ${stage}, running without secrets\n`);
+		if (error instanceof Error && error.message.includes("key not found")) console.log(`  Decryption key not found for ${stage}`);
 		else throw error;
 	}
+	const composePath = (0, node_path.join)(cwd, "docker-compose.yml");
+	const mappings = parseComposePortMappings(composePath);
+	if (mappings.length > 0) {
+		const ports = await loadPortState(cwd);
+		if (Object.keys(ports).length > 0) {
+			secretsEnv = rewriteUrlsWithPorts(secretsEnv, {
+				dockerEnv: {},
+				ports,
+				mappings
+			});
+			console.log(`  🔌 Applied ${Object.keys(ports).length} port mapping(s)`);
+		}
+	}
+	secretsEnv = rewriteDatabaseUrlForTests(secretsEnv);
+	await ensureTestDatabase(secretsEnv);
+	let dependencyEnv = {};
+	try {
+		const appInfo = await require_config.loadWorkspaceAppInfo(cwd);
+		dependencyEnv = require_workspace.getDependencyEnvVars(appInfo.workspace, appInfo.appName);
+		if (Object.keys(dependencyEnv).length > 0) console.log(`  🔗 Loaded ${Object.keys(dependencyEnv).length} dependency URL(s)`);
+		const sniffed = await sniffAppEnvironment(appInfo.app, appInfo.appName, appInfo.workspaceRoot, { logWarnings: false });
+		if (sniffed.requiredEnvVars.length > 0) {
+			const needed = new Set(sniffed.requiredEnvVars);
+			const allEnv = {
+				...secretsEnv,
+				...dependencyEnv
+			};
+			const filteredEnv = {};
+			for (const [key, value] of Object.entries(allEnv)) if (needed.has(key)) filteredEnv[key] = value;
+			secretsEnv = {};
+			dependencyEnv = filteredEnv;
+			console.log(`  🔍 Sniffed ${sniffed.requiredEnvVars.length} required env var(s)`);
+		}
+	} catch {}
+	console.log("");
 	const args = [];
 	if (options.run) args.push("run");
 	else if (options.watch) args.push("--watch");
@@ -10869,11 +11233,12 @@ async function testCommand(options = {}) {
 	if (options.ui) args.push("--ui");
 	if (options.pattern) args.push(options.pattern);
 	const vitestProcess = (0, node_child_process.spawn)("npx", ["vitest", ...args], {
-		cwd: process.cwd(),
+		cwd,
 		stdio: "inherit",
 		env: {
 			...process.env,
-			...envVars,
+			...secretsEnv,
+			...dependencyEnv,
 			NODE_ENV: "test"
 		}
 	});
@@ -10887,6 +11252,57 @@ async function testCommand(options = {}) {
 		});
 	});
 }
+const TEST_DB_SUFFIX = "_test";
+/**
+* Rewrite DATABASE_URL to point to a separate test database.
+* Appends `_test` to the database name (e.g., `app` -> `app_test`).
+* @internal Exported for testing
+*/
+function rewriteDatabaseUrlForTests(env) {
+	const result = { ...env };
+	for (const key of Object.keys(result)) {
+		if (!key.includes("DATABASE_URL")) continue;
+		const value = result[key];
+		try {
+			const url = new URL(value);
+			const dbName = url.pathname.slice(1);
+			if (dbName && !dbName.endsWith(TEST_DB_SUFFIX)) {
+				url.pathname = `/${dbName}${TEST_DB_SUFFIX}`;
+				result[key] = url.toString();
+				console.log(`  🧪 ${key}: using test database "${dbName}${TEST_DB_SUFFIX}"`);
+			}
+		} catch {}
+	}
+	return result;
+}
+/**
+* Ensure the test database exists by connecting to the default database
+* and running CREATE DATABASE IF NOT EXISTS.
+* @internal Exported for testing
+*/
+async function ensureTestDatabase(env) {
+	const databaseUrl = env.DATABASE_URL;
+	if (!databaseUrl) return;
+	try {
+		const url = new URL(databaseUrl);
+		const testDbName = url.pathname.slice(1);
+		if (!testDbName) return;
+		url.pathname = "/postgres";
+		const { default: pg$1 } = await import("pg");
+		const client = new pg$1.Client({ connectionString: url.toString() });
+		await client.connect();
+		try {
+			await client.query(`CREATE DATABASE "${testDbName}"`);
+			console.log(`  📦 Created test database "${testDbName}"`);
+		} catch (err) {
+			if (err.code !== "42P04") throw err;
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		console.log(`  ⚠️  Could not ensure test database: ${err.message}`);
+	}
+}
 
 //#endregion
 //#region src/index.ts